An image editor may satisfy every regional plausibility constraint individually, yet no single latent explanation can account for the entire output. We formalize this local‑to‑global failure with a common witness grade and a witness nerve. The framework separates auditing from causal identification: with only shared exogeneity, any coupling of the regime marginals is admissible; an externally justified witness relation yields sharp partial‑identification bounds for pre‑specified image features.
Helly‑type arguments give short incompatibility certificates for quasiconvex losses, heterogeneous action strata, and finite witness atlases. A blocker‑hypergraph formula provides exact repair counts. Simultaneous confidence regions for the regime marginals deliver finite‑sample outer coverage of the full identified interval.
Controlled experiments on MNIST, Morpho‑MNIST, and smallNORB demonstrate the predicted local‑global separation, while synthetic tests assess bound sharpness, certificate recovery, and structured computation. The method audits a declared feature relation and does not identify unrestricted pixel‑level counterfactuals.
$$ \text{Sharp bound: } \theta \in [\theta{L}, \theta{U}]\quad\text{with}\quad \theta_{L}=\sup{\theta: \exists\,W\text{ satisfying constraints}} $$
Review