# Model Card — Petrel Karst & Depressions Layer v0.1

## Intended use

Screening and input generation for sinkhole and subsidence assessment:
narrowing where to commission ground investigation, flagging portfolio
exposure for closer review, and supplying terrain and lithology inputs to a
user's own model.

**Not intended** for parcel-level underwriting decisions on its own, for
pricing without additional evidence, or for any use that treats the depth band
as a probability of collapse. It is a terrain measurement.

## Model

There is no fitted model. Both bands are deterministic transforms:
depression depth is a priority-flood fill of a bare-earth DEM; solubility is an
ordinal reclass of GLiM lithology. Nothing is trained, so nothing is
overfitted — and equally, nothing is calibrated to observed sinkhole rates.

## Why there is no probability band

The only commercially usable sinkhole inventory available to us is the Florida
DEP Subsidence Incident Reports: 4,449 records, of which **103** are verified
sinkholes. Other candidate inventories are unusable or unresolved — the BGS
National Karst Database is enquiry-only with an unset licence; three European
and Chinese inventories are "free academic", which does not clear commercial
use, and a model trained on them is not laundered by being a new work.

We tested whether the 4,232 *unverified* reports could act as weak positives.
They cannot: AUC **0.520** against the confirmed non-sinkholes, indistinguishable
from chance. Their spatial pattern is a reporting pattern — the top counties are
Hillsborough, Marion, Citrus, Pasco and Hernando, i.e. populated Tampa-area
karst — so training on them would learn where insurance claims are filed.

## Performance

Measured on the shipped **global** raster, 103 verified sinkholes vs 108
confirmed non-sinkholes — every labelled point in the Florida DEP inventory:

| Band | AUC (verified vs confirmed-not) | 95% CI |
|---|---|---|
| depression_depth_m | **0.649** | [0.58, 0.71] |
| karst_solubility | 0.520 | [0.46, 0.58] |
| depth masked to soluble bedrock (**not shipped**) | 0.520 | [0.48, 0.56] |

Interpretation: 51% of verified sinkholes sit in a closed depression against
24% of confirmed non-sinkholes. Solubility does not discriminate in Florida and
is shipped as context, not as a ranking variable.

CIs are bootstrap (4,000 resamples). Hanley-McNeil intervals are not used
because these bands are tie-heavy and that estimator assumes no ties.

## Known weaknesses

- **One validation region.** Florida only. Performance in evaporite, cone or
  mantled karst elsewhere is unknown, not merely uncertain.
- **Small n.** 211 labelled points. The CI is wide and honest; a 0.649 point
  estimate should not be quoted without it.
- **The label set is itself an artefact of a reporting process.** "Verified"
  means a Florida DEP inspector confirmed it, which correlates with access and
  population as well as with geology.
- **No subsurface, no groundwater, no time.** Water-table depth and its
  fluctuation are primary drivers and are absent; a stabilised Pleistocene
  doline is indistinguishable from an actively subsiding one.
- **Depression != sinkhole, and the exceptions are measured below.** This is
  the most important limitation in this card and the one most likely to be
  missed, because the features that violate it are the *brightest* ones on a
  global view.

## What else is in the depression band

A priority-flood fill finds every closed depression in the terrain. Most of
them are not dolines. We measured the three classes that matter rather than
listing them, because an unquantified caveat leaves a reader unable to act on
it.

### 1. Endorheic and internally-drained basins — the dominant class

A basin with no outlet to the sea is, to a fill algorithm, one enormous
depression. Measured on the shipped raster over 4x3 degree windows:

| Region | Type | Land with depth>0 | Mean depth (land) | p99 |
|---|---|---|---|---|
| Sahara / Chad (Bodele) | endorheic | 78.6% | **52.18 m** | 155.7 |
| Tibetan Plateau | endorheic | 25.6% | **20.35 m** | 222.6 |
| Great Basin, US | endorheic | — | 7.27 m | 128.1 |
| Lake Eyre, AU | endorheic | — | 7.22 m | 30.4 |
| Dinaric karst | karst | — | 5.36 m | 118.0 |
| S China cone karst | karst | — | 4.46 m | 94.2 |
| Florida karst *(the validated region)* | karst | 39.4% | **0.99 m** | 8.8 |
| Yucatan | karst | — | 0.54 m | 6.0 |

**The validated karst region is the faintest thing in the table and the
endorheic basins are 20-50x brighter.** A global rendering of this band is
therefore not a sinkhole map, and reading it as one inverts the answer.

### 2. Open-pit mines and quarries — striking, and a rounding error

A 2020s DEM contains active mine workings, so the largest open pits are in the
band and read deeper than any natural doline. Sampled at 5 km boxes, 12 of 14
major pits read over 100 m and 7 exceed 250 m — Bingham Canyon,
Chuquicamata, Escondida, Hambach, Palabora, Aitik, Grasberg.

**That is vivid and it is not the problem.** Measured against the Maus et al.
global mining inventory (44,929 polygons, 101,583 km²), mining accounts for
**0.24% of all land this band reports above 10 m, and 0.38% above 50 m**. The
capped endorheic population alone is **29x** the entire deep mine area.

Two further findings, both of which argue against ever building a quarry filter:

- **Depth is a poor mine detector.** Of the 1,200 largest mining polygons, only
  38% reach 50 m and 24% reach 100 m; the median polygon maximum is 26 m. In a
  random sample of the rest the median maximum is **0.32 m**. Most mining ground
  is tailings dams, waste-rock dumps — which are *mounds* — ponds and plant, not
  void. A depth threshold would miss three quarters of large mines.
- **Area-weighted, only 12.5% of large-mine pixels read above 10 m at all.**

So the honest statement is that mines are individually conspicuous and
collectively negligible, and no filter for them is worth its complexity.

*The mining inventory was used as an instrument only — to grade this band, never
as an input to it. See `data_sources.md`.*

### 3. Lakes, reservoirs and playas

Any standing water body sits in a closed depression by definition. These are
not filtered out.

## Why we do not ship a mask for these

Three candidate filters were evaluated and none is shipped:

- **Depression area.** Structurally the cleanest separator — 97-98% of
  endorheic depression area sits in connected components larger than 10 km2,
  against 24% for S China cone karst. But tested against the Florida labels,
  *every* area cutoff scored at or below the unfiltered band. It cleans the
  picture
  without improving the answer, so it is offered as an interpretation below
  rather than baked into the raster.
- **The shipped `karst_solubility` band.** It removes some of the problem and
  not all of it: Sahara/Chad drops out completely (0.0% soluble) and the Great
  Basin nearly so (mean 7.27 -> 0.20 m), but the Tibetan Plateau is 40.5%
  soluble on marine carbonates and survives at 10.95 m. Tibet is *genuinely*
  karst-capable terrain that is *also* endorheic; no lithology mask can
  separate two things that are both true.
- **A mining mask is not worth building at all** — measured above, mining is
  0.24% of the deep signal. This was the candidate that motivated the licence
  question below, and the measurement retired it before the licence mattered.
- **External mining and basin datasets — usable as instruments, declined as
  inputs.** ShareAlike licences restrict *sharing*, not use: CC-BY-SA-4.0
  (Maus et al. global-scale mining polygons, verified at PANGAEA
  10.1594/PANGAEA.942325, not from a description column) triggers only when you
  Share Adapted Material, and ODbL §4.5(c) says internal organisational use is
  not public use. So validating our thresholds against either is unrestricted.
  What we declined is baking them into the shipped pixels: mask quarries to
  nodata and the source footprint is *recoverable from our output* — it is the
  holes — which is redistribution with extra steps. (ODbL is the more
  permissive of the two here: §4.5(b) makes a rendered raster a **Produced
  Work**, publishable under our own terms with an attribution notice. CC-BY-SA
  4.0 has no equivalent carve-out.) **MERIT-Plus endorheic delineations are
  blocked for a different and stronger reason** — they derive from MERIT Hydro,
  which is CC-BY-**NC**, and NonCommercial restricts the use itself whether or
  not anything is shared.

  The consequence for this layer is a design preference, not just a compliance
  one: a rule expressed in **our own measured quantities** (depth, area) applies
  to every quarry on Earth, while a polygon mask only covers the ones somebody
  has surveyed.

## How to read the band around these

Two practical rules, both derivable from the table above:

1. **Interpret regionally, never globally.** Compare a depression depth to
   other depths in the same terrain, not to the global range.
2. **Depth above ~10 m is not a doline** in any region we have validated.
   Florida karst's p99 is 8.8 m. Above that you are almost certainly looking at
   a basin, a mine, or a water body. This is a reading rule, not a filter, so
   you can apply whatever threshold your region justifies.

**On the encoding cap, and what raising it cost.** The band is uint16 with
`physical = raw * SCALE` and a ceiling of **3000 m**, which clips exactly **one
pixel on Earth**. The v0.1 draft capped at 250 m, and a full-globe ceiling
histogram showed that was wrong: 129,313 pixels sat in [249, 250) against
**16,675,929 at exactly 250.00** — a 129x pile-up, which is a hard clip, not a
tail. That is 143,494 km², about the area of Nepal, every pixel reading the same
number.

The clipped population was not artefacts. Fill depth is the height of the *pour
point* above the ground, and a large closed basin's lowest escape route sits
over the surrounding mountain rim — so its floor is legitimately hundreds to
thousands of metres "deep". Every clipped region is a named endorheic basin: the
Mongolian Great Lakes Depression, Sistan and Jaz Murian, the Altiplano and
Argentine Puna, Death Valley, Lake Urmia, the Tarim, the East African Rift lakes
and the Dead Sea. The true uncapped maximum is **3736.08 m**. On the shipped
band those now read their real depths — Tarim 605-611 m, Death Valley 1184 m,
Altiplano 645 m — while Viñales still reads **111.2 m** and Florida karst 30.8 m.

⚠️ **RAISING IT COST 0.010 OF AUC, AND THE REASON IS WORTH KNOWING.** Measured on
the built product, `depression_depth_m` scores **0.649**, against **0.659** for
the 250 m encoding and 0.6593 for the unquantised float32 source. The entire
difference is **three verified sinkholes whose depth is 3-4 CENTIMETRES**
(0.0305, 0.0417, 0.0417 m). The re-encode *floors* rather than rounds, so at a
0.0458 m step those three fell to exactly 0, and no confirmed non-sinkhole was
affected — an asymmetric loss that lands entirely on the positives.

**GEDTM30's vertical accuracy is ~1-2 m, so a 3 cm depression is roughly 1/50th
of the DEM's own noise floor.** The 250 m encoding was resolving below the
instrument, and the headline AUC was quietly benefiting from it. We regard 0.649
as the more honest number rather than treating the 0.010 as a regression — but
it is a real change to a published figure and it is recorded rather than
absorbed.

*(An earlier internal cap table predicted 0.6598 here. It was wrong: it
simulated the encodings by re-quantising the ALREADY-QUANTISED 250 m raster, and
double quantisation is not single quantisation. Re-measured from the float32
source, the whole range 250-3000 m is flat at 0.659-0.660 and only 5000 m
degrades — which is why the built product's 0.649 needed explaining rather than
accepting.)*

**Consequence for the reader: depth is now a usable basin discriminator.** A
pixel reading several hundred metres is deeply enclosed by construction, which
separates the dominant false-positive class using nothing but this band — no
external dataset, no licence, and it works in basins nobody has mapped.

## Ethical and commercial considerations

A sinkhole layer can affect property valuation and insurability. Two
consequences we take seriously: the layer must not be presented as a
probability it cannot support, and its **absence** of signal must not be read
as safety — a pixel reading 0 m means "this pixel drains", not "this ground is
stable". Both statements are in README.md because a bare number in a GIS tends
to arrive without its documentation.

## Provenance of the numbers in this card

Every figure is recomputed from the shipped raster rather than from the
analysis that motivated the layer.

Two corrections are on the record, both made because a number was re-derived
rather than carried forward:

- An earlier internal figure of **0.686 was withdrawn**. It came from a
  rank-AUC implementation that mishandled ties, which inflates scores on these
  zero-heavy bands. It was caught by a control variable expected to score ~0.5
  that instead scored 0.765.
- The **0.638 [0.57, 0.71] figure drafted at v0.1 was not measured on the
  shipped raster**, though it said it was. Two things were wrong with it. It was
  measured on the **pilot tile**, whose northern edge is 30 degrees N, which
  silently dropped 21 verified and 10 confirmed-not points in north Florida and
  the panhandle and reported n=180 as the whole inventory. And points were
  sampled through a **window transform**, whose origin does not align to the
  parent grid — on a band where 60% of Florida reads exactly zero, a one-pixel
  shift moves the score materially. Sampled canonically with `src.sample()` on
  the global COG, all 211 points score and the band measures **0.659
  [0.59, 0.72]** on the 250 m encoding this card no longer ships (see the cap
  section: the shipped 3000 m encoding measures 0.649). The published interval contained the corrected value, so no
  claim becomes false; the provenance sentence was the part that was wrong.
  Every comparison figure moved with it (solubility 0.490 -> 0.520, the
  solubility-masked band 0.480 -> 0.520) and every conclusion survived —
  including the one that killed the masked band, whose interval still does not
  overlap the unmasked band's.