What Each Package Actually Contributes: An Adversarial Audit of Madhava, winnex-ai-normalize, winnex-nano and Tracer-MED

Four benchmarks measure, independently, the four components of the Winnex stack — the Madhava vector-search engine, the winnex-ai-normalize quality gate, the winnex-nano HRR encoder, and the Tracer-MED clinical product — and the effect of each on a 4B language model's answer. The design is adversarial: every claim is paired with a control that would refute it if false — a random-context placebo against retrieved context, shuffled multiple-choice alternatives against memorisation, a complete relevance ground truth against a truncated one, and an exact full scan against the approximate index. Five findings. (1) The index is not the bottleneck. On the patient-record corpus Madhava scores recall@10 = 0.2687 against an exact-scan ceiling of 0.2674 — within 0.05% — with zero bound violations across 172,000 issued certificates. (2) The certificate proves exclusion, not relevance. Scope is pool_only in 585 of 585 queries across two benchmarks, and the same certificate configuration spans downstream accuracy from 0.523 to 0.617 depending on corpus. (3) The embedding sets the ceiling and the engine does not reach it equally. With MiniLM-L6 the ceiling is 0.7467 and the engine delivers 0.7453 (99.8%); with winnex-nano the ceiling collapses to 0.0649 and the engine delivers 0.0411 (63.3%). (4) The corpus determines the sign of the effect. With patient records, retrieved context harms the clinical answer (delta = -0.060, p = 0.029); with clinical knowledge it helps (delta = +0.073, p = 0.0115), and beats a random-document placebo by +0.090 (p = 0.0021). (5) The evidence chain detects tampering, but the default receipt carries no signature — integrity against accidental edit, not non-repudiation. Full vector path. Section 2 traces every stage: text to vector (MiniLM mean-pooled 384d versus nano's algebraic circular-convolution HRR at 256d), optional L2 normalisation, projection basis choice (PCA versus random, measured as indistinguishable), the three-stage pruning cascade, and the certificate. It documents that exact_evals equals k2_fraction x k1_fraction x N — a configuration constant, always exactly 1.000% of the corpus, never a data-dependent saving. Audit trail and inference. Section 7 states what is recorded per query (bound_violations, recall_guarantee, bound_pairs, exact_evals, pruned_by_bound, pruned_by_prefilter, total_excluded_count, per-document audit records) and four production patterns: certificate as response metadata; certificate as a confidence filter; audit_exhaustive=True for a global guarantee (top-10 overlap with exact scan rises from 0.934 to 1.0000 at +43% latency); and an Ed25519-signed commitment for WORM storage. It also states the limit: the certificate is sound = true in configurations scoring 0.0411 and 0.7453 alike. Component roles are separated explicitly. For each experiment the article declares whether the index, the product, or the corpus was under test, holding the rest fixed. Kernel results included. Kaggle kernel results are reported alongside local runs: 203/300 subject match (67.7% versus 4.8% chance), zero bound violations, and the full four-arm comparison (A 0.540, B 0.613, C 0.523, D 0.523; B vs A +0.0733 p = 0.0115; B vs C +0.0900 p = 0.0021; D vs A -0.0167 p = 0.6089). Additional results. Contamination ruled out by the shuffled-alternatives arm. Accuracy conditional on retrieval subject rises 9.9 points when the retrieved document matches the question's subject, versus 5.7 for random context. Normalisation changes top-10 overlap with the exact scan in nano by 3x (0.3354 to 0.1147) while leaving transformers unchanged. A 0.6B embedding model beats its own 4B sibling by 0.042 p@10 at one fifth the latency. A one-line max_seq_length fix raises production p@10 from 0.2800 to 0.6063 (2.2x). A truncation defect in the relevance ground truth had understated the embedding ceiling by 2.7x. Public correction. An earlier version reported +0.147 where the correct value is +0.073. Section 10 documents the error, its causes (an answer parser that read "The answer is B" as A, and a retrieval query that included the four alternatives), and why the smaller number is defensible. Both versions remain available and identified.