Lock in the self-weighting property of the random walk design

[soodoku]

Why this property

allocator's random walk is usable as a survey design only because it is self-weighting: points spaced evenly along a walk are a uniform sample of the road network, so a walk-based survey needs no inclusion-probability correction. Nothing tested that, and it is the property the whole design rests on.

It's provable, not merely observed. generate_walk picks uniformly among a node's neighbours — a simple random walk — where π(v) = deg(v)/2|E|. The rate of traversing a directed edge (u,v) is therefore

π(u) · (1/deg u) = deg(u)/(2|E|) · 1/deg(u) = 1/(2|E|)

independent of the edge, its length, and its endpoints' degrees. Every edge is crossed equally often, and since crossing costs distance proportional to length, distance-share equals length-share.

Measured

On a deliberately irregular graph — degrees 1–4, lengths 0.5–20, so that "equally often" and "in proportion to length" are very different statements — over independent walks of 40 network-lengths each:

walk	max |t| over 19 edges
simple random walk (the real one)	1.88
length-proportional (the plausible bug)	269.09

The second is the falsification partner and the reason the first means anything. Choosing the next edge with probability proportional to its length is a natural-looking change — it sounds more length-aware — and it destroys the property, because long edges are then favoured in the count of traversals on top of costing more distance each.

Two design points

• Replicates are independent walks, not segments of one long walk. A single walk is a Markov chain, so successive traversals are correlated and a binomial SE from the step count would understate the variance. On one long walk the largest deviation measured 2.85 binomial σ — the sort of number that looks fine until the dependence is accounted for.
• The band is Bonferroni-corrected for testing all |E| edges at once, derived from the edge count rather than picked until the suite went quiet.

The mechanism is asserted directly too, not just the consequence: traversal counts per edge against 1/|E|. A future change that preserved self-weighting by accident would still be visible there.

Verified the gates can fail by stubbing every simcheck assertion to a no-op — the falsification test goes red, the two positive tests stay green.

138 passed, 13 subtests, at both simcheck tiers. ruff clean.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[soodoku]

Two follow-on commits, both CI fixes rather than test work, flagged here so they're easy to split out if you'd rather.

14090bf — install the test dependency-group in CI. The new module imports simcheck and CI couldn't find it. simcheck is declared in [dependency-groups], and this repo installs published extras (uv pip install -e ".[test]"), which doesn't read PEP 735 groups. It can't move into [project.optional-dependencies] because it's a git reference and PyPI rejects direct URL references in distribution metadata — that would break allocator's own release. Verified the distinction in a throwaway venv rather than assuming it:

after `uv pip install -e ".[test]"`   -> simcheck absent
after `uv pip install --group test`   -> Name: simcheck

bc9bffa — keep haversine checkable across numba releases. The lint job has been red on master since numba 0.66.0 shipped (master run 27514699462, June 14, shows lint: failure with all tests passing — the same shape as this PR before the fix). 0.66.0 changed prange's annotation so mypy stopped seeing it as iterable. It went unnoticed locally because uv.lock pins 0.65.0 while CI resolves latest:

numba 0.66.0  ->  1 error
numba 0.65.0  ->  Success

A # type: ignore can't fix it — warn_unused_ignores is on, so the ignore becomes an error under 0.65 and just moves the failure to the other environment. The module now tells the type checker that prange is range, which is what it is, and binds numba.prange at runtime. Both environments pass after.

Runtime is untouched: 21 distance tests pass, and against an independently written great-circle formula the largest disagreement over a 50×40 matrix is 0.000000 m, with self-distances zero.