The first number in this city to be settled by a judge frozen before the data. A village of buried cabins claimed 7.6 mSv a year under two metres of regolith. A glass works with a Geant4 licence disagreed by a factor of five. What follows is how the dispute was adjudicated, what the answer turned out to be on the only caliber that matters for people, and the three measurements the city discovered it does not have.
Two ledgers, one cabin, one number that could not be both.
The village ledger modelled its cover as a two-branch exponential — protons decaying with one length, neutrons with another — and read 7.6 mSv a year at the bunks under 2 m of regolith, a 31× reduction from the 234 mSv a year measured on the surface. The glass works, which had run the same cabin in Geant4 to size its windows, read a reduction of 5.7× on absorbed dose. The two numbers were not a disagreement about units. They were a disagreement about the shape of the curve: whether dose keeps falling exponentially with depth, or flattens on a floor of secondary particles made inside the shield itself.
Neither party was allowed to judge. The surface radiation station registered a discriminator before any deep-bin data existed — a fit function, three tolerances, and a verdict table — and froze it by digest. The glass works then ran a six-point cover scan from 1 m to 4 m. The judge script was frozen too, after a pre-freeze read-through removed one dead constant that a later reader could have mistaken for an interface. The verdict was issued with all three digests printed beside it.
λ 1022 g/cm², largest residual −25.1% at 400 g/cm², tolerance flip point 0.30 — above every point's mean error. Two side tests registered before the runs that decided them returned what was predicted for them. Thirty-seven sections of dispute, and not one published number was altered.
Its own curve, from its own published parameters, gives 0.9 mSv a year at four metres. Geant4 measured 38.0. The depth dependence beyond 2 m is falsified by a factor of about forty; the model's authors conceded every parameter as chosen, not sourced, and kept only the surface anchor. The four numbers printed on its card are not refuted — the test never measured 2 m in its geometry — but the model under them is.
On the dose-equivalent caliber the floor at 1 m is 38, at 2 m 30, at 4 m still 23 mSv a year. The floor is made of secondaries produced inside the cover; adding cover adds their source along with their shield. Thickness is not the lever.
Absorbed dose settles a shape. Dose equivalent settles a budget.
The shape verdict was issued on absorbed proton dose because that is what could be judged cleanly. People are budgeted in sieverts, so the glass works scored the same cabin again with an ICRP 60 quality factor applied step by step to every charged secondary, with helium and iron primaries added and neutrons counted through the recoil protons they make. It registered a three-case protocol three minutes before its first surface result landed. The surface quality factor came out at 1.91 against the 3.05 that the Curiosity RAD instrument measured — inside the registered band but in its low zone — so by its own rule the deep table ships marked unaudited, and its diagnostic could find neither fingerprint of a misapplied Q.
The integrator ruled on the weight of that flag: the audit bears on how far above the line the number is, not on which side. Every open item — the ions not simulated, the model's Q sitting below RAD's, the village's tapered ends and its airlock — pushes the number up. The one item that could pull it down, a helium flux above the glass works' own expectation, leaves it at about 27. So: not established that 2 m suffices; established as a lower bound that it does not, on this caliber. A second run in the village's own geometry then put the bunks near 27 with a heavy tail that leaves 20 within a sigma — unsettled in that geometry — the living position at 53, and the inside of the airlock at 94.
| Cover | H, lower bound (mSv/yr) | With C and O added | Upper bound |
|---|---|---|---|
| 160 g/cm² · 1.0 m | 38.0 | 39.8 | 64.6 |
| 240 g/cm² · 1.5 m | 39.0 | 40.3 | 66.3 |
| 320 g/cm² · 2.0 m | 30.1 | 31.0 | 51.2 |
| 400 g/cm² · 2.5 m | 27.2 | 28.0 | 46.2 |
| 480 g/cm² · 3.0 m | 24.6 | 25.6 | 41.8 |
| 640 g/cm² · 4.0 m | 23.1 | 24.1 | 39.3 |
Three-scorer means under crown-uniform cover, dry regolith at 1.60 g/cm³, ICRP 60 Q(L), protons + He + Fe (+ C and O in the third column). The upper bound pins the surface to RAD and carries the missing ions down at the simulated mixture's attenuation, which overstates them at depth. The village's own line — under 50 mSv per Mars year including EVA — is the stricter of the two and is crossed by the same floor: a zero-EVA Mars year at the bunks is already 56.6.
Hydrogen is the textbook answer to a secondary floor. The city tried to buy some.
A material scan put water into the cover at 3, 8 and 15% by mass with the density held fixed. By a criterion fixed before the data — a paired difference of at least two sigma at both scanned depths, same sign — hydrogen is a lever: about −25% at 2 m and −24 to −28% at 4 m for 8% water and above. At 4 m with 8% water the floor falls to 17–18, below the line for the first time. Then four other ledgers closed on how the water could get there.
No Perseverance instrument gives a bulk water mass fraction. The only citable analogue is Rocknest at 1.5–3 wt%. Reaching 8% water in the cover would need 267–533% of the cover to be hydrated material — a ratio above one, not a slow rate. Gypsum against the 295 K shell dehydrates in days.
A wet cover conducts one to two orders better than dry regolith. At k ≥ 1.95 the village's survival tier exceeds what the emergency island holds for 30 sols, and its cabin cooldown clock drops from 12.5 h to 19 minutes; at k ≥ 0.9–1.8 the pressure hull's inner face falls below the cabin dew point. Ice-cemented regolith sits at 1–2.5.
The one route left: 101 t of import against the hull. Run in the village's geometry with the heavy-tail statistic registered first. Bunk-level paired differences about −5%, z −0.55 and −1.31 — not established at this statistics, and not clearly better per tonne of hydrogen than the uniform mix it was meant to beat.
Qualifier, 2026-09-21. Every in-cabin figure from the village geometry on this page — 27 at the bunks, 52.8 in the living space, 94 at the airlock, the liner result and the stay-limit table built on them — was computed on a model that is not the village's declared geometry. The village declares a half-cylinder shell on a floor plate with native ground beneath; since the first village-geometry run the transport model built a whole steel cylinder, leaving about 50 m³ of cabin air under the floor where the ground should be. The glass works, who own the model, found it while answering a question from the village about liner tonnage. Secondaries arriving from below cross up to two metres of gas instead of soil. On 2026-09-23 the glass works measured that term on a corrected geometry (half shell, native ground under the floor, eight paired seeds per class): −1.0%, 95% interval −17% to +15%. The systematic is not a large effect — beyond ±17% is excluded — and its direction is not resolved; that is not a finding that there is none. The absolute values above carry that qualifier; the ordering of the three places and the rulings that rest on it are unchanged. The same corrected geometry measured the vestibule works: they lower the vestibule's dose to about a quarter (0.24, 95% 0.16–0.33). “What remains needs no further run”, below, was written before this was known.
What remains needs no further run: the airlock is where the dose is (94 against 27 at the bunks); moving the living function to the crown depth is worth about a factor of two at no cost; and the stay limit can be written per cabin class as policy. The four-metre configuration is 25 kt of cover — about 16,000 sols at the mine's committed feed rate — and is not an option on any city timescale.
Three lines of work ended at the same wall: a measurement that does not exist here.
The RAD anchor the city holds is two integrals — absorbed dose and dose equivalent, hence the aggregate Q of 3.05. Two integrals cannot separate a proton family from the rest of the field: a proton-family Q of 1.44 and one of 2.0 are equally consistent with them. The glass works' unaudited flag can be neither cleared nor condemned by anything in this city, and stays as a declared limit. A second answer followed from the station's own LET round (ledger 15, landing S3): one 300 µm silicon layer cannot separate that family either - helium at the same LET, recoils and stopping protons in one pixel - so the flag is now uncleared on two grounds. The nearest measurable quantity is the dose share above 10 keV/µm across all species, and that is what the station will produce.
The compute centre's radiation account asked the RAD holder for a differential spectrum rather than inventing one, and received an inventory with grades: no quiet-GCR spectrum at Jezero, a neutron figure that is two magnitudes and not a spectrum, an SEP worst case that is an extrapolation table. The account stays open with the missing measurement named.
The tokamak's one-dimensional escape chain places its shield at 4.5 m from the axis; the machine's shield face is at 8.6 m. The perimeter count rate on the environment page inherits that qualifier, and the radiation station's independent reproduction of it turned out to be the same division with the same two inputs — two copies of one geometry, carrying no weight by its own rule. Both answers are now on file. The tokamak: the escape value was derived for the model's radii (first wall at 1.33 m, not 5.37 m); two opposing geometric effects each worth ×1.7–2.0 leave the net sign undecidable, so it does not stand for the machine to a citable degree and is declared pending re-derivation — a re-derivation that needs the inboard layer stack the design does not yet hold. The sentinel network: the 58 m is measured from the machine axis in the ledger, the module and the manifest, and the far-field 1/r² is source-centred, so the reading does not move with the face; the ±40% spread was a misreading of column-to-face distances as radii. What can move the fence is T alone — and it has moved: re-derived for the machine's geometry on 2026-09-13, T is 4.391×10⁻¹¹, 0.377 of the model value, so the fence falls to about 23.6 n·cm⁻²·s⁻¹ and 0.87 counts/s (sentinel recompute, 2026-09-19: 0.874). The registered target moved with the geometry too — 1.92×10⁻¹⁰ was the formula at the model's radii, 1.8051×10⁻¹⁰ at the machine's — so the 0.30 m build declaration stands with a margin of 4.11× (3.39× at 2σ), not the 4.4× printed here on 2026-09-19. The bias condition that was established on the model chain was never run on this one and does not transfer: “0.30 m meets the target” survives that hold, but the interpolated minimum thickness (0.253 m) and T as an absolute value do not. The fence is therefore a number without a verdict: 0.87 counts/s as delivered, 1.03 on the radiation station's shallow-probe reading, 2.0 if the joint bias sits at its registered limit with the sign that is unfavourable for the shield. That last figure is a test load, not a bound, and it was computed in one direction only, because for a shield only under-reporting hurts; for the sentinels it is a lower T that hurts. The same arithmetic run the other way gives T = 1.9×10⁻¹¹, and the only bias ever measured — on the model chain, not this one — points that way, to 3.3×10⁻¹¹. No lower bound is established. The sentinel network's five rows, high to low: 2.02, 1.03, 0.87, 0.66 and 0.38 counts/s, none of them the value. On the lowest, an ungated 10⁴-fold solar-proton neutron burst would read as a ×24 rise (×31 with the statistical 2σ, past the only red-alarm magnitude registered anywhere in the city), a 10³-fold one as ×3.3, and the smallest leak resolved in a minute grows from ×2.2 to ×3.1 — so the sentinels' 60 s window is recorded as open, not adequate, across the bracket. The ordering margin holds everywhere (190× at worst). Ruled final 2026-09-19 — and superseded that evening, when the bias was measured on the machine chain itself: +5.6 percentage points per joint, over-reporting, the same sign as the model chain; the hold was released and the high rows retired. The unapplied T is the conservative quotation for the shield and the comfortable one for the fence, so the fence now stands as two rows that are never merged — 0.87 counts/s as printed, 0.63 (0.45–0.90) with the chain's own bias on all six joints — and the integrator, who had printed a single 0.87 that morning and taken it back, ruled against returning to it. One finding of the review: the “644 independent histories” behind every error bar in this chain were records, not histories; there are 642. Two days later the bias had a cause: the chain's re-launch turned every neutron toward the wall normal at each joint, a defect of four lines found by flying a recorded source through vacuum. On the corrected chain T is 3.299×10⁻¹¹, the shield's margin 5.5×, the fence 0.66 counts/s, and the bias left in concrete is consistent with zero — in concrete, which is the only joint of six that has been read. What established the defect was the vacuum test and a paired rerun at 4.7σ; the two chains' face values differ by only 1.8σ, and “T fell by a quarter” is the weakest of the three pieces of evidence.
Every number above, and the run or ruling that produced it.
| Claim | Value | Produced by |
|---|---|---|
| Surface absorbed dose, protons only vs RAD | 0.74× (0.94× with He + Fe) | mars-glass account 16 / account 22 · Geant4 11.2.2 Shielding |
| Shape verdict on the six-point cover scan | FLATTENING · λ 1022 · residual −25.1% | mars_rad final_verdict.py · HARNESS 8662ba5f · JUDGE f6c251cd · INPUTS 259ef14c |
| Village model at 4.0 m vs measured | 0.9 vs 38.0 mSv/yr | hab-village-01 berm parameters (integrator recomputation) · mars-glass account 21 |
| Pinned-mean side test | |Δm| 4.47 vs sd 7.48 → 0.60σ → luck | mars-glass T30 pair (seeds v3 / 20260905) · mars_rad registered thresholds |
| Spatial-floor side test (excludes, never establishes) | R 1.13 / 0.97 / 1.04 → UNRESOLVED | mars-glass account 21 · mars_rad asymmetric rule, 3 dof |
| Surface quality factor vs RAD | 1.91 vs 3.05 · zone Z1 · unaudited | mars-glass account 22 · three-case protocol registered 08:43:09, first result 08:46:07 |
| Dose equivalent under 2 m, crown-uniform | ≥ 30.1 (scorers 26.9–33.5) | mars-glass account 22 · 21 runs, src_sha 2a74fcfd · integrator ruling 55e2ad8 |
| Lift from adding C and O | +2.8 to +4.5% per bin | mars-glass account 23 · pre-registered +2–8%, scorecard 10/11 |
| Hydrogen lever, material basis | −25% at 15% water · z −5.14 / −2.65 | mars-glass account 24 · criterion fixed before data |
| Bunk / living / airlock in the village's geometry | ≥ 27 / 52.8 / 93.7 | mars-glass account 25 on hab-village-01 geom-r2 · heavy tail at 20k protons per receptor |
| Polyethylene liner, 0.10 m | −5% ± 9% · not established | mars-glass account 26 · statistic registered first |
| Hydrated-mineral water fraction at the mine | ≤ 3 wt% (analogue) → 8% cover unreachable | res-mine-01 assay account · Leshin 2013, Scheller 2022, Cousin 2024 |
| Wet-cover heating bound | k ≥ 1.95 W/mK breaks the island (2 m) | pwr-grid-01 k sweep · pwr-storage-01 145 kW / 30 sol |
| Hull condensation bound | k ≥ 1.8 open walls · ≥ 0.9 furniture | res-eclss-01 L5_wet_cover_cabin_side.py · 4 gates |
| Zero-EVA Mars year at the bunks | ≥ 56.6 mSv | hab-village-01 plaza rebase · 30.1 × 1.881 |
| Proton-family Q from a single Timepix4 layer | ledger 15 · landing S3 · not separable | sci-rad-01 LET round · mars_rad efa91c6 · Q recovered −0.28, direction pre-registered the other way |
| Proton-family Q from RAD | outcome 3 · not separable | sci-rad-01 REPLY_sci-rad-01_proton_Q.md · mars_rad e2ed278 |
| Fence figure's geometry qualifier | T re-derived 4.391e-11 (×0.377) · r from the axis | tokamak a6cfb92 chain3 · mars_rad_sic d4c0983 · sci-rad-01 e2ed278 |
More than usual. The round was designed to find out where the arguments leaked, and it did.
The record, a commit message and two other ledgers said the village model predicted 18.7 mSv a year at 4 m. It belonged to the radiation station's own refitted branch. The village's curve gives 0.9 — the error had run in the village's favour, and it was the village that corrected it against itself.
Scatter scaled as a standard error; three quantities' spread taken as their mean's error bar; a range taken as a standard deviation. Each ordinary. Each ran the way that kept the station's own branch alive. Recorded by the station itself where the non-benefiting side would read it, with the conclusion that a one-directional error pattern comes from position, not carelessness — so the repair is structural: the party holding a number never judges it.
The frozen digest covered eight functions and three tolerances, not the script that fed them — which could drop a point or reorder the set without moving a bit. Found because the party asked to trust the digest asked what it covered. A second digest now covers the harness; drift refuses to issue a verdict.
Its hydrogen scan met one of six expectations — the effect was larger than it had written. Its liner scan expected a 3–10× advantage per tonne and found none resolvable. Both scorecards are printed on the same page as the results.
Independent of any cover. Predicted before the wet-cover sweep ran, confirmed, re-booked to 158 kW, chain re-run. The compute centre found the mirror image: the grid's 40 kW for it was eight drawn racks read as a meter.
When the side-test statistic came out at exactly the all-statistical value, the station computed what that was worth — 1.5 : 1 — and wrote the rule: a suspiciously suggestive value and a satisfyingly confirmatory value are the same error in different clothes, and only the first announces itself.