[m-murphy]

Summary

The leak and the observation error rates can be sampled.

--leak-prior loguniform[:LO,HI] | exponential[:RATE]
    the leak becomes a Run scalar (transmission_leak), starting at --transmission-leak
    exponential is truncated to (0, 0.5)
--error-model infection | shared | hierarchical
    infection     each Infection its own rates, prior Gamma(10, 0.001) (default, as before)
    shared        one false-positive and one false-negative rate for every Infection, priors Gamma(2, 0.01) and Gamma(2, 0.02)
    hierarchical  each Infection's rates from Gamma(shape, mean / shape); efp_mean, efp_shape, efn_mean, efn_shape sampled

• ModelChoice (its own ModelChoice.h/.cpp) carries the Run recipe's model choices to the State and checkpoint::restore as one value, and is the one place leak priors and error models are parsed. A number in a leak prior must parse whole: loguniform:1e-3x,0.1 is refused.
• The start: a --transmission-leak outside the prior's range (the default 0, say) is moved just inside it, and a notice says so. The manifest records the start used. On resume, the leak given and the one recorded compare as the starts they make, so the original command still resumes, and so does a manifest written before this change.
• On restore, a leak the prior holds stays bit-identical, so a resumed chain goes on as an uninterrupted one would. Only a leak outside the prior's range is moved, for example one from a Run with another prior.
• The Transmission memo follows a sampled leak: a change puts its results aside, and a rejected step brings them back without recomputing.
• On resume, leak priors and error models compare by meaning (loguniform = loguniform:1e-07,0.1; infection = not given).
• The manifest records leak_prior and error_model. A manifest without them reads as a fixed leak and per-Infection rates.
• plasmotrackr: pt_convergence() gives R-hat for transmission_leak and efp_*/efn_* when the Runs have them. pt_read() refuses to pool Runs that differ in leak prior or error model, compared by meaning. With a leak prior, Runs that differ only in their recorded start still pool.
• Glossary: Error model, Leak prior and Model choice.

Evidence

• Before: the leak and error-rate structure are fixed.
  After: engine tests 344 pass (1 skipped without OpenMP), among them:

  • SampledLeakTest: the cached log posterior matches a Model built from scratch, with leak steps accepted and rejected, and with frequency ids forgotten mid-step; the leak walk matches its exact conditional; a restored leak inside the prior is unchanged; the start; whole-number parsing;
  • RunRecipe: the manifest records the start; resuming compares starts;
  • prior-recovery tests for the hierarchical rates.

  plasmotrackr tests 3732 pass; golden copies in sync; Golden Stores unchanged.

• On six simulated studies with family moves, the sampled log-uniform leak gives R-hat 1.03 and edge AP 0.666.

Merge Danger

Door: two-way

Both options are off by default, and Runs without them have the Sampler set they had before.

Blast Radius: small

• Two new manifest keys.
• With a leak prior, transmission_leak in the manifest is the start used, which can differ from --transmission-leak.
• --start-from needs the same Sampler set as the source Run (the README says so).