scram PJ reach: clean 60s horizon, n monotone decay, exit-threshold mismatch

Scram reach via PJ model runs cleanly through all three probe
horizons:

  T=10s:  6919 sets in 118s — n ∈ [0.0347, 0.0355]
  T=30s:  9900 sets in 156s — n ∈ [0.0153, 0.0156]
  T=60s: 12340 sets in 198s — n ∈ [0.00682, 0.00698]

Factor-of-two power decay per 30s matches the delayed-neutron group
structure (lambda_1=0.0124, half-life ~56s). At t=0 the algebraic n
drops from 1.0 → 0.15 (prompt jump captured as an instantaneous
algebraic adjustment); then tails off on precursor timescales.

Scram reach is completely sound across the full 60s horizon — no
step-budget truncation, unlike heatup beyond 300s.

HOWEVER: X_exit(scram) = n ≤ 1e-4 is not reached in 60s (current
n ~ 7e-3). This is a T_max vs plant-decay-rate mismatch, not a
control failure. Options documented in journal: redefine X_exit in
terms of shutdown margin (industry standard), extend T_max to 600s,
or loosen to n ≤ 0.05. Flagged for Dane's review.

Scram envelope summaries saved to reach_scram_pj_result.mat.
Journal now 33 pages, still compiles clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

journal/entries/2026-04-20-overnight-prompt-jump.tex

@@ -230,6 +230,76 @@ failure of the controller.}
 The reach-set envelope summary is saved to
 \texttt{reachability/reach\_heatup\_pj\_result.mat} for app ingestion.
 
+\subsection*{Part 4b: Scram PJ reach}
+
+The scram controller is constant ($u = -8\beta$) with no time-varying
+reference, making it structurally simpler than heatup.  Same PJ
+reduction applies.  Script: \texttt{code/scripts/reach\_scram\_pj.jl}.
+$X_{\mathrm{entry}}$: $\pm 1\,\%$ box on precursors, $\pm 1\,^\circ C$
+on temperatures about the operating point.  $Q_{\mathrm{sg}} = 0.03 P_0$
+(constant decay-heat-level sink, placeholder).
+
+\textbf{Results:}
+
+\begin{lstlisting}[style=terminal]
+--- Probe T = 10.0 s ---
+  TMJets: 6919 reach-sets in 118.3 s
+  n at T_probe:   [0.0347, 0.0355]
+  T_c at T_probe: [299.24, 301.27] °C
+  T_f at T_probe: [299.95, 301.99] °C
+
+--- Probe T = 30.0 s ---
+  TMJets: 9900 reach-sets in 155.5 s
+  n at T_probe:   [0.0153, 0.0156]
+  T_c at T_probe: [298.6, 300.66] °C
+
+--- Probe T = 60.0 s ---
+  TMJets: 12340 reach-sets in 198.2 s
+  n at T_probe:   [0.00682, 0.00698]
+  T_c at T_probe: [296.51, 298.58] °C
+\end{lstlisting}
+
+Power trajectory is $n \in \{0.035, 0.0155, 0.00690\}$ at the three
+horizons --- monotone decay, roughly factor 2 per 30~\unit{\second}
+which matches the delayed-neutron group structure
+($\lambda_1 = 0.0124$, half-life $\sim 56$~\unit{\second}).  At
+$t = 0$ the PJ algebraic $n$ jumps from the operating-point 1.0 down
+to $\sim 0.15$ due to the scram rod worth; then tails off on
+precursor timescales.
+
+\begin{limitation}
+\textbf{$X_{\mathrm{exit}}(\text{scram}) = \{n \leq 10^{-4}\}$ is not
+reached within the predicate-file $T_{\max} = 60$~\unit{\second}.}
+At 60~\unit{\second}, $n \approx 7 \times 10^{-3}$, two orders of
+magnitude above the threshold.  This is not a control failure --- the
+reactor is safely subcritical throughout the tube ($\rho \ll \beta$)
+--- it is a mismatch between the $T_{\max}$ I put in
+\texttt{mode\_boundaries} and the plant's actual delayed-neutron
+decay time constant (tens of seconds per group).  Three ways to
+resolve:
+\begin{enumerate}
+  \item \textbf{Redefine $X_{\mathrm{exit}}$} to a weaker predicate
+        that matches industry practice for ``reactor safely subcritical''
+        --- typically phrased in terms of \emph{shutdown margin} (total
+        negative reactivity below $-\beta$ by at least some $\Delta\rho$),
+        not a specific $n$ threshold.  In our reach: $\rho_{\text{total}}
+        \leq -\Delta\rho_{\min}$ is a halfspace in state space; trivially
+        satisfied here.
+  \item \textbf{Extend $T_{\max}$} to $\sim 600$~\unit{\second}
+        ($10$~\unit{\minute}) to match the plant's decay rate.
+  \item \textbf{Accept} $X_{\mathrm{exit}}$ as ``5\,\% of nominal power'',
+        which is reached around $t = 40$~\unit{\second}.
+\end{enumerate}
+Any of the three is defensible; option 1 aligns best with real
+reactor-safety semantics.  Flag for Dane's review.
+\end{limitation}
+
+Bright side: \textbf{the scram PJ reach is completely clean} --- no
+step-budget truncation, sound tube over the full 60~\unit{\second}
+horizon, temperatures decay through expected PWR post-scram
+trajectory, $n$ decays monotonically.  The infrastructure works on
+two modes now, not just heatup.
+
 \subsection*{Part 5: App buildout}
 
 While the reach is running, extended the Pluto predicate explorer