The Uncertain Document: Propagating Uncertainty Through Everyday Software

1.Introduction

In 2013, a graduate student named Thomas Herndon requested the spreadsheet behind a famous 2010 economics paper — Growth in a Time of Debt, whose threshold claim (growth turns negative above 90% debt-to-GDP) had anchored several governments' austerity budgets. He found that the authors' Excel formula averaged the wrong rows: five countries' post-war data simply never entered the calculation. The corrected average swung the headline result. The event became folklore for two opposite lessons. The first was the industry's: spreadsheets need auditing — a demand the auditing literature had been making for decades with the numbers to back it (Panko's research program: across field audits, roughly 88–94% of inspected spreadsheets contain at least one error; cell error rates around 1–3%; the numbers have been stable since the 1990s). The second lesson is this paper's: the artifact's physics made the error invisible. A cell holding a bare number does not say where it came from, what was included, what it excludes, how wrong it might be, or what happens downstream when it is wrong. The spreadsheet did not fail because LLM-era humans are careless; it failed because a point-estimate artifact is epistemically opaque by construction — it displays the fiction of exactness in every cell, and the fiction is what everyone downstream believed.

The problem's scope is not spreadsheets; it is the number itself, as an object, in every operational document civilization runs on. A project plan says "14 days" — a point estimate for a duration that is genuinely a distribution, drawn from a reference class the plan does not state. A budget says "$1.2M" — a point estimate of a convolution whose inputs (headcount timing, vendor quotes, currency) are each themselves estimates. A hospital discharge summary says "ejection fraction 40%" — a measurement with instrument error, reported bare. A news article says "the policy will cost $3B over five years" — an estimate whose confidence interval, if drawn honestly, is often wider than the estimate is large. The decision literature has a name for the systematic damage: overconfidence, the illusion of precision, the plan's fictional anchor — entire literatures (reference-class forecasting; planning fallacy corrections; calibration training) exist to patch humans around the artifact's defect. The artifact itself was never fixed.

Metrology fixed its version of the artifact a century ago. No laboratory reports 3.2 ± nothing: the GUM standard (ISO/IEC Guide 98) defines how a measured value carries its standard uncertainty, how uncertainties propagate through computation, and how the final result is reported with stated confidence. Every engineering discipline that touches matter runs on it. The disciplines that run on documents — which is to say, all of management, most of medicine's paperwork, all of policy analysis, all of journalism's quantitative claims — never imported the standard, because their artifact (the document) had no place to put the error bars, and their display culture (false precision as authority) had every incentive not to.

The thesis in one sentence: uncertainty can be a native property of the numbers in ordinary documents — carried, propagated, presented, audited, and calibrated by the document system itself — and every required piece already exists in an adjacent world, uncomposed.

2.The point-estimate fallacy

The fallacy has four moving parts, each independently documented:

Numbers come from somewhere. Every quantity in an operational document is either measured (instrument + protocol → error), modeled (assumptions → structural error), or guessed (interval, honestly wide). Point-ness is not a property of the world; it is a display convention. The document records the convention and discards the provenance — then spends its whole life re-deriving the provenance in meetings ("where did this number come from?"), because the meetings are the only place it can live.

Computation compounds the loss. Arithmetic over point estimates discards error structure at every step: sums of independent errors narrow (in relative terms); sums of correlated errors widen; products of estimates compound multiplicatively; worst-case bounds explode under composition. Interval arithmetic has been the formal answer since Moore (1966), and the Monte Carlo machinery has been the practical one since physics adopted it at Los Alamos — both confined to expert tools, while the world's actual arithmetic happens in grids of bare floats whose formula bar has never heard of either.

Display manufactures confidence. A number shown as "3.2" is believed differently from "3.2 ± 1.4" or "roughly three": the digits perform authority. The presentation-science literature — Gigerenzer's natural-frequencies program (transparent risk communication), the calibration-training literature (forecasters trained to intervals with scoring rules become measurably better estimators), and the public-facing success of probabilistic weather (probability of precipitation, publicly legible since the 1960s-70s and U.S. public comprehension surveys at encouraging levels) and election forecasting (mainstream distributional communication in the 2008–2024 cycle) — established that presentation form drives both comprehension and calibration. The office suite chose the form that manufactures confidence, and the choice was never a decision anyone remembers making.

Decisions price the fiction. Point-estimate plans interact with commitment structures that punish variance asymmetrically (deadlines, budgets, contracts), so the organization learns to pad — privately, in the heads of estimators, reference-class knowledge encoded in personal multipliers — while the documents stay bare and the padding stays invisible to the system. The plan is a negotiation performed in point-estimate theater; the uncertainty exists, distributed across humans, unpriced by the artifact.

3.The landscape: adjacent solutions and their precise boundaries

Enterprise risk add-ons. Monte Carlo plug-ins for spreadsheets (@RISK, Crystal Ball, and descendants) have served risk analysts since the 1980s-90s: they bolt distribution objects onto cells and run the sampling. Their boundary is the gap's proof: the native cell type remains the bare float; distributions are a bolt-on used by a trained priesthood in dedicated risk workbooks, while the organization's operative documents — the plan, the budget, the summary that goes to the board — remain point-native. The add-on proved the machinery and never touched the artifact's defaults.

Scenario-modeling products. The closest commercial incumbents: dedicated modeling tools (the Causal lineage) build distribution-native models as standalone artifacts. Their boundary is the document: a Causal model is a destination you visit; the budget still lives in the grid, the prose still lives in the doc, and the numbers that actually circulate through the organization — pasted into decks, quoted in memos, embedded in dashboards — still travel as bare points. Distribution-native artifacts exist as islands; the interdocument economy runs on point freight.

Probabilistic programming. Stan, PyMC, and the Bayesian-inference ecosystem give experts full posterior machinery; the Uncertain<T>-line research (first-order types for uncertain data) showed the type-theoretic path into general languages; both stopped at the expert boundary. The programming-language research demonstrated the semantics; the office suite never imported them, and the civilians were never going to write Stan.

Interval arithmetic. Moore's 1966 framework — compute over ranges, bounds guaranteed — is textbook-complete, library-available, and product-absent for the same cultural reason: intervals are honest about their own width, and width reads as weakness in a precision-performance culture. Its current residence is compiler and numerical-analysis internals, where it does floating-point safety work invisibly — the exact invisibility pattern this program's papers keep finding.

Units as precedent. The units-of-measure type systems (F# units, the Frink calculator, the SI discipline in engineering tools) proved a property adjacent to the one this paper needs: an annotation can ride a value through computation and constrain misuse, invisibly to the expert, with errors at compile time. Units are the proof the plumbing ships: if meters can ride a number, distributions can.

Metrology. GUM (ISO/IEC Guide 98, evolving since 1993 from a 1978-originating initiative) is the standard: uncertainty budgets, propagation law, confidence reporting. Its jurisdiction is the measurement chain; the standard ends at the laboratory report, and the world's documents were never its problem. This paper is, in a precise sense, GUM's import into the document layer — with the presentation-science literature as the customs agent.

Presentation science. Natural frequencies (Gigerenzer's program and its clinical trials), calibration training with scoring rules, and the public-probabilistic successes (PoP in weather; the election-forecast era) solve the legibility objection empirically: given engineered presentation, civilians read uncertainty better than they read false precision. The display culture is not a fixed constraint; it is a choice with measured alternatives.

VERDICT: STRONG. The failure class is famous and quantified (spreadsheet-error literature; the austerity-spreadsheet incident; the planning-fallacy and overconfidence literatures); the machinery is proven in six adjacent worlds (add-ons, scenario models, PPLs, intervals, units, GUM); the presentation science exists and says the legibility objection is false; and the composition — distribution-native quantities as the default citizen of ordinary documents — exists nowhere. No office suite, no BI tool, no note app, no document standard ships it. The gap survived for cultural, not mathematical, reasons — which is the kind of gap that dissolves first once one incumbent crosses it.

4.Why the gap survived

The authority economy of the number. In organizational life, a point estimate is a commitment device and a status instrument: digits signal mastery. An uncertainty-native document redistributes authority — from the author's confidence to the evidence's structure — and the author's status loses its cheapest signal. Every participant rationally defends the display culture that prices their performance, which is why the demand for honest intervals always arrives from consumers of documents (decision-makers burned by plans) and is always resisted by producers. The composition's natural customer is the reader; the office suite sells to the writer.

Excel's grid physics. The dominant artifact is fifty years of float-cell semantics, backward compatibility as religion, and a user base of a billion non-statisticians. The add-on market is the local optimum that the artifact's owners could reach without changing the cell's type; the genuinely native move (the distribution as the cell's default citizen) requires the format, the formula language, the display layer, and the export formats to change together — a platform-scale bet nobody has wanted to make for a cultural demand that had not yet been measured.

The legibility objection was believed, not tested. "Civilians can't read error bars" was an industry article of faith; the presentation-science literature tested the faith and found the opposite — presentation form, not statistical capacity, is the binding constraint, and engineered presentation (natural frequencies, calibrated language, progressive disclosure) measurably works. The objection was refuted in the clinic and the weather page before it was ever made about the office suite; the news has not yet arrived.

The audit constituency was absent. The calibration ledger (§5.5) — retro-scoring a document's past numbers — requires the document to remember its own claims with provenance, which point-native artifacts cannot do. So the feedback loop that would create demand (your plans are systematically 12% optimistic, and here is the ledger) never spun up: the organization's estimation bias is invisible by construction, every quarter, forever. The gap is self-concealing — the strongest survival mechanism in this program's catalogue.

Tools treated uncertainty as a destination, not a transport. Every adjacent product made distributional thinking a place you go (a risk workbook, a model, a PPL script) rather than a property of the numbers in transit — and the numbers that matter are precisely the ones in transit: copied from the plan into the deck, from the deck into the memo, from the memo into the contract. Uncertainty that does not survive copy-paste is uncertainty that dies at the organization's first boundary, which is to say, immediately.

5.The specification

5.1 The quantity object

The document's atomic numeric type becomes the quant: {value (point), distribution (parametric or sampled), provenance (origin record: measured-by, modeled-from, assumed, or guessed; with links), confidence (the stated interval and level), units (physical or currency, per the units precedent), and created-at}. Backward compatibility is total: a bare number is a quant whose distribution has degenerated to a delta — the document system upgrades it silently, and every operation that follows treats it as what it is: an assumption with infinite confidence asserted and none held. The provocation is deliberate: in a quant-native document, the bare number is flagged as an epistemically naked value, the way a modern linter flags an unhandled case.

5.2 Propagation semantics

Operations over quants follow a cost-tiered engine: interval arithmetic for the linear and monotone cases (fast, sound bounds); Monte Carlo for the general case (composition, conditionals, aggregations — with the sampling budget adaptive to the display context: a hover gets 10,000 draws, a print gets a precomputed summary); symbolic forms preserved where cheap (the Gaussian-sum closed forms, the standard GUM propagation law as the first tier, exactly as the metrology standard specifies). The engine is invisible: civilians never see the math; they see results whose honesty is computed rather than asserted by footnote. Correlation is the honest hard part: the object carries declared dependence classes (independent / common-driver / perfectly correlated), defaults conservative, and the document surfaces the assumption the way it surfaces a formula's precedent cells.

5.3 The presentation layer

The display contract is where the presentation science cashes out: default rendering is calibrated prose with progressive disclosure — "roughly 3.2k (90%: 2.1k–4.6k)" — with the full distribution, provenance chain, and sampling detail one interaction away; ranges over point digits wherever the quant is live (the font of the digit stops performing authority); natural-frequency forms for risk ratios ("about 4 in 100," per the clinical evidence); and a calibrated-language scale binding prose qualifiers to stated probabilities ("very likely" ≥ 90%, per the IPCC's calibrated-uncertainty language precedent), so words stop drifting from numbers. Charts render the distribution by default (interval bands; densities), not the point.

5.4 The assumption registry

Every quant whose provenance is modeled-from or assumed links to its assumptions, and the registry ages them: assumptions carry creation dates, sensitivity ranks (which inputs the output actually moves — the engine's derivative information, free), and a depreciation schedule (an assumption from 2019 quoted in a 2026 document is aged, and the document says so). The registry is the answer to the question every meeting asks — where did this number come from? — answered by the artifact instead of the archaeology.

5.5 The calibration ledger

The paper's sharpest instrument: the document system retro-scores its own past quants when outcomes arrive (the actual duration; the actual spend; the actual event), computing a calibration record per author, per template, per organization, per horizon — Brier-score-style, with the overconfidence/underconfidence decomposition (bias vs. spread), reported in the document's own language ("this team's 90% intervals have covered 62% of outcomes over eight quarters: intervals too narrow, durations biased 12% optimistic at the 90-day horizon"). Calibration training's literature says the feedback loop improves estimators; the ledger builds the loop into the artifact. Reference-class forecasting stops being a consultancy and becomes a query.

5.6 Transport

Uncertainty survives copy-paste (the quant serializes with the number), export (the interchange format carries the object), and APIs (the field is a quant, not a float) — the units precedent's lesson applied: the property must ride the value across every boundary, or it dies at the first one. The deck pasted from the plan inherits the plan's intervals; the memo quoting the budget quotes its bands; the contract referencing the estimate states its confidence, or its absence, as a first-class fact.

5.7 Migration

The deployment answer to Excel's fifty-year physics: a quant layer as an add-in-shaped surface over the existing grid (the add-on market's proven adoption channel), quant-native as the default for new documents, and a one-command audit ("bare-number census: this workbook contains 340 naked values, 41 load-bearing") that turns existing point-native artifacts into upgrade candidates by counting their epistemic debt — the census being the moment the artifact's physics becomes a choice the organization can see.

6.Evaluation design

1. Error-detection trials. The austerity-spreadsheet class, experimentally: participants receive documents with seeded errors (wrong rows averaged; stale assumptions; unit confusions) in point-native and quant-native forms; measure detection rate and time. The theory predicts the error class that was invisible to a decade of policy economics becomes findable, because provenance and intervals are the search surface.
2. Decision-quality trials. Standard decision-paradigm studies (planning tasks, budget reviews) under both document forms; measure the plans' calibration (post-hoc coverage of outcome distributions) and the decisions' sensitivity to stated confidence. The presentation-science literature predicts legible intervals improve both; the falsifier is the legibility objection turning out true at document scale.
3. Calibration-loop field trial. Teams run the ledger for three quarters; measure estimator calibration drift (bias and spread error before/after feedback). The training literature predicts improvement; the artifact-level test is whether the loop works when it is ambient rather than enrolled.
4. Comprehension across presentation forms. Counterbalance prose-digits, intervals, natural frequencies, densities, and progressive disclosure across lay populations; establish the display contract empirically rather than by taste.
5. Transport integrity. Round-trip quants across paste, export, and API surfaces; measure where the uncertainty dies. Every boundary it survives is adoption surface area; every boundary it does not is the next spec item.

7.What this is not

This is not a statistics package: the user never enrolls in a stats curriculum; the engine does the statistics and the display contract does the translation. This is not Monte Carlo for modelers — the risk-analyst priesthood already has its tools; the paper's artifact is the document where the organization's actual numbers live. This is not a universal-precision fantasy — plenty of numbers are exact (counts, prices at the register, integers by definition) and the quant degrades to a delta with no display overhead; the paper's claim is that the estimates stop being dressed as exact numbers, not that exact numbers stop existing. This is not a forecast product — forecasting is the discipline of producing the distributions; this paper is about the medium that carries them once produced. And this is not a demand that every memo carry Bayesian machinery: the minimum viable cultural act is the honest interval on the load-bearing number, and the artifact makes that the path of least resistance rather than an act of professional courage.

8.Objections, confronted

"People can't read error bars; this will overwhelm every reader." The empirical literature says otherwise with two strong qualifications: presentation form is the binding constraint (natural frequencies, calibrated language, and progressive disclosure demonstrably work with lay audiences — the clinical trials and the public weather record), and defaults matter (bare digits do manufacture false confidence, which is the current system quietly overwhelming readers with misinformation). The objection is a taste claim dressed as a capacity claim; the presentation science adjudicated it a decade ago, and §6.4 re-tests it at document scale because the paper's own bar demands the re-test.

**"Organizations don't want honest uncertainty; it reads as weakness."** In negotiation, sometimes true — and the spec's answer is that the document now separates epistemic state from performance: you may display a point (negotiation theater) while the system knows the interval, exactly as a round number on a price tag coexists with the ledger's exact figures. The demand for honest intervals comes from document consumers — boards burned by plans, clinicians reading summaries, citizens reading journalism — and the artifact is the first instrument that lets the reader demand without the writer performing. Cultural resistance is real; it is also the same resistance that fought mandatory ingredient labels, and it loses the same way: gradually, then generational.

"The math is too heavy for ambient use." The tiered engine is the answer: GUM-law propagation is algebra; intervals are interval arithmetic; Monte Carlo is a lazily-computed cache in a world where the machine doing the spreadsheet already does a million times the arithmetic of 1990s Excel. The performance objection was true when the add-on market was born and is obsolete now; what was never solved is the display problem, which is the actual subject of this paper.

"Correlations and dependence are hard; garbage distributions will launder as rigor." Correct — the ledger's calibration audit is the counter-fraud instrument: distributions whose intervals chronically fail to cover outcomes are visible as such, which is more than the point-native artifact can ever say about its own naked numbers. Garbage precision is already the status quo; garbage at least has bounds, and the audit prices the garbage publicly. The objection argues for the audit, not against the object.

"Excel's compatibility makes this impossible." The units precedent says annotation layers ship (F# units ride values through real compilers; the add-on market rode distributions onto real grids for decades); the migration path (§5.7) is deliberately add-in-shaped for exactly this reason, and the census command converts the compatibility mountain into an upgrade queue the organization can prioritize. Impossible is a strong word for an artifact whose owners already host a thriving distributional add-on ecosystem; the gap is the default, and defaults are changed by decision, not by physics.

"Point estimates are sometimes the honest form — a count is a count." Yes, and the quant says so: a delta distribution with no display overhead. The type system distinguishes the exact from the estimated, which the current artifact's float uniformity cannot; the paper's demand is not that everything become fuzzy, but that the fuzzy stop impersonating the exact.

9.Limitations

The propagation engine's honest ceiling is dependence modeling: real documents carry correlated assumptions whose dependence structure is unknown, the conservative defaults overstate widths, and over-wide intervals have their own failure mode (alarm-blindness to honest uncertainty). The calibration ledger requires outcome data that arrives slowly, selectively, and sometimes never — the loop works best precisely where it is least needed (frequent, verifiable forecasts) and worst where it is most needed (one-off strategic estimates). The presentation layer's defaults will be tuned on WEIRD populations first, per the pattern of the field's history. The migration's add-in shape means the point-native culture coexists with the quant-native layer for decades, and hybrid documents will carry the seam — the census audit mitigates the seam's invisibility but not its existence. And the authority-economy objection (§4) is not dissolved by the artifact: a technology that redistributes epistemic authority from writers to readers will be resisted by writers, and the resistance will be political, not technical; the specification can win the format war and still lose the culture war, in which case it will have made honest intervals available, which is the necessary and insufficient condition.

10.Conclusion

The laboratory solved this in the last century: no measurement without its uncertainty, no computation without propagation, no report without stated confidence. The office, the hospital, the newsroom, and the ministry — the rooms where civilization's actual numbers do civilization's actual work — run on an artifact that stamps the fiction of exactness onto estimates, discards the provenance at birth, compounds the fiction through every formula, and displays the result in digits that perform authority they do not possess. The spreadsheet that steered a decade of policy was not an anomaly; it was the artifact working as designed, and the design is the defect. Every piece of the fix is proven and waiting: the metrology standard, the propagation mathematics, the type-theoretic precedent, the presentation science, the calibration discipline, the add-in-shaped migration channel. The composition — the uncertainty-native document, the quant riding every number across every boundary, the ledger that finally lets an organization learn its own bias — is specified above, and it exists nowhere yet. The number was never certain. It is time the document stopped pretending, and started computing the difference.

11.References

1. Herndon, T., Ash, M., Pollin, R. (2013). "Does High Public Debt Consistently Restrain Economic Growth? A Critique of Reinhart and Rogoff." Political Economy Research Institute — the austerity-spreadsheet correction; Reinhart & Rogoff (2010), "Growth in a Time of Debt," Papers and Proceedings, AEA. [Peer-reviewed working paper + journal; high confidence.]
2. Panko, R. — spreadsheet-error research program; field audits finding errors in roughly 84–94% of operational spreadsheets, with cell error rates ~1–3% (e.g., 91% and 84% in the audits Panko tabulates; the ~88% figure is his aggregate). [Research line; verified 2026-10 against Panko’s "Spreadsheet Errors: What We Know. What We Think We Can Do." and his operational-audits page.]
3. ISO/IEC Guide 98-3 (GUM) — Guide to the Expression of Uncertainty in Measurement; standard-lineage from the 1978 initiative to the 1993/2008 editions. [Standard; high confidence.]
4. Moore, R. E. (1966). Interval Analysis. [Book; high confidence.]
5. Gigerenzer, G. — natural-frequencies program for transparent risk communication, with clinical evaluation. [Research line; high confidence.]
6. Forecast-calibration and scoring-rules literature (Brier score; calibration training; superforecasting-line evaluation studies). [Research line; high confidence.]
7. Probability-of-precipitation communication — U.S. public comprehension surveys; the weather-public precedent for probabilistic display. [Research/survey record; PARTIAL confidence on specific survey vintages; verification queued.]
8. Election-forecasting popularization (FiveThirtyEight-line models) — mainstream distributional communication. [Media record; high confidence.]
9. The Uncertain<T>-line research — first-order types for uncertain data. [Programming-language research; PARTIAL confidence on the exact citation; verification queued.]
10. Stan, PyMC, and the probabilistic-programming ecosystem. [Software/standard record; high confidence.]
11. Units-of-measure type systems — F# units; the Frink calculator; engineering tools with unit discipline. [Platform records; high confidence.]
12. IPCC calibrated-uncertainty language — the prose-qualifier-to-probability scale precedent. [Standards-body practice; high confidence.]
13. Enterprise Monte Carlo add-ons (@RISK, Crystal Ball lineage) and scenario-modeling products (the Causal lineage). [Product records; high confidence.]
14. Reference-class forecasting (Kahneman/Tversky planning-fallacy lineage; Flyvbjerg's reference-class practice). [Research line; high confidence.]
15. p-rick P-003, The n=1 Cost-of-Living Index — this program's statistics-methodology paper; P-003 builds an honest personal index over point-price data, and notes the display layer's point-native culture as a boundary; the present paper is the display-and-artifact-side counterpart. [Program cross-reference.]
16. p-rick P-012, The Complexity Ledger — the consent and relocation accounting for the design decision "where do the error bars go"; false precision is the unpriced relocation of complexity (epistemic labor) to the reader. [Program cross-reference.]

Working-paper note: references marked "verification queued" are recorded from domain knowledge at high confidence and await the program's live citation-verification pass (see agents.md); the verification ledger is maintained with the paper sources.