Event location and hybrid trajectory error

A smooth hybrid ODE system on a finite horizon $[0,T]$, with $T\ge 0$ and positive integer state dimension $d\ge 1$, consists of a finite mode set $M$, an open state-time domain $D_m\subseteq \mathbb{R}\times {\mathbb{R}}^d$ and a $C^1$ vector field $f_m:D_m\to {\mathbb{R}}^d$ for each $m\in M$, a finite set of directed transitions $(m,n)$, and for each transition a $C^1$ scalar guard $g_{mn}:D_m\to \mathbb{R}$, a declared crossing orientation ${\sigma }_{mn}\in \{-1,+1\}$, and a $C^1$ reset map $R_{mn}:U_{mn}\to {\mathbb{R}}^d$ on an open neighborhood $U_{mn}\subseteq D_m$ of the guard zero set, satisfying $(t,R_{mn}(t,x))\in D_n$ for every $(t,x)\in U_{mn}$. Here $C^1$ has the meaning in Continuously differentiable maps, local inverses, and local diffeomorphisms. In mode $m$, a trajectory is a solution of the first-order initial-value problem $y^{\mathrm{\prime }}=f_m(t,y)$ in the sense of First-order systems, initial value problems, and solutions on intervals. It follows that mode only until the selected event time.

An event time for transition $(m,n)$ is a time $\tau$ at which $g_{mn}(\tau ,y(\tau ))=0$ and the guard crosses in its declared direction, meaning ${\sigma }_{mn}\frac{d}{dt}{g}_{mn}(t,y(t)){\mathrm{\mid }}_{t=\tau }>0$. It is transverse with margin $\nu >0$ on a bracket when ${\sigma }_{mn}\frac{d}{dt}{g}_{mn}(t,y(t))\ge \nu$ throughout that bracket. At an event, the state changes from $y({\tau }^{-})$ to $R_{mn}(\tau ,y({\tau }^{-}))$ and the mode changes from $m$ to $n$. A deterministic event-priority rule is a fixed total order on the finite outgoing transition set of each mode; if several enabled guards vanish at exactly the same first time, the least transition in that order is selected.

A hybrid trajectory has a finite separated event list on $[0,T]$ when it has finitely many event times $0<{\tau }_1<\cdots <{\tau }_N<T$ and some $\delta >0$ with ${\tau }_{j+1}-{\tau }_j\ge \delta$ for each adjacent pair. The definition does not assert that a solution exists, that an event is detected, or that the event list is finite. Those are separate hypotheses or conclusions.

Let $y$ be a differentiable solution in mode $m$ on an interval $J$, with $y^{\mathrm{\prime }}(t)=f_m(t,y(t))$. Let $g(t,x)$ be $C^1$ on an open neighborhood of the graph of $y$, and define $h(t)=g(t,y(t))$. Then $h$ is differentiable on $J$ and $h^{\mathrm{\prime }}(t)={\mathrm{\partial }}_{t}g(t,y(t))+D_{x}g(t,y(t))f_m(t,y(t))\mathrm{.}$

Fix a mode $m$ and times $a\le t\le T$. Suppose $u,v:[a,T]\to {\mathbb{R}}^d$ solve $y^{\mathrm{\prime }}=f_m(s,y)$, both graphs stay in a convex tube on which $f_m$ is $L$-Lipschitz in the state, uniformly in time, and both solutions have initial values at $a$. Then $\mathrm{\parallel }u(t)-v(t){\mathrm{\parallel }}_2\le e^{L(t-a)}\mathrm{\parallel }u(a)-v(a){\mathrm{\parallel }}_2\mathrm{.}$

Let $\tau$ be an exact event time and $\widehat{\tau }$ its reported time, with $\mathrm{\Delta }=\mathrm{\mid }\widehat{\tau }-\tau \mathrm{\mid }$. On the interval $J$ between these times, suppose the incoming exact mode extension $y^{-}$ and dense reconstruction $U^{-}$ satisfy $\mathrm{\parallel }{U}^{-}(t)-y^{-}(t){\mathrm{\parallel }}_2\le \eta$, and $\mathrm{\parallel }{f}^{-}(t,y^{-}(t)){\mathrm{\parallel }}_2\le M^{-}$. Assume $\eta ,M^{-},M^{+},L_R,L_{R,t},L^{+}\ge 0$. Suppose the reset is defined on a neighborhood containing $(\tau ,y^{-}(\tau ))$, $(\widehat{\tau },U^{-}(\widehat{\tau }))$, and the coordinate segments joining them, with Lipschitz bounds $L_R$ in state and $L_{R,t}$ in time there. Let $y^{+}$ start from $R(\tau ,y^{-}(\tau ))$ at time $\tau$, and let ${\tilde{y}}^{+}$ start from $R(\widehat{\tau },U^{-}(\widehat{\tau }))$ at time $\widehat{\tau }$. Assume both outgoing solution pieces through $t_0=\max \{\tau ,\widehat{\tau }\}$ lie in a common convex tube where the outgoing field is bounded by $M^{+}$ and is $L^{+}$-Lipschitz in state. For $s\ge t_0$ while both outgoing solutions remain in a common convex tube on which the field is $L^{+}$-Lipschitz, we have $\mathrm{\parallel }{\tilde{y}}^{+}(t_0)-y^{+}(t_0){\mathrm{\parallel }}_2\le L_R\eta +(L_R{M}^{-}+L_{R,t}+M^{+})\mathrm{\Delta }\mathrm{.}$ For $s\ge t_0$ while both outgoing solutions remain in the tube, $\mathrm{\parallel }{\tilde{y}}^{+}(s)-y^{+}(s){\mathrm{\parallel }}_2\le e^{L^{+}(s-t_0)}[L_R\eta +(L_R{M}^{-}+L_{R,t}+M^{+})\mathrm{\Delta }]\mathrm{.}$

Consider a transition in Smooth hybrid ODE modes, guards, resets, and deterministic event priority with state dimension $d\ge 1$, from mode $m^{-}$ to mode $m^{+}$ at $(\tau ,x^{-})$. Let $g(t,x)=0$ be its $C^1$ guard, let $R(t,x)$ be its $C^1$ reset, and write $f^{-}=f_{m^{-}}(\tau ,x^{-})$ and $f^{+}=f_{m^{+}}(\tau ,R(\tau ,x^{-}))$. For each incoming and outgoing mode, assume its IVPs initialized at time $\tau$ from states near $x^{-}$ and $R(\tau ,x^{-})$, respectively, have unique solutions on a common finite interval and remain in a bounded convex open tube whose compact closure lies inside the open ODE domain. Use the initial state as the parameter and the identity as its $C^1$ initial map in Parameter-dependent ODE flows have the variational tangent on a common tube. For event-time variations to the left of $\tau$, impose the same tube hypothesis on the time-reversed incoming field. Thus the relevant mode flows are $C^1$ in initial state, and the incoming flow is jointly $C^1$ in time and initial state near $(\tau ,x^{-})$. Assume also that $\kappa :={\mathrm{\partial }}_{t}g(\tau ,x^{-})+D_{x}g(\tau ,x^{-})f^{-}\mathrm{\ne }0,$ and the nominal event crosses in its declared orientation. For every sufficiently small incoming perturbation $\delta x^{-}$ at the common pre-event time $\tau$, initialize the perturbed incoming mode at $x^{-}+\delta x^{-}$, and let ${\tau }_{\delta }$ be its local guard root near $\tau$; assume this root is the selected transition. Put $t_0=\max \{\tau ,{\tau }_{\delta }\}$, and define $\delta x^{+}$ as the right-limit difference ${\lim }_{t\downarrow t_0}(x_{\delta }^{+}(t)-x^{+}(t))$, with both outgoing trajectories evaluated at the same clock time $t>t_0$. Then $\delta x^{+}=S\delta x^{-}+o(\mathrm{\parallel }\delta x^{-}{\mathrm{\parallel }}_2),S=D_{x}R+\frac{(f^{+}-D_{x}R{f}^{-}-{\mathrm{\partial }}_{t}R)D_{x}g}{{\mathrm{\partial }}_{t}g+D_{x}g{f}^{-}},$ where all derivatives and vector fields are evaluated at the nominal event and the matrix product in the numerator is a column times a row. No claim is made when the crossing derivative vanishes or a nearby trajectory follows a different transition.

The batch-96 supplier Parameter-dependent ODE flows have the variational tangent on a common tube is present on library/numerical-optimization-inverse-problems-and-uncertainty-quantification/discrete-continuous-and-pde-adjoint-sensitivities.md, with its companion page at the same canonical category. The earlier missing-page observation checked the different dynamics-category path. The exact common-tube interface and identity-initial-map/time-reversal specialization above are retained; this placement reconciliation grants no independent proof acceptance.

Fix one mode $m$ and a positive-length closed trial interval $J=[a,b]$ with $a<b$, contained in a finite accumulated prefix that starts at the last reported reset. Certified hybrid event-enclosure data consist of the following.

1. A continuous piecewise-$C^1$ dense reconstruction $U$ on the accumulated prefix, the exact mode solution $y_{\mathrm{l}\mathrm{o}\mathrm{c}}$ launched from the last reported reset on that prefix, and a finite bound ${\eta }_{\mathrm{l}\mathrm{o}\mathrm{c}}\ge 0$ justified to satisfy $\mathrm{\parallel }{y}_{\mathrm{l}\mathrm{o}\mathrm{c}}(t)-U(t){\mathrm{\parallel }}_2\le {\eta }_{\mathrm{l}\mathrm{o}\mathrm{c}}$ throughout the prefix. The provider also supplies a finite bound ${\eta }_{\mathrm{r}\mathrm{e}\mathrm{f}}\ge 0$ justified to satisfy $\mathrm{\parallel }{y}_{\mathrm{r}\mathrm{e}\mathrm{f}}(t)-U(t){\mathrm{\parallel }}_2\le {\eta }_{\mathrm{r}\mathrm{e}\mathrm{f}}$ there, where $y_{\mathrm{r}\mathrm{e}\mathrm{f}}$ is the exact incoming-mode continuation of the reference hybrid trajectory. On an open interval containing each queried trial interval, this reference continuation exists and is $C^1$, so each exact reference guard is $C^1$ there. Its finite error ledger records the aligned mode-segment start and an upper bound $E\ge \mathrm{\parallel }{x}_{\mathrm{r}\mathrm{e}\mathrm{p}\mathrm{o}\mathrm{r}\mathrm{t}\mathrm{e}\mathrm{d}}-x_{\mathrm{r}\mathrm{e}\mathrm{f}}{\mathrm{\parallel }}_2$ on the discrepancy between reported and reference states there. One sufficient ledger calculation, when both exact mode solutions remain in a common convex tube and the field is $L$-Lipschitz in state there for duration $H$, is ${\eta }_{\mathrm{r}\mathrm{e}\mathrm{f}}={\eta }_{\mathrm{l}\mathrm{o}\mathrm{c}}+e^{LH}E$ by A Lipschitz ODE mode flow is stable to its initial state on a tube. A provider may instead supply a separately justified total bound ${\eta }_{\mathrm{r}\mathrm{e}\mathrm{f}}$ directly. The rational route in Finite rational residual-tube certificate for an ODE trajectory, Finite checker for rational residual-tube certificates, and A validated rational residual-tube certificate encloses an exact ODE solution is one sufficient provider for ${\eta }_{\mathrm{l}\mathrm{o}\mathrm{c}}$: its panel-radius functions must be accompanied by a finite uniform upper bound on the whole prefix. It is restricted to the rational-expression fields and polynomial reconstructions stated there; it is not required. One concrete dense-output formula is Quadratic continuous extension for Heun's method, which by itself is not an error certificate.
2. For each active transition $(m,n)$, a state-Lipschitz constant $L_g$ for its guard on a tube containing the exact and reconstructed states, interval enclosures $G_{mn}^U(I)$ of $g_{mn}(t,U(t))$, and finite interval evaluators $E_{mn}(I),D_{mn}(I)$ for every queried closed subinterval $I\subseteq J$. For every $t\in I$, $E_{mn}(I)$ must contain $g_{mn}(t,y_{\mathrm{r}\mathrm{e}\mathrm{f}}(t))$, $D_{mn}(I)$ must contain ${\mathrm{\partial }}_t{g}_{mn}(t,y_{\mathrm{r}\mathrm{e}\mathrm{f}}(t))+D_y{g}_{mn}(t,y_{\mathrm{r}\mathrm{e}\mathrm{f}}(t))f_m(t,y_{\mathrm{r}\mathrm{e}\mathrm{f}}(t))$, and $G_{mn}^U(I)$ must contain $g_{mn}(t,U(t))$. By The derivative of a guard along an ODE mode is its Lie derivative, the second enclosure is the derivative of the exact reference guard. For orientation ${\sigma }_{mn}$, an interval has certified transverse margin $\nu >0$ when ${\sigma }_{mn}{D}_{mn}(I)\subseteq [\nu ,\mathrm{\infty })$. Reset data include state and time Lipschitz constants $L_R,L_{R,t}$ certified on a domain containing both reset inputs and the coordinate segments joining $(\tau ,y_{\mathrm{r}\mathrm{e}\mathrm{f}}(\tau ))$ to $(\widehat{\tau },U(\widehat{\tau }))$. The incoming field bound $M^{-}$ holds along $y_{\mathrm{r}\mathrm{e}\mathrm{f}}$ on the event-time bracket; $M^{+}$ bounds the outgoing field along the outgoing solution that starts earlier, from its reset time through the first common post-reset time.
3. A finite error-ledger update rule and a certified separation bound $\delta >0$ between consecutive selected exact hybrid event times on the horizon. The provider must supply a finite sound justification or validation for every successor local or total error bound it returns. When a no-event trial is accepted, append its dense panel to $U$, retain the aligned-start discrepancy $E$, and certify valid local and total reference-error bounds over the enlarged prefix. When a prefix ends at a selected transverse event, let $\tau$ be the unique selected exact event time in the certified physical-time bracket and let $\widehat{\tau }$ be the bracket's upper endpoint. Suppose the whole bracket has certified signed derivative margin $\nu >0$, the dense guard residual at $\widehat{\tau }$ is bounded by $\epsilon$, the total reference error on the bracket is bounded by ${\eta }_{\mathrm{r}\mathrm{e}\mathrm{f}}$, the reset has state and time Lipschitz constants $L_R,L_{R,t}$, and the incoming and outgoing fields have norm bounds $M^{-},M^{+}$ on the intervals required for comparison. A sufficient conditional provider rule is to justify $0\le \widehat{\tau }-\tau \le {\mathrm{\Delta }}_{\mathrm{n}\mathrm{e}\mathrm{x}\mathrm{t}}$ with ${\mathrm{\Delta }}_{\mathrm{n}\mathrm{e}\mathrm{x}\mathrm{t}}=(L_g{\eta }_{\mathrm{r}\mathrm{e}\mathrm{f}}+\epsilon )\mathrm{/}\nu$, require ${\mathrm{\Delta }}_{\mathrm{n}\mathrm{e}\mathrm{x}\mathrm{t}}<\delta \mathrm{/}3$, and set $E_{\mathrm{n}\mathrm{e}\mathrm{x}\mathrm{t}}=L_R{\eta }_{\mathrm{r}\mathrm{e}\mathrm{f}}+(L_R{M}^{-}+L_{R,t}+M^{+}){\mathrm{\Delta }}_{\mathrm{n}\mathrm{e}\mathrm{x}\mathrm{t}}$ for the exact reset evaluated at the reported state. If the reported reset is computed as $\widehat{R}$ with a separately certified error $\mathrm{\parallel }\widehat{R}-R{\mathrm{\parallel }}_2\le {\epsilon }_R$, add ${\epsilon }_R$ to this $E_{\mathrm{n}\mathrm{e}\mathrm{x}\mathrm{t}}$ bound; exact reset evaluation has ${\epsilon }_R=0$. The provider must validate the hypotheses and inequalities and certify the next prefix's total reference-error bound with this aligned-start discrepancy included (or provide another sound proof of that total bound). Since $\widehat{\tau }-\tau \le {\mathrm{\Delta }}_{\mathrm{n}\mathrm{e}\mathrm{x}\mathrm{t}}<\delta \mathrm{/}3<\delta$, the next selected exact event cannot precede $\widehat{\tau }$. These formulas are a sufficient provider-supplied rule, not inequalities proved by this definition itself. If any proof obligation, required bound, separation certificate, or strict lag test is missing or invalid, no restart ledger update is certified. A local error bound alone does not establish the total reference bound; prior reset-state errors must be included in ${\eta }_{\mathrm{r}\mathrm{e}\mathrm{f}}$.

The provider may be any finite, sound method that supplies the stated bounds and interval inclusions; it returns certified with the data or inconclusive without them. Its checks may be provider-specific: a rational residual-tube checker is a sufficient concrete branch, not a universal evaluator for arbitrary $C^1$ fields or reset states. The bounds and enclosures are admissible only when their claimed inequalities and inclusions are justified. A dense-output point evaluation alone establishes none of them. If a required evaluator, ledger entry, bound, or inclusion is unavailable or nonfinite, the event data are uncertified and no event-absence conclusion is permitted.

Let $J=[a,b]$ with $a<b$, let $y$ be an exact incoming mode trajectory on $J$, and let $U$ be a dense reconstruction with ${\sup }_{t\in J}\mathrm{\parallel }y(t)-U(t){\mathrm{\parallel }}_2\le \eta$. Let $g(t,x)$ be $L_g$-Lipschitz in $x$ on the certified tube, with declared crossing orientation $\sigma \in \{-1,+1\}$. Suppose $h(t)=g(t,y(t))$ has a root $\tau \in J$ and, throughout $J$, $\sigma h^{\mathrm{\prime }}(t)\ge \nu$ for some $\nu >0$. If a reported time $\widehat{\tau }\in J$ satisfies $\mathrm{\mid }g(\widehat{\tau },U(\widehat{\tau }))\mathrm{\mid }\le \epsilon$, then $\mathrm{\mid }\widehat{\tau }-\tau \mathrm{\mid }\le \frac{L_g\eta +\epsilon }{\nu }\le \frac{C(\eta +\epsilon )}{\nu },C:=\max \{L_g,1\}\mathrm{.}$ The same-sign derivative condition makes $\tau$ the unique guard root in $J$. The conclusion concerns a root matched to this transverse bracket; it gives no bound at grazing or across a change of event ordering.

Inputs. A smooth hybrid ODE system with a fixed total event-priority order; an initial mode, time $t_0$, and state; a finite bound $E_0\ge 0$ on the discrepancy between that state and the exact reference state at $t_0$ (take $E_0=0$ when the reference trajectory starts from the supplied state); a finite horizon $T\ge t_0$; a finite trial-step provider; a finite enclosure provider satisfying Certified dense-output and reference-guard enclosure data for hybrid events for every accumulated mode prefix; a physical-time root-box width target $\omega >0$; a separate guard-residual tolerance $ϵ>0$; and finite nonnegative integer limits $B_{\mathrm{s}\mathrm{t}\mathrm{e}\mathrm{p}},B_{\mathrm{r}\mathrm{o}\mathrm{o}\mathrm{t}},B_{\mathrm{e}\mathrm{v}\mathrm{e}\mathrm{n}\mathrm{t}}$. All scalar certificate data used in decisions have finite exact rational representations, including $E_0,\omega ,ϵ,\delta$ and the error, Lipschitz, and field bounds. Time values have finite exact representations. Each provider or certificate-validation call returns data or a failure status in finite time; all computations and comparisons use exact rational or certified outward interval arithmetic, and any comparison that cannot be certified returns inconclusive. The trial provider returns a finite interval $J=[a,b]$ with exact finite endpoints and positive rational duration $b-a$ with $a$ equal to the current reported time and $a<b\le T$. For each trial interval use $\theta =(t-a)\mathrm{/}(b-a)$ and the transformed guard ${\tilde{h}}_{mn}(\theta )=g_{mn}(a+(b-a)\theta ,y_{\mathrm{r}\mathrm{e}\mathrm{f}}(a+(b-a)\theta ))$. The root isolator then starts from the finite dyadic interval $[0,1]$, regardless of the physical-time endpoints. For $Q\subseteq [0,1]$, write $J(Q)=[a+(b-a)\inf Q,a+(b-a)\sup Q]$. $B_{\mathrm{r}\mathrm{o}\mathrm{o}\mathrm{t}}$ is the maximum number of root-isolator boxes processed for one guard on one trial interval, summed over initial isolation, root-box refinement, endpoint checks, and event-order refinement. The enclosure provider supplies justified local and total reference-error bounds, valid dense-guard, exact-guard, and exact-guard-derivative enclosures on every queried subinterval, and a certified positive separation bound $\delta$ between consecutive selected exact event times on the horizon. It may use a rational residual-tube checker as one provider branch; no particular checker is required. A common-root certificate is a finite proof object with a finite sound validation procedure; it is admissible only when validated to certify that the unique exact roots in all named physical-time boxes occur at one common time. A certified exact singleton root is one such certificate. The error ledger $E$ is an upper bound on discrepancy between reported and reference states at the aligned mode-segment start. The provider accumulates a continuous piecewise-$C^1$ reconstruction $U$ from the last reported reset. The formula in Quadratic continuous extension for Heun's method is one possible reconstruction, not an error certificate.

Procedure. Before any root-isolator call or further root-box work, if its per-guard counter equals $B_{\mathrm{r}\mathrm{o}\mathrm{o}\mathrm{t}}$, return budget-exhausted with the certified prefix. After a call, if unresolved boxes remain and that counter has reached $B_{\mathrm{r}\mathrm{o}\mathrm{o}\mathrm{t}}$, return budget-exhausted; if unresolved boxes remain with budget available, return inconclusive unless the refinement procedure below explicitly continues them. A completed certificate may be used even when its last call exactly spends the budget. These budget checks take precedence over the unresolved-result branches below.

1. Initialize the current reported time, mode, and state from the inputs; set the accepted-event count and trial-step count to zero; set $E=E_0$. If the current time is $T$, return the completed prefix. If the trial-step budget is exhausted before reaching $T$, return budget-exhausted with the certified prefix. Check the event budget only after a next enabled event has been certified, so it does not prevent a no-event step from reaching $T$.

2. Increment the trial-step count and request the next interval $J=[a,b]$. If the increment exceeds $B_{\mathrm{s}\mathrm{t}\mathrm{e}\mathrm{p}}$, return budget-exhausted. If $a$ is not the current reported time or $a<b\le T$ fails, return inconclusive. Extend $U$ by the proposed panel. Obtain and validate the provider's data for the whole accumulated prefix, including a $C^1$ reference-mode continuation on an open interval containing $J$, the total bound ${\eta }_{\mathrm{r}\mathrm{e}\mathrm{f}}$, and each active guard's interval evaluators. Continue only on a certified response under Certified dense-output and reference-guard enclosure data for hybrid events; if the provider returns inconclusive or any required bound, inclusion, reset datum, or evaluator is missing, unjustified, or nonfinite, return inconclusive with the certified prefix.

3. For each outgoing transition in its fixed order, initialize a processed-box counter $c_{mn}=0$ and apply Finite-budget interval isolation for smooth scalar roots to ${\tilde{h}}_{mn}$ on $[0,1]$. On each queried local interval $Q$, use the exact-guard range enclosure $E_{mn}(J(Q))$ and the derivative enclosure $(b-a)D_{mn}(J(Q))$; these enclose ${\tilde{h}}_{mn}(Q)$ and ${\tilde{h}}_{mn}^{\mathrm{\prime }}(Q)$. Set the minimum width to $\eta =\omega \mathrm{/}(b-a)$ and the box budget to $B_{\mathrm{r}\mathrm{o}\mathrm{o}\mathrm{t}}$. Add the returned processed-box count to $c_{mn}$. If any result is inconclusive or contains unresolved boxes, return inconclusive. The result is usable only when it is complete, so all roots in the physical interval $J$ are covered by excluded or certified boxes.

4. Classify each certified local-time root box $Q$ using $D_{mn}(J(Q))$. If ${\sigma }_{mn}{D}_{mn}(J(Q))\subseteq (-\mathrm{\infty },-{\nu }_Q]$ for some ${\nu }_Q>0$, record that root as strictly opposite-oriented and nontriggering. If ${\sigma }_{mn}{D}_{mn}(J(Q))\subseteq [{\nu }_Q,\mathrm{\infty })$ for some ${\nu }_Q>0$, it is an enabled candidate. If neither inclusion is proved and $(b-a)\mathrm{width}(Q)=0$, return inconclusive; otherwise call the refinement procedure below with requested physical width $w=(b-a)\mathrm{width}(Q)\mathrm{/}2$, then repeat this classification on the returned smaller unique-root box. If further refinement is required after the box budget is spent, return budget-exhausted; any other failure to certify a strict sign returns inconclusive.

   Unique-root refinement. This procedure is called only on a local-time box $Q$ already certified to contain exactly one root and with a positive requested physical width $w$. While $(b-a)\mathrm{width}(Q)>w$, initialize a FIFO worklist with $Q$ and an empty set of certified subboxes. Remove the first local-time interval $I$ from the worklist. If $(b-a)\mathrm{width}(I)=0$, return inconclusive; otherwise bisect $I$ at its dyadic midpoint into two closed halves. For each half $K$, call Finite-budget interval isolation for smooth scalar roots on $K$ with minimum width ${\eta }_K=\min \{w\mathrm{/}(b-a),\mathrm{width}(K)\mathrm{/}2\}$ and the remaining per-guard budget; charge every processed box, including singleton calls, to $c_{mn}$. Add every certified root box returned to the set of certified subboxes, and append every unresolved box returned to the worklist; discard root-free boxes. Any certified subbox lies in $Q$, so the unique root of $Q$ is the root it certifies. If the certified set is nonempty, replace $Q$ by the intersection of its boxes; they all contain the same root, so the intersection is nonempty and contains exactly that root. If the new box is still too wide in physical time, repeat with worklist initialized to this smaller $Q$. If the certified set is empty, continue processing the worklist; root-isolation soundness ensures the root remains in its unresolved union. If $c_{mn}=B_{\mathrm{r}\mathrm{o}\mathrm{o}\mathrm{t}}$ while more work is required, return budget-exhausted. If the worklist empties without a certified subbox, return inconclusive. Closed halves include their shared midpoint, so an endpoint root cannot be dropped; if both halves certify it, their intersection records it once, possibly as a singleton.

5. For each guard, sort its certified local-time root boxes by lower endpoint. Normalize adjacent boxes that share a bisection endpoint $m$ by calling the root isolator on $\{m\}$ for ${\tilde{h}}_{mn}$ with minimum width $\omega \mathrm{/}(b-a)$ and the remaining per-guard budget, charging its processed boxes to that guard's counter. If it certifies a root, replace all touching boxes by the singleton root. If it certifies that $m$ is root-free, keep the boxes as distinct roots on opposite sides of $m$. If it is inconclusive, refine the touching boxes using step 4; if more work is required and $c_{mn}=B_{\mathrm{r}\mathrm{o}\mathrm{o}\mathrm{t}}$, return budget-exhausted; if their relation otherwise remains undecided, return inconclusive.

6. If every isolator is complete and every certified root is strictly opposite-oriented, accept the no-event panel. Set the current reported time to $b$ and state to $U(b)$, append the dense panel, and retain the aligned-start ledger $E$. Obtain updated certified local and total error bounds on the enlarged prefix; if the provider does not certify them, return inconclusive. A no-event decision is therefore based on complete root isolation and direction classification of the entire trial interval, not on endpoint signs or on the absence of guard roots.

7. If enabled candidates remain, order their local-time root boxes. For boxes that are strictly disjoint, their interval order gives their physical root order. If two boxes meet only at a local-time endpoint $m$, query the root isolator on $\{m\}$ for each guard with minimum width $\omega \mathrm{/}(b-a)$ and the remaining budget, charging each call to that guard: two certified singleton roots give a common-root certificate at physical time $a+(b-a)m$ and a priority-selected tie; a singleton root-free result proves that guard's root is strictly to its box's side of $m$ and orders it against a root at $m$ or on the other side. If a singleton result is inconclusive, refine the boxes. For boxes with a nontrivial overlap, use a valid common-root certificate to establish exact simultaneity and apply the fixed priority among those enabled transitions; otherwise refine the overlapping boxes one bisection level at a time by requesting half their physical widths in step 4. If a box has zero physical width and still overlaps another candidate without a certified tie, return inconclusive. For same-guard boxes that touch at a bisection endpoint, the singleton check in step 5 either merges one root there or proves that the roots lie strictly on opposite sides. If the order is not certified before a box budget is exhausted, return budget-exhausted. Select the earliest enabled root or the priority-selected transition at a certified tie. Refine its box to physical width at most $\omega$.

8. Let $\widehat{\tau }=a+(b-a)\sup Q$ be the physical upper endpoint of the selected local-time box $Q$, so the exact root $\tau$ satisfies $\tau \le \widehat{\tau }$. From the dense-guard enclosure $G_{mn}^U(\{\widehat{\tau }\})$, take the maximum absolute endpoint as a certified upper bound ${ϵ}_{\mathrm{o}\mathrm{b}\mathrm{s}}$ for $\mathrm{\mid }{g}_{mn}(\widehat{\tau },U(\widehat{\tau }))\mathrm{\mid }$. If the enclosure is nonfinite or ${ϵ}_{\mathrm{o}\mathrm{b}\mathrm{s}}>ϵ$, return inconclusive when $(b-a)\mathrm{width}(Q)=0$; otherwise call unique-root refinement with requested physical width $w=(b-a)\mathrm{width}(Q)\mathrm{/}2$ and recompute. If the tolerance still requires root-box work after the budget is spent, return budget-exhausted; any other failure to certify it returns inconclusive.

9. If the accepted-event count is already $B_{\mathrm{e}\mathrm{v}\mathrm{e}\mathrm{n}\mathrm{t}}$, return budget-exhausted with the certified prefix without applying another reset. Otherwise let $\nu >0$ be the certified signed derivative margin on the selected physical-time root box. If that box is a singleton, its certified root is $\tau =\widehat{\tau }$; set $\mathrm{\Delta }=0$. For a positive-length box, compute $\mathrm{\Delta }=(L_g{\eta }_{\mathrm{r}\mathrm{e}\mathrm{f}}+{ϵ}_{\mathrm{o}\mathrm{b}\mathrm{s}})\mathrm{/}\nu$ by A transverse hybrid event time is stable under dense-output and root error. In both cases the selected box contains its unique exact root $\tau$, and step 8 selects its upper endpoint, so $0\le \widehat{\tau }-\tau \le \mathrm{\Delta }$. If the certified separation bound is missing or $\mathrm{\Delta }\ge \delta \mathrm{/}3$, return inconclusive without restarting, since another selected exact event may occur before the reported time. Otherwise, separation by $\delta$ ensures no next selected exact event occurs before $\widehat{\tau }$. Check that $(\widehat{\tau },U(\widehat{\tau }))$ lies in the reset domain and that $(\widehat{\tau },x^{+})\in D_n$, where $x^{+}$ is the actual proposed exact or approximate reset value and $n$ is the selected target mode; a failed check returns domain-failure. Apply the exact reset and set ${ϵ}_R=0$, or obtain a finite certified error bound ${\epsilon }_R\ge 0$ between the applied approximate reset value and $R(\widehat{\tau },U(\widehat{\tau }))$; if that bound is unavailable, return inconclusive. A root at $T$ is processed by this same rule, and the output at $T$ is post-reset. The exact reference trajectory has reset at $\tau$ and followed the outgoing field through the alignment time $\widehat{\tau }$; its flow over this lag contributes at most $M^{+}\mathrm{\Delta }$. By Reset and smooth-mode flow propagate a transverse event-time error, then add the reported reset-evaluation error to set the next aligned-segment state-error bound to $E\leftarrow L_R{\eta }_{\mathrm{r}\mathrm{e}\mathrm{f}}+(L_R{M}^{-}+L_{R,t}+M^{+})\mathrm{\Delta }+{\epsilon }_R\mathrm{.}$ Then discard the pre-reset reconstruction, set the current reported time and state to $\widehat{\tau }$ and the applied reset value, start a new accumulated reconstruction in the selected mode, append the event certificate, and increment the accepted-event count. Before processing any later trial interval, step 2 must obtain certified provider data whose total reference-error bound is valid on that whole accumulated prefix and includes this aligned-start discrepancy (or is independently justified on that full prefix); if the provider cannot certify it, return inconclusive with the certified prefix. Continue from step 1. Whenever further step, root-box, or event work is required after its budget is spent, return budget-exhausted with the certified prefix.

Outputs. A finite list of certified no-event panels and transverse event boxes with selected transitions, reset states, event-time bounds, and an updated state-error ledger; or an explicit inconclusive, domain-failure, or budget-exhausted status with the certified prefix. No no-event conclusion is drawn from endpoint signs alone.

Consider exact and reported hybrid trajectories with the same initial data and a common finite sequence of transitions at exact event times ${\tau }_1<\cdots <{\tau }_N$ and reported times ${\widehat{\tau }}_1<\cdots <{\widehat{\tau }}_N$. Assume the events are separated by $\delta >0$, are transverse with margins ${\nu }_j>0$, and the reported event times are upper endpoints of certified root boxes, so ${\tau }_j\le {\widehat{\tau }}_j$. After each event, both trajectories are compared at the reported event time, when both are in the outgoing mode. Let $E_j$ bound their state discrepancy at this aligned mode-segment start, with $E_0=0$.

For mode segment $j$, let $U_j$ be the accumulated piecewise dense reconstruction from the reported start, with a certified local error bound ${\eta }_j^{\mathrm{l}\mathrm{o}\mathrm{c}}$ relative to the exact mode solution from that same start. Let $L_j$ be a state-Lipschitz bound, $H_j$ the segment duration, and $L_{g,j},{\epsilon }_j$ the guard state-Lipschitz and reported guard-residual bounds. Let $D_j$ be a certified total error bound between $U_j$ and the exact reference incoming-mode continuation on the prefix. It may be supplied directly; a sufficient ledger calculation is $D_j:={\eta }_j^{\mathrm{l}\mathrm{o}\mathrm{c}}+e^{L_j{H}_j}{E}_j,$ when the two exact mode solutions share the aligned start time, their initial discrepancy is at most $E_j$, and both remain in a common convex tube on which the field is $L_j$-Lipschitz. Then $D_j$ bounds the reference error on the incoming-mode prefix and ${\mathrm{\Delta }}_{j+1}:=\frac{L_{g,j}{D}_j+{\epsilon }_j}{{\nu }_{j+1}}$ bounds ${\widehat{\tau }}_{j+1}-{\tau }_{j+1}$. Assume ${\mathrm{\Delta }}_{j+1}<\delta \mathrm{/}3$ for each event; the event separation then ensures no later exact event occurs before the reported reset time. At each event assume the reset has state and time Lipschitz constants $L_{R,j+1},L_{R,t,j+1}$ on a domain containing both compared reset inputs and the coordinate segments joining them, the incoming field is bounded by $M_j^{-}$ over the event-time bracket, and both outgoing solutions remain through their alignment time in a common tube where the outgoing field is bounded by $M_{j+1}^{+}$ and is $L_{j+1}^{+}$-Lipschitz in state. If the reported reset value is approximate, let ${\epsilon }_{R,j+1}\ge 0$ be a certified bound on its evaluation error, with ${\epsilon }_{R,j+1}=0$ for exact evaluation. Then $E_{j+1}:=L_{R,j+1}{D}_j+(L_{R,j+1}{M}_j^{-}+L_{R,t,j+1}+M_{j+1}^{+}){\mathrm{\Delta }}_{j+1}+{\epsilon }_{R,j+1}$ bounds the state discrepancy at the next aligned mode-segment start. The terminal segment has its supplied total bound $D_N$; when the sufficient common-tube ledger calculation applies, one may take $D_N={\eta }_N^{\mathrm{l}\mathrm{o}\mathrm{c}}+e^{L_N{H}_N}{E}_N$. These finite recurrences bound state errors on matched smooth-mode segments and reset states at aligned times; they make no same-clock state claim between an exact jump and its later reported jump.