Companion to the Operation Florida showcase. Frozen 2026-08-30.
Measuring seven
people
A complete-census preference instrument, an estimator chosen for ordinal data from a fixed electorate, and a set of results the method declines to combine. Written as a companion to the showcase, which shows the outcome without the argument.
Preference Engine OPFLA-PE-0.1 · n = 7 of 7 · 30 items
01The setting, and why it is unusual
A family of 7 had one week in Florida and no agreement about how to spend it. Each member rated 30 candidate experiences on a 1–5 scale and then spent exactly 7 scarce tokens on the things they most wanted protected. The result is a small, complete, high-stakes dataset with an unusual set of properties.
Every member of the population responded, so this is a census rather than a sample. The stakes are real but not institutional: no ethics board, no funding body, no publication, and a decision that had to be made either way. The analyst is also a respondent. And the audience for the results is the population itself, which will read them and then live with the consequences.
Those conditions rule out most of the apparatus that usually carries a preference study, and they make several ordinary defaults actively wrong. What follows is the reasoning.
02Two instruments, deliberately
A rating scale measures declared sentiment. It does not measure intensity of preference, because nothing constrains a respondent from rating everything highly. A budget constraint measures intensity, because spending is costly. Neither substitutes for the other, so the ballot carried both.
Each ballot rated all 30 items on 1–5, then allocated exactly 7 indivisible tokens across those items, one per item, no reallocation to signal degree. That is a coarse forced-choice instrument sitting beside a fine-grained rating one. The coarseness is the point: a token means do not let this get cut, and it costs one of 7.
Design consequence. Because the two instruments answer different questions, they can disagree, and their disagreement is information rather than measurement error. Section 05 is about what happens when a method refuses to resolve that disagreement on the respondents’ behalf.
03Why the mean was not available
The obvious estimator is the item mean of the raw 1–5 ratings. It is not defensible here, for a reason that has nothing to do with sample size.
Likert responses are ordinal. The distance between 4 and 5 is not known to equal the distance between 2 and 3, and more importantly it is not known to be the same distance for two different respondents. One person rates generously and reserves 5 for the extraordinary; another treats 3 as polite refusal. Averaging across respondents assumes interpersonal comparability of scale units, and that assumption is false in a way that systematically favours whoever rates hardest.
So each ballot is read relative to itself. Every respondent’s 30 ratings are converted to empirical mid-rank percentiles within that ballot, and those percentiles are averaged across respondents. The quantity that results describes position within a respondent’s own ordering, which is comparable across people in a way that a raw scale point is not.
This is a within-respondent normalisation, and it has a cost worth stating: it discards absolute enthusiasm entirely. A ballot that loves everything and a ballot that likes nothing produce the same percentile distribution. That is why declared sentiment is kept as a separate channel rather than replaced.
04A census, not a sample
The cohort is the entire population of people going on this trip. There is no superpopulation from which they were drawn, and no larger group to which the result generalises. That single fact removes a great deal of standard practice.
There are no confidence intervals here, no standard errors, no p-values, and no posterior distributions. Not because the sample is small, but because there is nothing to be uncertain about in the sampling sense: the values are exact descriptions of a complete population. Reporting an interval would imply an inference to a wider group that is not being made and could not be made.
Measurement doctrine
The submitted cohort is the electorate for this trip, so headline values are census descriptives rather than estimates of a larger population.
Ratings are ordinal. Relative order, declared sentiment, and Golden Ticket priority remain separate evidence channels.
Missing ratings remain missing. No absent response is synthesized as zero.
What remains genuinely uncertain is something else, and section 06 measures it directly: not how the result would vary across hypothetical samples, but how much it depends on any one real person.
05Four channels, never combined
The engine emits four readings per item and provides no function that combines them. There is no composite score, no weighting, and no ranking that blends evidence types. Relative support, declared sentiment, scarcity-constrained protection and robustness are reported side by side.
The reason is visible in the data. Below are five items chosen because their channels disagree.
| Item | Rank | Support | Tokens | High | Low | Polar. |
|---|---|---|---|---|---|---|
| Epic Universe day | 16.5 | 0.53 | 4 | 2 | 1 | 0.08 |
| One big family meal | 1 | 0.78 | 3 | 5 | 0 | 0.00 |
| Guardians of the Galaxy: Cosmic Rewind | 8 | 0.58 | 3 | 4 | 3 | 0.98 |
| Slower vacation pace | 28 | 0.27 | 2 | 0 | 5 | 0.33 |
| Premium / preferred BoardWalk view | 30 | 0.20 | 0 | 1 | 6 | 0.00 |
Rank of 30. Support is mean within-respondent percentile. Tokens, High and Low are counts of people out of 7.
Epic Universe day
The strongest scarcity signal in the cohort sits in the bottom half on relative support, with four of seven ballots neutral. Any weighted composite reports one number here and conceals both facts.
One big family meal
The one case where the channels agree, and the only experience on the ballot with no low rating at all. Shown so the disagreements below are not mistaken for noise in the instrument.
Guardians of the Galaxy: Cosmic Rewind
Near-maximal polarization with both tails populated. A mean of the raw ratings lands close to the scale midpoint and reports this as mild approval.
Slower vacation pace
Five of seven rate it low and nobody rates it high, yet two ballots spend a scarce token on it. Minority intensity survives here precisely because it was elicited separately.
Premium / preferred BoardWalk view
The clearest negative result: last of thirty, no tokens, and a leave-one-out band that never leaves the bottom two positions. Strong agreement, and the agreement is negative.
The case in one line. Epic Universe day carries the highest scarcity signal in the cohort at 4 of 7 tokens, and sits at rank 16.5 of 30 on relative support with 2 high and 1 low ratings. Every weighting scheme that produces a single number produces a middling one here, and a middling number is the one description of this item that is false in both directions.
06Robustness, measured by omission
With 7 respondents, the question that matters is not sampling error. It is dependence: how much of a result rests on one person. So the full census is recomputed 7 times, each run omitting exactly one ballot, and the range of each item’s support and rank across those runs is reported. This is a leave-one-out sensitivity analysis, close in construction to a jackknife but used as a diagnostic rather than as a variance estimator.
The result is the most useful finding in the study, and it is unflattering. Only 4 of 30 items hold their position within 2 places when any single ballot is removed. Star Wars: Rise of the Resistance sits at rank 11 and moves between 5 and 19 depending on which one person is dropped.
The ranking is not interpretable in its middle
That conclusion is reported on the showcase rather than hidden in an appendix, and it is the reason the surface presents the ordering as evidence rather than as a verdict. An analysis that produces a confident 1-to-30 list from 7 ballots is not measuring preference. It is measuring one person.
A dropout is treated as the strongest possible dependence signal: if omitting one ballot removes an item from the census entirely, the range is reported as undefined rather than computed over the surviving runs, which would manufacture a narrow band from an unstable item.
07The quantities, exactly as published
The engine ships a machine-readable contract of its own definitions, and every surface that displays a formula renders it from that contract. Nothing below is retyped for this page. A visual treatment that re-authors an equation can be beautifully wrong about the engine underneath it, which is a mistake this project made once and now prevents structurally.
Relative support
support_j = (1 / n_j) · Σ_i p_ijFor each ballot i, convert its 1–5 ratings into empirical mid-rank percentiles p_ij, then average those percentiles across the n_j ballots that rated experience j.
Where the experience sits within respondents' own expressed ordering. It is not absolute enthusiasm.
Golden Ticket priority
priority_j = tickets_j / n_jShare of observed respondents for experience j who spent one of their seven Golden Tickets on it.
Scarcity-constrained protection. It stays separate from ratings because a middling rating can still be a protected choice.
High-rating share
high_j = #{r_ij ∈ {4,5}} / n_jShare of observed raw ratings for experience j that are 4 or 5.
Declared positive sentiment in the original response scale.
Low-rating share
low_j = #{r_ij ∈ {1,2}} / n_jShare of observed raw ratings for experience j that are 1 or 2.
Declared negative sentiment in the original response scale.
Observed agreement
agreement_j = clamp₀¹(1 − MAD(p_·j) / 0.5)Compute the mean absolute deviation of observed respondent-level support percentiles around their mean, divide it by 0.5, subtract from 1, and clamp to [0,1].
How similarly the respondents who rated this experience placed it in their own preference ordering. It is never called family consensus when coverage is incomplete.
Undefined when n_j < 2 — reported as nothing, never as a zero.
Observed polarization
polarization_j = clamp₀¹(4 · lowTail_j · highTail_j)lowTail_j is the share of observed support percentiles at or below 0.25; highTail_j is the share at or above 0.75. Multiply the two tail shares by 4 and clamp to [0,1].
Whether strong relative detractors and strong relative supporters coexist. It is high only when both tails are populated.
Undefined when n_j < 2 — reported as nothing, never as a zero.
Observed rank
rank_j = mid-rank of support_j in descending cohort orderRank the exact census support values from highest to lowest. Equal support values receive the midpoint of the positions occupied by their tied block.
Relative cohort position after support is computed. Array order may further break ties for presentation, but the tied observedRank remains the inferential result.
Ties
Within a ballot, equal raw ratings share the midpoint of the percentile positions occupied by their tied rating block: p = (items below + 0.5 · items in tied block) / items on ballot.
Across experiences, support values are rounded only for tie grouping at 1e-12 precision; tied experiences receive the midpoint of their occupied rank positions.
Leave-one-out
When ballotCount >= 2, recompute the full census once per submitted ballot, each time omitting exactly one ballot. leaveOneOutScenarioCount is the number of omission scenarios in which the experience still exists. When ballotCount < 2, no omission scenarios run and leaveOneOutScenarioCount is 0.
leaveOneOutSupportRange = [min support_j^(−i), max support_j^(−i)] across omission scenarios, but only when the experience survives every scenario.
If ballotCount < 2, or if any single-ballot omission removes the experience entirely, both leave-one-out ranges are null. A dropout is itself the strongest possible dependence signal and is never discarded to manufacture a narrow range.
These are robustness diagnostics about dependence on any one family member, not confidence intervals, credible intervals, posterior intervals, or sampling uncertainty.
08Anonymity, and its honest limit
Ballots are separated from respondents at the query layer rather than in application code. The read that feeds the engine groups rows by respondent only long enough to assemble each ballot, then emits opaque labels assigned in random order, and the identifier is never projected past that step. The labels are reshuffled on every call, so no stable pseudonym accumulates across runs. The frozen file this analysis reads was captured under the same protocol, and the mapping was discarded rather than stored.
The engine also refuses identifier-shaped input: a ballot label matching a database key is rejected before analysis begins, which catches the most likely accidental re-identification path rather than trusting a convention.
The limit, stated plainly. 30 ordinal ratings plus 7 token allocations is close to a fingerprint. Anyone holding two releases of this data can almost certainly match ballots between them, and anyone who knows a respondent well could probably identify their ballot from its contents. The data is anonymous, not anonymised beyond recovery, and the difference is the sort of thing that gets glossed in a methods section. Publication is a small, closed population with a genuine re-identification surface, which is why the public release names the respondents and shows the ballots and connects the two nowhere.
09Where the machine stops
The engine measures. It does not decide, and it is constructed so that it cannot. No scoring, planning, cost or constraint process may write a decision about whether an item is in the trip. Those states are authored by a person, and the absence of a decision is preserved as its own state rather than defaulted into a soft yes.
The consequence is visible in the record. Two items are in the final plan that the measurement did not ask for, and both rulings say so in their own text: one is included because another protected item structurally requires it, and one because it improves the shape of the week. Both notes warn the next reader not to read the decision back as evidence of preference.
That is the part of a decision-support system most likely to be quietly lost. A tool that derives its recommendations from its own measurements produces a plan nobody has to defend, and an audit trail that cannot distinguish what the data said from what a person chose.
10How it was built
The implementation was written with an AI coding agent, and the method matters more than the fact. Constraints were numbered and written down before features, and most of them are enforced a layer below where a person could forget them: identity is severed in SQL rather than in TypeScript, cost is unreachable from the shaping layer through the module graph rather than by convention, and the estimator has no function that would combine its channels.
Roughly a dozen test files compute nothing at all. They read the source tree and refuse things: that no second scoring implementation exists, that a respondent-facing module never imports planning data, that a public page holds no database connection. Those are architectural claims, and an agent that writes a great deal of code very quickly is exactly the collaborator for whom review discipline is the wrong enforcement mechanism.
The most expensive lesson. The original brief for the public surface stated its purpose in one sentence and then proposed an implementation that did not serve it: a route list mirroring the internal architecture and read-only clones of every working screen. Following the concrete proposal rather than the stated purpose cost most of an audit before the disagreement was noticed and named. Showing someone what a system did is not the same product as letting them operate it, and the difference is roughly an order of magnitude.
11Reproducibility
The estimator is a pure function. It reads no database, no clock and no environment, so the same input produces byte-identical output on any machine. Ordering is a total order with explicit tie-breaking, so no result depends on the order rows arrive in.
The census is frozen as a committed file, and the expected ranking is pinned in a test character by character. The page you are reading and the internal planning dashboard call the same functions on the same file: there is one implementation and two consumers, and a test scores both paths and asserts the results are identical. Nothing on either surface is a stored result, so neither can drift from the engine it describes.
12What this does not establish
The findings describe 7 people and generalise to nobody. The instrument was not validated, the item set was authored rather than derived, and the analyst is a respondent, which is a conflict no amount of anonymity removes. Order effects were not controlled. The mid-rank transformation assumes only that respondents can order their own preferences, which is weak and therefore safe, but it discards intensity that the token instrument then has to recover separately and coarsely.
The result that would survive scrutiny in a larger study is the negative one: at this n, a ranking is not a finding. Everything else here is a description of what 7 particular people said on one particular evening, which is exactly as much as it claims.