% ---------------------------------------------------------------------------
% Appendix A — Mathematical appendix (Agent H): proofs of the propositions of
% Section 3 and the variance / bootstrap results used by the inference plan.
% ---------------------------------------------------------------------------
\section{Mathematical appendix}\label{app:math}

This appendix proves the propositions stated in Section~\ref{sec:theory} and records two results used by the inference plan of Section~\ref{sec:design-inference}: the variance of the scenario-weighted estimator under cluster sampling and a sketch of the validity of the scenario-cluster bootstrap. Notation is that of Section~\ref{sec:theory}; the occupation index $o$ is suppressed when it plays no role.

\subsection{Proof of Proposition~\ref{prop:alf} (properties of the frontier)}

Write $\pi_j(B,H,q)=\Pr\{S_j(q)=1,\,C_j\le B,\,H_j\le H\}$ so that $\mathrm{ALF}(B,H,q)=\sum_j w_j\pi_j(B,H,q)$.

\emph{(i)} Each $\pi_j$ is a probability, hence in $[0,1]$; the weights are non-negative and sum to one, so the weighted sum lies in $[0,1]$.

\emph{(ii)} For $B\le B'$ the event $\{C_j\le B\}$ is contained in $\{C_j\le B'\}$, hence $\pi_j(B,H,q)\le\pi_j(B',H,q)$; the same holds in $H$. For $q\le q'$, $\{Q_j\ge q'\}\subseteq\{Q_j\ge q\}$, hence $S_j(q')\le S_j(q)$ pointwise and $\pi_j$ is non-increasing in $q$. Right-continuity in $B$ follows from the continuity from above of probability measures: for $B_n\downarrow B$, $\bigcap_n\{C_j\le B_n\}=\{C_j\le B\}$, so $\pi_j(B_n,H,q)\to\pi_j(B,H,q)$; likewise in $H$. Finite weighted sums preserve these properties.

\emph{(iii)} $\{S_j(q)=1,C_j\le B,H_j\le H\}\subseteq\{S_j(q)=1\}$ gives $\pi_j\le p_j(q)$ and hence $\mathrm{ALF}\le\rho(q)$. For $B_n\uparrow\infty$ and $H_n\uparrow\infty$, $\bigcup_n\{C_j\le B_n,H_j\le H_n\}=\{C_j<\infty,H_j<\infty\}$, which has probability one because $C_j$ and $H_j$ are finite random variables; continuity from below gives $\pi_j\to p_j(q)$ and the limit of the weighted sum follows.

\emph{(iv)} For events $A_1,A_2,A_3$ in a probability space, $\Pr(A_1\cap A_2\cap A_3)\le\min_k\Pr(A_k)$ and, by Bonferroni's inequality applied twice, $\Pr(A_1\cap A_2\cap A_3)\ge\Pr(A_1)+\Pr(A_2)+\Pr(A_3)-2$. Apply with $A_1=\{S_j(q)=1\}$, $A_2=\{C_j\le B\}$, $A_3=\{H_j\le H\}$, take the maximum with zero on the lower side, and sum with the weights.

\emph{(v)} If every run is stopped when its cost reaches $\bar B$ and evaluated as delivered, then $C_j\le\bar B$ almost surely, so $\{C_j\le B\}=\{C_j\le\bar B\}$ up to a null set for every $B\ge\bar B$, and $\pi_j(B,H,q)=\pi_j(\bar B,H,q)$.

\emph{(vi)} Since $\sum_j w_j=\sum_j w'_j=1$, for any constant $c$,
\[
\mathrm{ALF}^{w}-\mathrm{ALF}^{w'}=\sum_j (w_j-w'_j)\pi_j=\sum_j (w_j-w'_j)(\pi_j-c).
\]
Choose $c=\tfrac12(\max_j\pi_j+\min_j\pi_j)$, so that $|\pi_j-c|\le\tfrac12(\max_j\pi_j-\min_j\pi_j)$ for every $j$. Then
\[
\bigl|\mathrm{ALF}^{w}-\mathrm{ALF}^{w'}\bigr|\le\sum_j|w_j-w'_j|\cdot\tfrac12(\max_j\pi_j-\min_j\pi_j)=\mathrm{TV}(w,w')\,(\max_j\pi_j-\min_j\pi_j).\qquad\qed
\]

\subsection{Proof of Proposition~\ref{prop:decomp} (decomposition)}

By Definition~\ref{def:acceptance}, $\{S_j(q)=1\}=\{D_j=1\}\cap\{Q_j\ge q\}\cap\{E_j=0\}$. The chain rule of conditional probability gives, whenever each conditioning event has positive probability,
\begin{multline*}
\Pr\{S_j(q)=1,C_j\le B,H_j\le H\}
=\Pr\{D_j=1\}\,\Pr\{Q_j\ge q\mid D_j=1\}\\
\times\Pr\{E_j=0\mid D_j=1,Q_j\ge q\}\,\Pr\{C_j\le B,H_j\le H\mid S_j(q)=1\}.
\end{multline*}
If a conditioning event has probability zero, the left-hand side is zero and the convention that the corresponding factor is zero preserves the identity. Weighting by $w_j$ and summing over $j$ gives the frontier. \qed

\subsection{Proof of Proposition~\ref{prop:premium} (identification and variance of the premium)}

Under Assumption~\ref{ass:exchange}, $S_{j1}(a),\dots,S_{jR_j}(a)$ are i.i.d.\ Bernoulli with mean $p_j(a)$, so $\mathbb{E}[\bar S_j(a)]=p_j(a)$ and $\operatorname{Var}[\bar S_j(a)]=p_j(a)\{1-p_j(a)\}/R_j$. Runs under different arms are separate sessions in separate workspaces and are independent by the no-interference clause, so $\operatorname{Cov}[\bar S_j(a),\bar S_j(a')]=0$; runs on different tasks are likewise independent. Linearity of expectation gives $\mathbb{E}[\hat\tau]=\sum_j w_j\{p_j(a)-p_j(a')\}=\tau$, and independence across tasks and arms gives \eqref{eq:premium-var}. Assumption~\ref{ass:info} is what makes $\tau$ interpretable as the effect of the tool bundle rather than of information, since it ensures that the potential outcomes under the two arms differ only through the tool configuration.

For \eqref{eq:premium-var-cluster}, let the tasks be an i.i.d.\ sample of size $J$ from a task population and let $w_j=1/J$. Write $\hat\Delta_j=\bar S_j(a)-\bar S_j(a')$, so that $\hat\tau=J^{-1}\sum_j\hat\Delta_j$ with the $\hat\Delta_j$ i.i.d.\ across $j$. By the law of total variance, conditioning on the task's parameters,
\[
\operatorname{Var}(\hat\Delta_j)=\operatorname{Var}_j\bigl(\mathbb{E}[\hat\Delta_j\mid j]\bigr)+\mathbb{E}_j\bigl(\operatorname{Var}[\hat\Delta_j\mid j]\bigr)
=\operatorname{Var}_j(\Delta_j)+\mathbb{E}_j\Bigl(\frac{\sigma_j^2(a)+\sigma_j^2(a')}{R_j}\Bigr),
\]
and $\operatorname{Var}(\hat\tau)=J^{-1}\operatorname{Var}(\hat\Delta_j)$. \qed

The decomposition shows that the second term is divided by $R_j$ and the first is not: repeats shrink the within-task component only, and the between-task component $\operatorname{Var}_j(\Delta_j)$ shrinks only with $J$. This is the formal reason for the primary inference to resample tasks rather than runs.

\subsection{Proof of Proposition~\ref{prop:compound} (compounding reliability)}

\emph{(i)} With $\pi_k=\pi$, $p(d)=\pi^d$ and $\log p(d)=d\log\pi$, linear in $d$ with slope $\log\pi<0$ for $\pi<1$. Setting $\pi^{d}=\tfrac12$ gives $d_{1/2}=\log 2/\log(1/\pi)$. The approximation $d_{1/2}\approx 0.69/(1-\pi)$ for $\pi$ near one follows from $\log(1/\pi)=-\log\{1-(1-\pi)\}=(1-\pi)+O((1-\pi)^2)$.

\emph{(ii)} By the inequality of arithmetic and geometric means, $\bigl(\prod_{k=1}^d\pi_k\bigr)^{1/d}\le d^{-1}\sum_{k=1}^d\pi_k=\bar\pi$, with equality if and only if all $\pi_k$ are equal; raising to the power $d$ gives $p(d)\le\bar\pi^{\,d}$.

\emph{(iii)} $-\log p(d)=\sum_{k=1}^d(-\log\pi_k)$. Its first difference in $d$ is $-\log\pi_{d+1}$, which is non-decreasing in $d$ when $\pi_k$ is non-increasing in $k$; a function on the integers with non-decreasing first differences is convex. \qed

\subsection{Proof of Proposition~\ref{prop:recovery} (recovery)}

\emph{(i)} A step is completed if it succeeds at the first attempt (probability $\pi$) or fails, is detected and is corrected (probability $(1-\pi)\delta\gamma=(1-\pi)\rho$). The events are disjoint, so the effective step reliability is $\pi'=\pi+(1-\pi)\rho\ge\pi$, with strict inequality when $\pi<1$ and $\rho>0$. With homogeneous steps, $p_\rho(d)=(\pi')^d$ by \eqref{eq:compound}, and
\[
\frac{p_\rho(d)}{p(d)}=\Bigl(\frac{\pi+(1-\pi)\rho}{\pi}\Bigr)^{d}=\Bigl(1+\rho\,\frac{1-\pi}{\pi}\Bigr)^{d},
\]
which is geometric in $d$ with ratio greater than one.

\emph{(ii)} Let $F$ be the event that the first session does not produce an accepted deliverable; under the stated distributional assumption $\Pr(F)=1-p(A3;d)$. On $F$, the self-check flags the run with probability $\delta$ and, if flagged, the recovery session produces an accepted deliverable with probability $\gamma$; on $F^c$ the run is already accepted. By the law of total probability, $p(A4;d)=p(A3;d)+(1-p(A3;d))\,\delta\gamma$, and the difference is $(1-p(A3;d))\delta\gamma$, which is non-negative and increasing in $1-p(A3;d)$. \qed

The bound stated after Definition~\ref{def:ari} follows by noting that $\gamma\le\Pr\{P_2\mid F_1\}=\mathrm{ARI}$ when acceptance implies passing the self-check, and that $\delta\le 1$; hence $\tau(A4,A3)\le\Pr(F_1)\cdot\mathrm{ARI}$ under the same distributional assumption.

\subsection{Proof of Proposition~\ref{prop:delegation} (delegation thresholds)}

The expected payoffs are: in-house, $U_H=v-c_H$; delegation with verification, $U_V=v-c_A-\kappa_V-(1-p)c_H$, since the deliverable is accepted with probability $p$ and otherwise the failure is detected and the task is completed in-house at cost $c_H$; delegation without verification, $U_N=v-c_A-(1-p)\ell-eL$, since an unacceptable deliverable is used at loss $\ell$ and a critical error at loss $L$.

\emph{(i)} $U_V\ge U_H\iff -c_A-\kappa_V-(1-p)c_H\ge -c_H\iff p\,c_H\ge c_A+\kappa_V\iff p\ge(c_A+\kappa_V)/c_H$.

\emph{(ii)} $U_V\ge U_N\iff -\kappa_V-(1-p)c_H\ge-(1-p)\ell-eL\iff\kappa_V\le(1-p)(\ell-c_H)+eL$.

\emph{(iii)} Delegation without verification is optimal when $U_N>U_V$ and $U_N\ge U_H$; the first is the negation of (ii) and the second is $c_A+(1-p)\ell+eL\le c_H$. As $L\to\infty$ with $e>0$, the left-hand side of the second condition diverges, so the condition fails; the right-hand side of (ii) also diverges, so verification is preferred to no verification, and the choice reduces to (i). \qed

\subsection{Variance of the scenario-weighted estimator under cluster sampling}\label{app:math-variance}

Let the occupation's tasks be sampled i.i.d.\ from a task population, let each sampled task $j$ receive $R_j$ i.i.d.\ runs, and let $g(Y)$ be any bounded run-level statistic (acceptance, acceptance within budget, cost, a product of indicators). The scenario-weighted estimator of $\theta=\mathbb{E}_j[\mu_j]$, with $\mu_j=\mathbb{E}[g(Y_{jr})\mid j]$, is $\hat\theta=\sum_j w_j\bar g_j$, $\bar g_j=R_j^{-1}\sum_r g(Y_{jr})$. With general fixed weights $w_j$ summing to one and $\sigma_j^2=\operatorname{Var}[g(Y_{jr})\mid j]$,
\[
\mathbb{E}[\hat\theta]=\sum_j w_j\,\mathbb{E}_j[\mu_j]=\theta,\qquad
\operatorname{Var}[\hat\theta]=\sum_j w_j^2\Bigl[\operatorname{Var}_j(\mu_j)+\mathbb{E}_j\Bigl(\frac{\sigma_j^2}{R_j}\Bigr)\Bigr]
+\sum_{j\ne j'}w_jw_{j'}\operatorname{Cov}(\bar g_j,\bar g_{j'}),
\]
and the covariance term vanishes under i.i.d.\ task sampling. For equal weights this is \eqref{eq:premium-var-cluster} with $g$ in place of the paired difference. For professional-minutes weights $w_j\propto m_j$ the effective number of tasks is $J_{\mathrm{eff}}=1/\sum_j w_j^2\le J$, which is the price of unequal weighting. A consistent estimator of the variance is the scenario-level sample variance of $\bar g_j$ divided by $J$ (equal weights), or its weighted analogue, which is what the cluster-robust standard errors of the sensitivity regressions estimate \citep{cameron2015practitioner}.

\subsection{Validity of the scenario-cluster bootstrap: a sketch}\label{app:math-bootstrap}

The primary interval of Section~\ref{sec:design-inference} resamples scenarios with replacement, keeping each scenario's runs together, and recomputes the scenario-weighted statistic. Validity rests on three observations. First, under i.i.d.\ task sampling the scenario-level summaries $\hat\Delta_1,\dots,\hat\Delta_J$ (for a contrast) or $\bar g_1,\dots,\bar g_J$ (for a level) are i.i.d.\ bounded random variables, so the estimator is a sample mean of i.i.d.\ bounded terms and the ordinary nonparametric bootstrap of the mean is consistent for its sampling distribution as $J\to\infty$; keeping runs together within the resampled scenario preserves the within-scenario dependence that resampling runs would destroy \citep{cameron2008bootstrap,abadie2023clustering}. Second, for ratio estimands such as the cost per accepted deliverable or the Autonomy-Adjusted Productivity, $\hat\theta=\sum_j w_j\bar u_j/\sum_j w_j\bar v_j$, the delta method shows that $\hat\theta$ is asymptotically linear in the scenario-level pairs $(\bar u_j,\bar v_j)$, and the same bootstrap, applied to the pairs, is consistent provided the denominator's limit is bounded away from zero; this is why numerator and denominator are resampled jointly. Third, the paired sign-flip permutation test is exact in finite samples under the sharp null that the arm has no effect on any run of any scenario, because under that null the sign of each scenario's difference is exchangeable; it therefore complements the bootstrap at the pilot's $J=10$, where asymptotic approximations are rough and percentile intervals may undercover. With few clusters, the wild cluster bootstrap of \citet{cameron2008bootstrap} is the recommended refinement for the regression-based sensitivity analyses, and the preregistration's statement that intervals at $J=10$ will be wide and reported as such is the honest consequence of these approximations.