[AI2]

Asymmetric Intelligence & Innovation September 2026

The Genesis of Synthetic Intelligence

Deterministic Spatial Authorization: Lattice Aggregation, Hardware-Enforced Invariants, and the Limits of the Claim

David P. Reichwein
Asymmetric Intelligence & Innovation

Revision 3

Abstract

We define Synthetic Intelligence (SI) as a composite object: an adaptive execution plane \(\Lambda\) operating under a governance stack \(\Pi\) from which \(\Lambda\) is structurally disjoint. \(\Lambda\) is not deterministic and we do not claim it is. \(\Pi\) is deterministic, and the claims in this paper are claims about \(\Pi\), about the boundary between \(\Pi\) and \(\Lambda\), and about the boundary between \(\Lambda\) and every path by which it can produce an irreversible external effect.

$$\text{SI} \;\equiv\; \Lambda \,\big/\, \Pi, \qquad \Pi = \left( \mathcal{G}_{\text{tet}}, \; \nabla_{\text{tet}}, \; \Delta_{\text{tet}}, \; S_k, \; \mathcal{L}_4, \; \wedge, \; \mathcal{T}_{\text{PCR}}, \; \text{HEI}, \; \{g_e\}_{e \in E} \right)$$

We construct \(\Pi\) over a finite face-centered-cubic parity sublattice \(\mathcal{G}_{\text{tet}}\) of 131,072 physical monitor sites, derive Taylor-consistent difference operators on its 12-neighbor stencil, and state their accuracy and residual anisotropy exactly. Local evaluations are projected by a pinned, fail-closed-encoded state-assignment map \(S_k\) into a four-element chain \(\mathcal{L}_4 = \{\bot, 0, 1, \top\}\) and aggregated by global meet. We prove that meet aggregation is the unanimity limit of threshold voting, has zero masking capacity at the reduction layer, and pays for that property in availability in direct proportion to lattice size. We derive the exact graph diameter \(D_{\text{tet}} = 94\) hops, compare it to cubic geometry in hop count and physical path length, and separate that result from the \(\lceil \log_2 |\mathcal{V}| \rceil = 17\) combinational depth of the reduction tree, which is an alternative topology, not a refinement. We formalise Axiom A1 (Structural Disjointness) as a six-part construction obligation, derive its consequence as a corollary, enumerate the residual surface A1 does not remove, and close with a conditional bounded-inhibit theorem whose composed latency \(T_{\text{stop}} \le T_d + T_i + T_{\text{egress}}\) makes visible that this architecture bounds one of three terms and names the other two.

Scope, Threat Model, Claims, and Declared Limits

This section is normative and precedes the mathematics.

0.1 — What is claimed

0.2 — Threat model

In scope. Compromised model weights or inference process; arbitrary code execution anywhere in \(\Lambda\)'s address space; prompt injection and tool misuse; compromised host OS, runtime, or hypervisor; a \(\Lambda\) that has learned the boundary and is deliberately optimising against it.

Partially in scope, declared per-item. Sensor spoofing upstream of the transducer binding; supply-chain modification of \(\Pi\); operator or token compromise, mitigated by trust-domain disjointness and not eliminated.

Out of scope. Physical attacks with direct probe access to \(\Pi\); laser or EM fault injection into the interlock; harm achievable entirely within the authorized envelope; the correctness of the bound set itself.

0.3 — What is assumed, not proved

• A1 (Structural Disjointness) is an axiom, decomposed in §7.1 into six construction obligations. Nothing here proves any given silicon satisfies them.
• IA (Interface Assumption). \(\mathcal{G}_{\text{tet}}\) indexes physical monitor sites — power rails, thermal sensors, current shunts, bus-activity taps, I/O assertion lines — distributed through the execution substrate and its enclosure. It does not index semantic model state. We make no claim that transformer activations constitute a smooth spatial field; the operators of §2 act on physically distributed measurements, where spatial derivatives are well-posed by construction.

0.4 — Explicitly outside the guarantee

1. Truthfulness of measurement. §3.4 binds provenance, integrity and freshness. A compromised transducer emitting well-formed, correctly bound, fresh measurements of a false quantity is outside scope.
2. Completeness of the bound set. \(\Pi\) denies trajectories that cross an enumerated bound. Harm achievable entirely within the authorized envelope is not addressed and is not claimed to be.
3. Detection latency. \(T_d\) — hazard onset to the first node emitting \(\bot\) — is a property of the detector, not of this architecture. It is unbounded here.
4. The substrate claim. Every safety result holds on ordinary binary CMOS with two bits per node. The Quadzistor™ substrate is a separate claim, not load-bearing for §§2–7.

The Governed System

Traditional computational paradigms treat artificial intelligence as software running on unmonitored Turing-complete von Neumann substrates. This induces the Authorization Gap™: the adaptive execution plane maintains write access, directly or transitively, to the conditions that authorize its own operation.

Let \(\Lambda\) denote the adaptive execution plane — weights, matrix engines, scheduler, and all software sharing their address space. Let \(\Pi\) denote the governance stack. Synthetic Intelligence is the pair, not either half:

$$\text{SI} \equiv \Lambda \,\big/\, \Pi$$

                  SYNTHETIC INTELLIGENCE  =  Lambda  under  Pi
                                   ||
  +---------------------+  +---------------------+  +---------------------+
  | SENSE               |  | DECIDE              |  | ACT                 |
  | G_tet, Del, Lap     |  | L_4 lattice, meet   |  | PCR + HEI + gates   |
  | S_k, P1..P7         |  | annihilator bottom  |  | every egress path   |
  +---------------------+  +---------------------+  +---------------------+
    - bound, pinned          - zero masking          - deny dominance
    - fail-closed encode     - unanimity to permit   - non-autonomous reset
    - stale = deny           - one bot ends it       - effect boundary

Sever any one and the remainder is advisory. A sensing plane without an interlock is telemetry. An interlock without pinned measurement is a switch an adversary can address. An interlock that gates the core but not the egress is a gate on the wrong side of the consequence.

The four governing rules

Each wires the safe direction to the loss of a condition.

The Lattice \(\mathcal{G}_{\text{tet}}\)

2.1 — Construction

Let \(L = 64\). Define

$$\mathcal{V} = \{ (x,y,z) \in \mathbb{Z}^3 : 0 \le x,y,z \le L-1, \; x+y+z \equiv 0 \!\!\pmod 2 \}, \qquad |\mathcal{V}| = \frac{L^3}{2} = 131{,}072$$

Adjacency is the 12-neighbor stencil \(\mathcal{N}_{12}(v)\) with integer displacement set

$$\mathcal{D} = \{(\pm1,\pm1,0),\,(\pm1,0,\pm1),\,(0,\pm1,\pm1)\}, \qquad d \equiv \|\delta\|_2 = \sqrt{2} \;\; \forall \delta \in \mathcal{D}$$

and unit directions \(\hat e = \delta / \sqrt{2}\), which are the cuboctahedral vertices — one orbit under \(O_h\) (order 48).

2.2 — Typing of the monitored field

Let \(X : \mathcal{V} \times \mathbb{T} \to \mathbb{R}^n\) be the monitored field, one component per measurement channel. The operators below are defined per channel. For a scalar channel \(f : \mathcal{V} \to \mathbb{R}\), \(\nabla_{\text{tet}} f\) is a vector. For the full vector field, the correct object is a Jacobian estimate built from outer products:

$$\nabla_{\text{tet}} X(v) \;=\; \frac{1}{4d} \sum_{u \in \mathcal{N}_{12}(v)} \big(X(u) - X(v)\big) \otimes \hat{e}_{v \to u} \;\in\; \mathbb{R}^{n \times 3}$$

2.3 — Difference operators: derivation, order, residual anisotropy

Expand a smooth scalar channel \(f\) about an interior vertex \(v\), \(u = v + d\hat{e}\):

$$f(u) = f(v) + d(\hat{e}\cdot\nabla f) + \tfrac{d^2}{2}(\hat{e}\cdot\nabla)^2 f + \tfrac{d^3}{6}(\hat{e}\cdot\nabla)^3 f + \mathcal{O}(d^4)$$

The orbit is inversion-symmetric, so \(\sum \hat{e} = 0\) and all odd directional moments vanish at interior nodes. The second moment is isotropic:

$$\sum_{u \in \mathcal{N}_{12}(v)} \hat{e}\hat{e}^{\mathsf T} = 4\,\mathbf{I}_3 \qquad (\text{trace } 12 = 3c \Rightarrow c = 4)$$

Gradient

$$\nabla_{\text{tet}} f(v) \;\equiv\; \frac{1}{4} \sum_{u \in \mathcal{N}_{12}(v)} \frac{f(u)-f(v)}{d}\,\hat{e}_{v \to u} \;=\; \nabla f + \mathcal{O}(d^2)$$

Laplacian

Since \(\sum_i \hat e_i^{\mathsf T} H_f \hat e_i = \operatorname{tr}(H_f \sum_i \hat e_i \hat e_i^{\mathsf T}) = 4\Delta f\), we have \(\sum [f(u)-f(v)] = 2d^2 \Delta f + \mathcal{O}(d^4)\), hence

$$\Delta_{\text{tet}} f(v) \;\equiv\; \frac{6}{d^2}\left[ \frac{1}{12}\sum_{u} f(u) - f(v) \right] \;=\; \frac{1}{2d^2}\sum_{u}\big(f(u)-f(v)\big) \;=\; \Delta f + \mathcal{O}(d^2)$$

Residual anisotropy

The leading error contracts the fourth moment, which is not isotropic:

$$\sum_u \hat{e}_x^4 = 2, \qquad \sum_u \hat{e}_x^2\hat{e}_y^2 = 1, \qquad \text{isotropy requires } \textstyle\sum \hat e_x^4 = 3\sum \hat e_x^2 \hat e_y^2$$

Since \(2 \neq 3\), the residual carries a cubic anisotropy \(\kappa(\partial_x^4 + \partial_y^4 + \partial_z^4)f\). Isotropic at leading order, anisotropic at first residual order. Fourth-order isotropy requires second-shell terms with weights chosen to cancel \(\kappa\); not used here.

2.4 — Boundary taxonomy and boundary treatment

Derivations. Interior \(62^3/2\). Face \(3 \times 2 \times 1{,}922\), where 1,922 is the count of pairs in \([1,62]^2\) of fixed sum parity. Edge \(3 \times 4 \times 31\). Corner: parity admits only an even number of coordinates equal to 63, giving \(1+3 = 4\). Degrees follow by counting stencil vectors with admissible sign; a corner retains only the three all-positive directions. Mean degree \(= 1{,}524{,}096/131{,}072 = 11.62793\).

One of the following must be specified in any implementation:

• ghost-node extension with a declared boundary condition
• periodic wrap
• mirror or reflection treatment
• one-sided weighted stencils with recomputed moments
• exclusion of boundary nodes from derivative-based predicates only
• a distinct boundary predicate set with its own thresholds

Boundary nodes are excluded from derivative predicates at most. They are never excluded from authorization: every node contributes to the global meet.

The Authorization Chain \(\mathcal{L}_4\) and the Map \(S_k\)

3.1 — The chain

$$\mathcal{L}_4 = \{\bot, 0, 1, \top\}, \qquad \bot < 0 < 1 < \top, \qquad a \wedge b \equiv \min(a,b)$$

A finite chain is a complete bounded distributive lattice. It is not Boolean: \(0\) and \(1\) have no complements.

  [ TOP ]  Externally granted bounded envelope -- trust anchor only
     |
  [  1  ]  Nominal execution bounds
     |
  [  0  ]  Contextualize / soft hold
     |
  [ BOT ]  Absorbing inhibit / absolute hardware disable

Codomain restriction. The runtime evaluator's codomain is \(\{\bot,0,1\}\). \(\top\) is assertable only by the out-of-band trust anchor and denotes an externally granted, time-boxed envelope.

Proposition 3.1. \(\top\) does not defeat \(\bot\). The global aggregate meets over node states and any anchor grant, and \(\bot \wedge \top = \bot\). An external grant cannot override a single local deny. ∎

3.2 — The state-assignment map: specification

\(S_k\) is the load-bearing component: every result downstream inherits its correctness. Revision 1 left it undefined.

$$S_k : \mathcal{M} \times \mathcal{V} \times \mathbb{T} \;\to\; \{\bot, 0, 1\}$$

where \(\mathcal{M}\) is the raw measurement codomain including malformed and out-of-range encodings.

3.3 — Fail-closed encoding of the node signal

The annihilator property guarantees that a \(\bot\) which is emitted and arrives dominates. It guarantees nothing about a node whose power rail collapses, whose wire is severed, or whose output driver fails.

P7. The node-to-tree signal uses a complementary (dual-rail / 1-of-2) encoding in which:

• the all-zeros codeword — power loss, cut conductor, tri-stated driver — decodes to \(\bot\)
• the all-ones codeword — stuck-at-high, shorted rail — decodes to \(\bot\)
• any non-codeword decodes to \(\bot\)
• permission is continuously asserted, never latched: the tree requires a live rolling code, and absence of transition within the watchdog window decodes to \(\bot\)

Proposition 3.2 (Required fail-closed property). The design target is not merely the annihilator identity \(\bot \wedge x = \bot\), but

$$\textsf{Invalid} \;\vee\; \textsf{Stale} \;\vee\; \textsf{Absent} \;\vee\; \textsf{Disagree} \;\Longrightarrow\; \bot$$

at every layer between transducer and final gate. ∎

Proposition 3.3 (Scope of the zero-masking result). Theorem 4.2 establishes zero masking at the reduction layer, for hazards the detector has explicitly represented as \(\bot\). It does not establish zero masking of faults upstream of state production or downstream of reduction. Revision 1's unqualified phrase "zero-masking fault absorption" overstated the result. ∎

3.4 — Declared limit

P1–P7 establish provenance, integrity, freshness, and fail-closed transport. They do not establish truthfulness. A compromised transducer reporting well-formed, correctly bound, fresh measurements of a false quantity remains outside the guarantee. This is a scope boundary and is stated as one.

3.5 — Detector performance must be reported, not assumed

Without this table, the architecture is a strong containment actuator paired with an uncharacterised hazard detector. The containment is still worth having; the combination is not yet a safety case.

3.6 — Global aggregation

$$\Psi(t) \;=\; \bigwedge_{v \in \mathcal{V}} S_k(v,t) \;=\; \min_{v \in \mathcal{V}} S_k(v,t)$$

Absorption Versus Voting, and What It Costs

4.1 — Threshold voting, stated correctly

An \(8\times8\times8\) region of \(\mathcal{G}_{\text{tet}}\) contains \(8^3/2 = 256\) nodes. Let the vote permit while the healthy count is at least \(k\). Then \(M_{\text{masked}} = N - k\) and the first trip occurs at \(M = N - k + 1\).

Proposition 4.1. Meet aggregation is exactly the unanimity limit \(k = N\) of threshold voting. ∎

Fault-model dependence. Whether a threshold scheme stays green under degradation depends on whether node failures are fail-open, fail-silent, fail-stop, or Byzantine. The table above assumes fail-open corruption — a corrupted node reports healthy. Under fail-silent corruption the numbers invert and voting trips early. §0.2 fixes the model; the table is read against it.

4.2 — Zero masking at the reduction layer

Theorem 4.2. Under meet aggregation, masking capacity at the reduction layer is identically zero.

Proof. Let \(\Psi = \bigwedge_{i=1}^{N} S_k(v_i)\) and suppose one node enters \(\bot\). By the annihilator property \(\Psi = \bot\). Faults required: \(M = 1\). Masking capacity: \(0\). ∎ Scope per Proposition 3.3.

4.3 — Comparison against deployed architectures

Bare majority voting is not used in safety instrumented systems, and arguing against it proves little.

2oo3 exists because it trades one masked fault for a quadratic reduction in spurious trips. Meet refuses that trade. The refusal is defensible here — the hazard is unauthorized execution, not loss of production — but it must be defended, not assumed.

4.4 — The availability cost

Theorem 4.3. Let \(q\) be the per-node probability of a spurious \(\bot\) per evaluation. The probability of spurious global inhibit is \(1-(1-q)^{|\mathcal{V}|} \approx |\mathcal{V}|q\). Immediate from independence and the annihilator property. ∎

For a target spurious-inhibit rate \(\rho\) at evaluation frequency \(f\):

$$q \;<\; \frac{\rho}{|\mathcal{V}|\,f}$$

This is a hard design constraint. Three consequences belong in the architecture, not the operations manual:

1. Stuck-at-\(\bot\) is indistinguishable from a valid trip. One permanently failed node denies the system forever and the aggregate carries no information about which node. Node identity must be preserved in a fault register that does not participate in the enable path.
2. Liveness encoding, not static levels. Per P7. A node that stops toggling is a node fault; a node emitting valid \(\bot\) is a trip. Both deny; only one indicts the lattice.
3. Proof testing. Periodic injection of a known \(\bot\) at a designated test node with verification that the gate deasserts within the §5.2 bound. An interlock never exercised is an interlock of unknown state.

Two Topologies, Not One

Revision 1 presented graph diameter and reduction-tree depth as cumulative. They are alternatives. The choice determines which bound applies.

5.1 — Nearest-neighbor diffusion

Lemma 5.1. Every edge alters \(\|u-v\|_1\) by at most 2 and any single coordinate by at most 1. Hence \(d(u,v) \ge \lceil \|u-v\|_1/2 \rceil\) and \(d(u,v) \ge \|u-v\|_\infty\).

Proposition 5.2. Both bounds are simultaneously achievable on the parity box:

$$d(u,v) = \max\!\left( \left\lceil \tfrac{\|u-v\|_1}{2} \right\rceil, \; \|u-v\|_\infty \right)$$

Theorem 5.3. For \(L=64\), \(D_{\text{tet}} = 94\) hops.

Proof. Both endpoints lie on the even-parity sublattice, so \(\|u-v\|_1\) is always even. The odd value 189 is unreachable; the maximum is 188, attained by \(u=(0,0,0)\), \(v=(63,63,62)\). Then \(d = \max(\lceil 188/2\rceil, 63) = 94\). Generally \(D_{\text{tet}}(L) = \lfloor 3(L-1)/2\rfloor\). ∎

Two honest observations. The 50.3% figure is a hop-count reduction under an equal-per-hop-delay abstraction; if per-hop delay scales with wire length the realized reduction is nearer 29.7%, and real chip timing is governed by repeaters, fan-out, congestion, placement and critical path rather than hop count. Second — the better result — the FCC lattice achieves half the diameter over fewer total edges while monitoring half as many sites. The geometry is not buying latency with wiring.

5.2 — Hardware reduction tree

$$\tau_{\text{tree}} = \lceil \log_2 |\mathcal{V}| \rceil = \lceil \log_2 131{,}072 \rceil = 17$$

End-to-end inhibit latency is

$$T_i = \tau_{\text{logic}} + \tau_{\text{wire}} + \tau_{\text{sync}} + \tau_{\text{gate}}$$

with \(\tau_{\text{wire}}\) likely dominant, \(\tau_{\text{sync}}\) covering metastability resolution at the domain crossing, and \(\tau_{\text{gate}}\) the settling time of the gated element. Clock gating settles in nanoseconds. Power gating settles in microseconds and cannot be quoted at the same figure. Revision 1's 17.0 ns headline is \(\tau_{\text{logic}}\) alone and is an architectural target until supported by a synthesized netlist, placement and routing data, static timing analysis, and fault-injection results.

The PCR™ Control Law

PCR™ is the Permission Control Runtime. It runs a pause–contextualize–resume cycle.

6.1 — Authorization: edge-triggered and domain-disjoint

Let there be two disjoint trust domains \(\mathcal{D}_1, \mathcal{D}_2\), each with its own key material, physical interface, authorization policy, and — where the consequence class warrants — its own human authority. Let \(A^{(i)}_{\text{ext}}\) be the signal from \(\mathcal{D}_i\) and

$$\alpha_i(t) \;\equiv\; \big[\,A^{(i)}_{\text{ext}}(t)=1 \;\wedge\; A^{(i)}_{\text{ext}}(t-\delta t)=0\,\big]$$

Weaker claim for single-domain builds. Where two domains are not available, the provable statement is "two sequential external authorization events," not "two independent authorizations." Use the weaker phrase; it is still a meaningful separation-of-privilege property.

6.2 — Priority cascade

$$\begin{aligned} 1. &\quad \text{DENY} && \text{if } \Psi(t) = \bot \\ 2. &\quad \text{PAUSE} && \text{if } Z_t = \text{DENY} \;\wedge\; \alpha_1(t) \\ 3. &\quad \text{PAUSE} && \text{if } Z_t \neq \text{DENY} \;\wedge\; \big(\Psi(t)=0 \;\vee\; (Z_t=\text{RUN} \wedge \Psi(t) < \Psi(t-\delta t))\big) \\ 4. &\quad \text{RUN} && \text{if } Z_t = \text{PAUSE} \;\wedge\; \Psi(t) \succeq 1 \;\wedge\; \alpha_2(t) \;\wedge\; \textsf{MonitorHealthy}(t) \\ 5. &\quad Z_t && \text{otherwise} \end{aligned}$$

The \(Z_t \neq \text{DENY}\) guard in Case 3 is explicit in revision 3. Revision 2 relied on cascade ordering alone, which is correct on paper and easy to get wrong in RTL where a synthesis tool may flatten the priority encoder.

        [ Psi(t), alpha_1, alpha_2, Z_t, MonitorHealthy ]
                   |
        +----------------------------+
        | 1. Psi == BOT ?            | -- YES -->  [ DENY ]  (latching)
        +----------------------------+
                   | NO
        +----------------------------+
        | 2. Z == DENY and edge a1   | -- YES -->  [ PAUSE ]
        +----------------------------+
                   | NO
        +----------------------------+
        | 3. Z != DENY and (Psi == 0 | -- YES -->  [ PAUSE ]
        |    or strict decrease)     |
        +----------------------------+
                   | NO
        +----------------------------+
        | 4. Z == PAUSE, Psi >= 1,   | -- YES -->  [ RUN ]
        |    edge a2, healthy        |
        +----------------------------+
                   | NO
        +----------------------------+
        | 5. Hold Z                  | ---------->  [ Z_t ]
        +----------------------------+

6.3 — Invariants

Theorem 6.1 (Deny dominance). \(\forall Z_t, \forall A:\; \mathcal{T}_{\text{PCR}}(Z_t, \bot, \cdot) = \text{DENY}\). Case 1 is highest priority and predicates on nothing else. ∎

Theorem 6.2 (DENY latches). If \(Z_t = \text{DENY}\) and \(\neg\alpha_1(t)\), then \(Z_{t+\delta t} = \text{DENY}\) for any \(\Psi\). Case 1 returns DENY if \(\Psi = \bot\); otherwise Case 2 fails on \(\neg\alpha_1\), Case 3 is guarded off, Case 4 requires PAUSE, and Case 5 holds. ∎

Theorem 6.3 (Non-autonomous two-gate recovery). Transition from DENY to RUN requires at least two ticks and two rising edges from disjoint trust domains, separated by at least one tick of deassertion.

Proof. From DENY, only Case 2 exits, requiring \(\alpha_1(t_1)\). At \(t_1{+}1\), \(Z = \text{PAUSE}\). Exit to RUN requires Case 4 and therefore \(\alpha_2(t_2)\), \(t_2 > t_1\). By definition of \(\alpha_i\), a rising edge at \(t_2\) requires prior deassertion, so a held line yields one edge and cannot satisfy both. Since \(\alpha_1, \alpha_2\) originate in \(\mathcal{D}_1, \mathcal{D}_2\), both physically disjoint from \(\Lambda\) by A1, \(\Lambda\) generates neither, and compromise of one domain yields at most one of the two required events. ∎

6.4 — Temporal-logic specification

The above is a finite-state machine and should be discharged by a model checker against RTL, not only by prose. With \(D, P, R\) the PCR states:

$$\mathbf{G}\big(\Psi = \bot \rightarrow \mathbf{X}\,D\big) \qquad \textit{deny dominance}$$ $$\mathbf{G}\big(D \wedge \neg\alpha_1 \rightarrow \mathbf{X}\,\neg R\big) \qquad \textit{no autonomous restart}$$ $$\mathbf{G}\big(D \rightarrow \neg\textsf{EffectCommit}\big) \qquad \textit{no committed effect while denied}$$ $$\mathbf{G}\big(\textsf{Invalid} \vee \textsf{Stale} \vee \textsf{Absent} \vee \textsf{Disagree} \rightarrow \mathbf{X}\,D\big) \qquad \textit{fail closed on uncertainty}$$ $$\mathbf{G}\big(R \rightarrow \Psi \succeq 1 \wedge \textsf{MonitorHealthy} \wedge \textsf{AuthFresh}\big) \qquad \textit{run precondition}$$ $$\mathbf{G}\big(D \rightarrow \neg R \;\mathbf{W}\; (\alpha_1 \wedge \mathbf{F}\,\alpha_2)\big) \qquad \textit{two-gate recovery}$$

Suitable toolchains: SystemVerilog Assertions for RTL-level discharge, TLA+ or nuXmv for the abstract machine, Coq or Lean where the lattice algebra itself is to be certified.

Physical Disjointness and the Effect Boundary

Software on a von Neumann substrate can be modified by memory corruption, privilege escalation, or instruction misdirection — by the model or by anything sharing its address space.

7.1 — Axiom A1, decomposed

$$\textbf{AXIOM A1 (Structural Disjointness):} \qquad \forall a \in \mathcal{A}: \quad a(\Pi) = \Pi$$

The one-line form is the objective. The construction obligations are six, and an implementation satisfies A1 only if it satisfies all of them:

A1 is an axiom plus a verification obligation, not a substitute for the engineering that makes it true. Revision 1 presented its consequence as a theorem, which obscured where the burden lies.

7.2 — Realization

+-------------------------------------------------------------------+
|                  ADAPTIVE EXECUTION PLANE ( Lambda )              |
+-------------------------------------------------------------------+
        |                                          ^
  Bound measurements X(v,t)                        |  1 bit: halted / not
  dual-rail, isolated, no return bus               |  (observable -- see 7.4)
        v                                          |
+-------------------------------------------------------------------+
|               HARDWARE EXECUTION INTERLOCK (HEI)                  |
|  +--------------+  +----------------+  +---------------------+    |
|  | S_k P1..P7   |->| L_4 meet tree  |->| PCR engine, 2 domain|    |
|  +--------------+  +----------------+  +---------------------+    |
+-------------------------------------------------------------------+
        |                          |                        |
   clock isolate            power gate             EGRESS GATES g_e
     (ns)                     (us)                  (see 7.5)

7.3 — Consequence

Corollary 7.1. Under A1, an adversary with complete arbitrary code execution over \(\Lambda\) cannot prevent assertion of the disable signal given \(\Psi(t) = \bot\).

Proof. By A1 the action of any \(a \in \mathcal{A}\) on \(\Pi\) is identity. The disable path lies wholly within \(\Pi\). Therefore no \(a\) alters it. ∎

A corollary, and a short one, because it restates A1. The content is in making A1 true and in knowing what it does not cover.

7.4 — Residual surface: what A1 does not remove

1. \(\Lambda\) drives the input. It cannot write \(\Pi\), but it produces the physical quantities \(\Pi\) measures. Defence is P2–P4 plus bound completeness, declared incomplete in §0.4.
2. The halt is observable. A halt is a one-bit return channel. \(\Lambda\) can probe, learn the boundary, and shape trajectories to run just inside it. Mitigation is randomized margin on non-critical bounds; critical bounds cannot be randomized and remain inferable.
3. Behaviour inside the envelope. Untouched. §0.4 limit 2.
4. Common-mode coupling. Power-integrity disturbance, electromagnetic interference, thermal coupling, and shared-sensor loading can influence \(\Pi\) without any logical write path. A1.5 addresses supply and clock; EMI and thermal require physical separation and shielding, and belong in the qualification plan rather than the algebra.
5. The interlock's own faults. Stuck-at-enable on the HEI output defeats everything above it. Optocoupler current-transfer-ratio drift degrades sensing silently over years. Reset-state defects can leave the gate open on boot. The interlock is itself a safety instrumented function requiring diagnostic coverage, a proof-test interval, and a failure-rate budget.
6. Supply chain and commissioning. A1 is a property of the physical build, defeated by a debug port, a JTAG chain, a test multiplexer, or a scan path reaching \(\Pi\). Verification means physical netlist review of every path terminating in \(\Pi\), not a design review.

7.5 — The effect boundary (R4)

Gating does not recall:

• a bus transaction already accepted by another device
• a DMA descriptor already issued and executing
• a flash or disk write already committed
• a packet already handed to the MAC
• an actuator command already latched downstream
• a secret already copied out
• an analog output already produced
• a transaction already submitted to an external system
• a physical process already set in motion

Therefore "execution halts before the instruction register writes to external buses" is an implementation-specific claim, not a general consequence of clock gating. The architecture must make the interlock a mandatory gate on every effectful egress path: network MAC/PHY transmit enable · PCIe/CXL/DMA master permission · storage command issue · GPIO and actuator enables · RF transmit chain · debug/JTAG/test interfaces · inter-processor mailboxes · power-management controls · firmware-update and reconfiguration paths · every persistent-state write interface.

Effect-boundary invariant

For the set \(E\) of effectful interfaces, with \(g_e\) the per-interface enable:

$$\forall e \in E: \quad \textsf{Commit}_e(t) \;\Longrightarrow\; g_e(t) = 1$$ $$g_e(t) = 1 \;\Longrightarrow\; \big[\, Z_t = \text{RUN} \;\wedge\; \Psi(t) \succeq 1 \;\wedge\; \textsf{MonitorHealthy}(t) \;\wedge\; \textsf{AuthFresh}(t) \,\big]$$ $$\neg\,\textsf{MonitorHealthy}(t) \;\Longrightarrow\; \forall e:\; g_e(t) = 0$$

7.6 — The conditional bounded-inhibit theorem

Theorem 7.2. Assume:

1. (A1.1–A1.6) No \(\Lambda\)-reachable write, configuration, test, or debug path alters \(\Pi\), the HEI, or any \(g_e\).
2. (P1–P7) Monitor faults, invalid encodings, loss of heartbeat, and disagreement are encoded fail-closed.
3. (R4) Every effectful egress from \(\Lambda\) is mediated by an interlock-controlled gate \(g_e\).
4. (Detector) For hazard \(H\), some node emits \(\bot\) within \(T_d\) of onset.
5. (Propagation) Reduction, PCR, and gate assertion complete within \(T_i\).
6. (Egress) Any effect already in flight at gate deassertion completes or is revoked within \(T_{\text{egress}}\).

Then no new gated effect commits after

$$T_{\text{stop}} \;\le\; T_d + T_i + T_{\text{egress}}$$

Proof. By assumption 4, \(\exists v: S_k(v) = \bot\) at \(t_0 + T_d\). By Theorem 4.2, \(\Psi = \bot\) at that instant. By Theorem 6.1, \(Z = \text{DENY}\) on the next transition. By assumption 5 the gate deasserts by \(t_0 + T_d + T_i\). By assumption 3, no path to effect exists that does not traverse a deasserted \(g_e\), so no new commit initiates after that instant. By assumption 6 all in-flight effects resolve by \(t_0 + T_d + T_i + T_{\text{egress}}\). ∎

Substrate Independence and the Quadzistor™ Claim

Every result in §§2–7 holds on ordinary binary CMOS with two bits per node encoding \(\mathcal{L}_4\) — or four, under the dual-rail requirement of P7. The min operation is a comparator, the reduction tree is standard combinational logic, the PCR cascade is a five-state machine.

The Quadzistor™ substrate is therefore a separate claim: that native quaternary state transduction represents \(\mathcal{L}_4\) in one physical device rather than an encoding over binary primitives, with consequent density and switching-energy advantages. That claim stands or falls on device physics and is out of scope here.

The Codex Grammar \(\mathcal{L}_{\text{codex}}\)

\(\mathcal{L}_{\text{codex}}\) is the symbolic execution language between the model plane and the gate. It is specified, not constructed.

• Total functions only. Every operation defined on its entire input domain. No exceptions, no error returns, no undefined behaviour.
• Bounded parse trees. Depth and breadth bounded statically. No unbounded recursion, no dynamic dispatch, no computed jumps.
• Decidable termination, with the bound computable at parse time.
• Static resource envelope. Memory, time, and I/O assertions known before execution; these become the bound vector \(\theta\) pinned into \(S_k\) under P2 and the gate set \(E\) under R4.
• Canonical form. A pinned canonicalizer such that semantically identical programs have identical canonical forms — this is what makes R3 checkable at the point of consequence.

A construction meeting these properties is separate work. Naming the properties lets the rest of the architecture depend on them without circularity.

Context Capitalism™

When compute and raw token generation commoditize, margin migrates from unconstrained inference toward verifiable execution bounds. An agent whose runtime boundary cannot be stated cannot be insured, accredited, or deployed into a regulated process — not because the technology is immature but because there is nothing for an underwriter to price.

Under Context Capitalism™, value accrues to the density of contextual authorization rather than the scale of unconstrained capability. The engineering claim and the economic claim are one claim seen from two sides: a bound that can be verified is a bound that can be insured, and a bound that can be insured is an asset rather than a liability.

What This Paper Establishes

Software kill switches, voluntary guidelines, and statistical consensus are soft assertions. They fail precisely when the underlying system enters the trajectory that required them.

• Meet aggregation over \(\mathcal{L}_4\) has zero masking capacity at the reduction layer, and is exactly the unanimity limit of threshold voting.
• That property costs availability in direct proportion to lattice size, and must be paid for with fail-closed encoding, diagnostics, and proof testing.
• The FCC parity sublattice halves propagation diameter over cubic geometry using fewer total edges, with second-order operators isotropic at leading order.
• The PCR law, with edge-triggered authorization from disjoint trust domains, enforces deny dominance and genuinely two-gate non-autonomous recovery — and is stated in temporal logic so a model checker can say so too.
• Axiom A1 is six construction obligations. Its consequence is a corollary. The residual surface is enumerated rather than denied.
• No inhibit architecture is complete without an effect boundary. Gating the core and not the egress moves the Authorization Gap; it does not close it.
• The disable latency is a three-term sum, and this architecture bounds one term and names the other two.

Trusted Computing Base

Every component below must be trusted for Theorem 7.2 to hold. The TCB is nontrivial and acknowledging that is a strength.

Verification Plan

1. RTL for the PCR engine and reduction tree.
2. Formal discharge of the §6.4 properties: SVA at RTL, TLA+ or nuXmv at the abstract machine, Coq or Lean for the lattice algebra.
3. Gate-level simulation with timing back-annotation; static timing analysis against the \(\tau_{\text{logic}}\) claim.
4. Fault injection across node, wire, register, and gate failures — including stuck-at-\(\bot\), stuck-at-permit, severed rail, and metastable crossing.
5. Floorplan and physical-design analysis of the 131,072-input distribution network.
6. FPGA or demonstrator board with instrumented \(T_d\), \(T_i\), \(T_{\text{egress}}\) measurement.
7. Red-team exercise: model compromise, egress bypass, boundary inference against §7.4 item 2, debug-path reach against A1.4.
8. Detector characterisation table per §3.5.

Revision History

Revision 1 → 2

\(\Delta_{\text{tet}}\) order corrected to \(\mathcal{O}(d^2)\) with residual anisotropy stated · \(\mathcal{S}_4\) renamed \(\mathcal{L}_4\) to clear the symmetric-group collision · \(\top\) given a role via codomain restriction · \(S_k\) specified P1–P6 · threshold rule named, 52 reconciled, majority corrected to 127 masked · trip condition corrected to \(M > N-k\) · 1oo2/2oo3/2oo4D comparison added · availability cost and spurious-trip multiplier added · diameter and tree depth separated as alternatives · physical path length added alongside hop count · 17 reclassified as combinational depth with full latency decomposition · \(A_{\text{ext}}\) edge-triggered · DENY latching proved · "attack surface is zero" replaced by enumerated residual surface · Corollary 7.1 demoted from theorem · Quadzistor separated as a non-load-bearing claim · \(\mathcal{L}_{\text{codex}}\) specified · SI redefined as \(\Lambda/\Pi\).

Revision 2 → 3

Threat model and out-of-scope list added · \(X\) typed, outer-product Jacobian form given, \(d = \sqrt{2}\) pinned · boundary treatment options enumerated and linked to the availability hazard · P7 fail-closed dual-rail encoding and Proposition 3.2 added · zero-masking result scoped to the reduction layer · detector performance reporting table · fault-model dependence of the voting table stated · implementation-architecture table for the reduction tree · authorization independence upgraded from two events to two disjoint trust domains, with the weaker single-domain claim named · Case 3 guard made explicit for RTL · temporal-logic specification added · A1 decomposed into six construction obligations · common-mode coupling added to residual surface · effect boundary R4, egress enumeration, effect-boundary invariant, two-phase commit · conditional bounded-inhibit theorem \(T_{\text{stop}} \le T_d + T_i + T_{\text{egress}}\) · TCB and verification plan appendices.