Tolerance limits as roles. A Tolerance k R is an optional LowerBound k R and an optional UpperBound k R — the directional roles of Bounds.lean, not bare endpoints — so each limit can only ever be used from its own side, and an absent bound is none rather than an infinity. Tolerance.admits asks whether a value conforms (the question a measurement cannot answer, which is why the rest of the module exists), and Tolerance.guardedBy derives the acceptance limits: it subtracts a band from an upper limit and adds it to a lower one. That direction is forced by the role, not chosen by convention, so "applied the guard band the wrong way and turned guarded acceptance into guarded rejection" is not a mistake a caller can make while still typechecking.

The guard band g = k\,u, a quantity of the measurand's own kind. It is built through Quantity.mul on expansionLaw, so the kind of the product is derived from a stated law — a coverage factor is dimension one in the role of expanding an uncertainty — rather than asserted. The input is a Dispersion and the output is not: a guard band is an expanded uncertainty, but what it is used as is a displacement of a limit, and the change of role happens once, here. accepts is then the decision — accept iff the estimate lies within the guarded acceptance limits — with the estimate and its uncertainty at their roles, so the two cannot be exchanged into an inverted rule that guards enormously on a small uncertainty and not at all on a large one. assess packages the whole thing: an evidence record, a tolerance and a target risk in; the factor, the band, the acceptance limits, the decision and the risk actually run out — the shape that makes the guard band an output.

The band from a stated risk. factorForRisk inverts §9.5.2: to hold the specific consumer's risk at a one-sided acceptance limit to p, the factor is k = \Phi^{-1}(1 - p) — none unless 0 < p < 1, since a risk of zero demands an infinite band and a risk of one is not a decision rule. The factor stops being an input and becomes a consequence of a risk the operator names. riskForFactor is its exact inverse, 1 - \Phi(k), and prices a band somebody else chose. Both are Gaussian, which is exact only when u is known; factorForEvidence and riskForFactorAt are the same pair at the evidence's own \nu (a Student t that is the Gaussian at \nu = \infty, so the correction appears and disappears by itself), and factorForRiskRectangular/riskForFactorRectangular are the closed-form pair for GUM 4.3.7's bounded posterior, which saturates at \sqrt{3}\,u where the risk is exactly zero.

The risk from the costs, when nobody knows what risk to ask for. Accepting a non-conforming value costs C_a; rejecting a conforming one costs C_r; at a measured value the expected costs are R_C\,C_a and (1 - R_C)\,C_r, so accepting is the cheaper action exactly while R_C \le C_r/(C_a + C_r), and that break-even risk is the target to hand to factorForRisk. The two costs must be quantities of one kind, and the step from their ratio to a probability is an authored crossing — nothing about a ratio of two durations makes it a probability except the decision-theoretic argument. Strongly asymmetric costs then produce the conclusion that is usually asserted: a wrong acceptance a hundred times as costly as a wrong rejection gives p^* \approx 1\,\% and a one-sided 2.33\,u, a derivation auditable in a way "we used 0.9" is not.

Reading a band that already exists. readBand g u divides a deployed margin by the measurand's own standard uncertainty — a quotient of two k-quantities, which bandReadingLaw declares to be a coverage factor — and says what kind of thing the band is. A BandReading is one of three constructors. coverage factor risk: a band at a few u is a coverage statement, dispersion that shrinks as evidence accumulates, and the risk it buys is attached. systematic factor: a band at tens of u is not — no risk target produces it under any posterior, so the margin is standing in for a systematic the model does not carry, which does not shrink with evidence, and tightening it as though it did is how a fleet walks into a correlated failure. unstated: the band cannot be read at all. The two readable cases have opposite repairs, which is why the distinction is a constructor and not a comment; systematicThreshold (6, where the Gaussian risk reaches 10^{-9}) is the judgement they turn on, taken as an argument so that it applies uniformly. Evidence.readBand e g is the same reading taken against a record's own evidence, priced at its \nu through riskForFactorAt instead of at the Gaussian limit, and declared in Evidence's namespace so the \nu cannot be dropped at the call site. BandReading.label forgets the evidence to a BandReadingLabel — the three-valued classification a report line or a record field states.

The one band-classification rule, and the NaN rule inside it. classifyBand g u hk systematicAt price is the single place a band is classified: the guard (u must be a positive number), the quotient g/u through bandReadingLaw, the comparison against the systematic threshold, and the pricing of a coverage statement through the price function the caller supplies — readBand passes the Gaussian riskForFactor, Evidence.readBand passes riskForFactorAt at the record's own \nu. Nothing else differs between the two entry points of the band reading.

The NaN rule. A coverage factor that is not a number — \infty/\infty, an unbounded band over an unbounded u — reads as unstated, and so does any band read against a systematic threshold that is not a number. The rule cannot be left to the comparison: NaN ≤ t and NaN > t are both false, so a rule written "\le t ⇒ coverage, else systematic" and the same rule written "> t ⇒ systematic, else coverage" classify the same band in opposite directions — one as a systematic that must never be tightened, the other as a coverage statement every downstream rule may shrink. Neither is right. unstated is chosen over the conservative systematic because a systematic is a positive claim — a term the model does not carry — that a factor nobody can price does not support; and over the permissive coverage because that is the reading whose repair, tightening, is the dangerous one. A factor nobody can price is not a reading, and a threshold nobody stated classifies nothing. Because the guard lives in classifyBand and both entry points are one-line calls to it, no caller can re-derive the wrong direction; and for every factor and threshold that are numbers the rule is unchanged — the guard falls through to exactly the comparison it always made, so \infty/1 is still a systematic and the threshold itself is still a coverage statement.