When Is Residual EOF1 Certifiable?

We study pipelines that compare an analysis window with a background reference and interpret the leading analysis mode as an anomaly—for example, a seismic event against ambient noise or a climate pattern against climatology. Write $\Sigma$ for the analysis-window covariance, $C$ for a quiet reference covariance in the same feature space, and $\Sigma -C$ for their background-adjusted contrast. We show that $\Sigma$ alone does not identify an anomaly: the same matrix admits pure-background and anomaly-plus-background decompositions, identical at second order when the anomaly lies along the background axis. Under partial contamination, the calibrated direction remains fixed while the whitened eigen-gap required for finite-sample certification shrinks to zero at same-record, where the direction is unidentified. Under independent sub-Gaussian sampling from the rank-one covariance model, a quiet held-out background recovers a residual spike above concentration scale, but that spike need not be EOF1 of $\Sigma$. We prove observational equivalence and a sharp gap law, and introduce a Contrast Audit Procedure (CAP) that separates declared guard passes from conditional, theorem-backed direction certificates and otherwise abstains. An optional held-out-control calibration bounds per-record null returns under exchangeability without assuming independent guards. On the public INSTANCE benchmark, with station keys held out and guards frozen, both guards pass $240/299$ earthquakes and $13/264$ noise records. Known-direction injections into the $264$ held-out real-noise backgrounds reach $98.1$ accurate CAP returns at twice the frozen strength threshold; on real LOCATA recordings, frozen guards return $11/13$ sources versus $1/13$ inactive controls with $2.1^{\circ }$ median azimuth error. We release our code, prespecified splits, results, and reproduction instructions in our anonymous repository https://anonymous.4open.science/r/eof1 for replication.