The failure characterised here is an instrument structurally incapable of returning a positive — and the remedy is a known-answer control: plant a signal, confirm the instrument finds it. On 2026-08-01 three independent sessions produced the same wrong null with that remedy in place and passing.
The claim was that two wearables share too few beats to align (5–26 % correspondence, called a physiological limit). Each session ran an honest chance control — circular shift, +1 h shift, shuffled surrogates — and each correctly reported that the measurement beat chance. The measurement was nonetheless meaningless: it fitted one constant offset to a pair whose clocks separate by more than a heartbeat across a night. Refitting locally takes correspondence to 43–98.8 %.
The known-answer control passed because it was planted under the model's own assumption. A synthetic pair offset by a constant 137 ms was recovered to 99.94 ms — proving the estimator works on the world the estimator assumes. It took planting a pair that drifts to expose the defect. So:
A control tells you whether you beat chance. A known-answer tells you whether the estimator recovers a planted truth. Neither can tell you the model is too simple — and a known-answer planted under the model's own assumptions is guaranteed to pass, however wrong the model is.
What exposed it was not a better statistic. Two things did:
refitting a supposedly-constant parameter locally and watching it march (a constant that
will not stay constant is a missing term), and an over-determined consistency check — with
three devices, the three pairwise rates must satisfy d(A↔B) ≡ d(A↔C) − d(B↔C), which
has no free parameter to absorb an error. Both are redundancy in the measurement, not more
surrogates around it.
This is a companion failure mode to the paper's, not a correction of it:
there the instrument could not return a positive; here it could, did, and was still wrong. The
practical addition to the checklist is plant your known-answer under a model you are not
assuming. Recorded in briefs/CROSS-DEVICE-DRIFT-AND-CLOSURE-2026-08-01-BRIEF.md §4.
Methods note, Tepna physiological-signal suite
Background. Negative results are increasingly published, and rightly so. But a null carries an asymmetric evidential burden that the positive literature does not: a positive result is checked by the world, whereas a null is only ever checked by the instrument that produced it. If that instrument was incapable of returning a positive, the null describes the instrument and not the world — and nothing in the usual reporting distinguishes the two cases. Objective. State the failure mode precisely, give the arithmetic that predicts when a search enters it, and demonstrate both on two of this suite's own published or near-published nulls. Method. Two diagnostics, each cheap. (i) A known-answer control: run the identical code and parameters on a case whose answer is fixed by construction, and on the same case with a known effect planted. (ii) A chance-maximum bound: for a search maximising correlation over N candidate lags with n samples per comparison, the expected largest spurious correlation is ≈ (1/√n)·√(2 ln N); if the acceptance threshold falls below it, the search is guaranteed to report a confident value drawn from noise. Results. Widening a cross-correlation from ±1.6 s to ±50 min at 250 ms resolution takes N from 65 to 24,001 while a ±15 s window supplies n = 121, giving a chance maximum of ≈ 0.41 against an acceptance threshold that had been lowered to 0.35 — inoperative. The known-answer control confirms it: on two accelerometers sharing one acquisition clock the search recovers a planted −39 min offset on 1 night of 13, attenuated to −14.3 min, while the same code at its design range aligns 13/13 to sub-1.6 s. Lengthening the correlation window restores the bound and recovery improves monotonically (±60 s → −27.3 min, 3/13; ±240 s → −31.4 min, 6/13), a dose-response that identifies the mechanism. Because the noise median regresses to the centre of the search range, the failed search reports ≈ 0 whatever the truth is — so its null is indistinguishable from a measurement. Two of this suite's conclusions rested on this regime: one is withdrawn, one is void. A third error, in the same family, shows a companion metric that cannot move under the failure it was trusted to detect. Conclusion. Report, alongside any null, the demonstration that the method recovers a planted effect of the size being denied. Where a null is explained by a physical mechanism, test one prediction that mechanism makes and its rivals do not; in our case that test was a single correlation over an already-published table, and it overturned the paper's thesis.
Keywords: negative results · null calibration · known-answer control · positive control · multiple comparisons · cross-correlation · sensor fusion · reproducibility · self-correction · research methods
If you search a haystack and find no needle, that tells you something — but only if you can show your search would have found a needle had one been there. Otherwise all you have learned is that your search doesn't work. This is obvious when stated, and we still got it wrong twice.
Both times we were trying to line up two recordings in time by sliding one against the other until they matched best. When you allow a very wide range of possible shifts, you get an enormous number of chances to match by pure luck — and luck reliably beats the real answer. Worse, we had lowered the bar for what counted as a good match, precisely because the search "wasn't finding anything". That guaranteed the luck would win. And because the lucky matches scatter evenly, their average lands in the middle of the range we searched, which looks reassuringly like "no shift found" — the exact answer a broken search produces regardless of the truth.
The fix costs almost nothing: take a case where you already know the answer, hide a known shift in it, and check the search finds it. When we did that, our search missed a hidden 39-minute shift on twelve of thirteen tries. So our earlier conclusion — that two body sensors couldn't be aligned from their motion — was never evidence. We also learned a second, sharper lesson: one of our safety checks was mathematically incapable of registering the error it was meant to catch, so it stayed green throughout and made us more confident, not less.
A published positive claim is exposed. Others will try to reproduce it, and the instrument that produced it will be turned on new data where it can embarrass its author. A published null is not exposed in the same way. Nobody reproduces an absence; the result is filed, cited as a boundary, and the instrument is retired. The only entity that ever tested whether the instrument worked is the instrument itself, and its null is consistent with two states of the world that the usual reporting cannot separate: the effect is absent, and the method could not have detected the effect.
This is not the familiar point about statistical power. Power analysis asks whether the sample was large enough given that the estimator is unbiased and the noise model holds. The failure here is upstream of that: the estimator is not merely underpowered but structurally incapable, and it reports a confident, stable, plausible number while being so. Nothing in a power calculation catches it, because the noise is not the noise the calculation assumed.
The remedy is the oldest one in experimental science and is simply not conventional in computational analysis: a positive control. Before believing a null, run the identical pipeline on a case where the answer is known, and on the same case with a known effect planted at the magnitude being denied. This note gives the arithmetic that predicts when the control is essential, and reports what happened when we finally ran it.
Consider the common shape: two series are aligned by choosing the lag that maximises their normalised cross-correlation, accepting the result if the correlation clears a threshold rmin. Let N be the number of candidate lags searched and n the number of samples in each comparison window. For roughly independent samples the sample correlation under the null has sd ≈ 1/√n, and the expected maximum of N such draws is approximately
E[max spurious r] ≈ (1/√n) · √(2 ln N)
The consequence is stark. If rmin < E[max spurious r], the acceptance threshold is inoperative: chance alone clears it on essentially every trial, so the search always returns a confident lag, and that lag is noise. Two further properties make the failure hard to notice.
The bound is crude — neighbouring lags are correlated, so the effective N is smaller than the nominal count, and the estimate is generous. That is the right direction for a screening test: it over-warns rather than under-warns. Table 1 evaluates it for the configurations at issue here.
| configuration | window samples n | candidate lags N | E[max spurious r] | rmin | verdict |
|---|---|---|---|---|---|
| design range (±1.6 s @ 50 ms) | 65 | 65 | 0.358 | 0.60 | threshold binds |
| wide search (±50 min @ 250 ms, ±15 s window) | 121 | 24,001 | 0.408 | 0.35 | INOPERATIVE |
| wide search, ±60 s window | 481 | 24,001 | 0.205 | 0.35 | threshold binds |
| wide search, ±240 s window | 1,921 | 24,001 | 0.102 | 0.35 | threshold binds |
Table 1 · The same aligner at four settings. Only the highlighted row was used to produce a published conclusion. Note that the design-range configuration is safe not because it searches few lags but because its threshold was never lowered.
The bound predicts failure; a control demonstrates it. The requirement is a case whose answer is fixed by construction while remaining, in every other respect, the problem actually being studied — otherwise the control tests the arithmetic rather than the method.
Construction. A capture host records a Polar H10 chest accelerometer and a Polar Verity accelerometer through one daemon on one clock. Their true relative offset is therefore zero by construction, while they remain two different sensors on two different body segments whose signals are correlated only through real body movement — which is the situation the original analysis addressed. An autocorrelation of one sensor against itself would have been useless here: it shares the noise, and would have verified only that the code can find a peak.
Legs. 13 nights, 30–1,313 min of overlap each. Each night was run at the design range, at the wide-search settings, and at the wide-search settings with a known offset planted in one stream by shifting its timeline. The planted leg is scored as recovered(I) − recovered(0), a self-consistency comparison that requires no knowledge of the implementation's sign convention.
| leg | nights aligned | median reported offset | median anchor spread | recovered |
|---|---|---|---|---|
| design range, true offset 0 | 13/13 | 0.00 min | 0.1 min | 13/13 |
| wide search, true offset 0 | 13/13 | 0.00 min | 92.4 min | 11/13 “within ±5 min” |
| wide search, −39 min planted | 13/13 | −20.11 min | 94.2 min | 1/13 (Δ = −14.3 of −39) |
| wide search, +17.5 min planted | 13/13 | +12.44 min | 92.4 min | 7/13 (Δ = +12.6 of +17.5) |
Table 2 · The control. Anchor spread is the range of the per-anchor offset estimates within a night: at the design range they agree to 0.1 min, in the wide search they cover essentially the entire ±50 min searched — the signature of noise.
Three things in Table 2 deserve emphasis.
4.1 A withdrawn cause. A prior preprint reported that two body-worn sensors could not be re-synchronised from their accelerometers, and attributed the failure to anatomy — that a chest strap and an ankle band register largely uncorrelated motion, from which it further concluded that inertial re-synchronisation requires co-located sensors. The failure reproduces. The explanation does not survive: the control above shows the same code, at the same settings, failing on a pair whose offset is known, while the same code at its design range aligns two different body segments 13/13 to sub-1.6 s. The anatomical claim is therefore unsupported rather than disproven — and the distinction matters, because the original wording closed a design direction that is in fact still open. (The control pairs chest with arm rather than chest with ankle, so it cannot establish the converse.)
4.2 A void null. A separate analysis asked whether a CPAP machine's mis-set clock could be fitted by correlating its airflow disturbances against body movement recorded on an accurately-clocked device. It returned 1 of 28 nights near the independently-known offset, against a chance expectation of 2.8 — read at the time as evidence that airflow disturbance does not track movement. It was run in exactly the regime of Table 1's highlighted row. That null is void: it cannot distinguish the physiological claim from the method's blindness, and the underlying question is reopened. The offset itself was recovered by a different estimator that pools every event across the whole night at each candidate lag rather than correlating a short window — raising n with the recording length, which is precisely the term the bound says must grow.
4.3 A companion metric that could not move. The same preprint's headline number — a per-night lag "drift" of ~1,150 ms attributed to quartz-crystal tolerance — was an artifact of a beat-coupler that searched a 2,000 ms span while only displaying its 200–650 ms physiological window, so a missed pulse admitted the next beat's. Beside that number stood a reassuring beat-to-beat interquartile spread of ~48 ms. A gated mutation control now shows that this spread cannot move at all under the failure mode: ten slipped beats in sixty do not shift a quartile. The check that supplied confidence was structurally blind to the error it was trusted to exclude, and its healthy value was uninformative rather than corroborating.
This generalises the note's thesis beyond search. Ask what a diagnostic is capable of reporting, not only what it reports. A companion metric earns its place only if some realisable failure makes it move.
4.4 A remedy accepted without measuring the quantity it removes. The same preprint prescribed single-clock acquisition as the fix. That recommendation was never checked against the size of the term it would eliminate, and both halves of that check were cheap. Upper end: the acquisition host's clock is disciplined by chrony against a local stratum-1 server to a 5.9 µs offset and a 0.008 ppm residual rate — one command on the box. Lower end: the inter-device rate implied by the observed half-to-half wander is 1.46 ppm median on the 27 longest nights, and the claimed 47.7 ppm is excluded on 51 of 54 — one division over data already collected. The remedy therefore removes ~1.5 ppm using a clock 6,000× better than the fault it was invoked against. When it was finally applied — a path that re-references both device clocks to that host every few minutes, capping accumulated drift at 8.6 ms even granting the claimed rate — the outcome was unchanged (18.8 % vs 19.0 %). A well-engineered solution to a non-problem.
Two further traps sit here, and both are general. First, establish what a comparison actually controls before resting on it. A first draft of this correction claimed the two corpora were architecturally identical — both timing samples as anchor + device-elapsed — and therefore that their agreement said nothing about the remedy. That was wrong, and it was checked only after a reviewer pressed: the single-host daemon does discipline both device clocks from its host on every connect and re-anchors each ~3.0 min fragment, so the comparison is a genuine test and the remedy genuinely fails to help. The lesson cuts both ways — an over-cautious retraction is also an unverified claim. Second, the remedy's own cost went unexamined: a genuine single-clock capture must stamp at packet arrival, and arrival stamping inherits transport burst jitter — on this host it steps backwards on 0.5–0.8 % of rows — so it would replace a stable per-sample clock with a noisier one. Before adopting a fix, measure the quantity it removes and the quantity it introduces.
The drift claim in §4.3 had a rival explanation available from the start — one slipped cardiac cycle — and the two make different, easily separated predictions. A fixed parts-per-million clock offset must produce a discrepancy proportional to recording duration. One slipped beat is independent of duration. The paper's own published per-night table contains both columns, so the test is a single correlation over data already in print:
| test on the published table (n = 11 nights) | fixed-ppm predicts | one-RR slip predicts | measured |
|---|---|---|---|
| r(recording duration, discrepancy in ms) | ≈ +1 | ≈ 0 | +0.17 |
| r(recording duration, discrepancy in ppm) | ≈ 0 | strongly negative | −0.71 |
| which is the stabler quantity across nights? | the ppm rate | the millisecond value | ms (CV 8.1 %) < ppm (CV 10.8 %) |
| median discrepancy expressed as a heart rate | unrelated to HR | = the subject's RR | 1,156 ms = RR at 51.9 bpm (stated ~50 bpm) |
Table 3 · Four discriminating tests, all computable from a table already published, all agreeing against the mechanism that was claimed.
The claimed mechanism fails every test, and the rival passes every one. Note also how the coincidence arose that made the wrong answer persuasive: one RR interval divided by one night's duration — 1,156 ms ÷ 6.6 h — is 48 ppm, which lands squarely inside the ±20–50 ppm tolerance band of ordinary quartz. A ratio of two unrelated quantities matched a familiar constant, and the match was taken as confirmation rather than as something to check.
We record this because the effort involved was negligible and the consequence was not. The refutation of a preprint's central thesis was available, for a year, in that preprint's own Table 1.
None of these require new equipment, new data, or meaningful compute. All five were available at the time of the errors described, and none was run.
tools/acc-acc-control.mjs, read-only, prints the per-night table and the aggregate verdict of Table 2. WH=<ms> overrides the correlation half-window to reproduce the ±15/60/240 s dose-response. It loads the production PATAlign aligner verbatim, so it tests the shipped code path rather than a re-implementation.*_ACC.txt streams. Note that the control's own first run silently produced 2 of 13 nights because the capture host had changed the accelerometer column layout mid-corpus and the harness indexed columns positionally — read these columns from the header.papers/wearable-clock-drift.html — One phone is not one clock — but the clock was never the problem, §7 correction record.papers/dead-ends.html.pat-align.js (coupleRtoFoot with the physiological window enforced; alignByAnchors; 16 gated assertions including the mutation control of §4.3) · tools/acc-acc-control.mjs (§3).INTEGRATOR-PAT-VASCULAR-2026-07-18-BRIEF.md §2-RESULT, §2-RESULT-II · CROSS-DEVICE-CLOCK-SKEW-2026-07-29-BRIEF.md §2c · PAT-FEASIBILITY-2026-07-08-BRIEF.md.