Hardening, reflex paths, and factual memory

Repeated transformations, reusable skills, and mutable propositions require different execution, update, and recovery contracts.

Scope

This chapter defines the boundary between five runtime outcomes:

1. a compiled reflex path executes a narrow, qualified transformation;
2. a reusable skill handles variable situations without embedding volatile propositions in its parameters;
3. versioned factual memory supplies mutable claims with provenance and validity state;
4. escalation sends an unresolved or high-risk event to a more capable model, tool, or human; and
5. rollback restores a last-known-good path or record after invalidation.

Hardening is a promotion decision, not a synonym for freezing. Every promoted artifact retains an applicability envelope, version, owner, regression set, physical cost record, invalidation policy, and recovery target.

Runtime paths and recovery

flowchart LR
    event["Event + available context"] --> gate{"Valid route?"}
    gate -->|"narrow + qualified"| reflex["Compiled reflex"]
    gate -->|"reusable behavior"| skill["Reusable skill"]
    gate -->|"mutable claim"| facts["Versioned facts"]
    gate -->|"uncertain / high risk"| escalate["Tool · larger model · human"]
    facts --> fresh{"Fresh + conflict-safe?"}
    fresh -->|"yes"| compose["Compose result"]
    fresh -->|"no"| escalate
    reflex --> compose
    skill --> compose
    compose --> trace["Outcome · cost · provenance"]
    trace --> repair["Invalidate · reopen · roll back"]
    repair -.-> gate

Editable source: ../assets/diagrams/hardening-memory-paths.mmd.

The gate selects authority, not merely compute. A reflex may execute but cannot silently update a fact. A retrieved record may inform an answer but cannot rewrite a skill. An escalated result enters durable state only through the ordinary memory and consolidation lifecycle.

Biological observation

Biological and computational evidence supports separating rapid acquisition from slower integration (C-008). Retrieval can also make an established memory temporarily update-sensitive in a scoped preparation (C-039), while prediction error is disputed as a precise general trigger for that transition (C-040). Separate intervention studies show that mature constraints can be reopened under specific conditions (C-044, C-045).

The transferable requirements are multiple update timescales, guarded promotion, local reopening, and recoverable versions. The compiled path, factual schema, and escalation protocol below are engineering mechanisms tested against conventional systems.

Proposed AI translation

Five distinct contracts

Compiled reflex paths

A compiled reflex is a versioned executable graph $h$ with:

• an input and output schema;
• a validity predicate $G_h(x,\mathcal I_t)\in\{0,1\}$;
• a declared applicability envelope $\mathcal A_h$;
• a deterministic or bounded-stochastic execution contract;
• a protected regression and adversarial set;
• a fallback route and last-known-good version; and
• a manifest for precision, kernels, placement, dependencies, and measured physical cost.

Here $x$ is one event, $\mathcal I_t$ is the information available at decision time $t$, $G_h$ is dimensionless, and $\mathcal A_h$ names the permitted input, environment, dependency, and risk strata. The runtime may dispatch $h$ only when $G_h=1$ and every dependency version remains valid. Guard evaluation is part of the path's latency, energy, and error budget.

Suitable candidates include parsing a fixed protocol, executing a stable local control law, applying a verified transform, or serving a repeatedly observed low-risk subgraph. Ordinary code, rules engines, memoization, and compiler optimization remain the first alternatives. A learned compiler is useful only if its generated guard and path outperform those alternatives under the same coverage and recovery requirements.

Compilation across physics

A mature reflex can also be stored in geometry, compliance, an analog transfer function, a physical reservoir, or a reprogrammable material state. Demonstrated components include passive task-specific dynamics (C-112), soft-body and physical-reservoir memory (C-113, C-114), mechanical logic and physical learning (C-115, C-116), and local material repair (C-120). These observations extend the set of possible deployment substrates; they do not bypass the qualification gates.

A physical pattern is classified before it is credited with computation:

This separation follows C-463–C-479. Flocking, phase separation, defect motion, jamming, or assembly can be useful physical operations; visible order alone does not supply a task, evaluator, or policy update.

The held systems candidate is a rewritable physical path whose input and output remain locally coupled to the environment, while a versioned digital shadow preserves its specification, protected tests, calibration envelope, fallback, and output trace. The path is admitted only while health probes remain inside that envelope. Drift or damage returns authority to the digital path before a new substrate state is programmed and shadow-validated. Static surface texture must therefore survive workload-envelope, manufacture, inflexibility, and reversal tests (C-1503); a locally adaptive interface additionally carries constituent inventory, activation/recovery, hysteresis, depletion, substrate health, and fallback (C-1504).

This path competes first with tuned passive mechanics, analog control, and FPGA/ASIC implementation, not only with an inefficient general model. Its lifecycle boundary includes design, fabrication, programming, drive, conversion, readout, reset, calibration, maintenance, fallback, repair, failed devices, and retirement. Candidate 006 tests whether a measured conversion, transport, recurrence, or command path is actually removed and whether break-even occurs before the qualified substrate lifetime ends.

flowchart LR
    M["Mature repeated local mapping"] --> Q{"Physical target qualified?"}
    Q -->|"no"| D["Keep digital / analog / fixed mechanics"]
    Q -->|"yes"| C["Classify passive · driven · feedback · adaptive"]
    C --> P["Design · fabricate · program · calibrate"]
    P --> F["Phase / interaction field executes mapping"]
    F --> O["Readout + qualified task outcome"]
    O --> H["Health probe + digital shadow"]
    H --> R{"Drift, damage, or task change?"}
    R -->|"no"| F
    R -->|"repairable"| P
    R -->|"unsafe / uneconomic"| B["Fallback · retire · recycle"]
    B --> D

Editable source: phase-field-compilation.mmd.

Candidate 006 now tests C-480 as one physical- phase specialization. Particle-scale power cannot win the comparison; the boundary includes fuel or field generation, sensing, control, transduction, readout, reset, fabrication yield, health probes, shadow, fallback, and retirement.

Reusable skills

A reusable skill is broader than a reflex. It accepts variable inputs, may consult current context or memory, and is evaluated for transfer outside the episodes that created it. It normally remains a slow-model module, adapter, tool policy, or callable subgraph.

Skill qualification asks whether the artifact preserves a reusable relation or operation. A proposition such as a price, office holder, software version, or medical recommendation is not a skill: its truth can change while the method used to retrieve, compare, or explain it remains valid. If a skill emits a mutable proposition, the output record must identify which factual version supplied it.

A skill may later receive structured pruning or quantization. Iterative pruning is evidence for competitive sparse subnetworks only in its tested settings (C-012). Ternary-weight language models are a plausible candidate under C-013; promotion still depends on end-to-end quality, risk, latency, bytes, and joules on the project workload.

Qualification gates

Promotion is conjunctive: a candidate fails when any hard gate fails.

For candidate path $h$ and baseline $b$, let $Q_h$ and $Q_b$ be task quality in one declared unit, $R_h$ and $R_b$ be risk in one declared unit, and $\epsilon_Q$ and $\epsilon_R$ be preregistered tolerances in those respective units. Let $p_{\mathrm{FA},h}$ be the dimensionless fraction of out-of-envelope events incorrectly admitted by $G_h$, and let $\alpha_{\mathrm{FA}}$ be its maximum permitted value. Qualification requires

These conditions are evaluated by stratum as well as in aggregate. A guard that rejects almost everything is exposed by reporting its coverage $c_h=N_{G_h=1}/N_{\mathrm{offered}}$, a dimensionless fraction. Coverage is a result, not a target inferred after testing; $N_{G_h=1}$ and $N_{\mathrm{offered}}$ are event counts.

Reversible verification before commitment

Kinetic proofreading shows that recognition and commitment can be separated by driven intermediate states with discriminatory rejection and reset (C-159). Its speed, error, and dissipation costs form a model-specific frontier rather than a universal accuracy multiplier (C-160). The systems translation therefore has four hard requirements:

1. temporary execution remains inside a declared rollback boundary;
2. the later verifier adds conditional information or a distinct detector;
3. rejected attempts, reset, delay, and provenance remain in the cost ledger;
4. irreversible authority is withheld until commitment.

For observations $z_1,\ldots,z_t$, the strongest statistical null conditions on the evidence already seen:

Here $L_t$ is the dimensionless cumulative log-likelihood ratio, $R$ and $W$ denote correct/safe and wrong/unsafe hypotheses, and $z_{<i}$ is prior evidence. Ignoring that conditioning turns correlated rechecks into false confidence.

Candidate 010 tests reversible execution and risk-conditioned verification against this sequential test, calibrated cascades, abstention, retries, redundant verifiers, and error-detecting codes. It must tie or lose when the later stage is only a correlated copy or when reset leaks irreversible effects.

Graded assurance envelopes

Qualification records must state what kind of assurance each result provides. The classes are not interchangeable:

These boundaries are established in scoped programming-language and systems results: type soundness (C-145), effects versus capabilities (C-148), runtime-monitor scope (C-152), transactional rollback limits (C-154), and provenance without truth (C-156).

The held synthesis binds every assurance record to the same module version, artifact digest, dependency graph, state migration, authority policy, monitor schema, evidence set, and invalidation triggers. A dependency change rechecks only its affected cone, but stale assurance escaping to production and unnecessary rechecks are both measured. Candidate 009 compares this envelope against a complete conventional stack of typed APIs, sandbox/IAM, CI and static analysis, runtime policy monitoring, lineage, canaries, transactions, schema migration, and build-system invalidation.

Compromise-bounded authority and recovery

The security contract adds an adversary and trust boundary without collapsing distinct stages. Authentication establishes a scoped protocol property; authorization grants an action; detection classifies telemetry; containment blocks covered future use; and recovery re-establishes declared invariants from a tested root. None substitutes for the next (C-250, C-262, C-265).

For capability class $j$, let $g_j$ and $r_j$ be its grant and effective revocation times in seconds, and let $w_j$ be a declared dimensionless severity weight. Authority exposure is

with unit weighted-capability-seconds. The weights and individual intervals remain visible because a single broad destructive capability is not equivalent to many harmless reads. Sensitivity to plausible weights is reported.

Nominal credential lifetime is not the revocation result. If $t_{\mathrm{comp}}$ is the bounded compromise time and $t_{\mathrm{last}}$ is the last acceptance at every covered enforcement point, then

is revocation exposure in seconds. Sessions, caches, delegation, offline verifiers, propagation delay, clock rollback, and missing acknowledgements are part of the measurement (C-260). The incident record keeps four clocks separately: compromise interval, detection, effective containment, and independently validated recovery.

The held profile binds principal and workload identity, capability scope, credential/key/attestation epoch, revocation freshness, approval-domain independence, observation age, adversary model, compromise horizon, and clean- root evidence to the same versioned artifact. It survives only if Candidates 009 and 012 reduce harm or secure recovery time beyond mature short-lived IAM and a rehearsed reimage–rotate–validate workflow at equal lifecycle cost.

Recovery is not one endpoint score

After a lesion or fault, the same task outcome can come from restored capability, a larger fallback, a different route, a tool, a cache, human intervention, or a more permissive environment. Rehabilitation evidence makes that underidentification explicit (C-316–C-324).

Let $z$ be a declared post-recovery internal, routing, or behavioral state and $z_{\mathrm{ref}}$ a justified reference. Report

where $D_{\mathrm{native}}$ has the declared metric's unit or is explicitly normalized; extra energy is joules; memory is bytes; latency and human support are seconds; and $P_{\mathrm{fragile}}$ is the dimensionless probability of failure under a named support-removal or shift test. These axes are not merged unless conversion weights are declared in advance.

flowchart LR
    L["Declared lesion or failure"] --> R["Recovery intervention"]
    R --> Y["Task outcome + calibration"]
    Y --> N["Native-path distance"]
    Y --> C["Compensation burden"]
    C --> D["Remove / perturb compensator"]
    N --> T["Shift + transfer tests"]
    D --> T
    T --> H["Recurrence + reserve horizon"]
    H --> A["Adverse-effect audit"]
    A --> Q{"Qualified recovery?"}
    Q -->|"yes"| P["Publish recovery envelope"]
    Q -->|"no"| X["Reclassify · repair · retain support"]

Editable source: compensation-aware-recovery.mmd.

Compensation is not a failure when it is robust, affordable, and declared. The failure is to call it restoration, hide recurring support, or deploy outside the context that makes it work. Conversely, an ordinary cheap workaround may dominate native restoration. Candidate 005 therefore compares the complete accounting method with conventional multi-objective robustness, fault injection, failover, checkpoint restoration, and functional reconstruction.

Versioned factual memory

A factual record $r$ contains at least

where:

• $k$ is a typed key or subject–predicate identifier;
• $v$ is the typed value and $u$ is its declared unit, or none for a unitless value;
• $s$ is the source identifier and $v_s$ its source version;
• $t_{\mathrm{obs}}$ is the observation timestamp;
• $[t_{\mathrm{from}},t_{\mathrm{to}})$ is the asserted validity interval;
• $v_r$ is the immutable record version;
• $\pi$ is the access, retention, and jurisdiction policy; and
• $\sigma\in\{\text{active},\text{superseded},\text{revoked},\text{disputed}\}$ is record status.

Timestamps use UTC with declared resolution. Differences between timestamps are reported in seconds. A record may also carry source-supplied confidence or a calibrated probability, always dimensionless and never substituted for source identity or conflict handling.

Let $t_{\mathrm{check}}$ be the last successful source check and let $\tau_k$ be the maximum unchecked age for key class $k$ in seconds. At query time $t$, the freshness gate is

$F(r,t)$ is dimensionless. The domain policy fixes $\tau_k$ before evaluation; an unbounded value is permitted only when the domain explicitly defines the record as non-expiring. Freshness means that the record passed its time and status policy, not that its proposition is correct.

For a key $k$, the conflict set $\mathcal C_k(t)$ contains active, policy- admissible records whose values cannot simultaneously hold at time $t$. Resolution may use an explicit source-authority rule, a time rule, or a domain-specific adjudicator. The system preserves losing records and the resolution trace. When no preregistered rule applies, the retrieval path abstains and escalates rather than averaging incompatible values.

Retrieval-augmented generation establishes that parametric generation can be combined with inspectable and replaceable non-parametric memory on evaluated knowledge-intensive tasks (C-014). This chapter adds version, freshness, conflict, and lifecycle accounting as requirements to test, not as evidence that retrieval is automatically correct.

Invalidation and rollback

Invalidation is triggered by any of the following observable events:

• an input-schema, dependency, tool, hardware, or source version changes;
• a validity interval or freshness allowance expires;
• a protected regression, shift probe, calibration check, or outcome fails;
• an authoritative source revokes or supersedes a record;
• a new admissible record creates an unresolved conflict; or
• guard false admissions, fallbacks, or escalations exceed their declared control limits.

The response depends on the artifact:

Every served output records the path, model, dependency, and factual versions that affected it. This makes the affected-output set enumerable after a defect. Report rollback time $T_{\mathrm{rb}}$ in seconds, rollback energy $E_{\mathrm{rb}}$ in joules at the declared boundary, lost or corrected events $N_{\mathrm{loss}}$ as a count, and restoration success as a dimensionless fraction.

Severity-ordered containment and triage

Rollback is one response to one fault contract. A stateful modular system also needs to keep the following actions distinct:

1. Sense: collect health evidence without treating a detector output as fault ground truth.
2. Contain: throttle inputs, revoke an interface, quarantine a route, or freeze a version to limit spread before diagnosis completes.
3. Triage: choose retry, local repair, selective reconstruction, restart, retirement, or replacement from the available evidence and declared cost.
4. Verify: test the affected behavior, protected rare behavior, provenance, and adjacent modules before restoring authority.
5. Escalate: move to a more destructive action only when verification fails or stronger evidence makes delay unsafe.
6. Replenish: restore validated capacity when a component is retired, rather than allowing maintenance to clean the system into capacity collapse.

The biological audit supplies scoped examples of fast load shedding (C-087), repair-versus-degradation triage (C-090), tag-dependent compartment routing (C-091), selective extraction (C-092), repair before removal (C-094), and removal coupled to replacement (C-095, C-096). The order is conditional: a rapidly spreading irrecoverable fault may require immediate replacement, while a local reversible fault should not trigger a global rebuild.

The engineering value of the composition remains unproven. Circuit breakers, taint tracking, checkpoints, replica failover, microreboots, scrubbing, rejuvenation, and Bayesian repair/replace policies are mandatory comparators. Candidate 005 tests the staged policy across locality, observability, repairability, and correlated detector error while charging sensing, reserve, copying, replacement, verification, downtime, and collateral loss.

Escalation is a budgeted route

Escalation activates when the local guard abstains, required facts are stale or conflicted, the event enters a protected risk stratum, or the available path cannot meet its quality contract. The escalation target may be a larger model, a deterministic tool, an authoritative data source, or a human.

The request carries the triggering uncertainty, attempted path and versions, relevant evidence, allowed data disclosure, deadline, and remaining energy or financial budget. Its result returns with provenance and observed cost. Escalation does not grant write authority; durable change still requires a versioned maintenance action.

Efficiency mechanism

Per-event and lifecycle accounting

For path version $h$ serving $N$ qualified events, define amortized energy

Lowercase $e$ terms are measured joules per qualified event. Capital $E$ terms are one-time joules at the same device, node, cluster, or facility boundary; $\mathbb{E}[E_{\mathrm{rollback},h}]$ includes failed promotions weighted by their observed or preregistered probability. $N$ is a dimensionless event count, so $e_h(N)$ is joules per qualified event. If the deployment horizon is unknown, report the break-even event count rather than assuming amortization.

For event $x$, end-to-end latency is

with every $\ell$ term in seconds. Report the empirical end-to-end percentile $L_{h,p}$ for a declared percentile $p\in(0,1)$ rather than adding separately measured component percentiles. Report physical traffic $B_h$ in bytes per qualified event across each named boundary. Energy, latency, and bytes remain separate results.

The execution term expands by path:

A candidate advances only when quality and risk remain qualified and it improves the preregistered energy–latency–traffic frontier after all listed costs are included. Skipped model operations alone are insufficient.

Provenance and freshness measurements

For $N_f$ outputs that use factual memory and $N_p$ of those outputs carrying a complete record-to-source trace, provenance coverage is

$C_{\mathrm{prov}}$ is dimensionless. Also report source-check age in seconds, stale-use and unresolved-conflict rates as fractions, index and evidence bytes, joules per lookup and update, and p50/p95 lookup latency in seconds.

If a source changes at $t_{\mathrm{source}}$ and the first correctly served version is available at $t_{\mathrm{serve}}$, correction latency is

in seconds. Record source polling or event-delivery cost alongside this value; instant correction purchased by continuous high-cost polling is not free.

Strongest null models

All nulls receive the same task stream, factual sources, safety policy, hardware opportunity, and lifecycle horizon.

If ordinary code or a standard data system matches the candidate, keep the conventional mechanism and retain only the qualification and accounting contract.

Evidence status

Speculative extensions

• Train a compiler to propose a small executable graph, applicability predicate, counterexample set, and rollback manifest as one candidate artifact.
• Learn source-check schedules from update hazard and consequence while keeping hard maximum ages for protected domains.
• Compile stable relations learned across factual versions while leaving the current proposition external and attributable.
• Use signed provenance graphs so a correction can enumerate dependent outputs, cached artifacts, and downstream derived records.
• Co-design path placement and precision with hardware only after the logical qualification gate passes on a conventional substrate.

Failure modes

Measurable predictions

1. For recurrent, stable, low-risk transformations above a measurable break-even horizon, a qualified compiled path reduces joules per event or end-to-end latency relative to N0–N3 while preserving stratum-level quality, risk, and guard false-admission limits.
2. Reusable skills outperform memoization and rules on held-out compositions, while reflex paths outperform the skill only inside their narrower declared envelope.
3. Separating mutable propositions from skills reduces correction latency, retraining energy, and obsolete-value carryover relative to parametric-only N4 at matched task quality.
4. Version, freshness, and conflict gates reduce stale or contradictory factual use relative to strong N5; the result is rejected if lookup cost erases the quality–risk benefit.
5. A structured applicability guard reduces out-of-envelope false admissions under shift relative to N1 and N7 without achieving the result by rejecting nearly all traffic.
6. Complete provenance increases the fraction of factual outputs whose source and dependent artifacts can be enumerated after a correction, at a measured byte, latency, and energy cost.
7. Atomic route rollback and versioned factual tombstones reduce restoration time and lost events relative to in-place N6 after injected bad promotions and source revocations.
8. Quantized or compiled paths produce an end-to-end physical gain only when dispatch, memory movement, validation, retained rollback state, and failed promotions amortize within the observed deployment horizon.
9. A reversible phase or interaction field advances only if it removes a measured repeated digital/transport path and beats passive mechanics, analog control, FPGA/ASIC, and distributed digital control after complete drive, fabrication, sensing, reset, drift, fallback, and retirement cost.