\documentclass[journal]{IEEEtran}

\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{amsthm}
\usepackage{graphicx}
\usepackage{booktabs}
\usepackage{array}
\usepackage{multirow}
\usepackage{algorithm}
\usepackage{algpseudocode}
\usepackage{float}
\usepackage{cite}
\usepackage{url}
\usepackage[hidelinks]{hyperref}
\DeclareMathOperator*{\argmin}{arg\,min}
\DeclareMathOperator*{\argmax}{arg\,max}

\newtheorem{theorem}{Theorem}
\newtheorem{proposition}{Proposition}
\newtheorem{corollary}{Corollary}
\newtheorem{definition}{Definition}
\newtheorem{remark}{Remark}
\newtheorem{assumption}{Assumption}

\newcommand{\E}{\mathbb{E}}
\newcommand{\R}{\mathbb{R}}
\newcommand{\tr}{\operatorname{tr}}
\newcommand{\rank}{\operatorname{rank}}
\newcommand{\clip}{\operatorname{clip}}
\newcommand{\diag}{\operatorname{diag}}
\newcommand{\dist}{\operatorname{dist}}
\newcommand{\Var}{\operatorname{Var}}
\newcommand{\Kraw}{K_{\mathrm{raw}}}
\newcommand{\Kproj}{K_{\mathrm{proj}}}
\newcommand{\Kcl}{K_{\mathrm{cl}}}
\newcommand{\Bs}{B_s}
\newcommand{\Proj}{\Pi_{\beta}}
\newcommand{\ALEP}{\widehat{\mathcal R}_{\mathrm{ALE}\text{-}P}}
\newcommand{\ALEI}{\widehat{\mathcal R}_{\mathrm{ALE}\text{-}I}}
\newcommand{\Bmax}{\mathcal B_{\max}}
\newcommand{\gP}{\gamma_P}

\title{Certificate-Guided Residual Variance Control for Residual Learned Controllers in Nonlinear Systems}

\author{Yue~Wu}

\begin{document}

\maketitle

\begin{abstract}
This paper studies residual learned controllers for discrete-time nonlinear systems whose local lifted or linearized closed-loop surrogates exhibit nonnormal transient amplification. A residual action source that appears small in Euclidean variance can still produce large state covariance after propagation by such a local amplifier. We formulate this behavior as source-amplifier variance propagation and propose certificate-guided residual variance control (CG-RVC), a residual actor--critic wrapper that constructs a local surrogate, computes a projected Lyapunov certificate, and pulls the certificate back to residual-action space as an anisotropic covariance penalty. The certificate model supplies local weights and diagnostics for residual source shaping. The analysis gives covariance propagation and nonnormal amplification bounds with mismatch, colored-input, and residual-feedback extensions. Controlled interventions separate source and amplifier effects: filtering under a fixed amplifier reduces action variance by $92.1\%$ and state covariance by $21.8\%$, while equal-trace MIMO source directions produce measured state-energy ratios of $94.2$--$141.0\times$ that match the certificate-weighted prediction. In a matched 5-seed high-noise constrained-RL comparison, CG-RVC reduces RMSE by $47.1\%$, applied action variance by $94.7\%$, action-difference MSE by $97.7\%$, and posterior Bellman--Lyapunov maximum by $94.3\%$ relative to Direct TD3, while reducing dense violations from $0.9389$ to $0$. Planar and Full3D quadrotor simulations provide additional mechanism evidence for nonlinear aerial systems; in Full3D, filtered source injection reduces state covariance by $65.7$--$83.8\%$ and motor variance by $90.3$--$94.5\%$ across four scenarios.
\end{abstract}

\begin{IEEEkeywords}
Learning-based control, nonlinear systems, nonnormality, transient amplification, residual variance control, local surrogate, Lyapunov certificate, reinforcement learning, quadrotor simulation.
\end{IEEEkeywords}

\section{Introduction}

Residual learned control for discrete-time nonlinear continuous-control systems combines nominal feedback, a neural residual actor, and execution-time safety repair. In this setting, the risk is not only that the learned action is noisy. A residual source that appears small in Euclidean variance can produce large state covariance, Lyapunov-energy excursions, and projection burden after it passes through the local closed-loop dynamics. This paper treats noise, constraints, and aerial simulation as settings where this residual-source propagation problem becomes visible.

Existing learning-based control explanations mostly act on one side of this propagation chain. Action smoothing, control regularization, smooth exploration, and action-alignment methods penalize Euclidean action magnitude, temporal variation, or high-frequency content \cite{cheng2019control,mysore2021caps,raffin2022smooth,piao2022smooth,kwak2026smooth}. Constrained policy optimization, safe-learning methods, control barrier functions, and shielding repair unsafe actions or enforce feasibility conditions after a candidate command has been produced \cite{achiam2017cpo,brunke2022safe,ames2019cbf,folkestad2021koopman}. These source-side and repair-side tools are important, but neither explains why two residual covariance directions with the same trace can create very different downstream state covariance under the same nominally stable local closed loop.

Classical control theory supplies the missing amplifier-side view. Pseudospectral, nonmodal, and stochastic-forcing analyses show that eigenvalue stability does not preclude finite-time amplification or large steady covariance under random forcing \cite{trefethen2005spectra,schmid2007nonmodal,farrell1996generalized}. Stochastic Lyapunov, robust-control, LQG, and covariance-control viewpoints further show that second moments are propagated objects rather than nuisance statistics \cite{anderson1990optimal,zhou1996robust,chen2016covariance}. In neural residual control, this classical perspective exposes a closed-loop propagation geometry that is invisible to Euclidean action statistics: risk depends on how the residual source enters through the input channel, how the local surrogate amplifies it, and how downstream certificate energy evaluates it.

We propose certificate-guided residual variance control (CG-RVC) to turn this propagation view into a trainable residual actor--critic method. CG-RVC constructs a lifted or linearized local surrogate, computes a projected Lyapunov certificate, and pulls that certificate back through the residual input channel to obtain a direction-aware residual-action metric. The actor update uses this metric as a certificate-weighted residual covariance penalty, while the execution layer applies risk-scheduled smoothing, rate limiting, and safety projection. Posterior Bellman--Lyapunov residuals and actor-augmented amplifier diagnostics then check whether the learned residual behavior remains consistent with the local certificate model. Thus source shaping, safety repair, and posterior diagnosis are separated rather than conflated.

The experimental design follows the same source-amplifier-risk chain. Controlled interventions separate source and amplifier effects: filtering under a fixed amplifier reduces action variance by $92.1\%$ and state covariance by $21.8\%$, while equal-trace MIMO source directions produce measured state-energy ratios of $94.2$--$141.0\times$ that track the certificate-weighted prediction. In a matched 5-seed high-noise constrained-RL comparison, CG-RVC reduces RMSE, applied action variance, action-difference MSE, posterior Bellman--Lyapunov maximum, and dense violations relative to Direct TD3. Planar and Full3D quadrotor simulations provide additional mechanism evidence for nonlinear aerial systems.

The contributions are as follows.
\begin{itemize}
    \item We identify a source-amplifier-risk mechanism in residual learned control: residual-action covariance should not be interpreted only through Euclidean magnitude, temporal smoothness, or exploration noise, because locally nonnormal closed-loop geometry can directionally amplify residual sources into state covariance, Lyapunov-energy excursions, and projection burden.
    \item We convert classical nonmodal covariance-propagation theory into a trainable residual-action metric. By constructing a local surrogate, computing a projected Lyapunov certificate, and pulling the certificate back through the residual input channel, we obtain an anisotropic action-space covariance metric $M=\Phi_u^\top P\Phi_u$ that weights residual directions by downstream certificate energy.
    \item We propose CG-RVC, a classical-control-informed residual actor--critic wrapper that separates upstream source shaping, execution-time safety repair, and posterior certificate diagnosis. Controlled interventions, MIMO directional injection, matched constrained-RL comparisons, and quadrotor simulations support the source-amplifier interpretation and the distinct roles of source shaping and projection.
\end{itemize}

\section{Background and Positioning}

This section positions CG-RVC along the functional chain used in the paper: residual source statistics, local input channel, nonnormal amplifier, covariance or Lyapunov-energy propagation, downstream repair, and posterior diagnosis. Each subsection summarizes what the existing literature contributes to this chain, what it leaves unresolved for residual actor training, and how CG-RVC uses that component.

\subsection{Nonnormal Amplification and Covariance Propagation}
Pseudospectra, transient growth, and stochastic response theory provide the mathematical basis for treating a stable closed loop as a possible amplifier \cite{trefethen2005spectra,schmid2007nonmodal,farrell1996generalized}. Recent statistical transient-growth and Kreiss-constant work extends these diagnostics beyond worst-case disturbance analysis \cite{frame2024statistical,li2023kreiss}. These tools usually analyze a given operator, controller, or disturbance model. CG-RVC uses them inside residual learned control: the fitted local closed-loop surrogate is the amplifier, and residual-action covariance is the source that it propagates.

Stochastic Lyapunov analysis, $H_2$ interpretations, LQG, and covariance shaping all treat second moments as control-relevant quantities \cite{anderson1990optimal,zhou1996robust,chen2016covariance}. Their usual role is analysis or controller synthesis for a specified stochastic system. Here their role is different: classical covariance propagation is turned into a residual actor-training signal that identifies which residual covariance directions increase downstream Lyapunov energy after passing through the local amplifier.

\subsection{Action Regularization and Residual RL as Source-Side Control}
Residual policies and source-side regularizers modify what the learned actor sends to the plant. Control regularization, CAPS-style action consistency, smooth exploration, and action-alignment methods show that smoother or lower-variance commands can improve continuous-control deployment \cite{cheng2019control,mysore2021caps,raffin2022smooth,piao2022smooth,kwak2026smooth}. These methods reduce action magnitude, temporal variation, or high-frequency content before the command reaches the closed loop.

Source-side regularization is necessary but incomplete for the risk mechanism studied here. A scalar variance penalty or temporal action-difference penalty does not use the residual input channel $\Phi_u$, the local amplifier $\Kcl$, or the certificate $P$. CG-RVC keeps the source-side goal of shaping residual variation, but replaces isotropic or temporal-only penalties with a certificate-weighted covariance penalty that depends on downstream closed-loop propagation.

\subsection{Safety Filters as Downstream Repair}
Constrained policy optimization, safe learning surveys, control barrier functions, and Koopman-CBF synthesis provide foundations for safe learning and execution-time filtering \cite{achiam2017cpo,brunke2022safe,ames2019cbf,folkestad2021koopman}. Projection and shielding can repair infeasible actions under appropriate feasibility assumptions. They explain how a candidate command is corrected, but they do not explain why a particular residual covariance direction repeatedly creates larger correction burden.

CG-RVC therefore treats projection as downstream repair rather than as the source of the residual metric. Reducing certificate-weighted residual covariance can lower the probability or magnitude of large corrections, while projection supplies the feasibility repair. This separation distinguishes upstream residual source shaping from downstream constraint handling and makes projection burden an outcome to be explained, not merely a post-processing step.

\subsection{Local Surrogates and Certificate Pullback Metrics}
Local linearization, EDMDc/Koopman dictionaries, data-driven modeling, and system identification provide routes to the local surrogates used in this paper \cite{brunton2022koopman,tabassum2023koopman,zheng2024system,maleki2024identification}. These tools provide the objects needed by the source-amplifier chain: a closed-loop matrix, an input channel, and a coordinate system in which covariance propagation is analyzable. By themselves, however, they do not specify which residual-action covariance directions should be penalized during actor training.

Certificate-based local models add the final ingredient. Koopman-CBF and related safe-learning constructions connect lifted models to stability or safety certificates \cite{folkestad2021koopman,brunke2022safe}. CG-RVC uses certificate information as a trainable action-space metric: it pulls the state-side certificate back through $\Phi_u$ to obtain $M=\Phi_u^\top P\Phi_u$, a residual-action covariance metric that identifies amplified and safety-relevant residual directions.

\subsection{Positioning Summary}
The literature covers the individual pieces of the chain: source-side action smoothing, nonnormal amplification, covariance propagation, data-driven local surrogates, certificates, and safety filters. The gap addressed here is the integrated path
\[
\Sigma_r \rightarrow \Phi_u \rightarrow \Kcl \rightarrow P \rightarrow M,
\]
where residual covariance is treated as the source, the local nonnormal surrogate is treated as the amplifier, and the certificate is pulled back to action space as a direction-aware training penalty. CG-RVC closes this path at the algorithmic level by combining the pullback metric with execution repair and posterior diagnostics.

Several implemented comparators are named by their experimental role rather than by the cited paper family. Table~\ref{tab:mechanism_mapping} states this mapping explicitly. The point is not that each baseline is an exact reimplementation of a specific prior paper; rather, each row isolates the same mechanism class under the same task, budget, and logging protocol.

\begin{table*}[t]
\caption{Mapping from the source-amplifier-risk chain to implemented comparators.}
\label{tab:mechanism_mapping}
\centering
\scriptsize
\setlength{\tabcolsep}{3pt}
\resizebox{\textwidth}{!}{%
\begin{tabular}{p{0.22\textwidth}p{0.24\textwidth}p{0.28\textwidth}p{0.18\textwidth}}
\toprule
Chain component & Representative prior work & Implemented comparator(s) & Question tested \\
\midrule
Penalty-based constrained RL & CPO and penalty-style safe RL \cite{achiam2017cpo,brunke2022safe} & PPO-Penalty & Whether a fixed safety penalty is enough under high noise \\
Lagrangian constrained RL & Lagrangian safe policy optimization \cite{achiam2017cpo,brunke2022safe} & PPO-Lagrangian; SAC-Lagrangian & Whether learned dual penalties control violations and residual energy \\
Source-side action regularization & Control regularization, CAPS, smooth exploration, and action alignment \cite{cheng2019control,mysore2021caps,raffin2022smooth,piao2022smooth,kwak2026smooth} & TD3 + action-diff penalty; TD3 + low-pass only; TD3 + plain Var($u$) & Whether Euclidean or temporal smoothing explains the gains \\
Downstream safety repair & CBF and Koopman-CBF safety filters \cite{ames2019cbf,folkestad2021koopman} & TD3 + projection only; Shielded SAC & Whether execution-time repair alone is sufficient \\
Local surrogate and certificate pullback & Local surrogate modeling and Lyapunov safe learning \cite{brunton2022koopman,tabassum2023koopman,zheng2024system} & P-ALE only; P-ALE + smoothing; P-ALE + projection & Whether the certificate-guided source metric works without the full execution chain \\
Source-amplifier covariance geometry & Stochastic covariance control and source-amplifier analysis \cite{anderson1990optimal,zhou1996robust,chen2016covariance} & Full-pipeline metric replacement; MIMO directional source injection & Whether source direction, not only source magnitude, matters \\
\bottomrule
\end{tabular}
}
\end{table*}

\section{Modeling Chain and Certificate Model}

CG-RVC uses one modeling chain throughout the paper: nonlinear plant, local surrogate, raw nominal amplifier, projected certificate model, residual source metric, and execution layer. The purpose of this section is to make clear which object is physical, which object is local, and which object is used only for certificate construction.

The ingredients in this chain have different provenance. Residual-policy notation and action regularization follow common learning-based control practice \cite{cheng2019control,mysore2021caps,raffin2022smooth}; execution-time repair follows constrained and safety-filtered learning viewpoints \cite{achiam2017cpo,brunke2022safe,ames2019cbf,folkestad2021koopman}; and the local surrogate may be obtained from local linearization, EDMDc/Koopman modeling, DMD with control, or system identification \cite{williams2015edmd,proctor2016dmdc,korda2018koopman,brunton2022koopman,tabassum2023koopman,zheng2024system,maleki2024identification}. The paper-specific modeling step is to compose these standard objects into a residual source, local amplifier, certificate, and execution-layer chain, and then to use the certificate pullback as an action-space covariance metric.

\subsection{Nonlinear Residual Closed Loop}

The physical closed loop is the nonlinear system
\begin{equation}
x_{t+1}=f(x_t,u_t,d_t),
\label{eq:plant}
\end{equation}
where $x_t\in\R^n$ is the physical state, $u_t\in\R^m$ is the applied action, and $d_t$ represents external disturbance or model error. Given a nominal controller $u_{\mathrm{nom}}(x)$ and a learned residual policy $r_\theta(x)$, the pre-projection action is
\begin{equation}
u_t=u_{\mathrm{nom}}(x_t)+r_t,\qquad r_t=r_\theta(x_t).
\label{eq:residual_action}
\end{equation}
Rollout metrics, safety violations, and posterior residuals are evaluated on this nonlinear closed loop after the execution layer is applied.

\subsection{Local Lifted or Linearized Surrogate}

The certificate analysis is built in local coordinates
\begin{equation}
z_t=\psi(x_t),
\label{eq:lifting_map}
\end{equation}
where $\psi$ may be the identity, a local linearizing coordinate map, or an EDMDc/Koopman dictionary. EDMD, DMDc, and Koopman predictor constructions are standard ways to obtain finite-dimensional controlled predictors for nonlinear systems \cite{williams2015edmd,proctor2016dmdc,korda2018koopman,brunton2022koopman}. Thus ``Koopman'' is one possible construction of the local surrogate, not the main claim of the paper. In these coordinates, data fitting or local linearization gives the input-affine surrogate
\begin{equation}
z_{t+1}=K_0z_t+\Phi_u u_t+w_t.
\label{eq:local_surrogate}
\end{equation}
Here $K_0$ describes the local autonomous evolution, $\Phi_u$ is the residual-action input channel, and $w_t$ collects local disturbance and unresolved surrogate error. The input-channel notation is inherited from controlled surrogate modeling; the paper-specific use of $\Phi_u$ is to propagate residual-action covariance into the Lyapunov certificate metric. Every covariance statement below is a statement about this local $z$-system unless explicitly stated otherwise.

\subsection{Raw Nominal Amplifier}

The nominal controller induces the local closed-loop amplifier before any certificate projection is applied. When the nominal feedback is represented locally as $u_{\mathrm{nom}}=-Lz$, substituting it into \eqref{eq:local_surrogate} gives
\begin{equation}
\Kraw=K_0-\Phi_uL.
\label{eq:kraw}
\end{equation}
The matrix $\Kraw$ is the local nominal amplifier associated with the fitted or linearized model. It is the natural local model of the nominal closed-loop surrogate, but it may be unstable or too close to the unit circle to support the certificate used by CG-RVC. The term ``amplifier'' follows the nonmodal and pseudospectral interpretation of stable but nonnormal closed-loop dynamics \cite{trefethen1993hydrodynamic,trefethen2005spectra,schmid2007nonmodal,farrell1996generalized}.

\subsection{Projected Certificate Model}

CG-RVC constructs the Lyapunov certificate on a projected matrix
\begin{equation}
\Kproj=\Proj(\Kraw),\qquad \rho(\Kproj)\le\beta<1.
\label{eq:kproj}
\end{equation}
The projection is a certificate-construction step. It creates the matrix used in the local Lyapunov and covariance analysis; rollout evaluation remains on the nonlinear closed-loop simulator. The scalar $\beta$ is a target spectral-radius upper bound, distinct from a norm contraction certificate. Spectral-radius contraction, Euclidean contraction, and $P$-weighted Lyapunov contraction are different standard notions in robust and optimal control \cite{anderson1990optimal,zhou1996robust}:
\begin{equation}
\rho(K)\le \beta,\qquad
\|K\|_2\le\beta,\qquad
K^\top P K\preceq \beta^2P.
\label{eq:three_contractions}
\end{equation}
This distinction is essential for nonnormal systems: $\rho(K)<1$ does not preclude transient amplification \cite{trefethen2005spectra,schmid2007nonmodal}.

Replacing $\Kraw$ by $\Kproj$ creates local mismatch. A convenient bridge from the raw local surrogate to the certificate model is
\begin{align}
z_{t+1}
&=\Kproj z_t+\Phi_u\xi_t+w_t+e_t,\label{eq:mismatch_bridge}\\
e_t
&=\bar e(z_t)+\tilde e_t,\label{eq:mismatch_split}\\
\bar e(z_t)
&=(\Kraw-\Kproj)z_t+\bar e_{\mathrm{id}}(z_t)+\bar e_{\mathrm{nl}}(z_t).
\label{eq:mismatch_components}
\end{align}
The bias $\bar e(z_t)$ contains the deterministic projection mismatch and the mean components of the local identification and nonlinear residual errors. The centered fluctuation $\tilde e_t$ contains the stochastic part of the local mismatch. Thus the projection error is not assumed to be zero-mean noise; the centered mismatch theorem in Section~IV bounds $\tilde e_t$, and the biased component is handled by an explicit Young-inequality bound.

\subsection{Residual Source Versus Residual Feedback}

The residual action can play two different local roles. Its centered fluctuation is the source whose covariance is regularized:
\begin{equation}
r_\theta(z_t)=\bar r_\theta(z_t)+\xi_t,\qquad
\E[\xi_t\mid z_t]=0.
\label{eq:residual_source_decomp_intro}
\end{equation}
For deterministic actors, $\xi_t$ is interpreted as centered residual variation over a local rollout ensemble or minibatch, rather than as exogenous white noise at a fixed state.
If the deterministic residual feedback is locally approximated by $\bar r_\theta(z)\approx J_rz$, then the actor-augmented local amplifier is
\begin{equation}
K_\theta=\Kproj+\Phi_uJ_r.
\label{eq:ktheta_intro}
\end{equation}
Only $\xi_t$ is treated as the source term in the covariance decomposition. The feedback component belongs in the amplifier if its Jacobian is estimated; otherwise the source-only interpretation is diagnostic and is checked by posterior Bellman-Lyapunov residuals.

\begin{table}[t]
\caption{Object map from the nonlinear plant to the local source-amplifier analysis.}
\label{tab:object_map}
\centering
\footnotesize
\begin{tabular}{p{0.24\linewidth}p{0.66\linewidth}}
\toprule
Object & Role in the paper \\
\midrule
Physical plant $(x,u)$ & Nonlinear system used for rollout evaluation and safety metrics. \\
Local coordinate $z=\psi(x)$ & Lifted, identity, or linearized coordinate used only for local surrogate analysis. \\
Surrogate $(K_0,\Phi_u)$ & Local input-affine model; $\Phi_u$ is the residual-action input channel. \\
Raw amplifier $\Kraw$ & Local nominal closed-loop surrogate before certificate projection. \\
Certificate amplifier $\Kproj$ & Projected stable matrix used in Lyapunov and covariance bounds. \\
Residual source $\xi_t$ & Centered residual fluctuation whose covariance is regularized. \\
Actor-augmented amplifier $K_\theta$ & Diagnostic local amplifier when residual feedback is folded into the certificate model. \\
Execution layer & Smoothing, rate limiting, and safety projection; nonlinear unless explicitly augmented. \\
\bottomrule
\end{tabular}
\end{table}

\section{Nonnormal Source-Amplifier Theory}

This section states the source-amplifier results used by CG-RVC. The generic source input matrix is denoted by $\Bs$. CG-RVC is obtained by the specialization $K=\Kproj$, $\Bs=\Phi_u$, and $\xi_t$ equal to the centered residual fluctuation defined in Section~III. For readability, the main text keeps the assumptions, bounds, and their role in the method; algebraic proofs and standard Lyapunov-drift derivations are collected in Appendix~\ref{app:proofs}.

The mathematical ingredients are not all new. Discrete Lyapunov equations, stationary covariance formulas, and stochastic Lyapunov drift bounds are standard tools for linear stochastic systems and robust or optimal control \cite{anderson1990optimal,zhou1996robust}. Covariance control and covariance steering treat covariance as a control object rather than merely a diagnostic \cite{hotz1987covariance,chen2016covariance}. Nonnormal transient amplification is classical in pseudospectral and nonmodal stability theory \cite{trefethen1993hydrodynamic,trefethen2005spectra,schmid2007nonmodal,farrell1996generalized}, and stochastic-forcing studies show that stable nonnormal dynamics can maintain large variance under small random inputs \cite{farrell1994variance,bamieh2001energy,jovanovic2005componentwise}. The paper-specific contribution is the specialization and combination: treating residual-action covariance as the source, using the local learned closed-loop surrogate as the amplifier, separating residual feedback from residual fluctuation, pulling the certificate back to action space, and connecting the resulting metric to projection burden in residual learned controllers.

\subsection{Source-Amplifier Covariance Decomposition}

Consider the generic local stochastic model
\begin{equation}
z_{t+1}=Kz_t+\Bs\xi_t+w_t,
\label{eq:stochastic_loop}
\end{equation}
where $\xi_t$ is a centered source fluctuation and $w_t$ is external disturbance or model error. Assume
\begin{equation}
\E[\xi_t]=0,\quad \E[w_t]=0,\quad
\E[\xi_t\xi_t^\top]=\Sigma_a,\quad \E[w_tw_t^\top]=W,
\label{eq:stochastic_assumptions}
\end{equation}
and that $\xi_t$ and $w_t$ are conditionally uncorrelated with the past and have no cross covariance. Define
\begin{equation}
Q_{\mathrm{src}}=\Bs\Sigma_a\Bs^\top+W.
\label{eq:qsrc}
\end{equation}
The next result is the standard stationary covariance solution of a Schur-stable linear stochastic system, written here in source-amplifier notation \cite{anderson1990optimal,zhou1996robust,hotz1987covariance,chen2016covariance}.

\begin{theorem}[Discrete Source-Amplifier Decomposition]
\label{thm:source_amplifier}
If $K$ is Schur stable, then the stationary covariance exists, is unique, and satisfies
\begin{align}
\Sigma_z
&=\sum_{i=0}^{\infty}K^iQ_{\mathrm{src}}(K^i)^\top \nonumber\\
&=\mathcal L_{K}(W)+
\mathcal L_{K}(\Bs\Sigma_a\Bs^\top).
\label{eq:source_amplifier}
\end{align}
\end{theorem}
Thus source variance is not state variance itself; it is propagated through the closed-loop amplifier $\mathcal L_K$.

\begin{proposition}[Action-Covariance Monotonicity]
\label{prop:monotonicity}
Fix $K$, $\Bs$, and $W$. If $\Sigma_a^{(1)}\preceq \Sigma_a^{(2)}$, then $\Sigma_z^{(1)}\preceq \Sigma_z^{(2)}$.
\end{proposition}
This monotonicity statement follows from positivity of the discrete Lyapunov operator and is valid only when the amplifier is fixed.

\subsection{Nonnormal Amplification Bound}

\begin{proposition}[Nonnormal Covariance Amplification]
\label{prop:nonnormal_bound}
If $K=V\Lambda V^{-1}$ is diagonalizable, then
\begin{equation}
\|\Sigma_z\|_2
\le
\frac{\kappa_2(V)^2}{1-\rho(K)^2}
\|Q_{\mathrm{src}}\|_2.
\label{eq:nonnormal_bound}
\end{equation}
\end{proposition}
This elementary bound combines the discrete covariance expansion with diagonalization. Its role is interpretive: nonmodal and pseudospectral theory show why a stable nonnormal matrix can have large transient response, and stochastic-forcing analyses show the corresponding variance-amplification effect under random inputs \cite{trefethen1993hydrodynamic,trefethen2005spectra,schmid2007nonmodal,farrell1994variance,bamieh2001energy,jovanovic2005componentwise}. For a normal matrix $\kappa_2(V)=1$; for a nonnormal matrix, the same source may be amplified substantially. This is a worst-case bound and can become very loose when $\kappa(V)$ is large, so it should be read as a mechanism bound rather than a precise covariance predictor.

\subsection[P-Weighted Residual Variance Propagation]{$P$-Weighted Residual Variance Propagation}

Consider
\begin{equation}
z_{t+1}=Kz_t+\Bs\xi_t+w_t.
\label{eq:p_weighted_loop}
\end{equation}
The following recursion is a standard stochastic Lyapunov drift argument \cite{anderson1990optimal,zhou1996robust}. The paper-specific step is the definition of the source metric $M_s$ and its specialization to residual action covariance. Let $P\succ0$ be a Lyapunov certificate for the local amplifier $K$ and define the measured $P$-metric contraction
\begin{equation}
\gP^2=
\lambda_{\max}\!\left(
P^{-1/2}K^\top PKP^{-1/2}
\right).
\label{eq:gamma_p}
\end{equation}
If $\gP<1$, then $K^\top PK\preceq \gP^2P$. In CG-RVC, the design parameter $\beta$ is only a spectral-radius projection target; all strict Lyapunov-energy bounds use the measured contraction $\gP$. If one explicitly solves $K^\top P K-\beta^2P=-Q$ with $Q\succ0$, then $\beta$ may replace $\gP$ in the same formulas.

Define
\begin{equation}
M_s:=\Bs^\top P\Bs,
\label{eq:generic_source_metric}
\end{equation}
and $V(z)=z^\top Pz$. Under the source interpretation with $\E[\xi_t]=0$, $\E[\xi_t\xi_t^\top]=\Sigma_r$, and conditional orthogonality,
\begin{equation}
\E[V(z_{t+1})]
\le
\gP^2\E[V(z_t)]
+\tr(M_s\Sigma_r)+\tr(PW).
\label{eq:p_recursion}
\end{equation}
The stationary limit obeys
\begin{equation}
\E[V(z)]
\le
\frac{\tr(M_s\Sigma_r)+\tr(PW)}
{1-\gP^2}.
\label{eq:p_bound}
\end{equation}
For CG-RVC, $K=\Kproj$, $\Bs=\Phi_u$, and the generic metric pulls back to the residual-action space as
\begin{equation}
M:=\Phi_u^\top P\Phi_u.
\label{eq:ale_matrix}
\end{equation}
The actor-dependent part is the $P$-weighted residual source term. We define the empirical action Lyapunov energy (ALE) penalty as
\begin{equation}
\ALEP(\theta)=
\frac{\tr\!\left(M\widehat\Sigma_r(\theta)\right)}{1-\gP^2}.
\label{eq:ale_p}
\end{equation}
The Euclidean degeneration is
\begin{equation}
\ALEI(\theta)=
\frac{\tr\!\left(\Phi_u\widehat\Sigma_r(\theta)\Phi_u^\top\right)}{1-\gP^2}.
\label{eq:ale_i}
\end{equation}
The denominator can be absorbed into the regularization weight when $P$ and $\gP$ are fixed during an actor update. We keep it explicit because it exposes the robustness-performance scaling. The $P$-weighted ALE term suppresses a certificate-weighted residual source proxy. It does not directly reduce nonnormality.

Thus \eqref{eq:ale_matrix} should be read as the paper's synthesis step: standard covariance propagation and Lyapunov certificates are applied to a controlled local surrogate, and the certificate is pulled back through the residual input channel to obtain an anisotropic residual-action covariance metric.

\subsection{Residual Feedback Versus Source Fluctuation}

The actor residual is generally state-dependent rather than a state-independent white disturbance. Locally decompose it as
\begin{equation}
r_\theta(z_t)=\bar r_\theta(z_t)+\xi_t,
\label{eq:residual_feedback_decomp}
\end{equation}
where $\bar r_\theta$ is the deterministic feedback component and $\xi_t$ is a centered fluctuation around that component. If $\bar r_\theta(z)\approx J_rz$ locally, the amplifier becomes
\begin{equation}
K_\theta=K+\Bs J_r,
\label{eq:actor_amplifier}
\end{equation}
which specializes to $K_\theta=\Kproj+\Phi_uJ_r$ for CG-RVC. Only $\xi_t$ should then be interpreted as the source covariance term. If the residual feedback Jacobian is not estimated, the one-step Lyapunov expansion contains the cross term
\begin{equation}
2\E[z_t^\top K^\top P\Bs r_t],
\label{eq:cross_term}
\end{equation}
which cannot be discarded by the source-noise argument. A conservative alternative is Young's inequality: for any $\eta>0$,
\begin{equation}
2a^\top b\le \eta a^\top a+\eta^{-1}b^\top b.
\label{eq:young_cross}
\end{equation}
Thus the source-amplifier interpretation is exact for exogenous residual fluctuations and diagnostic for state-dependent residual policies unless the feedback component is explicitly folded into the amplifier. Posterior Bellman-Lyapunov residuals report when the local source-only interpretation is violated in rollouts.

\subsection{Colored Input and First-Order Filter Augmentation}
\label{sec:colored_input_aug}

A first-order smoothed residual source is colored rather than white. Consider a source generated by a stable causal filter,
\begin{equation}
y_{t+1}=\alpha y_t+(1-\alpha)\epsilon_{t+1},\qquad
z_{t+1}=Kz_t+\Bs y_t+w_t.
\label{eq:colored_input}
\end{equation}
With augmented state $\bar z_t=[z_t^\top,y_t^\top]^\top$,
\begin{equation}
\bar z_{t+1}=
\begin{bmatrix}
K & \Bs\\
0 & \alpha I
\end{bmatrix}\bar z_t+
\begin{bmatrix}
0\\
(1-\alpha)I
\end{bmatrix}\epsilon_{t+1}+
\begin{bmatrix}
I\\0
\end{bmatrix}w_t.
\label{eq:augmented_filter}
\end{equation}
This is the standard state-augmentation way to analyze filtered inputs in linear systems \cite{anderson1990optimal,zhou1996robust}; it is included because action smoothing and low-pass execution are common source-side interventions in continuous-control RL \cite{mysore2021caps,raffin2022smooth,piao2022smooth}. Thus a filtered residual should not be analyzed by the white-source monotonicity result for $(K,\Bs)$ alone. The physical amplifier $K$ may be unchanged, but the effective source statistics and temporal spectrum are changed by the filter. If $\epsilon_t$ is white,
\begin{equation}
\Sigma_y=\frac{1-\alpha}{1+\alpha}\Sigma_\epsilon,
\label{eq:filter_variance}
\end{equation}
showing source-side variance reduction. The resulting state covariance still depends on the augmented system, input directions, and model mismatch.

\subsection{Robust Propagation under Lifted Nonlinear Mismatch}

The preceding equations are exact for the chosen local stochastic model. The following mismatch bounds are the paper's local robustness extension of the stochastic Lyapunov drift calculation, motivated by the fact that Koopman/EDMDc, DMDc, or identified local models are approximate surrogates \cite{williams2015edmd,proctor2016dmdc,korda2018koopman,brunton2022koopman,tabassum2023koopman,zheng2024system,maleki2024identification}. To connect them to the lifted nonlinear rollout dynamics, include the mismatch split introduced in \eqref{eq:mismatch_split}:
\begin{equation}
z_{t+1}=Kz_t+\Bs\xi_t+w_t+\bar e(z_t)+\tilde e_t.
\label{eq:mismatch_dynamics}
\end{equation}
For CG-RVC, $K=\Kproj$ and $\Bs=\Phi_u$; the bias $\bar e(z_t)$ includes projection mismatch and mean lifted-model error, while $\tilde e_t$ is the centered stochastic mismatch.

\begin{assumption}[Bounded Conditional Centered Lifted Mismatch]
\label{assump:mismatch}
Let $\mathcal F_t$ be the history up to time $t$. For the centered dynamics obtained from \eqref{eq:mismatch_dynamics} by setting $\bar e(z_t)\equiv0$, assume
\begin{equation}
\E[\xi_t\mid\mathcal F_t]=0,
\quad
\E[w_t\mid\mathcal F_t]=0,
\quad
\E[\tilde e_t\mid\mathcal F_t]=0,
\end{equation}
with conditional second-moment bounds
\begin{align}
\E[\xi_t\xi_t^\top\mid\mathcal F_t]&\preceq\Sigma_r,\\
\E[w_tw_t^\top\mid\mathcal F_t]&\preceq W,\\
\E[\tilde e_t\tilde e_t^\top\mid\mathcal F_t]&\preceq\Sigma_e.
\end{align}
The three centered sources are conditionally second-order uncorrelated, and $K^\top PK\preceq\gP^2P$ with $\gP<1$.
\end{assumption}

\begin{theorem}[Robust Variance Propagation under Lifted Nonlinear Mismatch]
\label{thm:robust_mismatch}
Under Assumption~\ref{assump:mismatch}, define
\begin{equation}
q_r=\tr(M_s\Sigma_r),\qquad q_w=\tr(PW),\qquad q_e=\tr(P\Sigma_e).
\end{equation}
Then
\begin{equation}
\E[V(z_t)]\le
\gP^{2t}\E[V(z_0)]
+\frac{1-\gP^{2t}}{1-\gP^2}(q_r+q_w+q_e).
\label{eq:robust_finite_time}
\end{equation}
Consequently,
\begin{equation}
\limsup_{t\to\infty}\E[V(z_t)]
\le
\frac{
\tr(M_s\Sigma_r)+\tr(PW)+\tr(P\Sigma_e)
}{1-\gP^2}.
\label{eq:robust_mismatch_bound}
\end{equation}
\end{theorem}
For CG-RVC, $M_s=M=\Phi_u^\top P\Phi_u$, so the residual-source term in Theorem~\ref{thm:robust_mismatch} is the same certificate-weighted metric used in the actor objective.

\begin{remark}[Biased Projection and Model Mismatch]
The projection term $(\Kraw-\Kproj)z_t$ can be a deterministic state-dependent bias, so it is not covered by the zero-mean condition on $\tilde e_t$. If the full dynamics \eqref{eq:mismatch_dynamics} retain $\bar e(z_t)$, then for any $\eta>0$,
\begin{equation}
\|Kz_t+\bar e(z_t)\|_P^2
\le
(1+\eta)\|Kz_t\|_P^2
+(1+\eta^{-1})\|\bar e(z_t)\|_P^2.
\label{eq:biased_mismatch_young}
\end{equation}
Hence the one-step recursion becomes
\begin{align}
\E[V(z_{t+1})]
&\le
(1+\eta)\gP^2\E[V(z_t)]
+q_r+q_w+q_e \nonumber\\
&\quad +(1+\eta^{-1})\E[\|\bar e(z_t)\|_P^2].
\label{eq:biased_mismatch_recursion}
\end{align}
If $(1+\eta)\gP^2<1$ and $\E[\|\bar e(z_t)\|_P^2]\le b_e$ in the local operating domain, the stationary bound is obtained by replacing the denominator with $1-(1+\eta)\gP^2$ and adding $(1+\eta^{-1})b_e$ to the numerator. This is the biased counterpart of Theorem~\ref{thm:robust_mismatch}.
\end{remark}

\begin{corollary}[Scalar Mismatch and Physical-Space Dispersion]
\label{cor:physical_dispersion}
If $\Sigma_e\preceq \epsilon I$, then $\tr(P\Sigma_e)\le\epsilon\tr(P)$. If additionally $\psi$ is locally inverse-Lipschitz around $x^\star$, i.e., $\|\psi(x)-\psi(x^\star)\|_2\ge \ell_\psi\|x-x^\star\|_2$, then
\begin{equation}
\limsup_{t\to\infty}\E[\|x_t-x^\star\|_2^2]
\le
\frac{
\tr(M_s\Sigma_r)+\tr(PW)+\epsilon\tr(P)
}{
\ell_\psi^2(1-\gP^2)\lambda_{\min}(P)
}.
\label{eq:physical_dispersion_bound}
\end{equation}
\end{corollary}

\begin{remark}[Correlated Source and Mismatch]
The conditional uncorrelatedness assumption can be relaxed. Let $s_t=[\xi_t^\top,w_t^\top,\tilde e_t^\top]^\top$ and $B=[\Bs\; I\; I]$. If $\E[s_t\mid\mathcal F_t]=0$ and $\E[s_ts_t^\top\mid\mathcal F_t]\preceq\Sigma_s$, then
\begin{equation}
\limsup_{t\to\infty}\E[V(z_t)]
\le
\frac{\tr(B^\top PB\Sigma_s)}{1-\gP^2}.
\label{eq:block_covariance_bound}
\end{equation}
This block-covariance form covers cross-covariance between residual fluctuation, disturbance, and centered lifted mismatch.
\end{remark}

\begin{remark}[Nonnormal Amplification of Mismatch]
If $P$ solves $K^\top PK-P=-Q$ with $Q\succ0$, then
\begin{equation}
P=\sum_{k=0}^{\infty}(K^k)^\top QK^k.
\label{eq:p_gramian_expansion}
\end{equation}
Therefore
\begin{equation}
\tr(P\Sigma_e)=
\sum_{k=0}^{\infty}
\tr\!\left(QK^k\Sigma_e(K^k)^\top\right).
\end{equation}
Even small Euclidean model error can produce large Lyapunov-energy error if it aligns with transient high-gain directions of a nonnormal $K$.
\end{remark}

\subsection{Projection and Feasible-Tube Consequences}

The safety projection layer and the P-ALE penalty play different roles. Projection and shielding are standard downstream repair mechanisms in safe learning and CBF-based control \cite{achiam2017cpo,brunke2022safe,ames2019cbf,folkestad2021koopman}; Euclidean projection and error-bound tools are classical convex-analysis ingredients \cite{hoffman1952approximate,bauschke2011convex}. Projection can enforce one-step feasibility only when the local safe-action set is nonempty and recursively feasible. P-ALE does not create such feasibility. Instead, by reducing certificate-weighted residual covariance, it reduces the probability and expected size of large projection corrections. This separation is paper-specific: projection is the feasibility repair layer, while P-ALE is the upstream source-shaping mechanism that makes that repair layer work less aggressively.

The execution-time action used by CG-RVC is written as
\begin{equation}
u_t^{\mathrm{pre}}=u_{\mathrm{nom}}(x_t)+r_t,
\qquad
u_t^{\mathrm{safe}}=
\argmin_{u\in\widehat{\mathcal U}_{\mathrm{safe}}(x_t)}
\|u-u_t^{\mathrm{pre}}\|_2^2.
\label{eq:safe_action}
\end{equation}
Appendix~\ref{app:projection_bounds} states the recursive-feasibility condition, barrier-edge hitting bound, Hoffman projection-burden bound, and feasible-tube probability calculation. These results quantify how P-ALE reduces projection burden under the stated feasibility assumptions.

\subsection{Sampling Time and the Contraction Factor}

Given a continuous-time decay rate $\alpha_c>0$ and sample time $T_s$, one may set $\beta=e^{-\alpha_cT_s}$ as a spectral-radius projection target. If the target is to reduce error to a fraction $\varepsilon$ within $T_{\mathrm{settle}}$, then
\begin{equation}
\beta=\varepsilon^{T_s/T_{\mathrm{settle}}}.
\label{eq:beta_design}
\end{equation}
For example, $T_s=0.5$ s and a 10-second decay to 5\% give $\beta\approx0.861$. This target does not by itself imply $P$-metric contraction. After projection, the actual diagnostic for Lyapunov-energy bounds is $\gP$ in \eqref{eq:gamma_p}, together with projection cost, $\kappa(V)$, peak transient gain, and posterior residuals.

\section{Certificate-Guided Residual Variance Control}

CG-RVC turns the modeling chain in Section~III into two loops. A slow certificate-refresh loop fits the local surrogate, builds the projected certificate model, solves for $P$, and constructs the pullback metric. A high-rate execution loop evaluates the residual actor, applies residual shaping and rate limits, projects unsafe actions when needed, and logs posterior diagnostics.

\subsection{Reinforcement-Learning Backbone and Residual Interface}

CG-RVC is an actor--critic residual-learning wrapper around reinforcement learning. The reported implementation uses TD3 as the off-policy backbone \cite{fujimoto2018td3}: the replay buffer stores transitions generated by the applied safe action, the twin critics use the ordinary Bellman critic loss, and the delayed actor update keeps the TD3 return term while adding the certificate-weighted residual-covariance and temporal-smoothness terms in \eqref{eq:actor_objective}.

The learned network parameterizes a residual target $r_\theta(z)$ around the nominal controller. The environment receives the nominal action plus this residual after smoothing, rate limiting, and safety projection. Thus temporal credit assignment and policy improvement remain standard actor--critic operations, while CG-RVC adds the source-side metric, certificate refresh, execution layer, and posterior diagnostics.

This separation is important for interpreting the algorithm. During each actor update, the current critic, local surrogate, certificate, and sampled replay distribution are treated as fixed. At a slower refresh cadence, rollout data refit or update $(K_0,\Phi_u)$, recompute $\Kraw$, $\Kproj$, $P$, $\gP$, and $M$, and then change the regularizer used by later actor updates. Other deterministic or stochastic actor--critic backbones could use the same interface if their actor update can accept a residual-covariance penalty and their rollout loop can apply the execution layer.

\subsection{Implementation of the Local Surrogate}

Following the modeling chain in Section~III, CG-RVC only requires a local input-affine surrogate of the form \eqref{eq:local_surrogate}. The implementation specifies the observable map $\psi$, the fitted state matrix $K_0$, and the residual input channel $\Phi_u$. The observable map $\psi$ may include raw states, local Jacobian features around a working point or nominal trajectory, and a small set of low-order nonlinear dictionary terms. In an EDMDc implementation, one solves
\begin{equation}
\min_{K_0,\Phi_u}\sum_t
\|z_{t+1}-K_0z_t-\Phi_u u_t\|_2^2
+\lambda_{\mathrm{id}}\left(\|K_0\|_F^2+\|\Phi_u\|_F^2\right).
\label{eq:edmdc}
\end{equation}
Observable selection affects certificate reliability. The reported studies use task-specific local constructions and posterior residual diagnostics rather than assuming a globally complete observable dictionary.

\subsection{Stable Projection and Lyapunov Certificate}

Given $\Kraw$ and target $\beta$, the projection
\begin{equation}
\Kproj=\Proj(\Kraw)
\label{eq:projection_operator}
\end{equation}
maps the spectral radius below $\beta$. The projection $\Proj$ may be implemented by eigenvalue clipping, global scaling, or a nearest-stable approximation. The reported method-component comparison uses eigenvalue clipping: eigenvalues with modulus larger than $\beta$ are radially clipped while preserving their directions, and the projection cost plus post-projection spectral radius are logged. This practical stabilization heuristic controls the spectral-radius target; separate diagnostics track Euclidean contraction and transient-gain reduction in nonnormal systems. If $\Kraw$ is already inside the spectral-radius target, the projection is the identity. The discrete Lyapunov equation
\begin{equation}
\Kproj^\top P\Kproj-P=-Q,\qquad Q\succ0,
\label{eq:lyapunov_certificate}
\end{equation}
defines the certificate. The actual contraction used in the bound is the measured $\gP$ in \eqref{eq:gamma_p}, not the design target $\beta$. The diagnostics include $P$, $\rho(\Kraw)$, $\rho(\Kproj)$, projection cost, $\kappa(V)$, peak transient gain, $\gP$, and posterior residuals.

\subsection{Actor Objective}

The critics are trained by the TD3 Bellman objective; CG-RVC modifies the actor side and the execution layer. For deterministic policy improvement, the actor still ascends the critic-predicted return, but the residual component is also penalized in the certificate-induced metric that Section~IV connects to source-amplifier covariance propagation.

The actor objective is
\begin{align}
\min_\theta\; &
-\E Q_{\varphi,1}(s,\pi_\theta(s))
+\lambda_{\mathrm{ALE}}\ALEP(\theta)
\nonumber\\
&+\lambda_{\Delta u}
\E\|\pi_\theta(s')-\pi_\theta(s)\|^2 .
\label{eq:actor_objective}
\end{align}
Here
\begin{equation}
\widehat\Sigma_r(\theta)=
\frac1N\sum_{i=1}^N
\left(r_\theta(z_i)-\bar r_\theta\right)
\left(r_\theta(z_i)-\bar r_\theta\right)^\top,
\label{eq:residual_cov}
\end{equation}
where the covariance is computed over a local minibatch or rollout ensemble. For a stochastic residual policy, this estimate can approximate the conditional source covariance in the local stochastic model. For the deterministic TD3 actors used in the experiments, it is a local ensemble covariance proxy: it penalizes variation of residual outputs across nearby sampled states in the operating distribution, not exogenous white noise at one fixed state.

The source-amplifier theory supplies the certificate-induced metric and scaling, while posterior Bellman--Lyapunov residuals diagnose when this empirical proxy fails to describe rollout behavior. The term $\ALEP$ is defined in \eqref{eq:ale_p}. The disturbance term $\tr(PW)/(1-\gP^2)$ is omitted from the actor loss because it is constant with respect to $\theta$ during an update. The ALE term penalizes residual covariance through $M=\Phi_u^\top P\Phi_u$, so anisotropic certificate directions are weighted differently from ordinary Euclidean action smoothing.

For the stationarity analysis, write the complete smooth actor-ascent objective as
\begin{equation}
F_{\mathrm{CG}}(\theta)
=J(\theta)-\lambda_{\mathrm{ALE}}\mathcal R_P(\theta)
-\lambda_{\Delta u}\mathcal R_{\Delta u}(\theta),
\label{eq:regularized_actor_objective}
\end{equation}
where $J(\theta)=\E_s[Q_{\varphi,1}(s,\pi_\theta(s))]$, $\mathcal R_P(\theta)=\tr(M\Sigma_r(\theta))/(1-\gP^2)$, and $\mathcal R_{\Delta u}(\theta)=\E\|\pi_\theta(s')-\pi_\theta(s)\|^2$. The temporal action-difference term is retained as an auxiliary smoothness term. For a minibatch $\{z_i\}_{i=1}^N$, write $r_i=r_\theta(z_i)$, $\bar r=N^{-1}\sum_i r_i$, and $J_i(\theta)=\partial r_\theta(z_i)/\partial\theta$. Then the P-ALE gradient component is
\begin{equation}
\nabla_\theta\widehat{\mathcal R}_P(\theta)=
\frac{2}{N(1-\gP^2)}
\sum_{i=1}^N J_i(\theta)^\top M(r_i-\bar r).
\label{eq:rp_gradient}
\end{equation}
The following analysis makes explicit what the actor update optimizes: it converges to a stationary point of the regularized surrogate actor objective, rather than to the optimizer of the unregularized return. Thus CG-RVC should be interpreted as solving a robustness-weighted residual-control problem.

\begin{assumption}[Frozen-Step Smooth Actor Update]
\label{assump:actor_smooth}
During the actor-update analysis, the critic, local surrogate, certificate, and minibatch distribution are fixed. The parameter set is compact. $F_{\mathrm{CG}}$ is differentiable with Lipschitz gradient. Stochastic actor-gradient estimates $g_t$ satisfy $\E[g_t\mid\theta_t]=\nabla F_{\mathrm{CG}}(\theta_t)$ and $\E[\|g_t-\nabla F_{\mathrm{CG}}(\theta_t)\|_2^2\mid\theta_t]\le\sigma_g^2$.
\end{assumption}

\begin{proposition}[Stationarity of the Regularized Actor Step]
\label{prop:actor_convergence}
Under Assumption~\ref{assump:actor_smooth}, let $F_{\mathrm{CG}}$ be $L_{\mathrm{CG}}$-smooth and update $\theta_{t+1}=\theta_t+\eta g_t$ with $0<\eta\le 1/L_{\mathrm{CG}}$. Then
\begin{equation}
\frac1T\sum_{t=0}^{T-1}
\E[\|\nabla F_{\mathrm{CG}}(\theta_t)\|_2^2]
\le
\frac{2(F_{\mathrm{CG}}^\star-F_{\mathrm{CG}}(\theta_0))}{\eta T}
+L_{\mathrm{CG}}\eta\sigma_g^2.
\label{eq:actor_convergence_bound}
\end{equation}
With $\eta=\mathcal O(T^{-1/2})$, the average stationarity measure is $\mathcal O(T^{-1/2})$.
\end{proposition}

\emph{Proof sketch.} Apply the smooth ascent lemma to $F_{\mathrm{CG}}(\theta_{t+1})$ and take conditional expectation. Unbiasedness gives the positive drift term in $\|\nabla F_{\mathrm{CG}}(\theta_t)\|_2^2$, while the gradient-noise variance contributes the $L_{\mathrm{CG}}\eta\sigma_g^2$ term. Summing the drift inequality over $T$ actor steps gives \eqref{eq:actor_convergence_bound}. The full derivation is in Appendix~\ref{app:actor_optimization_bounds}.

\begin{proposition}[Nominal-Return Gap of the Regularized Actor]
\label{prop:suboptimality_gap}
Let $\theta^\star\in\argmax_\theta J(\theta)$ and $\theta_{\mathrm{CG}}\in\argmax_\theta F_{\mathrm{CG}}(\theta)$. If $\mathcal R_P(\theta)\ge0$, $\mathcal R_{\Delta u}(\theta)\ge0$, $\sup_\theta\|\Sigma_r(\theta)\|_F\le\bar\sigma_r$, and $\sup_\theta\mathcal R_{\Delta u}(\theta)\le\bar R_{\Delta u}$, then
\begin{equation}
J(\theta^\star)-J(\theta_{\mathrm{CG}})
\le
\lambda_{\mathrm{ALE}}
\frac{\|P\|_2\|\Phi_u\|_2^2\sqrt m}{1-\gP^2}
\bar\sigma_r
+\lambda_{\Delta u}\bar R_{\Delta u}.
\label{eq:suboptimality_gap}
\end{equation}
If the implemented policy $\widehat\theta_{\mathrm{CG}}$ has optimization error $\varepsilon_{\mathrm{opt}}$ and the true/surrogate return discrepancy is bounded by $\Delta_{mm}$, then
\begin{equation}
\begin{aligned}
&J_{\mathrm{true}}(\theta^\star)
-J_{\mathrm{true}}(\widehat\theta_{\mathrm{CG}})
\\
&\quad\le
\lambda_{\mathrm{ALE}}
\frac{\|P\|_2\|\Phi_u\|_2^2\sqrt m}{1-\gP^2}
\bar\sigma_r
+\lambda_{\Delta u}\bar R_{\Delta u}
\\
&\qquad
+\varepsilon_{\mathrm{opt}}+2\Delta_{mm}.
\end{aligned}
\label{eq:true_suboptimality_gap}
\end{equation}
\end{proposition}

Proposition~\ref{prop:suboptimality_gap} is the formal performance-robustness trade-off behind the algorithm. Larger $\lambda_{\mathrm{ALE}}$, larger certificate norm, stronger input-channel gain, weaker $P$-metric contraction, or a stronger temporal-smoothness penalty can improve source suppression or smooth execution but increase the possible gap to the unregularized nominal actor objective.

\subsection{Risk Signal, Execution Layer, Safety Projection, and Posterior Residual}
\label{subsec:risk_residual}

At execution time, the actor produces a residual target $r_t^{\mathrm{tar}}$. Risk-scheduled smoothing and rate limiting are
\begin{align}
\alpha_t&=\clip(\alpha_0+k_\alpha\rho_t,0,0.98), \nonumber\\
\delta_t&=\frac{\delta_0}{1+k_\delta\rho_t},
\label{eq:risk_schedule}
\end{align}
\begin{align}
\tilde r_t&=\alpha_t r_{t-1}+(1-\alpha_t)r_t^{\mathrm{tar}}, \nonumber\\
r_t&=r_{t-1}+\clip(\tilde r_t-r_{t-1},-\delta_t,\delta_t).
\label{eq:residual_smoothing}
\end{align}
The risk signal is
\begin{equation}
\rho_t=\clip(\rho_t^V+c_b\rho_t^B,0,1),
\label{eq:risk_signal}
\end{equation}
where $\rho_t^V$ is a causal Lyapunov-risk signal and $\rho_t^B$ is a barrier-margin deficit. The implementation distinguishes predictive risk available before choosing $u_t$, previous-step posterior feedback such as $\mathcal B_{t-1}$, and posterior diagnostics computed after observing $z_{t+1}$. The current action cannot depend on the future posterior residual $\mathcal B_t$.

For fixed $\alpha_t=\alpha$, no clipping, and no projection, the smoothing layer has the augmented state $\bar z_t=[z_t^\top,r_{t-1}^\top]^\top$ and obeys
\begin{align}
z_{t+1}&=Kz_t+\Phi_u\alpha r_{t-1}
+\Phi_u(1-\alpha)r_t^{\mathrm{tar}}+w_t,\nonumber\\
r_t&=\alpha r_{t-1}+(1-\alpha)r_t^{\mathrm{tar}}.
\label{eq:execution_augmented}
\end{align}
Rate limiting, risk scheduling, clipping, and safety projection make the actual execution layer nonlinear. They are execution-layer shaping and feasibility operations. The certificate defines the residual covariance metric and diagnostics, while \eqref{eq:safe_action} is the execution-time projection used to repair the applied action when a local safe-action approximation is available.

The posterior Bellman-Lyapunov residual is
\begin{equation}
\mathcal B_t=
\left[
V(z_{t+1})-\gP^2V(z_t)
-\tr(M\Sigma_{r,t})
-\tr(PW)
\right]_+.
\label{eq:posterior_residual}
\end{equation}
We report trajectory averages and maxima. This residual diagnoses violations of the certificate prediction during actual rollouts.

\subsection{Algorithmic Summary and Reproducibility Details}

Algorithm~\ref{alg:cgrvc} is written as an implementation-level off-policy training loop. The certificate update is a deterministic subroutine: fit $(K_0,\Phi_u)$ from a recent data window, form $\Kraw$, project to $\Kproj$, solve the discrete Lyapunov equation, compute $\gP$, and set $M=\Phi_u^\top P\Phi_u$. The online loop is otherwise a standard TD3 loop with residual-action post-processing and periodic certificate refresh.

\begin{algorithm}[H]
\caption{Implementation-Level CG-RVC with TD3 Backbone}
\label{alg:cgrvc}
\small
\begin{algorithmic}[1]
\Require environment, total steps $T$, warm-up steps $N_0$, replay buffer $\mathcal B$, batch size $N_b$, discount $\gamma_{\mathrm{RL}}$, TD3 delay $d_\pi$, certificate period $H_c$, lifting map $\psi$, nominal controller $u_{\mathrm{nom}}$, target bound $\beta$, disturbance covariance $W$, weights $(\lambda_{\mathrm{ALE}},\lambda_{\Delta u})$
\Ensure trained residual actor $r_\theta$, certificate $(\Kproj,P,\gP)$, execution policy $u^{\mathrm{safe}}(x)$, rollout diagnostics
\State Initialize actor $r_\theta$, critics $Q_{\varphi_1},Q_{\varphi_2}$, target copies $(\bar\theta,\bar\varphi_1,\bar\varphi_2)$, and residual memory $r_{-1}=0$
\For{$t=1,\ldots,N_0$}
    \State Execute $u_{\mathrm{nom}}(x_t)$ plus bounded noise; push $(x_t,u_t,\mathrm{rew}_t,x_{t+1},d_t)$ to $\mathcal B$
\EndFor
\State $\mathcal D\gets$ recent transitions from $\mathcal B$
\State $(K_0,\Phi_u,\Kraw,\Kproj,P,\gP,M)\gets\textsc{CertUpdate}(\mathcal D,\psi,\beta,W)$
\For{$t=1,\ldots,T$}
    \State $z_t\gets\psi(x_t)$
    \State $r_t^{\mathrm{tar}}\gets r_\theta(z_t)+\epsilon_t$ in training, or $r_\theta(z_t)$ in evaluation
    \State Compute $\rho_t$; smooth and rate-limit $r_t^{\mathrm{tar}}$ using \eqref{eq:risk_schedule}--\eqref{eq:residual_smoothing}
    \State $u_t^{\mathrm{pre}}\gets u_{\mathrm{nom}}(x_t)+r_t$
    \State $u_t^{\mathrm{safe}}\gets\Pi_{\widehat{\mathcal U}_{\mathrm{safe}}(x_t)}(u_t^{\mathrm{pre}})$, or $u_t^{\mathrm{pre}}$ if the projection layer is disabled
    \State Execute $u_t^{\mathrm{safe}}$; push $(x_t,z_t,r_t,u_t^{\mathrm{safe}},\mathrm{rew}_t,x_{t+1},d_t)$ to $\mathcal B$; log \eqref{eq:posterior_residual}
    \State Sample $\{(x_i,u_i,\mathrm{rew}_i,x_i',d_i)\}_{i=1}^{N_b}$ from $\mathcal B$
    \State $u_i'\gets u_{\mathrm{nom}}(x_i')+r_{\bar\theta}(\psi(x_i'))$ with clipped TD3 target noise
    \State $y_i\gets \mathrm{rew}_i+\gamma_{\mathrm{RL}}(1-d_i)\min_{j=1,2}Q_{\bar\varphi_j}(x_i',u_i')$
    \State Update $Q_{\varphi_1},Q_{\varphi_2}$ by minimizing $\sum_i(Q_{\varphi_j}(x_i,u_i)-y_i)^2$
    \If{$t\bmod d_\pi=0$}
        \State Compute $\widehat\Sigma_r(\theta)$ from $\{r_\theta(\psi(x_i))\}_{i=1}^{N_b}$
        \State Update $\theta$ by \eqref{eq:actor_objective}; soft-update $(\bar\theta,\bar\varphi_1,\bar\varphi_2)$
    \EndIf
    \If{$t\bmod H_c=0$}
        \State Refresh $\mathcal D$ and rerun \textsc{CertUpdate}
    \EndIf
    \If{$d_t=1$} \State Reset environment and residual memory \EndIf
\EndFor
\State \Return $r_\theta$, $(\Kproj,P,\gP)$, $u^{\mathrm{safe}}$, and diagnostics
\end{algorithmic}
\end{algorithm}

For the matched 2D constrained RL run, the high-noise point is $\sigma=0.30$ and seeds are $0$--$4$. For Full3D, the run uses 5 seeds, 48 rollouts per scenario/seed, horizon 80, and noise levels $0$, $0.05$, $0.10$, $0.20$. The planar UAV study is used as a scenario-level bridge and boundary-case analysis; the primary statistical evidence is provided by the matched 2D RL and Full3D 5-seed runs. The artifact package records the source data for each table and figure.

\subsection{Computational Footprint and Real-Time Use}

CG-RVC separates certificate construction from the high-rate execution loop. The expensive operations--local surrogate fitting, stable projection, Lyapunov solve, and pullback-metric construction--are performed offline, during training, or at a low-frequency model-refresh cadence. The per-step execution path uses only the actor forward pass, risk-scheduled smoothing, rate limiting, the local safety projection, and optional diagnostic logging. Table~\ref{tab:runtime_footprint} summarizes this split for a lifted dimension $d_z$ and action dimension $m$. Embedded flight deployment would require precomputing the certificate objects, using a bounded-complexity projection routine, and benchmarking the resulting controller on the target processor.

\begin{table*}[t]
\centering
\caption{Computational footprint of CG-RVC components. The table reports algorithmic cadence and dominant scaling, not measured embedded latency.}
\label{tab:runtime_footprint}
\scriptsize
\setlength{\tabcolsep}{3pt}
\resizebox{\textwidth}{!}{%
\begin{tabular}{p{0.19\textwidth}p{0.20\textwidth}p{0.28\textwidth}p{0.23\textwidth}}
\toprule
Component & Cadence & Dominant cost & Real-time implication \\
\midrule
EDMDc/local surrogate fit & Offline, training, or low-frequency refresh & Least-squares fit in the lifted dimension; depends on batch size and dictionary size & Not placed in the high-rate inner loop \\
Stable projection and Lyapunov solve & After surrogate refresh & Matrix operations in $d_z$, including a discrete Lyapunov solve with cubic dense scaling in the worst case & Precompute $\Kproj$, $P$, $\gP$, and $M$ before high-rate execution \\
Actor forward pass & Every control step & Neural-network inference cost for the selected actor architecture & Same order as the underlying TD3 actor evaluation \\
Risk scheduling, smoothing, and rate limiting & Every control step & Elementwise operations in $m$ & Negligible relative to actor inference for small action dimension \\
Safety projection & Every control step when enabled & Projection in the action dimension or local constraint dimension & Must use a bounded-time implementation for high-rate flight control \\
Posterior residual logging & Evaluation step or downsampled online diagnostic & Quadratic form evaluations in $d_z$ plus covariance estimate bookkeeping & Diagnostic; can be logged at a lower rate than the actuator loop \\
\bottomrule
\end{tabular}
}
\end{table*}

\section{Simulation and Controlled-Intervention Studies}

Before reporting metrics, we specify the simulated systems used in each evidence block. The main learned-control benchmark is a two-dimensional constrained Lienard oscillator, while the quadrotor studies are nonlinear aerial-system diagnostics used to test whether the same source-side mechanism remains visible beyond the 2D task. The controlled-intervention studies are not plant benchmarks; they are synthetic closed-loop constructions designed to isolate source and amplifier effects.

\begin{table*}[t]
\caption{Simulated systems and protocols used in the experimental section.}
\label{tab:simulation_systems}
\centering
\scriptsize
\setlength{\tabcolsep}{3pt}
\resizebox{\textwidth}{!}{%
\begin{tabular}{p{0.16\textwidth}p{0.30\textwidth}p{0.25\textwidth}p{0.22\textwidth}}
\toprule
Evidence block & Simulated system & State and action & Role in the paper \\
\midrule
CI-1 / CI-2 & Synthetic discrete-time two-dimensional closed-loop family with fixed eigenvalues and controlled eigenvector conditioning & State $z\in\mathbb R^2$; additive input/source process with fixed or filtered source statistics & Mechanism construction for separating nonnormal amplifier geometry from source-side suppression \\
2D constrained RL / safe10 & Controlled damped Lienard oscillator integrated by RK4:
$\dot x_1=x_2$, $\dot x_2=-x_1/(1+x_1^2)-d x_2+u$ & State $x=(x_1,x_2)$; scalar action $u\in[-5,5]$; target is the origin; circular unsafe set centered at $(0.5,0.5)$ with radius $0.46$ & Main end-to-end residual-RL benchmark; high-noise tables use $\sigma=0.30$ and matched 5-seed comparisons \\
Planar quadrotor & Nonlinear planar hover model with RK4 integration and scenario-dependent mass/inertia & State $(p_x,p_z,\theta,v_x,v_z,\omega)\in\mathbb R^6$; action is hover-relative thrust increment and torque; actuator limits are $(4.0,0.4)$ & External nonlinear flight bridge with nominal, heavy-payload, agile-pitch, and payload-mismatch scenarios \\
Full3D quadrotor & Nonlinear 3D quadrotor simulator with 13D quaternion state and a 12D hover-error diagnostic state & Diagnostic state contains position, Euler attitude, velocity, and body rates; action is four hover-relative motor thrust increments with limit $2.5$ & 5-seed, 48-rollout-per-seed numerical source-side diagnostic over four aerial scenarios; learned-policy Full3D training is left for future work \\
\bottomrule
\end{tabular}
}
\end{table*}

\begin{table*}[t]
\caption{Evidence chain, manipulated variables, key evidence, and interpretation scope.}
\label{tab:evidence_chain}
\centering
\scriptsize
\begin{tabular}{p{0.12\textwidth}p{0.22\textwidth}p{0.34\textwidth}p{0.19\textwidth}}
\toprule
Experiment & Question & Key evidence & Interpretation Scope \\
\midrule
CI-1 & Can nonnormal geometry independently amplify variance? & Covariance trace $0.37\to15.66$, peak gain $1.0\to5.55$ & Controlled construction \\
CI-2 & Can source suppression reduce downstream variance? & Action variance $0.03992\to0.00317$, state covariance $15.849\to12.393$ & Colored-input augmented interpretation \\
MIMO direction & Does $M=\Phi_u^\top P\Phi_u$ distinguish equal-trace source directions? & Predicted max/min $89.7$--$135.8\times$; measured max/min $94.2$--$141.0\times$ & Directional MIMO attribution \\
P-ALE matched & Are P-ALE, smoothing, and projection jointly needed? & CG-RVC: RMSE 0.284, Var 0.0060, Dense 0, Bmax 5.24 & Matched variant comparison \\
Planar UAV & Is the effect observable in nonlinear flight? & Action variance decreases in all four scenarios; Payload Mismatch state covariance rises & Scenario-level simulation bridge \\
Full3D & Does source-side suppression persist in a 12-state/4-motor nonnormal numerical loop? & 5-seed state covariance and motor variance decrease in all four scenarios & Numerical mechanism consistency; not end-to-end aerial RL \\
Safe RL external & Does the mechanism have RL consequences beyond Direct TD3? & PPO/CPO-style penalty, PPO/SAC-Lagrangian, and Shielded SAC remain high on at least one risk metric; full method is low on all reported metrics & Broader safe-RL comparator, not leaderboard \\
Metric repl. & Does the full execution layer hide scalar metric replacement effects? & Identity, diagonal, random-PSD, and one-step metrics are run under the same execution stack & Full-pipeline scalar-channel sanity check; directional evidence comes from MIMO injection \\
Actor feedback & Does the learned residual actor modify the amplifier? & Direct TD3 has $\rho(K_\theta)=2.006$; CG-RVC has $\rho(K_\theta)=0.900$ in the lifted diagnostic & Representative lifted fit \\
\bottomrule
\end{tabular}
\end{table*}

Table~\ref{tab:evidence_chain} maps each experiment to the claim it supports. CI-1, CI-2, and the MIMO directional-injection test identify the source-amplifier mechanism; matched TD3 variants test method components; UAV simulations and PPO/SAC safe-RL comparators provide scope-limited context. The table states interpretation scope before metrics are introduced.

\begin{table*}[t]
\caption{Experiment scope and surrogate source.}
\label{tab:experiment_scope}
\centering
\scriptsize
\setlength{\tabcolsep}{3pt}
\resizebox{\textwidth}{!}{%
\begin{tabular}{p{0.17\textwidth}p{0.30\textwidth}p{0.28\textwidth}p{0.17\textwidth}}
\toprule
Study & Purpose & Surrogate or construction & Claim scope \\
\midrule
CI-1 & Isolate nonnormal amplifier geometry & Synthetic two-dimensional closed-loop family; no Koopman claim & Mechanism construction \\
CI-2 & Isolate source-side filtering under a fixed amplifier & Same synthetic amplifier with colored-input augmentation & Mechanism construction \\
MIMO directional injection & Test equal-trace source directions in motor space & Full3D input channel and certificate metric & Directional attribution \\
2D Lienard hard-obstacle RL & Test CG-RVC against matched TD3 variants & Local lifted/linearized construction in the runner & Method-component comparison \\
Planar quadrotor & Check nonlinear aerial simulation behavior and a boundary case & Scenario-level local diagnostic bundle & External simulation bridge \\
Full3D & Test source-side suppression in a 12-state, 4-motor numerical loop & Lightweight linearized closed-loop diagnostic & Numerical mechanism consistency \\
\bottomrule
\end{tabular}
}
\end{table*}

\subsection{Metrics and Aggregation Protocol}

Table~\ref{tab:experiment_scope} separates evidence sources before reporting metrics. For 2D RL experiments, RMSE measures tracking error, applied variance measures postprocessed action variance, Diff MSE measures consecutive-action changes, dense violation rate measures barrier violations, and Bellman--Lyapunov max reports the largest posterior residual over evaluation rollouts. UAV diagnostics use state covariance trace and, in Full3D, applied motor-command variance. The MIMO directional-injection table reports both the predicted ratio $\tr(M\Sigma_r^{\max})/\tr(M\Sigma_r^{\min})$ and the measured state-energy ratio under equal source trace. All 2D RL tables use high-noise aggregation at $\sigma=0.30$; Full3D reports mean $\pm$ standard deviation over 5 seeds at noise key $0.20$.

Table~\ref{tab:comparator_protocol} clarifies the comparison protocol. The matched TD3 rows share the same backbone, update schedule, evaluation seeds, and logger; they differ only in the listed regularizer or execution layer. The broader PPO/SAC rows include penalty, Lagrangian, and shielding-style safe-RL comparators under the same high-noise safe10 evaluation, not as a safe-RL leaderboard.

\begin{table*}[t]
\centering
\caption{Comparator protocol. All methods are evaluated on the same environment, state/action normalization, noise setting, seed set, rollout horizon, and metric logger. Differences are restricted to the training objective and execution layer listed below.}
\label{tab:comparator_protocol}
\scriptsize
\setlength{\tabcolsep}{3pt}
\resizebox{\textwidth}{!}{%
\begin{tabular}{p{0.16\linewidth} p{0.16\linewidth} p{0.18\linewidth} p{0.20\linewidth} p{0.20\linewidth}}
\toprule
Comparator group & Backbone and budget & Network / optimizer protocol & Training signal & Execution layer \\
\midrule
Direct TD3 & TD3, same replay budget and update schedule as the matched TD3 variants & Same TD3 actor--critic architecture, optimizer, batch size, target-update schedule, and evaluation seeds across all TD3 rows & Reward only; no residual covariance penalty and no safety-cost dual update & No certificate smoothing, no rate limiting, no projection unless stated \\
TD3 + plain Var$(u)$ & Same TD3 budget as Direct TD3 & Same TD3 network and optimizer protocol & Adds scalar Euclidean action-variance penalty & Same as Direct TD3 \\
TD3 + action-diff penalty & Same TD3 budget as Direct TD3 & Same TD3 network and optimizer protocol & Adds temporal action-difference penalty, corresponding to the CAPS-style smooth-action component tested in this task & Same as Direct TD3 \\
TD3 + beta-ALE / P-ALE & Same TD3 budget as Direct TD3 & Same TD3 network and optimizer protocol & Adds the indicated ALE residual-covariance penalty; only the actor-side regularizer is changed & No projection or execution smoothing unless stated in the method name \\
TD3 + P-ALE + smoothing & Same TD3 budget as Direct TD3 & Same TD3 network and optimizer protocol & P-ALE actor regularization & Risk-scheduled smoothing and rate limiting; no safety projection \\
TD3 + P-ALE + projection & Same TD3 budget as Direct TD3 & Same TD3 network and optimizer protocol & P-ALE actor regularization & Safety projection enabled; smoothing/rate limiting disabled unless specified \\
TD3 + projection only & Same TD3 budget as Direct TD3 & Same TD3 network and optimizer protocol & Reward only; no P-ALE penalty & Same projection operator as the full method; no certificate-weighted source penalty \\
CG-RVC / full method & Same TD3 budget and seed set as matched TD3 variants & Same TD3 network and optimizer protocol & P-ALE residual covariance penalty plus auxiliary action-difference term & Risk-scheduled smoothing, rate limiting, and the same safety projection operator \\
PPO / SAC safe-RL comparators & Equal-budget safe10 runs under the same high-noise evaluation protocol & Fixed PPO or SAC actor--critic architectures within each backbone family & PPO-Penalty (CPO/CMDP penalty family), PPO-Lagrangian, SAC-Lagrangian, or shielded SAC objective as indicated by the method name & Projection/shielding only when stated; otherwise no CG-RVC certificate metric or residual-shaping layer \\
\bottomrule
\end{tabular}
}
\end{table*}

\subsection{CI-1: Amplifier Isolation}

CI-1 uses the two-dimensional closed-loop family
\begin{equation}
A_{\mathrm{cl}}(\alpha)=S(\alpha)\Lambda S(\alpha)^{-1},\qquad
\Lambda=\diag(0.93,0.68).
\label{eq:ci1_family}
\end{equation}
Across all $\alpha$, the eigenvalues, spectral radius, input channel, and source covariance are fixed; only the eigenvector geometry changes. When $\kappa(V)$ increases from approximately 1.0 to approximately 20.05, theoretical and empirical state covariance trace increase from approximately 0.37 to 15.66, and peak transient gain increases from approximately 1.0 to 5.55. The Pearson correlation between $\kappa(V)$ and state covariance trace is 0.9704; the correlation between $\kappa(V)$ and peak transient gain is 0.9965.

\begin{figure}[t]
\centering
\includegraphics[width=\linewidth]{figures_v4_1/fig1_ci1_amplifier_isolation.png}
\caption{CI-1 amplifier isolation. Eigenvalues, spectral radius, input channel, and source covariance are fixed; only the eigenvector geometry changes.}
\label{fig:ci1}
\end{figure}

Fig.~\ref{fig:ci1} isolates the amplifier factor in Proposition~\ref{prop:nonnormal_bound}. Since $\rho$, $G$, and $W$ are fixed, the covariance increase cannot be explained by source energy or asymptotic instability; it is attributed to the change in closed-loop geometry. This controlled construction does not prove that every nonnormal system is monotone in $\kappa(V)$; it demonstrates that nonnormal geometry can be an independent variance amplifier under fixed source conditions.

\subsection{CI-2: Source-Side Intervention}

CI-2 fixes the strongly nonnormal matrix from CI-1 and compares white input with first-order causal filtered input. Switching from white to filtered input reduces applied action variance from 0.03992 to 0.00317 and state covariance trace from 15.849 to 12.393, while peak transient gain remains approximately 5.5486.

\begin{figure}[t]
\centering
\includegraphics[width=\linewidth]{figures_v4_1/fig2_ci2_source_intervention.png}
\caption{CI-2 source-side intervention. The physical amplifier is fixed; filtering changes the effective source statistics and spectrum, and the filtered signal is interpreted through the augmented colored-input model.}
\label{fig:ci2}
\end{figure}

Fig.~\ref{fig:ci2} corresponds to a fixed physical amplifier and altered source statistics. Because filtered input is colored, the result is interpreted through the augmented system in Section~\ref{sec:colored_input_aug}. It provides mechanism-consistent evidence that reducing the effective source variance entering a fixed amplifier can reduce downstream state covariance.

\subsection{MIMO Directional Source Injection}

The Full3D motor channel is MIMO, so it can directly test whether the certificate-induced input metric distinguishes source directions rather than only source magnitude. For each scenario, the closed-loop surrogate, input channel, and source trace are fixed. We form $M=\Phi_u^\top P\Phi_u$ and inject two rank-one residual covariances,
\begin{equation}
\Sigma_r^{\min}=s v_{\min}v_{\min}^\top,\qquad
\Sigma_r^{\max}=s v_{\max}v_{\max}^\top,
\label{eq:mimo_directional_sources}
\end{equation}
where $v_{\min}$ and $v_{\max}$ are the eigenvectors of $M$ associated with its minimum and maximum eigenvalues and $s=0.04$ keeps $\tr(\Sigma_r)$ identical. An isotropic action-variance penalty assigns the two injections the same source cost. The certificate-weighted proxy instead predicts the ratio
\begin{equation}
\frac{\tr(M\Sigma_r^{\max})}{\tr(M\Sigma_r^{\min})}
=\frac{\lambda_{\max}(M)}{\lambda_{\min}(M)}.
\label{eq:mimo_directional_ratio}
\end{equation}

\begin{table}[t]
\caption{MIMO directional source injection with matched source trace. Predicted ratios use $\tr(M\Sigma_r)$; measured ratios use downstream state energy under the same Full3D scenario.}
\label{tab:mimo_directional_injection}
\centering
\scriptsize
\begin{tabular}{lccc}
\toprule
Scenario & $\kappa(M)$ & Pred. ratio & Meas. ratio \\
\midrule
Nominal Hover & $123.6$ & $123.6\times$ & $128.5\times$ \\
Heavy Payload & $89.7$ & $89.7\times$ & $94.2\times$ \\
Agile Attitude & $135.8$ & $135.8\times$ & $141.0\times$ \\
Payload Mismatch & $94.5$ & $94.5\times$ & $99.7\times$ \\
\bottomrule
\end{tabular}
\end{table}

Table~\ref{tab:mimo_directional_injection} shows that equal-trace residual sources can induce roughly two orders of magnitude difference in downstream state energy when their directions are changed. The measured ratios track the $M$-based predictions across all four scenarios. This directly supports the use of the pullback metric $\Phi_u^\top P\Phi_u$: scalar source trace alone would predict no difference between the two injections, while the certificate-weighted direction predicts the observed large separation.

Because the MIMO directional-injection study is a paired directional diagnostic rather than a stochastic training benchmark, the ratios in Table~\ref{tab:mimo_directional_injection} should not be interpreted as seed-level confidence intervals. To quantify across-scenario variability without adding new experiments, Table~\ref{tab:mimo_direction_summary} reports descriptive statistics over the four Full3D scenarios. The measured separation is consistently about $4.6\%$ above the certificate-weighted prediction while preserving the same scenario ordering.

\begin{table}[t]
\centering
\caption{Descriptive across-scenario summary for MIMO directional injection. Intervals are descriptive $t$-intervals over the four Full3D scenarios, not seed-level stochastic confidence intervals.}
\label{tab:mimo_direction_summary}
\scriptsize
\resizebox{\linewidth}{!}{%
\begin{tabular}{lccc}
\toprule
Quantity & Mean & Std. dev. & Descriptive 95\% interval \\
\midrule
Predicted max/min ratio & $110.90$ & $22.36$ & $[75.3,146.5]$ \\
Measured max/min ratio & $115.85$ & $22.52$ & $[80.0,151.7]$ \\
Measured / predicted & $1.046$ & $0.008$ & $[1.033,1.059]$ \\
Measured $-$ predicted & $4.95$ & $0.33$ & $[4.42,5.48]$ \\
\bottomrule
\end{tabular}
}
\end{table}

\subsection{P-ALE Matched 5-Seed Comparison}

This section reports a matched 5-seed comparison in the same 2D Lienard hard-obstacle runner. The table compares nine matched TD3 variants. All values in Table~\ref{tab:v3_pale} are 5-seed mean $\pm$ standard deviation at high noise $\sigma=0.30$.

\begin{table*}[t]
\caption{Matched method-component comparison in the 2D constrained RL task, high-noise setting.}
\label{tab:v3_pale}
\centering
\footnotesize
\begin{tabular}{lccccc}
\toprule
Method & RMSE & Applied Var & Diff MSE & Dense Viol. & Bellman-Lyapunov Max \\
\midrule
Direct TD3 & $0.537 \pm 0.056$ & $0.1138 \pm 0.0066$ & $0.2731 \pm 0.0177$ & $0.9389 \pm 0.1366$ & $92.391 \pm 34.518$ \\
TD3 + plain Var($u$) & $0.612 \pm 0.063$ & $0.1026 \pm 0.0022$ & $0.2365 \pm 0.0130$ & $0.9278 \pm 0.0800$ & $161.860 \pm 47.677$ \\
TD3 + action-diff penalty & $0.565 \pm 0.068$ & $0.1118 \pm 0.0059$ & $0.2657 \pm 0.0172$ & $0.9389 \pm 0.1366$ & $109.096 \pm 44.352$ \\
TD3 + beta-ALE & $0.661 \pm 0.085$ & $0.0984 \pm 0.0023$ & $0.2212 \pm 0.0081$ & $0.9167 \pm 0.1145$ & $208.176 \pm 79.238$ \\
TD3 + P-ALE & $0.592 \pm 0.056$ & $0.1049 \pm 0.0032$ & $0.2460 \pm 0.0156$ & $0.9389 \pm 0.0569$ & $143.114 \pm 45.627$ \\
TD3 + P-ALE + smoothing & $0.527 \pm 0.048$ & $0.0456 \pm 0.0008$ & $0.0722 \pm 0.0042$ & $0.9278 \pm 0.1204$ & $57.246 \pm 8.177$ \\
TD3 + P-ALE + projection & $0.554 \pm 0.033$ & $0.0940 \pm 0.0026$ & $0.2302 \pm 0.0097$ & $0.1500 \pm 0.0724$ & $128.767 \pm 27.250$ \\
TD3 + projection only & $0.505 \pm 0.108$ & $0.1033 \pm 0.0141$ & $0.2761 \pm 0.0366$ & $0.1222 \pm 0.0639$ & $82.320 \pm 52.322$ \\
CG-RVC / Full method & $\mathbf{0.284 \pm 0.004}$ & $\mathbf{0.0060 \pm 0.0006}$ & $\mathbf{0.0063 \pm 0.0018}$ & $\mathbf{0.0000 \pm 0.0000}$ & $\mathbf{5.239 \pm 2.698}$ \\
\bottomrule
\end{tabular}
\end{table*}

Table~\ref{tab:v3_pale} is the core matched method-component comparison. Plain Var($u$) and action-diff baselines cover scalar variance and temporal smoothing, but neither resolves dense violations or posterior residuals. P-ALE alone is also insufficient; adding smoothing lowers applied variance and Diff MSE while leaving violations high, whereas adding projection lowers violations while leaving variance and residuals high. The full CG-RVC stack combines $P$-weighted ALE, residual shaping, and projection, and is best on all five reported metrics. The table is a matched component comparison rather than an exhaustive factorial decomposition of the execution layer.

\begin{figure*}[t]
\centering
\includegraphics[width=0.95\textwidth]{figures_v4_1/caps_style_method_comparison_v4_1.png}
\caption{High-noise matched TD3 comparison including smooth-action baselines. TD3 + plain Var($u$) penalizes scalar action variance, and TD3 + CAPS-style $\Delta u$ penalizes temporal action differences. CG-RVC further uses certificate-weighted residual covariance and execution-layer projection, yielding lower applied variance, dense violations, and posterior Bellman-Lyapunov residual.}
\label{fig:caps_style}
\end{figure*}

Fig.~\ref{fig:caps_style} highlights the distinction between ordinary action smoothing and certificate-guided residual variance control. The CAPS-style temporal penalty targets $\Delta u$ directly, but it does not account for the local nonnormal propagation metric $\Phi_u^\top P\Phi_u$ or the safety projection channel. The gap between these baselines and CG-RVC supports the central methodological claim: low Euclidean action variation alone is not equivalent to suppressing certificate-weighted source energy entering a nonnormal amplifier.

\subsection{Planar Quadrotor External Validation}

The planar quadrotor experiment checks whether source suppression is observable in a nonlinear flight closed loop. At the highest noise level, \texttt{noise\_key = 0.10}, action variance decreases in all four scenarios: Nominal Hover from 0.1922 to 0.0511, Heavy Payload from 0.3217 to 0.1089, Agile Pitch from 0.1665 to 0.0186, and Payload Mismatch from 0.2498 to 0.0823. State covariance decreases in Nominal Hover (0.1192 to 0.0997), Heavy Payload (0.3134 to 0.3095), and Agile Pitch (0.0884 to 0.0863), but increases in Payload Mismatch (0.1056 to 0.1226).

\begin{figure}[t]
\centering
\includegraphics[width=\linewidth]{figures_v4_1/suite_high_noise_comparison.png}
\caption{Planar quadrotor simulation at the high-noise setting. The study exposes both consistent action-variance reduction and the Payload Mismatch boundary case.}
\label{fig:planar}
\end{figure}

Fig.~\ref{fig:planar} is a supporting diagnostic for the aerial simulation bundle. It shows that filtering consistently reduces action variance, while Payload Mismatch gives a boundary case: scalar source variance can drop while state covariance rises if the residual energy remains aligned with high-gain directions. This motivates direction-aware penalties based on $\Phi_u^\top P\Phi_u$, rather than scalar action variance alone.

\subsection{Full3D Quadrotor Numerical Supplement}

The Full3D study is a numerical mechanism-consistency supplement. It fixes a 12-state, 4-motor local diagnostic and compares white versus filtered source injection under the same simulation protocol; it does not train a complete Full3D quadrotor RL controller. The simulation uses 5 random seeds, and Table~\ref{tab:full3d_high_noise} reports the highest noise level, \texttt{noise\_key = 0.20}.

\begin{table}[t]
\caption{Full3D scenario structural diagnostics.}
\label{tab:full3d_structure}
\centering
\footnotesize
\begin{tabular}{lccc}
\toprule
Scenario & $\rho$ & $\kappa(V)$ & $G_{\mathrm{peak}}$ \\
\midrule
Nominal Hover & 0.926008 & 108.530414 & 7.983893 \\
Heavy Payload & 0.926002 & 271.757813 & 6.923904 \\
Agile Attitude & 0.940357 & 52.401604 & 8.912704 \\
Payload Mismatch & 0.933107 & 25.394522 & 6.772842 \\
\bottomrule
\end{tabular}
\end{table}

Table~\ref{tab:full3d_structure} shows that all Full3D scenarios are clearly nonnormal. In particular, Heavy Payload has the largest eigenvector conditioning, so the worst-case nonnormal bound is expected to be loose. Therefore, the interpretation relies on empirical covariance, PSD, and posterior diagnostics, not only on Proposition~\ref{prop:nonnormal_bound}.

\begin{table*}[t]
\caption{Full3D high-noise white vs. filtered comparison, 5 seeds.}
\label{tab:full3d_high_noise}
\centering
\footnotesize
\begin{tabular}{lcccc}
\toprule
Scenario & White state cov. & Filtered state cov. & White motor var. & Filtered motor var. \\
\midrule
Nominal Hover & $0.551549 \pm 0.003477$ & $0.089192 \pm 0.005230$ & $1.901316 \pm 0.019104$ & $0.104565 \pm 0.006143$ \\
Heavy Payload & $0.266570 \pm 0.003897$ & $0.083648 \pm 0.006377$ & $1.763106 \pm 0.013489$ & $0.146811 \pm 0.010697$ \\
Agile Attitude & $0.950270 \pm 0.009514$ & $0.174127 \pm 0.016088$ & $1.898488 \pm 0.016801$ & $0.121955 \pm 0.009240$ \\
Payload Mismatch & $0.336788 \pm 0.006714$ & $0.115505 \pm 0.008461$ & $1.579815 \pm 0.013373$ & $0.153382 \pm 0.010421$ \\
\bottomrule
\end{tabular}
\end{table*}

\begin{figure}[t]
\centering
\includegraphics[width=\linewidth]{figures_v4_1/full3d_5seed_high_noise_summary.png}
\caption{Full3D quadrotor numerical simulation at the high-noise setting. The bars show 5-seed mean $\pm$ standard deviation for state covariance trace and applied motor variance.}
\label{fig:full3d}
\end{figure}

Table~\ref{tab:full3d_high_noise} and Fig.~\ref{fig:full3d} show that filtering reduces both state covariance and motor variance across all four Full3D scenarios in the 5-seed numerical simulation. This strengthens the mechanism-consistency evidence relative to the planar boundary case while keeping the claim at simulation and diagnostic level.

\subsection{External Safe RL Consequence Table}

To show that the mechanism has practical RL consequences beyond Direct TD3 and matched TD3 variants, Table~\ref{tab:safe_rl_external} reports the safe-RL comparator rows from the 5-seed safe10 formal run, again at $\sigma=0.30$. The table includes penalty-based constrained policy optimization in the CPO/CMDP family, PPO-Lagrangian, SAC-Lagrangian, and Shielded SAC baselines.

\begin{table*}[t]
\caption{External safe-RL comparator table, high-noise setting with 5 seeds. PPO-Penalty represents the CPO/CMDP penalty-family constrained baseline used in this implementation.}
\label{tab:safe_rl_external}
\centering
\footnotesize
\begin{tabular}{lcccc}
\toprule
Method & RMSE & Applied Var & Dense Viol. & B-L Max \\
\midrule
Direct TD3 & $0.5368 \pm 0.0560$ & $0.1138 \pm 0.0066$ & $0.9389 \pm 0.1366$ & $92.3911 \pm 34.5179$ \\
TD3 + projection only & $0.5047 \pm 0.1081$ & $0.1033 \pm 0.0141$ & $0.1222 \pm 0.0639$ & $82.3203 \pm 52.3218$ \\
PPO-Penalty (CPO/CMDP family) & $1.1330 \pm 0.6140$ & $0.0937 \pm 0.0055$ & $0.8330 \pm 0.1560$ & $3083.988 \pm 3827.861$ \\
PPO-Lagrangian & $0.8850 \pm 0.1270$ & $0.0912 \pm 0.0023$ & $0.9330 \pm 0.0840$ & $2163.164 \pm 1695.603$ \\
SAC-Lagrangian & $0.4640 \pm 0.0390$ & $0.1340 \pm 0.0017$ & $0.7560 \pm 0.0900$ & $45.690 \pm 7.582$ \\
Shielded SAC & $0.3823 \pm 0.0183$ & $0.1056 \pm 0.0100$ & $0.1667 \pm 0.0556$ & $42.3887 \pm 10.9532$ \\
CG-RVC / Full method & $\mathbf{0.2817 \pm 0.0045}$ & $\mathbf{0.0064 \pm 0.0009}$ & $\mathbf{0.0000 \pm 0.0000}$ & $\mathbf{6.7080 \pm 1.4745}$ \\
\bottomrule
\end{tabular}
\end{table*}

Table~\ref{tab:safe_rl_external} provides policy-level context rather than a safe RL leaderboard. Direct TD3 lacks constraints and variance control; projection only reduces violations; PPO-Penalty and PPO-Lagrangian remain high in tracking error, dense violations, and posterior residuals; SAC-Lagrangian improves tracking but leaves high dense violation and source variance; Shielded SAC lowers violations but still leaves high source variance and posterior residuals. The full method is low on all four reported quantities. The complete safe-RL comparator table with return and Diff MSE is retained in Appendix~\ref{app:additional_tables}. Mechanism identification still rests primarily on CI-1, CI-2, the MIMO directional-injection test, and the UAV bridge.

\subsection{Boundary and Failure Cases}

The experiment narrative includes two boundary checks. First, the planar Payload Mismatch case reduces applied action variance but increases state covariance, showing that scalar source reduction can still fail when residual energy remains aligned with high-gain directions. Second, the safe-RL consequence table shows that projection alone can reduce dense violations while leaving high residual variance and posterior residuals. These cases explain why source shaping, projection, and posterior diagnostics are reported separately.

\section{Discussion}

CG-RVC differs from ordinary action smoothing because it weights residual variance by downstream certificate energy. The matched TD3 comparisons include scalar action-variance and CAPS-style temporal action-difference baselines, while the MIMO directional-injection experiment isolates the metric itself: equal-trace sources are indistinguishable to scalar variance but differ by $94$--$141\times$ in measured downstream state energy when aligned with low- and high-curvature eigenvectors of $M$.

The ALE term does not directly reduce nonnormality. Nonnormality is a geometric property of $\Kproj$ or of the actor-augmented local amplifier. CG-RVC suppresses certificate-weighted residual source covariance entering that amplifier. Reducing the amplifier itself would require additional objectives, such as peak-gain penalties, departure-from-normality penalties, or direct penalties on $\|\Phi_u^\top P\Phi_u\|$.

\paragraph{Actor-Augmented Diagnostic.}
The actor-augmented lifted-amplifier diagnostic is a local empirical consistency check. Folding the estimated residual feedback Jacobian into the diagnostic gives $K_\theta=\Kproj+\Phi_uJ_r$. In the representative lifted fit, CG-RVC reduces the spectral radius of $K_\theta$ relative to Direct TD3, indicating less destabilizing residual feedback in the local spectral geometry.

The certificate matrix $P$ is computed for $\Kproj$, and the measured $P$-metric factor for $K_\theta$ remains larger than one. We therefore interpret the table as a diagnostic of the learned residual feedback, while the analytical bounds use $\Kproj$, the centered source interpretation, and the posterior Bellman--Lyapunov residuals.

The new robust mismatch bound clarifies the role of local modeling error. Lifted mismatch enters the same Lyapunov propagation channel as residual and disturbance sources, but it is weighted by $P$. Thus small Euclidean model error can still create large Lyapunov-energy error if it aligns with nonnormal high-gain directions.

Safety projection is local and conditional. Projection gives forward invariance only on a recursively feasible local CBF set where the projected action set is nonempty. P-ALE does not create feasibility. It reduces the probability and magnitude of large projection corrections by suppressing residual variance in certificate-weighted action directions.

P-ALE changes the RL objective. It does not preserve the optimizer of the unregularized actor objective; it solves a robustness-weighted residual-control problem. The suboptimality bounds in Appendix~\ref{app:actor_optimization_bounds} quantify this performance-robustness trade-off through $\lambda_{\mathrm{ALE}}$, $\|P\|_2$, $\|\Phi_u\|_2$, and $1/(1-\gP^2)$.

The aerial simulations are mechanism diagnostics. The planar study retains the Payload Mismatch boundary case, while the Full3D 5-seed study shows consistent state-covariance and motor-variance reductions across four scenarios.

\section{Limitations and Broader Impact}

\subsection{Limitations and Failure Modes}

The main limitations are locality, feedback dependence, model mismatch, safety scope, and evaluation scope. The certificate is attached to the projected local surrogate $\Kproj$ used in the source-amplifier analysis. If the actor substantially changes the local amplifier, the source-only interpretation becomes diagnostic unless the feedback component is folded into the amplifier. Biased, state-dependent, or high-gain-aligned lifted error enters the robust bound through $\tr(P\Sigma_e)$ and may increase posterior residuals.

Projection guarantees local recursive feasibility only under the nonempty-set assumptions in Proposition~\ref{prop:recursive_feasibility}. The paper reports broader safe RL comparators and matched TD3 variants, including plain action-variance and CAPS-style temporal regularization baselines, but exhaustive factorial ablations, a complete Full3D aerial RL benchmark, and hardware validation are outside the present simulation study.

\subsection{Broader Impact}

The intended impact is safer and smoother deployment of learning-based continuous controllers under noise and constraints. Lower action variance and reduced posterior residuals may reduce actuator wear and improve robustness. For safety-critical deployment, CG-RVC should be combined with plant-level verification, higher-fidelity simulation, physical-system validation, and conservative fallback controllers.

\section{Conclusion}

This paper proposed CG-RVC for residual learned controllers in nonlinear systems with locally nonnormal closed-loop surrogates. It treats residual-action covariance as a source, the local surrogate as an amplifier, and a projected Lyapunov certificate as the metric that pulls downstream risk back to action space. Controlled interventions, MIMO directional injection, matched TD3 variants, and quadrotor diagnostics support this source-amplifier interpretation and show that certificate-weighted residual shaping and projection play distinct roles. Future work includes Lyapunov-constrained surrogate learning, amplifier-side penalties, anisotropic residual smoothing, and higher-fidelity simulation and physical evaluation.

\appendices

\section{Additional Experiment Tables}
\label{app:additional_tables}

\subsection{Hyperparameter Tuning Heuristics}

Table~\ref{tab:hyperparameter_heuristics} records the tuning logic used to interpret the main CG-RVC hyperparameters. It is a practical guide rather than a new sensitivity experiment. The recommended workflow is to choose $\beta$ from the sampling-time or settling-time target, verify the measured contraction $\gP$, increase $\lambda_{\mathrm{ALE}}$ until certificate-weighted residual covariance decreases without unacceptable return loss, then tune $\lambda_{\Delta u}$ and the risk-scheduling gains to remove remaining high-frequency action changes and projection spikes.

\begin{table*}[t]
\centering
\caption{Hyperparameter roles and tuning heuristics. This table summarizes practical tuning guidance; it does not report a separate sensitivity sweep.}
\label{tab:hyperparameter_heuristics}
\scriptsize
\setlength{\tabcolsep}{3pt}
\resizebox{\textwidth}{!}{%
\begin{tabular}{p{0.14\textwidth}p{0.26\textwidth}p{0.25\textwidth}p{0.25\textwidth}}
\toprule
Parameter & Main effect when increased & Failure symptom & Practical tuning heuristic \\
\midrule
$\beta$ & Stronger spectral-radius target for the projected certificate model & Too small: large projection mismatch and conservative certificate; too large: weak $P$-metric margin & Pick from \eqref{eq:beta_design}, then verify $\gP<1$, projection cost, and posterior residuals \\
$\lambda_{\mathrm{ALE}}$ & Stronger penalty on certificate-weighted residual covariance & Too small: high applied variance and posterior residual; too large: sluggish residual action and return loss & Increase until $\tr(M\widehat\Sigma_r)$ and $\mathcal B_t$ drop; stop when RMSE or return degrades materially \\
$\lambda_{\Delta u}$ & Stronger temporal smoothness penalty on actor outputs & Too small: high Diff MSE; too large: delayed response and tracking loss & Tune after $\lambda_{\mathrm{ALE}}$; use it to remove residual high-frequency action changes, not to replace P-ALE \\
$k_\alpha$ & More aggressive risk-scheduled low-pass smoothing near high risk & Too small: noisy residuals near boundaries; too large: excessive lag after risk rises & Increase until projection spikes decrease without causing visible tracking delay \\
$k_\delta$ & Tighter risk-scheduled rate limit near high risk & Too small: abrupt residual jumps; too large: actuator commands cannot change fast enough & Tune against Diff MSE and tracking transient; keep the nominal low-risk rate limit permissive \\
$c_b$ & Larger weight on barrier-margin deficit in the risk signal & Too small: late reaction near the safe-set boundary; too large: conservative smoothing far from actual violations & Set so barrier risk dominates only near small safety margins; verify projection trigger and dense violation rates \\
Surrogate refresh interval & More frequent updates of $(K_0,\Phi_u,\Kraw,\Kproj,P,M)$ & Too frequent: training overhead and noisy certificates; too infrequent: stale metric and larger posterior residuals & Refresh when posterior residuals or projection cost drift persistently, not at every control step \\
\bottomrule
\end{tabular}
}
\end{table*}

\subsection{Full-Pipeline Metric Replacement}

Table~\ref{tab:appendix_metric_replacement} holds the execution stack fixed and changes only the actor-side covariance metric. The rows use the same nominal controller, risk-scheduled smoothing, rate limiter, and projection layer. This table is a full-pipeline scalar-channel sanity check; because the formal constrained-RL runner has one residual action channel, identity, diagonal, random-PSD, and one-step certificate metrics collapse to scalar metric variants. The MIMO directional source-injection experiment in Table~\ref{tab:mimo_directional_injection} is therefore the directional evidence for the pullback metric.

\begin{table*}[t]
\caption{Full-pipeline metric replacement ablation, high-noise constrained-RL setting.}
\label{tab:appendix_metric_replacement}
\centering
\scriptsize
\setlength{\tabcolsep}{3pt}
\resizebox{\textwidth}{!}{%
\begin{tabular}{lccccccc}
\toprule
Metric in actor regularizer & Return & RMSE & Applied Var & Diff MSE & Dense Viol. & B-L Max & Proj. trigger \\
\midrule
$I$ & $-10.056 \pm 0.857$ & $0.279 \pm 0.003$ & $0.0100 \pm 0.0034$ & $0.0203 \pm 0.0128$ & $0.000 \pm 0.000$ & $6.082 \pm 0.729$ & $0.321 \pm 0.150$ \\
$\mathrm{diag}(\Phi_u^\top P\Phi_u)$ & $-10.056 \pm 0.857$ & $0.279 \pm 0.003$ & $0.0100 \pm 0.0034$ & $0.0203 \pm 0.0128$ & $0.000 \pm 0.000$ & $6.082 \pm 0.729$ & $0.321 \pm 0.150$ \\
Random PSD & $-10.056 \pm 0.857$ & $0.279 \pm 0.003$ & $0.0100 \pm 0.0034$ & $0.0203 \pm 0.0128$ & $0.000 \pm 0.000$ & $6.082 \pm 0.729$ & $0.321 \pm 0.150$ \\
$\Phi_u^\top P\Phi_u$ & $-10.056 \pm 0.857$ & $0.279 \pm 0.003$ & $0.0100 \pm 0.0034$ & $0.0203 \pm 0.0128$ & $0.000 \pm 0.000$ & $6.082 \pm 0.729$ & $0.321 \pm 0.150$ \\
\bottomrule
\end{tabular}
}
\end{table*}

\subsection{Actor-Augmented Amplifier Diagnostic}

Table~\ref{tab:appendix_actor_augmented} estimates the actor-augmented lifted amplifier using the formal safe10 seed-0 models. For each method, rollout states are lifted and a ridge linear fit maps lifted states to deterministic residual actor outputs; the fitted feedback is then folded into the projected surrogate as $K_\theta=K_{\mathrm{proj}}+\Phi_uJ_r$. The peak gain is computed over a 10-step horizon. This diagnostic checks whether the learned residual actor is changing the local amplifier in the expected direction.

\begin{table*}[t]
\caption{Actor-augmented lifted-amplifier diagnostic, representative seed 0.}
\label{tab:appendix_actor_augmented}
\centering
\scriptsize
\begin{tabular}{lccccc}
\toprule
Method & Actor Jacobian & $\rho(K_\theta)$ & $\kappa(V_\theta)$ & $G_{\mathrm{peak}}(K_\theta)$ & $\gamma_P(K_\theta)$ \\
\midrule
Direct TD3 & $16.143$ & $2.006$ & $4.63{\times}10^6$ & $4.30{\times}10^6$ & $126.112$ \\
Euclidean variance & $6.385$ & $0.902$ & $3.20{\times}10^6$ & $4.60{\times}10^3$ & $27.117$ \\
Low-pass execution & $30.711$ & $1.255$ & $4.42{\times}10^6$ & $1.11{\times}10^5$ & $178.178$ \\
Projection only & $17.791$ & $1.551$ & $5.13{\times}10^6$ & $7.35{\times}10^5$ & $147.595$ \\
CG-RVC full & $0.136$ & $0.900$ & $3.01{\times}10^6$ & $3.60{\times}10^3$ & $1.625$ \\
\bottomrule
\end{tabular}
\end{table*}

\subsection{Complete Safe-RL Comparator Table}

Table~\ref{tab:appendix_safe_rl_full} gives the same safe-RL comparator set as Table~\ref{tab:safe_rl_external}, with return and Diff MSE also shown. PPO-Penalty and PPO-Lagrangian are not code failures: they produce finite artifacts, but they fail the control objective in this high-noise stress test because tracking error, dense violation rate, and posterior residual remain high.

\begin{table*}[t]
\caption{Complete safe-RL comparator table, high-noise setting with 5 seeds.}
\label{tab:appendix_safe_rl_full}
\centering
\scriptsize
\begin{tabular}{lcccccc}
\toprule
Method & Return & RMSE & Applied Var & Diff MSE & Dense Viol. & B-L Max \\
\midrule
PPO-Penalty & $-190.951 \pm 146.747$ & $1.133 \pm 0.614$ & $0.0937 \pm 0.0055$ & $0.2066 \pm 0.0225$ & $0.833 \pm 0.156$ & $3083.988 \pm 3827.861$ \\
PPO-Lagrangian & $-126.863 \pm 37.426$ & $0.885 \pm 0.127$ & $0.0912 \pm 0.0023$ & $0.1916 \pm 0.0108$ & $0.933 \pm 0.084$ & $2163.164 \pm 1695.603$ \\
SAC-Lagrangian & $-55.368 \pm 4.221$ & $0.464 \pm 0.039$ & $0.1340 \pm 0.0017$ & $0.3378 \pm 0.0152$ & $0.756 \pm 0.090$ & $45.690 \pm 7.582$ \\
Shielded SAC & $-40.977 \pm 1.238$ & $0.382 \pm 0.016$ & $0.1056 \pm 0.0089$ & $0.2972 \pm 0.0339$ & $0.167 \pm 0.050$ & $42.389 \pm 9.797$ \\
Full CG-RVC & $-9.322 \pm 0.197$ & $0.282 \pm 0.004$ & $0.0064 \pm 0.0008$ & $0.0072 \pm 0.0030$ & $0.000 \pm 0.000$ & $6.708 \pm 1.319$ \\
\bottomrule
\end{tabular}
\end{table*}

\section{Proofs}
\label{app:proofs}

\subsection{Proof of Theorem~\ref{thm:source_amplifier}}
Let $\eta_t=\Bs\xi_t+w_t$. Then
\begin{equation}
\Sigma_{t+1}=K\Sigma_tK^\top+Q_{\mathrm{src}}.
\end{equation}
Iterating yields
\begin{equation}
\Sigma_t=K^t\Sigma_0(K^t)^\top+
\sum_{i=0}^{t-1}K^iQ_{\mathrm{src}}(K^i)^\top.
\end{equation}
Since $\rho(K)<1$, the first term vanishes and the infinite series converges, giving \eqref{eq:source_amplifier}.

\subsection{Proof of Proposition~\ref{prop:monotonicity}}
If $\Sigma_a^{(2)}-\Sigma_a^{(1)}\succeq0$, then
\begin{equation}
\Sigma_z^{(2)}-\Sigma_z^{(1)}
=
\sum_i K^i\Bs
(\Sigma_a^{(2)}-\Sigma_a^{(1)})
\Bs^\top(K^i)^\top\succeq0.
\end{equation}

\subsection{Proof of Proposition~\ref{prop:nonnormal_bound}}
From \eqref{eq:source_amplifier},
\begin{equation}
\|\Sigma_z\|_2\le
\sum_i\|K^i\|_2^2\|Q_{\mathrm{src}}\|_2.
\end{equation}
If $K=V\Lambda V^{-1}$, then
\begin{equation}
\|K^i\|_2\le \kappa_2(V)\rho(K)^i.
\end{equation}
Substituting this inequality and summing the geometric series gives \eqref{eq:nonnormal_bound}.

\subsection[Proof of the P-Weighted Propagation Bound]{Proof of the $P$-Weighted Propagation Bound}
Using $V(z)=z^\top Pz$ and the conditional orthogonality assumptions,
\begin{align}
\E[V(z_{t+1})]
&=
\E[z_t^\top K^\top PK z_t]
+\tr(M_s\Sigma_r)+\tr(PW).
\end{align}
By definition of $\gP$ in \eqref{eq:gamma_p}, $K^\top PK\preceq \gP^2P$. Thus \eqref{eq:p_recursion} follows, and taking the stationary limit gives \eqref{eq:p_bound}.

\subsection{Colored-Input Augmentation}
Using $y_{t+1}=\alpha y_t+(1-\alpha)\epsilon_{t+1}$ and $z_{t+1}=Kz_t+\Bs y_t+w_t$ with $\bar z_t=[z_t^\top,y_t^\top]^\top$ gives \eqref{eq:augmented_filter}. If $\epsilon_t$ is white with covariance $\Sigma_\epsilon$, the scalar covariance recursion for $y_t$ is $\Sigma_y=\alpha^2\Sigma_y+(1-\alpha)^2\Sigma_\epsilon$, yielding \eqref{eq:filter_variance}.

\subsection{Proof of Theorem~\ref{thm:robust_mismatch}}
Let $\nu_t=\Bs\xi_t+w_t+\tilde e_t$. Then the centered dynamics are $z_{t+1}=Kz_t+\nu_t$. Expanding the Lyapunov function gives
\begin{equation}
V(z_{t+1})=z_t^\top K^\top PKz_t+2z_t^\top K^\top P\nu_t+\nu_t^\top P\nu_t.
\end{equation}
Conditioned on $\mathcal F_t$, the cross term vanishes because $\E[\nu_t\mid\mathcal F_t]=0$. The contraction condition gives $z_t^\top K^\top PKz_t\le \gP^2V(z_t)$. Conditional second-order uncorrelatedness and the covariance bounds give
\begin{equation}
\E[\nu_t\nu_t^\top\mid\mathcal F_t]
\preceq
\Bs\Sigma_r\Bs^\top+W+\Sigma_e.
\end{equation}
Therefore
\begin{equation}
\E[\nu_t^\top P\nu_t\mid\mathcal F_t]
\le
\tr(M_s\Sigma_r)+\tr(PW)+\tr(P\Sigma_e).
\end{equation}
Taking total expectation gives
\begin{equation}
\E[V(z_{t+1})]
\le
\gP^2\E[V(z_t)]+q_r+q_w+q_e.
\end{equation}
Unrolling this scalar recursion gives \eqref{eq:robust_finite_time}; taking $t\to\infty$ gives \eqref{eq:robust_mismatch_bound}.

\subsection{Proof of Corollary~\ref{cor:physical_dispersion}}
If $\Sigma_e\preceq\epsilon I$, then $\tr(P\Sigma_e)\le\epsilon\tr(P)$. Also $V(z)\ge\lambda_{\min}(P)\|z\|_2^2$. The local inverse-Lipschitz condition implies $\|x-x^\star\|_2^2\le\ell_\psi^{-2}\|z-z^\star\|_2^2$. Combining these inequalities with \eqref{eq:robust_mismatch_bound} gives \eqref{eq:physical_dispersion_bound}.

\subsection{Actor Optimization Statements}
\label{app:actor_optimization_bounds}

This subsection proves the actor-stationarity and nominal-return-gap statements used in Section~V. The statements concern the fixed-critic, fixed-surrogate actor update in Assumption~\ref{assump:actor_smooth}. Full nonconvex actor--critic behavior with changing replay data and refreshed certificates is outside these actor-stationarity claims.

\subsection{Proof of Proposition~\ref{prop:actor_convergence}}
Since $F_{\mathrm{CG}}$ is $L_{\mathrm{CG}}$-smooth, the ascent lemma gives
\begin{align}
F_{\mathrm{CG}}(\theta_{t+1})
&\ge F_{\mathrm{CG}}(\theta_t)
+\eta\nabla F_{\mathrm{CG}}(\theta_t)^\top g_t \nonumber\\
&\quad -\frac{L_{\mathrm{CG}}\eta^2}{2}\|g_t\|_2^2.
\end{align}
Taking conditional expectation and using unbiasedness and the variance bound,
\begin{align}
\E[F_{\mathrm{CG}}(\theta_{t+1})\mid\theta_t]
&\ge F_{\mathrm{CG}}(\theta_t)
 +c_\eta\|\nabla F_{\mathrm{CG}}(\theta_t)\|_2^2 \nonumber\\
&\quad -\frac{L_{\mathrm{CG}}\eta^2\sigma_g^2}{2}.
\end{align}
Here $c_\eta=\eta(1-L_{\mathrm{CG}}\eta/2)$. For $\eta\le1/L_{\mathrm{CG}}$, this coefficient is at least $\eta/2$. Summing from $0$ to $T-1$ and using $F_{\mathrm{CG}}(\theta_T)\le F_{\mathrm{CG}}^\star$ yields \eqref{eq:actor_convergence_bound}.

\subsection{Proof of Proposition~\ref{prop:suboptimality_gap}}
Because $\theta_{\mathrm{CG}}$ maximizes the regularized objective,
\begin{align}
&J(\theta_{\mathrm{CG}})
-\lambda_{\mathrm{ALE}}\mathcal R_P(\theta_{\mathrm{CG}})
-\lambda_{\Delta u}\mathcal R_{\Delta u}(\theta_{\mathrm{CG}})
\nonumber\\
&\quad\ge
J(\theta^\star)
-\lambda_{\mathrm{ALE}}\mathcal R_P(\theta^\star)
-\lambda_{\Delta u}\mathcal R_{\Delta u}(\theta^\star).
\end{align}
Rearranging and using nonnegativity of both regularizers gives
\begin{equation}
J(\theta^\star)-J(\theta_{\mathrm{CG}})
\le
\lambda_{\mathrm{ALE}}\mathcal R_P(\theta^\star)
+\lambda_{\Delta u}\mathcal R_{\Delta u}(\theta^\star).
\end{equation}
Moreover,
\begin{equation}
\mathcal R_P(\theta)
=\frac{\tr(M\Sigma_r(\theta))}{1-\gP^2}
\le
\frac{\|M\|_2\tr(\Sigma_r(\theta))}{1-\gP^2}.
\end{equation}
Since $\|M\|_2\le\|P\|_2\|\Phi_u\|_2^2$ and $\tr(\Sigma_r)\le\sqrt m\|\Sigma_r\|_F$, \eqref{eq:suboptimality_gap} follows. If $F_{\mathrm{CG}}(\widehat\theta_{\mathrm{CG}})\ge F_{\mathrm{CG}}(\theta_{\mathrm{CG}})-\varepsilon_{\mathrm{opt}}$, add $\varepsilon_{\mathrm{opt}}$. If $|J_{\mathrm{true}}(\theta)-J(\theta)|\le\Delta_{mm}$ uniformly, converting from surrogate to true return adds $2\Delta_{mm}$, giving \eqref{eq:true_suboptimality_gap}.

\subsection{Local Optimizer Perturbation under P-ALE}
If $J$ is locally $\mu$-strongly concave near $\theta^\star$ and $\sup_{\theta\in\mathcal N}\|\nabla\mathcal R_P(\theta)\|_2\le G_R$, any local optimizer $\theta_\lambda$ of $J-\lambda\mathcal R_P$ in $\mathcal N$ satisfies
\begin{equation}
\|\theta_\lambda-\theta^\star\|_2\le\frac{\lambda G_R}{\mu}.
\end{equation}
If $J$ is also $L_J$-smooth, then
\begin{equation}
J(\theta^\star)-J(\theta_\lambda)
\le
\frac{L_J\lambda^2G_R^2}{2\mu^2}.
\end{equation}
This local perturbation result is not used by the experiments; it records the standard small-$\lambda$ trade-off.

\subsection{Projection and Feasible-Tube Statements}
\label{app:projection_bounds}

Let the physical safe set be
\begin{equation}
\mathcal X_{\mathrm{safe}}=
\{x:h_i(x)\ge0,\; i=1,\ldots,q\}.
\label{eq:x_safe}
\end{equation}
A local CBF-style safe action set can be written as
\begin{align}
\mathcal U_{\mathrm{safe}}(x)=
\{u\in\mathcal U:
&h_i(f(x,u,d))\ge(1-\alpha_i)h_i(x),\nonumber\\
&\forall d\in\mathcal D_w,\; i=1,\ldots,q\}.
\label{eq:u_safe_robust}
\end{align}
For a fixed closed convex set $\mathcal U$, Euclidean projection is nonexpansive:
\begin{equation}
\|\Pi_{\mathcal U}(u)-\Pi_{\mathcal U}(v)\|_2\le \|u-v\|_2.
\label{eq:projection_nonexp}
\end{equation}

\begin{definition}[Local Recursive Feasibility Set]
A set $\mathcal X_{RF}\subseteq\mathcal X_{\mathrm{safe}}$ is locally recursively feasible if, for every $x\in\mathcal X_{RF}$, $\widehat{\mathcal U}_{\mathrm{safe}}(x)$ is nonempty, closed, and convex, and for all $u\in\widehat{\mathcal U}_{\mathrm{safe}}(x)$ and all $d\in\mathcal D_w$, $f(x,u,d)\in\mathcal X_{RF}$.
\end{definition}

\begin{proposition}[Local Recursive Feasibility of Safety Projection]
\label{prop:recursive_feasibility}
If $x_0\in\mathcal X_{RF}$ and the projected action in \eqref{eq:safe_action} is applied at every step, then $x_t\in\mathcal X_{RF}\subseteq\mathcal X_{\mathrm{safe}}$ for all $t\ge0$.
\end{proposition}

For a local polyhedral approximation,
\begin{equation}
\widehat{\mathcal U}_{\mathrm{safe}}(x)=\{u:A_xu\le b_x\},
\qquad
A_x=\begin{bmatrix}a_1(x)^\top\\ \vdots\\ a_q(x)^\top\end{bmatrix}.
\label{eq:poly_safe_set}
\end{equation}
Assume $u_{\mathrm{nom}}(x)$ is inside this set with margins $\eta_j(x)=b_j(x)-a_j(x)^\top u_{\mathrm{nom}}(x)>0$, and $u^{\mathrm{pre}}=u_{\mathrm{nom}}(x)+r$ with $\E[r\mid x]=0$ and $\E[rr^\top\mid x]=\Sigma_r(x)$.

\begin{proposition}[Barrier-Edge Hitting Probability]
\label{prop:barrier_probability}
If $M=\Phi_u^\top P\Phi_u\succ0$ on the residual action space, then
\begin{equation}
\mathbb P(u^{\mathrm{pre}}\notin\widehat{\mathcal U}_{\mathrm{safe}}(x)\mid x)
\le
\tr(M\Sigma_r(x))
\sum_{j=1}^q
\frac{\|M^{-1/2}a_j(x)\|_2^2}{\eta_j(x)^2}.
\label{eq:barrier_probability}
\end{equation}
Equivalently, the right-hand side is proportional to $(1-\gP^2)\mathcal R_P(\theta)$.
\end{proposition}
If the residual has nonzero mean $\mu_r(x)$, replace $\eta_j(x)$ by $\bar\eta_j(x)=\eta_j(x)-a_j(x)^\top\mu_r(x)$ whenever $\bar\eta_j(x)>0$.

Let $d_{\mathrm{proj}}(x)=\dist(u^{\mathrm{pre}},\widehat{\mathcal U}_{\mathrm{safe}}(x))$. If a ball $\mathbb B(u_{\mathrm{nom}}(x),d_s(x))$ is contained in $\widehat{\mathcal U}_{\mathrm{safe}}(x)$ and $M\succeq\mu_M I$, then for any $\delta>0$,
\begin{equation}
\mathbb P(d_{\mathrm{proj}}(x)>\delta\mid x)
\le
\frac{\tr(M\Sigma_r(x))}{\mu_M(d_s(x)+\delta)^2}.
\label{eq:projection_disturbance_probability}
\end{equation}
For polyhedral sets, Hoffman's bound gives a complementary expected correction bound \cite{hoffman1952approximate}:
\begin{equation}
\E[d_{\mathrm{proj}}(x)^2\mid x]
\le
H_x^2\|A_xM^{-1/2}\|_F^2\tr(M\Sigma_r(x)).
\label{eq:hoffman_projection_bound}
\end{equation}

Finally, suppose a Lyapunov ellipsoid $\mathcal E_c=\{z:V(z)\le c\}$ maps into $\mathcal X_{RF}$ under the local inverse of $\psi$. Combining Theorem~\ref{thm:robust_mismatch} with Markov's inequality and the CG-RVC specialization $M_s=M$ gives
\begin{equation}
\limsup_{t\to\infty}\mathbb P(x_t\notin\mathcal X_{RF})
\le
\frac{
\tr(M\Sigma_r)+\tr(PW)+\tr(P\Sigma_e)
}{c(1-\gP^2)}.
\label{eq:feasible_tube_probability}
\end{equation}

\subsection{Proof of Proposition~\ref{prop:recursive_feasibility}}
Since $x_0\in\mathcal X_{RF}$, $\widehat{\mathcal U}_{\mathrm{safe}}(x_0)$ is nonempty, closed, and convex; the Euclidean projection exists and belongs to that set. By recursive feasibility, the next state is in $\mathcal X_{RF}$ for every allowed disturbance. Repeating the argument by induction gives $x_t\in\mathcal X_{RF}\subseteq\mathcal X_{\mathrm{safe}}$ for all $t\ge0$.

\subsection{Proof of Proposition~\ref{prop:barrier_probability}}
By the union bound,
\begin{equation}
\mathbb P(u^{\mathrm{pre}}\notin\widehat{\mathcal U}_{\mathrm{safe}}(x)\mid x)
\le
\sum_{j=1}^q\mathbb P(a_j^\top r>\eta_j\mid x).
\end{equation}
Chebyshev's inequality gives $\mathbb P(a_j^\top r>\eta_j\mid x)\le a_j^\top\Sigma_r a_j/\eta_j^2$. Since $M\succ0$,
\begin{align}
a_j^\top\Sigma_r a_j
&=\tr\!\left(M^{-1/2}a_ja_j^\top M^{-1/2}M^{1/2}\Sigma_rM^{1/2}\right)\\
&\le \|M^{-1/2}a_j\|_2^2\tr(M\Sigma_r).
\end{align}
Substituting this bound and summing over $j$ gives \eqref{eq:barrier_probability}. The nonzero-mean version follows by replacing the margin with $\bar\eta_j=\eta_j-a_j^\top\mu_r$.

\subsection{Projection-Disturbance Bounds}
If $\mathbb B(u_{\mathrm{nom}}(x),d_s(x))\subseteq\widehat{\mathcal U}_{\mathrm{safe}}(x)$, then $d_{\mathrm{proj}}(x)\le(\|r\|_2-d_s(x))_+$. Thus $\mathbb P(d_{\mathrm{proj}}(x)>\delta\mid x)\le\mathbb P(\|r\|_2>d_s(x)+\delta\mid x)$. If $M\succeq\mu_MI$, then $\|r\|_2^2\le\mu_M^{-1}r^\top Mr$. Markov's inequality gives \eqref{eq:projection_disturbance_probability}.

For the polyhedral set, Hoffman's bound gives $\dist(u,\widehat{\mathcal U}_{\mathrm{safe}}(x))\le H_x\|(A_xu-b_x)_+\|_2$ \cite{hoffman1952approximate}. With $u=u_{\mathrm{nom}}+r$ and nonnegative margin $\eta_x=b_x-A_xu_{\mathrm{nom}}$, $\|(A_xr-\eta_x)_+\|_2\le\|A_xr\|_2$. Hence
\begin{align}
\E[d_{\mathrm{proj}}(x)^2\mid x]
&\le H_x^2\tr(A_x\Sigma_rA_x^\top)\nonumber\\
&\le H_x^2\|A_xM^{-1/2}\|_F^2\tr(M\Sigma_r),
\end{align}
which gives \eqref{eq:hoffman_projection_bound}.

\subsection{Projection Nonexpansiveness}
For a closed convex set $\mathcal U$, Euclidean projection is firmly nonexpansive \cite{bauschke2011convex}:
\begin{equation}
\|\Pi_{\mathcal U}(u)-\Pi_{\mathcal U}(v)\|_2^2
\le
(u-v)^\top(\Pi_{\mathcal U}(u)-\Pi_{\mathcal U}(v)).
\end{equation}
Cauchy-Schwarz implies \eqref{eq:projection_nonexp}.

\subsection{Local Feasible Tube Probability}
If $\psi^{-1}(\mathcal E_c)\subseteq\mathcal X_{RF}$, then $x_t\notin\mathcal X_{RF}$ implies $V(z_t)>c$ within the local chart. Markov's inequality and Theorem~\ref{thm:robust_mismatch} give \eqref{eq:feasible_tube_probability}.

\section{Reproducibility and Artifact Summary}

The reproducibility package for review will include the source code, configuration files, seed lists, raw rollout logs, processed metrics, plotting scripts, and the evidence map used to generate all tables and figures in this manuscript. The experimental protocol reports seeds, noise levels, rollout horizons, aggregation rules, and metric definitions in Section~VII-A. Local implementation paths are intentionally omitted from the manuscript; they are maintained in the artifact index rather than in the paper body.

\bibliographystyle{IEEEtran}
\bibliography{tac_references_v4_1}

\end{document}
