Knowing the Collective: Temporal Cohort Membership and Small-Cell Governance as Foundations for Cohort Negentropic Assessment

Abstract

Part IV of Volume II (the outward extensions) of the H-DKPS series on physician-governed clinical AI (知衡八法). The redacted code package is included as a separate file. Clinical problem. Patients who share a workplace, a night-shift rota or a neighbourhood share more than an address. They share exposures — noise, dust, heat, disrupted sleep, the same air — that leave traces in many individual records before any single record looks unusual. A clinic that sees several workers from one factory, or several residents of one district, holds information about that group that no single encounter reveals. It also holds a responsibility: group-level statements about a small number of identifiable people can disclose what each individual's record would have kept private. Engineering problem. A clinical decision system built to reason about one patient at a time — as the system examined in this series is — has no concept of a group. Adding one raises two problems that must be solved before any group analysis is attempted. The first is membership: who belonged to which group, and when — because people change jobs and move house, and a group defined only by the present misattributes the past. The second is disclosure: in a single clinic, most groups are small, and small counts identify people, directly or by subtraction. Approach. We specify and implement the foundation for cohort assessment as two parts. A cohort registry records group membership with periods: workplace groups (with shift pattern, exposures and occupation as membership attributes) and community groups at two levels (district and the village beneath it); leaving a group records a date and never deletes the membership; addresses are reduced to city, district and village, with city names matched against the official list so that recognition errors cannot split one place into several; and every write is hash-chained. A small-cell governance gate, following the published rule of Taiwan's health-data science centre for the release of statistical results, suppresses any cell of one or two people, applies complementary suppression so that no suppressed group can be recovered by subtraction, rolls small villages up into their district, exports suppressed cells only as a merged category without special symbols, outputs aggregates only, and records every export with its stated purpose. Population analysis itself, and any use of group membership in prescribing, are deliberately not built. Evidence. This is an architecture study; all evidence is from guard suites on synthetic data. The registry guard (29 checks) verifies data minimisation, type rules, temporal membership, idempotent joins, hash-chain integrity and intake wiring; six mutations — among them returning the street address, deleting on leave and skipping city-name matching — are each caught. The governance guard (24 checks) verifies primary and complementary suppression, roll-up, symbol-free merged export and identifier screening; an exhaustive property check over 3,000 random tables confirms that no visible cell contains one or two people and that every suppressed set is either empty or at least two cells totalling at least three; six mutations are each caught, and one candidate mutation was found to be equivalent and is reported as such. Contribution. Population-level negentropic assessment in a small clinic is first a problem of governance, not of analysis. Temporal membership and small-cell suppression with complementary protection can be specified as checkable properties, implemented before any analysis exists, and verified to fail when weakened. Not peer reviewed.