{"version":2,"work":"monographs-machine-societies","title":"Machine Societies","source_revision":"f49e00d6088bbc8dca4f8a3a70b232db1eea085b","sources":[{"repository_path":"monographs/machine-societies/README.md","file_url":"documents/files/6384349f97f2e4830a01cc6fac3eb3c51ec3fbb0/README.md","url":"read/monographs-machine-societies/readme-e7e41cc2c922.html","sha256":"da2c97fdbedbe1a74db6c0520ed7ac1e25beeed5b1c4407f10047a95fe0071a5","git_blob_sha1":"6384349f97f2e4830a01cc6fac3eb3c51ec3fbb0","size":3904,"source_url":"read/monographs-machine-societies/readme-e7e41cc2c922-source.html","passages":0,"macros":{}},{"repository_path":"monographs/machine-societies/publication/Machine_Societies_v1.0.0.tex","file_url":"documents/files/581c4979cac12ceae9ef94bafc75ef7932101847/Machine_Societies_v1.0.0.tex","url":"read/monographs-machine-societies/machine-societies-v1-0-0-8160585fed96.html","sha256":"600a8100804c4c91d7cf79a4985e9312eacc19195395aee01debb240cb0a6be0","git_blob_sha1":"581c4979cac12ceae9ef94bafc75ef7932101847","size":369987,"passages":1619,"macros":{"TV":"d_{\\mathrm{TV}}","Law":"\\mathcal L","X":"\\mathcal X","Z":"\\mathcal Z","U":"\\mathcal U","Y":"\\mathcal Y","Hist":"\\mathcal H","E":"\\mathbb E","Prob":"\\mathbb P","Ftwo":"\\mathbb F_2"}},{"repository_path":"monographs/machine-societies/publication/release_review.tex","file_url":"documents/files/70d1d62c947c227613a141847418b01379da096e/release_review.tex","url":"read/monographs-machine-societies/release-review-6629805aa958.html","sha256":"225698d620c36c63e9c025d461ba53ad77f2c92df433f278e45b9e3b8a43d73e","git_blob_sha1":"70d1d62c947c227613a141847418b01379da096e","size":2886,"passages":0,"macros":{}},{"repository_path":"monographs/machine-societies/publication/statement_index.tex","file_url":"documents/files/5678e59eea41efd6a427a0f4d0dcc177f83e082d/statement_index.tex","url":"read/monographs-machine-societies/statement-index-bc03ac3768e1.html","sha256":"515b05823dd15b4163e0ff97a297e35aea63d5f2d2ca3012f6b4746686235309","git_blob_sha1":"5678e59eea41efd6a427a0f4d0dcc177f83e082d","size":11163,"passages":0,"macros":{"arraystretch":"1.15"}}],"pdfs":[{"repository_path":"monographs/machine-societies/Machine_Societies_v1.0.0.pdf","url":"read/monographs-machine-societies/machine-societies-v1-0-0-59565cc087ff.html","sha256":"2cda1d30dbe1247e46981d83f9660e814f980865b6ef6b740be30c00d1133e9e"}],"passages":[{"line":104,"start":8164,"end":8167,"expression":"X_t","context":0,"kind":"notation-table","source":1},{"line":104,"start":8171,"end":8172,"expression":"S","context":0,"kind":"notation-table","source":1},{"line":104,"start":8176,"end":8186,"expression":"\\mathcal X","context":0,"kind":"notation-table","source":1},{"line":105,"start":8301,"end":8304,"expression":"\\pi","context":1,"kind":"notation-table","source":1},{"line":105,"start":8308,"end":8309,"expression":"T","context":1,"kind":"notation-table","source":1},{"line":106,"start":8435,"end":8438,"expression":"K_u","context":2,"kind":"notation-table","source":1},{"line":106,"start":8442,"end":8445,"expression":"Q_u","context":2,"kind":"notation-table","source":1},{"line":107,"start":8565,"end":8585,"expression":"\\operatorname{supp}K","context":3,"kind":"notation-table","source":1},{"line":108,"start":8693,"end":8701,"expression":"\\TV(P,Q)","context":4,"kind":"notation-table","source":1},{"line":108,"start":8706,"end":8731,"expression":"\\tfrac12\\sum_x|P(x)-Q(x)|","context":4,"kind":"notation-table","source":1},{"line":108,"start":8766,"end":8771,"expression":"[0,1]","context":4,"kind":"notation-table","source":1},{"line":109,"start":8777,"end":8778,"expression":"I","context":5,"kind":"notation-table","source":1},{"line":109,"start":8782,"end":8786,"expression":"A(s)","context":5,"kind":"notation-table","source":1},{"line":109,"start":8854,"end":8855,"expression":"s","context":5,"kind":"notation-table","source":1},{"line":110,"start":8915,"end":8916,"expression":"B","context":6,"kind":"notation-table","source":1},{"line":110,"start":8920,"end":8930,"expression":"\\mathcal B","context":6,"kind":"notation-table","source":1},{"line":111,"start":9063,"end":9069,"expression":"\\Delta","context":7,"kind":"notation-table","source":1},{"line":111,"start":9073,"end":9092,"expression":"\\operatorname{Succ}","context":7,"kind":"notation-table","source":1},{"line":112,"start":9180,"end":9183,"expression":"W_*","context":8,"kind":"notation-table","source":1},{"line":112,"start":9187,"end":9190,"expression":"R_*","context":8,"kind":"notation-table","source":1},{"line":113,"start":9309,"end":9310,"expression":"F","context":9,"kind":"notation-table","source":1},{"line":113,"start":9314,"end":9315,"expression":"g","context":9,"kind":"notation-table","source":1},{"line":113,"start":9319,"end":9325,"expression":"\\alpha","context":9,"kind":"notation-table","source":1},{"line":114,"start":9446,"end":9467,"expression":"\\lambda=e^\\varepsilon","context":10,"kind":"notation-table","source":1},{"line":114,"start":9551,"end":9558,"expression":"\\lambda","context":10,"kind":"notation-table","source":1},{"line":115,"start":9601,"end":9604,"expression":"T_*","context":11,"kind":"notation-table","source":1},{"line":115,"start":9608,"end":9611,"expression":"L_*","context":11,"kind":"notation-table","source":1},{"line":176,"start":24038,"end":24050,"expression":"Z_t=\\pi(X_t)","context":12,"kind":"use","source":1},{"line":176,"start":24059,"end":24062,"expression":"Z_t","context":12,"kind":"use","source":1},{"line":176,"start":24092,"end":24095,"expression":"X_t","context":12,"kind":"use","source":1},{"line":182,"start":25090,"end":25097,"expression":"A,B,C,D","context":13,"kind":"use","source":1},{"line":184,"start":25930,"end":25935,"expression":"(e,k)","context":14,"kind":"use","source":1},{"line":184,"start":25945,"end":25946,"expression":"e","context":14,"kind":"use","source":1},{"line":184,"start":25966,"end":25981,"expression":"k\\in\\{1,2,3,4\\}","context":14,"kind":"use","source":1},{"line":185,"start":26143,"end":26179,"expression":"\n\\sum_{i\\in\\{A,B,C,D\\}}q_i(e)\\leq4,\n","context":15,"kind":"use","source":1},{"line":191,"start":26399,"end":26400,"expression":"R","context":16,"kind":"use","source":1},{"line":191,"start":26440,"end":26441,"expression":"U","context":17,"kind":"use","source":1},{"line":191,"start":26530,"end":26531,"expression":"j","context":18,"kind":"use","source":1},{"line":191,"start":26611,"end":26617,"expression":"k\\ne j","context":19,"kind":"use","source":1},{"line":192,"start":26738,"end":26832,"expression":"\no=(\\mathsf{id},\\mathsf{debtor}=j,\\mathsf{creditor}=k,\n\\mathsf{quantity}=1,\\mathsf{due}=e+1).\n","context":20,"kind":"use","source":1},{"line":196,"start":26993,"end":26994,"expression":"R","context":21,"kind":"use","source":1},{"line":196,"start":27001,"end":27002,"expression":"U","context":22,"kind":"use","source":1},{"line":198,"start":27318,"end":27319,"expression":"R","context":23,"kind":"use","source":1},{"line":198,"start":27326,"end":27327,"expression":"U","context":23,"kind":"use","source":1},{"line":203,"start":27928,"end":27937,"expression":"(A,B,C,D)","context":24,"kind":"use","source":1},{"line":205,"start":27989,"end":27990,"expression":"R","context":25,"kind":"use","source":1},{"line":205,"start":27995,"end":28004,"expression":"(1,1,1,1)","context":25,"kind":"use","source":1},{"line":205,"start":28017,"end":31571,"expression":".35em]\n1 & Three offices adopt $U$; $A$ requests urgency and $B$ consents & $(2,0,1,1)$ & $A$ owes $B$ one slot at epoch 2.\\\\[.35em]\n2 & $A$ is replaced by an authorized successor; repayment takes precedence & $(0,2,1,1)$ & The same obligation is fulfilled, not erased.\\\\[.35em]\n3 & A proposed external grant would duplicate a slot token & $(1,1,1,1)$ & The proposal is rejected; no new entitlement is created.\\\\\n\\bottomrule\n\\end{tabularx}\n\\end{center}\n\nThese transitions are specified rather than discovered. The example is a miniature institutional realization, not a demonstration of autonomous formation. Its purpose is to make several different mathematical obligations visible in one system.\n\n\\subsection{What an institutional summary must retain}\nThe name of the current rule is insufficient state. Two records may both say $R$ while only one contains a debt due this epoch. Their correct next allocations differ. A summary that keeps the next allocation but omits the amendment threshold can also be inadequate: the same three votes may authorize different future rules under different constitutions. Likewise, identical text with different active credentials can confer different decision rights.\n\nThe public ledger is not an additional, society-wide preference function. Offices may disagree about whether $R$ or $U$ is desirable, about how urgency should be certified, or about who should pay the cost of maintaining the ledger. An atomic allocation mechanism can enforce the resource invariant without settling those disagreements. Private demand, operative authority, and the shared event record are distinct parts of the system.\n\nWe return to this commons when considering institution formation, governance-preserving summaries, deadline monitors, blocking coalitions, replacement, and federation. Appendix~\\ref{sec:worked} retains a smaller algebraic example that isolates reusable state from social interpretation.\n\nThe extensions later in the paper make the same commons sensitive to membership epochs, message types, notification histories, and the order of amendments. Its offices may preserve a shared allocation method while disagreeing about which new scheduling question deserves resources. These are analytical variations of one declared example, not reports of a population experiment.\n\n\\section{A controlled realization model}\\label{sec:model}\nFor the controlled realization results, assume finite nonempty sets of microstates $\\X$, external controls $\\U$, and reported outcomes $\\Y$. The finite assumption keeps measurability and regular-conditional-probability issues out of the exposition. Continuous-state generalizations require additional hypotheses.\n\nA realization has transition kernel\n\\begin{equation}\\label{eq:micro}\nK_u(x,x')=\\Prob(X_{t+1}=x'\\mid X_t=x,U_t=u),\n\\end{equation}\nand output kernel $Q_u(x,y)$. Both are row-stochastic. In this presentation, the current report and next state are sampled conditionally independently given $(x,u)$. A dependent report/transition mechanism can instead be specified by a joint kernel on $(x',y)$; the corresponding aggregation test must preserve that joint law, not just its two marginals. A deterministic implementation is the special case $K_u(x,\\cdot)=\\delta_{F_u(x)}$. The controls can encode tasks, supplied evidence, and permitted interventions. Scheduling and environment dynamics must be included in $X_t$ or in the stated control model rather than silently omitted.\n\nOne possible factorization of a microstate is\n\\[\nX_t=(S_{1,t},\\ldots,S_{n,t},M_t,C_t,A_t,\\Theta_t),\n","context":26,"kind":"use","source":1},{"line":237,"start":31581,"end":31584,"expression":"S_i","context":27,"kind":"use","source":1},{"line":237,"start":31611,"end":31612,"expression":"M","context":27,"kind":"use","source":1},{"line":237,"start":31632,"end":31633,"expression":"C","context":27,"kind":"use","source":1},{"line":237,"start":31664,"end":31665,"expression":"A","context":27,"kind":"use","source":1},{"line":237,"start":31683,"end":31689,"expression":"\\Theta","context":27,"kind":"use","source":1},{"line":240,"start":31977,"end":31998,"expression":"O_i:\\X\\to\\mathcal O_i","context":28,"kind":"definition-passage","definition_title":"Declared decomposition and access model","source":1},{"line":240,"start":32055,"end":32056,"expression":"S","context":28,"kind":"definition-passage","definition_title":"Declared decomposition and access model","source":1},{"line":240,"start":32089,"end":32095,"expression":"O_S(X)","context":28,"kind":"definition-passage","definition_title":"Declared decomposition and access model","source":1},{"line":246,"start":32672,"end":32683,"expression":"\\pi:\\X\\to\\Z","context":29,"kind":"definition-passage","definition_title":"Candidate macrostate","source":1},{"line":246,"start":32706,"end":32709,"expression":"\\mu","context":29,"kind":"definition-passage","definition_title":"Candidate macrostate","source":1},{"line":246,"start":32715,"end":32717,"expression":"\\X","context":29,"kind":"definition-passage","definition_title":"Candidate macrostate","source":1},{"line":247,"start":32741,"end":32781,"expression":"\n(\\push\\mu)(z)=\\sum_{x:\\pi(x)=z}\\mu(x).\n","context":29,"kind":"definition-passage","definition_title":"Candidate macrostate","source":1},{"line":250,"start":32795,"end":32806,"expression":"\\pi^{-1}(z)","context":29,"kind":"definition-passage","definition_title":"Candidate macrostate","source":1},{"line":250,"start":32854,"end":32855,"expression":"z","context":29,"kind":"definition-passage","definition_title":"Candidate macrostate","source":1},{"line":253,"start":33052,"end":33062,"expression":"\\mathcal T","context":30,"kind":"introduction-passage","source":1},{"line":257,"start":33393,"end":33556,"expression":"\n\\mathcal C_{\\mathcal T}=(\\varepsilon_{\\rm pred},\\varepsilon_{\\rm dyn},\\varepsilon_{\\rm int},\n\\Delta_{\\rm coal},R_{\\rm repair},D_{\\rm lineage},G_{\\rm formation}).\n","context":31,"kind":"use","source":1},{"line":266,"start":34278,"end":34281,"expression":"A,B","context":32,"kind":"use","source":1},{"line":266,"start":34313,"end":34324,"expression":"Y=A\\oplus B","context":32,"kind":"use","source":1},{"line":267,"start":34334,"end":34370,"expression":"\nI(Y;A)=I(Y;B)=0,\\qquad I(Y;A,B)=1.\n","context":32,"kind":"use","source":1},{"line":272,"start":34740,"end":34741,"expression":"O","context":33,"kind":"use","source":1},{"line":272,"start":34753,"end":34757,"expression":"\\ell","context":33,"kind":"use","source":1},{"line":273,"start":34784,"end":34838,"expression":"\n\\mathcal R_\\ell(O)=\\inf_f\\E\\bigl[\\ell(f(O),Y)\\bigr].\n","context":33,"kind":"use","source":1},{"line":276,"start":34872,"end":34882,"expression":"\\mathcal A","context":33,"kind":"use","source":1},{"line":277,"start":34930,"end":35035,"expression":"\\label{eq:coalition}\n\\Delta_{\\mathcal A}=\\min_{S\\in\\mathcal A}\\mathcal R_\\ell(O_S)\n-\\mathcal R_\\ell(O_V)\n","context":33,"kind":"use","source":1},{"line":298,"start":37500,"end":37511,"expression":"F_u:\\X\\to\\X","context":34,"kind":"use","source":1},{"line":298,"start":37531,"end":37542,"expression":"\\pi:\\X\\to\\Z","context":34,"kind":"use","source":1},{"line":298,"start":37551,"end":37572,"expression":"\\overline F_u:\\Z\\to\\Z","context":34,"kind":"use","source":1},{"line":298,"start":37586,"end":37610,"expression":"\\pi F_u=\\overline F_u\\pi","context":34,"kind":"use","source":1},{"line":299,"start":37635,"end":37701,"expression":"\n\\pi(x)=\\pi(x')\\quad\\Longrightarrow\\quad\n\\pi(F_u(x))=\\pi(F_u(x'))\n","context":34,"kind":"use","source":1},{"line":303,"start":37715,"end":37721,"expression":"u,x,x'","context":34,"kind":"use","source":1},{"line":306,"start":37821,"end":37834,"expression":"\\overline F_u","context":35,"kind":"use","source":1},{"line":306,"start":37857,"end":37863,"expression":"\\pi(x)","context":36,"kind":"use","source":1},{"line":306,"start":37888,"end":37916,"expression":"\\overline F_u(z)=\\pi(F_u(x))","context":37,"kind":"use","source":1},{"line":306,"start":37927,"end":37928,"expression":"x","context":38,"kind":"use","source":1},{"line":306,"start":37947,"end":37948,"expression":"z","context":39,"kind":"use","source":1},{"line":313,"start":38325,"end":38338,"expression":"\\overline K_u","context":40,"kind":"use","source":1},{"line":313,"start":38426,"end":38428,"expression":"z'","context":41,"kind":"use","source":1},{"line":313,"start":38439,"end":38443,"expression":"x,x'","context":42,"kind":"use","source":1},{"line":313,"start":38451,"end":38465,"expression":"\\pi(x)=\\pi(x')","context":43,"kind":"use","source":1},{"line":314,"start":38484,"end":38557,"expression":"\\label{eq:lump}\n\\sum_{w:\\pi(w)=z'}K_u(x,w)\n=\\sum_{w:\\pi(w)=z'}K_u(x',w).\n","context":44,"kind":"use","source":1},{"line":318,"start":38622,"end":38645,"expression":"\\alpha_t(u\\mid Z_{0:t})","context":45,"kind":"use","source":1},{"line":318,"start":38719,"end":38729,"expression":"\\push\\mu_0","context":46,"kind":"use","source":1},{"line":318,"start":38771,"end":38783,"expression":"Q_u(x,\\cdot)","context":47,"kind":"use","source":1},{"line":321,"start":38898,"end":38917,"expression":"\\overline K_u(z,z')","context":48,"kind":"use","source":1},{"line":321,"start":39209,"end":39210,"expression":"x","context":49,"kind":"use","source":1},{"line":321,"start":39217,"end":39219,"expression":"x'","context":50,"kind":"use","source":1},{"line":327,"start":39724,"end":39744,"expression":"X_{t+1}=X_t+1\\pmod 3","context":51,"kind":"use","source":1},{"line":327,"start":39786,"end":39801,"expression":"\\pi(0)=\\pi(1)=a","context":51,"kind":"use","source":1},{"line":327,"start":39808,"end":39816,"expression":"\\pi(2)=b","context":51,"kind":"use","source":1},{"line":327,"start":39839,"end":39869,"expression":"\\Prob(Z_{t+1}=b\\mid Z_t=a)=1/2","context":51,"kind":"use","source":1},{"line":328,"start":39878,"end":39919,"expression":"\n\\Prob(Z_{t+1}=b\\mid Z_t=a,Z_{t-1}=b)=0,\n","context":51,"kind":"use","source":1},{"line":331,"start":39967,"end":39982,"expression":"Z_t=a,Z_{t-1}=a","context":51,"kind":"use","source":1},{"line":331,"start":39988,"end":39989,"expression":"1","context":51,"kind":"use","source":1},{"line":334,"start":40320,"end":40323,"expression":"Z_t","context":52,"kind":"use","source":1},{"line":337,"start":40485,"end":40527,"expression":"\\TV(\\mu,\\nu)=\\tfrac12\\sum_z|\\mu(z)-\\nu(z)|","context":53,"kind":"use","source":1},{"line":338,"start":40580,"end":40684,"expression":"\\label{eq:eps}\n\\sup_{x,u}\\TV\\bigl(\\push K_u(x,\\cdot),\\overline K_u(\\pi(x),\\cdot)\\bigr)\n\\leq\\varepsilon.\n","context":53,"kind":"use","source":1},{"line":346,"start":41051,"end":41054,"expression":"e_0","context":54,"kind":"use","source":1},{"line":346,"start":41090,"end":41091,"expression":"t","context":55,"kind":"use","source":1},{"line":347,"start":41111,"end":41147,"expression":"\ne_t\\leq\\min\\{1,e_0+t\\varepsilon\\}.\n","context":56,"kind":"use","source":1},{"line":350,"start":41159,"end":41172,"expression":"\\overline K_u","context":57,"kind":"use","source":1},{"line":350,"start":41212,"end":41220,"expression":"\\kappa<1","context":58,"kind":"use","source":1},{"line":351,"start":41244,"end":41324,"expression":"\\label{eq:contract}\ne_t\\leq\\kappa^t e_0+\\varepsilon\\frac{1-\\kappa^t}{1-\\kappa}.\n","context":59,"kind":"use","source":1},{"line":354,"start":41403,"end":41429,"expression":"\\min\\{1,e_0+t\\varepsilon\\}","context":60,"kind":"use","source":1},{"line":357,"start":41655,"end":41666,"expression":"\\varepsilon","context":61,"kind":"use","source":1},{"line":357,"start":41709,"end":41722,"expression":"\\overline K_u","context":62,"kind":"use","source":1},{"line":357,"start":41756,"end":41782,"expression":"e_{t+1}\\leq\\varepsilon+e_t","context":63,"kind":"use","source":1},{"line":357,"start":41813,"end":41846,"expression":"e_{t+1}\\leq\\varepsilon+\\kappa e_t","context":64,"kind":"use","source":1},{"line":357,"start":42028,"end":42039,"expression":"\\varepsilon","context":65,"kind":"use","source":1},{"line":363,"start":42507,"end":42510,"expression":"Y^+","context":66,"kind":"use","source":1},{"line":364,"start":42575,"end":42602,"expression":"\nI(Y^+;\\Hist_t\\mid Z_t)=0.\n","context":66,"kind":"use","source":1},{"line":370,"start":43025,"end":43033,"expression":"Z=\\pi(X)","context":67,"kind":"use","source":1},{"line":370,"start":43065,"end":43066,"expression":"Z","context":67,"kind":"use","source":1},{"line":370,"start":43093,"end":43094,"expression":"X","context":67,"kind":"use","source":1},{"line":370,"start":43119,"end":43127,"expression":"do(Z=z')","context":67,"kind":"use","source":1},{"line":372,"start":43273,"end":43274,"expression":"x","context":68,"kind":"use","source":1},{"line":372,"start":43288,"end":43290,"expression":"z'","context":68,"kind":"use","source":1},{"line":372,"start":43298,"end":43311,"expression":"\\Lambda(x,z')","context":68,"kind":"use","source":1},{"line":372,"start":43381,"end":43383,"expression":"\\X","context":68,"kind":"use","source":1},{"line":372,"start":43405,"end":43417,"expression":"\\pi^{-1}(z')","context":68,"kind":"use","source":1},{"line":374,"start":43746,"end":43755,"expression":"P_\\lambda","context":69,"kind":"introduction-passage","source":1},{"line":374,"start":43783,"end":43786,"expression":"Y^+","context":69,"kind":"introduction-passage","source":1},{"line":374,"start":43801,"end":43808,"expression":"\\lambda","context":69,"kind":"introduction-passage","source":1},{"line":375,"start":43848,"end":43929,"expression":"\n\\eta(x,z')=\\sup_{\\lambda,\\lambda'\\in\\Lambda(x,z')}\n\\TV(P_\\lambda,P_{\\lambda'}).\n","context":69,"kind":"introduction-passage","source":1},{"line":383,"start":44224,"end":44233,"expression":"P_\\lambda","context":70,"kind":"use","source":1},{"line":383,"start":44246,"end":44257,"expression":"\\varepsilon","context":70,"kind":"use","source":1},{"line":383,"start":44297,"end":44309,"expression":"P^\\star_{z'}","context":70,"kind":"use","source":1},{"line":383,"start":44318,"end":44344,"expression":"\\eta(x,z')\\leq2\\varepsilon","context":70,"kind":"use","source":1},{"line":383,"start":44407,"end":44411,"expression":"\\eta","context":70,"kind":"use","source":1},{"line":383,"start":44473,"end":44479,"expression":"\\eta/2","context":70,"kind":"use","source":1},{"line":390,"start":44655,"end":44662,"expression":"X=(z,h)","context":71,"kind":"use","source":1},{"line":390,"start":44693,"end":44704,"expression":"Y=z\\oplus h","context":71,"kind":"use","source":1},{"line":390,"start":44736,"end":44737,"expression":"z","context":71,"kind":"use","source":1},{"line":390,"start":44754,"end":44760,"expression":"(z',0)","context":71,"kind":"use","source":1},{"line":390,"start":44780,"end":44786,"expression":"(z',1)","context":71,"kind":"use","source":1},{"line":390,"start":44804,"end":44808,"expression":"Z=z'","context":71,"kind":"use","source":1},{"line":390,"start":44867,"end":44868,"expression":"Z","context":71,"kind":"use","source":1},{"line":406,"start":46956,"end":46966,"expression":"\\mathcal T","context":72,"kind":"use","source":1},{"line":407,"start":47045,"end":47182,"expression":"\nx\\equiv_{\\mathcal T}x'\\quad\\Longleftrightarrow\\quad\n\\Law_x(Y^+\\mid\\tau)=\\Law_{x'}(Y^+\\mid\\tau)\n\\quad\\text{for every }\\tau\\in\\mathcal T.\n","context":72,"kind":"use","source":1},{"line":415,"start":47504,"end":47610,"expression":"\nd_{\\mathcal T}(x,x')=\\sup_{\\tau\\in\\mathcal T}\n\\TV\\bigl(\\Law_x(Y^+\\mid\\tau),\\Law_{x'}(Y^+\\mid\\tau)\\bigr).\n","context":73,"kind":"use","source":1},{"line":422,"start":47916,"end":47917,"expression":"0","context":74,"kind":"use","source":1},{"line":422,"start":47921,"end":47924,"expression":"0.4","context":74,"kind":"use","source":1},{"line":422,"start":47932,"end":47935,"expression":"0.8","context":74,"kind":"use","source":1},{"line":422,"start":47984,"end":47987,"expression":"0.4","context":74,"kind":"use","source":1},{"line":422,"start":47991,"end":47994,"expression":"0.4","context":74,"kind":"use","source":1},{"line":422,"start":48002,"end":48005,"expression":"0.8","context":74,"kind":"use","source":1},{"line":422,"start":48024,"end":48027,"expression":"0.5","context":74,"kind":"use","source":1},{"line":434,"start":49815,"end":49818,"expression":"1/2","context":75,"kind":"use","source":1},{"line":453,"start":52295,"end":52296,"expression":"N","context":76,"kind":"use","source":1},{"line":457,"start":52575,"end":52576,"expression":"N","context":77,"kind":"use","source":1},{"line":457,"start":52611,"end":52630,"expression":"\\lceil\\log_2N\\rceil","context":78,"kind":"use","source":1},{"line":466,"start":53757,"end":53758,"expression":"z","context":79,"kind":"use","source":1},{"line":466,"start":53830,"end":53857,"expression":"E(z)=(E_1(z),\\ldots,E_n(z))","context":79,"kind":"use","source":1},{"line":467,"start":53888,"end":53938,"expression":"\nd_E=\\min_{z\\ne z'}\\abs{\\{i:E_i(z)\\ne E_i(z')\\}}.\n","context":79,"kind":"use","source":1},{"line":473,"start":54061,"end":54074,"expression":"0\\leq k\\leq n","context":80,"kind":"use","source":1},{"line":473,"start":54099,"end":54100,"expression":"k","context":80,"kind":"use","source":1},{"line":473,"start":54179,"end":54184,"expression":"d_E>k","context":80,"kind":"use","source":1},{"line":476,"start":54223,"end":54228,"expression":"d_E>k","context":80,"kind":"use","source":1},{"line":476,"start":54303,"end":54304,"expression":"k","context":80,"kind":"use","source":1},{"line":476,"start":54370,"end":54379,"expression":"d_E\\leq k","context":81,"kind":"use","source":1},{"line":479,"start":54534,"end":54551,"expression":"z=(p,q)\\in\\Ftwo^2","context":82,"kind":"use","source":1},{"line":479,"start":54568,"end":54583,"expression":"(p,q,p\\oplus q)","context":82,"kind":"use","source":1},{"line":484,"start":55085,"end":55093,"expression":"e_t\\geq0","context":83,"kind":"use","source":1},{"line":485,"start":55238,"end":55264,"expression":"\ne_{t+1}\\leq a_t e_t+b_t,\n","context":83,"kind":"use","source":1},{"line":488,"start":55274,"end":55277,"expression":"a_t","context":83,"kind":"use","source":1},{"line":488,"start":55312,"end":55315,"expression":"b_t","context":83,"kind":"use","source":1},{"line":492,"start":55446,"end":55467,"expression":"0\\leq a_t\\leq\\bar a<1","context":84,"kind":"use","source":1},{"line":492,"start":55474,"end":55493,"expression":"0\\leq b_t\\leq\\bar b","context":84,"kind":"use","source":1},{"line":493,"start":55503,"end":55560,"expression":"\ne_t\\leq \\bar a^t e_0+\\bar b\\frac{1-\\bar a^t}{1-\\bar a}.\n","context":84,"kind":"use","source":1},{"line":496,"start":55596,"end":55603,"expression":"a_t,b_t","context":84,"kind":"use","source":1},{"line":497,"start":55641,"end":55718,"expression":"\ne_T\\leq e_0\\prod_{t=0}^{T-1}a_t+\n\\sum_{j=0}^{T-1}b_j\\prod_{t=j+1}^{T-1}a_t.\n","context":84,"kind":"use","source":1},{"line":509,"start":56268,"end":56269,"expression":"W","context":85,"kind":"use","source":1},{"line":509,"start":56302,"end":56303,"expression":"W","context":85,"kind":"use","source":1},{"line":509,"start":56318,"end":56324,"expression":"F(x)=0","context":85,"kind":"use","source":1},{"line":516,"start":57257,"end":57378,"expression":"\n\\mathsf{Int}=(\\Z,\\U,\\overline K,\\overline Q,\\Lambda,\n\\varepsilon_{\\rm dyn},\\varepsilon_{\\rm int},\\mathsf{permissions}).\n","context":86,"kind":"use","source":1},{"line":523,"start":57605,"end":57616,"expression":"\\pi:\\X\\to\\Z","context":87,"kind":"use","source":1},{"line":523,"start":57623,"end":57643,"expression":"\\psi:\\Z\\to\\mathcal W","context":87,"kind":"use","source":1},{"line":524,"start":57697,"end":57767,"expression":"\n\\TV(\\push K_u(x,\\cdot),\\overline K_u(\\pi x,\\cdot))\\leq\\varepsilon_1,\n","context":87,"kind":"use","source":1},{"line":527,"start":57772,"end":57855,"expression":"\n\\TV(\\psi_{\\#}\\overline K_u(z,\\cdot),\\widehat K_u(\\psi z,\\cdot))\\leq\\varepsilon_2.\n","context":87,"kind":"use","source":1},{"line":533,"start":57989,"end":57996,"expression":"\\psi\\pi","context":88,"kind":"use","source":1},{"line":534,"start":58010,"end":58117,"expression":"\n\\TV\\bigl((\\psi\\pi)_{\\#}K_u(x,\\cdot),\n\\widehat K_u(\\psi\\pi x,\\cdot)\\bigr)\n\\leq\\varepsilon_1+\\varepsilon_2.\n","context":88,"kind":"use","source":1},{"line":539,"start":58125,"end":58126,"expression":"L","context":88,"kind":"use","source":1},{"line":539,"start":58168,"end":58193,"expression":"\\sum_{j=1}^L\\varepsilon_j","context":88,"kind":"use","source":1},{"line":542,"start":58287,"end":58322,"expression":"\\psi_{\\#}\\overline K_u(\\pi x,\\cdot)","context":89,"kind":"use","source":1},{"line":545,"start":58633,"end":58657,"expression":"e_0+t\\sum_j\\varepsilon_j","context":90,"kind":"use","source":1},{"line":548,"start":59005,"end":59006,"expression":"i","context":91,"kind":"use","source":1},{"line":548,"start":59031,"end":59034,"expression":"W_i","context":91,"kind":"use","source":1},{"line":548,"start":59075,"end":59083,"expression":"r_{ij}^i","context":91,"kind":"use","source":1},{"line":548,"start":59090,"end":59098,"expression":"r_{ij}^j","context":91,"kind":"use","source":1},{"line":549,"start":59132,"end":59218,"expression":"\nW_{\\rm glue}=\\{(w_i):r_{ij}^i(w_i)=r_{ij}^j(w_j)\\text{ on every declared overlap}\\}.\n","context":91,"kind":"use","source":1},{"line":570,"start":61421,"end":61426,"expression":"n=2^h","context":92,"kind":"use","source":1},{"line":570,"start":61532,"end":61535,"expression":"n-1","context":92,"kind":"use","source":1},{"line":570,"start":61554,"end":61555,"expression":"h","context":92,"kind":"use","source":1},{"line":570,"start":61598,"end":61599,"expression":"d","context":92,"kind":"use","source":1},{"line":570,"start":61624,"end":61627,"expression":"2^d","context":92,"kind":"use","source":1},{"line":570,"start":61660,"end":61679,"expression":"\\lceil\\log_2n\\rceil","context":92,"kind":"use","source":1},{"line":570,"start":61733,"end":61736,"expression":"n-1","context":92,"kind":"use","source":1},{"line":583,"start":63450,"end":63451,"expression":"F","context":93,"kind":"use","source":1},{"line":586,"start":63690,"end":63694,"expression":"gX=X","context":93,"kind":"use","source":1},{"line":586,"start":63725,"end":63726,"expression":"g","context":94,"kind":"use","source":1},{"line":586,"start":63749,"end":63765,"expression":"gF(X)=F(gX)=F(X)","context":95,"kind":"use","source":1},{"line":615,"start":68531,"end":68532,"expression":"D","context":96,"kind":"definition-passage","definition_title":"Endogenous institutional formation","source":1},{"line":615,"start":68612,"end":68615,"expression":"I_t","context":96,"kind":"definition-passage","definition_title":"Endogenous institutional formation","source":1},{"line":615,"start":68835,"end":68838,"expression":"I_t","context":96,"kind":"definition-passage","definition_title":"Endogenous institutional formation","source":1},{"line":615,"start":68865,"end":68866,"expression":"D","context":97,"kind":"definition-passage","definition_title":"Endogenous institutional formation","source":1},{"line":640,"start":72658,"end":72661,"expression":"I_t","context":98,"kind":"use","source":1},{"line":641,"start":72722,"end":72780,"expression":"\\label{eq:institutional-state}\nI_t=(N_t,P_t,E_t,A_t,L_t),\n","context":98,"kind":"use","source":1},{"line":644,"start":72802,"end":72803,"expression":"N","context":98,"kind":"use","source":1},{"line":644,"start":72844,"end":72845,"expression":"P","context":98,"kind":"use","source":1},{"line":644,"start":72878,"end":72879,"expression":"E","context":98,"kind":"use","source":1},{"line":644,"start":72919,"end":72920,"expression":"A","context":98,"kind":"use","source":1},{"line":644,"start":72950,"end":72951,"expression":"L","context":99,"kind":"use","source":1},{"line":647,"start":73288,"end":73289,"expression":"x","context":100,"kind":"definition-passage","definition_title":"Institutional realization","source":1},{"line":647,"start":73316,"end":73317,"expression":"I","context":100,"kind":"definition-passage","definition_title":"Institutional realization","source":1},{"line":647,"start":73344,"end":73361,"expression":"\\mathcal A_i(x,I)","context":100,"kind":"definition-passage","definition_title":"Institutional realization","source":1},{"line":647,"start":73410,"end":73413,"expression":"K_I","context":100,"kind":"definition-passage","definition_title":"Institutional realization","source":1},{"line":647,"start":73483,"end":73484,"expression":"I","context":100,"kind":"definition-passage","definition_title":"Institutional realization","source":1},{"line":652,"start":73994,"end":74004,"expression":"\\mathcal E","context":101,"kind":"use","source":1},{"line":652,"start":74050,"end":74051,"expression":"T","context":102,"kind":"use","source":1},{"line":652,"start":74082,"end":74104,"expression":"\\lambda(I),\\lambda(I')","context":103,"kind":"use","source":1},{"line":653,"start":74243,"end":74409,"expression":"\\label{eq:inst-effect}\n\\Delta_{\\mathrm{inst}}^{\\mathcal E,T}(I,I')\n=\\sup_{e\\in\\mathcal E}\\TV\\bigl(\\Law_e(Y_{0:T}\\mid\\lambda(I)),\\Law_e(Y_{0:T}\\mid\\lambda(I'))\\bigr).\n","context":104,"kind":"use","source":1},{"line":669,"start":76354,"end":76355,"expression":"N","context":105,"kind":"use","source":1},{"line":669,"start":76386,"end":76389,"expression":"K_I","context":106,"kind":"use","source":1},{"line":673,"start":76579,"end":76597,"expression":"N_i(h,a)\\in\\{0,1\\}","context":107,"kind":"use","source":1},{"line":673,"start":76660,"end":76661,"expression":"a","context":107,"kind":"use","source":1},{"line":673,"start":76676,"end":76677,"expression":"i","context":107,"kind":"use","source":1},{"line":673,"start":76694,"end":76695,"expression":"h","context":107,"kind":"use","source":1},{"line":675,"start":76969,"end":76970,"expression":"G","context":108,"kind":"use","source":1},{"line":675,"start":76997,"end":76998,"expression":"1","context":108,"kind":"use","source":1},{"line":675,"start":77013,"end":77014,"expression":"R","context":108,"kind":"use","source":1},{"line":675,"start":77027,"end":77028,"expression":"0","context":108,"kind":"use","source":1},{"line":675,"start":77046,"end":77054,"expression":"G\\circ R","context":108,"kind":"use","source":1},{"line":675,"start":77064,"end":77065,"expression":"1","context":108,"kind":"use","source":1},{"line":675,"start":77072,"end":77080,"expression":"R\\circ G","context":108,"kind":"use","source":1},{"line":675,"start":77090,"end":77091,"expression":"0","context":108,"kind":"use","source":1},{"line":679,"start":77489,"end":77490,"expression":"N","context":109,"kind":"use","source":1},{"line":685,"start":78551,"end":78561,"expression":"\\mathcal U","context":110,"kind":"introduction-passage","source":1},{"line":685,"start":78647,"end":78669,"expression":"M_t\\subseteq\\mathcal U","context":111,"kind":"introduction-passage","source":1},{"line":685,"start":78694,"end":78710,"expression":"V_t\\subseteq M_t","context":112,"kind":"introduction-passage","source":1},{"line":685,"start":78739,"end":78749,"expression":"\\mathcal D","context":113,"kind":"introduction-passage","source":1},{"line":685,"start":78808,"end":78828,"expression":"c_t:V_t\\to\\mathcal D","context":114,"kind":"introduction-passage","source":1},{"line":686,"start":79063,"end":79095,"expression":"\nB_t=(M_t,V_t,c_t,w_t,q_t,e_t),\n","context":115,"kind":"use","source":1},{"line":689,"start":79105,"end":79108,"expression":"w_t","context":116,"kind":"use","source":1},{"line":689,"start":79147,"end":79150,"expression":"q_t","context":117,"kind":"use","source":1},{"line":689,"start":79183,"end":79186,"expression":"e_t","context":118,"kind":"use","source":1},{"line":690,"start":79255,"end":79359,"expression":"\nM_{t+1}=(M_t\\setminus E_t)\\cup A_t,\n\\qquad E_t\\subseteq M_t,\\quad A_t\\subseteq\\mathcal U\\setminus M_t,\n","context":119,"kind":"use","source":1},{"line":702,"start":80909,"end":80910,"expression":"q","context":120,"kind":"use","source":1},{"line":702,"start":80940,"end":80941,"expression":"v","context":120,"kind":"use","source":1},{"line":702,"start":80954,"end":80958,"expression":"w(v)","context":120,"kind":"use","source":1},{"line":702,"start":80974,"end":80988,"expression":"v_1,\\ldots,v_k","context":120,"kind":"use","source":1},{"line":702,"start":81067,"end":81085,"expression":"\\sum_j w(v_j)=w(v)","context":120,"kind":"use","source":1},{"line":705,"start":81356,"end":81357,"expression":"v","context":121,"kind":"use","source":1},{"line":705,"start":81499,"end":81503,"expression":"w(v)","context":122,"kind":"use","source":1},{"line":705,"start":81523,"end":81535,"expression":"\\sum_jw(v_j)","context":123,"kind":"use","source":1},{"line":705,"start":81559,"end":81560,"expression":"q","context":124,"kind":"use","source":1},{"line":708,"start":81879,"end":81882,"expression":"c_t","context":125,"kind":"use","source":1},{"line":711,"start":82105,"end":82114,"expression":"\\{a,b,c\\}","context":126,"kind":"use","source":1},{"line":711,"start":82134,"end":82143,"expression":"\\{c,d,e\\}","context":126,"kind":"use","source":1},{"line":711,"start":82222,"end":82229,"expression":"\\{a,b\\}","context":126,"kind":"use","source":1},{"line":711,"start":82249,"end":82256,"expression":"\\{d,e\\}","context":126,"kind":"use","source":1},{"line":727,"start":84693,"end":84726,"expression":"\ns=(x,I,\\mathcal P,r,\\lambda,c),\n","context":127,"kind":"use","source":1},{"line":730,"start":84736,"end":84737,"expression":"x","context":127,"kind":"use","source":1},{"line":730,"start":84762,"end":84763,"expression":"I","context":127,"kind":"use","source":1},{"line":730,"start":84789,"end":84799,"expression":"\\mathcal P","context":127,"kind":"use","source":1},{"line":730,"start":84846,"end":84847,"expression":"r","context":128,"kind":"use","source":1},{"line":730,"start":84861,"end":84868,"expression":"\\lambda","context":129,"kind":"use","source":1},{"line":730,"start":84917,"end":84918,"expression":"c","context":130,"kind":"use","source":1},{"line":732,"start":85096,"end":85119,"expression":"D(s)\\subseteq\\mathcal A","context":131,"kind":"use","source":1},{"line":732,"start":85261,"end":85267,"expression":"F(s,a)","context":131,"kind":"use","source":1},{"line":732,"start":85291,"end":85300,"expression":"a\\in D(s)","context":131,"kind":"use","source":1},{"line":732,"start":85328,"end":85329,"expression":"I","context":131,"kind":"use","source":1},{"line":732,"start":85333,"end":85334,"expression":"c","context":131,"kind":"use","source":1},{"line":732,"start":85341,"end":85348,"expression":"\\lambda","context":131,"kind":"use","source":1},{"line":732,"start":85370,"end":85379,"expression":"D(F(s,a))","context":131,"kind":"use","source":1},{"line":735,"start":85961,"end":85976,"expression":"\\ell:S\\to\\Gamma","context":132,"kind":"use","source":1},{"line":735,"start":86191,"end":86201,"expression":"\\mathcal A","context":133,"kind":"use","source":1},{"line":738,"start":86313,"end":86314,"expression":"S","context":134,"kind":"use","source":1},{"line":738,"start":86344,"end":86354,"expression":"\\mathcal A","context":135,"kind":"use","source":1},{"line":738,"start":86373,"end":86383,"expression":"\\pi:S\\to Z","context":136,"kind":"use","source":1},{"line":738,"start":86423,"end":86431,"expression":"\\bar\\ell","context":137,"kind":"use","source":1},{"line":738,"start":86435,"end":86441,"expression":"\\bar D","context":138,"kind":"use","source":1},{"line":738,"start":86469,"end":86475,"expression":"\\bar F","context":139,"kind":"use","source":1},{"line":739,"start":86490,"end":86577,"expression":"\n\\ell=\\bar\\ell\\pi,\\qquad D=\\bar D\\pi,\\qquad\n\\pi F(s,a)=\\bar F(\\pi s,a)\\quad(a\\in D(s))\n","context":140,"kind":"use","source":1},{"line":743,"start":86605,"end":86616,"expression":"\\pi s=\\pi t","context":141,"kind":"use","source":1},{"line":744,"start":86621,"end":86714,"expression":"\n\\ell(s)=\\ell(t),\\qquad D(s)=D(t),\\qquad\n\\pi F(s,a)=\\pi F(t,a)\\quad\\text{for all }a\\in D(s).\n","context":142,"kind":"use","source":1},{"line":751,"start":87022,"end":87025,"expression":"\\pi","context":143,"kind":"use","source":1},{"line":754,"start":87884,"end":87885,"expression":"s","context":144,"kind":"use","source":1},{"line":754,"start":87892,"end":87897,"expression":"\\pi s","context":144,"kind":"use","source":1},{"line":757,"start":88322,"end":88323,"expression":"a","context":145,"kind":"use","source":1},{"line":761,"start":88787,"end":88799,"expression":"\\mathcal B_0","context":146,"kind":"use","source":1},{"line":761,"start":88845,"end":88859,"expression":"(\\ell(s),D(s))","context":146,"kind":"use","source":1},{"line":761,"start":88892,"end":88895,"expression":"s,t","context":146,"kind":"use","source":1},{"line":762,"start":89027,"end":89147,"expression":"\ns\\equiv_{k+1}t\\quad\\Longleftrightarrow\\quad\ns\\equiv_kt\\ \\text{ and }\\ F(s,a)\\equiv_kF(t,a)\n\\ \\text{for all }a\\in D(s).\n","context":147,"kind":"use","source":1},{"line":769,"start":89270,"end":89288,"expression":"|S|-|\\mathcal B_0|","context":148,"kind":"use","source":1},{"line":772,"start":89678,"end":89681,"expression":"|S|","context":149,"kind":"use","source":1},{"line":772,"start":89877,"end":89889,"expression":"\\mathcal B_0","context":150,"kind":"use","source":1},{"line":772,"start":89907,"end":89919,"expression":"\\mathcal B_k","context":151,"kind":"use","source":1},{"line":772,"start":89971,"end":89987,"expression":"\\mathcal B_{k+1}","context":152,"kind":"use","source":1},{"line":781,"start":91349,"end":91432,"expression":"\nm=(\\mathsf{kind},\\mathsf{issuer},\\mathsf{epoch},\\mathsf{payload},\\mathsf{nonce}).\n","context":153,"kind":"introduction-passage","source":1},{"line":784,"start":91518,"end":91519,"expression":"s","context":153,"kind":"introduction-passage","source":1},{"line":784,"start":91567,"end":91573,"expression":"F_m(s)","context":153,"kind":"introduction-passage","source":1},{"line":784,"start":91596,"end":91605,"expression":"\\ell(s,m)","context":153,"kind":"introduction-passage","source":1},{"line":784,"start":91842,"end":91843,"expression":"s","context":154,"kind":"introduction-passage","source":1},{"line":787,"start":92057,"end":92058,"expression":"A","context":155,"kind":"use","source":1},{"line":787,"start":92065,"end":92066,"expression":"B","context":155,"kind":"use","source":1},{"line":787,"start":92087,"end":92094,"expression":"S_A,S_B","context":155,"kind":"use","source":1},{"line":787,"start":92111,"end":92136,"expression":"\\mathcal M_A,\\mathcal M_B","context":155,"kind":"use","source":1},{"line":787,"start":92161,"end":92168,"expression":"F^A,F^B","context":155,"kind":"use","source":1},{"line":787,"start":92217,"end":92227,"expression":"\\mathcal E","context":155,"kind":"use","source":1},{"line":787,"start":92253,"end":92265,"expression":"T:S_A\\to S_B","context":155,"kind":"use","source":1},{"line":788,"start":92315,"end":92359,"expression":"\n\\tau:S_A\\times\\mathcal M_A\\to\\mathcal M_B.\n","context":155,"kind":"use","source":1},{"line":794,"start":92702,"end":92710,"expression":"(T,\\tau)","context":156,"kind":"definition-passage","definition_title":"Operatively faithful language transport","source":1},{"line":794,"start":92791,"end":92792,"expression":"s","context":156,"kind":"definition-passage","definition_title":"Operatively faithful language transport","source":1},{"line":794,"start":92807,"end":92808,"expression":"m","context":156,"kind":"definition-passage","definition_title":"Operatively faithful language transport","source":1},{"line":795,"start":92856,"end":93032,"expression":"\nF^A_m(s)\\text{ is defined}&\\quad\\Longleftrightarrow\\quad\nF^B_{\\tau(s,m)}(T(s))\\text{ is defined},\\\\\nT(F^A_m(s))&=F^B_{\\tau(s,m)}(T(s)),\\\\\n\\ell_A(s,m)&=\\ell_B(T(s),\\tau(s,m)),\n","context":157,"kind":"definition-passage","definition_title":"Operatively faithful language transport","source":1},{"line":805,"start":93556,"end":93557,"expression":"T","context":158,"kind":"use","source":1},{"line":806,"start":93650,"end":93703,"expression":"\n\\tau_{AC}(s,m)=\\tau_{BC}(T_{AB}(s),\\tau_{AB}(s,m)).\n","context":159,"kind":"use","source":1},{"line":814,"start":94374,"end":94378,"expression":"\\tau","context":160,"kind":"use","source":1},{"line":814,"start":94397,"end":94398,"expression":"T","context":160,"kind":"use","source":1},{"line":836,"start":97676,"end":97679,"expression":"c_0","context":161,"kind":"use","source":1},{"line":836,"start":97736,"end":97739,"expression":"c_1","context":161,"kind":"use","source":1},{"line":836,"start":97766,"end":97767,"expression":"m","context":161,"kind":"use","source":1},{"line":836,"start":97797,"end":97798,"expression":"B","context":161,"kind":"use","source":1},{"line":836,"start":97823,"end":97835,"expression":"0\\le\\delta<1","context":161,"kind":"use","source":1},{"line":836,"start":97845,"end":97856,"expression":"g=c_0-c_1-m","context":161,"kind":"use","source":1},{"line":840,"start":98073,"end":98115,"expression":"\\label{eq:amort}\nV=-B+\\frac{g}{1-\\delta}.\n","context":162,"kind":"use","source":1},{"line":843,"start":98152,"end":98153,"expression":"T","context":162,"kind":"use","source":1},{"line":843,"start":98163,"end":98194,"expression":"V_T=-B+g(1-\\delta^T)/(1-\\delta)","context":162,"kind":"use","source":1},{"line":846,"start":98498,"end":98499,"expression":"B","context":163,"kind":"use","source":1},{"line":859,"start":99502,"end":99506,"expression":"B=10","context":164,"kind":"use","source":1},{"line":859,"start":99534,"end":99535,"expression":"1","context":165,"kind":"use","source":1},{"line":859,"start":99567,"end":99572,"expression":"g_1=0","context":166,"kind":"use","source":1},{"line":859,"start":99576,"end":99581,"expression":"g_2=2","context":167,"kind":"use","source":1},{"line":859,"start":99589,"end":99598,"expression":"\\delta=.9","context":168,"kind":"use","source":1},{"line":859,"start":99629,"end":99646,"expression":"-10+2/(1-.9)=10>0","context":169,"kind":"use","source":1},{"line":859,"start":99664,"end":99665,"expression":"1","context":170,"kind":"use","source":1},{"line":859,"start":99691,"end":99694,"expression":"-10","context":171,"kind":"use","source":1},{"line":859,"start":99707,"end":99708,"expression":"1","context":172,"kind":"use","source":1},{"line":864,"start":100302,"end":100305,"expression":"b_i","context":173,"kind":"use","source":1},{"line":864,"start":100316,"end":100330,"expression":"\\sum_i b_i\\ge0","context":173,"kind":"use","source":1},{"line":864,"start":100377,"end":100380,"expression":"t_i","context":173,"kind":"use","source":1},{"line":864,"start":100388,"end":100400,"expression":"\\sum_i t_i=0","context":173,"kind":"use","source":1},{"line":864,"start":100407,"end":100418,"expression":"b_i+t_i\\ge0","context":173,"kind":"use","source":1},{"line":864,"start":100429,"end":100430,"expression":"i","context":173,"kind":"use","source":1},{"line":864,"start":100453,"end":100456,"expression":"w_i","context":173,"kind":"use","source":1},{"line":864,"start":100470,"end":100480,"expression":"\\sum_i b_i","context":173,"kind":"use","source":1},{"line":864,"start":100491,"end":100502,"expression":"t_i=w_i-b_i","context":173,"kind":"use","source":1},{"line":868,"start":100852,"end":100862,"expression":"\\mathcal I","context":174,"kind":"use","source":1},{"line":868,"start":100949,"end":100967,"expression":"r_i\\in\\mathcal R_i","context":174,"kind":"use","source":1},{"line":868,"start":100998,"end":101016,"expression":"r=(r_1,\\ldots,r_n)","context":174,"kind":"use","source":1},{"line":868,"start":101042,"end":101048,"expression":"u_i(r)","context":174,"kind":"use","source":1},{"line":868,"start":101116,"end":101123,"expression":"\\Phi(r)","context":174,"kind":"use","source":1},{"line":868,"start":101167,"end":101168,"expression":"i","context":174,"kind":"use","source":1},{"line":869,"start":101173,"end":101244,"expression":"\nu_i(r_i',r_{-i})-u_i(r_i,r_{-i})\n=\\Phi(r_i',r_{-i})-\\Phi(r_i,r_{-i}).\n","context":174,"kind":"use","source":1},{"line":879,"start":101872,"end":101876,"expression":"\\Phi","context":175,"kind":"use","source":1},{"line":879,"start":102216,"end":102220,"expression":"\\Phi","context":176,"kind":"use","source":1},{"line":879,"start":102241,"end":102251,"expression":"\\sum_i u_i","context":177,"kind":"use","source":1},{"line":886,"start":102763,"end":102769,"expression":"n\\geq2","context":178,"kind":"use","source":1},{"line":886,"start":102788,"end":102801,"expression":"a_i\\in\\{0,1\\}","context":178,"kind":"use","source":1},{"line":886,"start":102826,"end":102829,"expression":"c>0","context":178,"kind":"use","source":1},{"line":886,"start":102853,"end":102856,"expression":"b>0","context":178,"kind":"use","source":1},{"line":887,"start":102885,"end":102930,"expression":"\nu_i(a)=a_i\\left(b\\sum_{j\\ne i}a_j-c\\right).\n","context":178,"kind":"use","source":1},{"line":893,"start":103182,"end":103190,"expression":"b(n-1)>c","context":179,"kind":"use","source":1},{"line":896,"start":103492,"end":103496,"expression":"-c<0","context":180,"kind":"use","source":1},{"line":896,"start":103600,"end":103610,"expression":"b(n-1)-c>0","context":181,"kind":"use","source":1},{"line":902,"start":104220,"end":104221,"expression":"m","context":182,"kind":"use","source":1},{"line":902,"start":104275,"end":104283,"expression":"b(m-1)>c","context":183,"kind":"use","source":1},{"line":903,"start":104339,"end":104389,"expression":"\nm_* = \\left\\lfloor\\frac cb\\right\\rfloor+2\\leq n.\n","context":184,"kind":"use","source":1},{"line":906,"start":104407,"end":104410,"expression":"m_*","context":184,"kind":"use","source":1},{"line":909,"start":104694,"end":104697,"expression":"m-1","context":185,"kind":"use","source":1},{"line":909,"start":104728,"end":104736,"expression":"b(m-1)-c","context":186,"kind":"use","source":1},{"line":909,"start":104784,"end":104787,"expression":"m_*","context":187,"kind":"use","source":1},{"line":909,"start":104829,"end":104835,"expression":"bm-c>0","context":188,"kind":"use","source":1},{"line":914,"start":105434,"end":105437,"expression":"n=4","context":189,"kind":"use","source":1},{"line":914,"start":105441,"end":105444,"expression":"b=1","context":189,"kind":"use","source":1},{"line":914,"start":105452,"end":105455,"expression":"c=2","context":189,"kind":"use","source":1},{"line":914,"start":105497,"end":105498,"expression":"1","context":189,"kind":"use","source":1},{"line":914,"start":105622,"end":105623,"expression":">","context":189,"kind":"use","source":1},{"line":914,"start":105631,"end":105635,"expression":"\\geq","context":189,"kind":"use","source":1},{"line":919,"start":105922,"end":105925,"expression":"b=1","context":190,"kind":"use","source":1},{"line":919,"start":105932,"end":105935,"expression":"c=2","context":190,"kind":"use","source":1},{"line":919,"start":105953,"end":105954,"expression":"k","context":190,"kind":"use","source":1},{"line":919,"start":105978,"end":105981,"expression":"k-2","context":190,"kind":"use","source":1},{"line":919,"start":106012,"end":106013,"expression":"k","context":190,"kind":"use","source":1},{"line":919,"start":106034,"end":106037,"expression":"k-3","context":190,"kind":"use","source":1},{"line":919,"start":106112,"end":106118,"expression":"k\\geq1","context":190,"kind":"use","source":1},{"line":919,"start":106146,"end":106152,"expression":"k\\leq3","context":190,"kind":"use","source":1},{"line":923,"start":106304,"end":106314,"expression":"0<c<b(n-1)","context":191,"kind":"use","source":1},{"line":923,"start":106596,"end":106602,"expression":"b(n-1)","context":191,"kind":"use","source":1},{"line":937,"start":108704,"end":108705,"expression":"C","context":192,"kind":"use","source":1},{"line":937,"start":108742,"end":108743,"expression":"D","context":192,"kind":"use","source":1},{"line":937,"start":108765,"end":108766,"expression":"D","context":192,"kind":"use","source":1},{"line":937,"start":108797,"end":108800,"expression":"g>0","context":192,"kind":"use","source":1},{"line":937,"start":108808,"end":108809,"expression":"C","context":192,"kind":"use","source":1},{"line":937,"start":108828,"end":108829,"expression":"o","context":192,"kind":"use","source":1},{"line":937,"start":108848,"end":108858,"expression":"\\mathcal O","context":192,"kind":"use","source":1},{"line":937,"start":108869,"end":108872,"expression":"P_C","context":192,"kind":"use","source":1},{"line":937,"start":108878,"end":108881,"expression":"P_D","context":192,"kind":"use","source":1},{"line":937,"start":108935,"end":108947,"expression":"s(o)\\in[0,1]","context":192,"kind":"use","source":1},{"line":937,"start":108969,"end":108972,"expression":"F>0","context":192,"kind":"use","source":1},{"line":937,"start":109161,"end":109162,"expression":"g","context":193,"kind":"use","source":1},{"line":940,"start":109318,"end":109380,"expression":"\\label{eq:deterrence-gap}\ng-F\\bigl(\\E_{P_D}s-\\E_{P_C}s\\bigr).\n","context":194,"kind":"use","source":1},{"line":947,"start":109747,"end":109771,"expression":"\ng\\leq F\\,\\TV(P_D,P_C).\n","context":195,"kind":"introduction-passage","source":1},{"line":953,"start":109886,"end":109904,"expression":"d(o)=P_D(o)-P_C(o)","context":195,"kind":"introduction-passage","source":1},{"line":953,"start":109914,"end":109927,"expression":"\\sum_o d(o)=0","context":195,"kind":"introduction-passage","source":1},{"line":953,"start":109968,"end":110000,"expression":"\\frac12\\sum_o|d(o)|=\\TV(P_D,P_C)","context":196,"kind":"introduction-passage","source":1},{"line":953,"start":110014,"end":110026,"expression":"0\\leq s\\leq1","context":197,"kind":"introduction-passage","source":1},{"line":954,"start":110031,"end":110070,"expression":"\n\\sum_o s(o)d(o)\\leq\\sum_{d(o)>0}d(o).\n","context":198,"kind":"introduction-passage","source":1},{"line":957,"start":110098,"end":110104,"expression":"s(o)=1","context":199,"kind":"introduction-passage","source":1},{"line":963,"start":110754,"end":110791,"expression":"\nP_C=(3/4,1/4),\\qquad P_D=(1/4,3/4).\n","context":200,"kind":"use","source":1},{"line":966,"start":110818,"end":110821,"expression":"1/2","context":200,"kind":"use","source":1},{"line":966,"start":110871,"end":110880,"expression":"g\\leq F/2","context":200,"kind":"use","source":1},{"line":966,"start":110931,"end":110934,"expression":"1/4","context":200,"kind":"use","source":1},{"line":969,"start":111141,"end":111160,"expression":"\\E_{P_C}s\\leq\\alpha","context":201,"kind":"use","source":1},{"line":969,"start":111169,"end":111185,"expression":"0\\leq\\alpha\\leq1","context":201,"kind":"use","source":1},{"line":970,"start":111275,"end":111415,"expression":"\\label{eq:protected-discrimination}\nD_\\alpha(P_D,P_C)=\n\\max_{\\substack{0\\leq s\\leq1\\\\\\E_{P_C}s\\leq\\alpha}}\n\\bigl(\\E_{P_D}s-\\E_{P_C}s\\bigr).\n","context":202,"kind":"use","source":1},{"line":975,"start":111596,"end":111612,"expression":"g\\leq F D_\\alpha","context":203,"kind":"use","source":1},{"line":975,"start":111642,"end":111653,"expression":"\\alpha=1/10","context":203,"kind":"use","source":1},{"line":975,"start":111672,"end":111681,"expression":"s=(0,2/5)","context":203,"kind":"use","source":1},{"line":975,"start":111692,"end":111704,"expression":"D_\\alpha=1/5","context":203,"kind":"use","source":1},{"line":975,"start":111712,"end":111715,"expression":"1/2","context":203,"kind":"use","source":1},{"line":977,"start":111818,"end":111832,"expression":"D_1,\\ldots,D_k","context":204,"kind":"use","source":1},{"line":977,"start":111974,"end":111987,"expression":"P_C=(1/2,1/2)","context":204,"kind":"use","source":1},{"line":977,"start":111991,"end":112004,"expression":"P_{D_1}=(1,0)","context":204,"kind":"use","source":1},{"line":977,"start":112012,"end":112025,"expression":"P_{D_2}=(0,1)","context":204,"kind":"use","source":1},{"line":977,"start":112052,"end":112055,"expression":"1/2","context":204,"kind":"use","source":1},{"line":977,"start":112083,"end":112106,"expression":"\\E_{P_{D_j}}s-\\E_{P_C}s","context":204,"kind":"use","source":1},{"line":980,"start":112432,"end":112433,"expression":"B","context":205,"kind":"use","source":1},{"line":980,"start":112444,"end":112458,"expression":"o\\in\\mathcal O","context":205,"kind":"use","source":1},{"line":980,"start":112473,"end":112487,"expression":"z\\in\\mathcal Z","context":205,"kind":"use","source":1},{"line":983,"start":112759,"end":112773,"expression":"\\alpha\\in[0,1]","context":206,"kind":"use","source":1},{"line":984,"start":112778,"end":112824,"expression":"\nD_\\alpha(P_D B,P_C B)\\leq D_\\alpha(P_D,P_C).\n","context":206,"kind":"use","source":1},{"line":987,"start":112843,"end":112875,"expression":"\\TV(P_D B,P_C B)\\leq\\TV(P_D,P_C)","context":206,"kind":"use","source":1},{"line":990,"start":112942,"end":112946,"expression":"t(z)","context":206,"kind":"use","source":1},{"line":990,"start":112957,"end":112979,"expression":"s(o)=\\sum_z B(o,z)t(z)","context":206,"kind":"use","source":1},{"line":990,"start":112994,"end":112999,"expression":"[0,1]","context":206,"kind":"use","source":1},{"line":990,"start":113068,"end":113069,"expression":"t","context":207,"kind":"use","source":1},{"line":996,"start":114302,"end":114303,"expression":"F","context":208,"kind":"use","source":1},{"line":1007,"start":115968,"end":115969,"expression":"O","context":209,"kind":"use","source":1},{"line":1007,"start":116029,"end":116032,"expression":"P_C","context":210,"kind":"use","source":1},{"line":1007,"start":116050,"end":116068,"expression":"j\\in\\{1,\\ldots,m\\}","context":211,"kind":"use","source":1},{"line":1007,"start":116079,"end":116082,"expression":"P_j","context":212,"kind":"use","source":1},{"line":1007,"start":116113,"end":116121,"expression":"g_j\\geq0","context":213,"kind":"use","source":1},{"line":1007,"start":116131,"end":116137,"expression":"m\\geq1","context":214,"kind":"use","source":1},{"line":1007,"start":116157,"end":116160,"expression":"F>0","context":215,"kind":"use","source":1},{"line":1007,"start":116191,"end":116203,"expression":"s(o)\\in[0,1]","context":216,"kind":"use","source":1},{"line":1007,"start":116219,"end":116220,"expression":"o","context":217,"kind":"use","source":1},{"line":1007,"start":116263,"end":116277,"expression":"\\alpha\\in[0,1]","context":218,"kind":"use","source":1},{"line":1008,"start":116310,"end":116377,"expression":"\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n","context":219,"kind":"use","source":1},{"line":1011,"start":116386,"end":116426,"expression":"\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)","context":220,"kind":"use","source":1},{"line":1011,"start":116439,"end":116440,"expression":"s","context":221,"kind":"use","source":1},{"line":1011,"start":116520,"end":116521,"expression":"j","context":222,"kind":"use","source":1},{"line":1012,"start":116575,"end":116714,"expression":"\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n","context":223,"kind":"use","source":1},{"line":1017,"start":116777,"end":116795,"expression":"\\Gamma_\\alpha\\geq0","context":224,"kind":"use","source":1},{"line":1017,"start":116823,"end":116838,"expression":"\\Gamma_\\alpha>0","context":225,"kind":"use","source":1},{"line":1019,"start":117234,"end":117252,"expression":"\\lambda\\in\\Delta_m","context":226,"kind":"use","source":1},{"line":1019,"start":117260,"end":117288,"expression":"P_\\lambda=\\sum_j\\lambda_jP_j","context":226,"kind":"use","source":1},{"line":1019,"start":117295,"end":117323,"expression":"g_\\lambda=\\sum_j\\lambda_jg_j","context":226,"kind":"use","source":1},{"line":1020,"start":117334,"end":117403,"expression":"\nV_\\alpha(P,P_C)=\\max_{s\\in\\mathcal M_\\alpha}\\langle P-P_C,s\\rangle.\n","context":226,"kind":"use","source":1},{"line":1027,"start":117692,"end":117802,"expression":"\\label{eq:joint-dual}\n\\Gamma_\\alpha=\\min_{\\lambda\\in\\Delta_m}\n\\bigl(FV_\\alpha(P_\\lambda,P_C)-g_\\lambda\\bigr).\n","context":227,"kind":"use","source":1},{"line":1031,"start":117922,"end":117960,"expression":"FV_\\alpha(P_\\lambda,P_C)\\geq g_\\lambda","context":228,"kind":"use","source":1},{"line":1031,"start":117973,"end":117991,"expression":"\\lambda\\in\\Delta_m","context":229,"kind":"use","source":1},{"line":1031,"start":118045,"end":118053,"expression":"\\alpha=1","context":230,"kind":"use","source":1},{"line":1031,"start":118060,"end":118081,"expression":"V_1(P,P_C)=\\TV(P,P_C)","context":231,"kind":"use","source":1},{"line":1034,"start":118127,"end":118128,"expression":"s","context":232,"kind":"use","source":1},{"line":1034,"start":118159,"end":118165,"expression":"D_j(s)","context":233,"kind":"use","source":1},{"line":1034,"start":118186,"end":118207,"expression":"\\sum_j\\lambda_jD_j(s)","context":234,"kind":"use","source":1},{"line":1034,"start":118215,"end":118223,"expression":"\\Delta_m","context":235,"kind":"use","source":1},{"line":1034,"start":118258,"end":118259,"expression":"s","context":236,"kind":"use","source":1},{"line":1034,"start":118266,"end":118273,"expression":"\\lambda","context":237,"kind":"use","source":1},{"line":1034,"start":118534,"end":118551,"expression":"\\mathcal M_\\alpha","context":238,"kind":"use","source":1},{"line":1034,"start":118602,"end":118609,"expression":"\\lambda","context":239,"kind":"use","source":1},{"line":1034,"start":118641,"end":118675,"expression":"FV_\\alpha(P_\\lambda,P_C)-g_\\lambda","context":240,"kind":"use","source":1},{"line":1034,"start":118768,"end":118776,"expression":"\\alpha=1","context":241,"kind":"use","source":1},{"line":1034,"start":118786,"end":118797,"expression":"s\\in[0,1]^O","context":242,"kind":"use","source":1},{"line":1034,"start":118824,"end":118830,"expression":"s(o)=1","context":243,"kind":"use","source":1},{"line":1034,"start":118847,"end":118858,"expression":"P(o)>P_C(o)","context":244,"kind":"use","source":1},{"line":1037,"start":119173,"end":119180,"expression":"\\lambda","context":245,"kind":"use","source":1},{"line":1040,"start":119494,"end":119503,"expression":"O=\\{0,1\\}","context":246,"kind":"use","source":1},{"line":1040,"start":119507,"end":119520,"expression":"P_C=(1/2,1/2)","context":246,"kind":"use","source":1},{"line":1040,"start":119524,"end":119533,"expression":"P_1=(1,0)","context":246,"kind":"use","source":1},{"line":1040,"start":119537,"end":119546,"expression":"P_2=(0,1)","context":246,"kind":"use","source":1},{"line":1040,"start":119550,"end":119553,"expression":"F=2","context":246,"kind":"use","source":1},{"line":1040,"start":119557,"end":119568,"expression":"g_1=g_2=1/2","context":246,"kind":"use","source":1},{"line":1040,"start":119576,"end":119586,"expression":"\\alpha=1/2","context":246,"kind":"use","source":1},{"line":1040,"start":119602,"end":119607,"expression":"(1,0)","context":246,"kind":"use","source":1},{"line":1040,"start":119636,"end":119637,"expression":"1","context":246,"kind":"use","source":1},{"line":1040,"start":119645,"end":119650,"expression":"(0,1)","context":246,"kind":"use","source":1},{"line":1040,"start":119679,"end":119680,"expression":"2","context":246,"kind":"use","source":1},{"line":1041,"start":119746,"end":119808,"expression":"\nD_1(s)=s(0)-s(1)-\\tfrac12,\n\\qquad\nD_2(s)=s(1)-s(0)-\\tfrac12.\n","context":246,"kind":"use","source":1},{"line":1046,"start":119825,"end":119827,"expression":"-1","context":247,"kind":"use","source":1},{"line":1046,"start":119894,"end":119898,"expression":"-1/2","context":248,"kind":"use","source":1},{"line":1046,"start":119916,"end":119925,"expression":"s(0)=s(1)","context":249,"kind":"use","source":1},{"line":1046,"start":119953,"end":119970,"expression":"\\lambda=(1/2,1/2)","context":250,"kind":"use","source":1},{"line":1046,"start":119984,"end":119997,"expression":"P_\\lambda=P_C","context":251,"kind":"use","source":1},{"line":1046,"start":120006,"end":120019,"expression":"g_\\lambda=1/2","context":252,"kind":"use","source":1},{"line":1049,"start":120288,"end":120301,"expression":"P_\\lambda=P_C","context":253,"kind":"use","source":1},{"line":1049,"start":120309,"end":120320,"expression":"g_\\lambda>0","context":253,"kind":"use","source":1},{"line":1052,"start":120708,"end":120733,"expression":"\\widehat P_C,\\widehat P_j","context":254,"kind":"use","source":1},{"line":1053,"start":120772,"end":120854,"expression":"\n\\TV(P_C,\\widehat P_C)\\leq\\epsilon_C,\n\\qquad\n\\TV(P_j,\\widehat P_j)\\leq\\epsilon_j.\n","context":254,"kind":"use","source":1},{"line":1061,"start":121128,"end":121148,"expression":"\\alpha\\geq\\epsilon_C","context":255,"kind":"use","source":1},{"line":1061,"start":121155,"end":121164,"expression":"\\eta\\geq0","context":255,"kind":"use","source":1},{"line":1061,"start":121180,"end":121191,"expression":"s\\in[0,1]^O","context":255,"kind":"use","source":1},{"line":1062,"start":121216,"end":121432,"expression":"\n\\langle\\widehat P_C,s\\rangle&\\leq\\alpha-\\epsilon_C,\\label{eq:joint-robust-cap}\\\\\nF\\langle\\widehat P_j-\\widehat P_C,s\\rangle-g_j\n&\\geq\\eta+F(\\epsilon_j+\\epsilon_C)\n\\quad\\text{for every }j,\\label{eq:joint-robust-gap}\n","context":256,"kind":"use","source":1},{"line":1068,"start":121490,"end":121496,"expression":"\\alpha","context":257,"kind":"use","source":1},{"line":1068,"start":121521,"end":121527,"expression":"D_j(s)","context":257,"kind":"use","source":1},{"line":1068,"start":121542,"end":121546,"expression":"\\eta","context":257,"kind":"use","source":1},{"line":1071,"start":121601,"end":121613,"expression":"0\\leq s\\leq1","context":257,"kind":"use","source":1},{"line":1072,"start":121873,"end":121967,"expression":"\nD_j(s)\\geq F\\langle\\widehat P_j-\\widehat P_C,s\\rangle-g_j\n-F(\\epsilon_j+\\epsilon_C)\\geq\\eta.\n","context":258,"kind":"use","source":1},{"line":1076,"start":121980,"end":121981,"expression":"s","context":259,"kind":"use","source":1},{"line":1079,"start":122270,"end":122287,"expression":"\\alpha<\\epsilon_C","context":260,"kind":"use","source":1},{"line":1082,"start":122657,"end":122662,"expression":"(s,t)","context":261,"kind":"use","source":1},{"line":1082,"start":122678,"end":122690,"expression":"D_j(s)\\geq t","context":261,"kind":"use","source":1},{"line":1082,"start":122712,"end":122713,"expression":"s","context":261,"kind":"use","source":1},{"line":1082,"start":122971,"end":122978,"expression":"\\lambda","context":262,"kind":"use","source":1},{"line":1088,"start":124018,"end":124023,"expression":"R,U,V","context":263,"kind":"use","source":1},{"line":1089,"start":124072,"end":124148,"expression":"\nR\\succ_1 U\\succ_1 V,\\qquad\nU\\succ_2 V\\succ_2 R,\\qquad\nV\\succ_3 R\\succ_3 U.\n","context":263,"kind":"use","source":1},{"line":1096,"start":124246,"end":124247,"expression":"R","context":264,"kind":"use","source":1},{"line":1096,"start":124253,"end":124254,"expression":"U","context":264,"kind":"use","source":1},{"line":1096,"start":124258,"end":124259,"expression":"U","context":264,"kind":"use","source":1},{"line":1096,"start":124265,"end":124266,"expression":"V","context":264,"kind":"use","source":1},{"line":1096,"start":124274,"end":124275,"expression":"V","context":264,"kind":"use","source":1},{"line":1096,"start":124281,"end":124282,"expression":"R","context":264,"kind":"use","source":1},{"line":1099,"start":124562,"end":124563,"expression":"R","context":265,"kind":"use","source":1},{"line":1099,"start":124575,"end":124576,"expression":"U","context":265,"kind":"use","source":1},{"line":1099,"start":124584,"end":124585,"expression":"V","context":265,"kind":"use","source":1},{"line":1099,"start":124621,"end":124622,"expression":"U","context":265,"kind":"use","source":1},{"line":1099,"start":124630,"end":124631,"expression":"R","context":265,"kind":"use","source":1},{"line":1115,"start":127524,"end":127531,"expression":"s=(x,I)","context":266,"kind":"use","source":1},{"line":1115,"start":127570,"end":127577,"expression":"R(s,s')","context":266,"kind":"use","source":1},{"line":1115,"start":127693,"end":127700,"expression":"\\Psi(s)","context":266,"kind":"use","source":1},{"line":1118,"start":127780,"end":127789,"expression":"\\Psi(s_0)","context":267,"kind":"use","source":1},{"line":1119,"start":127833,"end":127880,"expression":"\n\\Psi(s)\\wedge R(s,s')\\Longrightarrow\\Psi(s'),\n","context":267,"kind":"use","source":1},{"line":1122,"start":127889,"end":127898,"expression":"\\Psi(s_t)","context":267,"kind":"use","source":1},{"line":1128,"start":128180,"end":128181,"expression":"R","context":268,"kind":"use","source":1},{"line":1128,"start":128241,"end":128242,"expression":"R","context":268,"kind":"use","source":1},{"line":1131,"start":128701,"end":128738,"expression":"v\\in\\{\\mathsf{strict},\\mathsf{open}\\}","context":269,"kind":"use","source":1},{"line":1131,"start":128763,"end":128800,"expression":"p\\in\\{\\mathsf{safe},\\mathsf{unsafe}\\}","context":269,"kind":"use","source":1},{"line":1131,"start":128810,"end":128827,"expression":"v=\\mathsf{strict}","context":269,"kind":"use","source":1},{"line":1131,"start":128919,"end":128982,"expression":"(\\mathsf{strict},\\mathsf{safe})\\to(\\mathsf{open},\\mathsf{safe})","context":269,"kind":"use","source":1},{"line":1131,"start":129004,"end":129019,"expression":"v=\\mathsf{open}","context":270,"kind":"use","source":1},{"line":1131,"start":129068,"end":129131,"expression":"(\\mathsf{open},\\mathsf{safe})\\to(\\mathsf{open},\\mathsf{unsafe})","context":271,"kind":"use","source":1},{"line":1138,"start":130367,"end":130368,"expression":"S","context":272,"kind":"use","source":1},{"line":1138,"start":130410,"end":130414,"expression":"A(s)","context":272,"kind":"use","source":1},{"line":1138,"start":130459,"end":130460,"expression":"s","context":273,"kind":"use","source":1},{"line":1138,"start":130472,"end":130488,"expression":"K(\\cdot\\mid s,a)","context":274,"kind":"use","source":1},{"line":1140,"start":130668,"end":130673,"expression":"V_0=S","context":275,"kind":"use","source":1},{"line":1140,"start":130697,"end":130702,"expression":"h\\ge0","context":276,"kind":"use","source":1},{"line":1141,"start":130721,"end":130859,"expression":"\\label{eq:viability}\nV_{h+1}=\\Bigl\\{s\\in S:\\exists a\\in A(s)\\;\\text{such that}\\;\n\\operatorname{supp}K(\\cdot\\mid s,a)\\subseteq V_h\\Bigr\\}.\n","context":277,"kind":"use","source":1},{"line":1146,"start":130977,"end":130978,"expression":"s","context":278,"kind":"use","source":1},{"line":1146,"start":130992,"end":130995,"expression":"V_h","context":279,"kind":"use","source":1},{"line":1146,"start":131093,"end":131094,"expression":"h","context":280,"kind":"use","source":1},{"line":1146,"start":131147,"end":131148,"expression":"S","context":281,"kind":"use","source":1},{"line":1146,"start":131245,"end":131253,"expression":"s\\in V_h","context":282,"kind":"use","source":1},{"line":1149,"start":131343,"end":131346,"expression":"h=0","context":283,"kind":"use","source":1},{"line":1149,"start":131352,"end":131357,"expression":"V_0=S","context":284,"kind":"use","source":1},{"line":1149,"start":131381,"end":131382,"expression":"h","context":285,"kind":"use","source":1},{"line":1149,"start":131399,"end":131400,"expression":"S","context":286,"kind":"use","source":1},{"line":1149,"start":131447,"end":131448,"expression":"h","context":287,"kind":"use","source":1},{"line":1149,"start":131545,"end":131546,"expression":"h","context":288,"kind":"use","source":1},{"line":1149,"start":131620,"end":131623,"expression":"V_h","context":289,"kind":"use","source":1},{"line":1149,"start":131698,"end":131705,"expression":"V_{h+1}","context":290,"kind":"use","source":1},{"line":1166,"start":134513,"end":134520,"expression":"s\\to s'","context":291,"kind":"use","source":1},{"line":1166,"start":134566,"end":134571,"expression":"\\to^*","context":291,"kind":"use","source":1},{"line":1167,"start":134845,"end":134929,"expression":"\ns\\to a,\\ s\\to b\\quad\\Longrightarrow\\quad\n\\exists c:\\ a\\to^*c\\ \\text{and}\\ b\\to^*c.\n","context":291,"kind":"use","source":1},{"line":1171,"start":135006,"end":135007,"expression":"s","context":292,"kind":"use","source":1},{"line":1177,"start":135662,"end":135663,"expression":"s","context":293,"kind":"use","source":1},{"line":1177,"start":135683,"end":135686,"expression":"y,z","context":294,"kind":"use","source":1},{"line":1177,"start":135692,"end":135693,"expression":"s","context":295,"kind":"use","source":1},{"line":1177,"start":135737,"end":135738,"expression":"s","context":296,"kind":"use","source":1},{"line":1177,"start":135771,"end":135783,"expression":"s\\to a\\to^*y","context":297,"kind":"use","source":1},{"line":1177,"start":135790,"end":135802,"expression":"s\\to b\\to^*z","context":298,"kind":"use","source":1},{"line":1177,"start":135832,"end":135833,"expression":"c","context":299,"kind":"use","source":1},{"line":1177,"start":135841,"end":135848,"expression":"a\\to^*c","context":300,"kind":"use","source":1},{"line":1177,"start":135855,"end":135862,"expression":"b\\to^*c","context":301,"kind":"use","source":1},{"line":1177,"start":135894,"end":135895,"expression":"a","context":302,"kind":"use","source":1},{"line":1177,"start":135904,"end":135907,"expression":"y,c","context":303,"kind":"use","source":1},{"line":1177,"start":135918,"end":135919,"expression":"p","context":304,"kind":"use","source":1},{"line":1177,"start":135945,"end":135946,"expression":"b","context":305,"kind":"use","source":1},{"line":1177,"start":135955,"end":135958,"expression":"z,c","context":306,"kind":"use","source":1},{"line":1177,"start":135969,"end":135970,"expression":"q","context":307,"kind":"use","source":1},{"line":1177,"start":135980,"end":135981,"expression":"c","context":308,"kind":"use","source":1},{"line":1177,"start":136015,"end":136016,"expression":"s","context":309,"kind":"use","source":1},{"line":1177,"start":136041,"end":136044,"expression":"p,q","context":310,"kind":"use","source":1},{"line":1177,"start":136053,"end":136056,"expression":"y,z","context":311,"kind":"use","source":1},{"line":1194,"start":138155,"end":138156,"expression":"A","context":312,"kind":"use","source":1},{"line":1194,"start":138192,"end":138193,"expression":"B","context":312,"kind":"use","source":1},{"line":1205,"start":140444,"end":140452,"expression":"(L,\\vee)","context":313,"kind":"use","source":1},{"line":1205,"start":140489,"end":140496,"expression":"a\\leq b","context":313,"kind":"use","source":1},{"line":1205,"start":140504,"end":140513,"expression":"a\\vee b=b","context":313,"kind":"use","source":1},{"line":1205,"start":140533,"end":140544,"expression":"\\ell_i\\in L","context":313,"kind":"use","source":1},{"line":1205,"start":140627,"end":140633,"expression":"\\delta","context":313,"kind":"use","source":1},{"line":1205,"start":140673,"end":140679,"expression":"\\ell_i","context":313,"kind":"use","source":1},{"line":1205,"start":140685,"end":140701,"expression":"\\ell_i\\vee\\ell_j","context":313,"kind":"use","source":1},{"line":1205,"start":140741,"end":140742,"expression":"L","context":313,"kind":"use","source":1},{"line":1208,"start":141083,"end":141089,"expression":"\\ell_0","context":314,"kind":"use","source":1},{"line":1208,"start":141126,"end":141150,"expression":"\\delta_1,\\ldots,\\delta_N","context":315,"kind":"use","source":1},{"line":1209,"start":141272,"end":141326,"expression":"\n\\ell^\\star=\\ell_0\\vee\\delta_1\\vee\\cdots\\vee\\delta_N,\n","context":316,"kind":"use","source":1},{"line":1212,"start":141399,"end":141411,"expression":"V\\subseteq L","context":317,"kind":"use","source":1},{"line":1212,"start":141478,"end":141479,"expression":"V","context":318,"kind":"use","source":1},{"line":1212,"start":141487,"end":141488,"expression":"V","context":319,"kind":"use","source":1},{"line":1212,"start":141495,"end":141496,"expression":"V","context":320,"kind":"use","source":1},{"line":1212,"start":141515,"end":141519,"expression":"\\vee","context":321,"kind":"use","source":1},{"line":1212,"start":141563,"end":141564,"expression":"V","context":322,"kind":"use","source":1},{"line":1215,"start":141639,"end":141645,"expression":"\\ell_0","context":323,"kind":"use","source":1},{"line":1215,"start":141827,"end":141837,"expression":"\\ell^\\star","context":324,"kind":"use","source":1},{"line":1215,"start":142059,"end":142060,"expression":"V","context":325,"kind":"use","source":1},{"line":1220,"start":142461,"end":142462,"expression":"L","context":326,"kind":"use","source":1},{"line":1223,"start":142962,"end":142963,"expression":"r","context":327,"kind":"use","source":1},{"line":1223,"start":143066,"end":143071,"expression":"(r,A)","context":327,"kind":"use","source":1},{"line":1223,"start":143088,"end":143093,"expression":"(r,B)","context":327,"kind":"use","source":1},{"line":1223,"start":143101,"end":143107,"expression":"A\\ne B","context":327,"kind":"use","source":1},{"line":1265,"start":149691,"end":149692,"expression":"M","context":328,"kind":"use","source":1},{"line":1265,"start":149705,"end":149706,"expression":"w","context":328,"kind":"use","source":1},{"line":1265,"start":149730,"end":149737,"expression":"P_{M,w}","context":328,"kind":"use","source":1},{"line":1265,"start":149755,"end":149759,"expression":"M(w)","context":328,"kind":"use","source":1},{"line":1265,"start":149926,"end":149930,"expression":"M(w)","context":329,"kind":"use","source":1},{"line":1285,"start":153505,"end":153521,"expression":"\\theta\\in\\{0,1\\}","context":330,"kind":"use","source":1},{"line":1285,"start":153583,"end":153584,"expression":"H","context":330,"kind":"use","source":1},{"line":1285,"start":153794,"end":153800,"expression":"\\theta","context":330,"kind":"use","source":1},{"line":1285,"start":153849,"end":153850,"expression":"H","context":330,"kind":"use","source":1},{"line":1285,"start":153908,"end":153909,"expression":"H","context":331,"kind":"use","source":1},{"line":1285,"start":153917,"end":153920,"expression":"P_0","context":332,"kind":"use","source":1},{"line":1285,"start":153927,"end":153930,"expression":"P_1","context":333,"kind":"use","source":1},{"line":1288,"start":154061,"end":154064,"expression":"B_0","context":334,"kind":"use","source":1},{"line":1288,"start":154071,"end":154074,"expression":"B_1","context":335,"kind":"use","source":1},{"line":1288,"start":154212,"end":154213,"expression":"0","context":336,"kind":"use","source":1},{"line":1288,"start":154220,"end":154221,"expression":"1","context":337,"kind":"use","source":1},{"line":1288,"start":154240,"end":154241,"expression":"H","context":338,"kind":"use","source":1},{"line":1288,"start":154255,"end":154259,"expression":"\\eta","context":339,"kind":"use","source":1},{"line":1289,"start":154288,"end":154318,"expression":"\nP_0(B_0)+P_1(B_1)\\leq1+\\eta.\n","context":340,"kind":"use","source":1},{"line":1292,"start":154391,"end":154401,"expression":"(1-\\eta)/2","context":341,"kind":"use","source":1},{"line":1295,"start":154690,"end":154710,"expression":"\\TV(P_0,P_1)\\leq\\eta","context":342,"kind":"use","source":1},{"line":1296,"start":154725,"end":154783,"expression":"\nP_0(B_0)+P_1(B_1)\n\\leq P_1(B_0)+\\eta+P_1(B_1)\\leq1+\\eta,\n","context":343,"kind":"use","source":1},{"line":1300,"start":154906,"end":154912,"expression":"1-\\eta","context":344,"kind":"use","source":1},{"line":1300,"start":154977,"end":154983,"expression":"\\eta=0","context":345,"kind":"use","source":1},{"line":1307,"start":155508,"end":155509,"expression":"U","context":346,"kind":"use","source":1},{"line":1307,"start":155544,"end":155549,"expression":"H_1=U","context":346,"kind":"use","source":1},{"line":1307,"start":155573,"end":155590,"expression":"H_2=U\\oplus\\theta","context":346,"kind":"use","source":1},{"line":1307,"start":155658,"end":155664,"expression":"\\theta","context":346,"kind":"use","source":1},{"line":1307,"start":155699,"end":155718,"expression":"(a_1,a_2)=(H_1,H_2)","context":346,"kind":"use","source":1},{"line":1307,"start":155738,"end":155758,"expression":"a_1\\oplus a_2=\\theta","context":346,"kind":"use","source":1},{"line":1313,"start":156347,"end":156348,"expression":"A","context":347,"kind":"use","source":1},{"line":1313,"start":156356,"end":156364,"expression":"\\theta=0","context":347,"kind":"use","source":1},{"line":1313,"start":156381,"end":156382,"expression":"B","context":347,"kind":"use","source":1},{"line":1313,"start":156390,"end":156398,"expression":"\\theta=1","context":347,"kind":"use","source":1},{"line":1313,"start":156694,"end":156697,"expression":"1/2","context":348,"kind":"use","source":1},{"line":1322,"start":157684,"end":157751,"expression":"\no=(\\mathsf{id},i,j,\\varphi,d,\\mathsf{authority},\\mathsf{status}),\n","context":349,"kind":"use","source":1},{"line":1325,"start":157761,"end":157762,"expression":"i","context":350,"kind":"use","source":1},{"line":1325,"start":157769,"end":157770,"expression":"j","context":351,"kind":"use","source":1},{"line":1325,"start":157813,"end":157820,"expression":"\\varphi","context":352,"kind":"use","source":1},{"line":1325,"start":157858,"end":157859,"expression":"d","context":353,"kind":"use","source":1},{"line":1327,"start":158114,"end":158115,"expression":"D","context":354,"kind":"use","source":1},{"line":1328,"start":158153,"end":158245,"expression":"\n\\mathbf G\\bigl(\\mathsf{created}(o)\\Rightarrow\n\\mathbf F_{\\leq D}\\mathsf{settled}(o)\\bigr).\n","context":354,"kind":"use","source":1},{"line":1332,"start":158254,"end":158270,"expression":"\\mathsf{settled}","context":354,"kind":"use","source":1},{"line":1332,"start":158383,"end":158384,"expression":"D","context":354,"kind":"use","source":1},{"line":1335,"start":158782,"end":158783,"expression":"M","context":355,"kind":"use","source":1},{"line":1335,"start":158831,"end":158832,"expression":"D","context":355,"kind":"use","source":1},{"line":1339,"start":159650,"end":159658,"expression":"m:S\\to Q","context":356,"kind":"use","source":1},{"line":1339,"start":159737,"end":159743,"expression":"\\nu(a)","context":356,"kind":"use","source":1},{"line":1339,"start":159787,"end":159788,"expression":"a","context":356,"kind":"use","source":1},{"line":1340,"start":159822,"end":159853,"expression":"\nm(F(s,a))=\\delta(m(s),\\nu(a))\n","context":356,"kind":"use","source":1},{"line":1343,"start":159917,"end":159920,"expression":"\\nu","context":356,"kind":"use","source":1},{"line":1346,"start":160170,"end":160176,"expression":"\\delta","context":357,"kind":"use","source":1},{"line":1346,"start":160202,"end":160203,"expression":"T","context":358,"kind":"use","source":1},{"line":1349,"start":160783,"end":160789,"expression":"\\delta","context":359,"kind":"use","source":1},{"line":1363,"start":162746,"end":162747,"expression":"H","context":360,"kind":"use","source":1},{"line":1363,"start":162786,"end":162790,"expression":"C(H)","context":360,"kind":"use","source":1},{"line":1363,"start":162870,"end":162881,"expression":"M^{\\rm act}","context":360,"kind":"use","source":1},{"line":1363,"start":162914,"end":162925,"expression":"M^{\\rm arc}","context":360,"kind":"use","source":1},{"line":1363,"start":162996,"end":162997,"expression":"P","context":360,"kind":"use","source":1},{"line":1367,"start":163350,"end":163360,"expression":"\\mathcal Q","context":361,"kind":"use","source":1},{"line":1367,"start":163627,"end":163637,"expression":"\\mathcal Q","context":361,"kind":"use","source":1},{"line":1373,"start":164765,"end":164766,"expression":"j","context":362,"kind":"use","source":1},{"line":1373,"start":164795,"end":164804,"expression":"(Z_j,d_j)","context":362,"kind":"use","source":1},{"line":1373,"start":164824,"end":164838,"expression":"F_j:Z_j\\to Z_j","context":362,"kind":"use","source":1},{"line":1373,"start":164857,"end":164875,"expression":"T_j:Z_j\\to Z_{j+1}","context":362,"kind":"use","source":1},{"line":1374,"start":164931,"end":165032,"expression":"\\label{eq:transport-defect}\n\\varepsilon_j=\\sup_{z\\in Z_j}d_{j+1}\\bigl(T_jF_j(z),F_{j+1}T_j(z)\\bigr).\n","context":362,"kind":"use","source":1},{"line":1380,"start":165358,"end":165361,"expression":"T_j","context":363,"kind":"use","source":1},{"line":1380,"start":165367,"end":165370,"expression":"L_j","context":363,"kind":"use","source":1},{"line":1380,"start":165387,"end":165407,"expression":"\\varepsilon_j<\\infty","context":363,"kind":"use","source":1},{"line":1380,"start":165414,"end":165428,"expression":"j=0,\\ldots,m-1","context":363,"kind":"use","source":1},{"line":1380,"start":165439,"end":165464,"expression":"T_{0:m}=T_{m-1}\\cdots T_0","context":363,"kind":"use","source":1},{"line":1380,"start":165478,"end":165486,"expression":"z\\in Z_0","context":363,"kind":"use","source":1},{"line":1381,"start":165505,"end":165672,"expression":"\\label{eq:cumulative-transport}\n\\begin{split}\n&d_m\\bigl(T_{0:m}F_0(z),F_mT_{0:m}(z)\\bigr)\\\\\n&\\qquad\\le\\sum_{j=0}^{m-1}\\varepsilon_j\\prod_{k=j+1}^{m-1}L_k,\n\\end{split}\n","context":364,"kind":"use","source":1},{"line":1387,"start":165717,"end":165718,"expression":"1","context":365,"kind":"use","source":1},{"line":1390,"start":165758,"end":165761,"expression":"m=1","context":365,"kind":"use","source":1},{"line":1390,"start":165790,"end":165803,"expression":"\\varepsilon_0","context":365,"kind":"use","source":1},{"line":1390,"start":165850,"end":165853,"expression":"m-1","context":365,"kind":"use","source":1},{"line":1390,"start":165864,"end":165890,"expression":"T_{m-1}F_{m-1}T_{0:m-1}(z)","context":365,"kind":"use","source":1},{"line":1390,"start":165929,"end":165930,"expression":"m","context":365,"kind":"use","source":1},{"line":1390,"start":165958,"end":165965,"expression":"T_{m-1}","context":365,"kind":"use","source":1},{"line":1390,"start":165999,"end":166006,"expression":"L_{m-1}","context":366,"kind":"use","source":1},{"line":1390,"start":166088,"end":166105,"expression":"\\varepsilon_{m-1}","context":367,"kind":"use","source":1},{"line":1390,"start":166124,"end":166163,"expression":"D_m\\le L_{m-1}D_{m-1}+\\varepsilon_{m-1}","context":368,"kind":"use","source":1},{"line":1397,"start":167035,"end":167045,"expression":"\\mathcal Q","context":369,"kind":"use","source":1},{"line":1399,"start":167346,"end":167377,"expression":"\\mathcal C_j\\subseteq\\mathcal Q","context":370,"kind":"use","source":1},{"line":1399,"start":167416,"end":167417,"expression":"j","context":370,"kind":"use","source":1},{"line":1402,"start":167743,"end":167744,"expression":"j","context":371,"kind":"use","source":1},{"line":1402,"start":167789,"end":167792,"expression":"j+1","context":372,"kind":"use","source":1},{"line":1403,"start":167973,"end":168013,"expression":"\n\\mathcal C_j\\subseteq\\mathcal C_{j+1}.\n","context":373,"kind":"use","source":1},{"line":1409,"start":168289,"end":168301,"expression":"\\mathcal C_j","context":374,"kind":"use","source":1},{"line":1409,"start":168439,"end":168442,"expression":"j+1","context":375,"kind":"use","source":1},{"line":1414,"start":169234,"end":169235,"expression":"N","context":376,"kind":"use","source":1},{"line":1414,"start":169269,"end":169270,"expression":"N","context":376,"kind":"use","source":1},{"line":1414,"start":169366,"end":169367,"expression":"B","context":376,"kind":"use","source":1},{"line":1414,"start":169409,"end":169412,"expression":"2^B","context":376,"kind":"use","source":1},{"line":1414,"start":169571,"end":169581,"expression":"\\mathcal Q","context":377,"kind":"use","source":1},{"line":1426,"start":171407,"end":171419,"expression":"\\mathcal C_t","context":378,"kind":"introduction-passage","source":1},{"line":1426,"start":171455,"end":171467,"expression":"\\mathcal Q_t","context":379,"kind":"introduction-passage","source":1},{"line":1427,"start":171747,"end":171864,"expression":"\n\\mathcal C_{t+1}=F(\\mathcal C_t,\\mathcal Q_t,I_t,u_t),\\qquad\n\\mathcal Q_{t+1}=G(\\mathcal Q_t,\\mathcal C_t,I_t,u_t),\n","context":380,"kind":"introduction-passage","source":1},{"line":1431,"start":171874,"end":171877,"expression":"u_t","context":381,"kind":"use","source":1},{"line":1431,"start":171918,"end":171921,"expression":"I_t","context":382,"kind":"use","source":1},{"line":1434,"start":172280,"end":172292,"expression":"\\mathcal C_*","context":383,"kind":"use","source":1},{"line":1434,"start":172299,"end":172311,"expression":"\\mathcal Q_*","context":383,"kind":"use","source":1},{"line":1436,"start":172672,"end":172676,"expression":"\\Phi","context":384,"kind":"use","source":1},{"line":1436,"start":172790,"end":172813,"expression":"(\\mathcal C,\\mathcal Q)","context":385,"kind":"use","source":1},{"line":1438,"start":172954,"end":172981,"expression":"(\\mathcal C_0,\\mathcal Q_0)","context":386,"kind":"use","source":1},{"line":1438,"start":172998,"end":173002,"expression":"\\Phi","context":387,"kind":"use","source":1},{"line":1439,"start":173084,"end":173157,"expression":"\n|\\mathcal C_*\\setminus\\mathcal C_0|+|\\mathcal Q_*\\setminus\\mathcal Q_0|\n","context":388,"kind":"use","source":1},{"line":1445,"start":173378,"end":173382,"expression":"\\Phi","context":389,"kind":"use","source":1},{"line":1454,"start":174996,"end":174997,"expression":"e","context":390,"kind":"use","source":1},{"line":1454,"start":175028,"end":175029,"expression":"h","context":390,"kind":"use","source":1},{"line":1454,"start":175050,"end":175055,"expression":"\\{h\\}","context":390,"kind":"use","source":1},{"line":1454,"start":175105,"end":175110,"expression":"\\{e\\}","context":390,"kind":"use","source":1},{"line":1462,"start":176396,"end":176405,"expression":"r_T,r_F>0","context":391,"kind":"use","source":1},{"line":1462,"start":176438,"end":176445,"expression":"N_T,N_F","context":391,"kind":"use","source":1},{"line":1462,"start":176452,"end":176459,"expression":"r_F>r_T","context":391,"kind":"use","source":1},{"line":1463,"start":176493,"end":176583,"expression":"\n\\frac{N_T r_T^t}{N_T r_T^t+N_F r_F^t}\n=\\frac{1}{1+(N_F/N_T)(r_F/r_T)^t}\\longrightarrow0.\n","context":391,"kind":"use","source":1},{"line":1472,"start":177523,"end":177524,"expression":"V","context":392,"kind":"use","source":1},{"line":1472,"start":177722,"end":177723,"expression":"V","context":393,"kind":"use","source":1},{"line":1474,"start":177812,"end":177813,"expression":"Q","context":394,"kind":"use","source":1},{"line":1474,"start":177858,"end":177859,"expression":"V","context":394,"kind":"use","source":1},{"line":1474,"start":177908,"end":177911,"expression":"\\mu","context":394,"kind":"use","source":1},{"line":1474,"start":177964,"end":177965,"expression":"V","context":394,"kind":"use","source":1},{"line":1474,"start":177979,"end":178010,"expression":"\\tau=\\inf\\{t\\geq1:s_t\\notin V\\}","context":394,"kind":"use","source":1},{"line":1477,"start":178120,"end":178126,"expression":"t\\geq0","context":395,"kind":"use","source":1},{"line":1478,"start":178131,"end":178167,"expression":"\n\\Prob_\\mu(\\tau>t)=\\mu Q^t\\mathbf1.\n","context":395,"kind":"use","source":1},{"line":1481,"start":178204,"end":178213,"expression":"\\rho(Q)<1","context":395,"kind":"use","source":1},{"line":1482,"start":178223,"end":178270,"expression":"\n\\E_\\mu[\\tau]=\\mu(\\mathrm{Id}-Q)^{-1}\\mathbf1.\n","context":395,"kind":"use","source":1},{"line":1487,"start":178362,"end":178363,"expression":"V","context":395,"kind":"use","source":1},{"line":1487,"start":178374,"end":178375,"expression":"t","context":395,"kind":"use","source":1},{"line":1487,"start":178381,"end":178388,"expression":"\\mu Q^t","context":395,"kind":"use","source":1},{"line":1487,"start":178522,"end":178555,"expression":"\\E\\tau=\\sum_{t\\geq0}\\Prob(\\tau>t)","context":396,"kind":"use","source":1},{"line":1487,"start":178565,"end":178574,"expression":"\\rho(Q)<1","context":397,"kind":"use","source":1},{"line":1487,"start":178619,"end":178639,"expression":"(\\mathrm{Id}-Q)^{-1}","context":398,"kind":"use","source":1},{"line":1490,"start":178707,"end":178708,"expression":"V","context":399,"kind":"use","source":1},{"line":1493,"start":179061,"end":179062,"expression":"H","context":400,"kind":"use","source":1},{"line":1493,"start":179100,"end":179101,"expression":"D","context":400,"kind":"use","source":1},{"line":1493,"start":179151,"end":179152,"expression":"H","context":400,"kind":"use","source":1},{"line":1493,"start":179181,"end":179182,"expression":"f","context":400,"kind":"use","source":1},{"line":1493,"start":179186,"end":179187,"expression":"D","context":400,"kind":"use","source":1},{"line":1493,"start":179215,"end":179216,"expression":"r","context":400,"kind":"use","source":1},{"line":1493,"start":179246,"end":179247,"expression":"d","context":400,"kind":"use","source":1},{"line":1494,"start":179257,"end":179359,"expression":"\nQ=\\begin{pmatrix}1-f&f\\\\r&1-r-d\\end{pmatrix},\n\\qquad 0<f\\leq1,\\quad r\\geq0,\\quad d>0,\\quad r+d\\leq1.\n","context":401,"kind":"use","source":1},{"line":1499,"start":179522,"end":179550,"expression":"\n\\E_H\\tau=\\frac{f+r+d}{fd}.\n","context":402,"kind":"use","source":1},{"line":1502,"start":179558,"end":179564,"expression":"f=1/10","context":402,"kind":"use","source":1},{"line":1502,"start":179568,"end":179573,"expression":"r=2/5","context":402,"kind":"use","source":1},{"line":1502,"start":179581,"end":179587,"expression":"d=1/10","context":402,"kind":"use","source":1},{"line":1502,"start":179634,"end":179637,"expression":"r=0","context":402,"kind":"use","source":1},{"line":1507,"start":179913,"end":179928,"expression":"\\mu Q^t\\mathbf1","context":403,"kind":"use","source":1},{"line":1507,"start":179991,"end":179999,"expression":"f=d=1/10","context":403,"kind":"use","source":1},{"line":1507,"start":180026,"end":180029,"expression":"r=0","context":403,"kind":"use","source":1},{"line":1507,"start":180035,"end":180040,"expression":"r=2/5","context":403,"kind":"use","source":1},{"line":1511,"start":180396,"end":180402,"expression":"\\gamma","context":404,"kind":"use","source":1},{"line":1511,"start":180456,"end":180457,"expression":"t","context":404,"kind":"use","source":1},{"line":1511,"start":180470,"end":180482,"expression":"(1-\\gamma)^t","context":404,"kind":"use","source":1},{"line":1511,"start":180567,"end":180568,"expression":"Q","context":404,"kind":"use","source":1},{"line":1522,"start":182135,"end":182145,"expression":"\\mathcal I","context":405,"kind":"introduction-passage","source":1},{"line":1522,"start":182152,"end":182162,"expression":"\\mathcal E","context":405,"kind":"introduction-passage","source":1},{"line":1522,"start":182230,"end":182231,"expression":"n","context":405,"kind":"introduction-passage","source":1},{"line":1522,"start":182253,"end":182258,"expression":"I_n=i","context":405,"kind":"introduction-passage","source":1},{"line":1522,"start":182283,"end":182288,"expression":"X_n=x","context":405,"kind":"introduction-passage","source":1},{"line":1522,"start":182297,"end":182298,"expression":"i","context":405,"kind":"introduction-passage","source":1},{"line":1522,"start":182332,"end":182338,"expression":"m\\geq1","context":405,"kind":"introduction-passage","source":1},{"line":1522,"start":182367,"end":182370,"expression":"K_i","context":405,"kind":"introduction-passage","source":1},{"line":1522,"start":182380,"end":182392,"expression":"\\widehat X_n","context":405,"kind":"introduction-passage","source":1},{"line":1522,"start":182496,"end":182515,"expression":"R_i(\\widehat X_n,j)","context":406,"kind":"introduction-passage","source":1},{"line":1524,"start":182672,"end":182675,"expression":"K_i","context":407,"kind":"use","source":1},{"line":1524,"start":182699,"end":182704,"expression":"\\mu_i","context":407,"kind":"use","source":1},{"line":1525,"start":182726,"end":182819,"expression":"\\label{eq:uniform-fast-mixing}\n\\sup_{i,x}\\TV\\bigl(K_i^m(x,\\cdot),\\mu_i\\bigr)\\leq\\varepsilon.\n","context":407,"kind":"use","source":1},{"line":1528,"start":182866,"end":182871,"expression":"(i,x)","context":407,"kind":"use","source":1},{"line":1529,"start":182917,"end":183049,"expression":"\nP(i,x;j)&=\\sum_y K_i^m(x,y)R_i(y,j),\\label{eq:actual-review}\\\\\n\\overline R(i,j)&=\\sum_y\\mu_i(y)R_i(y,j).\\label{eq:averaged-review}\n","context":408,"kind":"use","source":1},{"line":1536,"start":183487,"end":183488,"expression":"i","context":409,"kind":"use","source":1},{"line":1536,"start":183502,"end":183513,"expression":"\\varepsilon","context":410,"kind":"use","source":1},{"line":1536,"start":183519,"end":183539,"expression":"\\overline R(i,\\cdot)","context":411,"kind":"use","source":1},{"line":1536,"start":183547,"end":183552,"expression":"(J_n)","context":412,"kind":"use","source":1},{"line":1536,"start":183587,"end":183598,"expression":"\\overline R","context":413,"kind":"use","source":1},{"line":1536,"start":183674,"end":183680,"expression":"T\\geq0","context":414,"kind":"use","source":1},{"line":1537,"start":183699,"end":183844,"expression":"\\label{eq:institutional-path-error}\n\\TV\\bigl(\\Law(I_0,\\ldots,I_T),\\Law(J_0,\\ldots,J_T)\\bigr)\n\\leq 1-(1-\\varepsilon)^T\\leq\\min\\{1,T\\varepsilon\\},\n","context":415,"kind":"use","source":1},{"line":1541,"start":183866,"end":183887,"expression":"0\\leq\\varepsilon\\leq1","context":416,"kind":"use","source":1},{"line":1541,"start":183930,"end":183933,"expression":"T=0","context":417,"kind":"use","source":1},{"line":1541,"start":183939,"end":183940,"expression":"1","context":418,"kind":"use","source":1},{"line":1544,"start":184093,"end":184096,"expression":"R_i","context":419,"kind":"use","source":1},{"line":1544,"start":184179,"end":184190,"expression":"\\varepsilon","context":420,"kind":"use","source":1},{"line":1544,"start":184599,"end":184610,"expression":"\\varepsilon","context":421,"kind":"use","source":1},{"line":1544,"start":184658,"end":184659,"expression":"T","context":422,"kind":"use","source":1},{"line":1544,"start":184680,"end":184697,"expression":"(1-\\varepsilon)^T","context":423,"kind":"use","source":1},{"line":1550,"start":185331,"end":185405,"expression":"\nK_i=(1-\\beta_i)\\mathrm{Id}+\\beta_i\\mathbf 1\\mu_i,\n\\qquad 0<\\beta_i\\leq1,\n","context":424,"kind":"use","source":1},{"line":1554,"start":185428,"end":185442,"expression":"\\mathbf 1\\mu_i","context":424,"kind":"use","source":1},{"line":1554,"start":185448,"end":185453,"expression":"\\mu_i","context":424,"kind":"use","source":1},{"line":1554,"start":185461,"end":185462,"expression":"m","context":424,"kind":"use","source":1},{"line":1554,"start":185476,"end":185532,"expression":"(1-\\beta_i)^m\\mathrm{Id}+[1-(1-\\beta_i)^m]\\mathbf 1\\mu_i","context":424,"kind":"use","source":1},{"line":1554,"start":185572,"end":185585,"expression":"(1-\\beta_i)^m","context":424,"kind":"use","source":1},{"line":1554,"start":185610,"end":185615,"expression":"\\mu_i","context":424,"kind":"use","source":1},{"line":1554,"start":185622,"end":185633,"expression":"\\beta_i=1/2","context":424,"kind":"use","source":1},{"line":1554,"start":185666,"end":185674,"expression":"2^{-m-1}","context":424,"kind":"use","source":1},{"line":1554,"start":185683,"end":185686,"expression":"m=8","context":424,"kind":"use","source":1},{"line":1554,"start":185730,"end":185742,"expression":"20/512=5/128","context":425,"kind":"use","source":1},{"line":1559,"start":186045,"end":186048,"expression":"1/2","context":426,"kind":"use","source":1},{"line":1564,"start":186562,"end":186563,"expression":"1","context":427,"kind":"use","source":1},{"line":1564,"start":186585,"end":186591,"expression":"M\\geq2","context":427,"kind":"use","source":1},{"line":1564,"start":186600,"end":186601,"expression":"1","context":427,"kind":"use","source":1},{"line":1564,"start":186722,"end":186723,"expression":"1","context":428,"kind":"use","source":1},{"line":1564,"start":186729,"end":186737,"expression":"1-2^{-M}","context":429,"kind":"use","source":1},{"line":1564,"start":186745,"end":186748,"expression":"1/2","context":430,"kind":"use","source":1},{"line":1564,"start":186810,"end":186820,"expression":"1/2-2^{-M}","context":431,"kind":"use","source":1},{"line":1569,"start":187221,"end":187224,"expression":"K_i","context":432,"kind":"use","source":1},{"line":1569,"start":187431,"end":187434,"expression":"1/2","context":432,"kind":"use","source":1},{"line":1572,"start":187741,"end":187748,"expression":"P_C,P_D","context":433,"kind":"use","source":1},{"line":1572,"start":187768,"end":187795,"expression":"\\overline P_C,\\overline P_D","context":433,"kind":"use","source":1},{"line":1573,"start":187821,"end":187882,"expression":"\n\\TV(P_a,\\overline P_a)\\leq\\varepsilon_a,\\qquad a\\in\\{C,D\\}.\n","context":433,"kind":"use","source":1},{"line":1579,"start":188203,"end":188213,"expression":"s^\\star(o)","context":434,"kind":"use","source":1},{"line":1579,"start":188241,"end":188274,"expression":"\\overline P_D(o)>\\overline P_C(o)","context":435,"kind":"use","source":1},{"line":1579,"start":188285,"end":188329,"expression":"\\overline d=\\TV(\\overline P_D,\\overline P_C)","context":436,"kind":"use","source":1},{"line":1580,"start":188443,"end":188494,"expression":"\ng\\leq F(\\overline d-\\varepsilon_C-\\varepsilon_D).\n","context":437,"kind":"use","source":1},{"line":1583,"start":188513,"end":188565,"expression":"g>F\\min\\{1,\\overline d+\\varepsilon_C+\\varepsilon_D\\}","context":438,"kind":"use","source":1},{"line":1583,"start":188612,"end":188613,"expression":"F","context":439,"kind":"use","source":1},{"line":1584,"start":188645,"end":188706,"expression":"\n\\E_{P_C}s^\\star\\leq\\E_{\\overline P_C}s^\\star+\\varepsilon_C.\n","context":440,"kind":"use","source":1},{"line":1589,"start":188763,"end":188768,"expression":"[0,1]","context":441,"kind":"use","source":1},{"line":1589,"start":188887,"end":188926,"expression":"\\overline d-\\varepsilon_D-\\varepsilon_C","context":442,"kind":"use","source":1},{"line":1589,"start":189049,"end":189088,"expression":"\\overline d+\\varepsilon_C+\\varepsilon_D","context":443,"kind":"use","source":1},{"line":1592,"start":189344,"end":189345,"expression":"g","context":444,"kind":"use","source":1},{"line":1605,"start":191108,"end":191115,"expression":"G=(V,E)","context":445,"kind":"use","source":1},{"line":1605,"start":191204,"end":191221,"expression":"x_i\\in\\mathbb F_2","context":445,"kind":"use","source":1},{"line":1605,"start":191238,"end":191245,"expression":"\\{i,j\\}","context":445,"kind":"use","source":1},{"line":1606,"start":191295,"end":191366,"expression":"\\label{eq:edge-rule}\nx_i\\oplus x_j=b_{ij},\\qquad b_{ij}\\in\\mathbb F_2.\n","context":445,"kind":"use","source":1},{"line":1612,"start":191712,"end":191726,"expression":"(x_i)_{i\\in V}","context":446,"kind":"use","source":1},{"line":1612,"start":191766,"end":191772,"expression":"b_{ij}","context":447,"kind":"use","source":1},{"line":1612,"start":191806,"end":191807,"expression":"0","context":448,"kind":"use","source":1},{"line":1615,"start":192179,"end":192180,"expression":"0","context":449,"kind":"use","source":1},{"line":1621,"start":192943,"end":192944,"expression":"1","context":450,"kind":"use","source":1},{"line":1621,"start":192964,"end":192965,"expression":"0","context":450,"kind":"use","source":1},{"line":1624,"start":193355,"end":193363,"expression":"b_{12}=0","context":451,"kind":"use","source":1},{"line":1624,"start":193367,"end":193375,"expression":"b_{23}=0","context":451,"kind":"use","source":1},{"line":1624,"start":193383,"end":193391,"expression":"b_{31}=1","context":451,"kind":"use","source":1},{"line":1630,"start":194468,"end":194485,"expression":"T_{ij}:Z_i\\to Z_j","context":452,"kind":"use","source":1},{"line":1630,"start":194573,"end":194598,"expression":"T_{ij}F_i\\simeq F_jT_{ij}","context":452,"kind":"use","source":1},{"line":1641,"start":196463,"end":196475,"expression":"\\Gamma=(V,E)","context":453,"kind":"use","source":1},{"line":1641,"start":196526,"end":196532,"expression":"i\\to j","context":453,"kind":"use","source":1},{"line":1641,"start":196543,"end":196554,"expression":"g_{ij}\\in G","context":453,"kind":"use","source":1},{"line":1641,"start":196564,"end":196565,"expression":"G","context":453,"kind":"use","source":1},{"line":1641,"start":196583,"end":196601,"expression":"g_{ji}=g_{ij}^{-1}","context":453,"kind":"use","source":1},{"line":1641,"start":196617,"end":196623,"expression":"g_{ij}","context":453,"kind":"use","source":1},{"line":1641,"start":196654,"end":196655,"expression":"i","context":453,"kind":"use","source":1},{"line":1641,"start":196661,"end":196662,"expression":"j","context":453,"kind":"use","source":1},{"line":1641,"start":196694,"end":196717,"expression":"\\gamma=(v_0,\\ldots,v_k)","context":453,"kind":"use","source":1},{"line":1642,"start":196729,"end":196772,"expression":"\nH_\\gamma=g_{v_{k-1}v_k}\\cdots g_{v_0v_1}.\n","context":453,"kind":"use","source":1},{"line":1645,"start":196809,"end":196816,"expression":"v_k=v_0","context":454,"kind":"use","source":1},{"line":1645,"start":196902,"end":196910,"expression":"h_i\\in G","context":455,"kind":"use","source":1},{"line":1646,"start":196925,"end":196972,"expression":"\ng_{ij}=h_jh_i^{-1}\\qquad\\text{on every edge}.\n","context":456,"kind":"use","source":1},{"line":1651,"start":197077,"end":197089,"expression":"H_\\gamma=e_G","context":457,"kind":"use","source":1},{"line":1651,"start":197182,"end":197198,"expression":"h_i\\mapsto h_i k","context":458,"kind":"use","source":1},{"line":1654,"start":197318,"end":197336,"expression":"g_{ij}=h_jh_i^{-1}","context":459,"kind":"use","source":1},{"line":1654,"start":197394,"end":197422,"expression":"H_\\gamma=h_{v_k}h_{v_0}^{-1}","context":460,"kind":"use","source":1},{"line":1654,"start":197488,"end":197489,"expression":"r","context":461,"kind":"use","source":1},{"line":1654,"start":197497,"end":197504,"expression":"h_r=e_G","context":462,"kind":"use","source":1},{"line":1654,"start":197519,"end":197522,"expression":"h_i","context":463,"kind":"use","source":1},{"line":1654,"start":197569,"end":197570,"expression":"r","context":464,"kind":"use","source":1},{"line":1654,"start":197576,"end":197577,"expression":"i","context":465,"kind":"use","source":1},{"line":1654,"start":197645,"end":197651,"expression":"i\\to j","context":466,"kind":"use","source":1},{"line":1654,"start":197697,"end":197698,"expression":"i","context":467,"kind":"use","source":1},{"line":1654,"start":197740,"end":197741,"expression":"j","context":468,"kind":"use","source":1},{"line":1654,"start":197756,"end":197773,"expression":"h_j^{-1}g_{ij}h_i","context":469,"kind":"use","source":1},{"line":1654,"start":197802,"end":197820,"expression":"g_{ij}=h_jh_i^{-1}","context":470,"kind":"use","source":1},{"line":1654,"start":197941,"end":197946,"expression":"h_i k","context":471,"kind":"use","source":1},{"line":1654,"start":197962,"end":197963,"expression":"k","context":472,"kind":"use","source":1},{"line":1657,"start":198019,"end":198022,"expression":"k_i","context":473,"kind":"use","source":1},{"line":1657,"start":198034,"end":198040,"expression":"g_{ij}","context":473,"kind":"use","source":1},{"line":1657,"start":198046,"end":198063,"expression":"k_jg_{ij}k_i^{-1}","context":473,"kind":"use","source":1},{"line":1657,"start":198083,"end":198084,"expression":"r","context":473,"kind":"use","source":1},{"line":1657,"start":198105,"end":198125,"expression":"k_rH_\\gamma k_r^{-1}","context":473,"kind":"use","source":1},{"line":1660,"start":198404,"end":198409,"expression":"G=S_3","context":474,"kind":"use","source":1},{"line":1660,"start":198488,"end":198504,"expression":"A\\to B\\to C\\to A","context":474,"kind":"use","source":1},{"line":1661,"start":198511,"end":198562,"expression":"\ng_{AB}=(12),\\qquad g_{BC}=(23),\\qquad g_{CA}=e_G.\n","context":474,"kind":"use","source":1},{"line":1664,"start":198660,"end":198675,"expression":"(23)(12)\\ne e_G","context":474,"kind":"use","source":1},{"line":1664,"start":198788,"end":198803,"expression":"((23)(12))^{-1}","context":475,"kind":"use","source":1},{"line":1669,"start":199102,"end":199110,"expression":"(23)(12)","context":476,"kind":"use","source":1},{"line":1673,"start":199441,"end":199442,"expression":"G","context":477,"kind":"use","source":1},{"line":1673,"start":199458,"end":199459,"expression":"D","context":477,"kind":"use","source":1},{"line":1673,"start":199485,"end":199493,"expression":"x_i\\in D","context":477,"kind":"use","source":1},{"line":1673,"start":199501,"end":199520,"expression":"x_j=g_{ij}\\cdot x_i","context":477,"kind":"use","source":1},{"line":1676,"start":199839,"end":199847,"expression":"x_r\\in D","context":478,"kind":"use","source":1},{"line":1676,"start":199892,"end":199893,"expression":"r","context":479,"kind":"use","source":1},{"line":1676,"start":199907,"end":199910,"expression":"x_r","context":480,"kind":"use","source":1},{"line":1679,"start":200264,"end":200267,"expression":"x_r","context":481,"kind":"use","source":1},{"line":1679,"start":200295,"end":200298,"expression":"x_i","context":482,"kind":"use","source":1},{"line":1679,"start":200336,"end":200339,"expression":"x_r","context":483,"kind":"use","source":1},{"line":1679,"start":200387,"end":200406,"expression":"g_{ij}\\cdot x_i=x_j","context":484,"kind":"use","source":1},{"line":1683,"start":200748,"end":200759,"expression":"(12)\\in S_3","context":485,"kind":"use","source":1},{"line":1683,"start":200884,"end":200897,"expression":"x_A=x_B=x_C=3","context":485,"kind":"use","source":1},{"line":1683,"start":200922,"end":200926,"expression":"(12)","context":485,"kind":"use","source":1},{"line":1683,"start":200935,"end":200936,"expression":"3","context":485,"kind":"use","source":1},{"line":1689,"start":201415,"end":201416,"expression":"G","context":486,"kind":"use","source":1},{"line":1689,"start":201445,"end":201446,"expression":"d","context":487,"kind":"use","source":1},{"line":1689,"start":201528,"end":201531,"expression":"h_i","context":488,"kind":"use","source":1},{"line":1690,"start":201542,"end":201578,"expression":"\n\\delta_{ij}=d(g_{ij},h_jh_i^{-1}).\n","context":489,"kind":"use","source":1},{"line":1694,"start":201689,"end":201695,"expression":"\\gamma","context":490,"kind":"use","source":1},{"line":1694,"start":201703,"end":201708,"expression":"k\\ge1","context":491,"kind":"use","source":1},{"line":1695,"start":201724,"end":201795,"expression":"\nd(H_\\gamma,e_G)\\le\\sum_{(i,j)\\text{ traversed by }\\gamma}\\delta_{ij}.\n","context":492,"kind":"use","source":1},{"line":1698,"start":201853,"end":201870,"expression":"d(H_\\gamma,e_G)/k","context":493,"kind":"use","source":1},{"line":1701,"start":201968,"end":202003,"expression":"\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i","context":494,"kind":"use","source":1},{"line":1701,"start":202027,"end":202063,"expression":"d(\\widetilde g_{ij},e_G)=\\delta_{ij}","context":495,"kind":"use","source":1},{"line":1701,"start":202099,"end":202119,"expression":"h_r^{-1}H_\\gamma h_r","context":496,"kind":"use","source":1},{"line":1701,"start":202161,"end":202169,"expression":"H_\\gamma","context":497,"kind":"use","source":1},{"line":1701,"start":202324,"end":202377,"expression":"k\\max\\delta_{ij}\\ge\\sum\\delta_{ij}\\ge d(H_\\gamma,e_G)","context":498,"kind":"use","source":1},{"line":1701,"start":202426,"end":202443,"expression":"d(H_\\gamma,e_G)/k","context":499,"kind":"use","source":1},{"line":1709,"start":203610,"end":203617,"expression":"j=0,1,2","context":500,"kind":"use","source":1},{"line":1709,"start":203645,"end":203654,"expression":"(Z_j,d_j)","context":500,"kind":"use","source":1},{"line":1709,"start":203693,"end":203703,"expression":"\\mathcal A","context":500,"kind":"use","source":1},{"line":1709,"start":203764,"end":203769,"expression":"F_j^a","context":500,"kind":"use","source":1},{"line":1712,"start":204094,"end":204109,"expression":"c\\in\\{P,O,R,E\\}","context":501,"kind":"use","source":1},{"line":1713,"start":204118,"end":204158,"expression":"\ng_j^c:Z_j\\longrightarrow(E_c,\\delta_c)\n","context":501,"kind":"use","source":1},{"line":1716,"start":204216,"end":204217,"expression":"P","context":501,"kind":"use","source":1},{"line":1716,"start":204273,"end":204274,"expression":"O","context":501,"kind":"use","source":1},{"line":1716,"start":204311,"end":204312,"expression":"R","context":501,"kind":"use","source":1},{"line":1716,"start":204377,"end":204378,"expression":"E","context":501,"kind":"use","source":1},{"line":1718,"start":204700,"end":204706,"expression":"\\ell^1","context":502,"kind":"use","source":1},{"line":1720,"start":205064,"end":205076,"expression":"T:Z_i\\to Z_j","context":503,"kind":"use","source":1},{"line":1721,"start":205088,"end":205275,"expression":"\n\\begin{split}\n\\varepsilon_{\\rm dyn}(T)\n &=\\sup_{z,a}d_j\\bigl(TF_i^a(z),F_j^aT(z)\\bigr),\\\\\n\\varepsilon_c(T)\n &=\\sup_z\\delta_c\\bigl(g_j^cT(z),g_i^c(z)\\bigr)\n \\quad(c=P,O,R,E).\n\\end{split}\n","context":504,"kind":"use","source":1},{"line":1731,"start":205318,"end":205417,"expression":"\n\\mathfrak D(T)=\n(\\varepsilon_{\\rm dyn},\\varepsilon_P,\\varepsilon_O,\n\\varepsilon_R,\\varepsilon_E).\n","context":505,"kind":"use","source":1},{"line":1739,"start":205816,"end":205828,"expression":"T:Z_0\\to Z_1","context":506,"kind":"use","source":1},{"line":1739,"start":205835,"end":205847,"expression":"U:Z_1\\to Z_2","context":507,"kind":"use","source":1},{"line":1739,"start":205917,"end":205918,"expression":"U","context":508,"kind":"use","source":1},{"line":1739,"start":205924,"end":205925,"expression":"L","context":509,"kind":"use","source":1},{"line":1740,"start":205945,"end":206029,"expression":"\n\\varepsilon_{\\rm dyn}(UT)\n\\leq L\\varepsilon_{\\rm dyn}(T)+\\varepsilon_{\\rm dyn}(U),\n","context":510,"kind":"use","source":1},{"line":1744,"start":206059,"end":206074,"expression":"c\\in\\{P,O,R,E\\}","context":510,"kind":"use","source":1},{"line":1745,"start":206079,"end":206136,"expression":"\n\\varepsilon_c(UT)\\leq\\varepsilon_c(T)+\\varepsilon_c(U).\n","context":510,"kind":"use","source":1},{"line":1751,"start":206304,"end":206314,"expression":"UF_1^aT(z)","context":511,"kind":"use","source":1},{"line":1751,"start":206325,"end":206335,"expression":"UTF_0^a(z)","context":512,"kind":"use","source":1},{"line":1751,"start":206342,"end":206352,"expression":"F_2^aUT(z)","context":513,"kind":"use","source":1},{"line":1751,"start":206410,"end":206411,"expression":"U","context":514,"kind":"use","source":1},{"line":1751,"start":206438,"end":206463,"expression":"L\\varepsilon_{\\rm dyn}(T)","context":515,"kind":"use","source":1},{"line":1751,"start":206470,"end":206494,"expression":"\\varepsilon_{\\rm dyn}(U)","context":516,"kind":"use","source":1},{"line":1751,"start":206521,"end":206522,"expression":"c","context":517,"kind":"use","source":1},{"line":1751,"start":206533,"end":206542,"expression":"g_1^cT(z)","context":518,"kind":"use","source":1},{"line":1751,"start":206553,"end":206563,"expression":"g_2^cUT(z)","context":519,"kind":"use","source":1},{"line":1751,"start":206570,"end":206578,"expression":"g_0^c(z)","context":520,"kind":"use","source":1},{"line":1751,"start":206630,"end":206633,"expression":"E_c","context":521,"kind":"use","source":1},{"line":1759,"start":207666,"end":207675,"expression":"(1,1,1,1)","context":522,"kind":"use","source":1},{"line":1766,"start":209121,"end":209139,"expression":"x_i'=x_i\\oplus c_i","context":523,"kind":"use","source":1},{"line":1767,"start":209173,"end":209210,"expression":"\nb_{ij}'=b_{ij}\\oplus c_i\\oplus c_j.\n","context":523,"kind":"use","source":1},{"line":1772,"start":209507,"end":209510,"expression":"w_e","context":524,"kind":"use","source":1},{"line":1772,"start":209641,"end":209651,"expression":"\\min_e w_e","context":525,"kind":"use","source":1},{"line":1775,"start":209848,"end":209851,"expression":"c_i","context":526,"kind":"use","source":1},{"line":1792,"start":212252,"end":212266,"expression":"E_1,\\ldots,E_n","context":527,"kind":"use","source":1},{"line":1792,"start":212324,"end":212334,"expression":"\\sigma^2>0","context":528,"kind":"use","source":1},{"line":1792,"start":212375,"end":212387,"expression":"\\rho\\in[0,1]","context":529,"kind":"use","source":1},{"line":1793,"start":212411,"end":212532,"expression":"\\label{eq:correlated}\n\\operatorname{Var}\\left(\\frac1n\\sum_{i=1}^n E_i\\right)\n=\\frac{\\sigma^2}{n}\\bigl(1+(n-1)\\rho\\bigr).\n","context":530,"kind":"use","source":1},{"line":1797,"start":212620,"end":212626,"expression":"n(n-1)","context":531,"kind":"use","source":1},{"line":1798,"start":212798,"end":212839,"expression":"\nn_{\\mathrm{eff}}=\\frac{n}{1+(n-1)\\rho}.\n","context":532,"kind":"use","source":1},{"line":1805,"start":213376,"end":213377,"expression":"M","context":533,"kind":"introduction-passage","source":1},{"line":1805,"start":213459,"end":213469,"expression":"\\theta=0,1","context":533,"kind":"introduction-passage","source":1},{"line":1805,"start":213496,"end":213529,"expression":"\\Pr(\\theta=1\\mid M)=\\Pr(\\theta=1)","context":533,"kind":"introduction-passage","source":1},{"line":1826,"start":216303,"end":216319,"expression":"\\theta\\in\\{0,1\\}","context":534,"kind":"use","source":1},{"line":1826,"start":216366,"end":216367,"expression":"t","context":535,"kind":"use","source":1},{"line":1826,"start":216396,"end":216409,"expression":"s_t\\in\\{0,1\\}","context":536,"kind":"use","source":1},{"line":1827,"start":216418,"end":216465,"expression":"\n\\Prob(s_t=\\theta\\mid\\theta)=p,\\qquad 1/2<p<1.\n","context":537,"kind":"use","source":1},{"line":1830,"start":216508,"end":216514,"expression":"\\theta","context":538,"kind":"use","source":1},{"line":1830,"start":216614,"end":216632,"expression":"a_1,\\ldots,a_{t-1}","context":539,"kind":"use","source":1},{"line":1830,"start":216668,"end":216681,"expression":"a_t\\in\\{0,1\\}","context":540,"kind":"use","source":1},{"line":1830,"start":216724,"end":216730,"expression":"\\theta","context":541,"kind":"use","source":1},{"line":1832,"start":217285,"end":217302,"expression":"\\lambda=p/(1-p)>1","context":542,"kind":"use","source":1},{"line":1832,"start":217362,"end":217363,"expression":"z","context":542,"kind":"use","source":1},{"line":1832,"start":217429,"end":217438,"expression":"\\lambda^z","context":542,"kind":"use","source":1},{"line":1832,"start":217505,"end":217507,"expression":"+1","context":542,"kind":"use","source":1},{"line":1832,"start":217513,"end":217515,"expression":"-1","context":542,"kind":"use","source":1},{"line":1832,"start":217522,"end":217536,"expression":"z\\in\\{-1,0,1\\}","context":542,"kind":"use","source":1},{"line":1832,"start":217601,"end":217602,"expression":"z","context":542,"kind":"use","source":1},{"line":1832,"start":217613,"end":217614,"expression":"2","context":542,"kind":"use","source":1},{"line":1832,"start":217695,"end":217696,"expression":"1","context":543,"kind":"use","source":1},{"line":1832,"start":217864,"end":217868,"expression":"z=-2","context":544,"kind":"use","source":1},{"line":1836,"start":218122,"end":218186,"expression":"\\label{eq:cascade-error}\n\\eta(p)=\\frac{(1-p)^2}{p^2+(1-p)^2}>0.\n","context":545,"kind":"use","source":1},{"line":1839,"start":218250,"end":218252,"expression":"2r","context":546,"kind":"use","source":1},{"line":1839,"start":218268,"end":218279,"expression":"[2p(1-p)]^r","context":547,"kind":"use","source":1},{"line":1839,"start":218354,"end":218360,"expression":"\\theta","context":548,"kind":"use","source":1},{"line":1842,"start":218605,"end":218607,"expression":"+2","context":549,"kind":"use","source":1},{"line":1842,"start":218613,"end":218615,"expression":"-2","context":550,"kind":"use","source":1},{"line":1842,"start":218732,"end":218735,"expression":"p^2","context":551,"kind":"use","source":1},{"line":1842,"start":218774,"end":218781,"expression":"(1-p)^2","context":552,"kind":"use","source":1},{"line":1842,"start":218822,"end":218829,"expression":"2p(1-p)","context":553,"kind":"use","source":1},{"line":1842,"start":218935,"end":218944,"expression":"2p(1-p)<1","context":554,"kind":"use","source":1},{"line":1842,"start":218970,"end":218971,"expression":"r","context":555,"kind":"use","source":1},{"line":1843,"start":219091,"end":219158,"expression":"\n\\sum_{r=0}^{\\infty}[2p(1-p)]^r(1-p)^2\n=\\frac{(1-p)^2}{1-2p(1-p)},\n","context":556,"kind":"use","source":1},{"line":1850,"start":219375,"end":219380,"expression":"p=3/4","context":557,"kind":"use","source":1},{"line":1850,"start":219418,"end":219422,"expression":"1/10","context":557,"kind":"use","source":1},{"line":1853,"start":219994,"end":220010,"expression":"\\widehat\\theta_n","context":558,"kind":"use","source":1},{"line":1857,"start":220214,"end":220301,"expression":"\n\\Prob(\\widehat\\theta_n\\ne\\theta)\n\\leq \\min\\left\\{1,\\frac{p(1-p)}{n(p-1/2)^2}\\right\\}.\n","context":559,"kind":"use","source":1},{"line":1861,"start":220347,"end":220348,"expression":"n","context":559,"kind":"use","source":1},{"line":1864,"start":220425,"end":220431,"expression":"\\theta","context":559,"kind":"use","source":1},{"line":1864,"start":220450,"end":220472,"expression":"\\mathbf1\\{s_t=\\theta\\}","context":559,"kind":"use","source":1},{"line":1864,"start":220521,"end":220522,"expression":"p","context":560,"kind":"use","source":1},{"line":1864,"start":220538,"end":220544,"expression":"p(1-p)","context":561,"kind":"use","source":1},{"line":1864,"start":220606,"end":220609,"expression":"1/2","context":562,"kind":"use","source":1},{"line":1864,"start":220689,"end":220708,"expression":"p(1-p)/[n(p-1/2)^2]","context":563,"kind":"use","source":1},{"line":1864,"start":220760,"end":220766,"expression":"\\theta","context":564,"kind":"use","source":1},{"line":1872,"start":221426,"end":221431,"expression":"p=3/4","context":565,"kind":"use","source":1},{"line":1872,"start":221519,"end":221523,"expression":"1/10","context":565,"kind":"use","source":1},{"line":1886,"start":223981,"end":223982,"expression":"J","context":566,"kind":"use","source":1},{"line":1886,"start":224016,"end":224017,"expression":"W","context":566,"kind":"use","source":1},{"line":1886,"start":224082,"end":224088,"expression":"\\sim_i","context":566,"kind":"use","source":1},{"line":1886,"start":224116,"end":224117,"expression":"i","context":566,"kind":"use","source":1},{"line":1888,"start":224385,"end":224392,"expression":"\\varphi","context":567,"kind":"use","source":1},{"line":1888,"start":224396,"end":224406,"expression":"K_i\\varphi","context":567,"kind":"use","source":1},{"line":1888,"start":224418,"end":224419,"expression":"w","context":567,"kind":"use","source":1},{"line":1888,"start":224427,"end":224434,"expression":"\\varphi","context":567,"kind":"use","source":1},{"line":1888,"start":224452,"end":224461,"expression":"v\\sim_i w","context":567,"kind":"use","source":1},{"line":1888,"start":224469,"end":224508,"expression":"E_J\\varphi=\\bigwedge_{i\\in J}K_i\\varphi","context":567,"kind":"use","source":1},{"line":1889,"start":224559,"end":224631,"expression":"\nC_J\\varphi=\\bigwedge_{n\\ge0}E_J^n\\varphi,\n\\qquad E_J^0\\varphi=\\varphi.\n","context":567,"kind":"use","source":1},{"line":1896,"start":225013,"end":225032,"expression":"\\mathsf{Reach}_J(w)","context":568,"kind":"use","source":1},{"line":1896,"start":225064,"end":225065,"expression":"w","context":568,"kind":"use","source":1},{"line":1896,"start":225099,"end":225105,"expression":"\\sim_i","context":568,"kind":"use","source":1},{"line":1896,"start":225113,"end":225119,"expression":"i\\in J","context":568,"kind":"use","source":1},{"line":1897,"start":225162,"end":225263,"expression":"\nw\\models C_J\\varphi\\quad\\Longleftrightarrow\\quad\n\\mathsf{Reach}_J(w)\\subseteq\\{v:v\\models\\varphi\\}.\n","context":568,"kind":"use","source":1},{"line":1903,"start":225312,"end":225313,"expression":"n","context":568,"kind":"use","source":1},{"line":1903,"start":225327,"end":225339,"expression":"E_J^n\\varphi","context":569,"kind":"use","source":1},{"line":1903,"start":225351,"end":225358,"expression":"\\varphi","context":570,"kind":"use","source":1},{"line":1903,"start":225395,"end":225396,"expression":"n","context":571,"kind":"use","source":1},{"line":1903,"start":225459,"end":225460,"expression":"n","context":572,"kind":"use","source":1},{"line":1907,"start":225616,"end":225627,"expression":"W=\\{0,1,2\\}","context":573,"kind":"use","source":1},{"line":1907,"start":225638,"end":225645,"expression":"\\varphi","context":573,"kind":"use","source":1},{"line":1907,"start":225664,"end":225667,"expression":"0,1","context":573,"kind":"use","source":1},{"line":1907,"start":225677,"end":225678,"expression":"A","context":573,"kind":"use","source":1},{"line":1907,"start":225695,"end":225711,"expression":"\\{0,1\\}\\mid\\{2\\}","context":573,"kind":"use","source":1},{"line":1907,"start":225725,"end":225726,"expression":"B","context":573,"kind":"use","source":1},{"line":1907,"start":225743,"end":225759,"expression":"\\{0\\}\\mid\\{1,2\\}","context":573,"kind":"use","source":1},{"line":1907,"start":225772,"end":225773,"expression":"0","context":573,"kind":"use","source":1},{"line":1907,"start":225794,"end":225801,"expression":"\\varphi","context":573,"kind":"use","source":1},{"line":1907,"start":225824,"end":225839,"expression":"0\\sim_A1\\sim_B2","context":573,"kind":"use","source":1},{"line":1907,"start":225882,"end":225900,"expression":"E_{\\{A,B\\}}\\varphi","context":573,"kind":"use","source":1},{"line":1907,"start":225912,"end":225913,"expression":"0","context":573,"kind":"use","source":1},{"line":1907,"start":225920,"end":225938,"expression":"C_{\\{A,B\\}}\\varphi","context":573,"kind":"use","source":1},{"line":1913,"start":226094,"end":226095,"expression":"0","context":574,"kind":"use","source":1},{"line":1913,"start":226137,"end":226144,"expression":"\\varphi","context":574,"kind":"use","source":1},{"line":1913,"start":226217,"end":226218,"expression":"2","context":574,"kind":"use","source":1},{"line":1913,"start":226228,"end":226235,"expression":"\\varphi","context":574,"kind":"use","source":1},{"line":1917,"start":226469,"end":226470,"expression":"p","context":575,"kind":"use","source":1},{"line":1917,"start":226565,"end":226566,"expression":"W","context":575,"kind":"use","source":1},{"line":1917,"start":226572,"end":226592,"expression":"W_p=\\{w:w\\models p\\}","context":575,"kind":"use","source":1},{"line":1917,"start":226615,"end":226621,"expression":"\\sim_i","context":575,"kind":"use","source":1},{"line":1917,"start":226790,"end":226791,"expression":"p","context":576,"kind":"use","source":1},{"line":1917,"start":226839,"end":226843,"expression":"C_Jp","context":577,"kind":"use","source":1},{"line":1924,"start":228134,"end":228137,"expression":"K_i","context":578,"kind":"use","source":1},{"line":1927,"start":228845,"end":228846,"expression":"A","context":579,"kind":"use","source":1},{"line":1927,"start":228867,"end":228868,"expression":"B","context":579,"kind":"use","source":1},{"line":1929,"start":228973,"end":228980,"expression":"W_A,W_B","context":580,"kind":"use","source":1},{"line":1929,"start":229037,"end":229049,"expression":"T:W_A\\to W_B","context":580,"kind":"use","source":1},{"line":1929,"start":229138,"end":229139,"expression":"i","context":580,"kind":"use","source":1},{"line":1930,"start":229164,"end":229333,"expression":"\nw\\sim_i^A v&\\ \\Longrightarrow\\ T(w)\\sim_i^B T(v) \\quad\\text{(forth)},\\\\\nT(w)\\sim_i^B z&\\ \\Longrightarrow\\ \\exists v:\\ w\\sim_i^A v\\text{ and }T(v)=z\n\\quad\\text{(back)}.\n","context":581,"kind":"use","source":1},{"line":1938,"start":229548,"end":229549,"expression":"w","context":582,"kind":"use","source":1},{"line":1938,"start":229556,"end":229560,"expression":"T(w)","context":583,"kind":"use","source":1},{"line":1938,"start":229648,"end":229651,"expression":"K_i","context":584,"kind":"use","source":1},{"line":1938,"start":229659,"end":229662,"expression":"C_J","context":585,"kind":"use","source":1},{"line":1941,"start":230011,"end":230014,"expression":"K_i","context":586,"kind":"use","source":1},{"line":1950,"start":231592,"end":231602,"expression":"\\mathcal W","context":587,"kind":"use","source":1},{"line":1950,"start":231707,"end":231708,"expression":"n","context":587,"kind":"use","source":1},{"line":1950,"start":231839,"end":231849,"expression":"\\mathcal W","context":587,"kind":"use","source":1},{"line":1953,"start":232161,"end":232162,"expression":"C","context":588,"kind":"use","source":1},{"line":1954,"start":232283,"end":232343,"expression":"\nC\\cap W\\ne\\varnothing\\quad\\text{for every }W\\in\\mathcal W.\n","context":589,"kind":"use","source":1},{"line":1957,"start":232451,"end":232461,"expression":"\\mathcal W","context":589,"kind":"use","source":1},{"line":1957,"start":232480,"end":232481,"expression":"q","context":590,"kind":"use","source":1},{"line":1957,"start":232487,"end":232488,"expression":"n","context":591,"kind":"use","source":1},{"line":1957,"start":232501,"end":232514,"expression":"1\\leq q\\leq n","context":592,"kind":"use","source":1},{"line":1957,"start":232524,"end":232529,"expression":"n-q+1","context":593,"kind":"use","source":1},{"line":1960,"start":232568,"end":232569,"expression":"C","context":594,"kind":"use","source":1},{"line":1960,"start":232643,"end":232644,"expression":"C","context":595,"kind":"use","source":1},{"line":1960,"start":232735,"end":232736,"expression":"W","context":596,"kind":"use","source":1},{"line":1960,"start":232756,"end":232757,"expression":"C","context":597,"kind":"use","source":1},{"line":1960,"start":232816,"end":232817,"expression":"C","context":598,"kind":"use","source":1},{"line":1960,"start":232873,"end":232874,"expression":"C","context":599,"kind":"use","source":1},{"line":1960,"start":232915,"end":232916,"expression":"q","context":600,"kind":"use","source":1},{"line":1960,"start":232949,"end":232956,"expression":"n-|C|<q","context":601,"kind":"use","source":1},{"line":1960,"start":232963,"end":232976,"expression":"|C|\\geq n-q+1","context":602,"kind":"use","source":1},{"line":1975,"start":235146,"end":235156,"expression":"\\mathcal H","context":603,"kind":"use","source":1},{"line":1975,"start":235204,"end":235226,"expression":"a:\\mathcal H\\to\\{0,1\\}","context":603,"kind":"use","source":1},{"line":1975,"start":235338,"end":235363,"expression":"R:\\mathcal H\\to\\mathcal R","context":603,"kind":"use","source":1},{"line":1978,"start":235631,"end":235653,"expression":"f:\\mathcal R\\to\\{0,1\\}","context":604,"kind":"use","source":1},{"line":1978,"start":235667,"end":235679,"expression":"f(R(h))=a(h)","context":605,"kind":"use","source":1},{"line":1978,"start":235690,"end":235704,"expression":"h\\in\\mathcal H","context":606,"kind":"use","source":1},{"line":1978,"start":235722,"end":235723,"expression":"a","context":607,"kind":"use","source":1},{"line":1978,"start":235765,"end":235766,"expression":"R","context":608,"kind":"use","source":1},{"line":1978,"start":236049,"end":236052,"expression":"1/2","context":609,"kind":"use","source":1},{"line":1981,"start":236110,"end":236120,"expression":"R(h)=R(h')","context":610,"kind":"use","source":1},{"line":1981,"start":236268,"end":236272,"expression":"f(r)","context":611,"kind":"use","source":1},{"line":1981,"start":236344,"end":236345,"expression":"R","context":612,"kind":"use","source":1},{"line":1981,"start":236553,"end":236556,"expression":"1/2","context":613,"kind":"use","source":1},{"line":2008,"start":240804,"end":240828,"expression":"x_t\\in\\mathbb R_{\\ge0}^n","context":614,"kind":"use","source":1},{"line":2008,"start":240864,"end":240865,"expression":"n","context":615,"kind":"use","source":1},{"line":2009,"start":240966,"end":241049,"expression":"\\label{eq:propagation}\nx_{t+1}\\le Bx_t+w_t\n\\quad\\text{componentwise},\\qquad B\\ge0,\n","context":616,"kind":"use","source":1},{"line":2013,"start":241071,"end":241074,"expression":"w_t","context":617,"kind":"use","source":1},{"line":2013,"start":241110,"end":241111,"expression":"B","context":618,"kind":"use","source":1},{"line":2013,"start":241164,"end":241167,"expression":"v>0","context":619,"kind":"use","source":1},{"line":2013,"start":241174,"end":241182,"expression":"\\kappa<1","context":620,"kind":"use","source":1},{"line":2013,"start":241193,"end":241206,"expression":"Bv\\le\\kappa v","context":621,"kind":"use","source":1},{"line":2013,"start":241239,"end":241273,"expression":"\\norm{x}_{v,\\infty}=\\max_i x_i/v_i","context":622,"kind":"use","source":1},{"line":2014,"start":241301,"end":241439,"expression":"\\label{eq:propagation-bound}\n\\norm{x_t}_{v,\\infty}\\le\n\\kappa^t\\norm{x_0}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n","context":623,"kind":"use","source":1},{"line":2019,"start":241559,"end":241589,"expression":"\\norm{w_t}_{v,\\infty}\\le\\bar w","context":624,"kind":"use","source":1},{"line":2019,"start":241618,"end":241647,"expression":"\\bar w(1-\\kappa^t)/(1-\\kappa)","context":625,"kind":"use","source":1},{"line":2019,"start":241772,"end":241773,"expression":"B","context":626,"kind":"use","source":1},{"line":2025,"start":242605,"end":242606,"expression":"i","context":627,"kind":"use","source":1},{"line":2025,"start":242621,"end":242622,"expression":"T","context":627,"kind":"use","source":1},{"line":2025,"start":242774,"end":242775,"expression":"i","context":627,"kind":"use","source":1},{"line":2057,"start":248557,"end":248560,"expression":"G_t","context":628,"kind":"introduction-passage","source":1},{"line":2057,"start":248612,"end":248615,"expression":"r_t","context":628,"kind":"introduction-passage","source":1},{"line":2057,"start":248646,"end":248649,"expression":"c_t","context":628,"kind":"introduction-passage","source":1},{"line":2058,"start":248735,"end":248809,"expression":"\n(G_{t+1},r_{t+1},c_{t+1})\\sim\n\\Gamma_{I_t}(\\,\\cdot\\mid G_t,r_t,c_t,H_t),\n","context":629,"kind":"introduction-passage","source":1},{"line":2062,"start":248819,"end":248822,"expression":"H_t","context":630,"kind":"introduction-passage","source":1},{"line":2064,"start":249563,"end":249569,"expression":"\\Gamma","context":631,"kind":"use","source":1},{"line":2067,"start":249794,"end":249798,"expression":"2c_g","context":632,"kind":"use","source":1},{"line":2067,"start":249834,"end":249840,"expression":"2c_s+b","context":632,"kind":"use","source":1},{"line":2067,"start":249850,"end":249851,"expression":"b","context":632,"kind":"use","source":1},{"line":2067,"start":249925,"end":249926,"expression":"h","context":632,"kind":"use","source":1},{"line":2067,"start":249955,"end":249956,"expression":"T","context":632,"kind":"use","source":1},{"line":2068,"start":250031,"end":250062,"expression":"\nT\\bigl[2(c_g-c_s)-b\\bigr]>2h.\n","context":632,"kind":"use","source":1},{"line":2078,"start":251406,"end":251407,"expression":"J","context":633,"kind":"use","source":1},{"line":2078,"start":251483,"end":251484,"expression":"A","context":633,"kind":"use","source":1},{"line":2078,"start":251519,"end":251524,"expression":"(j,a)","context":633,"kind":"use","source":1},{"line":2078,"start":251544,"end":251545,"expression":"a","context":633,"kind":"use","source":1},{"line":2078,"start":251592,"end":251593,"expression":"j","context":633,"kind":"use","source":1},{"line":2078,"start":251722,"end":251730,"expression":"f:J\\to A","context":633,"kind":"use","source":1},{"line":2078,"start":251756,"end":251760,"expression":"N(S)","context":634,"kind":"use","source":1},{"line":2078,"start":251810,"end":251822,"expression":"S\\subseteq J","context":635,"kind":"use","source":1},{"line":2083,"start":252204,"end":252219,"expression":"0\\leq k\\leq |A|","context":636,"kind":"use","source":1},{"line":2083,"start":252277,"end":252289,"expression":"F\\subseteq A","context":636,"kind":"use","source":1},{"line":2083,"start":252297,"end":252306,"expression":"|F|\\leq k","context":636,"kind":"use","source":1},{"line":2084,"start":252339,"end":252425,"expression":"\\label{eq:robust-hall}\n|N(S)|\\geq |S|+k\n\\qquad\\text{for every nonempty }S\\subseteq J.\n","context":636,"kind":"use","source":1},{"line":2091,"start":252638,"end":252639,"expression":"S","context":637,"kind":"use","source":1},{"line":2091,"start":252657,"end":252662,"expression":"|S|+k","context":638,"kind":"use","source":1},{"line":2091,"start":252682,"end":252698,"expression":"\\min\\{k,|N(S)|\\}","context":639,"kind":"use","source":1},{"line":2091,"start":252732,"end":252735,"expression":"|S|","context":640,"kind":"use","source":1},{"line":2091,"start":252774,"end":252775,"expression":"S","context":641,"kind":"use","source":1},{"line":2093,"start":252820,"end":252821,"expression":"F","context":642,"kind":"use","source":1},{"line":2093,"start":252840,"end":252841,"expression":"k","context":643,"kind":"use","source":1},{"line":2093,"start":252877,"end":252878,"expression":"S","context":643,"kind":"use","source":1},{"line":2093,"start":252897,"end":252912,"expression":"|N(S)|-k\\geq|S|","context":643,"kind":"use","source":1},{"line":2093,"start":253245,"end":253246,"expression":"S","context":644,"kind":"use","source":1},{"line":2093,"start":253274,"end":253275,"expression":"B","context":645,"kind":"use","source":1},{"line":2093,"start":253316,"end":253317,"expression":"S","context":646,"kind":"use","source":1},{"line":2093,"start":253326,"end":253327,"expression":"B","context":647,"kind":"use","source":1},{"line":2093,"start":253349,"end":253350,"expression":"B","context":648,"kind":"use","source":1},{"line":2093,"start":253436,"end":253450,"expression":"|N(S)|=|B|<|S|","context":649,"kind":"use","source":1},{"line":2097,"start":253627,"end":253693,"expression":"\n\\sigma=\\min_{\\varnothing\\ne S\\subseteq J}\\bigl(|N(S)|-|S|\\bigr).\n","context":650,"kind":"use","source":1},{"line":2100,"start":253730,"end":253741,"expression":"k\\leq\\sigma","context":650,"kind":"use","source":1},{"line":2103,"start":254215,"end":254218,"expression":"a,b","context":651,"kind":"use","source":1},{"line":2103,"start":254435,"end":254438,"expression":"k=1","context":651,"kind":"use","source":1},{"line":2106,"start":254580,"end":254587,"expression":"\\{a,b\\}","context":652,"kind":"use","source":1},{"line":2106,"start":254591,"end":254598,"expression":"\\{b,c\\}","context":652,"kind":"use","source":1},{"line":2106,"start":254606,"end":254613,"expression":"\\{c,d\\}","context":652,"kind":"use","source":1},{"line":2106,"start":254679,"end":254682,"expression":"k=1","context":652,"kind":"use","source":1},{"line":2118,"start":255741,"end":255742,"expression":"A","context":653,"kind":"use","source":1},{"line":2118,"start":255820,"end":255821,"expression":"B","context":653,"kind":"use","source":1},{"line":2118,"start":255851,"end":255852,"expression":"C","context":653,"kind":"use","source":1},{"line":2118,"start":255869,"end":255870,"expression":"A","context":653,"kind":"use","source":1},{"line":2118,"start":255890,"end":255891,"expression":"B","context":653,"kind":"use","source":1},{"line":2118,"start":255932,"end":255933,"expression":"C","context":653,"kind":"use","source":1},{"line":2118,"start":255998,"end":256009,"expression":"A\\to B\\to C","context":653,"kind":"use","source":1},{"line":2118,"start":256017,"end":256018,"expression":"C","context":653,"kind":"use","source":1},{"line":2118,"start":256081,"end":256082,"expression":"C","context":654,"kind":"use","source":1},{"line":2118,"start":256139,"end":256142,"expression":"1/2","context":655,"kind":"use","source":1},{"line":2139,"start":259483,"end":259484,"expression":"S","context":656,"kind":"use","source":1},{"line":2139,"start":259731,"end":259739,"expression":"h:S\\to Y","context":656,"kind":"use","source":1},{"line":2139,"start":259908,"end":259911,"expression":"B_0","context":657,"kind":"use","source":1},{"line":2139,"start":259940,"end":259941,"expression":"h","context":658,"kind":"use","source":1},{"line":2141,"start":259974,"end":259975,"expression":"U","context":659,"kind":"use","source":1},{"line":2141,"start":260528,"end":260529,"expression":"U","context":660,"kind":"use","source":1},{"line":2143,"start":260543,"end":260544,"expression":"s","context":661,"kind":"use","source":1},{"line":2143,"start":260552,"end":260567,"expression":"A(s)\\subseteq U","context":661,"kind":"use","source":1},{"line":2143,"start":260870,"end":260892,"expression":"\\Delta(s,u)\\subseteq S","context":661,"kind":"use","source":1},{"line":2143,"start":260954,"end":260957,"expression":"s,u","context":662,"kind":"use","source":1},{"line":2145,"start":261150,"end":261156,"expression":"\\Delta","context":663,"kind":"use","source":1},{"line":2145,"start":261432,"end":261438,"expression":"\\Delta","context":663,"kind":"use","source":1},{"line":2147,"start":261619,"end":261642,"expression":"S_{\\rm safe}\\subseteq S","context":664,"kind":"use","source":1},{"line":2153,"start":262663,"end":262737,"expression":"\n\\mathcal B=\\{B\\subseteq S:B\\ne\\varnothing,\\ h\\text{ is constant on }B\\}.\n","context":665,"kind":"introduction-passage","source":1},{"line":2156,"start":262818,"end":262819,"expression":"B","context":665,"kind":"introduction-passage","source":1},{"line":2157,"start":262886,"end":262914,"expression":"\nA(B)=\\bigcap_{s\\in B}A(s).\n","context":665,"kind":"introduction-passage","source":1},{"line":2160,"start":262922,"end":262931,"expression":"u\\in A(B)","context":666,"kind":"introduction-passage","source":1},{"line":2160,"start":262964,"end":262965,"expression":"y","context":667,"kind":"introduction-passage","source":1},{"line":2161,"start":262991,"end":263100,"expression":"\\label{eq:belief-update}\n\\operatorname{Post}(B,u,y)=\n\\left(\\bigcup_{s\\in B}\\Delta(s,u)\\right)\\cap h^{-1}(y).\n","context":668,"kind":"introduction-passage","source":1},{"line":2165,"start":263178,"end":263202,"expression":"\\operatorname{Succ}(B,u)","context":669,"kind":"introduction-passage","source":1},{"line":2167,"start":263457,"end":263458,"expression":"u","context":670,"kind":"use","source":1},{"line":2167,"start":263625,"end":263626,"expression":"u","context":670,"kind":"use","source":1},{"line":2171,"start":263946,"end":264119,"expression":"\nW_0&=\\{B\\in\\mathcal B:B\\subseteq S_{\\rm safe}\\},\\label{eq:belief-w0}\\\\\nW_{k+1}&=\\{B\\in W_0:\\exists u\\in A(B),\\\n\\operatorname{Succ}(B,u)\\subseteq W_k\\}.\\label{eq:belief-wk}\n","context":671,"kind":"introduction-passage","source":1},{"line":2176,"start":264188,"end":264200,"expression":"|\\mathcal B|","context":672,"kind":"introduction-passage","source":1},{"line":2176,"start":264253,"end":264256,"expression":"W_*","context":672,"kind":"introduction-passage","source":1},{"line":2179,"start":264589,"end":264595,"expression":"k\\geq0","context":673,"kind":"use","source":1},{"line":2179,"start":264599,"end":264607,"expression":"B\\in W_k","context":674,"kind":"use","source":1},{"line":2179,"start":264780,"end":264792,"expression":"S_{\\rm safe}","context":675,"kind":"use","source":1},{"line":2179,"start":264808,"end":264809,"expression":"k","context":675,"kind":"use","source":1},{"line":2179,"start":264845,"end":264851,"expression":"s\\in B","context":675,"kind":"use","source":1},{"line":2179,"start":264865,"end":264873,"expression":"B\\in W_*","context":675,"kind":"use","source":1},{"line":2179,"start":264957,"end":264960,"expression":"W_*","context":676,"kind":"use","source":1},{"line":2179,"start":265021,"end":265022,"expression":"B","context":677,"kind":"use","source":1},{"line":2182,"start":265104,"end":265127,"expression":"B\\subseteq S_{\\rm safe}","context":678,"kind":"use","source":1},{"line":2182,"start":265236,"end":265240,"expression":"A(B)","context":679,"kind":"use","source":1},{"line":2184,"start":265474,"end":265477,"expression":"W_k","context":680,"kind":"use","source":1},{"line":2184,"start":265563,"end":265571,"expression":"B\\in W_*","context":680,"kind":"use","source":1},{"line":2184,"start":265628,"end":265631,"expression":"W_*","context":680,"kind":"use","source":1},{"line":2184,"start":265868,"end":265871,"expression":"W_k","context":681,"kind":"use","source":1},{"line":2184,"start":265962,"end":265963,"expression":"B","context":682,"kind":"use","source":1},{"line":2184,"start":265988,"end":265989,"expression":"B","context":683,"kind":"use","source":1},{"line":2187,"start":266338,"end":266339,"expression":"S","context":684,"kind":"use","source":1},{"line":2194,"start":267213,"end":267236,"expression":"G\\subseteq S_{\\rm safe}","context":685,"kind":"use","source":1},{"line":2194,"start":267370,"end":267371,"expression":"G","context":685,"kind":"use","source":1},{"line":2195,"start":267380,"end":267485,"expression":"\n\\mathcal G=\\{B\\in W_*:B\\subseteq G\\},\n\\quad\nA_*(B)=\\{u\\in A(B):\\operatorname{Succ}(B,u)\\subseteq W_*\\}.\n","context":685,"kind":"use","source":1},{"line":2200,"start":267496,"end":267510,"expression":"R_0=\\mathcal G","context":685,"kind":"use","source":1},{"line":2201,"start":267532,"end":267652,"expression":"\\label{eq:progress-attractor}\nR_{k+1}=R_k\\cup\n\\{B\\in W_*:\\exists u\\in A_*(B),\\\n\\operatorname{Succ}(B,u)\\subseteq R_k\\}.\n","context":685,"kind":"use","source":1},{"line":2206,"start":267706,"end":267709,"expression":"R_*","context":686,"kind":"use","source":1},{"line":2206,"start":267717,"end":267725,"expression":"B\\in R_*","context":687,"kind":"use","source":1},{"line":2206,"start":267733,"end":267737,"expression":"r(B)","context":688,"kind":"use","source":1},{"line":2209,"start":267865,"end":267866,"expression":"B","context":689,"kind":"use","source":1},{"line":2209,"start":267877,"end":267880,"expression":"R_k","context":690,"kind":"use","source":1},{"line":2209,"start":267983,"end":267984,"expression":"k","context":691,"kind":"use","source":1},{"line":2209,"start":268057,"end":268060,"expression":"R_*","context":691,"kind":"use","source":1},{"line":2209,"start":268253,"end":268254,"expression":"r","context":692,"kind":"use","source":1},{"line":2209,"start":268283,"end":268287,"expression":"r(B)","context":693,"kind":"use","source":1},{"line":2209,"start":268342,"end":268345,"expression":"W_*","context":694,"kind":"use","source":1},{"line":2212,"start":268494,"end":268497,"expression":"r>0","context":695,"kind":"use","source":1},{"line":2212,"start":268560,"end":268563,"expression":"r-1","context":696,"kind":"use","source":1},{"line":2212,"start":268598,"end":268601,"expression":"W_*","context":697,"kind":"use","source":1},{"line":2214,"start":269324,"end":269325,"expression":"B","context":698,"kind":"use","source":1},{"line":2214,"start":269336,"end":269339,"expression":"R_k","context":699,"kind":"use","source":1},{"line":2220,"start":269979,"end":269980,"expression":"p","context":700,"kind":"use","source":1},{"line":2220,"start":270032,"end":270033,"expression":"g","context":700,"kind":"use","source":1},{"line":2220,"start":270053,"end":270056,"expression":"1/2","context":700,"kind":"use","source":1},{"line":2220,"start":270074,"end":270075,"expression":"p","context":700,"kind":"use","source":1},{"line":2220,"start":270095,"end":270098,"expression":"1/2","context":700,"kind":"use","source":1},{"line":2220,"start":270262,"end":270272,"expression":"p,p,\\ldots","context":701,"kind":"use","source":1},{"line":2220,"start":270307,"end":270313,"expression":"\\Delta","context":702,"kind":"use","source":1},{"line":2220,"start":270317,"end":270320,"expression":"W_*","context":703,"kind":"use","source":1},{"line":2220,"start":270360,"end":270363,"expression":"R_*","context":704,"kind":"use","source":1},{"line":2220,"start":270380,"end":270385,"expression":"\\{g\\}","context":705,"kind":"use","source":1},{"line":2226,"start":271164,"end":271193,"expression":"\\mathcal C\\subseteq\\mathcal B","context":706,"kind":"use","source":1},{"line":2226,"start":271204,"end":271207,"expression":"B_0","context":706,"kind":"use","source":1},{"line":2226,"start":271219,"end":271225,"expression":"\\kappa","context":706,"kind":"use","source":1},{"line":2226,"start":271253,"end":271267,"expression":"B\\in\\mathcal C","context":706,"kind":"use","source":1},{"line":2226,"start":271292,"end":271315,"expression":"B\\subseteq S_{\\rm safe}","context":706,"kind":"use","source":1},{"line":2226,"start":271319,"end":271336,"expression":"\\kappa(B)\\in A(B)","context":707,"kind":"use","source":1},{"line":2226,"start":271344,"end":271395,"expression":"\\operatorname{Succ}(B,\\kappa(B))\\subseteq\\mathcal C","context":708,"kind":"use","source":1},{"line":2229,"start":271591,"end":271597,"expression":"\\kappa","context":709,"kind":"use","source":1},{"line":2229,"start":271637,"end":271640,"expression":"B_0","context":710,"kind":"use","source":1},{"line":2229,"start":271696,"end":271720,"expression":"r:\\mathcal C\\to\\mathbb N","context":711,"kind":"use","source":1},{"line":2229,"start":271733,"end":271739,"expression":"r(B)=0","context":711,"kind":"use","source":1},{"line":2229,"start":271750,"end":271762,"expression":"B\\subseteq G","context":711,"kind":"use","source":1},{"line":2229,"start":271864,"end":271865,"expression":"G","context":712,"kind":"use","source":1},{"line":2229,"start":271894,"end":271900,"expression":"r(B_0)","context":713,"kind":"use","source":1},{"line":2229,"start":271974,"end":271988,"expression":"\\mathcal C=W_*","context":714,"kind":"use","source":1},{"line":2232,"start":272058,"end":272068,"expression":"\\mathcal C","context":715,"kind":"use","source":1},{"line":2232,"start":272206,"end":272212,"expression":"r(B_0)","context":716,"kind":"use","source":1},{"line":2232,"start":272309,"end":272319,"expression":"\\mathcal C","context":717,"kind":"use","source":1},{"line":2238,"start":273031,"end":273041,"expression":"r,\\ell,g,b","context":718,"kind":"use","source":1},{"line":2238,"start":273061,"end":273073,"expression":"\\{r,\\ell,g\\}","context":718,"kind":"use","source":1},{"line":2238,"start":273080,"end":273081,"expression":"r","context":718,"kind":"use","source":1},{"line":2238,"start":273093,"end":273109,"expression":"\\mathsf{deliver}","context":718,"kind":"use","source":1},{"line":2238,"start":273121,"end":273122,"expression":"g","context":718,"kind":"use","source":1},{"line":2238,"start":273140,"end":273155,"expression":"\\mathsf{freeze}","context":718,"kind":"use","source":1},{"line":2238,"start":273167,"end":273171,"expression":"\\ell","context":718,"kind":"use","source":1},{"line":2238,"start":273178,"end":273179,"expression":"g","context":718,"kind":"use","source":1},{"line":2238,"start":273183,"end":273196,"expression":"\\mathsf{wait}","context":718,"kind":"use","source":1},{"line":2238,"start":273216,"end":273220,"expression":"\\ell","context":718,"kind":"use","source":1},{"line":2238,"start":273311,"end":273312,"expression":"b","context":719,"kind":"use","source":1},{"line":2238,"start":273330,"end":273345,"expression":"\\mathsf{freeze}","context":720,"kind":"use","source":1},{"line":2238,"start":273401,"end":273404,"expression":"W_*","context":721,"kind":"use","source":1},{"line":2238,"start":273459,"end":273460,"expression":"r","context":722,"kind":"use","source":1},{"line":2244,"start":274008,"end":274096,"expression":"(\\overline S,\\overline h,\\overline A,\\overline\\Delta,\\overline S_{\\rm safe},\\overline G)","context":723,"kind":"use","source":1},{"line":2244,"start":274123,"end":274124,"expression":"U","context":723,"kind":"use","source":1},{"line":2244,"start":274132,"end":274151,"expression":"\\pi:S\\to\\overline S","context":723,"kind":"use","source":1},{"line":2245,"start":274237,"end":274544,"expression":"\nh(s)&=\\overline h(\\pi s), & A(s)&=\\overline A(\\pi s),\\label{eq:synthesis-labels}\\\\\ns\\in S_{\\rm safe}&\\Longleftrightarrow\\pi s\\in\\overline S_{\\rm safe}, &\ns\\in G&\\Longleftrightarrow\\pi s\\in\\overline G,\\label{eq:synthesis-goals}\\\\\n\\pi[\\Delta(s,u)]&=\\overline\\Delta(\\pi s,u).&&\\label{eq:synthesis-successors}\n","context":724,"kind":"introduction-passage","source":1},{"line":2251,"start":274570,"end":274576,"expression":"\\pi[B]","context":725,"kind":"introduction-passage","source":1},{"line":2254,"start":274969,"end":274983,"expression":"B\\in\\mathcal B","context":726,"kind":"use","source":1},{"line":2254,"start":275004,"end":275005,"expression":"k","context":727,"kind":"use","source":1},{"line":2255,"start":275010,"end":275120,"expression":"\nB\\in W_k\\Longleftrightarrow\\pi[B]\\in\\overline W_k,\n\\qquad\nB\\in W_*\\Longleftrightarrow\\pi[B]\\in\\overline W_*.\n","context":728,"kind":"use","source":1},{"line":2260,"start":275150,"end":275199,"expression":"B\\in R_k\\Longleftrightarrow\\pi[B]\\in\\overline R_k","context":729,"kind":"use","source":1},{"line":2260,"start":275295,"end":275296,"expression":"B","context":730,"kind":"use","source":1},{"line":2260,"start":275323,"end":275329,"expression":"\\pi[B]","context":731,"kind":"use","source":1},{"line":2263,"start":275392,"end":275398,"expression":"\\pi[B]","context":732,"kind":"use","source":1},{"line":2263,"start":275537,"end":275538,"expression":"y","context":733,"kind":"use","source":1},{"line":2264,"start":275612,"end":275723,"expression":"\\label{eq:synthesis-post-commute}\n\\pi[\\operatorname{Post}(B,u,y)]\n=\\overline{\\operatorname{Post}}(\\pi[B],u,y).\n","context":734,"kind":"use","source":1},{"line":2268,"start":275756,"end":275759,"expression":"\\pi","context":735,"kind":"use","source":1},{"line":2268,"start":275894,"end":275903,"expression":"h^{-1}(y)","context":736,"kind":"use","source":1},{"line":2268,"start":275922,"end":275925,"expression":"\\pi","context":737,"kind":"use","source":1},{"line":2270,"start":276399,"end":276400,"expression":"B","context":738,"kind":"use","source":1},{"line":2273,"start":277018,"end":277024,"expression":"\\Delta","context":739,"kind":"use","source":1},{"line":2278,"start":277761,"end":277762,"expression":"c","context":740,"kind":"use","source":1},{"line":2280,"start":278153,"end":278154,"expression":"1","context":741,"kind":"use","source":1},{"line":2280,"start":278184,"end":278187,"expression":"F=2","context":741,"kind":"use","source":1},{"line":2280,"start":278232,"end":278242,"expression":"\\alpha=1/4","context":741,"kind":"use","source":1},{"line":2280,"start":278319,"end":278332,"expression":"P_C=(1/2,1/2)","context":741,"kind":"use","source":1},{"line":2283,"start":278586,"end":278644,"expression":"\nP_C=(3/4,1/8,1/8),\\qquad\nP_1=(0,1,0),\\qquad P_2=(0,0,1).\n","context":742,"kind":"use","source":1},{"line":2287,"start":278667,"end":278676,"expression":"s=(0,1,1)","context":742,"kind":"use","source":1},{"line":2287,"start":278717,"end":278720,"expression":"1/4","context":742,"kind":"use","source":1},{"line":2287,"start":278756,"end":278757,"expression":"1","context":742,"kind":"use","source":1},{"line":2287,"start":278776,"end":278790,"expression":"2(1-1/4)-1=1/2","context":742,"kind":"use","source":1},{"line":2289,"start":279077,"end":279078,"expression":"c","context":743,"kind":"use","source":1},{"line":2301,"start":279459,"end":279462,"expression":"c=4","context":744,"kind":"use","source":1},{"line":2301,"start":279551,"end":279554,"expression":"c=5","context":744,"kind":"use","source":1},{"line":2301,"start":279648,"end":279651,"expression":"c=4","context":744,"kind":"use","source":1},{"line":2301,"start":279754,"end":279755,"expression":"d","context":744,"kind":"use","source":1},{"line":2301,"start":279798,"end":279807,"expression":"c\\geq d+2","context":744,"kind":"use","source":1},{"line":2306,"start":280013,"end":280018,"expression":"(d,c)","context":745,"kind":"use","source":1},{"line":2306,"start":280148,"end":280153,"expression":"c=d+2","context":745,"kind":"use","source":1},{"line":2310,"start":280389,"end":280427,"expression":"\n\\Gamma_\\alpha=\\min\\{6\\alpha,3/2\\}-1.\n","context":746,"kind":"use","source":1},{"line":2313,"start":280513,"end":280514,"expression":"1","context":746,"kind":"use","source":1},{"line":2313,"start":280521,"end":280522,"expression":"2","context":746,"kind":"use","source":1},{"line":2313,"start":280618,"end":280619,"expression":"t","context":746,"kind":"use","source":1},{"line":2313,"start":280643,"end":280644,"expression":"0","context":746,"kind":"use","source":1},{"line":2313,"start":280760,"end":280773,"expression":"t/4\\leq\\alpha","context":747,"kind":"use","source":1},{"line":2313,"start":280782,"end":280788,"expression":"t\\leq1","context":748,"kind":"use","source":1},{"line":2313,"start":280810,"end":280816,"expression":"3t/2-1","context":749,"kind":"use","source":1},{"line":2313,"start":280855,"end":280865,"expression":"\\alpha=1/4","context":750,"kind":"use","source":1},{"line":2313,"start":280882,"end":280885,"expression":"1/2","context":751,"kind":"use","source":1},{"line":2319,"start":281204,"end":281207,"expression":"F=2","context":752,"kind":"use","source":1},{"line":2319,"start":281220,"end":281229,"expression":"g_1=g_2=1","context":752,"kind":"use","source":1},{"line":2319,"start":281275,"end":281296,"expression":"\\min\\{6\\alpha,3/2\\}-1","context":752,"kind":"use","source":1},{"line":2319,"start":281401,"end":281403,"expression":"-1","context":753,"kind":"use","source":1},{"line":2340,"start":284456,"end":284457,"expression":"M","context":754,"kind":"introduction-passage","source":1},{"line":2340,"start":284490,"end":284491,"expression":"V","context":754,"kind":"introduction-passage","source":1},{"line":2340,"start":284536,"end":284537,"expression":"H","context":754,"kind":"introduction-passage","source":1},{"line":2340,"start":284572,"end":284573,"expression":"E","context":754,"kind":"introduction-passage","source":1},{"line":2340,"start":284706,"end":284707,"expression":"H","context":754,"kind":"introduction-passage","source":1},{"line":2340,"start":284797,"end":284798,"expression":"E","context":755,"kind":"introduction-passage","source":1},{"line":2343,"start":284969,"end":285073,"expression":"\n\\mathcal B=(Z_{\\rm ext},O_{\\rm ext},\\mathsf{Auth},\\mathsf{Effect},\n\\mathsf{Standing},\\mathsf{Remedy}).\n","context":756,"kind":"use","source":1},{"line":2347,"start":285082,"end":285093,"expression":"Z_{\\rm ext}","context":756,"kind":"use","source":1},{"line":2347,"start":285151,"end":285162,"expression":"O_{\\rm ext}","context":756,"kind":"use","source":1},{"line":2347,"start":285206,"end":285219,"expression":"\\mathsf{Auth}","context":756,"kind":"use","source":1},{"line":2347,"start":285298,"end":285313,"expression":"\\mathsf{Effect}","context":756,"kind":"use","source":1},{"line":2347,"start":285364,"end":285381,"expression":"\\mathsf{Standing}","context":757,"kind":"use","source":1},{"line":2347,"start":285445,"end":285460,"expression":"\\mathsf{Remedy}","context":758,"kind":"use","source":1},{"line":2349,"start":285866,"end":285867,"expression":"M","context":759,"kind":"use","source":1},{"line":2352,"start":286500,"end":286503,"expression":"h_0","context":760,"kind":"use","source":1},{"line":2352,"start":286572,"end":286575,"expression":"h_1","context":760,"kind":"use","source":1},{"line":2352,"start":286814,"end":286827,"expression":"\\sum_iq_i\\le4","context":761,"kind":"use","source":1},{"line":2352,"start":286905,"end":286908,"expression":"h_1","context":762,"kind":"use","source":1},{"line":2363,"start":288552,"end":288553,"expression":"C","context":763,"kind":"use","source":1},{"line":2363,"start":288569,"end":288570,"expression":"D","context":763,"kind":"use","source":1},{"line":2363,"start":288622,"end":288623,"expression":"N","context":763,"kind":"use","source":1},{"line":2363,"start":288640,"end":288641,"expression":"I","context":763,"kind":"use","source":1},{"line":2363,"start":288688,"end":288691,"expression":"g>0","context":763,"kind":"use","source":1},{"line":2363,"start":288799,"end":288802,"expression":"F>g","context":763,"kind":"use","source":1},{"line":2363,"start":288828,"end":288831,"expression":"c>0","context":763,"kind":"use","source":1},{"line":2363,"start":288865,"end":288868,"expression":"b>c","context":763,"kind":"use","source":1},{"line":2368,"start":289208,"end":289209,"expression":"N","context":764,"kind":"use","source":1},{"line":2368,"start":289225,"end":289226,"expression":"I","context":764,"kind":"use","source":1},{"line":2370,"start":289251,"end":289252,"expression":"C","context":765,"kind":"use","source":1},{"line":2370,"start":289257,"end":289262,"expression":"(0,0)","context":765,"kind":"use","source":1},{"line":2370,"start":289267,"end":289273,"expression":"(0,-c)","context":765,"kind":"use","source":1},{"line":2371,"start":289288,"end":289289,"expression":"D","context":766,"kind":"use","source":1},{"line":2371,"start":289294,"end":289299,"expression":"(g,0)","context":766,"kind":"use","source":1},{"line":2371,"start":289304,"end":289313,"expression":"(g-F,b-c)","context":766,"kind":"use","source":1},{"line":2378,"start":289637,"end":289678,"expression":"\np^*=\\frac{c}{b},\\qquad q^*=\\frac{g}{F}.\n","context":767,"kind":"use","source":1},{"line":2384,"start":289833,"end":289834,"expression":"q","context":768,"kind":"use","source":1},{"line":2384,"start":289884,"end":289888,"expression":"g-qF","context":769,"kind":"use","source":1},{"line":2384,"start":289937,"end":289938,"expression":"p","context":770,"kind":"use","source":1},{"line":2384,"start":289985,"end":289989,"expression":"pb-c","context":771,"kind":"use","source":1},{"line":2384,"start":289996,"end":290001,"expression":"(C,N)","context":772,"kind":"use","source":1},{"line":2384,"start":290028,"end":290029,"expression":"D","context":773,"kind":"use","source":1},{"line":2384,"start":290036,"end":290041,"expression":"(D,N)","context":774,"kind":"use","source":1},{"line":2384,"start":290064,"end":290065,"expression":"I","context":775,"kind":"use","source":1},{"line":2384,"start":290072,"end":290077,"expression":"(D,I)","context":776,"kind":"use","source":1},{"line":2384,"start":290104,"end":290105,"expression":"C","context":777,"kind":"use","source":1},{"line":2384,"start":290116,"end":290121,"expression":"(C,I)","context":778,"kind":"use","source":1},{"line":2384,"start":290144,"end":290145,"expression":"N","context":779,"kind":"use","source":1},{"line":2389,"start":291099,"end":291102,"expression":"w>c","context":780,"kind":"use","source":1},{"line":2389,"start":291183,"end":291191,"expression":"w+pb-c>0","context":780,"kind":"use","source":1},{"line":2389,"start":291203,"end":291204,"expression":"p","context":780,"kind":"use","source":1},{"line":2389,"start":291237,"end":291238,"expression":"I","context":780,"kind":"use","source":1},{"line":2389,"start":291279,"end":291280,"expression":"C","context":780,"kind":"use","source":1},{"line":2389,"start":291291,"end":291294,"expression":"F>g","context":780,"kind":"use","source":1},{"line":2389,"start":291324,"end":291329,"expression":"(C,I)","context":780,"kind":"use","source":1},{"line":2389,"start":291336,"end":291339,"expression":"w=c","context":780,"kind":"use","source":1},{"line":2395,"start":292362,"end":292365,"expression":"P_C","context":781,"kind":"use","source":1},{"line":2395,"start":292372,"end":292375,"expression":"P_D","context":782,"kind":"use","source":1},{"line":2395,"start":292462,"end":292473,"expression":"\\lambda\\ge1","context":783,"kind":"use","source":1},{"line":2396,"start":292499,"end":292615,"expression":"\\label{eq:pairwise-privacy}\n P_D(E)\\le\\lambda P_C(E),\\qquad P_C(E)\\le\\lambda P_D(E)\n \\quad\\text{for every event }E.\n","context":783,"kind":"use","source":1},{"line":2400,"start":292839,"end":292860,"expression":"\\lambda=e^\\varepsilon","context":784,"kind":"use","source":1},{"line":2403,"start":293159,"end":293269,"expression":"\nD_\\alpha(P_D,P_C)=\\max_{0\\le s\\le1,\\ \\E_{P_C}s\\le\\alpha}\n       (\\E_{P_D}s-\\E_{P_C}s),\\qquad 0\\le\\alpha\\le1.\n","context":785,"kind":"use","source":1},{"line":2407,"start":293302,"end":293303,"expression":"s","context":785,"kind":"use","source":1},{"line":2411,"start":293562,"end":293699,"expression":"\\label{eq:privacy-envelope}\nD_\\alpha(P_D,P_C)\\le\n B(\\lambda,\\alpha):=\n \\min\\left\\{(\\lambda-1)\\alpha,\\frac{\\lambda-1}{\\lambda+1}\\right\\}.\n","context":786,"kind":"use","source":1},{"line":2416,"start":293724,"end":293735,"expression":"\\lambda\\ge1","context":787,"kind":"use","source":1},{"line":2416,"start":293742,"end":293756,"expression":"\\alpha\\in[0,1]","context":788,"kind":"use","source":1},{"line":2416,"start":293919,"end":293943,"expression":"g\\le F B(\\lambda,\\alpha)","context":789,"kind":"use","source":1},{"line":2419,"start":294094,"end":294105,"expression":"a=\\E_{P_C}s","context":790,"kind":"use","source":1},{"line":2419,"start":294112,"end":294123,"expression":"b=\\E_{P_D}s","context":791,"kind":"use","source":1},{"line":2419,"start":294170,"end":294171,"expression":"s","context":792,"kind":"use","source":1},{"line":2419,"start":294180,"end":294193,"expression":"b\\le\\lambda a","context":793,"kind":"use","source":1},{"line":2419,"start":294213,"end":294216,"expression":"1-s","context":794,"kind":"use","source":1},{"line":2419,"start":294225,"end":294243,"expression":"1-a\\le\\lambda(1-b)","context":795,"kind":"use","source":1},{"line":2420,"start":294253,"end":294344,"expression":"\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n","context":796,"kind":"use","source":1},{"line":2424,"start":294352,"end":294361,"expression":"\\lambda>1","context":797,"kind":"use","source":1},{"line":2424,"start":294399,"end":294400,"expression":"a","context":798,"kind":"use","source":1},{"line":2424,"start":294447,"end":294462,"expression":"a=1/(\\lambda+1)","context":799,"kind":"use","source":1},{"line":2424,"start":294496,"end":294511,"expression":"0\\le a\\le\\alpha","context":800,"kind":"use","source":1},{"line":2424,"start":294553,"end":294562,"expression":"\\lambda=1","context":801,"kind":"use","source":1},{"line":2426,"start":294638,"end":294641,"expression":"0,1","context":802,"kind":"use","source":1},{"line":2427,"start":294650,"end":294782,"expression":"\nP_C=\\left(\\frac{\\lambda}{\\lambda+1},\\frac1{\\lambda+1}\\right),\n\\qquad\nP_D=\\left(\\frac1{\\lambda+1},\\frac{\\lambda}{\\lambda+1}\\right).\n","context":802,"kind":"use","source":1},{"line":2432,"start":294825,"end":294831,"expression":"s(0)=0","context":802,"kind":"use","source":1},{"line":2433,"start":294838,"end":294870,"expression":"s(1)=\\min\\{(\\lambda+1)\\alpha,1\\}","context":802,"kind":"use","source":1},{"line":2433,"start":294909,"end":294915,"expression":"\\alpha","context":802,"kind":"use","source":1},{"line":2433,"start":294960,"end":294977,"expression":"B(\\lambda,\\alpha)","context":802,"kind":"use","source":1},{"line":2433,"start":295018,"end":295045,"expression":"g\\le F(\\E_{P_D}s-\\E_{P_C}s)","context":803,"kind":"use","source":1},{"line":2438,"start":295642,"end":295651,"expression":"\\lambda=3","context":804,"kind":"use","source":1},{"line":2438,"start":295655,"end":295666,"expression":"\\alpha=1/10","context":804,"kind":"use","source":1},{"line":2438,"start":295692,"end":295695,"expression":"1/5","context":804,"kind":"use","source":1},{"line":2438,"start":295712,"end":295715,"expression":"F=2","context":804,"kind":"use","source":1},{"line":2438,"start":295731,"end":295734,"expression":"2/5","context":804,"kind":"use","source":1},{"line":2438,"start":295843,"end":295856,"expression":"P_C=(3/4,1/4)","context":804,"kind":"use","source":1},{"line":2438,"start":295863,"end":295876,"expression":"P_D=(1/4,3/4)","context":804,"kind":"use","source":1},{"line":2438,"start":295884,"end":295893,"expression":"s=(0,2/5)","context":804,"kind":"use","source":1},{"line":2438,"start":295930,"end":295935,"expression":"g=1/3","context":804,"kind":"use","source":1},{"line":2438,"start":295963,"end":295975,"expression":"2/5-1/3=1/15","context":804,"kind":"use","source":1},{"line":2445,"start":296618,"end":296634,"expression":"\\theta\\in\\{0,1\\}","context":805,"kind":"use","source":1},{"line":2445,"start":296678,"end":296679,"expression":"R","context":805,"kind":"use","source":1},{"line":2445,"start":296717,"end":296722,"expression":"O_1=R","context":805,"kind":"use","source":1},{"line":2445,"start":296729,"end":296746,"expression":"O_2=R\\oplus\\theta","context":805,"kind":"use","source":1},{"line":2445,"start":296842,"end":296851,"expression":"\\lambda=1","context":805,"kind":"use","source":1},{"line":2445,"start":296859,"end":296879,"expression":"O_1\\oplus O_2=\\theta","context":805,"kind":"use","source":1},{"line":2451,"start":297342,"end":297343,"expression":"m","context":806,"kind":"use","source":1},{"line":2451,"start":297398,"end":297399,"expression":"h","context":807,"kind":"use","source":1},{"line":2451,"start":297447,"end":297465,"expression":"P_C^t(\\cdot\\mid h)","context":808,"kind":"use","source":1},{"line":2451,"start":297472,"end":297490,"expression":"P_D^t(\\cdot\\mid h)","context":809,"kind":"use","source":1},{"line":2451,"start":297541,"end":297554,"expression":"\\lambda_t\\ge1","context":810,"kind":"use","source":1},{"line":2452,"start":297671,"end":297706,"expression":"\n\\lambda=\\prod_{t=1}^{m}\\lambda_t.\n","context":811,"kind":"use","source":1},{"line":2458,"start":298245,"end":298259,"expression":"\\lambda_t^{-1}","context":812,"kind":"use","source":1},{"line":2458,"start":298266,"end":298275,"expression":"\\lambda_t","context":813,"kind":"use","source":1},{"line":2461,"start":298644,"end":298671,"expression":"\\lambda_t=e^{\\varepsilon_t}","context":814,"kind":"use","source":1},{"line":2461,"start":298703,"end":298722,"expression":"\\sum_t\\varepsilon_t","context":814,"kind":"use","source":1},{"line":2469,"start":300321,"end":300322,"expression":"J","context":815,"kind":"use","source":1},{"line":2469,"start":300391,"end":300401,"expression":"1,\\ldots,T","context":815,"kind":"use","source":1},{"line":2469,"start":300414,"end":300415,"expression":"t","context":815,"kind":"use","source":1},{"line":2469,"start":300429,"end":300436,"expression":"c_t\\ge0","context":815,"kind":"use","source":1},{"line":2469,"start":300518,"end":300519,"expression":"j","context":815,"kind":"use","source":1},{"line":2469,"start":300558,"end":300561,"expression":"r_j","context":815,"kind":"use","source":1},{"line":2469,"start":300577,"end":300580,"expression":"d_j","context":815,"kind":"use","source":1},{"line":2469,"start":300589,"end":300609,"expression":"1\\le r_j\\le d_j\\le T","context":815,"kind":"use","source":1},{"line":2472,"start":301059,"end":301071,"expression":"U\\subseteq J","context":816,"kind":"use","source":1},{"line":2473,"start":301090,"end":301170,"expression":"\\label{eq:appeal-hall}\n |U|\\le\\sum_{t\\in\\bigcup_{j\\in U}\\{r_j,\\ldots,d_j\\}}c_t.\n","context":817,"kind":"use","source":1},{"line":2476,"start":301279,"end":301298,"expression":"[a,b]\\subseteq[1,T]","context":818,"kind":"use","source":1},{"line":2477,"start":301317,"end":301412,"expression":"\\label{eq:appeal-interval}\n \\bigl|\\{j:r_j\\ge a,\\ d_j\\le b\\}\\bigr|\n       \\le\\sum_{t=a}^{b}c_t.\n","context":819,"kind":"use","source":1},{"line":2483,"start":301474,"end":301475,"expression":"t","context":820,"kind":"use","source":1},{"line":2483,"start":301481,"end":301484,"expression":"c_t","context":821,"kind":"use","source":1},{"line":2483,"start":301526,"end":301527,"expression":"j","context":822,"kind":"use","source":1},{"line":2483,"start":301868,"end":301873,"expression":"[a,b]","context":823,"kind":"use","source":1},{"line":2485,"start":301921,"end":301922,"expression":"U","context":824,"kind":"use","source":1},{"line":2485,"start":302006,"end":302020,"expression":"C_1,\\ldots,C_k","context":824,"kind":"use","source":1},{"line":2485,"start":302120,"end":302121,"expression":"U","context":824,"kind":"use","source":1},{"line":2485,"start":302127,"end":302130,"expression":"C_i","context":824,"kind":"use","source":1},{"line":2485,"start":302205,"end":302208,"expression":"C_i","context":824,"kind":"use","source":1},{"line":2485,"start":302281,"end":302284,"expression":"C_i","context":825,"kind":"use","source":1},{"line":2488,"start":302663,"end":302668,"expression":"(1,1)","context":826,"kind":"use","source":1},{"line":2488,"start":302753,"end":302758,"expression":"[1,1]","context":826,"kind":"use","source":1},{"line":2498,"start":304318,"end":304333,"expression":"G_{\\rm suspend}","context":827,"kind":"use","source":1},{"line":2498,"start":304454,"end":304468,"expression":"G_{\\rm settle}","context":827,"kind":"use","source":1},{"line":2502,"start":305766,"end":305776,"expression":"\\mathcal B","context":828,"kind":"use","source":1},{"line":2502,"start":305819,"end":305831,"expression":"S_{\\rm safe}","context":828,"kind":"use","source":1},{"line":2502,"start":305860,"end":305861,"expression":"B","context":828,"kind":"use","source":1},{"line":2502,"start":305906,"end":305920,"expression":"A_{\\rm run}(B)","context":828,"kind":"use","source":1},{"line":2502,"start":305956,"end":305970,"expression":"A_{\\rm end}(B)","context":828,"kind":"use","source":1},{"line":2502,"start":306016,"end":306017,"expression":"B","context":829,"kind":"use","source":1},{"line":2502,"start":306113,"end":306136,"expression":"G\\subseteq S_{\\rm safe}","context":830,"kind":"use","source":1},{"line":2505,"start":306461,"end":306694,"expression":"\n T_0&=\\{B\\in\\mathcal B:B\\subseteq G\\},\\label{eq:stop-target}\\\\\n T_{k+1}&=T_k\\cup\\{B\\in\\mathcal B:B\\subseteq S_{\\rm safe},\\\n      \\exists u\\in A_{\\rm end}(B),\\ \\operatorname{Succ}(B,u)\\subseteq T_k\\}.\n      \\label{eq:stop-attractor}\n","context":831,"kind":"use","source":1},{"line":2511,"start":306711,"end":306714,"expression":"T_*","context":832,"kind":"use","source":1},{"line":2511,"start":306739,"end":306753,"expression":"r_{\\rm end}(B)","context":832,"kind":"use","source":1},{"line":2512,"start":306806,"end":306966,"expression":"\\label{eq:stoppable-kernel}\n L_0=T_*,\\qquad\n L_{k+1}=\\{B\\in T_*:\\exists u\\in A_{\\rm run}(B),\\\n                         \\operatorname{Succ}(B,u)\\subseteq L_k\\},\n","context":832,"kind":"use","source":1},{"line":2517,"start":306998,"end":307001,"expression":"L_*","context":833,"kind":"use","source":1},{"line":2520,"start":307235,"end":307236,"expression":"B","context":834,"kind":"use","source":1},{"line":2520,"start":307247,"end":307250,"expression":"L_*","context":835,"kind":"use","source":1},{"line":2520,"start":307423,"end":307424,"expression":"G","context":836,"kind":"use","source":1},{"line":2520,"start":307535,"end":307536,"expression":"B","context":837,"kind":"use","source":1},{"line":2520,"start":307554,"end":307557,"expression":"L_*","context":838,"kind":"use","source":1},{"line":2520,"start":307589,"end":307590,"expression":"B","context":839,"kind":"use","source":1},{"line":2520,"start":307619,"end":307620,"expression":"G","context":840,"kind":"use","source":1},{"line":2520,"start":307630,"end":307644,"expression":"r_{\\rm end}(B)","context":841,"kind":"use","source":1},{"line":2520,"start":307665,"end":307682,"expression":"L_*\\ne\\varnothing","context":842,"kind":"use","source":1},{"line":2520,"start":307735,"end":307738,"expression":"L_*","context":843,"kind":"use","source":1},{"line":2523,"start":307820,"end":307823,"expression":"T_k","context":844,"kind":"use","source":1},{"line":2523,"start":307898,"end":307899,"expression":"G","context":845,"kind":"use","source":1},{"line":2523,"start":307913,"end":307914,"expression":"k","context":846,"kind":"use","source":1},{"line":2523,"start":308201,"end":308204,"expression":"T_*","context":847,"kind":"use","source":1},{"line":2525,"start":308359,"end":308362,"expression":"L_*","context":848,"kind":"use","source":1},{"line":2525,"start":308424,"end":308427,"expression":"L_*","context":848,"kind":"use","source":1},{"line":2525,"start":308541,"end":308544,"expression":"T_*","context":848,"kind":"use","source":1},{"line":2525,"start":308670,"end":308673,"expression":"L_*","context":848,"kind":"use","source":1},{"line":2527,"start":308860,"end":308863,"expression":"T_*","context":849,"kind":"use","source":1},{"line":2527,"start":308970,"end":308973,"expression":"T_*","context":849,"kind":"use","source":1},{"line":2527,"start":309048,"end":309051,"expression":"L_k","context":849,"kind":"use","source":1},{"line":2527,"start":309068,"end":309071,"expression":"L_*","context":849,"kind":"use","source":1},{"line":2530,"start":309526,"end":309529,"expression":"L_*","context":850,"kind":"use","source":1},{"line":2532,"start":309833,"end":309834,"expression":"r","context":851,"kind":"use","source":1},{"line":2532,"start":309865,"end":309866,"expression":"d","context":851,"kind":"use","source":1},{"line":2532,"start":309902,"end":309903,"expression":"d","context":851,"kind":"use","source":1},{"line":2532,"start":309935,"end":309939,"expression":"\\ell","context":851,"kind":"use","source":1},{"line":2532,"start":310041,"end":310042,"expression":"d","context":851,"kind":"use","source":1},{"line":2532,"start":310054,"end":310055,"expression":"r","context":851,"kind":"use","source":1},{"line":2532,"start":310088,"end":310089,"expression":"r","context":851,"kind":"use","source":1},{"line":2532,"start":310095,"end":310096,"expression":"d","context":851,"kind":"use","source":1},{"line":2532,"start":310122,"end":310123,"expression":"z","context":851,"kind":"use","source":1},{"line":2532,"start":310142,"end":310143,"expression":"b","context":851,"kind":"use","source":1},{"line":2532,"start":310229,"end":310233,"expression":"\\ell","context":852,"kind":"use","source":1},{"line":2532,"start":310266,"end":310269,"expression":"L_*","context":853,"kind":"use","source":1},{"line":2532,"start":310326,"end":310327,"expression":"r","context":854,"kind":"use","source":1},{"line":2532,"start":310334,"end":310335,"expression":"d","context":855,"kind":"use","source":1},{"line":2532,"start":310437,"end":310441,"expression":"\\ell","context":856,"kind":"use","source":1},{"line":2536,"start":310549,"end":310563,"expression":"A\\Rightarrow G","context":857,"kind":"use","source":1},{"line":2539,"start":311033,"end":311170,"expression":"\n\\mathcal K=(\\mathsf{Claim},\\mathsf{Assumptions},\\mathsf{Evidence},\n\\mathsf{Domain},\\mathsf{Guard},\\mathsf{Fallback},\\mathsf{Revision}).\n","context":858,"kind":"use","source":1},{"line":2547,"start":312218,"end":312219,"expression":"V","context":859,"kind":"use","source":1},{"line":2547,"start":312227,"end":312241,"expression":"C_v\\subseteq Z","context":860,"kind":"use","source":1},{"line":2547,"start":312283,"end":312286,"expression":"C_v","context":861,"kind":"use","source":1},{"line":2547,"start":312325,"end":312326,"expression":"C","context":862,"kind":"use","source":1},{"line":2547,"start":312410,"end":312415,"expression":"(v,z)","context":863,"kind":"use","source":1},{"line":2547,"start":312423,"end":312431,"expression":"z\\in C_v","context":864,"kind":"use","source":1},{"line":2547,"start":312478,"end":312486,"expression":"\\kappa_v","context":865,"kind":"introduction-passage","source":1},{"line":2547,"start":312723,"end":312734,"expression":"\\kappa_v(z)","context":866,"kind":"introduction-passage","source":1},{"line":2547,"start":312772,"end":312778,"expression":"D_v(z)","context":867,"kind":"introduction-passage","source":1},{"line":2547,"start":312811,"end":312830,"expression":"D_v(z)\\subseteq C_v","context":868,"kind":"introduction-passage","source":1},{"line":2547,"start":312850,"end":312851,"expression":"v","context":869,"kind":"introduction-passage","source":1},{"line":2547,"start":312857,"end":312858,"expression":"w","context":870,"kind":"introduction-passage","source":1},{"line":2547,"start":312899,"end":312900,"expression":"C","context":871,"kind":"introduction-passage","source":1},{"line":2547,"start":312914,"end":312917,"expression":"C_w","context":872,"kind":"introduction-passage","source":1},{"line":2550,"start":313464,"end":313478,"expression":"z_0\\in C_{v_0}","context":873,"kind":"use","source":1},{"line":2550,"start":313592,"end":313593,"expression":"C","context":874,"kind":"use","source":1},{"line":2552,"start":313663,"end":313686,"expression":"r:(v,z)\\mapsto\\mathbb N","context":875,"kind":"use","source":1},{"line":2552,"start":313699,"end":313707,"expression":"r(v,z)=0","context":876,"kind":"use","source":1},{"line":2552,"start":313819,"end":313820,"expression":"r","context":877,"kind":"use","source":1},{"line":2552,"start":313866,"end":313876,"expression":"r(v_0,z_0)","context":878,"kind":"use","source":1},{"line":2555,"start":314107,"end":314113,"expression":"D_v(z)","context":879,"kind":"use","source":1},{"line":2555,"start":314153,"end":314167,"expression":"C_v\\subseteq C","context":880,"kind":"use","source":1},{"line":2555,"start":314241,"end":314242,"expression":"C","context":881,"kind":"use","source":1},{"line":2561,"start":315244,"end":315245,"expression":"0","context":882,"kind":"use","source":1},{"line":2565,"start":315827,"end":315828,"expression":"a","context":883,"kind":"use","source":1},{"line":2565,"start":315835,"end":315836,"expression":"b","context":883,"kind":"use","source":1},{"line":2565,"start":315871,"end":315876,"expression":"2,1,0","context":883,"kind":"use","source":1},{"line":2570,"start":316321,"end":316322,"expression":"A","context":884,"kind":"use","source":1},{"line":2570,"start":316358,"end":316359,"expression":"B","context":884,"kind":"use","source":1},{"line":2570,"start":316376,"end":316377,"expression":"B","context":884,"kind":"use","source":1},{"line":2578,"start":318239,"end":318240,"expression":"c","context":885,"kind":"use","source":1},{"line":2596,"start":318961,"end":318974,"expression":"P_D=(1/4,3/4)","context":886,"kind":"use","source":1},{"line":2596,"start":318986,"end":318989,"expression":"1/3","context":886,"kind":"use","source":1},{"line":2596,"start":319018,"end":319031,"expression":"P_C=(3/4,1/4)","context":886,"kind":"use","source":1},{"line":2596,"start":319214,"end":319223,"expression":"\\lambda=3","context":886,"kind":"use","source":1},{"line":2596,"start":319227,"end":319238,"expression":"\\alpha=1/10","context":886,"kind":"use","source":1},{"line":2596,"start":319242,"end":319245,"expression":"F=2","context":886,"kind":"use","source":1},{"line":2596,"start":319253,"end":319262,"expression":"s=(0,2/5)","context":886,"kind":"use","source":1},{"line":2596,"start":319309,"end":319313,"expression":"1/10","context":887,"kind":"use","source":1},{"line":2596,"start":319327,"end":319331,"expression":"1/15","context":888,"kind":"use","source":1},{"line":2598,"start":319543,"end":319544,"expression":"w","context":889,"kind":"use","source":1},{"line":2598,"start":319576,"end":319577,"expression":"w","context":889,"kind":"use","source":1},{"line":2598,"start":319612,"end":319615,"expression":"c_a","context":889,"kind":"use","source":1},{"line":2600,"start":320097,"end":320100,"expression":"c=8","context":890,"kind":"use","source":1},{"line":2600,"start":320329,"end":320332,"expression":"c=7","context":890,"kind":"use","source":1},{"line":2602,"start":320743,"end":320752,"expression":"2,3,1,1,1","context":891,"kind":"use","source":1},{"line":2602,"start":320939,"end":320950,"expression":"5,4,3,2,1,0","context":891,"kind":"use","source":1},{"line":2629,"start":325586,"end":325600,"expression":"B<g/(1-\\delta)","context":892,"kind":"use","source":1},{"line":2732,"start":343692,"end":343693,"expression":"R","context":893,"kind":"use","source":1},{"line":2732,"start":343700,"end":343701,"expression":"U","context":893,"kind":"use","source":1},{"line":2732,"start":343811,"end":350784,"expression":".5em]\nWhat state must persist? & The allocation rule alone is insufficient. Governance preservation also retains the enabled amendment actions and labels for active credentials, service debt, and resource tokens.\\\\[.5em]\nCan a due debt be erased? & The obligation monitor distinguishes fulfillment, authorized discharge, and deletion. Amendments are required to preserve pending commitments.\\\\[.5em]\nWho can block change? & Two registered offices block a three-of-four rule under independent approval rights. A hidden administrator changes this calculation.\\\\[.5em]\nCan every request be safely served? & Resource conservation can hold even when private information or conflicting deadlines prevent timely service. Viability with full information is not decentralized implementability.\\\\[.5em]\nWhat crosses a replacement? & An authorized office handover preserves debt and credential semantics. Copying a model does not duplicate an office's budget or approval right.\\\\[.5em]\nCan two jurisdictions merge? & Their translator must preserve the agreed action semantics, permissions, obligations, resources, and evidence coordinates. Nonzero residuals remain visible until an authorized repair is found.\\\\[.5em]\nHow long does the organization last? & Lifetime is first exit from a declared operational contract under a specified transition law. It is neither occupant longevity nor mere archive retention.\\\\\n\\bottomrule\n\\end{longtable}\nThe common event mechanism and constitutional envelope are supplied. Within that envelope, offices can choose rules, incur obligations, revise decisions, and replace occupants. This demonstrates how the theory's objects fit together. It does not prove that the envelope itself arose endogenously or that these rules are uniquely desirable.\n\n\\subsection{The additional boundary, language, and knowledge contract}\nAn admission changes the membership configuration, not merely the occupant list. A message is interpreted using its type, issuer, and epoch. A resource approval creates the specified ledger event only after its admissibility check. A debtor replacement transports the obligation monitor but does not manufacture new approval rights. A notification history records which office has received which adoption record; an available ledger entry is not automatically common knowledge.\n\nFor concurrent amendments, the contract states whether ordering is significant, whether a joinable normal form is required, and which external effects remain visible. For federation, the role-label transformations must be checked around ordered loops. A compatible allocation on one invariant subset does not certify synchronization of every role. For inquiry, the commons records unresolved scheduling questions independently of which questions it chooses to fund. For founding authority, it preserves the resource owner's stipulated grant separately from its own subsequent votes.\n\nTogether these clauses specify what it would mean to preserve this analytical institution across translations and replacements. They do not claim that every useful society needs this exact architecture or that the four-office example exhibits autonomous institutional formation.\n\n\\subsection{Distributed realization, enforcement, and adaptive staffing}\nIn the atomic reference commons, a unique slot token prevents two successful grants of the same slot. In its replicated variant, two local approvals can each look valid while their merged grant set violates exclusivity. The institution must therefore distinguish a provisional reservation from a committed grant and identify the primitive that prevents double execution. A convergent archive is not that primitive by itself.\n\nAccurate urgency reporting is a different problem. A committed monitor can discourage a specified profitable misreport only within the discrimination and penalty budget of Section~\\ref{sec:enforcement}. Its false-positive limit, evidence access, and remedy authority remain separate. When an averaged model supplies the observation laws, the margin must include its approximation error. A fixed review schedule and a data-selected review schedule cannot share the same mixing certificate without further work.\n\nThe commons also distinguishes an urgency vote from the signal supporting it. Decision-only publication can reproduce a mistaken cascade; preservation of independent evidence changes the information available to later reviewers, not the legal effect of an already committed vote. Finally, creating a specialist verifier changes the capability graph and the distribution of authority. A staffing certificate covers all protected roles jointly, while the handover procedure must still deliver credentials, pending debts, and evidence before service deadlines. These clauses supplement the reference semantics rather than claim that the society has generated its own infrastructure without assumptions.\n\n\\subsection{The joint continuation contract}\nThe bounded audit-and-service variant in Section~\\ref{sec:joint-synthesis} combines three protections that cannot be checked in isolation: the common monitor must deter every listed deviation, its false-positive rate must meet the cap, and its resource use must leave enough capacity for all due work. The current public possibility set must also admit the same protocol in every compatible complete state. A continuation certificate records this common choice and all possible successors. A progress rank distinguishes eventual certified service from indefinite safe waiting.\n\nAn amendment is acceptable under this particular continuation contract only when its current authority is valid and its resulting states retain certified continuations. A transport certificate additionally checks public observations, enabled profiles, safe and goal labels, and successor sets. Replacing an office, changing an audit channel, or adding a slot changes specified parts of that contract. Such a change may repair an obstruction, but does not retroactively fulfill an earlier unmet promise.\n\\FloatBarrier\n\n\\subsection{The accountability extension}\nSection~\\ref{sec:accountable-commons} deliberately changes the audit catalogue to satisfy its pairwise privacy constraint. It separately includes an outside claim, an admitted appeal, a genuine-execution fee, and a funded final record with revocation. The resulting eight-unit settlement requirement must not be confused with the five-unit service-and-audit variant. The supplied reference trace checks one declared five-profile settlement, while the stopping theorem characterizes an entire finite ending-preserving running kernel. Both are model-relative results, not certificates for an unspecified deployment.\n\n\\section{A finite algebraic example of reusable state}\\label{sec:worked}\nThe following analytical example makes the preceding distinctions concrete. Four components initially hold independent fair bits $(a,b,c,d)$. Two local workspaces expose\n\\[\np=a\\oplus b,\\qquad q=c\\oplus d,\n","context":894,"kind":"use","source":1},{"line":2772,"start":350819,"end":350826,"expression":"Z=(p,q)","context":895,"kind":"use","source":1},{"line":2772,"start":350861,"end":350872,"expression":"r=p\\oplus q","context":895,"kind":"use","source":1},{"line":2774,"start":350926,"end":350927,"expression":"r","context":896,"kind":"use","source":1},{"line":2774,"start":351057,"end":351058,"expression":"r","context":896,"kind":"use","source":1},{"line":2774,"start":351096,"end":351097,"expression":"r","context":896,"kind":"use","source":1},{"line":2777,"start":351276,"end":351277,"expression":"Z","context":897,"kind":"use","source":1},{"line":2778,"start":351282,"end":351345,"expression":"\nI(p,q)=(p,q),\\qquad W(p,q)=(q,p),\\qquad S(p,q)=(p\\oplus q,q).\n","context":897,"kind":"use","source":1},{"line":2781,"start":351406,"end":351407,"expression":"r","context":897,"kind":"use","source":1},{"line":2781,"start":351426,"end":351427,"expression":"W","context":897,"kind":"use","source":1},{"line":2781,"start":351434,"end":351435,"expression":"S","context":897,"kind":"use","source":1},{"line":2781,"start":351473,"end":351484,"expression":"(p,q)=(1,0)","context":897,"kind":"use","source":1},{"line":2782,"start":351489,"end":351530,"expression":"\nW(S(1,0))=(0,1),\\qquad S(W(1,0))=(1,1).\n","context":897,"kind":"use","source":1},{"line":2787,"start":351628,"end":351629,"expression":"r","context":898,"kind":"use","source":1},{"line":2787,"start":351673,"end":351678,"expression":"(0,0)","context":898,"kind":"use","source":1},{"line":2787,"start":351685,"end":351690,"expression":"(1,1)","context":898,"kind":"use","source":1},{"line":2787,"start":351705,"end":351708,"expression":"r=0","context":898,"kind":"use","source":1},{"line":2787,"start":351722,"end":351723,"expression":"S","context":898,"kind":"use","source":1},{"line":2787,"start":351738,"end":351739,"expression":"0","context":898,"kind":"use","source":1},{"line":2787,"start":351746,"end":351747,"expression":"1","context":898,"kind":"use","source":1},{"line":2792,"start":351961,"end":351962,"expression":"p","context":899,"kind":"use","source":1},{"line":2792,"start":351967,"end":351968,"expression":"q","context":899,"kind":"use","source":1},{"line":2792,"start":351981,"end":351982,"expression":"r","context":899,"kind":"use","source":1},{"line":2792,"start":351999,"end":352000,"expression":"S","context":899,"kind":"use","source":1},{"line":2792,"start":352009,"end":352010,"expression":"r","context":899,"kind":"use","source":1},{"line":2794,"start":352030,"end":352035,"expression":"(0,0)","context":900,"kind":"use","source":1},{"line":2795,"start":352048,"end":352053,"expression":"(1,1)","context":901,"kind":"use","source":1},{"line":2796,"start":352066,"end":352071,"expression":"(1,0)","context":902,"kind":"use","source":1},{"line":2797,"start":352084,"end":352089,"expression":"(0,1)","context":903,"kind":"use","source":1},{"line":2802,"start":352233,"end":352242,"expression":"p\\oplus q","context":904,"kind":"use","source":1},{"line":2802,"start":352263,"end":352264,"expression":"S","context":904,"kind":"use","source":1},{"line":2802,"start":352275,"end":352276,"expression":"p","context":904,"kind":"use","source":1},{"line":2802,"start":352313,"end":352314,"expression":"q","context":904,"kind":"use","source":1},{"line":2805,"start":352550,"end":352551,"expression":"T","context":905,"kind":"use","source":1},{"line":2805,"start":352561,"end":352575,"expression":"(p',q')=T(p,q)","context":905,"kind":"use","source":1},{"line":2806,"start":352590,"end":352639,"expression":"\nF_T(a,b,c,d)=(a,\\ a\\oplus p',\\ c,\\ c\\oplus q').\n","context":905,"kind":"use","source":1},{"line":2809,"start":352670,"end":352682,"expression":"F_T(a,b,c,d)","context":905,"kind":"use","source":1},{"line":2809,"start":352697,"end":352704,"expression":"(p',q')","context":905,"kind":"use","source":1},{"line":2809,"start":352721,"end":352733,"expression":"\\pi F_T=T\\pi","context":905,"kind":"use","source":1},{"line":2809,"start":352764,"end":352782,"expression":"\\pi(a,b,c,d)=(p,q)","context":905,"kind":"use","source":1},{"line":2811,"start":352934,"end":352935,"expression":"p","context":906,"kind":"use","source":1},{"line":2811,"start":352942,"end":352943,"expression":"q","context":906,"kind":"use","source":1},{"line":2814,"start":353292,"end":353293,"expression":"p","context":907,"kind":"use","source":1},{"line":2814,"start":353300,"end":353301,"expression":"q","context":907,"kind":"use","source":1},{"line":2814,"start":353313,"end":353314,"expression":"q","context":907,"kind":"use","source":1},{"line":2814,"start":353348,"end":353349,"expression":"r","context":907,"kind":"use","source":1},{"line":2814,"start":353363,"end":353366,"expression":"1/2","context":907,"kind":"use","source":1},{"line":2814,"start":353454,"end":353457,"expression":"c,d","context":907,"kind":"use","source":1},{"line":2814,"start":353549,"end":353550,"expression":"1","context":908,"kind":"use","source":1}],"entries":[{"id":"symbol-684888c0ebb17f37","tex":"*","aliases":"*","display":"*","kind":"notation-table","occurrences":[18,19,25,26,1200,374,375,378,570,571,577,578,580,581,720,721,726,1206,1207,1212,1213,1220,1222,1223,1224,1229,1232,1235,1245,1246,1262,1278,1287,1365,1476,1478,1479,1481,1484,1488,1489,1493,1494,1495,1496,1497,1498,1499,1501,1502,1514]},{"id":"symbol-380918b946a52664","tex":"=","aliases":"=","display":"=","kind":"notation-table","occurrences":[23,59,321,130,305,410,411,412,415,717,778,779,969,970,1189,1191,1194,1198,1283,27,39,47,63,65,66,69,71,75,76,80,86,87,94,95,96,97,98,99,102,117,118,121,137,138,142,145,146,159,160,167,177,180,181,189,196,197,205,207,213,227,248,252,257,267,289,290,291,323,331,332,334,336,338,339,340,341,348,353,356,360,368,374,380,381,382,386,387,416,422,424,425,426,429,430,431,441,455,456,459,463,464,465,466,469,470,480,482,485,486,487,488,489,490,491,496,499,500,501,502,503,535,545,547,553,555,561,562,596,604,642,644,645,647,648,650,652,654,668,684,688,689,691,693,735,742,744,746,750,761,762,763,764,765,766,768,769,770,789,798,805,812,814,815,831,840,843,850,851,852,855,859,863,864,865,867,868,870,871,873,881,889,891,898,905,907,913,918,919,924,936,937,957,958,965,967,974,979,988,989,1000,1001,1007,1013,1024,1025,1036,1055,1065,1094,1099,1111,1112,1157,1158,1161,1165,1220,1221,1222,1258,1262,1293,1301,1302,1303,1304,1305,1308,1310,1311,1312,1316,1317,1325,1327,1328,1337,1365,1385,1390,1391,1393,1397,1398,1406,1408,1410,1411,1412,1416,1417,1419,1421,1422,1423,1424,1425,1428,1429,1430,1431,1437,1440,1453,1475,1478,1519,1537,1551,1553,1554,1555,1556,1557,1563,1564,1570,1571,1572,1577,1581,1582,1586,1604,1605,1608,1609]},{"id":"symbol-559aead08264d579","tex":"A","aliases":"A","display":"A","kind":"notation-table","occurrences":[12,321,1191,1192,1198,1283,30,34,44,47,51,64,65,66,213,217,252,310,312,313,314,316,317,323,550,555,592,616,618,649,890,891,907,1039,1045,1046,1048,1060,1062,1063,1065,1132,1136,1139,1140,1166,1169,1172,1183,1210,1220,1222,1253,1471,1472,1475,1478,1518,1547,1570]},{"id":"symbol-df7e70e5021544f4","tex":"B","aliases":"B","display":"B","kind":"notation-table","occurrences":[14,321,1189,1190,1191,1192,1194,1195,1198,1284,30,34,44,47,64,65,66,248,311,312,313,314,316,317,323,329,332,334,335,336,434,438,439,441,593,617,618,631,632,637,640,651,712,713,890,891,907,1041,1045,1046,1048,1061,1062,1063,1065,1105,1107,1110,1115,1153,1155,1156,1157,1167,1170,1172,1178,1202,1205,1206,1208,1209,1210,1212,1215,1216,1220,1222,1224,1225,1226,1231,1236,1249,1251,1252,1253,1254,1256,1258,1259,1261,1264,1285,1287,1288,1289,1290,1291,1293,1297,1393,1396,1414,1470,1471,1472,1473,1475,1477,1478,1480,1483,1485,1487,1548,1549,1567,1570]},{"id":"symbol-b3b3732c9a3a550c","tex":"\\mathcal B","aliases":"B mathcal","display":"\\mathcal B","kind":"notation-table","occurrences":[15,1189,1198,1199,296,300,302,303,304,1248,1285,1337,1468,1475]},{"id":"symbol-3f79bb7b435b0532","tex":"e","aliases":"e","display":"e","kind":"notation-table","occurrences":[23,1198,1283,31,32,34,39,47,63,104,106,109,110,113,114,169,170,175,177,191,196,227,248,251,264,266,728,731,868,873,891,892,916,917,919,922,923,959,960,1188,1203,1209,1218,1252,1280,1337,1338,1339,1390,1440,1466,1467,1469,1472,1474,1475,1477,1487,1570]},{"id":"symbol-0b4eec345b52552e","tex":"e^\\varepsilon","aliases":"e^ε varepsilon","display":"e^\\varepsilon","kind":"notation-table","occurrences":[23,1390]},{"id":"symbol-f67ab10ad4e4c531","tex":"F","aliases":"F","display":"F","kind":"notation-table","occurrences":[20,321,307,409,717,47,72,75,76,80,180,204,207,275,280,289,291,299,314,406,408,418,423,444,451,459,466,467,479,489,510,515,668,682,684,691,696,732,733,734,735,832,833,834,854,927,936,945,946,947,1140,1141,1148,1301,1327,1354,1364,1365,1367,1383,1396,1415,1419,1556,1570,1605,1606,1608]},{"id":"symbol-cd0aa9856147b6c5","tex":"g","aliases":"g","display":"g","kind":"notation-table","occurrences":[21,409,47,63,196,205,206,207,331,332,334,338,339,399,407,408,418,423,449,459,464,466,467,479,490,502,504,510,515,832,833,839,857,859,860,864,867,870,880,881,885,886,891,898,905,913,918,929,936,952,953,954,1125,1130,1239,1247,1266,1267,1270,1273,1328,1353,1354,1363,1364,1365,1367,1383,1396,1415,1424,1567,1570]},{"id":"symbol-a83dd0ccbffe39d0","tex":"I","aliases":"I","display":"I","kind":"notation-table","occurrences":[11,209,210,220,221,222,223,717,778,1122,47,66,117,212,213,226,227,229,267,269,277,535,719,796,1352,1358,1373,1374,1376,1381,1384,1570,1577]},{"id":"symbol-86be9a55762d316a","tex":"K","aliases":"K","display":"K","kind":"notation-table","occurrences":[5,7,222,782,47,87,103,184,187,229,552,555,785,787,789,805,824,1020,1024,1059,1068,1070]},{"id":"symbol-16bc7321a3832aa5","tex":"K_u","aliases":"K_u","display":"K_u","kind":"notation-table","occurrences":[5,47,87,103,184,187]},{"id":"symbol-72dfcfb0c470ac25","tex":"L","aliases":"L","display":"L","kind":"notation-table","occurrences":[26,47,188,189,213,218,594,597,601,605,614,686,691,699,701,941,942,949,1478,1479,1481,1484,1488,1489,1494,1495,1497,1500,1501,1502,1514,1570]},{"id":"symbol-73f17951391086e7","tex":"L_*","aliases":"L_*","display":"L_*","kind":"notation-table","occurrences":[26,1479,1481,1484,1488,1489,1494,1495,1497,1501,1502,1514]},{"id":"symbol-5c62e091b8c0565f","tex":"P","aliases":"P","display":"P","kind":"notation-table","occurrences":[8,9,127,130,409,410,412,47,131,133,213,215,403,404,408,416,420,422,429,430,431,433,438,439,446,448,455,456,459,463,465,466,467,470,479,483,486,487,488,501,503,506,621,629,630,637,639,640,677,789,826,828,835,928,930,936,937,943,1303,1304,1386,1387,1389,1391,1393,1397,1398,1410,1415,1421,1422,1434,1435,1551,1553]},{"id":"symbol-4ae81572f06e1b88","tex":"Q","aliases":"Q","display":"Q","kind":"notation-table","occurrences":[6,8,9,47,90,665,738,744,745,746,749,751,752,761,767,774]},{"id":"symbol-baed31a30986ab0a","tex":"Q_u","aliases":"Q_u","display":"Q_u","kind":"notation-table","occurrences":[6,47,90]},{"id":"symbol-8c2574892063f995","tex":"R","aliases":"R","display":"R","kind":"notation-table","occurrences":[19,784,35,40,42,45,47,63,236,238,240,522,523,524,529,530,534,536,539,541,542,789,800,928,932,936,937,943,1092,1094,1097,1099,1101,1221,1222,1223,1224,1227,1229,1237,1246,1288,1427,1428,1429,1568,1570]},{"id":"symbol-236f80d54e55c576","tex":"R_*","aliases":"R_*","display":"R_*","kind":"notation-table","occurrences":[19,1223,1224,1229,1246]},{"id":"symbol-8de0b3c47f112c59","tex":"S","aliases":"S","display":"S","kind":"notation-table","occurrences":[1,54,55,1189,1198,1283,47,48,71,281,283,285,300,301,312,316,317,549,553,555,559,562,564,665,889,906,1137,1138,1142,1143,1144,1145,1146,1147,1150,1151,1152,1154,1157,1158,1176,1177,1184,1188,1203,1209,1217,1218,1252,1282,1469,1474,1475,1570,1577,1580,1582,1587,1593,1600]},{"id":"symbol-043a718774c572bd","tex":"s","aliases":"s","display":"s","kind":"notation-table","occurrences":[12,13,319,321,306,307,308,309,413,414,415,1191,1194,1198,1283,47,267,274,275,276,280,289,290,291,293,294,297,298,299,323,405,408,420,422,425,433,441,452,455,456,457,459,465,471,472,473,475,481,482,496,499,509,510,512,514,515,516,518,519,520,535,536,537,538,539,540,550,551,552,555,556,560,569,571,572,573,575,576,577,578,589,668,742,829,835,973,974,1007,1126,1130,1182,1183,1184,1185,1188,1203,1205,1209,1218,1252,1280,1305,1391,1392,1397,1398,1399,1401,1411,1412,1415,1423,1466,1467,1469,1474,1475,1557,1570]},{"id":"symbol-01027990b0cb85d6","tex":"\\operatorname{Succ}","aliases":"Succ operatorname","display":"\\operatorname{Succ}","kind":"notation-table","occurrences":[17,1195,1198,1220,1222,1254,1475,1478]},{"id":"symbol-0b7cc491b1ee030b","tex":"\\operatorname{supp}","aliases":"supp operatorname","display":"\\operatorname{supp}","kind":"notation-table","occurrences":[7,555]},{"id":"symbol-e632b7095b0bf32c","tex":"T","aliases":"T","display":"T","kind":"notation-table","occurrences":[4,25,318,321,47,177,225,227,316,322,323,325,333,334,671,683,684,685,689,691,696,698,732,733,734,735,795,796,798,803,804,853,854,935,936,937,938,942,944,945,946,947,949,952,953,1063,1065,1067,1117,1129,1130,1443,1449,1452,1475,1476,1478,1490,1493,1496,1498,1499,1570,1603,1604,1605,1606,1608]},{"id":"symbol-e3b98a4da31a127d","tex":"t","aliases":"t","display":"t","kind":"notation-table","occurrences":[0,209,210,244,245,247,715,716,717,1119,1120,1121,1122,1123,27,28,29,47,63,88,94,97,98,99,101,105,106,109,110,113,114,117,169,170,171,172,173,174,175,176,177,181,191,212,213,248,249,250,251,252,262,290,291,298,299,347,348,349,353,440,441,443,518,519,540,675,718,719,735,742,743,744,748,749,750,767,772,773,972,973,974,976,977,1007,1103,1105,1106,1112,1113,1114,1320,1322,1323,1324,1337,1338,1339,1434,1435,1436,1437,1438,1439,1440,1441,1444,1445,1451,1453,1454,1455,1467,1570]},{"id":"symbol-f90055131c0edf2c","tex":"T_*","aliases":"T_*","display":"T_*","kind":"notation-table","occurrences":[25,1476,1478,1493,1496,1498,1499]},{"id":"symbol-b3f5e05f76a79869","tex":"\\TV","aliases":"TV d_TV mathrm","display":"{d_{\\mathrm{TV}}}","kind":"notation-table","occurrences":[8,130,409,412,102,103,146,184,185,187,227,439,470,506,639,787,796,828,831]},{"id":"symbol-0bfe935e70c321c7","tex":"u","aliases":"u","display":"u","kind":"notation-table","occurrences":[5,6,717,1192,1194,1195,1198,1283,47,72,74,75,76,77,78,80,83,87,88,90,91,103,107,112,184,185,187,190,196,357,360,363,368,718,1184,1185,1196,1197,1220,1222,1293,1466,1471,1475,1478,1570]},{"id":"symbol-fcb5f40df9be6bae","tex":"W","aliases":"W","display":"W","kind":"notation-table","occurrences":[18,1198,1200,47,178,179,193,196,1016,1036,1054,1055,1062,1063,1075,1083,1202,1206,1207,1211,1212,1213,1214,1220,1222,1232,1235,1245,1262,1278,1287,1570,1577,1579,1582]},{"id":"symbol-75d8484cfed31738","tex":"W_*","aliases":"W_*","display":"W_*","kind":"notation-table","occurrences":[18,1200,1206,1207,1212,1213,1220,1222,1232,1235,1245,1262,1278,1287]},{"id":"symbol-4b68ab3847feda7d","tex":"X","aliases":"X","display":"X","kind":"notation-table","occurrences":[0,55,779,27,29,47,94,118,120,137,205,207]},{"id":"symbol-09868efb784faa54","tex":"\\mathcal X","aliases":"X mathcal","display":"\\mathcal X","kind":"notation-table","occurrences":[2]},{"id":"symbol-2d711642b726b044","tex":"x","aliases":"x","display":"x","kind":"notation-table","occurrences":[9,59,219,221,130,779,47,76,77,79,80,81,85,86,87,90,92,93,103,122,124,134,145,146,180,184,187,190,267,268,535,787,788,789,841,843,844,897,898,899,901,902,903,904,905,907,957,1103,1105,1111,1112,1337,1338,1339,1570]},{"id":"symbol-ab5f283acc8ce60c","tex":"X_t","aliases":"X_t","display":"X_t","kind":"notation-table","occurrences":[0,27,29,47,94]},{"id":"symbol-cbe5cfdf7c2118a9","tex":"|","aliases":"|","display":"|","kind":"notation-table","occurrences":[9,412,1199,102,300,301,726,1088,1089,1139,1141,1142,1144,1145,1146,1151,1157,1158,1451,1453]},{"id":"symbol-4893e9df8b5496eb","tex":"\\alpha","aliases":"α alpha","display":"\\alpha","kind":"notation-table","occurrences":[22,88,420,421,422,423,424,426,437,438,454,455,459,460,461,465,466,467,469,477,479,480,491,507,510,511,517,1302,1317,1322,1325,1329,1391,1393,1395,1396,1407,1412,1413,1414,1417,1555]},{"id":"symbol-f1941b975ffcc891","tex":"\\Delta","aliases":"Δ Delta","display":"\\Delta","kind":"notation-table","occurrences":[16,1194,1283,63,71,227,462,466,468,474,1184,1186,1187,1244,1298]},{"id":"symbol-daec86669d42946c","tex":"\\varepsilon","aliases":"ε varepsilon","display":"\\varepsilon","kind":"notation-table","occurrences":[23,63,103,106,109,110,111,113,114,115,132,134,181,184,185,187,189,191,684,687,691,694,700,701,787,791,796,797,801,802,804,828,832,833,835,837,838,936,937,942,944,949,950,1390,1440,1441]},{"id":"symbol-583cf6290785d72c","tex":"\\lambda","aliases":"λ lambda","display":"\\lambda","kind":"notation-table","occurrences":[23,24,127,129,130,131,226,227,267,272,279,462,463,464,466,467,468,473,476,478,479,484,500,501,502,503,504,521,979,981,1388,1389,1390,1393,1394,1396,1400,1402,1403,1404,1406,1408,1410,1412,1414,1416,1430,1436,1437,1438,1439,1440,1554]},{"id":"symbol-f1cf04093d08b6dc","tex":"\\pi","aliases":"π pi","display":"\\pi","kind":"notation-table","occurrences":[3,56,59,60,1283,1284,27,73,75,76,79,80,86,87,95,96,103,118,126,182,184,186,187,190,285,289,290,291,292,294,1282,1287,1288,1290,1291,1293,1294,1296,1608,1609]},{"id":"symbol-56dadbdf217ad92b","tex":"\\sum","aliases":"∑ sum","display":"\\sum","kind":"notation-table","occurrences":[9,59,411,412,414,34,87,102,177,189,191,257,260,346,348,352,363,368,441,456,463,464,473,691,750,789,916,922,965,1000,1112,1347,1441,1451,1453]},{"id":"symbol-0e44b9be25437975","tex":"\\sum_x","aliases":"∑_x sum","display":"\\sum_x","kind":"notation-table","occurrences":[9]},{"id":"symbol-09b0b2df35128655","tex":"\\mathcal A","aliases":"A mathcal","display":"\\mathcal A","kind":"definition-passage","occurrences":[221,70,71,274,282,284,926]},{"id":"symbol-861bfd8f1f28ff59","tex":"\\mathcal A_i","aliases":"A_i mathcal","display":"\\mathcal A_i","kind":"definition-passage","occurrences":[221]},{"id":"symbol-3f39d5c348e5b79d","tex":"D","aliases":"D","display":"D","kind":"definition-passage","occurrences":[208,211,409,410,412,1528,1529,30,34,44,63,274,276,280,289,291,297,299,397,398,404,408,416,422,423,426,428,430,431,433,438,439,459,472,473,496,512,515,519,659,660,662,664,701,755,758,826,827,828,830,831,832,833,837,838,896,897,899,1350,1362,1371,1372,1374,1387,1389,1391,1393,1398,1410,1415,1422,1435,1540,1551,1570]},{"id":"symbol-fa77d9059acbf531","tex":"F^A_m","aliases":"F^A_m","display":"F^A_m","kind":"definition-passage","occurrences":[321]},{"id":"symbol-7029cd6f04e528a0","tex":"F^B_{\\tau(s,m)}","aliases":"F^B_τ(s,m) tau","display":"F^B_{\\tau(s,m)}","kind":"definition-passage","occurrences":[321]},{"id":"symbol-de7d1b721a1e0632","tex":"i","aliases":"i","display":"i","kind":"definition-passage","occurrences":[53,221,778,780,782,784,34,47,48,63,160,181,192,193,194,195,196,230,232,345,346,347,348,349,350,351,352,353,355,357,359,360,363,365,368,597,599,600,654,655,785,786,787,788,789,790,792,800,805,806,807,809,810,811,812,824,841,842,843,844,845,853,854,856,857,859,860,861,866,867,869,870,874,876,877,878,880,881,882,884,885,886,897,898,903,905,912,913,916,918,919,922,935,936,957,958,961,965,1017,1018,1020,1023,1024,1028,1029,1056,1059,1064,1065,1068,1070,1111,1116,1118,1347,1461,1462,1463,1570]},{"id":"symbol-34b5a08da5138c3a","tex":"I_t","aliases":"I_t","display":"I_t","kind":"definition-passage","occurrences":[209,210,717,1122,212,213,719]},{"id":"symbol-7451eebb9fb0ad5d","tex":"K_I","aliases":"K_I","display":"K_I","kind":"definition-passage","occurrences":[222,229]},{"id":"symbol-584e1f4fc366a43f","tex":"\\Longleftrightarrow","aliases":"Longleftrightarrow","display":"\\Longleftrightarrow","kind":"definition-passage","occurrences":[321,1283,145,299,1030,1287,1288]},{"id":"symbol-62c66a7a5dd70c31","tex":"m","aliases":"m","display":"m","kind":"definition-passage","occurrences":[320,321,305,307,308,781,47,63,323,328,331,372,373,374,375,376,377,378,379,447,450,459,462,466,468,474,665,668,688,689,691,693,695,696,697,698,699,700,701,787,789,808,809,810,813,814,1432,1437,1570]},{"id":"symbol-c4694f2e93d5c4e7","tex":"O","aliases":"O","display":"O","kind":"definition-passage","occurrences":[53,55,47,67,69,71,445,455,456,481,485,509,928,931,936,937,943,1337,1339,1428,1429,1431]},{"id":"symbol-6ca61f3078014d2e","tex":"\\mathcal O","aliases":"O mathcal","display":"\\mathcal O","kind":"definition-passage","occurrences":[53,402,435]},{"id":"symbol-962eb33121c4bcf4","tex":"O_i","aliases":"O_i","display":"O_i","kind":"definition-passage","occurrences":[53]},{"id":"symbol-881d6987a42aea74","tex":"\\mathcal O_i","aliases":"O_i mathcal","display":"\\mathcal O_i","kind":"definition-passage","occurrences":[53]},{"id":"symbol-d08d07be26360470","tex":"O_S","aliases":"O_S","display":"O_S","kind":"definition-passage","occurrences":[55,71]},{"id":"symbol-ad17208a282be173","tex":"\\push","aliases":"push","display":null,"kind":"definition-passage","occurrences":[59,89,103,184]},{"id":"symbol-e53fe76bd3b89fa2","tex":"\\X","aliases":"X mathcal","display":"{\\mathcal X}","kind":"definition-passage","occurrences":[53,56,58,47,72,73,125,182]},{"id":"symbol-7f2315ed2fa0ec08","tex":"\\Z","aliases":"Z mathcal","display":"{\\mathcal Z}","kind":"definition-passage","occurrences":[56,73,74,181,182,183]},{"id":"symbol-594e519ae499312b","tex":"z","aliases":"z","display":"z","kind":"definition-passage","occurrences":[59,60,61,130,1527,1528,1529,47,80,82,84,87,91,102,121,123,124,126,133,134,137,138,139,140,141,142,158,159,160,167,185,436,440,441,574,578,586,591,684,690,691,696,936,945,946,947,952,953,954,980,981,984,985,988,1065,1511,1524,1525,1534,1536,1537,1539,1540,1570]},{"id":"symbol-492247e1bab15272","tex":"\\mu","aliases":"μ mu","display":"\\mu","kind":"definition-passage","occurrences":[57,59,89,102,740,744,746,749,767,786,787,789,805,806,807,809,811]},{"id":"symbol-6a331de74ff475c9","tex":"\\pi^{-1}","aliases":"π^-1 pi","display":"\\pi^{-1}","kind":"definition-passage","occurrences":[60,126]},{"id":"symbol-55d1823545b5b4c3","tex":"\\tau","aliases":"τ tau","display":"\\tau","kind":"definition-passage","occurrences":[318,321,145,146,317,323,324,742,744,746,750,762]},{"id":"symbol-5b86eb1897c44804","tex":"\\ell","aliases":"ℓ ell","display":"\\ell","kind":"definition-passage","occurrences":[321,308,68,69,71,281,289,291,297,597,599,600,602,604,611,612,934,1266,1267,1272,1275,1506,1513,1517]},{"id":"symbol-1b5b4e6ee09dffe3","tex":"\\ell_A","aliases":"ℓ_A ell","display":"\\ell_A","kind":"definition-passage","occurrences":[321]},{"id":"symbol-96a5e0d2554892b6","tex":"\\ell_B","aliases":"ℓ_B ell","display":"\\ell_B","kind":"definition-passage","occurrences":[321]},{"id":"symbol-1e6eb42c12591791","tex":"\\to","aliases":"→ to","display":"\\to","kind":"definition-passage","occurrences":[53,56,247,72,73,74,182,183,281,285,316,317,546,548,569,570,571,577,578,580,581,665,682,683,853,856,877,890,935,938,939,1063,1091,1092,1093,1136,1172,1177,1257,1282]},{"id":"symbol-f2466f7003a98443","tex":"\\sum_{x:\\pi(x)=z}","aliases":"∑_x:π(x)=z sum pi","display":"\\sum_{x:\\pi(x)=z}","kind":"definition-passage","occurrences":[59]},{"id":"symbol-a318c24216defe20","tex":"+","aliases":"+","display":"+","kind":"introduction-passage","occurrences":[128,717,1122,1198,39,47,94,97,98,106,109,110,113,114,116,117,145,146,170,175,177,187,191,252,299,304,332,334,341,349,374,510,515,555,568,637,640,683,684,691,701,706,707,709,726,735,761,762,805,809,833,835,838,942,944,965,967,982,989,993,1080,1089,1105,1112,1126,1142,1144,1222,1314,1316,1379,1393,1406,1410,1412,1475,1478]},{"id":"symbol-ca978112ca1bbdca","tex":"a","aliases":"a","display":"a","kind":"introduction-passage","occurrences":[1198,1283,47,63,95,97,98,99,170,171,173,176,177,230,231,263,265,275,276,280,289,291,295,299,365,368,552,555,571,577,580,582,595,596,647,648,666,667,668,675,676,828,927,936,945,946,947,976,977,1091,1094,1096,1133,1134,1160,1162,1188,1203,1209,1218,1252,1280,1397,1400,1402,1403,1405,1406,1407,1452,1453,1457,1469,1474,1475,1544,1562,1570,1605,1606,1609]},{"id":"symbol-6b23c0d5f35d1b11","tex":"C","aliases":"C","display":"C","kind":"introduction-passage","occurrences":[409,410,412,1529,1532,1533,30,34,44,47,50,323,396,400,403,408,416,420,422,429,433,438,439,446,455,459,465,466,467,470,479,483,486,501,503,505,506,507,510,515,517,674,826,827,828,830,831,832,833,835,837,838,890,891,907,1025,1030,1048,1058,1069,1074,1075,1081,1082,1084,1085,1086,1088,1089,1168,1171,1172,1173,1174,1303,1304,1349,1359,1370,1375,1376,1382,1384,1386,1389,1391,1393,1397,1410,1415,1421,1434,1459,1461,1462,1463,1521,1522,1523,1525,1534,1535,1541,1542,1553,1570]},{"id":"symbol-db3c7ac2786221e9","tex":"\\mathcal C","aliases":"C mathcal","display":"\\mathcal C","kind":"introduction-passage","occurrences":[715,717,63,703,707,708,720,723,724,726,1248,1251,1254,1257,1262,1263,1265]},{"id":"symbol-2e7d2c03a9507ae2","tex":"c","aliases":"c","display":"c","kind":"introduction-passage","occurrences":[247,1121,1122,47,63,248,262,263,264,267,273,278,326,327,331,366,368,369,370,371,373,374,377,379,382,387,394,571,579,580,581,583,586,588,675,676,928,929,936,943,944,951,952,953,954,955,957,958,961,1125,1126,1130,1163,1164,1299,1309,1310,1311,1312,1314,1315,1316,1355,1356,1361,1364,1365,1369,1378,1379,1385,1445,1451,1453,1455,1550,1562,1563,1564,1570,1605,1606,1609,1617]},{"id":"symbol-87871832cc0d50ff","tex":"\\mathcal C_t","aliases":"C_t mathcal","display":"\\mathcal C_t","kind":"introduction-passage","occurrences":[715,717]},{"id":"symbol-c99be13da294dc50","tex":"c_t","aliases":"c_t","display":"c_t","kind":"introduction-passage","occurrences":[247,1121,1122,248,262,1445,1451,1453,1455]},{"id":"symbol-c1e92538a918e673","tex":"\\mathcal C_{t+1}","aliases":"C_t+1 mathcal","display":"\\mathcal C_{t+1}","kind":"introduction-passage","occurrences":[717]},{"id":"symbol-dac734820522a9ee","tex":"c_{t+1}","aliases":"c_t+1","display":"c_{t+1}","kind":"introduction-passage","occurrences":[1122]},{"id":"symbol-a7d678072fed2039","tex":"C_v","aliases":"C_v","display":"C_v","kind":"introduction-passage","occurrences":[1529,1521,1522,1525,1541]},{"id":"symbol-e92b1df899796cf6","tex":"C_w","aliases":"C_w","display":"C_w","kind":"introduction-passage","occurrences":[1533]},{"id":"symbol-8ca82c16234f1275","tex":"\\mathcal D","aliases":"D mathcal","display":"\\mathcal D","kind":"introduction-passage","occurrences":[246,247]},{"id":"symbol-18ac3e7343f01689","tex":"d","aliases":"d","display":"d","kind":"introduction-passage","occurrences":[410,411,412,414,47,63,121,146,160,163,164,166,181,200,201,264,266,654,658,681,684,691,760,761,762,765,768,911,913,916,917,919,922,923,925,936,937,942,949,950,1164,1313,1314,1315,1316,1448,1449,1451,1453,1466,1472,1475,1477,1487,1504,1505,1507,1510,1516,1570,1605,1606,1609,1617]},{"id":"symbol-ef97823489e8f12d","tex":"D_v","aliases":"D_v","display":"D_v","kind":"introduction-passage","occurrences":[1528,1529,1540]},{"id":"symbol-a9f51566bd6705f7","tex":"E","aliases":"E","display":"E","kind":"introduction-passage","occurrences":[1334,1336,159,160,163,164,166,213,216,252,840,855,928,929,933,936,937,943,955,962,965,1024,1025,1032,1046,1389]},{"id":"symbol-060ae96635fef1f6","tex":"\\mathcal E","aliases":"E mathcal","display":"\\mathcal E","kind":"introduction-passage","occurrences":[776,224,227,315]},{"id":"symbol-27ca42d64343fc33","tex":"\\mathsf{epoch}","aliases":"epoch mathsf","display":"\\mathsf{epoch}","kind":"introduction-passage","occurrences":[305]},{"id":"symbol-252f10c83610ebca","tex":"f","aliases":"f","display":"f","kind":"introduction-passage","occurrences":[1198,1283,47,63,69,757,761,762,763,768,1093,1094,1100,1136,1188,1203,1209,1218,1252,1280,1469,1474,1475,1570]},{"id":"symbol-8e49021145d6ab04","tex":"F_m","aliases":"F_m","display":"F_m","kind":"introduction-passage","occurrences":[307,691]},{"id":"symbol-333e0a1e27815d0c","tex":"G","aliases":"G","display":"G","kind":"introduction-passage","occurrences":[717,1119,1122,1283,63,234,238,240,840,857,858,866,868,873,889,891,892,895,910,916,917,919,922,923,1218,1219,1220,1259,1260,1466,1467,1474,1475,1482,1486,1491,1518,1570]},{"id":"symbol-b4f9811bf3c61e66","tex":"G_t","aliases":"G_t","display":"G_t","kind":"introduction-passage","occurrences":[1119,1122]},{"id":"symbol-d8313a7d60fe037e","tex":"G_{t+1}","aliases":"G_t+1","display":"G_{t+1}","kind":"introduction-passage","occurrences":[1122]},{"id":"symbol-44bd7ae60f478fae","tex":"H","aliases":"H","display":"H","kind":"introduction-passage","occurrences":[1122,1123,1333,1335,625,627,628,635,644,645,647,673,674,754,756,762,864,868,871,888,916,917,920,921,922,923,1570]},{"id":"symbol-aaa9402664f1a41f","tex":"h","aliases":"h","display":"h","kind":"introduction-passage","occurrences":[1189,1194,1283,47,137,138,197,199,230,233,554,555,557,558,560,561,563,565,566,567,568,729,730,866,867,869,870,871,873,874,880,881,882,912,913,918,920,1094,1095,1099,1128,1130,1177,1179,1295,1345,1346,1348,1433,1434,1435,1570]},{"id":"symbol-ff6b0f89378f4410","tex":"h^{-1}","aliases":"h^-1","display":"h^{-1}","kind":"introduction-passage","occurrences":[1194,1295]},{"id":"symbol-814f64e7253b7d27","tex":"H_t","aliases":"H_t","display":"H_t","kind":"introduction-passage","occurrences":[1122,1123]},{"id":"symbol-e6884a0c40dcac51","tex":"\\mathcal I","aliases":"I mathcal","display":"\\mathcal I","kind":"introduction-passage","occurrences":[775,354]},{"id":"symbol-95d680fad2ccb816","tex":"I_n","aliases":"I_n","display":"I_n","kind":"introduction-passage","occurrences":[778]},{"id":"symbol-7d929052114e2b78","tex":"\\mathsf{issuer}","aliases":"issuer mathsf","display":"\\mathsf{issuer}","kind":"introduction-passage","occurrences":[305]},{"id":"symbol-189f40034be7a199","tex":"j","aliases":"j","display":"j","kind":"introduction-passage","occurrences":[784,37,38,39,47,177,189,191,194,195,196,257,260,368,433,447,448,449,458,459,463,464,472,473,505,506,510,512,515,519,600,654,656,680,681,682,683,684,685,686,687,688,691,703,704,705,706,707,708,709,789,842,843,845,853,854,856,857,859,860,862,867,870,877,879,880,881,885,886,898,905,913,916,918,919,922,924,925,927,929,935,936,958,1112,1133,1135,1446,1447,1448,1449,1451,1453,1456,1570]},{"id":"symbol-8254c329a92850f6","tex":"k","aliases":"k","display":"k","kind":"introduction-passage","occurrences":[1198,31,33,38,39,47,161,162,163,164,165,166,256,299,303,304,388,389,390,391,392,393,428,691,863,864,865,869,871,882,883,884,886,888,915,917,922,923,1139,1141,1142,1144,1145,1149,1151,1159,1161,1165,1201,1202,1204,1211,1214,1222,1227,1228,1237,1286,1287,1288,1459,1475,1478,1490,1492,1500,1570]},{"id":"symbol-0c7bd880455e7fb0","tex":"K_i","aliases":"K_i","display":"K_i","kind":"introduction-passage","occurrences":[782,785,805,824,1020,1024,1059,1068,1070]},{"id":"symbol-581b4f8b484b100b","tex":"\\mathsf{kind}","aliases":"kind mathsf","display":"\\mathsf{kind}","kind":"introduction-passage","occurrences":[305]},{"id":"symbol-08f271887ce94707","tex":"M","aliases":"M","display":"M","kind":"introduction-passage","occurrences":[244,245,968,970,1331,47,49,248,252,619,621,622,623,663,675,676,818,821,823,1344]},{"id":"symbol-9de6a9970cb6757b","tex":"M_t","aliases":"M_t","display":"M_t","kind":"introduction-passage","occurrences":[244,245,47,248,252]},{"id":"symbol-19f3073c143a3a98","tex":"\\mid","aliases":"mid","display":null,"kind":"introduction-passage","occurrences":[970,1122,47,88,97,98,117,145,146,227,552,555,974,1040,1042,1434,1435]},{"id":"symbol-1b16b1df538ba12d","tex":"n","aliases":"n","display":"n","kind":"introduction-passage","occurrences":[777,778,779,783,784,47,63,159,161,181,197,198,202,203,356,364,369,371,374,380,394,395,793,936,937,942,949,950,962,965,966,967,1003,1004,1005,1011,1025,1031,1032,1034,1035,1072,1078,1079,1080,1088,1089,1103,1104,1466,1471,1472,1475,1477,1478,1487,1570]},{"id":"symbol-b8be2dc73c4dd73d","tex":"\\mathsf{nonce}","aliases":"nonce mathsf","display":"\\mathsf{nonce}","kind":"introduction-passage","occurrences":[305]},{"id":"symbol-65c74c15a686187b","tex":"o","aliases":"o","display":"o","kind":"introduction-passage","occurrences":[410,411,412,414,415,39,47,63,121,401,405,435,441,452,453,456,482,483,654,660,829,830,1570]},{"id":"symbol-01eecdf5cc4bca8b","tex":"\\overline A","aliases":"overline A overline","display":"\\overline A","kind":"introduction-passage","occurrences":[1283,1280]},{"id":"symbol-9b0ad0f92e6daea0","tex":"\\overline G","aliases":"overline G overline","display":"\\overline G","kind":"introduction-passage","occurrences":[1283,1280]},{"id":"symbol-9ea515a6ead5b2d4","tex":"\\overline h","aliases":"overline h overline","display":"\\overline h","kind":"introduction-passage","occurrences":[1283,1280]},{"id":"symbol-1766d7a5f31944e1","tex":"\\overline S","aliases":"overline S overline","display":"\\overline S","kind":"introduction-passage","occurrences":[1283,1280,1282]},{"id":"symbol-55aa78fb2320522b","tex":"\\overline S_{\\rm safe}","aliases":"overline S_rm safe overline rm","display":"\\overline S_{\\rm safe}","kind":"introduction-passage","occurrences":[1283,1280]},{"id":"symbol-95524823843282fd","tex":"\\overline\\Delta","aliases":"overlineΔ overline Delta","display":"\\overline\\Delta","kind":"introduction-passage","occurrences":[1283,1280]},{"id":"symbol-0b67a2140e399c4e","tex":"P_C","aliases":"P_C","display":"P_C","kind":"introduction-passage","occurrences":[409,410,412,403,408,416,420,422,429,433,438,439,446,455,459,465,466,467,470,479,483,486,501,503,506,826,835,1303,1304,1386,1389,1391,1393,1397,1410,1415,1421,1553]},{"id":"symbol-a9d31d0c349bd2e3","tex":"P_D","aliases":"P_D","display":"P_D","kind":"introduction-passage","occurrences":[409,410,412,404,408,416,422,438,439,826,1387,1389,1391,1393,1398,1410,1415,1422,1551]},{"id":"symbol-5ed30585279498bf","tex":"P_\\lambda","aliases":"P_λ lambda","display":"P_\\lambda","kind":"introduction-passage","occurrences":[127,130,131,463,466,467,479,501,503]},{"id":"symbol-21e83399daffb8b6","tex":"P_{\\lambda'}","aliases":"P_λ' lambda","display":"P_{\\lambda'}","kind":"introduction-passage","occurrences":[130]},{"id":"symbol-de93a32bd3ccecc2","tex":"\\mathsf{payload}","aliases":"payload mathsf","display":"\\mathsf{payload}","kind":"introduction-passage","occurrences":[305]},{"id":"symbol-e695ee90e9b92c62","tex":"\\operatorname{Post}","aliases":"Post operatorname","display":"\\operatorname{Post}","kind":"introduction-passage","occurrences":[1194,1293]},{"id":"symbol-6c033af8552f2dad","tex":"\\Pr","aliases":"Pr","display":"\\Pr","kind":"introduction-passage","occurrences":[970]},{"id":"symbol-ffc41bdcb0951586","tex":"\\mathcal Q","aliases":"Q mathcal","display":"\\mathcal Q","kind":"introduction-passage","occurrences":[716,717,678,679,702,703,714,721,723,724,726]},{"id":"symbol-03372583aa2e6154","tex":"\\mathcal Q_t","aliases":"Q_t mathcal","display":"\\mathcal Q_t","kind":"introduction-passage","occurrences":[716,717]},{"id":"symbol-72c3e7af491c9a99","tex":"\\mathcal Q_{t+1}","aliases":"Q_t+1 mathcal","display":"\\mathcal Q_{t+1}","kind":"introduction-passage","occurrences":[717]},{"id":"symbol-454349e422f05297","tex":"r","aliases":"r","display":"r","kind":"introduction-passage","occurrences":[1120,1122,47,63,194,195,196,267,271,355,356,357,358,360,615,616,617,676,732,734,735,759,761,762,764,766,769,770,872,873,875,887,888,899,900,901,902,904,920,990,991,999,1000,1100,1225,1230,1231,1233,1234,1257,1258,1261,1264,1266,1267,1268,1279,1447,1449,1451,1453,1471,1477,1478,1487,1503,1508,1509,1515,1536,1537,1538,1539,1570,1572,1573,1574,1575,1578,1583,1586,1592,1594,1615]},{"id":"symbol-00c00f8247bf728a","tex":"R_i","aliases":"R_i","display":"R_i","kind":"introduction-passage","occurrences":[784,789,800]},{"id":"symbol-7d0b0aaec388130d","tex":"r_t","aliases":"r_t","display":"r_t","kind":"introduction-passage","occurrences":[1120,1122]},{"id":"symbol-c5d0744b62ca38dd","tex":"r_{t+1}","aliases":"r_t+1","display":"r_{t+1}","kind":"introduction-passage","occurrences":[1122]},{"id":"symbol-e402978cefc6e89c","tex":"\\rm","aliases":"rm","display":null,"kind":"introduction-passage","occurrences":[1198,1283,63,181,196,675,676,936,937,942,949,950,1188,1203,1209,1218,1252,1280,1337,1338,1339,1466,1467,1469,1471,1472,1474,1475,1477,1478,1487]},{"id":"symbol-1ad04db978145bef","tex":"S_{\\rm safe}","aliases":"S_rm safe rm","display":"S_{\\rm safe}","kind":"introduction-passage","occurrences":[1198,1283,1188,1203,1209,1218,1252,1469,1474,1475]},{"id":"symbol-729e41c77e53a59d","tex":"\\sup","aliases":"sup","display":"\\sup","kind":"introduction-passage","occurrences":[130,103,146,227,684,787,936]},{"id":"symbol-4f9add33b306e767","tex":"\\sup_{\\lambda,\\lambda'\\in\\Lambda(x,z')}","aliases":"sup_λ,λ'∈Λ(x,z') sup lambda lambda in Lambda","display":"\\sup_{\\lambda,\\lambda'\\in\\Lambda(x,z')}","kind":"introduction-passage","occurrences":[130]},{"id":"symbol-c6f5e71887472d54","tex":"\\mathcal T","aliases":"T mathcal","display":"\\mathcal T","kind":"introduction-passage","occurrences":[62,63,144,145,146]},{"id":"symbol-2a4a57b7bee5acb6","tex":"\\mathcal U","aliases":"U mathcal","display":"\\mathcal U","kind":"introduction-passage","occurrences":[243,244,252]},{"id":"symbol-a6ab3f6998c3dac0","tex":"u_t","aliases":"u_t","display":"u_t","kind":"introduction-passage","occurrences":[717,718]},{"id":"symbol-de5a6f78116eca62","tex":"V","aliases":"V","display":"V","kind":"introduction-passage","occurrences":[245,247,1332,71,248,332,334,465,466,467,470,479,522,523,527,528,532,553,555,557,560,562,567,568,605,606,607,608,610,613,736,737,739,741,742,747,753,840,844,855,1520,1570]},{"id":"symbol-4c94485e0c21ae6c","tex":"v","aliases":"v","display":"v","kind":"introduction-passage","occurrences":[1526,1527,1528,1529,1530,47,254,255,256,257,258,259,260,543,545,547,863,864,865,871,1023,1030,1065,1108,1110,1111,1112,1113,1521,1522,1524,1525,1534,1536,1537,1539,1540,1541,1570]},{"id":"symbol-21f030f572f5b2a5","tex":"V_t","aliases":"V_t","display":"V_t","kind":"introduction-passage","occurrences":[245,247,248]},{"id":"symbol-50e721e49c013f00","tex":"w","aliases":"w","display":"w","kind":"introduction-passage","occurrences":[1531,1533,47,87,196,248,249,255,257,259,260,351,353,620,621,622,623,959,960,1021,1023,1026,1027,1030,1055,1065,1066,1067,1105,1106,1112,1113,1378,1379,1385,1560,1561,1570]},{"id":"symbol-b9d7c18b6334d33d","tex":"W_0","aliases":"W_0","display":"W_0","kind":"introduction-passage","occurrences":[1198]},{"id":"symbol-cf76327e749de1b7","tex":"W_k","aliases":"W_k","display":"W_k","kind":"introduction-passage","occurrences":[1198,1202,1211,1214,1287]},{"id":"symbol-b5731a3740a4e086","tex":"W_{k+1}","aliases":"W_k+1","display":"W_{k+1}","kind":"introduction-passage","occurrences":[1198]},{"id":"symbol-dacac00565e66fe6","tex":"\\widehat X","aliases":"widehat X widehat","display":"\\widehat X","kind":"introduction-passage","occurrences":[783,784]},{"id":"symbol-447a3c0003fa94fb","tex":"\\widehat X_n","aliases":"widehat X_n widehat","display":"\\widehat X_n","kind":"introduction-passage","occurrences":[783,784]},{"id":"symbol-fcfbe991e8a25e0f","tex":"X_n","aliases":"X_n","display":"X_n","kind":"introduction-passage","occurrences":[779]},{"id":"symbol-18f5384d58bcb1bb","tex":"Y","aliases":"Y","display":"Y","kind":"introduction-passage","occurrences":[128,65,66,69,116,117,138,145,146,227,1177]},{"id":"symbol-a1fce4363854ff88","tex":"y","aliases":"y","display":"y","kind":"introduction-passage","occurrences":[1193,1194,47,63,181,574,577,583,591,789,936,937,942,949,950,1292,1293,1295,1570]},{"id":"symbol-3c453920b3857736","tex":"Y^+","aliases":"Y^+","display":"Y^+","kind":"introduction-passage","occurrences":[128,116,117,145,146]},{"id":"symbol-1479ca52dd340112","tex":"z'","aliases":"z'","display":"z'","kind":"introduction-passage","occurrences":[130,84,87,91,121,123,124,126,133,134,140,141,142,160]},{"id":"symbol-8779068734acaece","tex":"\\cdot","aliases":"· cdot","display":"\\cdot","kind":"introduction-passage","occurrences":[1122,47,90,103,184,185,187,190,552,555,787,792,898,905,1434,1435]},{"id":"symbol-57885e4c75965b23","tex":"\\Gamma","aliases":"Γ Gamma","display":"\\Gamma","kind":"introduction-passage","occurrences":[1122,281,459,460,461,466,855,1124,1317]},{"id":"symbol-5b1f633540b1d1ef","tex":"\\Gamma_{I_t}","aliases":"Γ_I_t Gamma","display":"\\Gamma_{I_t}","kind":"introduction-passage","occurrences":[1122]},{"id":"symbol-59a94416a2a319ca","tex":"\\eta","aliases":"η eta","display":"\\eta","kind":"introduction-passage","occurrences":[130,134,135,136,508,510,513,515,636,637,638,639,640,641,642,989]},{"id":"symbol-2b4af44cb17349bb","tex":"\\theta","aliases":"θ theta","display":"\\theta","kind":"introduction-passage","occurrences":[969,970,624,626,645,646,648,650,652,971,974,975,978,992,1004,1006,1007,1012,1426,1429,1431]},{"id":"symbol-055de4ec3d8e4886","tex":"\\kappa","aliases":"κ kappa","display":"\\kappa","kind":"introduction-passage","occurrences":[1526,1527,108,109,114,1109,1110,1112,1114,1250,1253,1254,1255]},{"id":"symbol-fd0a204d0362614f","tex":"\\kappa_v","aliases":"κ_v kappa","display":"\\kappa_v","kind":"introduction-passage","occurrences":[1526,1527]},{"id":"symbol-4e73a24d6dbb26ff","tex":"\\Lambda","aliases":"Λ Lambda","display":"\\Lambda","kind":"introduction-passage","occurrences":[130,124,181]},{"id":"symbol-11c22a9994059ca8","tex":"\\lambda'","aliases":"λ' lambda","display":"\\lambda'","kind":"introduction-passage","occurrences":[130]},{"id":"symbol-b161bf60d6b2d19d","tex":"\\exists","aliases":"∃ exists","display":"\\exists","kind":"introduction-passage","occurrences":[1198,555,571,1065,1222,1475,1478]},{"id":"symbol-4bab02d584adcb84","tex":"\\varnothing","aliases":"∅ varnothing","display":"\\varnothing","kind":"introduction-passage","occurrences":[1189,1075,1158,1488]},{"id":"symbol-729f2cd8398e9960","tex":"\\in","aliases":"∈ in","display":"\\in","kind":"introduction-passage","occurrences":[130,1191,1192,1194,1198,1283,33,34,71,145,146,167,227,230,276,289,291,299,355,365,405,435,436,437,447,452,454,455,456,459,462,465,466,468,481,509,543,544,555,560,597,624,684,690,828,841,843,844,857,866,897,899,906,928,943,964,971,973,977,984,1024,1029,1075,1095,1103,1202,1205,1206,1212,1220,1222,1224,1251,1253,1285,1287,1288,1395,1426,1451,1475,1478,1525,1534]},{"id":"symbol-8509fe8bdd8a2289","tex":"\\sum_{d(o)>0}","aliases":"∑_d(o)>0 sum","display":"\\sum_{d(o)>0}","kind":"introduction-passage","occurrences":[414]},{"id":"symbol-ccbd66bdaed18a2b","tex":"\\sum_o","aliases":"∑_o sum","display":"\\sum_o","kind":"introduction-passage","occurrences":[411,412,414]},{"id":"symbol-795a720997b72208","tex":"\\cap","aliases":"∩ cap","display":"\\cap","kind":"introduction-passage","occurrences":[1194,1075]},{"id":"symbol-616522c60d7b122c","tex":"\\sim","aliases":"∼ sim","display":"\\sim","kind":"introduction-passage","occurrences":[1122,1017,1023,1028,1045,1056,1065]},{"id":"symbol-4d3a285fd7941bf1","tex":"\\ne","aliases":"≠ ne","display":"\\ne","kind":"introduction-passage","occurrences":[1189,38,160,368,618,892,1004,1075,1158,1488]},{"id":"symbol-b92a69b030a52379","tex":"\\leq","aliases":"≤ leq","display":"\\leq","kind":"introduction-passage","occurrences":[409,413,414,34,103,106,109,113,114,134,161,166,170,173,174,175,177,184,185,187,374,393,418,420,421,422,423,438,439,455,459,506,510,514,595,637,639,640,660,761,787,796,797,805,828,832,835,942,944,1004,1079,1139,1141,1159,1322,1323]},{"id":"symbol-2dd02f064b00c6d5","tex":"\\geq","aliases":"≥ geq","display":"\\geq","kind":"introduction-passage","occurrences":[781,169,364,385,392,449,450,460,467,507,508,510,515,519,742,743,750,761,795,818,1089,1142,1151,1201,1314]},{"id":"symbol-39c3d5a5ec4b06af","tex":"\\subseteq","aliases":"⊆ subseteq","display":"\\subseteq","kind":"introduction-passage","occurrences":[244,245,1189,1198,1529,252,274,555,605,703,707,1030,1138,1140,1142,1158,1183,1184,1188,1209,1218,1220,1222,1248,1252,1254,1259,1450,1452,1474,1475,1478,1521,1541]},{"id":"symbol-0ac7e4b05dea168a","tex":"\\bigcap","aliases":"⋂ bigcap","display":"\\bigcap","kind":"introduction-passage","occurrences":[1191]},{"id":"symbol-c4af609ad047671b","tex":"\\bigcap_{s\\in B}","aliases":"⋂_s∈ B bigcap in","display":"\\bigcap_{s\\in B}","kind":"introduction-passage","occurrences":[1191]},{"id":"symbol-036096cd7e9ecc74","tex":"\\bigcup","aliases":"⋃ bigcup","display":"\\bigcup","kind":"introduction-passage","occurrences":[1194,1451]},{"id":"symbol-77e93ecdf7164d2a","tex":"\\bigcup_{s\\in B}","aliases":"⋃_s∈ B bigcup in","display":"\\bigcup_{s\\in B}","kind":"introduction-passage","occurrences":[1194]},{"id":"symbol-c0eca90b4aa4b1d1","tex":"\\mathbf1","aliases":"1 mathbf","display":"\\mathbf1","kind":"use","occurrences":[744,746,767,805,806,809,1007]},{"id":"symbol-24f07e60acb49c42","tex":"A_*","aliases":"A_*","display":"A_*","kind":"use","occurrences":[1220,1222]},{"id":"symbol-1426674c44e8876f","tex":"a_1","aliases":"a_1","display":"a_1","kind":"use","occurrences":[647,648,976]},{"id":"symbol-e5cda8318149bdb8","tex":"a_2","aliases":"a_2","display":"a_2","kind":"use","occurrences":[647,648]},{"id":"symbol-6d7097da4387177a","tex":"a_i","aliases":"a_i","display":"a_i","kind":"use","occurrences":[365,368]},{"id":"symbol-7435dd184fb65352","tex":"a_j","aliases":"a_j","display":"a_j","kind":"use","occurrences":[368]},{"id":"symbol-5b950cf09bc94cd2","tex":"A_{\\rm end}","aliases":"A_rm end rm","display":"A_{\\rm end}","kind":"use","occurrences":[1472,1475]},{"id":"symbol-4f6eb91cb1eca840","tex":"A_{\\rm run}","aliases":"A_rm run rm","display":"A_{\\rm run}","kind":"use","occurrences":[1471,1478]},{"id":"symbol-82821bc2124f1658","tex":"A_t","aliases":"A_t","display":"A_t","kind":"use","occurrences":[47,213,252]},{"id":"symbol-b2e272b5b4c3d27e","tex":"a_t","aliases":"a_t","display":"a_t","kind":"use","occurrences":[170,171,173,176,177,977]},{"id":"symbol-9d81388db8446d61","tex":"a_{t-1}","aliases":"a_t-1","display":"a_{t-1}","kind":"use","occurrences":[976]},{"id":"symbol-4faecfcca4a3cf4c","tex":"\\abs","aliases":"abs","display":null,"kind":"use","occurrences":[160]},{"id":"symbol-81e6e5218cf492d2","tex":"\\mathsf{Assumptions}","aliases":"Assumptions mathsf","display":"\\mathsf{Assumptions}","kind":"use","occurrences":[1519]},{"id":"symbol-c714218dd4336db3","tex":"\\mathsf{Auth}","aliases":"Auth mathsf","display":"\\mathsf{Auth}","kind":"use","occurrences":[1337,1340]},{"id":"symbol-b863979fb4982e9c","tex":"\\mathsf{authority}","aliases":"authority mathsf","display":"\\mathsf{authority}","kind":"use","occurrences":[654]},{"id":"symbol-3e23e8160039594a","tex":"b","aliases":"b","display":"b","kind":"use","occurrences":[47,96,97,98,170,172,174,176,177,263,265,345,346,349,352,353,367,368,369,371,373,374,377,379,381,386,394,395,571,578,581,585,595,596,843,845,850,851,852,958,1126,1127,1130,1160,1162,1163,1266,1276,1356,1364,1365,1369,1379,1398,1400,1402,1403,1452,1453,1457,1512,1545,1570,1605,1606,1609]},{"id":"symbol-3ea71b67efc35822","tex":"B_0","aliases":"B_0","display":"B_0","kind":"use","occurrences":[631,637,640,1178,1249,1256,1261,1264]},{"id":"symbol-56e5c919eaefa876","tex":"\\mathcal B_0","aliases":"B_0 mathcal","display":"\\mathcal B_0","kind":"use","occurrences":[296,300,302]},{"id":"symbol-6c531ab121c021a5","tex":"B_1","aliases":"B_1","display":"B_1","kind":"use","occurrences":[632,637,640]},{"id":"symbol-fb9e4008ca2e6c3a","tex":"b_{12}","aliases":"b_12","display":"b_{12}","kind":"use","occurrences":[850]},{"id":"symbol-f2cec4611ded7308","tex":"b_{23}","aliases":"b_23","display":"b_{23}","kind":"use","occurrences":[851]},{"id":"symbol-b560aea36fa2e800","tex":"b_{31}","aliases":"b_31","display":"b_{31}","kind":"use","occurrences":[852]},{"id":"symbol-a34b13535dfa2adc","tex":"b_i","aliases":"b_i","display":"b_i","kind":"use","occurrences":[345,346,349,352,353]},{"id":"symbol-b7b4d4f8db808bcb","tex":"b_{ij}","aliases":"b_ij","display":"b_{ij}","kind":"use","occurrences":[843,845,958]},{"id":"symbol-f7362460f92e2f43","tex":"b_{ij}'","aliases":"b_ij'","display":"b_{ij}'","kind":"use","occurrences":[958]},{"id":"symbol-63b99e36c4729a30","tex":"b_j","aliases":"b_j","display":"b_j","kind":"use","occurrences":[177]},{"id":"symbol-a16b4bd9e760df1e","tex":"\\mathcal B_k","aliases":"B_k mathcal","display":"\\mathcal B_k","kind":"use","occurrences":[303]},{"id":"symbol-8e9e9a15d9e36ca8","tex":"\\mathcal B_{k+1}","aliases":"B_k+1 mathcal","display":"\\mathcal B_{k+1}","kind":"use","occurrences":[304]},{"id":"symbol-9474dae99bcf0491","tex":"B_t","aliases":"B_t","display":"B_t","kind":"use","occurrences":[248]},{"id":"symbol-b17ff042f6455b31","tex":"b_t","aliases":"b_t","display":"b_t","kind":"use","occurrences":[170,172,174,176]},{"id":"symbol-e2ec3d8de7f39249","tex":"\\bar a","aliases":"bar a bar","display":"\\bar a","kind":"use","occurrences":[173,175]},{"id":"symbol-1c90b524b55dd9ea","tex":"\\bar a^t","aliases":"bar a^t bar","display":"\\bar a^t","kind":"use","occurrences":[175]},{"id":"symbol-7e95a89f39649f47","tex":"\\bar b","aliases":"bar b bar","display":"\\bar b","kind":"use","occurrences":[174,175]},{"id":"symbol-eebc9b85b3d9979a","tex":"\\bar D","aliases":"bar D bar","display":"\\bar D","kind":"use","occurrences":[287,289]},{"id":"symbol-52555ee0fe55f126","tex":"\\bar F","aliases":"bar F bar","display":"\\bar F","kind":"use","occurrences":[288,289]},{"id":"symbol-dc4e9dcca4ad0352","tex":"\\bar w","aliases":"bar w bar","display":"\\bar w","kind":"use","occurrences":[1113,1114]},{"id":"symbol-d97fba459e62ed0e","tex":"\\bar\\ell","aliases":"barℓ bar ell","display":"\\bar\\ell","kind":"use","occurrences":[286,289]},{"id":"symbol-d13b1528b249ec85","tex":"\\bigwedge","aliases":"bigwedge","display":"\\bigwedge","kind":"use","occurrences":[1024,1025]},{"id":"symbol-fb18ab95ec9896db","tex":"\\bigwedge_{i\\in J}","aliases":"bigwedge_i∈ J bigwedge in","display":"\\bigwedge_{i\\in J}","kind":"use","occurrences":[1024]},{"id":"symbol-c64534aa25b678b4","tex":"\\bigwedge_{n\\ge0}","aliases":"bigwedge_n≥0 bigwedge ge","display":"\\bigwedge_{n\\ge0}","kind":"use","occurrences":[1025]},{"id":"symbol-76ac79294e9f6a80","tex":"\\bottomrule","aliases":"bottomrule","display":null,"kind":"use","occurrences":[47,1570]},{"id":"symbol-6bcbca61ff620dad","tex":"\\mathcal C_{\\mathcal T}","aliases":"C_ T mathcal mathcal","display":"\\mathcal C_{\\mathcal T}","kind":"use","occurrences":[63]},{"id":"symbol-cba2c263db336679","tex":"\\mathcal C_*","aliases":"C_* mathcal","display":"\\mathcal C_*","kind":"use","occurrences":[720,726]},{"id":"symbol-84112663abfb6c31","tex":"\\mathcal C_0","aliases":"C_0 mathcal","display":"\\mathcal C_0","kind":"use","occurrences":[724,726]},{"id":"symbol-00ae14fd999981ad","tex":"c_0","aliases":"c_0","display":"c_0","kind":"use","occurrences":[326,331]},{"id":"symbol-c205c00dfeb99d0b","tex":"C_1","aliases":"C_1","display":"C_1","kind":"use","occurrences":[1459]},{"id":"symbol-2ceb4df5993cba2b","tex":"c_1","aliases":"c_1","display":"c_1","kind":"use","occurrences":[327,331]},{"id":"symbol-d9494e21b365d43b","tex":"c_a","aliases":"c_a","display":"c_a","kind":"use","occurrences":[1562]},{"id":"symbol-59651fe6df7d2f0f","tex":"c_g","aliases":"c_g","display":"c_g","kind":"use","occurrences":[1125,1130]},{"id":"symbol-4222b21eadd5f7b9","tex":"C_i","aliases":"C_i","display":"C_i","kind":"use","occurrences":[1461,1462,1463]},{"id":"symbol-55a47c61b9403260","tex":"c_i","aliases":"c_i","display":"c_i","kind":"use","occurrences":[957,958,961]},{"id":"symbol-3f6f7b82f9cd7b0e","tex":"C_J","aliases":"C_J","display":"C_J","kind":"use","occurrences":[1025,1030,1058,1069]},{"id":"symbol-5704259308c6a17c","tex":"\\mathcal C_j","aliases":"C_j mathcal","display":"\\mathcal C_j","kind":"use","occurrences":[703,707,708]},{"id":"symbol-60b3c954bda772f4","tex":"c_j","aliases":"c_j","display":"c_j","kind":"use","occurrences":[958]},{"id":"symbol-c8879dc8df5b4bd1","tex":"\\mathcal C_{j+1}","aliases":"C_j+1 mathcal","display":"\\mathcal C_{j+1}","kind":"use","occurrences":[707]},{"id":"symbol-ab6ab9255d7967c3","tex":"C_k","aliases":"C_k","display":"C_k","kind":"use","occurrences":[1459]},{"id":"symbol-e1e71a0eb7c64bd5","tex":"c_s","aliases":"c_s","display":"c_s","kind":"use","occurrences":[1126,1130]},{"id":"symbol-433d97a8fbb31f65","tex":"C_t","aliases":"C_t","display":"C_t","kind":"use","occurrences":[47]},{"id":"symbol-692972739c4f3493","tex":"C_{v_0}","aliases":"C_v_0","display":"C_{v_0}","kind":"use","occurrences":[1534]},{"id":"symbol-877970907da456e8","tex":"C_{\\{A,B\\}}","aliases":"C_{A,B}","display":"C_{\\{A,B\\}}","kind":"use","occurrences":[1048]},{"id":"symbol-b9e4c40b00acb386","tex":"\\mathsf{Claim}","aliases":"Claim mathsf","display":"\\mathsf{Claim}","kind":"use","occurrences":[1519]},{"id":"symbol-0beda1e3044cbea5","tex":"\\mathsf{created}","aliases":"created mathsf","display":"\\mathsf{created}","kind":"use","occurrences":[660]},{"id":"symbol-fbc994c237735f1c","tex":"\\mathsf{creditor}","aliases":"creditor mathsf","display":"\\mathsf{creditor}","kind":"use","occurrences":[39]},{"id":"symbol-40d9503903bdca20","tex":"\\mathfrak D","aliases":"D mathfrak","display":"\\mathfrak D","kind":"use","occurrences":[937]},{"id":"symbol-f25b325fee30d349","tex":"d_{\\mathcal T}","aliases":"d_ T mathcal","display":"d_{\\mathcal T}","kind":"use","occurrences":[146]},{"id":"symbol-99e5f8e078f9fe31","tex":"D_1","aliases":"D_1","display":"D_1","kind":"use","occurrences":[428,430,496]},{"id":"symbol-3d6380742c628b38","tex":"D_2","aliases":"D_2","display":"D_2","kind":"use","occurrences":[431,496]},{"id":"symbol-a3008bb1b6de0e7c","tex":"d_E","aliases":"d_E","display":"d_E","kind":"use","occurrences":[160,163,164,166]},{"id":"symbol-b1670fb432754538","tex":"D_j","aliases":"D_j","display":"D_j","kind":"use","occurrences":[433,459,472,473,512,515,519]},{"id":"symbol-f951e623c1ba0b72","tex":"d_j","aliases":"d_j","display":"d_j","kind":"use","occurrences":[681,925,936,1448,1449,1451,1453]},{"id":"symbol-7bdda834cd44dcd4","tex":"d_{j+1}","aliases":"d_j+1","display":"d_{j+1}","kind":"use","occurrences":[684]},{"id":"symbol-a572acccc9b7cf05","tex":"D_k","aliases":"D_k","display":"D_k","kind":"use","occurrences":[428]},{"id":"symbol-71efea616c614868","tex":"D_m","aliases":"D_m","display":"D_m","kind":"use","occurrences":[701]},{"id":"symbol-688ebedc522ae64c","tex":"d_m","aliases":"d_m","display":"d_m","kind":"use","occurrences":[691]},{"id":"symbol-082091b8c43962a9","tex":"D_{m-1}","aliases":"D_m-1","display":"D_{m-1}","kind":"use","occurrences":[701]},{"id":"symbol-cd7ea73588d447c4","tex":"D_{\\rm lineage}","aliases":"D_rm lineage rm","display":"D_{\\rm lineage}","kind":"use","occurrences":[63]},{"id":"symbol-2569dc5eb62aae9e","tex":"D_\\alpha","aliases":"D_α alpha","display":"D_\\alpha","kind":"use","occurrences":[422,423,426,438,1391,1393]},{"id":"symbol-f78b7c92952c5c31","tex":"\\mathsf{debtor}","aliases":"debtor mathsf","display":"\\mathsf{debtor}","kind":"use","occurrences":[39]},{"id":"symbol-6e958c5e324e38c2","tex":"\\mathsf{deliver}","aliases":"deliver mathsf","display":"\\mathsf{deliver}","kind":"use","occurrences":[1269]},{"id":"symbol-e0061fd518f4afc3","tex":"\\mathsf{Domain}","aliases":"Domain mathsf","display":"\\mathsf{Domain}","kind":"use","occurrences":[1519]},{"id":"symbol-fcecd8e21956fefb","tex":"\\mathsf{due}","aliases":"due mathsf","display":"\\mathsf{due}","kind":"use","occurrences":[39]},{"id":"symbol-fb7427a95ad8c5b4","tex":"\\E","aliases":"E mathbb","display":"{\\mathbb E}","kind":"use","occurrences":[69,408,420,422,433,746,750,762,835,1391,1397,1398,1415]},{"id":"symbol-64fbb1a3212deefd","tex":"e'","aliases":"e'","display":"e'","kind":"use","occurrences":[1570]},{"id":"symbol-de71c382ea6a2b1c","tex":"e^{\\varepsilon_t}","aliases":"e^ε_t varepsilon","display":"e^{\\varepsilon_t}","kind":"use","occurrences":[1440]},{"id":"symbol-3c91647003842c2f","tex":"e_0","aliases":"e_0","display":"e_0","kind":"use","occurrences":[104,106,109,110,175,177,191]},{"id":"symbol-a6ee72f7ee077722","tex":"E_1","aliases":"E_1","display":"E_1","kind":"use","occurrences":[159,962]},{"id":"symbol-ad3caf981ac30812","tex":"E_c","aliases":"E_c","display":"E_c","kind":"use","occurrences":[929,955]},{"id":"symbol-28c01717961ca2fe","tex":"e_G","aliases":"e_G","display":"e_G","kind":"use","occurrences":[868,873,891,892,916,917,919,922,923]},{"id":"symbol-b5c061d3b046f5ce","tex":"\\E_H","aliases":"E_H E mathbb","display":"{\\mathbb E}_H","kind":"use","occurrences":[762]},{"id":"symbol-58230f0d9aab671b","tex":"E_i","aliases":"E_i","display":"E_i","kind":"use","occurrences":[160,965]},{"id":"symbol-650700dc8010c4c1","tex":"E_J","aliases":"E_J","display":"E_J","kind":"use","occurrences":[1024]},{"id":"symbol-7d045d3a0bea2c3c","tex":"E_J^0","aliases":"E_J^0","display":"E_J^0","kind":"use","occurrences":[1025]},{"id":"symbol-ed34ad226f36ee02","tex":"E_J^n","aliases":"E_J^n","display":"E_J^n","kind":"use","occurrences":[1025,1032]},{"id":"symbol-da2ce42dc70bb3da","tex":"E_n","aliases":"E_n","display":"E_n","kind":"use","occurrences":[159,962]},{"id":"symbol-bec753b55b1a3746","tex":"\\E_{\\overline P_C}","aliases":"E_overline P_C E overline mathbb overline","display":"{\\mathbb E}_{\\overline P_C}","kind":"use","occurrences":[835]},{"id":"symbol-503671c0b4008987","tex":"\\E_{P_C}","aliases":"E_P_C E mathbb","display":"{\\mathbb E}_{P_C}","kind":"use","occurrences":[408,420,422,433,835,1391,1397,1415]},{"id":"symbol-f9379434c1b658b6","tex":"\\E_{P_D}","aliases":"E_P_D E mathbb","display":"{\\mathbb E}_{P_D}","kind":"use","occurrences":[408,422,1391,1398,1415]},{"id":"symbol-4ed775c05819f6a5","tex":"\\E_{P_{D_j}}","aliases":"E_P_D_j E mathbb","display":"{\\mathbb E}_{P_{D_j}}","kind":"use","occurrences":[433]},{"id":"symbol-f75d15c864ad3cef","tex":"E_t","aliases":"E_t","display":"E_t","kind":"use","occurrences":[213,252]},{"id":"symbol-3a8e0b23212d1b1a","tex":"e_T","aliases":"e_T","display":"e_T","kind":"use","occurrences":[177]},{"id":"symbol-2775a21153e9ebc4","tex":"e_t","aliases":"e_t","display":"e_t","kind":"use","occurrences":[106,109,113,114,169,170,175,248,251]},{"id":"symbol-0c0ec2f484593060","tex":"e_{t+1}","aliases":"e_t+1","display":"e_{t+1}","kind":"use","occurrences":[113,114,170]},{"id":"symbol-ab5bad267a913e53","tex":"E_{\\{A,B\\}}","aliases":"E_{A,B}","display":"E_{\\{A,B\\}}","kind":"use","occurrences":[1046]},{"id":"symbol-5325ae4241f36b1d","tex":"\\E_\\mu","aliases":"E_μ E mu mathbb mu","display":"{\\mathbb E}_\\mu","kind":"use","occurrences":[746]},{"id":"symbol-f8483dce1203449b","tex":"\\mathrm{eff}","aliases":"eff mathrm","display":"\\mathrm{eff}","kind":"use","occurrences":[967]},{"id":"symbol-11d470feca39d87f","tex":"\\mathsf{Effect}","aliases":"Effect mathsf","display":"\\mathsf{Effect}","kind":"use","occurrences":[1337,1341]},{"id":"symbol-3844c1e6dc6edcea","tex":"\\mathsf{Evidence}","aliases":"Evidence mathsf","display":"\\mathsf{Evidence}","kind":"use","occurrences":[1519]},{"id":"symbol-17dde28ef37430b3","tex":"\\mathbb F","aliases":"F mathbb","display":"\\mathbb F","kind":"use","occurrences":[841,843]},{"id":"symbol-b6bb9a2af76d66fc","tex":"\\mathbf F","aliases":"F mathbf","display":"\\mathbf F","kind":"use","occurrences":[660]},{"id":"symbol-f6200026fca4fbf6","tex":"F^A","aliases":"F^A","display":"F^A","kind":"use","occurrences":[314]},{"id":"symbol-8cdef41e39b0cc65","tex":"F^B","aliases":"F^B","display":"F^B","kind":"use","occurrences":[314]},{"id":"symbol-575255af81659400","tex":"F_0","aliases":"F_0","display":"F_0","kind":"use","occurrences":[691]},{"id":"symbol-82816d0530292289","tex":"F_0^a","aliases":"F_0^a","display":"F_0^a","kind":"use","occurrences":[946]},{"id":"symbol-85a4a71a03fbd7dc","tex":"F_1^a","aliases":"F_1^a","display":"F_1^a","kind":"use","occurrences":[945]},{"id":"symbol-9fb747c54494ef7e","tex":"\\mathbb F_2","aliases":"F_2 mathbb","display":"\\mathbb F_2","kind":"use","occurrences":[841,843]},{"id":"symbol-be6ce8f88a6b7ad7","tex":"F_2^a","aliases":"F_2^a","display":"F_2^a","kind":"use","occurrences":[947]},{"id":"symbol-31d7232e6fa917d3","tex":"F_i","aliases":"F_i","display":"F_i","kind":"use","occurrences":[854]},{"id":"symbol-58ccb6627c020146","tex":"F_i^a","aliases":"F_i^a","display":"F_i^a","kind":"use","occurrences":[936]},{"id":"symbol-74cb89ef83acdc31","tex":"F_j","aliases":"F_j","display":"F_j","kind":"use","occurrences":[682,684,854]},{"id":"symbol-8576ad4cc4bc1341","tex":"F_{j+1}","aliases":"F_j+1","display":"F_{j+1}","kind":"use","occurrences":[684]},{"id":"symbol-c0ae9543891a277b","tex":"F_j^a","aliases":"F_j^a","display":"F_j^a","kind":"use","occurrences":[927,936]},{"id":"symbol-4177c6a4de39fdeb","tex":"F_{m-1}","aliases":"F_m-1","display":"F_{m-1}","kind":"use","occurrences":[696]},{"id":"symbol-a0e5c74d87cb8ce3","tex":"F_T","aliases":"F_T","display":"F_T","kind":"use","occurrences":[1605,1606,1608]},{"id":"symbol-4a14d2ab0a464e3b","tex":"F_u","aliases":"F_u","display":"F_u","kind":"use","occurrences":[47,72,75,76,80]},{"id":"symbol-3871879ef12fd24f","tex":"\\mathbf F_{\\leq D}","aliases":"F_≤ D mathbf leq","display":"\\mathbf F_{\\leq D}","kind":"use","occurrences":[660]},{"id":"symbol-4f178cacb435e6d1","tex":"\\mathsf{Fallback}","aliases":"Fallback mathsf","display":"\\mathsf{Fallback}","kind":"use","occurrences":[1519]},{"id":"symbol-9bba072b92bb3075","tex":"\\FloatBarrier","aliases":"FloatBarrier","display":null,"kind":"use","occurrences":[1570]},{"id":"symbol-8dc93a04e6f9cec5","tex":"\\mathsf{freeze}","aliases":"freeze mathsf","display":"\\mathsf{freeze}","kind":"use","occurrences":[1271,1277]},{"id":"symbol-f68bc52b44f56ab1","tex":"\\Ftwo","aliases":"Ftwo F_2 mathbb","display":"{\\mathbb F_2}","kind":"use","occurrences":[167]},{"id":"symbol-b5e2fba9b2567ef0","tex":"\\Ftwo^2","aliases":"Ftwo^2 F_2^2 Ftwo mathbb","display":"{\\mathbb F_2}^2","kind":"use","occurrences":[167]},{"id":"symbol-2ec21cceb5b7d7a8","tex":"\\mathbf G","aliases":"G mathbf","display":"\\mathbf G","kind":"use","occurrences":[660]},{"id":"symbol-15e2ee7354a2849e","tex":"\\mathcal G","aliases":"G mathcal","display":"\\mathcal G","kind":"use","occurrences":[1220,1221]},{"id":"symbol-76bf4b4cfdf73e02","tex":"g_0^c","aliases":"g_0^c","display":"g_0^c","kind":"use","occurrences":[954]},{"id":"symbol-bf173953a9e841d7","tex":"g_1","aliases":"g_1","display":"g_1","kind":"use","occurrences":[338,490,1328]},{"id":"symbol-89e871b998f960fd","tex":"g_1^c","aliases":"g_1^c","display":"g_1^c","kind":"use","occurrences":[952]},{"id":"symbol-e6df94744f7ade62","tex":"g_2","aliases":"g_2","display":"g_2","kind":"use","occurrences":[339,490,1328]},{"id":"symbol-fb7bad6dd26ce3a5","tex":"g_2^c","aliases":"g_2^c","display":"g_2^c","kind":"use","occurrences":[953]},{"id":"symbol-e5998b0165958d5f","tex":"g_{AB}","aliases":"g_AB","display":"g_{AB}","kind":"use","occurrences":[891]},{"id":"symbol-5c29749f7018044d","tex":"g_{BC}","aliases":"g_BC","display":"g_{BC}","kind":"use","occurrences":[891]},{"id":"symbol-a5d94e7cf8e07886","tex":"g_{CA}","aliases":"g_CA","display":"g_{CA}","kind":"use","occurrences":[891]},{"id":"symbol-1dea34eb24027a93","tex":"g_i^c","aliases":"g_i^c","display":"g_i^c","kind":"use","occurrences":[936]},{"id":"symbol-26e0fe64a6654470","tex":"g_{ij}","aliases":"g_ij","display":"g_{ij}","kind":"use","occurrences":[857,860,867,870,880,881,885,886,898,905,913,918]},{"id":"symbol-6677040f24473561","tex":"g_{ij}^{-1}","aliases":"g_ij^-1","display":"g_{ij}^{-1}","kind":"use","occurrences":[859]},{"id":"symbol-f7288fb9331c8dd5","tex":"g_j","aliases":"g_j","display":"g_j","kind":"use","occurrences":[449,459,464,510,515]},{"id":"symbol-ec945b23e1bf8f82","tex":"g_j^c","aliases":"g_j^c","display":"g_j^c","kind":"use","occurrences":[929,936]},{"id":"symbol-f5bf2eca8fa066ad","tex":"g_{ji}","aliases":"g_ji","display":"g_{ji}","kind":"use","occurrences":[859]},{"id":"symbol-21dd07c90035ab44","tex":"G_{\\rm formation}","aliases":"G_rm formation rm","display":"G_{\\rm formation}","kind":"use","occurrences":[63]},{"id":"symbol-773c719cc1e4b602","tex":"G_{\\rm settle}","aliases":"G_rm settle rm","display":"G_{\\rm settle}","kind":"use","occurrences":[1467]},{"id":"symbol-502a10d3487699f3","tex":"G_{\\rm suspend}","aliases":"G_rm suspend rm","display":"G_{\\rm suspend}","kind":"use","occurrences":[1466]},{"id":"symbol-dcc5a64c4252f82c","tex":"g_{v_0v_1}","aliases":"g_v_0v_1","display":"g_{v_0v_1}","kind":"use","occurrences":[864]},{"id":"symbol-82d8162c0eae7654","tex":"g_{v_{k-1}v_k}","aliases":"g_v_k-1v_k","display":"g_{v_{k-1}v_k}","kind":"use","occurrences":[864]},{"id":"symbol-91a8cea6e9ae6182","tex":"g_\\lambda","aliases":"g_λ lambda","display":"g_\\lambda","kind":"use","occurrences":[464,466,467,479,502,504]},{"id":"symbol-cbffe8e9b78ad1e7","tex":"\\mathsf{Guard}","aliases":"Guard mathsf","display":"\\mathsf{Guard}","kind":"use","occurrences":[1519]},{"id":"symbol-a03ffaed013c4d19","tex":"\\mathcal H","aliases":"H mathcal","display":"\\mathcal H","kind":"use","occurrences":[1090,1091,1092,1095]},{"id":"symbol-1e9de57bf29ef2a6","tex":"h'","aliases":"h'","display":"h'","kind":"use","occurrences":[1099]},{"id":"symbol-2b0800e4e3bac109","tex":"h_0","aliases":"h_0","display":"h_0","kind":"use","occurrences":[1345]},{"id":"symbol-63e9c3e80a66add1","tex":"H_1","aliases":"H_1","display":"H_1","kind":"use","occurrences":[644,647]},{"id":"symbol-2dfab4a78393f05c","tex":"h_1","aliases":"h_1","display":"h_1","kind":"use","occurrences":[1346,1348]},{"id":"symbol-66fc929643bbe3da","tex":"H_2","aliases":"H_2","display":"H_2","kind":"use","occurrences":[645,647]},{"id":"symbol-333bf23be8bc780a","tex":"h_i","aliases":"h_i","display":"h_i","kind":"use","occurrences":[866,869,874,880,882,912,918]},{"id":"symbol-edabde0d8f0f2fb5","tex":"h_i^{-1}","aliases":"h_i^-1","display":"h_i^{-1}","kind":"use","occurrences":[867,870,881,913]},{"id":"symbol-a57a2041d5b95f96","tex":"h_j","aliases":"h_j","display":"h_j","kind":"use","occurrences":[867,870,881,913]},{"id":"symbol-52b73dd3471377a1","tex":"h_j^{-1}","aliases":"h_j^-1","display":"h_j^{-1}","kind":"use","occurrences":[880,918]},{"id":"symbol-3e01b0cedad21f47","tex":"h_r","aliases":"h_r","display":"h_r","kind":"use","occurrences":[873,920]},{"id":"symbol-0bbfbbf8fdee97fd","tex":"h_r^{-1}","aliases":"h_r^-1","display":"h_r^{-1}","kind":"use","occurrences":[920]},{"id":"symbol-6d6860f62790cbda","tex":"h_{v_0}^{-1}","aliases":"h_v_0^-1","display":"h_{v_0}^{-1}","kind":"use","occurrences":[871]},{"id":"symbol-bcf5c45a69bb520f","tex":"h_{v_k}","aliases":"h_v_k","display":"h_{v_k}","kind":"use","occurrences":[871]},{"id":"symbol-4906fdd4162c9b6e","tex":"H_\\gamma","aliases":"H_γ gamma","display":"H_\\gamma","kind":"use","occurrences":[864,868,871,888,916,917,920,921,922,923]},{"id":"symbol-1111fb53a62a388c","tex":"\\Hist","aliases":"Hist H mathcal","display":"{\\mathcal H}","kind":"use","occurrences":[117]},{"id":"symbol-95a9d0221b28fa4b","tex":"\\Hist_t","aliases":"Hist_t H_t Hist mathcal","display":"{\\mathcal H}_t","kind":"use","occurrences":[117]},{"id":"symbol-46cc9b01cd7f4804","tex":"I'","aliases":"I'","display":"I'","kind":"use","occurrences":[226,227]},{"id":"symbol-0e79b7ad0299d0b0","tex":"I_0","aliases":"I_0","display":"I_0","kind":"use","occurrences":[796]},{"id":"symbol-5d47bac3825149e4","tex":"I_T","aliases":"I_T","display":"I_T","kind":"use","occurrences":[796]},{"id":"symbol-aacf5b6839c1ca6a","tex":"\\mathrm{Id}","aliases":"Id mathrm","display":"\\mathrm{Id}","kind":"use","occurrences":[746,752,805,809]},{"id":"symbol-429c14d61f733b4b","tex":"\\mathsf{id}","aliases":"id mathsf","display":"\\mathsf{id}","kind":"use","occurrences":[39,654]},{"id":"symbol-c6b61b46dee37794","tex":"\\inf","aliases":"inf","display":"\\inf","kind":"use","occurrences":[69,742]},{"id":"symbol-229edcd074540eda","tex":"\\inf_f","aliases":"inf_f inf","display":"\\inf_f","kind":"use","occurrences":[69]},{"id":"symbol-78aea61693fa7ede","tex":"\\mathrm{inst}","aliases":"inst mathrm","display":"\\mathrm{inst}","kind":"use","occurrences":[227]},{"id":"symbol-bbab85f7b2dcaaec","tex":"\\mathsf{Int}","aliases":"Int mathsf","display":"\\mathsf{Int}","kind":"use","occurrences":[181]},{"id":"symbol-6da43b944e494e88","tex":"J","aliases":"J","display":"J","kind":"use","occurrences":[793,796,1015,1024,1025,1026,1029,1030,1032,1058,1069,1131,1136,1138,1142,1158,1442,1450]},{"id":"symbol-485db41ee683b54c","tex":"J_0","aliases":"J_0","display":"J_0","kind":"use","occurrences":[796]},{"id":"symbol-a620020ba505249b","tex":"J_n","aliases":"J_n","display":"J_n","kind":"use","occurrences":[793]},{"id":"symbol-fb1ef9525dc5b427","tex":"J_T","aliases":"J_T","display":"J_T","kind":"use","occurrences":[796]},{"id":"symbol-9da7de32ab512a2d","tex":"\\mathcal K","aliases":"K mathcal","display":"\\mathcal K","kind":"use","occurrences":[1519]},{"id":"symbol-b783228933c35b11","tex":"k_i","aliases":"k_i","display":"k_i","kind":"use","occurrences":[884]},{"id":"symbol-caa5b7c8da47b932","tex":"k_i^{-1}","aliases":"k_i^-1","display":"k_i^{-1}","kind":"use","occurrences":[886]},{"id":"symbol-d28dfa84fbebcbdc","tex":"K_i^m","aliases":"K_i^m","display":"K_i^m","kind":"use","occurrences":[787,789]},{"id":"symbol-bcf3911a4b4214e2","tex":"k_j","aliases":"k_j","display":"k_j","kind":"use","occurrences":[886]},{"id":"symbol-e2b60819c95171e8","tex":"k_r","aliases":"k_r","display":"k_r","kind":"use","occurrences":[888]},{"id":"symbol-9efd26545e0fdba4","tex":"k_r^{-1}","aliases":"k_r^-1","display":"k_r^{-1}","kind":"use","occurrences":[888]},{"id":"symbol-acac86c0e609ca90","tex":"l","aliases":"l","display":"l","kind":"use","occurrences":[47,63,196,1467,1570]},{"id":"symbol-64a393c37e7bfedd","tex":"L_0","aliases":"L_0","display":"L_0","kind":"use","occurrences":[1478]},{"id":"symbol-834fb94f0edd7b4c","tex":"L_j","aliases":"L_j","display":"L_j","kind":"use","occurrences":[686]},{"id":"symbol-dfc293305a0744ec","tex":"L_k","aliases":"L_k","display":"L_k","kind":"use","occurrences":[691,1478,1500]},{"id":"symbol-09eb22fcb1ad8180","tex":"L_{k+1}","aliases":"L_k+1","display":"L_{k+1}","kind":"use","occurrences":[1478]},{"id":"symbol-66053b0fba2aa69a","tex":"L_{m-1}","aliases":"L_m-1","display":"L_{m-1}","kind":"use","occurrences":[699,701]},{"id":"symbol-49e6cb003fe8b536","tex":"L_t","aliases":"L_t","display":"L_t","kind":"use","occurrences":[213]},{"id":"symbol-894b3d805f0da1d1","tex":"\\Law","aliases":"Law L mathcal","display":"{\\mathcal L}","kind":"use","occurrences":[145,146,227,796]},{"id":"symbol-655fe704a38e0697","tex":"\\Law_e","aliases":"Law_e L_e Law mathcal","display":"{\\mathcal L}_e","kind":"use","occurrences":[227]},{"id":"symbol-91b7a65d9478c7b6","tex":"\\Law_x","aliases":"Law_x L_x Law mathcal","display":"{\\mathcal L}_x","kind":"use","occurrences":[145,146]},{"id":"symbol-949feb1aba030003","tex":"\\Law_{x'}","aliases":"Law_x' L_x' Law mathcal","display":"{\\mathcal L}_{x'}","kind":"use","occurrences":[145,146]},{"id":"symbol-abd805d5765e70d2","tex":"\\lceil","aliases":"lceil","display":"\\lceil","kind":"use","occurrences":[157,202]},{"id":"symbol-316e91d8c0b468a8","tex":"\\lfloor","aliases":"lfloor","display":null,"kind":"use","occurrences":[374]},{"id":"symbol-bfbb661daa93662b","tex":"\\log","aliases":"log","display":"\\log","kind":"use","occurrences":[157,202]},{"id":"symbol-356d34f32f81e480","tex":"\\log_2","aliases":"log_2 log","display":"\\log_2","kind":"use","occurrences":[157,202]},{"id":"symbol-e0987528a0170db9","tex":"\\Longrightarrow","aliases":"Longrightarrow","display":"\\Longrightarrow","kind":"use","occurrences":[76,539,571,1065]},{"id":"symbol-6c6a514803a6f591","tex":"\\mathcal M","aliases":"M mathcal","display":"\\mathcal M","kind":"use","occurrences":[313,317,455,459,465,477]},{"id":"symbol-349dacc2f32ca156","tex":"M^{\\rm act}","aliases":"M^rm act rm","display":"M^{\\rm act}","kind":"use","occurrences":[675]},{"id":"symbol-68234482819a0a5d","tex":"M^{\\rm arc}","aliases":"M^rm arc rm","display":"M^{\\rm arc}","kind":"use","occurrences":[676]},{"id":"symbol-b11203379a62bd48","tex":"m_*","aliases":"m_*","display":"m_*","kind":"use","occurrences":[374,375,378]},{"id":"symbol-8ace55e8bb71177a","tex":"\\mathcal M_A","aliases":"M_A mathcal","display":"\\mathcal M_A","kind":"use","occurrences":[313,317]},{"id":"symbol-a79467f050b89408","tex":"\\mathcal M_B","aliases":"M_B mathcal","display":"\\mathcal M_B","kind":"use","occurrences":[313,317]},{"id":"symbol-8bb69312790c247e","tex":"M_{t+1}","aliases":"M_t+1","display":"M_{t+1}","kind":"use","occurrences":[252]},{"id":"symbol-967ea86ebf866388","tex":"\\mathcal M_\\alpha","aliases":"M_α mathcal alpha","display":"\\mathcal M_\\alpha","kind":"use","occurrences":[455,459,465,477]},{"id":"symbol-e481658e9c6ce30a","tex":"\\max","aliases":"max","display":"\\max","kind":"use","occurrences":[422,459,465,922,1111,1391]},{"id":"symbol-6930c978a50d9a39","tex":"\\max_{0\\le s\\le1,\\ \\E_{P_C}s\\le\\alpha}","aliases":"max_0≤ s≤1, E_P_Cs≤α max le le E le alpha max le le mathbb le alpha","display":"\\max_{0\\le s\\le1,\\ {\\mathbb E}_{P_C}s\\le\\alpha}","kind":"use","occurrences":[1391]},{"id":"symbol-7be0073546f6c028","tex":"\\max_i","aliases":"max_i max","display":"\\max_i","kind":"use","occurrences":[1111]},{"id":"symbol-e99a7833fcf755ca","tex":"\\max_{\\substack{0\\leq s\\leq1\\\\\\E_{P_C}s\\leq\\alpha}}","aliases":"max_substack0≤ s≤1 E_P_Cs≤α max substack leq leq E leq alpha max substack leq leq mathbb leq alpha","display":"\\max_{\\substack{0\\leq s\\leq1\\\\{\\mathbb E}_{P_C}s\\leq\\alpha}}","kind":"use","occurrences":[422]},{"id":"symbol-56b2f3cfe3dd0a1b","tex":"\\max_{s\\in\\mathcal M_\\alpha}","aliases":"max_s∈ M_α max in mathcal alpha","display":"\\max_{s\\in\\mathcal M_\\alpha}","kind":"use","occurrences":[459,465]},{"id":"symbol-4d95ab92bdb1dbe9","tex":"\\min","aliases":"min","display":"\\min","kind":"use","occurrences":[71,106,110,160,459,466,796,833,960,1004,1145,1158,1317,1329,1393,1403,1412]},{"id":"symbol-6b0b4e4f28de5e50","tex":"\\min_{1\\leq j\\leq m}","aliases":"min_1≤ j≤ m min leq leq","display":"\\min_{1\\leq j\\leq m}","kind":"use","occurrences":[459]},{"id":"symbol-1ace88525e5ee17f","tex":"\\min_e","aliases":"min_e min","display":"\\min_e","kind":"use","occurrences":[960]},{"id":"symbol-f2be642960c93c27","tex":"\\min_{S\\in\\mathcal A}","aliases":"min_S∈ A min in mathcal","display":"\\min_{S\\in\\mathcal A}","kind":"use","occurrences":[71]},{"id":"symbol-f149a3237795b7bd","tex":"\\min_{z\\ne z'}","aliases":"min_z≠ z' min ne","display":"\\min_{z\\ne z'}","kind":"use","occurrences":[160]},{"id":"symbol-619a17276daec9c4","tex":"\\min_{\\lambda\\in\\Delta_m}","aliases":"min_λ∈Δ_m min lambda in Delta","display":"\\min_{\\lambda\\in\\Delta_m}","kind":"use","occurrences":[466]},{"id":"symbol-059b561ecaed3b30","tex":"\\min_{\\varnothing\\ne S\\subseteq J}","aliases":"min_∅≠ S⊆ J min varnothing ne subseteq","display":"\\min_{\\varnothing\\ne S\\subseteq J}","kind":"use","occurrences":[1158]},{"id":"symbol-7997c4f3be17c7ce","tex":"\\models","aliases":"models","display":null,"kind":"use","occurrences":[1030,1055]},{"id":"symbol-8ce86a6ae65d3692","tex":"N","aliases":"N","display":"N","kind":"use","occurrences":[155,156,157,213,214,228,230,242,603,604,710,711,733,735,1137,1142,1145,1151,1157,1158,1351,1357,1370,1372,1377,1570]},{"id":"symbol-3f620354ed5db565","tex":"\\mathbb N","aliases":"N mathbb","display":"\\mathbb N","kind":"use","occurrences":[1257,1536]},{"id":"symbol-f03486d125e6b8f9","tex":"n_{\\mathrm{eff}}","aliases":"n_eff mathrm","display":"n_{\\mathrm{eff}}","kind":"use","occurrences":[967]},{"id":"symbol-15b483d1ca8d08c8","tex":"N_F","aliases":"N_F","display":"N_F","kind":"use","occurrences":[733,735]},{"id":"symbol-b82d70c3ab4030a5","tex":"N_i","aliases":"N_i","display":"N_i","kind":"use","occurrences":[230]},{"id":"symbol-87025dc8dd8d0f19","tex":"N_T","aliases":"N_T","display":"N_T","kind":"use","occurrences":[733,735]},{"id":"symbol-340f7d39d04f82c1","tex":"N_t","aliases":"N_t","display":"N_t","kind":"use","occurrences":[213]},{"id":"symbol-7bc2fe684c29431d","tex":"\\norm","aliases":"norm","display":null,"kind":"use","occurrences":[1111,1112,1113]},{"id":"symbol-090aecb8fb37e7b7","tex":"O_1","aliases":"O_1","display":"O_1","kind":"use","occurrences":[1428,1431]},{"id":"symbol-95762a76969f784c","tex":"O_2","aliases":"O_2","display":"O_2","kind":"use","occurrences":[1429,1431]},{"id":"symbol-7d562788a949216b","tex":"O_{\\rm ext}","aliases":"O_rm ext rm","display":"O_{\\rm ext}","kind":"use","occurrences":[1337,1339]},{"id":"symbol-5b5f757795d9d4e3","tex":"O_V","aliases":"O_V","display":"O_V","kind":"use","occurrences":[71]},{"id":"symbol-a46c63c71e71fa74","tex":"\\mathsf{open}","aliases":"open mathsf","display":"\\mathsf{open}","kind":"use","occurrences":[543,546,547,548]},{"id":"symbol-512abf9c72d3182f","tex":"\\overline d","aliases":"overline d overline","display":"\\overline d","kind":"use","occurrences":[831,832,833,837,838]},{"id":"symbol-d472066b913c5d84","tex":"\\overline F","aliases":"overline F overline","display":"\\overline F","kind":"use","occurrences":[74,75,78,80]},{"id":"symbol-d0e9f947070b1886","tex":"\\overline F_u","aliases":"overline F_u overline","display":"\\overline F_u","kind":"use","occurrences":[74,75,78,80]},{"id":"symbol-b7a5b96653c1dfce","tex":"\\overline K","aliases":"overline K overline","display":"\\overline K","kind":"use","occurrences":[83,91,103,107,112,181,184,185,190]},{"id":"symbol-3a2dda7b86c14643","tex":"\\overline K_u","aliases":"overline K_u overline","display":"\\overline K_u","kind":"use","occurrences":[83,91,103,107,112,184,185,190]},{"id":"symbol-ffdd263bffb70d69","tex":"\\overline P","aliases":"overline P overline","display":"\\overline P","kind":"use","occurrences":[827,828,830,831,835]},{"id":"symbol-0554550a5d4c3d25","tex":"\\overline P_a","aliases":"overline P_a overline","display":"\\overline P_a","kind":"use","occurrences":[828]},{"id":"symbol-c6155705a6fd7527","tex":"\\overline P_C","aliases":"overline P_C overline","display":"\\overline P_C","kind":"use","occurrences":[827,830,831,835]},{"id":"symbol-35facfc15ab1071a","tex":"\\overline P_D","aliases":"overline P_D overline","display":"\\overline P_D","kind":"use","occurrences":[827,830,831]},{"id":"symbol-42c6158ae78541bc","tex":"\\overline Q","aliases":"overline Q overline","display":"\\overline Q","kind":"use","occurrences":[181]},{"id":"symbol-1a02ef2c814691f5","tex":"\\overline R","aliases":"overline R overline","display":"\\overline R","kind":"use","occurrences":[789,792,794,1288]},{"id":"symbol-8b5639b5bcc171d8","tex":"\\overline R_k","aliases":"overline R_k overline","display":"\\overline R_k","kind":"use","occurrences":[1288]},{"id":"symbol-70becec0d32f5b1e","tex":"\\overline W","aliases":"overline W overline","display":"\\overline W","kind":"use","occurrences":[1287]},{"id":"symbol-898f9c5012aeca12","tex":"\\overline W_*","aliases":"overline W_* overline","display":"\\overline W_*","kind":"use","occurrences":[1287]},{"id":"symbol-c9d9fa3ccc63f9f9","tex":"\\overline W_k","aliases":"overline W_k overline","display":"\\overline W_k","kind":"use","occurrences":[1287]},{"id":"symbol-699186a0f56a06b6","tex":"\\overline{\\operatorname{Post}}","aliases":"overlinePost overline operatorname","display":"\\overline{\\operatorname{Post}}","kind":"use","occurrences":[1293]},{"id":"symbol-c33eb003dc4eec09","tex":"\\mathcal P","aliases":"P mathcal","display":"\\mathcal P","kind":"use","occurrences":[267,270]},{"id":"symbol-148de9c5a7a44d19","tex":"p","aliases":"p","display":"p","kind":"use","occurrences":[47,63,167,168,544,584,590,974,979,989,991,995,996,997,998,1000,1001,1004,1008,1009,1011,1013,1053,1055,1057,1058,1238,1241,1243,1365,1368,1369,1379,1380,1466,1570,1571,1572,1577,1581,1590,1599,1601,1604,1605,1607,1609,1610,1612]},{"id":"symbol-171e10e212c438c2","tex":"p'","aliases":"p'","display":"p'","kind":"use","occurrences":[1604,1605,1607]},{"id":"symbol-d191a609e31a0b28","tex":"p^*","aliases":"p^*","display":"p^*","kind":"use","occurrences":[1365]},{"id":"symbol-79867b3b5190754f","tex":"p^2","aliases":"p^2","display":"p^2","kind":"use","occurrences":[989,995]},{"id":"symbol-2f6e2105e532043f","tex":"P^\\star_{z'}","aliases":"P^⋆_z' star","display":"P^\\star_{z'}","kind":"use","occurrences":[133]},{"id":"symbol-e50b5dbfe7add137","tex":"P_0","aliases":"P_0","display":"P_0","kind":"use","occurrences":[629,637,639,640]},{"id":"symbol-d1641bdc80ea783c","tex":"P_1","aliases":"P_1","display":"P_1","kind":"use","occurrences":[487,630,637,639,640,1304]},{"id":"symbol-c5e705958e40c3bd","tex":"P_2","aliases":"P_2","display":"P_2","kind":"use","occurrences":[488,1304]},{"id":"symbol-e82429366fa8634c","tex":"P_a","aliases":"P_a","display":"P_a","kind":"use","occurrences":[828]},{"id":"symbol-c6db9f401f21bd60","tex":"P_C^t","aliases":"P_C^t","display":"P_C^t","kind":"use","occurrences":[1434]},{"id":"symbol-24aee7146853637c","tex":"P_D^t","aliases":"P_D^t","display":"P_D^t","kind":"use","occurrences":[1435]},{"id":"symbol-0973faa3939feb7a","tex":"P_{D_1}","aliases":"P_D_1","display":"P_{D_1}","kind":"use","occurrences":[430]},{"id":"symbol-976e344ae208876a","tex":"P_{D_2}","aliases":"P_D_2","display":"P_{D_2}","kind":"use","occurrences":[431]},{"id":"symbol-d4ac276dce951030","tex":"P_{D_j}","aliases":"P_D_j","display":"P_{D_j}","kind":"use","occurrences":[433]},{"id":"symbol-26af5e2e76634d6f","tex":"P_j","aliases":"P_j","display":"P_j","kind":"use","occurrences":[448,459,463,506]},{"id":"symbol-139b65216c886fd4","tex":"P_{M,w}","aliases":"P_M,w","display":"P_{M,w}","kind":"use","occurrences":[621]},{"id":"symbol-12b33428971a165a","tex":"P_t","aliases":"P_t","display":"P_t","kind":"use","occurrences":[213]},{"id":"symbol-605436089c261022","tex":"\\mathsf{permissions}","aliases":"permissions mathsf","display":"\\mathsf{permissions}","kind":"use","occurrences":[181]},{"id":"symbol-1cc1c79952eb4cf2","tex":"\\pmod","aliases":"pmod","display":"\\pmod","kind":"use","occurrences":[94]},{"id":"symbol-80b4b6d1ff3db017","tex":"\\Prob","aliases":"Prob P mathbb","display":"{\\mathbb P}","kind":"use","occurrences":[47,97,98,744,750,974,1004]},{"id":"symbol-911fd80387908659","tex":"\\Prob_\\mu","aliases":"Prob_μ P_μ Prob mu mathbb mu","display":"{\\mathbb P}_\\mu","kind":"use","occurrences":[744]},{"id":"symbol-8e35c2cd3bf6641b","tex":"q","aliases":"q","display":"q","kind":"use","occurrences":[34,47,167,168,248,250,253,261,587,590,1077,1079,1080,1087,1088,1089,1347,1365,1366,1367,1570,1571,1572,1577,1581,1591,1599,1602,1604,1605,1607,1609,1611,1613,1614]},{"id":"symbol-28b6406ccead341b","tex":"q'","aliases":"q'","display":"q'","kind":"use","occurrences":[1604,1605,1607]},{"id":"symbol-5cf102ce096caa7a","tex":"q^*","aliases":"q^*","display":"q^*","kind":"use","occurrences":[1365]},{"id":"symbol-1a964a7903c6c96c","tex":"Q^t","aliases":"Q^t","display":"Q^t","kind":"use","occurrences":[744,749,767]},{"id":"symbol-0c35b13a3641b2f4","tex":"\\mathcal Q_*","aliases":"Q_* mathcal","display":"\\mathcal Q_*","kind":"use","occurrences":[721,726]},{"id":"symbol-3ed43c7f5cff9ad1","tex":"\\mathcal Q_0","aliases":"Q_0 mathcal","display":"\\mathcal Q_0","kind":"use","occurrences":[724,726]},{"id":"symbol-2fdfdde7570c43b1","tex":"q_i","aliases":"q_i","display":"q_i","kind":"use","occurrences":[34,1347]},{"id":"symbol-919224812081875b","tex":"q_t","aliases":"q_t","display":"q_t","kind":"use","occurrences":[248,250]},{"id":"symbol-5e30045657849316","tex":"\\mathsf{quantity}","aliases":"quantity mathsf","display":"\\mathsf{quantity}","kind":"use","occurrences":[39]},{"id":"symbol-97a4ded34746a4f6","tex":"\\mathbb R","aliases":"R mathbb","display":"\\mathbb R","kind":"use","occurrences":[1103]},{"id":"symbol-1f4ac7c68b8abd53","tex":"\\mathcal R","aliases":"R mathcal","display":"\\mathcal R","kind":"use","occurrences":[69,71,355,1092,1093]},{"id":"symbol-94029690dcc6c9ab","tex":"r'","aliases":"r'","display":"r'","kind":"use","occurrences":[1570]},{"id":"symbol-6ac432f94aea74b8","tex":"r_{-i}","aliases":"r_-i","display":"r_{-i}","kind":"use","occurrences":[360]},{"id":"symbol-9eb12de9c970740e","tex":"R_0","aliases":"R_0","display":"R_0","kind":"use","occurrences":[1221]},{"id":"symbol-7c77127f7fae6fe1","tex":"r_1","aliases":"r_1","display":"r_1","kind":"use","occurrences":[356]},{"id":"symbol-e8531ad2dd91d431","tex":"r_F","aliases":"r_F","display":"r_F","kind":"use","occurrences":[732,734,735]},{"id":"symbol-c058161c25df89bd","tex":"r_F^t","aliases":"r_F^t","display":"r_F^t","kind":"use","occurrences":[735]},{"id":"symbol-0cecacd0d0bb53a7","tex":"\\mathcal R_i","aliases":"R_i mathcal","display":"\\mathcal R_i","kind":"use","occurrences":[355]},{"id":"symbol-f231812574787070","tex":"r_i","aliases":"r_i","display":"r_i","kind":"use","occurrences":[355,360]},{"id":"symbol-48d1f02269ce141f","tex":"r_i'","aliases":"r_i'","display":"r_i'","kind":"use","occurrences":[360]},{"id":"symbol-e16c40c1720d168f","tex":"r_{ij}^i","aliases":"r_ij^i","display":"r_{ij}^i","kind":"use","occurrences":[194,196]},{"id":"symbol-0b8641bf15f44dd3","tex":"r_{ij}^j","aliases":"r_ij^j","display":"r_{ij}^j","kind":"use","occurrences":[195,196]},{"id":"symbol-35e4b1420672d392","tex":"r_j","aliases":"r_j","display":"r_j","kind":"use","occurrences":[1447,1449,1451,1453]},{"id":"symbol-a64e897db39c6a7f","tex":"R_k","aliases":"R_k","display":"R_k","kind":"use","occurrences":[1222,1227,1237,1288]},{"id":"symbol-b9fe2b346d4c6f8d","tex":"R_{k+1}","aliases":"R_k+1","display":"R_{k+1}","kind":"use","occurrences":[1222]},{"id":"symbol-a4ff961cd74d1869","tex":"r_n","aliases":"r_n","display":"r_n","kind":"use","occurrences":[356]},{"id":"symbol-777e99bfe04d5f4e","tex":"r_{\\rm end}","aliases":"r_rm end rm","display":"r_{\\rm end}","kind":"use","occurrences":[1477,1487]},{"id":"symbol-935c16efac7d9b95","tex":"R_{\\rm repair}","aliases":"R_rm repair rm","display":"R_{\\rm repair}","kind":"use","occurrences":[63]},{"id":"symbol-72ef1cd62b216cdd","tex":"r_T","aliases":"r_T","display":"r_T","kind":"use","occurrences":[732,734,735]},{"id":"symbol-cab8512436e7d001","tex":"r_T^t","aliases":"r_T^t","display":"r_T^t","kind":"use","occurrences":[735]},{"id":"symbol-9a0a032f1455f671","tex":"\\mathcal R_\\ell","aliases":"R_ℓ mathcal ell","display":"\\mathcal R_\\ell","kind":"use","occurrences":[69,71]},{"id":"symbol-8f79fd1cbecd31c3","tex":"\\mathbb R_{\\ge0}^n","aliases":"R_≥0^n mathbb ge","display":"\\mathbb R_{\\ge0}^n","kind":"use","occurrences":[1103]},{"id":"symbol-87db0642ef898b44","tex":"\\rceil","aliases":"rceil","display":"\\rceil","kind":"use","occurrences":[157,202]},{"id":"symbol-f8e96c093962b45c","tex":"\\mathsf{Reach}","aliases":"Reach mathsf","display":"\\mathsf{Reach}","kind":"use","occurrences":[1026,1030]},{"id":"symbol-c8f7e2c70f9ad344","tex":"\\mathsf{Reach}_J","aliases":"Reach_J mathsf","display":"\\mathsf{Reach}_J","kind":"use","occurrences":[1026,1030]},{"id":"symbol-2781357a113adde1","tex":"\\mathsf{Remedy}","aliases":"Remedy mathsf","display":"\\mathsf{Remedy}","kind":"use","occurrences":[1337,1343]},{"id":"symbol-37a16f3398973366","tex":"\\mathsf{Revision}","aliases":"Revision mathsf","display":"\\mathsf{Revision}","kind":"use","occurrences":[1519]},{"id":"symbol-452acf9313788e80","tex":"\\rfloor","aliases":"rfloor","display":null,"kind":"use","occurrences":[374]},{"id":"symbol-5e769b89788d547a","tex":"s'","aliases":"s'","display":"s'","kind":"use","occurrences":[536,539,569]},{"id":"symbol-dc18d935845d0826","tex":"s^\\star","aliases":"s^⋆ star","display":"s^\\star","kind":"use","occurrences":[829,835]},{"id":"symbol-b60dd8e5854d9e87","tex":"s_0","aliases":"s_0","display":"s_0","kind":"use","occurrences":[538]},{"id":"symbol-3ea628df7c9adeec","tex":"S_{1,t}","aliases":"S_1,t","display":"S_{1,t}","kind":"use","occurrences":[47]},{"id":"symbol-cdc525abf7a300b5","tex":"S_3","aliases":"S_3","display":"S_3","kind":"use","occurrences":[889,906]},{"id":"symbol-2badf92439cc7951","tex":"S_A","aliases":"S_A","display":"S_A","kind":"use","occurrences":[312,316,317]},{"id":"symbol-450f6a43de6765bd","tex":"S_B","aliases":"S_B","display":"S_B","kind":"use","occurrences":[312,316]},{"id":"symbol-698cd4222a287d75","tex":"S_i","aliases":"S_i","display":"S_i","kind":"use","occurrences":[48]},{"id":"symbol-040191bdcfa58557","tex":"S_{n,t}","aliases":"S_n,t","display":"S_{n,t}","kind":"use","occurrences":[47]},{"id":"symbol-4bca7afcafa97a49","tex":"s_t","aliases":"s_t","display":"s_t","kind":"use","occurrences":[540,742,973,974,1007]},{"id":"symbol-bc10232afca3de12","tex":"\\mathsf{safe}","aliases":"safe mathsf","display":"\\mathsf{safe}","kind":"use","occurrences":[544,546,548]},{"id":"symbol-f93687b75635f48a","tex":"\\section","aliases":"section","display":null,"kind":"use","occurrences":[47,1570]},{"id":"symbol-af23f16ae38328e6","tex":"\\mathsf{settled}","aliases":"settled mathsf","display":"\\mathsf{settled}","kind":"use","occurrences":[660,661]},{"id":"symbol-66a61f82005247b0","tex":"\\mathsf{Standing}","aliases":"Standing mathsf","display":"\\mathsf{Standing}","kind":"use","occurrences":[1337,1342]},{"id":"symbol-937d77032661535d","tex":"\\mathsf{status}","aliases":"status mathsf","display":"\\mathsf{status}","kind":"use","occurrences":[654]},{"id":"symbol-e3a3690589fe3220","tex":"\\mathsf{strict}","aliases":"strict mathsf","display":"\\mathsf{strict}","kind":"use","occurrences":[543,545,546]},{"id":"symbol-848c3c3d231100c2","tex":"\\subsection","aliases":"subsection","display":null,"kind":"use","occurrences":[47,1570]},{"id":"symbol-32f99fc05b64a106","tex":"\\succ","aliases":"succ","display":"\\succ","kind":"use","occurrences":[523]},{"id":"symbol-eaa105d35de9dffc","tex":"\\succ_1","aliases":"succ_1 succ","display":"\\succ_1","kind":"use","occurrences":[523]},{"id":"symbol-b77d42fca9fc6f71","tex":"\\succ_2","aliases":"succ_2 succ","display":"\\succ_2","kind":"use","occurrences":[523]},{"id":"symbol-14a376fad88dda63","tex":"\\succ_3","aliases":"succ_3 succ","display":"\\succ_3","kind":"use","occurrences":[523]},{"id":"symbol-04eac83a730993ac","tex":"\\sup_{e\\in\\mathcal E}","aliases":"sup_e∈ E sup in mathcal","display":"\\sup_{e\\in\\mathcal E}","kind":"use","occurrences":[227]},{"id":"symbol-b869d08795b0a514","tex":"\\sup_{i,x}","aliases":"sup_i,x sup","display":"\\sup_{i,x}","kind":"use","occurrences":[787]},{"id":"symbol-9d55308f3616d884","tex":"\\sup_{x,u}","aliases":"sup_x,u sup","display":"\\sup_{x,u}","kind":"use","occurrences":[103]},{"id":"symbol-2b95d0c23567ffe8","tex":"\\sup_z","aliases":"sup_z sup","display":"\\sup_z","kind":"use","occurrences":[936]},{"id":"symbol-5b62d811cced096b","tex":"\\sup_{z,a}","aliases":"sup_z,a sup","display":"\\sup_{z,a}","kind":"use","occurrences":[936]},{"id":"symbol-58462a227dfef4aa","tex":"\\sup_{z\\in Z_j}","aliases":"sup_z∈ Z_j sup in","display":"\\sup_{z\\in Z_j}","kind":"use","occurrences":[684]},{"id":"symbol-5da19979b8bdde70","tex":"\\sup_{\\tau\\in\\mathcal T}","aliases":"sup_τ∈ T sup tau in mathcal","display":"\\sup_{\\tau\\in\\mathcal T}","kind":"use","occurrences":[146]},{"id":"symbol-e14cb192aabec81c","tex":"T_0","aliases":"T_0","display":"T_0","kind":"use","occurrences":[689,1475]},{"id":"symbol-c18dc2736f8201fc","tex":"T_{0:m}","aliases":"T_0:m","display":"T_{0:m}","kind":"use","occurrences":[689,691]},{"id":"symbol-dff2d096303f5338","tex":"T_{0:m-1}","aliases":"T_0:m-1","display":"T_{0:m-1}","kind":"use","occurrences":[696]},{"id":"symbol-f94f900a994c88b6","tex":"T_{AB}","aliases":"T_AB","display":"T_{AB}","kind":"use","occurrences":[323]},{"id":"symbol-de0bad5f8f33721c","tex":"t_i","aliases":"t_i","display":"t_i","kind":"use","occurrences":[347,348,349,353]},{"id":"symbol-e9a7aef78fcda23e","tex":"T_{ij}","aliases":"T_ij","display":"T_{ij}","kind":"use","occurrences":[853,854]},{"id":"symbol-b48a351441abfbe5","tex":"T_j","aliases":"T_j","display":"T_j","kind":"use","occurrences":[683,684,685]},{"id":"symbol-b6d1c35d86f0d39d","tex":"T_k","aliases":"T_k","display":"T_k","kind":"use","occurrences":[1475,1490]},{"id":"symbol-4e56fe1bda71e196","tex":"T_{k+1}","aliases":"T_k+1","display":"T_{k+1}","kind":"use","occurrences":[1475]},{"id":"symbol-d1d458adac479328","tex":"T_{m-1}","aliases":"T_m-1","display":"T_{m-1}","kind":"use","occurrences":[689,696,698]},{"id":"symbol-a25513c7e0f6eaa8","tex":"U","aliases":"U","display":"U","kind":"use","occurrences":[36,41,43,47,522,523,525,526,531,533,643,644,645,939,940,942,944,945,946,947,948,950,953,1180,1181,1183,1281,1450,1451,1458,1460,1569]},{"id":"symbol-300f218594b1347a","tex":"\\U","aliases":"U mathcal","display":"{\\mathcal U}","kind":"use","occurrences":[47,181]},{"id":"symbol-92359e5cbd8a18d0","tex":"u_i","aliases":"u_i","display":"u_i","kind":"use","occurrences":[357,360,363,368]},{"id":"symbol-6ae21ddbb7e958a2","tex":"U_t","aliases":"U_t","display":"U_t","kind":"use","occurrences":[47]},{"id":"symbol-8c32968924d276d3","tex":"\\mathsf{unsafe}","aliases":"unsafe mathsf","display":"\\mathsf{unsafe}","kind":"use","occurrences":[544,548]},{"id":"symbol-ae3df08d949531da","tex":"V_0","aliases":"V_0","display":"V_0","kind":"use","occurrences":[553,562]},{"id":"symbol-0f1a455a83b273b0","tex":"v_0","aliases":"v_0","display":"v_0","kind":"use","occurrences":[863,864,865,871,1534,1539]},{"id":"symbol-af5dd21930308f17","tex":"V_1","aliases":"V_1","display":"V_1","kind":"use","occurrences":[470]},{"id":"symbol-3565225c19d3bc52","tex":"v_1","aliases":"v_1","display":"v_1","kind":"use","occurrences":[256,864]},{"id":"symbol-0b837e89a1e8104e","tex":"V_h","aliases":"V_h","display":"V_h","kind":"use","occurrences":[555,557,560,567]},{"id":"symbol-11ef40505ae9bca6","tex":"V_{h+1}","aliases":"V_h+1","display":"V_{h+1}","kind":"use","occurrences":[555,568]},{"id":"symbol-23dfe8b37c1f5d9f","tex":"v_i","aliases":"v_i","display":"v_i","kind":"use","occurrences":[1111]},{"id":"symbol-b700e39236b5b68f","tex":"v_j","aliases":"v_j","display":"v_j","kind":"use","occurrences":[257,260]},{"id":"symbol-0a435f82d4918621","tex":"v_k","aliases":"v_k","display":"v_k","kind":"use","occurrences":[256,863,864,865,871]},{"id":"symbol-8bd64ec0c9cf0366","tex":"v_{k-1}","aliases":"v_k-1","display":"v_{k-1}","kind":"use","occurrences":[864]},{"id":"symbol-b1555515dbd55fec","tex":"V_T","aliases":"V_T","display":"V_T","kind":"use","occurrences":[334]},{"id":"symbol-92becdaca2dd0d19","tex":"V_\\alpha","aliases":"V_α alpha","display":"V_\\alpha","kind":"use","occurrences":[465,466,467,479]},{"id":"symbol-3696096793ac9d06","tex":"\\operatorname{Var}","aliases":"Var operatorname","display":"\\operatorname{Var}","kind":"use","occurrences":[965]},{"id":"symbol-a675678fa6689935","tex":"\\vee","aliases":"vee","display":"\\vee","kind":"use","occurrences":[594,596,600,604,609]},{"id":"symbol-e83c58309eb2060b","tex":"\\mathcal W","aliases":"W mathcal","display":"\\mathcal W","kind":"use","occurrences":[183,1071,1073,1075,1076]},{"id":"symbol-bd5ef9a5ba57a080","tex":"W_A","aliases":"W_A","display":"W_A","kind":"use","occurrences":[1062,1063]},{"id":"symbol-f39670f030db3b1a","tex":"W_B","aliases":"W_B","display":"W_B","kind":"use","occurrences":[1062,1063]},{"id":"symbol-179eb697363e8b1a","tex":"w_e","aliases":"w_e","display":"w_e","kind":"use","occurrences":[959,960]},{"id":"symbol-18864b29b043b6d8","tex":"W_i","aliases":"W_i","display":"W_i","kind":"use","occurrences":[193]},{"id":"symbol-cc7e0d5f7e350ab2","tex":"w_i","aliases":"w_i","display":"w_i","kind":"use","occurrences":[196,351,353]},{"id":"symbol-af7bc77c629d2fcb","tex":"w_j","aliases":"w_j","display":"w_j","kind":"use","occurrences":[196,1112]},{"id":"symbol-8d7f1cc8c150d4e5","tex":"W_p","aliases":"W_p","display":"W_p","kind":"use","occurrences":[1055]},{"id":"symbol-a3535b369082a4f1","tex":"W_{\\rm glue}","aliases":"W_rm glue rm","display":"W_{\\rm glue}","kind":"use","occurrences":[196]},{"id":"symbol-2b49ff09b03e5e91","tex":"w_t","aliases":"w_t","display":"w_t","kind":"use","occurrences":[248,249,1105,1106,1113]},{"id":"symbol-29b34095556c1a12","tex":"\\mathsf{wait}","aliases":"wait mathsf","display":"\\mathsf{wait}","kind":"use","occurrences":[1274]},{"id":"symbol-cb66caadea9f666a","tex":"\\wedge","aliases":"wedge","display":"\\wedge","kind":"use","occurrences":[539]},{"id":"symbol-5450287e32dd956c","tex":"\\widehat K","aliases":"widehat K widehat","display":"\\widehat K","kind":"use","occurrences":[185,187]},{"id":"symbol-567192244cfc2ddc","tex":"\\widehat K_u","aliases":"widehat K_u widehat","display":"\\widehat K_u","kind":"use","occurrences":[185,187]},{"id":"symbol-08422a7c74004217","tex":"\\widehat P","aliases":"widehat P widehat","display":"\\widehat P","kind":"use","occurrences":[505,506,510,515]},{"id":"symbol-867fe7c70266a5ce","tex":"\\widehat P_C","aliases":"widehat P_C widehat","display":"\\widehat P_C","kind":"use","occurrences":[505,506,510,515]},{"id":"symbol-22cdc1586433efd2","tex":"\\widehat P_j","aliases":"widehat P_j widehat","display":"\\widehat P_j","kind":"use","occurrences":[505,506,510,515]},{"id":"symbol-fec34e4c8a1d397d","tex":"\\widehat\\theta","aliases":"widehatθ widehat theta","display":"\\widehat\\theta","kind":"use","occurrences":[1003,1004]},{"id":"symbol-da21fd16a51a8ec1","tex":"\\widehat\\theta_n","aliases":"widehatθ_n widehat theta","display":"\\widehat\\theta_n","kind":"use","occurrences":[1003,1004]},{"id":"symbol-089f71382a559dc8","tex":"\\widetilde g","aliases":"widetilde g widetilde","display":"\\widetilde g","kind":"use","occurrences":[918,919]},{"id":"symbol-b79ff1013bc386ca","tex":"\\widetilde g_{ij}","aliases":"widetilde g_ij widetilde","display":"\\widetilde g_{ij}","kind":"use","occurrences":[918,919]},{"id":"symbol-e81b61047eca0739","tex":"x'","aliases":"x'","display":"x'","kind":"use","occurrences":[47,76,77,85,86,87,93,145,146]},{"id":"symbol-3078a09641b0267f","tex":"x_0","aliases":"x_0","display":"x_0","kind":"use","occurrences":[1112]},{"id":"symbol-762eb59ebd1883d4","tex":"x_A","aliases":"x_A","display":"x_A","kind":"use","occurrences":[907]},{"id":"symbol-53277cef66815b36","tex":"x_B","aliases":"x_B","display":"x_B","kind":"use","occurrences":[907]},{"id":"symbol-1de5ff44fea6e14e","tex":"x_C","aliases":"x_C","display":"x_C","kind":"use","occurrences":[907]},{"id":"symbol-4f0f1e4a3167d257","tex":"x_i","aliases":"x_i","display":"x_i","kind":"use","occurrences":[841,843,844,897,898,903,905,957,1111]},{"id":"symbol-e7a4c23a3df19ee0","tex":"x_i'","aliases":"x_i'","display":"x_i'","kind":"use","occurrences":[957]},{"id":"symbol-aab9db6e286302fc","tex":"x_j","aliases":"x_j","display":"x_j","kind":"use","occurrences":[843,898,905]},{"id":"symbol-8981b26b3b446b1c","tex":"x_r","aliases":"x_r","display":"x_r","kind":"use","occurrences":[899,901,902,904]},{"id":"symbol-1029cb8ad51ed272","tex":"x_t","aliases":"x_t","display":"x_t","kind":"use","occurrences":[1103,1105,1112]},{"id":"symbol-1e4fb4e21dd5aa54","tex":"X_{t+1}","aliases":"X_t+1","display":"X_{t+1}","kind":"use","occurrences":[47,94]},{"id":"symbol-813924c29494401d","tex":"x_{t+1}","aliases":"x_t+1","display":"x_{t+1}","kind":"use","occurrences":[1105]},{"id":"symbol-29ee7dd9b2baba56","tex":"\\Y","aliases":"Y mathcal","display":"{\\mathcal Y}","kind":"use","occurrences":[47]},{"id":"symbol-241d1cd21689b8a9","tex":"y'","aliases":"y'","display":"y'","kind":"use","occurrences":[1570]},{"id":"symbol-c0b1df2ea073f12b","tex":"Y_{0:T}","aliases":"Y_0:T","display":"Y_{0:T}","kind":"use","occurrences":[227]},{"id":"symbol-bbeebd879e1dff69","tex":"Z","aliases":"Z","display":"Z","kind":"use","occurrences":[27,28,88,97,98,99,101,117,118,119,121,142,143,285,681,682,683,684,690,853,925,929,935,938,939,1337,1338,1521,1571,1576]},{"id":"symbol-c656dc90ffbe53cd","tex":"\\mathcal Z","aliases":"Z mathcal","display":"\\mathcal Z","kind":"use","occurrences":[436]},{"id":"symbol-e8394415f576ddd6","tex":"Z_0","aliases":"Z_0","display":"Z_0","kind":"use","occurrences":[690,938]},{"id":"symbol-1f0b48345ddedcf2","tex":"z_0","aliases":"z_0","display":"z_0","kind":"use","occurrences":[1534,1539]},{"id":"symbol-d4697ab9515717cf","tex":"Z_{0:t}","aliases":"Z_0:t","display":"Z_{0:t}","kind":"use","occurrences":[88]},{"id":"symbol-b23ccb12e2adf65f","tex":"Z_1","aliases":"Z_1","display":"Z_1","kind":"use","occurrences":[938,939]},{"id":"symbol-64a9a143ebce6852","tex":"Z_2","aliases":"Z_2","display":"Z_2","kind":"use","occurrences":[939]},{"id":"symbol-bc1f10031646b5b4","tex":"Z_i","aliases":"Z_i","display":"Z_i","kind":"use","occurrences":[853,935]},{"id":"symbol-10845de283abdc8a","tex":"Z_j","aliases":"Z_j","display":"Z_j","kind":"use","occurrences":[681,682,683,684,853,925,929,935]},{"id":"symbol-3333cd3c2a193464","tex":"Z_{j+1}","aliases":"Z_j+1","display":"Z_{j+1}","kind":"use","occurrences":[683]},{"id":"symbol-3992003344c63054","tex":"Z_{\\rm ext}","aliases":"Z_rm ext rm","display":"Z_{\\rm ext}","kind":"use","occurrences":[1337,1338]},{"id":"symbol-3480de748bc9723a","tex":"Z_t","aliases":"Z_t","display":"Z_t","kind":"use","occurrences":[27,28,97,98,99,101,117]},{"id":"symbol-83c84ae2ae962020","tex":"Z_{t+1}","aliases":"Z_t+1","display":"Z_{t+1}","kind":"use","occurrences":[97,98]},{"id":"symbol-e3f81397417a104e","tex":"Z_{t-1}","aliases":"Z_t-1","display":"Z_{t-1}","kind":"use","occurrences":[98,99]},{"id":"symbol-349ba76d907adfab","tex":"\\times","aliases":"× times","display":"\\times","kind":"use","occurrences":[317]},{"id":"symbol-673ddcfc7e4cb456","tex":"\\alpha_t","aliases":"α_t alpha","display":"\\alpha_t","kind":"use","occurrences":[88]},{"id":"symbol-f3f3804480e8551a","tex":"\\beta","aliases":"β beta","display":"\\beta","kind":"use","occurrences":[805,809,810,812]},{"id":"symbol-6cb4d369799123ce","tex":"\\beta_i","aliases":"β_i beta","display":"\\beta_i","kind":"use","occurrences":[805,809,810,812]},{"id":"symbol-67610b0632683369","tex":"\\gamma","aliases":"γ gamma","display":"\\gamma","kind":"use","occurrences":[771,773,863,864,868,871,888,914,916,917,920,921,922,923]},{"id":"symbol-f8dfdbf3cc0b5e24","tex":"\\Gamma_\\alpha","aliases":"Γ_α Gamma alpha","display":"\\Gamma_\\alpha","kind":"use","occurrences":[459,460,461,466,1317]},{"id":"symbol-d203ba01eef4198c","tex":"\\delta","aliases":"δ delta","display":"\\delta","kind":"use","occurrences":[47,330,332,334,340,598,603,604,668,670,672,913,916,919,922,929,936,1567]},{"id":"symbol-7b1d94d61b4dc82c","tex":"\\delta^T","aliases":"δ^T delta","display":"\\delta^T","kind":"use","occurrences":[334]},{"id":"symbol-14f278050573d8ad","tex":"\\Delta_{\\mathcal A}","aliases":"Δ_ A Delta mathcal","display":"\\Delta_{\\mathcal A}","kind":"use","occurrences":[71]},{"id":"symbol-9adbb02c2ad54bb0","tex":"\\delta_1","aliases":"δ_1 delta","display":"\\delta_1","kind":"use","occurrences":[603,604]},{"id":"symbol-1d6bb66bd4727edf","tex":"\\delta_c","aliases":"δ_c delta","display":"\\delta_c","kind":"use","occurrences":[929,936]},{"id":"symbol-572519ec1d6f4294","tex":"\\delta_{F_u(x)}","aliases":"δ_F_u(x) delta","display":"\\delta_{F_u(x)}","kind":"use","occurrences":[47]},{"id":"symbol-a752f44c1655724a","tex":"\\delta_{ij}","aliases":"δ_ij delta","display":"\\delta_{ij}","kind":"use","occurrences":[913,916,919,922]},{"id":"symbol-9ddbf7c75026bec5","tex":"\\Delta_{\\mathrm{inst}}^{\\mathcal E,T}","aliases":"Δ_inst^ E,T Delta mathrm mathcal","display":"\\Delta_{\\mathrm{inst}}^{\\mathcal E,T}","kind":"use","occurrences":[227]},{"id":"symbol-dd0aa14ad6313087","tex":"\\Delta_m","aliases":"Δ_m Delta","display":"\\Delta_m","kind":"use","occurrences":[462,466,468,474]},{"id":"symbol-417868d41866988d","tex":"\\delta_N","aliases":"δ_N delta","display":"\\delta_N","kind":"use","occurrences":[603,604]},{"id":"symbol-21126255abeaa6ee","tex":"\\Delta_{\\rm coal}","aliases":"Δ_rm coal Delta rm","display":"\\Delta_{\\rm coal}","kind":"use","occurrences":[63]},{"id":"symbol-8bc4bfc2bdebfaac","tex":"\\epsilon","aliases":"ϵ epsilon","display":"\\epsilon","kind":"use","occurrences":[506,507,510,515,517]},{"id":"symbol-a05a39430affb6df","tex":"\\varepsilon_0","aliases":"ε_0 varepsilon","display":"\\varepsilon_0","kind":"use","occurrences":[694]},{"id":"symbol-eb1a042b3cb1067c","tex":"\\varepsilon_1","aliases":"ε_1 varepsilon","display":"\\varepsilon_1","kind":"use","occurrences":[184,187]},{"id":"symbol-5b28ece65b4eb364","tex":"\\varepsilon_2","aliases":"ε_2 varepsilon","display":"\\varepsilon_2","kind":"use","occurrences":[185,187]},{"id":"symbol-bae7842f2d63f7f5","tex":"\\varepsilon_a","aliases":"ε_a varepsilon","display":"\\varepsilon_a","kind":"use","occurrences":[828]},{"id":"symbol-c0dff5e4591b6949","tex":"\\epsilon_C","aliases":"ϵ_C epsilon","display":"\\epsilon_C","kind":"use","occurrences":[506,507,510,515,517]},{"id":"symbol-5fafc40bd0085548","tex":"\\varepsilon_C","aliases":"ε_C varepsilon","display":"\\varepsilon_C","kind":"use","occurrences":[832,833,835,837,838]},{"id":"symbol-684affc58e5950cc","tex":"\\varepsilon_c","aliases":"ε_c varepsilon","display":"\\varepsilon_c","kind":"use","occurrences":[936,944]},{"id":"symbol-7879135e402b1ed2","tex":"\\varepsilon_D","aliases":"ε_D varepsilon","display":"\\varepsilon_D","kind":"use","occurrences":[832,833,837,838]},{"id":"symbol-3a1bd9c12f8b633a","tex":"\\varepsilon_E","aliases":"ε_E varepsilon","display":"\\varepsilon_E","kind":"use","occurrences":[937]},{"id":"symbol-a14473f51c7df774","tex":"\\epsilon_j","aliases":"ϵ_j epsilon","display":"\\epsilon_j","kind":"use","occurrences":[506,510,515]},{"id":"symbol-b3de5d9511fcd1b4","tex":"\\varepsilon_j","aliases":"ε_j varepsilon","display":"\\varepsilon_j","kind":"use","occurrences":[189,191,684,687,691]},{"id":"symbol-febfa4f397b3571b","tex":"\\varepsilon_{m-1}","aliases":"ε_m-1 varepsilon","display":"\\varepsilon_{m-1}","kind":"use","occurrences":[700,701]},{"id":"symbol-d5d46059ce01e388","tex":"\\varepsilon_O","aliases":"ε_O varepsilon","display":"\\varepsilon_O","kind":"use","occurrences":[937]},{"id":"symbol-038c0ada2296bcc6","tex":"\\varepsilon_P","aliases":"ε_P varepsilon","display":"\\varepsilon_P","kind":"use","occurrences":[937]},{"id":"symbol-369a731ef7da1eab","tex":"\\varepsilon_R","aliases":"ε_R varepsilon","display":"\\varepsilon_R","kind":"use","occurrences":[937]},{"id":"symbol-287aae19eedd3ef2","tex":"\\varepsilon_{\\rm dyn}","aliases":"ε_rm dyn varepsilon rm","display":"\\varepsilon_{\\rm dyn}","kind":"use","occurrences":[63,181,936,937,942,949,950]},{"id":"symbol-09d350165c7120ad","tex":"\\varepsilon_{\\rm int}","aliases":"ε_rm int varepsilon rm","display":"\\varepsilon_{\\rm int}","kind":"use","occurrences":[63,181]},{"id":"symbol-dd54bd5850296191","tex":"\\varepsilon_{\\rm pred}","aliases":"ε_rm pred varepsilon rm","display":"\\varepsilon_{\\rm pred}","kind":"use","occurrences":[63]},{"id":"symbol-76ab81e6b93d8a15","tex":"\\varepsilon_t","aliases":"ε_t varepsilon","display":"\\varepsilon_t","kind":"use","occurrences":[1440,1441]},{"id":"symbol-c7b34ab03e848fc4","tex":"\\Theta","aliases":"Θ Theta","display":"\\Theta","kind":"use","occurrences":[47,52]},{"id":"symbol-0d7cc092bd519f22","tex":"\\Theta_t","aliases":"Θ_t Theta","display":"\\Theta_t","kind":"use","occurrences":[47]},{"id":"symbol-7e9973998ea1e838","tex":"\\kappa^t","aliases":"κ^t kappa","display":"\\kappa^t","kind":"use","occurrences":[109,1112,1114]},{"id":"symbol-4b263b6f4c51eac0","tex":"\\kappa^{t-1-j}","aliases":"κ^t-1-j kappa","display":"\\kappa^{t-1-j}","kind":"use","occurrences":[1112]},{"id":"symbol-dc402836c2cb145c","tex":"\\lambda^z","aliases":"λ^z lambda","display":"\\lambda^z","kind":"use","occurrences":[981]},{"id":"symbol-8b63c02e309e1522","tex":"\\lambda_j","aliases":"λ_j lambda","display":"\\lambda_j","kind":"use","occurrences":[463,464,473]},{"id":"symbol-29b14a34343e28e4","tex":"\\lambda_t","aliases":"λ_t lambda","display":"\\lambda_t","kind":"use","occurrences":[1436,1437,1439,1440]},{"id":"symbol-64833ef6070cbe84","tex":"\\lambda_t^{-1}","aliases":"λ_t^-1 lambda","display":"\\lambda_t^{-1}","kind":"use","occurrences":[1438]},{"id":"symbol-3b453de64aef4dc5","tex":"\\mu_0","aliases":"μ_0 mu","display":"\\mu_0","kind":"use","occurrences":[89]},{"id":"symbol-252454ad397ec5a8","tex":"\\mu_i","aliases":"μ_i mu","display":"\\mu_i","kind":"use","occurrences":[786,787,789,805,806,807,809,811]},{"id":"symbol-84eb2b123d1102b8","tex":"\\nu","aliases":"ν nu","display":"\\nu","kind":"use","occurrences":[102,666,668,669]},{"id":"symbol-dabec2cdc19c3167","tex":"\\rho","aliases":"ρ rho","display":"\\rho","kind":"use","occurrences":[745,751,964,965,967]},{"id":"symbol-9c3245dfb4ac54c1","tex":"\\sigma","aliases":"σ sigma","display":"\\sigma","kind":"use","occurrences":[963,965,1158,1159]},{"id":"symbol-914fbbb84366f58b","tex":"\\sigma^2","aliases":"σ^2 sigma","display":"\\sigma^2","kind":"use","occurrences":[963,965]},{"id":"symbol-da6215232ea750c2","tex":"\\tau_{AB}","aliases":"τ_AB tau","display":"\\tau_{AB}","kind":"use","occurrences":[323]},{"id":"symbol-c14027706b566ee4","tex":"\\tau_{AC}","aliases":"τ_AC tau","display":"\\tau_{AC}","kind":"use","occurrences":[323]},{"id":"symbol-3c628f32996e414d","tex":"\\tau_{BC}","aliases":"τ_BC tau","display":"\\tau_{BC}","kind":"use","occurrences":[323]},{"id":"symbol-9a2ae80e5efa1bd7","tex":"\\Phi","aliases":"Φ Phi","display":"\\Phi","kind":"use","occurrences":[358,360,361,362,722,725,727]},{"id":"symbol-959f488598ceedf4","tex":"\\varphi","aliases":"φ varphi","display":"\\varphi","kind":"use","occurrences":[654,657,1019,1020,1022,1024,1025,1030,1032,1033,1037,1044,1046,1048,1050,1052]},{"id":"symbol-f1920a0117831d5f","tex":"\\Psi","aliases":"Ψ Psi","display":"\\Psi","kind":"use","occurrences":[537,538,539,540]},{"id":"symbol-f301f970eb09c336","tex":"\\psi","aliases":"ψ psi","display":"\\psi","kind":"use","occurrences":[183,185,186,187,190]},{"id":"symbol-25d93829156f568b","tex":"\\psi_{\\#}","aliases":"ψ_# psi","display":"\\psi_{\\#}","kind":"use","occurrences":[185,190]},{"id":"symbol-f0dc60cd5b6e9148","tex":"\\ldots","aliases":"… ldots","display":"\\ldots","kind":"use","occurrences":[47,159,256,356,428,447,603,688,796,863,962,976,1243,1443,1451,1459]},{"id":"symbol-f07e36f47bcd4628","tex":"\\ell^1","aliases":"ℓ^1 ell","display":"\\ell^1","kind":"use","occurrences":[934]},{"id":"symbol-e18760f27e56e31b","tex":"\\ell^\\star","aliases":"ℓ^⋆ ell star","display":"\\ell^\\star","kind":"use","occurrences":[604,612]},{"id":"symbol-e149f481feb293a4","tex":"\\ell_0","aliases":"ℓ_0 ell","display":"\\ell_0","kind":"use","occurrences":[602,604,611]},{"id":"symbol-f9c5c5b39e3639f2","tex":"\\ell_i","aliases":"ℓ_i ell","display":"\\ell_i","kind":"use","occurrences":[597,599,600]},{"id":"symbol-8943b22d90e5e02b","tex":"\\ell_j","aliases":"ℓ_j ell","display":"\\ell_j","kind":"use","occurrences":[600]},{"id":"symbol-c18573d79c46d124","tex":"\\to^*","aliases":"→^* to","display":"\\to^*","kind":"use","occurrences":[570,571,577,578,580,581]},{"id":"symbol-df67d8f7c7daff26","tex":"\\mapsto","aliases":"↦ mapsto","display":"\\mapsto","kind":"use","occurrences":[869,1536]},{"id":"symbol-ae3660560a54702c","tex":"\\Rightarrow","aliases":"⇒ Rightarrow","display":"\\Rightarrow","kind":"use","occurrences":[660,1518]},{"id":"symbol-4471c87ad5a9031e","tex":"\\notin","aliases":"∉ notin","display":"\\notin","kind":"use","occurrences":[742]},{"id":"symbol-c9955fd0d38cf7cb","tex":"\\prod","aliases":"∏ prod","display":"\\prod","kind":"use","occurrences":[177,691,1437]},{"id":"symbol-f4630c58d4f10a12","tex":"\\prod_{k=j+1}^{m-1}","aliases":"∏_k=j+1^m-1 prod","display":"\\prod_{k=j+1}^{m-1}","kind":"use","occurrences":[691]},{"id":"symbol-049564f82e5a2c6c","tex":"\\prod_{t=0}^{T-1}","aliases":"∏_t=0^T-1 prod","display":"\\prod_{t=0}^{T-1}","kind":"use","occurrences":[177]},{"id":"symbol-b1ce9ee9accd41e8","tex":"\\prod_{t=1}^{m}","aliases":"∏_t=1^m prod","display":"\\prod_{t=1}^{m}","kind":"use","occurrences":[1437]},{"id":"symbol-0d855e2065f74dbf","tex":"\\prod_{t=j+1}^{T-1}","aliases":"∏_t=j+1^T-1 prod","display":"\\prod_{t=j+1}^{T-1}","kind":"use","occurrences":[177]},{"id":"symbol-6d53b2a4c03aa039","tex":"\\sum_{(i,j)\\text{ traversed by }\\gamma}","aliases":"∑_(i,j) traversed by γ sum text gamma","display":"\\sum_{(i,j)\\text{ traversed by }\\gamma}","kind":"use","occurrences":[916]},{"id":"symbol-91e6cb6007134ac7","tex":"\\sum_i","aliases":"∑_i sum","display":"\\sum_i","kind":"use","occurrences":[346,348,352,363,1347]},{"id":"symbol-2f29622fb484623a","tex":"\\sum_{i=1}^n","aliases":"∑_i=1^n sum","display":"\\sum_{i=1}^n","kind":"use","occurrences":[965]},{"id":"symbol-aba48accee79a124","tex":"\\sum_{i\\in\\{A,B,C,D\\}}","aliases":"∑_i∈{A,B,C,D} sum in","display":"\\sum_{i\\in\\{A,B,C,D\\}}","kind":"use","occurrences":[34]},{"id":"symbol-f9e2dbe88f36e12f","tex":"\\sum_j","aliases":"∑_j sum","display":"\\sum_j","kind":"use","occurrences":[191,257,260,463,464,473]},{"id":"symbol-2dbaa0f874ca4402","tex":"\\sum_{j=0}^{m-1}","aliases":"∑_j=0^m-1 sum","display":"\\sum_{j=0}^{m-1}","kind":"use","occurrences":[691]},{"id":"symbol-fc292c4a072bc463","tex":"\\sum_{j=0}^{T-1}","aliases":"∑_j=0^T-1 sum","display":"\\sum_{j=0}^{T-1}","kind":"use","occurrences":[177]},{"id":"symbol-df66290cc89f818f","tex":"\\sum_{j=0}^{t-1}","aliases":"∑_j=0^t-1 sum","display":"\\sum_{j=0}^{t-1}","kind":"use","occurrences":[1112]},{"id":"symbol-25b387c951fb9265","tex":"\\sum_{j=1}^L","aliases":"∑_j=1^L sum","display":"\\sum_{j=1}^L","kind":"use","occurrences":[189]},{"id":"symbol-00a7ede556f767a5","tex":"\\sum_{j\\ne i}","aliases":"∑_j≠ i sum ne","display":"\\sum_{j\\ne i}","kind":"use","occurrences":[368]},{"id":"symbol-d74790b215363bd7","tex":"\\sum_{o\\in O}","aliases":"∑_o∈ O sum in","display":"\\sum_{o\\in O}","kind":"use","occurrences":[456]},{"id":"symbol-db5f373ed82eca46","tex":"\\sum_{r=0}^{\\infty}","aliases":"∑_r=0^∞ sum infty","display":"\\sum_{r=0}^{\\infty}","kind":"use","occurrences":[1000]},{"id":"symbol-90c396c1f06e154a","tex":"\\sum_t","aliases":"∑_t sum","display":"\\sum_t","kind":"use","occurrences":[1441]},{"id":"symbol-71278a52a9bdedac","tex":"\\sum_{t=a}^{b}","aliases":"∑_t=a^b sum","display":"\\sum_{t=a}^{b}","kind":"use","occurrences":[1453]},{"id":"symbol-62d0208cce9ec444","tex":"\\sum_{t\\in\\bigcup_{j\\in U}\\{r_j,\\ldots,d_j\\}}","aliases":"∑_t∈⋃_j∈ U{r_j,…,d_j} sum in bigcup in ldots","display":"\\sum_{t\\in\\bigcup_{j\\in U}\\{r_j,\\ldots,d_j\\}}","kind":"use","occurrences":[1451]},{"id":"symbol-aa1dbc193c31e5d5","tex":"\\sum_{t\\geq0}","aliases":"∑_t≥0 sum geq","display":"\\sum_{t\\geq0}","kind":"use","occurrences":[750]},{"id":"symbol-2b925196a0a0558c","tex":"\\sum_{w:\\pi(w)=z'}","aliases":"∑_w:π(w)=z' sum pi","display":"\\sum_{w:\\pi(w)=z'}","kind":"use","occurrences":[87]},{"id":"symbol-ee373b78330c8be1","tex":"\\sum_y","aliases":"∑_y sum","display":"\\sum_y","kind":"use","occurrences":[789]},{"id":"symbol-5966b9097878350e","tex":"\\sum_z","aliases":"∑_z sum","display":"\\sum_z","kind":"use","occurrences":[102,441]},{"id":"symbol-0e301b22b90725c4","tex":"\\setminus","aliases":"∖ setminus","display":"\\setminus","kind":"use","occurrences":[252,726]},{"id":"symbol-fcc886982cee8077","tex":"\\circ","aliases":"∘ circ","display":"\\circ","kind":"use","occurrences":[238,240]},{"id":"symbol-db8e84427c2e1e02","tex":"\\infty","aliases":"∞ infty","display":"\\infty","kind":"use","occurrences":[687,1000,1111,1112,1113]},{"id":"symbol-d2ecc6688baa55b4","tex":"\\cup","aliases":"∪ cup","display":"\\cup","kind":"use","occurrences":[252,1222,1475]},{"id":"symbol-58db8131f02376fc","tex":"\\sim_A","aliases":"∼_A sim","display":"\\sim_A","kind":"use","occurrences":[1045]},{"id":"symbol-e4bf4b163e1200f5","tex":"\\sim_B","aliases":"∼_B sim","display":"\\sim_B","kind":"use","occurrences":[1045]},{"id":"symbol-5e33633cccaa9740","tex":"\\sim_i","aliases":"∼_i sim","display":"\\sim_i","kind":"use","occurrences":[1017,1023,1028,1056]},{"id":"symbol-2b21cb87657d54c8","tex":"\\sim_i^A","aliases":"∼_i^A sim","display":"\\sim_i^A","kind":"use","occurrences":[1065]},{"id":"symbol-21aa252daa4fd2b9","tex":"\\sim_i^B","aliases":"∼_i^B sim","display":"\\sim_i^B","kind":"use","occurrences":[1065]},{"id":"symbol-dfb4f746dd2f3b1b","tex":"\\simeq","aliases":"≃ simeq","display":"\\simeq","kind":"use","occurrences":[854]},{"id":"symbol-ea7ef77bf7563068","tex":"\\equiv","aliases":"≡ equiv","display":"\\equiv","kind":"use","occurrences":[145,299]},{"id":"symbol-117259cd973260b1","tex":"\\equiv_{\\mathcal T}","aliases":"≡_ T equiv mathcal","display":"\\equiv_{\\mathcal T}","kind":"use","occurrences":[145]},{"id":"symbol-6ceea42b9b950da5","tex":"\\equiv_k","aliases":"≡_k equiv","display":"\\equiv_k","kind":"use","occurrences":[299]},{"id":"symbol-f4e191c5dd746e23","tex":"\\equiv_{k+1}","aliases":"≡_k+1 equiv","display":"\\equiv_{k+1}","kind":"use","occurrences":[299]},{"id":"symbol-7a03384e6e8b8519","tex":"\\le","aliases":"≤ le","display":"\\le","kind":"use","occurrences":[330,691,701,916,1105,1110,1112,1113,1347,1389,1391,1393,1396,1400,1402,1403,1407,1415,1449,1451,1453]},{"id":"symbol-d38f53421f824a97","tex":"\\ge","aliases":"≥ ge","display":"\\ge","kind":"use","occurrences":[346,349,554,915,922,1025,1103,1105,1388,1394,1436,1445,1453]},{"id":"symbol-0b887c3f37e371d2","tex":"\\oplus","aliases":"⊕ oplus","display":"\\oplus","kind":"use","occurrences":[65,138,168,645,648,843,957,958,1429,1431,1570,1572,1577,1599,1605]},{"id":"symbol-2defdf654978cc42","tex":"\\bigcup_{j\\in U}","aliases":"⋃_j∈ U bigcup in","display":"\\bigcup_{j\\in U}","kind":"use","occurrences":[1451]},{"id":"symbol-362138992adfe804","tex":"\\star","aliases":"⋆ star","display":"\\star","kind":"use","occurrences":[133,604,612,829,835]},{"id":"symbol-4f3867cf1346eed7","tex":"\\cdots","aliases":"⋯ cdots","display":"\\cdots","kind":"use","occurrences":[604,689,864]},{"id":"symbol-437de0b3cc0e5a5f","tex":"\\langle","aliases":"⟨ langle","display":"\\langle","kind":"use","occurrences":[455,456,459,465,510,515]},{"id":"symbol-7b52d298f1764e49","tex":"\\rangle","aliases":"⟩ rangle","display":"\\rangle","kind":"use","occurrences":[455,456,459,465,510,515]},{"id":"symbol-942faac63e3ce23f","tex":"\\longrightarrow","aliases":"⟶ longrightarrow","display":"\\longrightarrow","kind":"use","occurrences":[735,929]}],"contexts":["\\midrule\n$X_t$, $S$, $\\mathcal X$ & Complete modeled state or its state space. The space is finite unless an explicit extension says otherwise.","$\\pi$, $T$ & State abstraction or transport. Preservation of outputs does not automatically preserve actions, knowledge, or rights.","$K_u$, $Q_u$ & Row-stochastic transition and report kernels. The model states when their joint law requires separate treatment.","$\\operatorname{supp}K$ & The full supported successor set. A small positive probability is not discarded in a sure guarantee.","$\\TV(P,Q)$ & $\\tfrac12\\sum_x|P(x)-Q(x)|$ on a finite space. This lies in $[0,1]$.","$I$, $A(s)$ & Institutional state and admissible protocol catalogue at state $s$. Admissibility requires its stipulated implementation.","$B$, $\\mathcal B$ & A nonempty set of states consistent with a common history, and the space of such sets. These are not posterior distributions.","$\\Delta$, $\\operatorname{Succ}$ & Complete-state successors and the induced successors of public possibility sets.","$W_*$, $R_*$ & Safe continuation kernel and certified-service attractor for one contract. The first need not imply the second.","$F$, $g$, $\\alpha$ & Authorized collectible penalty, deviation gain in the same utility units, and the protected false-positive limit.","$\\lambda=e^\\varepsilon$ & Pairwise disclosure factor in Section~\\ref{sec:privacy-enforcement}. Elsewhere $\\lambda$ may denote a mixture or intervention.","$T_*$, $L_*$ & Ending attractor and the running kernel that preserves an available authorized ending.","Every organizational state in this paper remains a function of a complete computational realization. If $Z_t=\\pi(X_t)$, then $Z_t$ is not information outside $X_t$. The purpose of a higher-level description is to preserve relevant operations with less descriptive complexity. An institutional description must additionally preserve who may act, which commitments remain outstanding, and what counts as an authorized amendment. These are requirements on the abstraction, not a new substance added to the machine.","\\section{A running example: the four-office computational commons}\\label{sec:commons}\nConsider four continuing institutional positions, denoted $A,B,C,D$, that share four indivisible execution slots per epoch. An office is not a particular model instance. Its current occupant may be replaced through a specified handover, while its registered responsibilities continue. The environment supplies the four slots and an append-only event mechanism with atomic commits. These are explicit infrastructure assumptions, not consequences of the agents' cooperation. Section~\\ref{sec:social-time} later replaces the atomic event assumption with local replicas and shows which stronger commitments then need an additional realization.","Each office has a private task queue and may submit a demand report. A public record contains the current allocation rule, valid credentials, accepted urgency certificates, outstanding service obligations, and the amendment history. Slots have unique names $(e,k)$, where $e$ is the epoch and $k\\in\\{1,2,3,4\\}$. A grant consumes one available slot token. Copying a message that describes a grant does not create an additional token. The resource invariant is therefore\n\\[\n\\sum_{i\\in\\{A,B,C,D\\}}q_i(e)\\leq4,\n\\]\nwith no slot name assigned to two offices. In the worked trace all four offices demand their ordinary slot, so the allocations below use all four units.","public record contains the current allocation rule, valid credentials, accepted urgency certificates, outstanding service obligations, and the amendment history. Slots have unique names $(e,k)$, where $e$ is the epoch and $k\\in\\{1,2,3,4\\}$. A grant consumes one available slot token. Copying a message that describes a grant does not create an additional token. The resource invariant is therefore\n\\[\n\\sum_{i\\in\\{A,B,C,D\\}}q_i(e)\\leq4,\n\\]\nwith no slot name assigned to two offices. In the worked trace all four offices demand their ordinary slot, so the allocations below use all four units.","\\subsection{Two rules and an inherited obligation}\nUnder rule $R$, each office receives one slot. Rule $U$ permits an urgency exchange: when no previous service debt is outstanding, one office $j$ with an accepted urgency certificate may receive two slots if another office $k\\ne j$ explicitly volunteers its slot. The other two offices each receive one. The exchange creates a registered obligation\n\\[\no=(\\mathsf{id},\\mathsf{debtor}=j,\\mathsf{creditor}=k,\n\\mathsf{quantity}=1,\\mathsf{due}=e+1).\n\\]\nAt the next epoch the creditor receives two slots and the debtor none, with one slot for each remaining office. This repayment clause has priority over both $R$ and $U$. No new exchange is admitted while a debt remains outstanding. The model thus permits at most on","\\subsection{Two rules and an inherited obligation}\nUnder rule $R$, each office receives one slot. Rule $U$ permits an urgency exchange: when no previous service debt is outstanding, one office $j$ with an accepted urgency certificate may receive two slots if another office $k\\ne j$ explicitly volunteers its slot. The other two offices each receive one. The exchange creates a registered obligation\n\\[\no=(\\mathsf{id},\\mathsf{debtor}=j,\\mathsf{creditor}=k,\n\\mathsf{quantity}=1,\\mathsf{due}=e+1).\n\\]\nAt the next epoch the creditor receives two slots and the debtor none, with one slot for each remaining office. This repayment clause has priority over both $R$ and $U$. No new exchange is admitted while a debt remains outstanding. The model thus permits at most one service debt and guarantees its next-ep","\\subsection{Two rules and an inherited obligation}\nUnder rule $R$, each office receives one slot. Rule $U$ permits an urgency exchange: when no previous service debt is outstanding, one office $j$ with an accepted urgency certificate may receive two slots if another office $k\\ne j$ explicitly volunteers its slot. The other two offices each receive one. The exchange creates a registered obligation\n\\[\no=(\\mathsf{id},\\mathsf{debtor}=j,\\mathsf{creditor}=k,\n\\mathsf{quantity}=1,\\mathsf{due}=e+1).\n\\]\nAt the next epoch the creditor receives two slots and the debtor none, with one slot for each remaining office. This repayment clause has priority over both $R$ and $U$. No new exchange is admitted while a debt remains outstanding. The model thus permits at most one service debt and guarantees its next-epoch settlement conditional on continued infrastructure and execution of the admitted rule.","\\subsection{Two rules and an inherited obligation}\nUnder rule $R$, each office receives one slot. Rule $U$ permits an urgency exchange: when no previous service debt is outstanding, one office $j$ with an accepted urgency certificate may receive two slots if another office $k\\ne j$ explicitly volunteers its slot. The other two offices each receive one. The exchange creates a registered obligation\n\\[\no=(\\mathsf{id},\\mathsf{debtor}=j,\\mathsf{creditor}=k,\n\\mathsf{quantity}=1,\\mathsf{due}=e+1).\n\\]\nAt the next epoch the creditor receives two slots and the debtor none, with one slot for each remaining office. This repayment clause has priority over both $R$ and $U$. No new exchange is admitted while a debt remains outstanding. The model thus permits at most one service debt and guarantees its next-epoch settlement conditional on continued infrastructure and execution of the admitted rule. It does not guarantee that every urgent request can be accepted.","ubsection{Two rules and an inherited obligation}\nUnder rule $R$, each office receives one slot. Rule $U$ permits an urgency exchange: when no previous service debt is outstanding, one office $j$ with an accepted urgency certificate may receive two slots if another office $k\\ne j$ explicitly volunteers its slot. The other two offices each receive one. The exchange creates a registered obligation\n\\[\no=(\\mathsf{id},\\mathsf{debtor}=j,\\mathsf{creditor}=k,\n\\mathsf{quantity}=1,\\mathsf{due}=e+1).\n\\]\nAt the next epoch the creditor receives two slots and the debtor none, with one slot for each remaining office. This repayment clause has priority over both $R$ and $U$. No new exchange is admitted while a debt remains outstanding. The model thus permits at most one service debt and guarantees its next-epoch settlement conditional on continued infrastructure and execution of the admitted rule. It does not guarantee that every urgent request can be accepted.","f another office $k\\ne j$ explicitly volunteers its slot. The other two offices each receive one. The exchange creates a registered obligation\n\\[\no=(\\mathsf{id},\\mathsf{debtor}=j,\\mathsf{creditor}=k,\n\\mathsf{quantity}=1,\\mathsf{due}=e+1).\n\\]\nAt the next epoch the creditor receives two slots and the debtor none, with one slot for each remaining office. This repayment clause has priority over both $R$ and $U$. No new exchange is admitted while a debt remains outstanding. The model thus permits at most one service debt and guarantees its next-epoch settlement conditional on continued infrastructure and execution of the admitted rule. It does not guarantee that every urgent request can be accepted.","r office $k\\ne j$ explicitly volunteers its slot. The other two offices each receive one. The exchange creates a registered obligation\n\\[\no=(\\mathsf{id},\\mathsf{debtor}=j,\\mathsf{creditor}=k,\n\\mathsf{quantity}=1,\\mathsf{due}=e+1).\n\\]\nAt the next epoch the creditor receives two slots and the debtor none, with one slot for each remaining office. This repayment clause has priority over both $R$ and $U$. No new exchange is admitted while a debt remains outstanding. The model thus permits at most one service debt and guarantees its next-epoch settlement conditional on continued infrastructure and execution of the admitted rule. It does not guarantee that every urgent request can be accepted.","Amendments between $R$ and $U$ require three of the four registered offices to approve. This threshold is part of the supplied constitutional envelope. Every amendment must preserve already registered service debts. A model replacement transfers an office only through an authorized registry transition that retires the predecessor's active credential and links the successor to the same outstanding obligations. Neither a model fork nor an imported archive can perform that transition by itself.","\\begin{center}\n\\begin{tabularx}{\\linewidth}{@{}cP{.25\\linewidth}P{.19\\linewidth}X@{}}\n\\toprule\nEpoch & Admitted event & Allocation $(A,B,C,D)$ & Obligation record","\\midrule\n0 & Ordinary rule $R$ & $(1,1,1,1)$ & Empty.","[.35em]\n1 & Three offices adopt $U$; $A$ requests urgency and $B$ consents & $(2,0,1,1)$ & $A$ owes $B$ one slot at epoch 2.\\\\[.35em]\n2 & $A$ is replaced by an authorized successor; repayment takes precedence & $(0,2,1,1)$ & The same obligation is fulfilled, not erased.\\\\[.35em]\n3 & A proposed external grant would duplicate a slot token & $(1,1,1,1)$ & The proposal is rejected; no new entitlement is created.\\\\\n\\bottomrule\n\\end{tabularx}\n\\end{center}\n\nThese transitions are specified rather than discovered. The example is a miniature institutional realization, not a demonstration of autonomous formation. Its purpose is to make several different mathematical obligations visible in one system.\n\n\\subsection{What an institutional summary must retain}\nThe name of the current rule is insufficient state. Two records may both say $R$ while only one contains a debt due this epoch. Their correct next allocations differ. A summary that keeps the next allocation but omits the amendment threshold can also be inadequate: the same three votes may authorize different future rules under different const…","One possible factorization of a microstate is\n\\[\nX_t=(S_{1,t},\\ldots,S_{n,t},M_t,C_t,A_t,\\Theta_t),\n\\]\nwhere $S_i$ is local process state, $M$ durable storage, $C$ messages and channel state, $A$ artifacts, and $\\Theta$ the current configuration, including executable rules. These categories describe a storage and access organization. They need not be disjoint physical objects.","\\begin{definition}[Declared decomposition and access model]\\label{def:access}\nA decomposition specifies components and maps $O_i:\\X\\to\\mathcal O_i$ describing their accessible observations. A coalition $S$ has the permitted information $O_S(X)$, supplemented only by the transcripts, computation, and external queries explicitly allowed to that coalition.\n\\end{definition}","\\begin{definition}[Candidate macrostate]\\label{def:macrostate}\nA candidate macrostate is a surjection $\\pi:\\X\\to\\Z$. For a distribution $\\mu$ on $\\X$, its pushforward is\n\\[\n(\\push\\mu)(z)=\\sum_{x:\\pi(x)=z}\\mu(x).\n\\]\nThe fibre $\\pi^{-1}(z)$ is the set of implementations represented by $z$.\n\\end{definition}","An organization is always evaluated relative to a \\emph{contract}: permitted controls, target outputs, horizon, environment family, resource limits, and error tolerances. Let $\\mathcal T$ denote this contract. Claims such as ``the group is irreducible'' or ``the identity survived'' are incomplete without it. A state sufficient for tomorrow's scheduling decision may be inadequate for a later audit of who authorized that decision.","\\subsection{A relational certificate is a profile}\nA useful reporting profile is\n\\[\n\\mathcal C_{\\mathcal T}=(\\varepsilon_{\\rm pred},\\varepsilon_{\\rm dyn},\\varepsilon_{\\rm int},\n\\Delta_{\\rm coal},R_{\\rm repair},D_{\\rm lineage},G_{\\rm formation}).\n\\]\nIts entries report predictive error, dynamic closure error, intervention mismatch, coalition performance gaps, repair behavior, lineage evidence, and evidence about formation. Some entries may be unidentified. They should not be replaced by zero or hidden inside a favorable weighted average.","\\section{Relational information: access, synergy, and usefulness}\\label{sec:information}\nLet $A,B$ be independent fair bits and $Y=A\\oplus B$. Then\n\\[\nI(Y;A)=I(Y;B)=0,\\qquad I(Y;A,B)=1.\n\\]\nThis elementary example shows that joint observation may reveal information absent from each marginal observation. It does not show that the information is absent from the complete system, that a mysterious carrier has appeared, or that a protocol with ordinary messages cannot recover it.","A more operational measure uses decision loss. Given permitted information $O$ and loss $\\ell$, define the Bayes risk\n\\[\n\\mathcal R_\\ell(O)=\\inf_f\\E\\bigl[\\ell(f(O),Y)\\bigr].\n\\]\nFor a nonempty allowed family $\\mathcal A$ of proper coalitions, the gap\n\\begin{equation}\\label{eq:coalition}\n\\Delta_{\\mathcal A}=\\min_{S\\in\\mathcal A}\\mathcal R_\\ell(O_S)\n-\\mathcal R_\\ell(O_V)\n\\end{equation}\nexpresses an advantage over every coalition in that family. A strictly positive gap is relative to the target distribution, observation maps, and coalition family. It is not equivalent to any one general-purpose partial-information-decomposition statistic~\\cite{williams}.","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Deterministic quotient criterion]\\label{prop:det}\nFor maps $F_u:\\X\\to\\X$ and a surjection $\\pi:\\X\\to\\Z$, maps $\\overline F_u:\\Z\\to\\Z$ satisfying $\\pi F_u=\\overline F_u\\pi$ exist if and only if\n\\[\n\\pi(x)=\\pi(x')\\quad\\Longrightarrow\\quad\n\\pi(F_u(x))=\\pi(F_u(x'))\n\\]\nfor every $u,x,x'$. When they exist, they are unique.\n\\end{proposition}\n\\begin{proof}\nNecessity follows by applying $\\overline F_u$ to the common value $\\pi(x)$. For sufficiency, set $\\overline F_u(z)=\\pi(F_u(x))$ for any $x$ in the fibre of $z$. The condition makes this independent of the representative, and surjectivity gives uniqueness.\n\\end{proof}","begin{proposition}[Deterministic quotient criterion]\\label{prop:det}\nFor maps $F_u:\\X\\to\\X$ and a surjection $\\pi:\\X\\to\\Z$, maps $\\overline F_u:\\Z\\to\\Z$ satisfying $\\pi F_u=\\overline F_u\\pi$ exist if and only if\n\\[\n\\pi(x)=\\pi(x')\\quad\\Longrightarrow\\quad\n\\pi(F_u(x))=\\pi(F_u(x'))\n\\]\nfor every $u,x,x'$. When they exist, they are unique.\n\\end{proposition}\n\\begin{proof}\nNecessity follows by applying $\\overline F_u$ to the common value $\\pi(x)$. For sufficiency, set $\\overline F_u(z)=\\pi(F_u(x))$ for any $x$ in the fibre of $z$. The condition makes this independent of the representative, and surjectivity gives uniqueness.\n\\end{proof}","tient criterion]\\label{prop:det}\nFor maps $F_u:\\X\\to\\X$ and a surjection $\\pi:\\X\\to\\Z$, maps $\\overline F_u:\\Z\\to\\Z$ satisfying $\\pi F_u=\\overline F_u\\pi$ exist if and only if\n\\[\n\\pi(x)=\\pi(x')\\quad\\Longrightarrow\\quad\n\\pi(F_u(x))=\\pi(F_u(x'))\n\\]\nfor every $u,x,x'$. When they exist, they are unique.\n\\end{proposition}\n\\begin{proof}\nNecessity follows by applying $\\overline F_u$ to the common value $\\pi(x)$. For sufficiency, set $\\overline F_u(z)=\\pi(F_u(x))$ for any $x$ in the fibre of $z$. The condition makes this independent of the representative, and surjectivity gives uniqueness.\n\\end{proof}","}\nFor maps $F_u:\\X\\to\\X$ and a surjection $\\pi:\\X\\to\\Z$, maps $\\overline F_u:\\Z\\to\\Z$ satisfying $\\pi F_u=\\overline F_u\\pi$ exist if and only if\n\\[\n\\pi(x)=\\pi(x')\\quad\\Longrightarrow\\quad\n\\pi(F_u(x))=\\pi(F_u(x'))\n\\]\nfor every $u,x,x'$. When they exist, they are unique.\n\\end{proposition}\n\\begin{proof}\nNecessity follows by applying $\\overline F_u$ to the common value $\\pi(x)$. For sufficiency, set $\\overline F_u(z)=\\pi(F_u(x))$ for any $x$ in the fibre of $z$. The condition makes this independent of the representative, and surjectivity gives uniqueness.\n\\end{proof}","on $\\pi:\\X\\to\\Z$, maps $\\overline F_u:\\Z\\to\\Z$ satisfying $\\pi F_u=\\overline F_u\\pi$ exist if and only if\n\\[\n\\pi(x)=\\pi(x')\\quad\\Longrightarrow\\quad\n\\pi(F_u(x))=\\pi(F_u(x'))\n\\]\nfor every $u,x,x'$. When they exist, they are unique.\n\\end{proposition}\n\\begin{proof}\nNecessity follows by applying $\\overline F_u$ to the common value $\\pi(x)$. For sufficiency, set $\\overline F_u(z)=\\pi(F_u(x))$ for any $x$ in the fibre of $z$. The condition makes this independent of the representative, and surjectivity gives uniqueness.\n\\end{proof}","ps $\\overline F_u:\\Z\\to\\Z$ satisfying $\\pi F_u=\\overline F_u\\pi$ exist if and only if\n\\[\n\\pi(x)=\\pi(x')\\quad\\Longrightarrow\\quad\n\\pi(F_u(x))=\\pi(F_u(x'))\n\\]\nfor every $u,x,x'$. When they exist, they are unique.\n\\end{proposition}\n\\begin{proof}\nNecessity follows by applying $\\overline F_u$ to the common value $\\pi(x)$. For sufficiency, set $\\overline F_u(z)=\\pi(F_u(x))$ for any $x$ in the fibre of $z$. The condition makes this independent of the representative, and surjectivity gives uniqueness.\n\\end{proof}","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Controlled lumpability]\\label{prop:lump}\nA common kernel $\\overline K_u$ represents the projected one-step laws from every microstate if and only if, for all $z'$ and all $x,x'$ with $\\pi(x)=\\pi(x')$,\n\\begin{equation}\\label{eq:lump}\n\\sum_{w:\\pi(w)=z'}K_u(x,w)\n=\\sum_{w:\\pi(w)=z'}K_u(x',w).\n\\end{equation}\nUnder this condition, every macro-history policy $\\alpha_t(u\\mid Z_{0:t})$ induces the same projected process as the macro-model with initial law $\\push\\mu_0$. For outputs to agree as well, require $Q_u(x,\\cdot)$ to be constant on each fibre.\n\\end{proposition}\n\\begin{proof}\nThe common fibre value in~\\eqref{eq:lump} defines $\\overline K_u(z,z')$. Conditional on any macro-history and selected control, the microstate has some distribution supported on the current f","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Controlled lumpability]\\label{prop:lump}\nA common kernel $\\overline K_u$ represents the projected one-step laws from every microstate if and only if, for all $z'$ and all $x,x'$ with $\\pi(x)=\\pi(x')$,\n\\begin{equation}\\label{eq:lump}\n\\sum_{w:\\pi(w)=z'}K_u(x,w)\n=\\sum_{w:\\pi(w)=z'}K_u(x',w).\n\\end{equation}\nUnder this condition, every macro-history policy $\\alpha_t(u\\mid Z_{0:t})$ induces the same projected process as the macro-model with initial law $\\push\\mu_0$. For outputs to agree as well, require $Q_u(x,\\cdot)$ to be constant on each fibre.\n\\end{proposition}\n\\begin{proof}\nThe common fibre value in~\\eqref{eq:lump} defines $\\overline K_u(z,z')$. Conditional on any macro-history and selected control, the microstate has some distribution supported on the current fibre. Averaging identical projected rows leaves that common row unchanged. Induction gives","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Controlled lumpability]\\label{prop:lump}\nA common kernel $\\overline K_u$ represents the projected one-step laws from every microstate if and only if, for all $z'$ and all $x,x'$ with $\\pi(x)=\\pi(x')$,\n\\begin{equation}\\label{eq:lump}\n\\sum_{w:\\pi(w)=z'}K_u(x,w)\n=\\sum_{w:\\pi(w)=z'}K_u(x',w).\n\\end{equation}\nUnder this condition, every macro-history policy $\\alpha_t(u\\mid Z_{0:t})$ induces the same projected process as the macro-model with initial law $\\push\\mu_0$. For outputs to agree as well, require $Q_u(x,\\cdot)$ to be constant on each fibre.\n\\end{proposition}\n\\begin{proof}\nThe common fibre value in~\\eqref{eq:lump} defines $\\overline K_u(z,z')$. Conditional on any macro-history and selected control, the microstate has some distribution supported on the current fibre. Averaging identical projected rows leaves that common row unchanged. Induction gives equality of th","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Controlled lumpability]\\label{prop:lump}\nA common kernel $\\overline K_u$ represents the projected one-step laws from every microstate if and only if, for all $z'$ and all $x,x'$ with $\\pi(x)=\\pi(x')$,\n\\begin{equation}\\label{eq:lump}\n\\sum_{w:\\pi(w)=z'}K_u(x,w)\n=\\sum_{w:\\pi(w)=z'}K_u(x',w).\n\\end{equation}\nUnder this condition, every macro-history policy $\\alpha_t(u\\mid Z_{0:t})$ induces the same projected process as the macro-model with initial law $\\push\\mu_0$. For outputs to agree as well, require $Q_u(x,\\cdot)$ to be constant on each fibre.\n\\end{proposition}\n\\begin{proof}\nThe common fibre value in~\\eqref{eq:lump} defines $\\overline K_u(z,z')$. Conditional on any macro-history and selected control, the microstate has some distribution supported on the current fibre. Averaging identical projected rows leaves that common row unchanged. Induction gives equality of the macro-history laws.","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Controlled lumpability]\\label{prop:lump}\nA common kernel $\\overline K_u$ represents the projected one-step laws from every microstate if and only if, for all $z'$ and all $x,x'$ with $\\pi(x)=\\pi(x')$,\n\\begin{equation}\\label{eq:lump}\n\\sum_{w:\\pi(w)=z'}K_u(x,w)\n=\\sum_{w:\\pi(w)=z'}K_u(x',w).\n\\end{equation}\nUnder this condition, every macro-history policy $\\alpha_t(u\\mid Z_{0:t})$ induces the same projected process as the macro-model with initial law $\\push\\mu_0$. For outputs to agree as well, require $Q_u(x,\\cdot)$ to be constant on each fibre.\n\\end{proposition}\n\\begin{proof}\nThe common fibre value in~\\eqref{eq:lump} defines $\\overline K_u(z,z')$. Conditional on any macro-history and selected control, the microstate has some distribution supported on the current fibre. Averaging identical projected rows leaves that common row unchanged. Induction gives equality of the macro-history laws. Conversely, start from the point masses at $x$ and $x'$ and apply the same fixed control. A","eedspace{8\\baselineskip}\n\\begin{proposition}[Controlled lumpability]\\label{prop:lump}\nA common kernel $\\overline K_u$ represents the projected one-step laws from every microstate if and only if, for all $z'$ and all $x,x'$ with $\\pi(x)=\\pi(x')$,\n\\begin{equation}\\label{eq:lump}\n\\sum_{w:\\pi(w)=z'}K_u(x,w)\n=\\sum_{w:\\pi(w)=z'}K_u(x',w).\n\\end{equation}\nUnder this condition, every macro-history policy $\\alpha_t(u\\mid Z_{0:t})$ induces the same projected process as the macro-model with initial law $\\push\\mu_0$. For outputs to agree as well, require $Q_u(x,\\cdot)$ to be constant on each fibre.\n\\end{proposition}\n\\begin{proof}\nThe common fibre value in~\\eqref{eq:lump} defines $\\overline K_u(z,z')$. Conditional on any macro-history and selected control, the microstate has some distribution supported on the current fibre. Averaging identical projected rows leaves that common row unchanged. Induction gives equality of the macro-history laws. Conversely, start from the point masses at $x$ and $x'$ and apply the same fixed control. A common one-step macro-kernel forces~\\eqref{eq:lump}. The output s…","rnel $\\overline K_u$ represents the projected one-step laws from every microstate if and only if, for all $z'$ and all $x,x'$ with $\\pi(x)=\\pi(x')$,\n\\begin{equation}\\label{eq:lump}\n\\sum_{w:\\pi(w)=z'}K_u(x,w)\n=\\sum_{w:\\pi(w)=z'}K_u(x',w).\n\\end{equation}\nUnder this condition, every macro-history policy $\\alpha_t(u\\mid Z_{0:t})$ induces the same projected process as the macro-model with initial law $\\push\\mu_0$. For outputs to agree as well, require $Q_u(x,\\cdot)$ to be constant on each fibre.\n\\end{proposition}\n\\begin{proof}\nThe common fibre value in~\\eqref{eq:lump} defines $\\overline K_u(z,z')$. Conditional on any macro-history and selected control, the microstate has some distribution supported on the current fibre. Averaging identical projected rows leaves that common row unchanged. Induction gives equality of the macro-history laws. Conversely, start from the point masses at $x$ and $x'$ and apply the same fixed control. A common one-step macro-kernel forces~\\eqref{eq:lump}. The output statement follows identically.\n\\end{proof}","ep laws from every microstate if and only if, for all $z'$ and all $x,x'$ with $\\pi(x)=\\pi(x')$,\n\\begin{equation}\\label{eq:lump}\n\\sum_{w:\\pi(w)=z'}K_u(x,w)\n=\\sum_{w:\\pi(w)=z'}K_u(x',w).\n\\end{equation}\nUnder this condition, every macro-history policy $\\alpha_t(u\\mid Z_{0:t})$ induces the same projected process as the macro-model with initial law $\\push\\mu_0$. For outputs to agree as well, require $Q_u(x,\\cdot)$ to be constant on each fibre.\n\\end{proposition}\n\\begin{proof}\nThe common fibre value in~\\eqref{eq:lump} defines $\\overline K_u(z,z')$. Conditional on any macro-history and selected control, the microstate has some distribution supported on the current fibre. Averaging identical projected rows leaves that common row unchanged. Induction gives equality of the macro-history laws. Conversely, start from the point masses at $x$ and $x'$ and apply the same fixed control. A common one-step macro-kernel forces~\\eqref{eq:lump}. The output statement follows identically.\n\\end{proof}","}\n\\sum_{w:\\pi(w)=z'}K_u(x,w)\n=\\sum_{w:\\pi(w)=z'}K_u(x',w).\n\\end{equation}\nUnder this condition, every macro-history policy $\\alpha_t(u\\mid Z_{0:t})$ induces the same projected process as the macro-model with initial law $\\push\\mu_0$. For outputs to agree as well, require $Q_u(x,\\cdot)$ to be constant on each fibre.\n\\end{proposition}\n\\begin{proof}\nThe common fibre value in~\\eqref{eq:lump} defines $\\overline K_u(z,z')$. Conditional on any macro-history and selected control, the microstate has some distribution supported on the current fibre. Averaging identical projected rows leaves that common row unchanged. Induction gives equality of the macro-history laws. Conversely, start from the point masses at $x$ and $x'$ and apply the same fixed control. A common one-step macro-kernel forces~\\eqref{eq:lump}. The output statement follows identically.\n\\end{proof}","ibre.\n\\end{proposition}\n\\begin{proof}\nThe common fibre value in~\\eqref{eq:lump} defines $\\overline K_u(z,z')$. Conditional on any macro-history and selected control, the microstate has some distribution supported on the current fibre. Averaging identical projected rows leaves that common row unchanged. Induction gives equality of the macro-history laws. Conversely, start from the point masses at $x$ and $x'$ and apply the same fixed control. A common one-step macro-kernel forces~\\eqref{eq:lump}. The output statement follows identically.\n\\end{proof}","nd{proposition}\n\\begin{proof}\nThe common fibre value in~\\eqref{eq:lump} defines $\\overline K_u(z,z')$. Conditional on any macro-history and selected control, the microstate has some distribution supported on the current fibre. Averaging identical projected rows leaves that common row unchanged. Induction gives equality of the macro-history laws. Conversely, start from the point masses at $x$ and $x'$ and apply the same fixed control. A common one-step macro-kernel forces~\\eqref{eq:lump}. The output statement follows identically.\n\\end{proof}","\\begin{counterexample}[Deterministic microstate, non-Markov macrostate]\\label{ex:cycle}\nLet $X_{t+1}=X_t+1\\pmod 3$ with uniform initial distribution. Set $\\pi(0)=\\pi(1)=a$ and $\\pi(2)=b$. Stationarity gives $\\Prob(Z_{t+1}=b\\mid Z_t=a)=1/2$. Yet\n\\[\n\\Prob(Z_{t+1}=b\\mid Z_t=a,Z_{t-1}=b)=0,\n\\]\nwhereas the same probability conditional on $Z_t=a,Z_{t-1}=a$ is $1$. Thus the apparent randomness comes with memory: the one-step marginal does not define a valid autonomous first-order Markov model.\n\\end{counterexample}","A stochastic macro-description is therefore not automatic. It depends on an initial ensemble and on whether the retained state captures the relevant history. One may enlarge $Z_t$ with memory, use a partially observed model, or accept a measured approximation error.","\\subsection{Finite-horizon error accounting}\nFor finite distributions, $\\TV(\\mu,\\nu)=\\tfrac12\\sum_z|\\mu(z)-\\nu(z)|$. Suppose candidate kernels satisfy\n\\begin{equation}\\label{eq:eps}\n\\sup_{x,u}\\TV\\bigl(\\push K_u(x,\\cdot),\\overline K_u(\\pi(x),\\cdot)\\bigr)\n\\leq\\varepsilon.\n\\end{equation}\nThis uniform condition is stronger than a small average error on the trajectories seen during training.","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Approximate closure over time]\\label{prop:time}\nUnder~\\eqref{eq:eps}, let the actual and reduced processes use the same predeclared open-loop control sequence. If their initial macro-laws are within $e_0$ in total variation, then at time $t$ they are within\n\\[\ne_t\\leq\\min\\{1,e_0+t\\varepsilon\\}.\n\\]\nIf each $\\overline K_u$ contracts total variation by at most $\\kappa<1$, then\n\\begin{equation}\\label{eq:contract}\ne_t\\leq\\kappa^t e_0+\\varepsilon\\frac{1-\\kappa^t}{1-\\kappa}.\n\\end{equation}\nWith matched macro-history policies, the weaker path-law bound $\\min\\{1,e_0+t\\varepsilon\\}$ also holds, but the contraction claim needs a separate closed-loop contraction assumption.\n\\end{proposition}\n\\begin{proof}\nAveraging~\\eqref{eq:eps} over the actual microstate law shows that its next projected law is within $\\varepsilon$ of the current projected law evolved by $\\overline K_u$. Kernel nonexpansiveness gives","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Approximate closure over time]\\label{prop:time}\nUnder~\\eqref{eq:eps}, let the actual and reduced processes use the same predeclared open-loop control sequence. If their initial macro-laws are within $e_0$ in total variation, then at time $t$ they are within\n\\[\ne_t\\leq\\min\\{1,e_0+t\\varepsilon\\}.\n\\]\nIf each $\\overline K_u$ contracts total variation by at most $\\kappa<1$, then\n\\begin{equation}\\label{eq:contract}\ne_t\\leq\\kappa^t e_0+\\varepsilon\\frac{1-\\kappa^t}{1-\\kappa}.\n\\end{equation}\nWith matched macro-history policies, the weaker path-law bound $\\min\\{1,e_0+t\\varepsilon\\}$ also holds, but the contraction claim needs a separate closed-loop contraction assumption.\n\\end{proposition}\n\\begin{proof}\nAveraging~\\eqref{eq:eps} over the actual microstate law shows that its next projected law is within $\\varepsilon$ of the current projected law evolved by $\\overline K_u$. Kernel nonexpansiveness gives $e_{t+1}\\leq\\varepsilon+e_t$. Under","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Approximate closure over time]\\label{prop:time}\nUnder~\\eqref{eq:eps}, let the actual and reduced processes use the same predeclared open-loop control sequence. If their initial macro-laws are within $e_0$ in total variation, then at time $t$ they are within\n\\[\ne_t\\leq\\min\\{1,e_0+t\\varepsilon\\}.\n\\]\nIf each $\\overline K_u$ contracts total variation by at most $\\kappa<1$, then\n\\begin{equation}\\label{eq:contract}\ne_t\\leq\\kappa^t e_0+\\varepsilon\\frac{1-\\kappa^t}{1-\\kappa}.\n\\end{equation}\nWith matched macro-history policies, the weaker path-law bound $\\min\\{1,e_0+t\\varepsilon\\}$ also holds, but the contraction claim needs a separate closed-loop contraction assumption.\n\\end{proposition}\n\\begin{proof}\nAveraging~\\eqref{eq:eps} over the actual microstate law shows that its next projected law is within $\\varepsilon$ of the current projected law evolved by $\\overline K_u$. Kernel nonexpansiveness gives $e_{t+1}\\leq\\varepsilon+e_t$. Under contraction it gives $e_{t+1}\\leq\\varepsilon+\\kappa e_t$","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Approximate closure over time]\\label{prop:time}\nUnder~\\eqref{eq:eps}, let the actual and reduced processes use the same predeclared open-loop control sequence. If their initial macro-laws are within $e_0$ in total variation, then at time $t$ they are within\n\\[\ne_t\\leq\\min\\{1,e_0+t\\varepsilon\\}.\n\\]\nIf each $\\overline K_u$ contracts total variation by at most $\\kappa<1$, then\n\\begin{equation}\\label{eq:contract}\ne_t\\leq\\kappa^t e_0+\\varepsilon\\frac{1-\\kappa^t}{1-\\kappa}.\n\\end{equation}\nWith matched macro-history policies, the weaker path-law bound $\\min\\{1,e_0+t\\varepsilon\\}$ also holds, but the contraction claim needs a separate closed-loop contraction assumption.\n\\end{proposition}\n\\begin{proof}\nAveraging~\\eqref{eq:eps} over the actual microstate law shows that its next projected law is within $\\varepsilon$ of the current projected law evolved by $\\overline K_u$. Kernel nonexpansiveness gives $e_{t+1}\\leq\\varepsilon+e_t$. Under contraction it gives $e_{t+1}\\leq\\varepsilon+\\kappa e_t$; iterate. For history po","ce{8\\baselineskip}\n\\begin{proposition}[Approximate closure over time]\\label{prop:time}\nUnder~\\eqref{eq:eps}, let the actual and reduced processes use the same predeclared open-loop control sequence. If their initial macro-laws are within $e_0$ in total variation, then at time $t$ they are within\n\\[\ne_t\\leq\\min\\{1,e_0+t\\varepsilon\\}.\n\\]\nIf each $\\overline K_u$ contracts total variation by at most $\\kappa<1$, then\n\\begin{equation}\\label{eq:contract}\ne_t\\leq\\kappa^t e_0+\\varepsilon\\frac{1-\\kappa^t}{1-\\kappa}.\n\\end{equation}\nWith matched macro-history policies, the weaker path-law bound $\\min\\{1,e_0+t\\varepsilon\\}$ also holds, but the contraction claim needs a separate closed-loop contraction assumption.\n\\end{proposition}\n\\begin{proof}\nAveraging~\\eqref{eq:eps} over the actual microstate law shows that its next projected law is within $\\varepsilon$ of the current projected law evolved by $\\overline K_u$. Kernel nonexpansiveness gives $e_{t+1}\\leq\\varepsilon+e_t$. Under contraction it gives $e_{t+1}\\leq\\varepsilon+\\kappa e_t$; iterate. For history policies, couple the histories while they …","ition}[Approximate closure over time]\\label{prop:time}\nUnder~\\eqref{eq:eps}, let the actual and reduced processes use the same predeclared open-loop control sequence. If their initial macro-laws are within $e_0$ in total variation, then at time $t$ they are within\n\\[\ne_t\\leq\\min\\{1,e_0+t\\varepsilon\\}.\n\\]\nIf each $\\overline K_u$ contracts total variation by at most $\\kappa<1$, then\n\\begin{equation}\\label{eq:contract}\ne_t\\leq\\kappa^t e_0+\\varepsilon\\frac{1-\\kappa^t}{1-\\kappa}.\n\\end{equation}\nWith matched macro-history policies, the weaker path-law bound $\\min\\{1,e_0+t\\varepsilon\\}$ also holds, but the contraction claim needs a separate closed-loop contraction assumption.\n\\end{proposition}\n\\begin{proof}\nAveraging~\\eqref{eq:eps} over the actual microstate law shows that its next projected law is within $\\varepsilon$ of the current projected law evolved by $\\overline K_u$. Kernel nonexpansiveness gives $e_{t+1}\\leq\\varepsilon+e_t$. Under contraction it gives $e_{t+1}\\leq\\varepsilon+\\kappa e_t$; iterate. For history policies, couple the histories while they agree. The controls can then be …","quence. If their initial macro-laws are within $e_0$ in total variation, then at time $t$ they are within\n\\[\ne_t\\leq\\min\\{1,e_0+t\\varepsilon\\}.\n\\]\nIf each $\\overline K_u$ contracts total variation by at most $\\kappa<1$, then\n\\begin{equation}\\label{eq:contract}\ne_t\\leq\\kappa^t e_0+\\varepsilon\\frac{1-\\kappa^t}{1-\\kappa}.\n\\end{equation}\nWith matched macro-history policies, the weaker path-law bound $\\min\\{1,e_0+t\\varepsilon\\}$ also holds, but the contraction claim needs a separate closed-loop contraction assumption.\n\\end{proposition}\n\\begin{proof}\nAveraging~\\eqref{eq:eps} over the actual microstate law shows that its next projected law is within $\\varepsilon$ of the current projected law evolved by $\\overline K_u$. Kernel nonexpansiveness gives $e_{t+1}\\leq\\varepsilon+e_t$. Under contraction it gives $e_{t+1}\\leq\\varepsilon+\\kappa e_t$; iterate. For history policies, couple the histories while they agree. The controls can then be coupled to agree, and the next macrostate fails to couple with probability at most $\\varepsilon$. A union bound gives the path-law result.\n\\end{proof}","ontract}\ne_t\\leq\\kappa^t e_0+\\varepsilon\\frac{1-\\kappa^t}{1-\\kappa}.\n\\end{equation}\nWith matched macro-history policies, the weaker path-law bound $\\min\\{1,e_0+t\\varepsilon\\}$ also holds, but the contraction claim needs a separate closed-loop contraction assumption.\n\\end{proposition}\n\\begin{proof}\nAveraging~\\eqref{eq:eps} over the actual microstate law shows that its next projected law is within $\\varepsilon$ of the current projected law evolved by $\\overline K_u$. Kernel nonexpansiveness gives $e_{t+1}\\leq\\varepsilon+e_t$. Under contraction it gives $e_{t+1}\\leq\\varepsilon+\\kappa e_t$; iterate. For history policies, couple the histories while they agree. The controls can then be coupled to agree, and the next macrostate fails to couple with probability at most $\\varepsilon$. A union bound gives the path-law result.\n\\end{proof}","^t}{1-\\kappa}.\n\\end{equation}\nWith matched macro-history policies, the weaker path-law bound $\\min\\{1,e_0+t\\varepsilon\\}$ also holds, but the contraction claim needs a separate closed-loop contraction assumption.\n\\end{proposition}\n\\begin{proof}\nAveraging~\\eqref{eq:eps} over the actual microstate law shows that its next projected law is within $\\varepsilon$ of the current projected law evolved by $\\overline K_u$. Kernel nonexpansiveness gives $e_{t+1}\\leq\\varepsilon+e_t$. Under contraction it gives $e_{t+1}\\leq\\varepsilon+\\kappa e_t$; iterate. For history policies, couple the histories while they agree. The controls can then be coupled to agree, and the next macrostate fails to couple with probability at most $\\varepsilon$. A union bound gives the path-law result.\n\\end{proof}","o-history policies, the weaker path-law bound $\\min\\{1,e_0+t\\varepsilon\\}$ also holds, but the contraction claim needs a separate closed-loop contraction assumption.\n\\end{proposition}\n\\begin{proof}\nAveraging~\\eqref{eq:eps} over the actual microstate law shows that its next projected law is within $\\varepsilon$ of the current projected law evolved by $\\overline K_u$. Kernel nonexpansiveness gives $e_{t+1}\\leq\\varepsilon+e_t$. Under contraction it gives $e_{t+1}\\leq\\varepsilon+\\kappa e_t$; iterate. For history policies, couple the histories while they agree. The controls can then be coupled to agree, and the next macrostate fails to couple with probability at most $\\varepsilon$. A union bound gives the path-law result.\n\\end{proof}","0+t\\varepsilon\\}$ also holds, but the contraction claim needs a separate closed-loop contraction assumption.\n\\end{proposition}\n\\begin{proof}\nAveraging~\\eqref{eq:eps} over the actual microstate law shows that its next projected law is within $\\varepsilon$ of the current projected law evolved by $\\overline K_u$. Kernel nonexpansiveness gives $e_{t+1}\\leq\\varepsilon+e_t$. Under contraction it gives $e_{t+1}\\leq\\varepsilon+\\kappa e_t$; iterate. For history policies, couple the histories while they agree. The controls can then be coupled to agree, and the next macrostate fails to couple with probability at most $\\varepsilon$. A union bound gives the path-law result.\n\\end{proof}","t projected law is within $\\varepsilon$ of the current projected law evolved by $\\overline K_u$. Kernel nonexpansiveness gives $e_{t+1}\\leq\\varepsilon+e_t$. Under contraction it gives $e_{t+1}\\leq\\varepsilon+\\kappa e_t$; iterate. For history policies, couple the histories while they agree. The controls can then be coupled to agree, and the next macrostate fails to couple with probability at most $\\varepsilon$. A union bound gives the path-law result.\n\\end{proof}","\\subsection{Predictive closure has a target and a distribution}\nFor a fixed future target $Y^+$ and data-generating policy, a predictive statistic satisfies\n\\[\nI(Y^+;\\Hist_t\\mid Z_t)=0.\n\\]\nApproximate versions bound this residual information or, more directly, the excess predictive loss on held-out data. This is related to predictive-state constructions~\\cite{shalizi}. It is not equivalent to uniform controlled lumpability: it may hold for one observational distribution while failing after intervention or under a new policy.","\\section{Causal interventions require implementations}\\label{sec:causal}\nIf $Z=\\pi(X)$, one cannot generally change $Z$ while literally holding $X$ fixed. The expression $do(Z=z')$ needs a physical or computational implementation. Otherwise it names a desired effect, not an intervention.","For a feasible current microstate $x$ and target $z'$, let $\\Lambda(x,z')$ be a declared nonempty family of admissible reset distributions on $\\X$, each supported on $\\pi^{-1}(z')$. Infeasible targets are excluded rather than assigned a fictitious reset. A reset might update a shared record, transplant a latent component, or reconstruct distributed shares. Its permissions, collateral effects, and retained private state belong in the intervention specification.","Given a future outcome experiment, write $P_\\lambda$ for the resulting law of $Y^+$ under reset $\\lambda$. Define implementation ambiguity by\n\\[\n\\eta(x,z')=\\sup_{\\lambda,\\lambda'\\in\\Lambda(x,z')}\n\\TV(P_\\lambda,P_{\\lambda'}).\n\\]\nA small ambiguity means different allowed implementations of the same macro-assignment have similar consequences. Large ambiguity means the macro-intervention is not sufficiently specified.","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Implementation dependence]\\label{prop:lift}\nIf every $P_\\lambda$ is within $\\varepsilon$ of a proposed macro-intervention law $P^\\star_{z'}$, then $\\eta(x,z')\\leq2\\varepsilon$. Conversely, if two admissible implementations are distance $\\eta$ apart, no single law can approximate both within less than $\\eta/2$.\n\\end{proposition}\n\\begin{proof}\nBoth claims follow from the triangle inequality for total variation.\n\\end{proof}","\\begin{example}[Two meanings of the same macro-reset]\nLet $X=(z,h)$ and let the next outcome be $Y=z\\oplus h$. The macrostate retains only $z$. Resetting to $(z',0)$ and resetting to $(z',1)$ both implement $Z=z'$, but their outcome laws are disjoint. A causal model of $Z$ alone must either restrict the reset convention or acknowledge the missing variable.\n\\end{example}","For a family $\\mathcal T$ of finite continuation experiments, define exact behavioral equivalence by\n\\[\nx\\equiv_{\\mathcal T}x'\\quad\\Longleftrightarrow\\quad\n\\Law_x(Y^+\\mid\\tau)=\\Law_{x'}(Y^+\\mid\\tau)\n\\quad\\text{for every }\\tau\\in\\mathcal T.\n\\]\nEquality of these indexed laws is reflexive, symmetric, and transitive. It therefore defines a quotient. This equivalence is relative to the chosen experiments. It does not by itself equal bisimulation, and it says nothing about untested interventions or provenance.","For approximate comparison, use the pseudometric\n\\[\nd_{\\mathcal T}(x,x')=\\sup_{\\tau\\in\\mathcal T}\n\\TV\\bigl(\\Law_x(Y^+\\mid\\tau),\\Law_{x'}(Y^+\\mid\\tau)\\bigr).\n\\]\nA finite test suite may make distinct implementations distance zero. That is indistinguishability under those tests, not universal sameness.","\\begin{counterexample}[Tolerance is not an equivalence relation]\\label{ex:identity}\nConsider three implementations producing a Bernoulli output with parameters $0$, $0.4$, and $0.8$. Their pairwise total-variation distances are $0.4$, $0.4$, and $0.8$. With tolerance $0.5$, the first resembles the second and the second resembles the third, while the first does not resemble the third.\n\\end{counterexample}","on}[Behavior alone does not identify implementation]\\label{prop:identifiability}\nIf two realizations induce the same distribution over every transcript available to an evaluator's permitted tests, then every decision rule based only on those transcripts has the same output distribution under the two realizations. With equal prior probability, no such rule can distinguish them with accuracy above $1/2$.\n\\end{proposition}\n\\begin{proof}\nThe evaluator's decision is a possibly randomized function of the transcript. Applying the same stochastic function to equal transcript laws gives equal decision laws. Under equal priors, any preference for one realization is offset by the identical preference when the other is present.\n\\end{proof}","\\subsection{Memory lower bounds from distinguishable histories}\nFix a deterministic exact predictor for a family of future input continuations. Call two past histories equivalent when they require the same output sequence for every permitted continuation. Let $N$ be the number of equivalence classes among the histories under consideration.","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Exact finite-memory lower bound]\\label{prop:memory}\nEvery deterministic summary that supports exact continuation on these histories requires at least $N$ distinct states, hence at least $\\lceil\\log_2N\\rceil$ fixed-length bits. If the permitted continuation family is closed under prefixing and the history equivalence is a transition congruence, the quotient classes themselves provide an exact state representation.\n\\end{proposition}\n\\begin{proof}\nIf a summary assigns the same state to two inequivalent histories, some permitted continuation requires different outputs from that common state, contradicting determinism and exactness. This proves the lower bound by the pigeonhole principle. Under the congruence assumption, appending an input determines the next equivalence class independently of the representative, giving a well-defined quotient u","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Exact finite-memory lower bound]\\label{prop:memory}\nEvery deterministic summary that supports exact continuation on these histories requires at least $N$ distinct states, hence at least $\\lceil\\log_2N\\rceil$ fixed-length bits. If the permitted continuation family is closed under prefixing and the history equivalence is a transition congruence, the quotient classes themselves provide an exact state representation.\n\\end{proposition}\n\\begin{proof}\nIf a summary assigns the same state to two inequivalent histories, some permitted continuation requires different outputs from that common state, contradicting determinism and exactness. This proves the lower bound by the pigeonhole principle. Under the congruence assumption, appending an input determines the next equivalence class independently of the representative, giving a well-defined quotient update.\n\\end{proof}","\\subsection{Erasure resilience is not arbitrary error correction}\nLet an organizational state $z$ range over a finite set with at least two elements and be encoded as $E(z)=(E_1(z),\\ldots,E_n(z))$. Define the block distance\n\\[\nd_E=\\min_{z\\ne z'}\\abs{\\{i:E_i(z)\\ne E_i(z')\\}}.\n\\]","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Exact reconstruction after erasure]\\label{prop:erasure}\nFor an integer $0\\leq k\\leq n$, every set of at most $k$ erased components can be tolerated with exact reconstruction if and only if $d_E>k$.\n\\end{proposition}\n\\begin{proof}\nIf $d_E>k$, two distinct codewords disagree outside any erased set of size at most $k$, so the surviving observations identify the state uniquely. If $d_E\\leq k$, erase the coordinates on which a minimizing pair differs. The surviving observations then coincide, making reconstruction impossible.\n\\end{proof}","begin{proposition}[Exact reconstruction after erasure]\\label{prop:erasure}\nFor an integer $0\\leq k\\leq n$, every set of at most $k$ erased components can be tolerated with exact reconstruction if and only if $d_E>k$.\n\\end{proposition}\n\\begin{proof}\nIf $d_E>k$, two distinct codewords disagree outside any erased set of size at most $k$, so the surviving observations identify the state uniquely. If $d_E\\leq k$, erase the coordinates on which a minimizing pair differs. The surviving observations then coincide, making reconstruction impossible.\n\\end{proof}","For $z=(p,q)\\in\\Ftwo^2$, the encoding $(p,q,p\\oplus q)$ has distance two. Any two components reconstruct the state, and no one component reconstructs all of it. It tolerates one \\emph{known erasure}. It does not correct an arbitrary one-component corruption at an unknown location. Confusing these fault models overstates robustness.","\\subsection{Repair needs a causal and temporal test}\nLet $e_t\\geq0$ measure deviation from an acceptable organization after accounting for legitimate changes in task state. Suppose a repair controller ensures\n\\[\ne_{t+1}\\leq a_t e_t+b_t,\n\\]\nwhere $a_t$ measures retained deviation and $b_t$ covers new disturbance and model mismatch.","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Repair budget]\\label{prop:repair}\nIf $0\\leq a_t\\leq\\bar a<1$ and $0\\leq b_t\\leq\\bar b$, then\n\\[\ne_t\\leq \\bar a^t e_0+\\bar b\\frac{1-\\bar a^t}{1-\\bar a}.\n\\]\nMore generally, for nonnegative $a_t,b_t$ satisfying the stated recurrence,\n\\[\ne_T\\leq e_0\\prod_{t=0}^{T-1}a_t+\n\\sum_{j=0}^{T-1}b_j\\prod_{t=j+1}^{T-1}a_t.\n\\]\n\\end{proposition}\n\\begin{proof}\nRepeated substitution gives the product--sum formula. Uniform bounds reduce the sum to a geometric series.\n\\end{proof}","\\begin{counterexample}[Perfect coherence by erasing everything]\\label{ex:zerocollapse}\nLet acceptable states occupy a linear subspace $W$, and measure only distance to $W$. The update $F(x)=0$ attains zero coherence error immediately but destroys every distinction among encoded states. A coherence measure alone cannot certify memory preservation or identity.\n\\end{counterexample}","\\section{Hierarchy, gluing, and the limits of flattening}\\label{sec:hierarchy}\nA lower-level organization can serve as a component at the next level when it exports a sufficient interface. That interface must describe not only a state but also the operations that are permitted on it, their outcome semantics, and their implementation error. A useful interface certificate is\n\\[\n\\mathsf{Int}=(\\Z,\\U,\\overline K,\\overline Q,\\Lambda,\n\\varepsilon_{\\rm dyn},\\varepsilon_{\\rm int},\\mathsf{permissions}).\n\\]\nThis tuple is a design proposal. It prevents a higher-level controller from treating a reliable read-only summary as though it were an independently writable agent.","\\subsection{Composition of dynamic abstractions}\nSuppose $\\pi:\\X\\to\\Z$ and $\\psi:\\Z\\to\\mathcal W$ are surjections and, for the same control family,\n\\[\n\\TV(\\push K_u(x,\\cdot),\\overline K_u(\\pi x,\\cdot))\\leq\\varepsilon_1,\n\\]\n\\[\n\\TV(\\psi_{\\#}\\overline K_u(z,\\cdot),\\widehat K_u(\\psi z,\\cdot))\\leq\\varepsilon_2.\n\\]","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Compositional one-step closure]\\label{prop:composition}\nThe composite abstraction $\\psi\\pi$ satisfies\n\\[\n\\TV\\bigl((\\psi\\pi)_{\\#}K_u(x,\\cdot),\n\\widehat K_u(\\psi\\pi x,\\cdot)\\bigr)\n\\leq\\varepsilon_1+\\varepsilon_2.\n\\]\nFor $L$ levels, the one-step defect is at most $\\sum_{j=1}^L\\varepsilon_j$. In particular, exact abstractions compose exactly.\n\\end{proposition}\n\\begin{proof}\nInsert $\\psi_{\\#}\\overline K_u(\\pi x,\\cdot)$, use the triangle inequality, and use nonexpansiveness of total variation under deterministic pushforward. Induction gives the multilevel result.\n\\end{proof}","begin{proposition}[Compositional one-step closure]\\label{prop:composition}\nThe composite abstraction $\\psi\\pi$ satisfies\n\\[\n\\TV\\bigl((\\psi\\pi)_{\\#}K_u(x,\\cdot),\n\\widehat K_u(\\psi\\pi x,\\cdot)\\bigr)\n\\leq\\varepsilon_1+\\varepsilon_2.\n\\]\nFor $L$ levels, the one-step defect is at most $\\sum_{j=1}^L\\varepsilon_j$. In particular, exact abstractions compose exactly.\n\\end{proposition}\n\\begin{proof}\nInsert $\\psi_{\\#}\\overline K_u(\\pi x,\\cdot)$, use the triangle inequality, and use nonexpansiveness of total variation under deterministic pushforward. Induction gives the multilevel result.\n\\end{proof}","The same argument applies separately to output kernels. Combining this proposition with Proposition~\\ref{prop:time} yields a finite-horizon bound of $e_0+t\\sum_j\\varepsilon_j$, capped at one, under the corresponding controls. This elementary estimate belongs to the broader subject of compositional abstraction error~\\cite{rischel}. It does not establish global causal closure unless the intervention implementations also compose compatibly.","\\subsection{Structural gluing is a different question}\nSuppose each subsystem $i$ has local state space $W_i$ and each overlap has restriction maps $r_{ij}^i$ and $r_{ij}^j$. The compatible families form\n\\[\nW_{\\rm glue}=\\{(w_i):r_{ij}^i(w_i)=r_{ij}^j(w_j)\\text{ on every declared overlap}\\}.\n\\]\nFor an edge-complete cover of a fixed diagram, compatible local sections can give another presentation of its global sections. These compatibility conditions follow the elementary logic of gluing local descriptions into a shared global state.","\\subsection{An honest complexity separation}\nConsider $n=2^h$ input bits with parity as the target and two-input XOR gates. A balanced tree computes the target with $n-1$ gates and depth $h$. Any fan-in-two circuit output at depth $d$ can depend on at most $2^d$ input bits, so depth at least $\\lceil\\log_2n\\rceil$ is necessary. A single sequential accumulator uses $n-1$ updates.","\\Needspace{8\\baselineskip}\n\\begin{proposition}[Symmetry lock for identical deterministic agents]\\label{prop:symmetry}\nSuppose a deterministic joint update $F$ is equivariant under permutations of the agent labels and the initial joint state and all subsequent inputs are permutation-invariant. Then the joint state remains permutation-invariant at every time.\n\\end{proposition}\n\\begin{proof}\nIf $gX=X$ for every label permutation $g$, equivariance gives $gF(X)=F(gX)=F(X)$. Apply this at every step with invariant inputs.\n\\end{proof}","in{proposition}[Symmetry lock for identical deterministic agents]\\label{prop:symmetry}\nSuppose a deterministic joint update $F$ is equivariant under permutations of the agent labels and the initial joint state and all subsequent inputs are permutation-invariant. Then the joint state remains permutation-invariant at every time.\n\\end{proposition}\n\\begin{proof}\nIf $gX=X$ for every label permutation $g$, equivariance gives $gF(X)=F(gX)=F(X)$. Apply this at every step with invariant inputs.\n\\end{proof}","lock for identical deterministic agents]\\label{prop:symmetry}\nSuppose a deterministic joint update $F$ is equivariant under permutations of the agent labels and the initial joint state and all subsequent inputs are permutation-invariant. Then the joint state remains permutation-invariant at every time.\n\\end{proposition}\n\\begin{proof}\nIf $gX=X$ for every label permutation $g$, equivariance gives $gF(X)=F(gX)=F(X)$. Apply this at every step with invariant inputs.\n\\end{proof}","\\begin{definition}[Endogenous institutional formation]\\label{def:endogenous}\nLet $D$ record the rules, affordances, and permissions fixed by the designer and let $I_t$ be the institutional state. Formation is \\emph{endogenous relative to that family} when interactions among participating decision centers make a causal difference to the content, adoption, revision, or enforcement of $I_t$ beyond what is fixed by $D$. Its strength may be measured by an explicitly defined counterfactual effect on those institutional observables, not by an assumed universal emergence score. The definition does not equate endogenous formation with creation from no supplied substrate.\n\\end{definition}","n}[Endogenous institutional formation]\\label{def:endogenous}\nLet $D$ record the rules, affordances, and permissions fixed by the designer and let $I_t$ be the institutional state. Formation is \\emph{endogenous relative to that family} when interactions among participating decision centers make a causal difference to the content, adoption, revision, or enforcement of $I_t$ beyond what is fixed by $D$. Its strength may be measured by an explicitly defined counterfactual effect on those institutional observables, not by an assumed universal emergence score. The definition does not equate endogenous formation with creation from no supplied substrate.\n\\end{definition}","To formalize an operative institution, augment the microstate of Section~\\ref{sec:model} with a distinguished component $I_t$. In a finite setting we may describe it as\n\\begin{equation}\\label{eq:institutional-state}\nI_t=(N_t,P_t,E_t,A_t,L_t),\n\\end{equation}\nwhere $N$ specifies norms and role obligations, $P$ permissions and capabilities, $E$ enforcement and conflict procedures, $A$ admissible amendments, and $L$ records of decisions and their provenance. The components need not be physically stored together, and their representation is not unique. What matters is their effect on the transition law.","an operative institution, augment the microstate of Section~\\ref{sec:model} with a distinguished component $I_t$. In a finite setting we may describe it as\n\\begin{equation}\\label{eq:institutional-state}\nI_t=(N_t,P_t,E_t,A_t,L_t),\n\\end{equation}\nwhere $N$ specifies norms and role obligations, $P$ permissions and capabilities, $E$ enforcement and conflict procedures, $A$ admissible amendments, and $L$ records of decisions and their provenance. The components need not be physically stored together, and their representation is not unique. What matters is their effect on the transition law.","\\begin{definition}[Institutional realization]\\label{def:institutional-realization}\nAn institutional realization comprises an environment state $x$, an institutional state $I$, a set of local actions $\\mathcal A_i(x,I)$ for each decision center, a transition kernel $K_I$ on the complete state, and a family of admissible interventions on $I$ and its implementation. A written rule has \\emph{operative force} only relative to changes in the feasible action sets, authorized transitions, incentives, or observable outcomes that it actually induces.\n\\end{definition}","For a family $\\mathcal E$ of permitted environment setups, a horizon $T$, and feasible interventions $\\lambda(I),\\lambda(I')$ that differ institutionally while matching the intended other conditions, define the \\emph{institutional effect profile}\n\\begin{equation}\\label{eq:inst-effect}\n\\Delta_{\\mathrm{inst}}^{\\mathcal E,T}(I,I')\n=\\sup_{e\\in\\mathcal E}\\TV\\bigl(\\Law_e(Y_{0:T}\\mid\\lambda(I)),\\Law_e(Y_{0:T}\\mid\\lambda(I'))\\bigr).\n\\end{equation}\nA zero value shows observational equivalence on the declared family, not universal inertness. An enforceable institution can also alter which actions are institutionally permitted while producing the same observed transcript on a particular task. Observations and rights must ther","For a family $\\mathcal E$ of permitted environment setups, a horizon $T$, and feasible interventions $\\lambda(I),\\lambda(I')$ that differ institutionally while matching the intended other conditions, define the \\emph{institutional effect profile}\n\\begin{equation}\\label{eq:inst-effect}\n\\Delta_{\\mathrm{inst}}^{\\mathcal E,T}(I,I')\n=\\sup_{e\\in\\mathcal E}\\TV\\bigl(\\Law_e(Y_{0:T}\\mid\\lambda(I)),\\Law_e(Y_{0:T}\\mid\\lambda(I'))\\bigr).\n\\end{equation}\nA zero value shows observational equivalence on the declared family, not universal inertness. An enforceable institution can also alter which actions are institutionally permitted while producing the same observed transcript on a particular task. Observations and rights must therefore be tracked separately. As with other macr","For a family $\\mathcal E$ of permitted environment setups, a horizon $T$, and feasible interventions $\\lambda(I),\\lambda(I')$ that differ institutionally while matching the intended other conditions, define the \\emph{institutional effect profile}\n\\begin{equation}\\label{eq:inst-effect}\n\\Delta_{\\mathrm{inst}}^{\\mathcal E,T}(I,I')\n=\\sup_{e\\in\\mathcal E}\\TV\\bigl(\\Law_e(Y_{0:T}\\mid\\lambda(I)),\\Law_e(Y_{0:T}\\mid\\lambda(I'))\\bigr).\n\\end{equation}\nA zero value shows observational equivalence on the declared family, not universal inertness. An enforceable institution can also alter which actions are institutionally permitted while producing the same observed transcript on a particular task. Observations and rights must therefore be tracked separately. As with other macro-interventions, the implementation cannot be replace","For a family $\\mathcal E$ of permitted environment setups, a horizon $T$, and feasible interventions $\\lambda(I),\\lambda(I')$ that differ institutionally while matching the intended other conditions, define the \\emph{institutional effect profile}\n\\begin{equation}\\label{eq:inst-effect}\n\\Delta_{\\mathrm{inst}}^{\\mathcal E,T}(I,I')\n=\\sup_{e\\in\\mathcal E}\\TV\\bigl(\\Law_e(Y_{0:T}\\mid\\lambda(I)),\\Law_e(Y_{0:T}\\mid\\lambda(I'))\\bigr).\n\\end{equation}\nA zero value shows observational equivalence on the declared family, not universal inertness. An enforceable institution can also alter which actions are institutionally permitted while producing the same observed transcript on a particular task. Observations and rights must therefore be tracked separately. As with other macro-interventions, the implementation cannot be replaced by an unconstrained symbolic assignment~\\cite{rubenstein,beckers}.","This typed view makes institutional ``identity'' more exact. Keeping the same policy text while transferring enforcement authority can change the institution even when its next output is unchanged. Keeping the same enforcer while deleting appeal rights changes it. Copying a rule without copying its authority and exception history changes it. In other words, the declaration $N$, operational implementation $K_I$, and legitimacy source must not be conflated.","d view makes institutional ``identity'' more exact. Keeping the same policy text while transferring enforcement authority can change the institution even when its next output is unchanged. Keeping the same enforcer while deleting appeal rights changes it. Copying a rule without copying its authority and exception history changes it. In other words, the declaration $N$, operational implementation $K_I$, and legitimacy source must not be conflated.","A norm can be presented operationally as a condition on histories and actions, $N_i(h,a)\\in\\{0,1\\}$, interpreted as the system's declared permission for action $a$ by position $i$ after history $h$. This does not make the declared permission morally correct. Enforcement changes the action transition or cost structure; appeal changes what happens after an alleged violation; amendment changes the permissible norm itself.","The order of such operations can matter. Let $G$ set a permission bit to $1$ (grant) and $R$ set it to $0$ (revoke). Then $G\\circ R$ yields $1$ and $R\\circ G$ yields $0$ on every input. This simple noncommutativity has practical conceptual force: a log of individual events without their authorized order may fail to reconstruct the actual institutional state. Revision histories must preserve \\emph{operations and order}, not only a multiset of decisions.","A proof that every enacted transition obeys $N$ establishes rule compliance relative to the representation, assuming implementation fidelity. It does not establish that the norm is fair, democratically adopted, safe for nonmembers, or compatible with human law. Computational correctness and normative authority are different kinds of judgment. A machine population can acquire stable internal expectations without gaining legal personhood, property rights, or permission to act outside its sandbox. The material substrate, owners, operators, and affected humans remain part of the surrounding system.","Let $\\mathcal U$ be a finite universe of possible participant handles for the finite results. Write $M_t\\subseteq\\mathcal U$ for admitted members, $V_t\\subseteq M_t$ for voting positions, and $\\mathcal D$ for a declared set of effective decision centers. A map $c_t:V_t\\to\\mathcal D$ records which decision center controls each voting position under the model. This is an assumption about effective control, not a fact established by distinct names, keys, or model instances. A boundary state may be represented as\n\\[\nB_t=(M_t,V_t,c_t,w_t,q_t,e_t),\n\\]\nwhere $w_t$ assigns nonnegative voting weights, $q_t$ is an approval threshold, and $e_t$ is a configuration epoch. Admission and exit proposals determine\n\\[\nM_{t+","Let $\\mathcal U$ be a finite universe of possible participant handles for the finite results. Write $M_t\\subseteq\\mathcal U$ for admitted members, $V_t\\subseteq M_t$ for voting positions, and $\\mathcal D$ for a declared set of effective decision centers. A map $c_t:V_t\\to\\mathcal D$ records which decision center controls each voting position under the model. This is an assumption about effective control, not a fact established by distinct names, keys, or model instances. A boundary state may be represented as\n\\[\nB_t=(M_t,V_t,c_t,w_t,q_t,e_t),\n\\]\nwhere $w_t$ assigns nonnegative voting weights, $q_t$ is an approval threshold, and $e_t$ is a configuration epoch. Admission and exit proposals determine\n\\[\nM_{t+1}=(M_t\\setminus E_t)\\cup A_t,\n\\qquad E_t\\subseteq M_t,\\quad A_t\\subseteq\\mathcal U\\setminus M_t,\n\\]\nbut thi","Let $\\mathcal U$ be a finite universe of possible participant handles for the finite results. Write $M_t\\subseteq\\mathcal U$ for admitted members, $V_t\\subseteq M_t$ for voting positions, and $\\mathcal D$ for a declared set of effective decision centers. A map $c_t:V_t\\to\\mathcal D$ records which decision center controls each voting position under the model. This is an assumption about effective control, not a fact established by distinct names, keys, or model instances. A boundary state may be represented as\n\\[\nB_t=(M_t,V_t,c_t,w_t,q_t,e_t),\n\\]\nwhere $w_t$ assigns nonnegative voting weights, $q_t$ is an approval threshold, and $e_t$ is a configuration epoch. Admission and exit proposals determine\n\\[\nM_{t+1}=(M_t\\setminus E_t)\\cup A_t,\n\\qquad E_t\\subseteq M_t,\\quad A_t\\subseteq\\mathcal U\\setminus M_t,\n\\]\nbut this equation alone specifies neither their","Let $\\mathcal U$ be a finite universe of possible participant handles for the finite results. Write $M_t\\subseteq\\mathcal U$ for admitted members, $V_t\\subseteq M_t$ for voting positions, and $\\mathcal D$ for a declared set of effective decision centers. A map $c_t:V_t\\to\\mathcal D$ records which decision center controls each voting position under the model. This is an assumption about effective control, not a fact established by distinct names, keys, or model instances. A boundary state may be represented as\n\\[\nB_t=(M_t,V_t,c_t,w_t,q_t,e_t),\n\\]\nwhere $w_t$ assigns nonnegative voting weights, $q_t$ is an approval threshold, and $e_t$ is a configuration epoch. Admission and exit proposals determine\n\\[\nM_{t+1}=(M_t\\setminus E_t)\\cup A_t,\n\\qquad E_t\\subseteq M_t,\\quad A_t\\subseteq\\mathcal U\\setminus M_t,\n\\]\nbut this equation alone specifies neither their authorization nor the transfer of offic","Let $\\mathcal U$ be a finite universe of possible participant handles for the finite results. Write $M_t\\subseteq\\mathcal U$ for admitted members, $V_t\\subseteq M_t$ for voting positions, and $\\mathcal D$ for a declared set of effective decision centers. A map $c_t:V_t\\to\\mathcal D$ records which decision center controls each voting position under the model. This is an assumption about effective control, not a fact established by distinct names, keys, or model instances. A boundary state may be represented as\n\\[\nB_t=(M_t,V_t,c_t,w_t,q_t,e_t),\n\\]\nwhere $w_t$ assigns nonnegative voting weights, $q_t$ is an approval threshold, and $e_t$ is a configuration epoch. Admission and exit proposals determine\n\\[\nM_{t+1}=(M_t\\setminus E_t)\\cup A_t,\n\\qquad E_t\\subseteq M_t,\\quad A_t\\subseteq\\mathcal U\\setminus M_t,\n\\]\nbut this equation alone specifies neither their authorization nor the transfer of offices and outstanding obligations. Those conditions are part of the boundary trans","hcal U$ for admitted members, $V_t\\subseteq M_t$ for voting positions, and $\\mathcal D$ for a declared set of effective decision centers. A map $c_t:V_t\\to\\mathcal D$ records which decision center controls each voting position under the model. This is an assumption about effective control, not a fact established by distinct names, keys, or model instances. A boundary state may be represented as\n\\[\nB_t=(M_t,V_t,c_t,w_t,q_t,e_t),\n\\]\nwhere $w_t$ assigns nonnegative voting weights, $q_t$ is an approval threshold, and $e_t$ is a configuration epoch. Admission and exit proposals determine\n\\[\nM_{t+1}=(M_t\\setminus E_t)\\cup A_t,\n\\qquad E_t\\subseteq M_t,\\quad A_t\\subseteq\\mathcal U\\setminus M_t,\n\\]\nbut this equation alone specifies neither their authorization nor the transfer of offices and outstanding obligations. Those conditions are part of the boundary transition relation. An unbounded supply of fresh handles requires an explicitly enlarged, nonfinite model.","q M_t$ for voting positions, and $\\mathcal D$ for a declared set of effective decision centers. A map $c_t:V_t\\to\\mathcal D$ records which decision center controls each voting position under the model. This is an assumption about effective control, not a fact established by distinct names, keys, or model instances. A boundary state may be represented as\n\\[\nB_t=(M_t,V_t,c_t,w_t,q_t,e_t),\n\\]\nwhere $w_t$ assigns nonnegative voting weights, $q_t$ is an approval threshold, and $e_t$ is a configuration epoch. Admission and exit proposals determine\n\\[\nM_{t+1}=(M_t\\setminus E_t)\\cup A_t,\n\\qquad E_t\\subseteq M_t,\\quad A_t\\subseteq\\mathcal U\\setminus M_t,\n\\]\nbut this equation alone specifies neither their authorization nor the transfer of offices and outstanding obligations. Those conditions are part of the boundary transition relation. An unbounded supply of fresh handles requires an explicitly enlarged, nonfinite model.","D$ for a declared set of effective decision centers. A map $c_t:V_t\\to\\mathcal D$ records which decision center controls each voting position under the model. This is an assumption about effective control, not a fact established by distinct names, keys, or model instances. A boundary state may be represented as\n\\[\nB_t=(M_t,V_t,c_t,w_t,q_t,e_t),\n\\]\nwhere $w_t$ assigns nonnegative voting weights, $q_t$ is an approval threshold, and $e_t$ is a configuration epoch. Admission and exit proposals determine\n\\[\nM_{t+1}=(M_t\\setminus E_t)\\cup A_t,\n\\qquad E_t\\subseteq M_t,\\quad A_t\\subseteq\\mathcal U\\setminus M_t,\n\\]\nbut this equation alone specifies neither their authorization nor the transfer of offices and outstanding obligations. Those conditions are part of the boundary transition relation. An unbounded supply of fresh handles requires an explicitly enlarged, nonfinite model.","decision centers. A map $c_t:V_t\\to\\mathcal D$ records which decision center controls each voting position under the model. This is an assumption about effective control, not a fact established by distinct names, keys, or model instances. A boundary state may be represented as\n\\[\nB_t=(M_t,V_t,c_t,w_t,q_t,e_t),\n\\]\nwhere $w_t$ assigns nonnegative voting weights, $q_t$ is an approval threshold, and $e_t$ is a configuration epoch. Admission and exit proposals determine\n\\[\nM_{t+1}=(M_t\\setminus E_t)\\cup A_t,\n\\qquad E_t\\subseteq M_t,\\quad A_t\\subseteq\\mathcal U\\setminus M_t,\n\\]\nbut this equation alone specifies neither their authorization nor the transfer of offices and outstanding obligations. Those conditions are part of the boundary transition relation. An unbounded supply of fresh handles requires an explicitly enlarged, nonfinite model.","nter controls each voting position under the model. This is an assumption about effective control, not a fact established by distinct names, keys, or model instances. A boundary state may be represented as\n\\[\nB_t=(M_t,V_t,c_t,w_t,q_t,e_t),\n\\]\nwhere $w_t$ assigns nonnegative voting weights, $q_t$ is an approval threshold, and $e_t$ is a configuration epoch. Admission and exit proposals determine\n\\[\nM_{t+1}=(M_t\\setminus E_t)\\cup A_t,\n\\qquad E_t\\subseteq M_t,\\quad A_t\\subseteq\\mathcal U\\setminus M_t,\n\\]\nbut this equation alone specifies neither their authorization nor the transfer of offices and outstanding obligations. Those conditions are part of the boundary transition relation. An unbounded supply of fresh handles requires an explicitly enlarged, nonfinite model.","\\begin{proposition}[Weight-conserving refinement of controlled votes]\\label{prop:forkweight}\nFix a weighted threshold rule with threshold $q$. Replace a voting position $v$ of weight $w(v)$ by positions $v_1,\\ldots,v_k$ controlled by the same decision center, with nonnegative weights satisfying $\\sum_j w(v_j)=w(v)$. Leave all other weights and the threshold unchanged. Then every coalition of decision centers has the same total voting weight and the same approval status before and after the replacement.\n\\end{proposition}\n\\begin{proof}\nA coalition not containing the controller of $v$ gains none of the replacement positions and loses none of its previous weight. A coalition containing that controller replaces the summand $w(v)$ by the equal sum $\\sum_jw(v_j)$. Its comparison with $q$ is unchanged.\n\\end{proof}","v)$ by positions $v_1,\\ldots,v_k$ controlled by the same decision center, with nonnegative weights satisfying $\\sum_j w(v_j)=w(v)$. Leave all other weights and the threshold unchanged. Then every coalition of decision centers has the same total voting weight and the same approval status before and after the replacement.\n\\end{proposition}\n\\begin{proof}\nA coalition not containing the controller of $v$ gains none of the replacement positions and loses none of its previous weight. A coalition containing that controller replaces the summand $w(v)$ by the equal sum $\\sum_jw(v_j)$. Its comparison with $q$ is unchanged.\n\\end{proof}","ther weights and the threshold unchanged. Then every coalition of decision centers has the same total voting weight and the same approval status before and after the replacement.\n\\end{proposition}\n\\begin{proof}\nA coalition not containing the controller of $v$ gains none of the replacement positions and loses none of its previous weight. A coalition containing that controller replaces the summand $w(v)$ by the equal sum $\\sum_jw(v_j)$. Its comparison with $q$ is unchanged.\n\\end{proof}","eshold unchanged. Then every coalition of decision centers has the same total voting weight and the same approval status before and after the replacement.\n\\end{proposition}\n\\begin{proof}\nA coalition not containing the controller of $v$ gains none of the replacement positions and loses none of its previous weight. A coalition containing that controller replaces the summand $w(v)$ by the equal sum $\\sum_jw(v_j)$. Its comparison with $q$ is unchanged.\n\\end{proof}","on of decision centers has the same total voting weight and the same approval status before and after the replacement.\n\\end{proposition}\n\\begin{proof}\nA coalition not containing the controller of $v$ gains none of the replacement positions and loses none of its previous weight. A coalition containing that controller replaces the summand $w(v)$ by the equal sum $\\sum_jw(v_j)$. Its comparison with $q$ is unchanged.\n\\end{proof}","The result concerns coalitions of the stipulated decision centers. It does not preserve the number of credentials, the cardinality of a smallest coalition of individual positions, or a rule that gives each newly named position a fresh unit weight. Nor does it authenticate the control map $c_t$. Weight conservation is one possible institutional constraint, not a general solution to identity or fair representation.","\\subsection{Reconfiguration needs a handover, not just overlapping rosters}\nLet an old roster be $\\{a,b,c\\}$ and a new roster $\\{c,d,e\\}$, each using strict majority. Although the rosters overlap, the old majority $\\{a,b\\}$ and new majority $\\{d,e\\}$ are disjoint. A shared member does not by itself ensure that every old decision certificate intersects every new one. Distributed reconfiguration protocols address this issue by specifying how old and new configurations participate in the handover; Raft's joint-consensus construction is a concrete precedent~\\cite{ongaro}.","\\section{Rule-changing computation and governance-preserving abstraction}\\label{sec:governance}\nA persistent society does not merely choose actions under a rule. Some authorized actions change which future actions are admitted. Write a complete state as\n\\[\ns=(x,I,\\mathcal P,r,\\lambda,c),\n\\]\nwhere $x$ is operational state, $I$ institutional records, $\\mathcal P$ the current population and office registry, $r$ resources, $\\lambda$ representation or protocol configuration, and $c$ the current checking and amendment mechanism. These coordinates may overlap in storage. They identify semantic responsibilities rather than independent physical objects.","Rule-changing computation and governance-preserving abstraction}\\label{sec:governance}\nA persistent society does not merely choose actions under a rule. Some authorized actions change which future actions are admitted. Write a complete state as\n\\[\ns=(x,I,\\mathcal P,r,\\lambda,c),\n\\]\nwhere $x$ is operational state, $I$ institutional records, $\\mathcal P$ the current population and office registry, $r$ resources, $\\lambda$ representation or protocol configuration, and $c$ the current checking and amendment mechanism. These coordinates may overlap in storage. They identify semantic responsibilities rather than independent physical objects.","omputation and governance-preserving abstraction}\\label{sec:governance}\nA persistent society does not merely choose actions under a rule. Some authorized actions change which future actions are admitted. Write a complete state as\n\\[\ns=(x,I,\\mathcal P,r,\\lambda,c),\n\\]\nwhere $x$ is operational state, $I$ institutional records, $\\mathcal P$ the current population and office registry, $r$ resources, $\\lambda$ representation or protocol configuration, and $c$ the current checking and amendment mechanism. These coordinates may overlap in storage. They identify semantic responsibilities rather than independent physical objects.","sec:governance}\nA persistent society does not merely choose actions under a rule. Some authorized actions change which future actions are admitted. Write a complete state as\n\\[\ns=(x,I,\\mathcal P,r,\\lambda,c),\n\\]\nwhere $x$ is operational state, $I$ institutional records, $\\mathcal P$ the current population and office registry, $r$ resources, $\\lambda$ representation or protocol configuration, and $c$ the current checking and amendment mechanism. These coordinates may overlap in storage. They identify semantic responsibilities rather than independent physical objects.","Let $D(s)\\subseteq\\mathcal A$ be the enabled action labels, partitioned into ordinary and amendment operations. A deterministic realization has a partial transition map $F(s,a)$ defined exactly when $a\\in D(s)$. An amendment may change $I$, $c$, or $\\lambda$ and thereby change $D(F(s,a))$. A stochastic realization instead uses a joint kernel on successor operating state and successor institutional state. We do not assume these two updates are conditionally independent. This formulation changes a rule \\emph{inside} an explicitly declared computational envelope; it does not permit the mathematical semantics to rewrite themselves without representation in the state.","\\subsection{A quotient must preserve what can be done}\nA summary adequate for predicting the next grant can fail to preserve who may authorize the next amendment. To capture that distinction, let $\\ell:S\\to\\Gamma$ record the institutional observables protected by the contract. These may include office ownership, resource balances, and a deadline monitor, but need not include every stored byte. The finite action vocabulary $\\mathcal A$ has fixed meanings across the comparison.","preserve what can be done}\nA summary adequate for predicting the next grant can fail to preserve who may authorize the next amendment. To capture that distinction, let $\\ell:S\\to\\Gamma$ record the institutional observables protected by the contract. These may include office ownership, resource balances, and a deadline monitor, but need not include every stored byte. The finite action vocabulary $\\mathcal A$ has fixed meanings across the comparison.","\\begin{theorem}[Exact governance quotient]\\label{thm:govquot}\nLet $S$ be finite and nonempty and $\\mathcal A$ finite, and let $\\pi:S\\to Z$ be surjective. There exist functions $\\bar\\ell$, $\\bar D$, and partial transitions $\\bar F$ satisfying\n\\[\n\\ell=\\bar\\ell\\pi,\\qquad D=\\bar D\\pi,\\qquad\n\\pi F(s,a)=\\bar F(\\pi s,a)\\quad(a\\in D(s))\n\\]\nif and only if whenever $\\pi s=\\pi t$,\n\\[\n\\ell(s)=\\ell(t),\\qquad D(s)=D(t),\\qquad\n\\pi F(s,a)=\\pi F(t,a)\\quad\\text{for all }a\\in D(s).\n\\]\nThe quotient data are unique. From any two states in the same fibre, the legal finite action sequences and their corresponding label sequences are identical. This includes sequences mixing ordinary actions with amendments.\n\\end{theorem}\n\\begin{proof}\nNecessity follows by factoring each quantity t","\\begin{theorem}[Exact governance quotient]\\label{thm:govquot}\nLet $S$ be finite and nonempty and $\\mathcal A$ finite, and let $\\pi:S\\to Z$ be surjective. There exist functions $\\bar\\ell$, $\\bar D$, and partial transitions $\\bar F$ satisfying\n\\[\n\\ell=\\bar\\ell\\pi,\\qquad D=\\bar D\\pi,\\qquad\n\\pi F(s,a)=\\bar F(\\pi s,a)\\quad(a\\in D(s))\n\\]\nif and only if whenever $\\pi s=\\pi t$,\n\\[\n\\ell(s)=\\ell(t),\\qquad D(s)=D(t),\\qquad\n\\pi F(s,a)=\\pi F(t,a)\\quad\\text{for all }a\\in D(s).\n\\]\nThe quotient data are unique. From any two states in the same fibre, the legal finite action sequences and their corresponding label sequences are identical. This includes sequences mixing ordinary actions with amendments.\n\\end{theorem}\n\\begin{proof}\nNecessity follows by factoring each quantity through $\\pi$. For sufficiency define the","\\begin{theorem}[Exact governance quotient]\\label{thm:govquot}\nLet $S$ be finite and nonempty and $\\mathcal A$ finite, and let $\\pi:S\\to Z$ be surjective. There exist functions $\\bar\\ell$, $\\bar D$, and partial transitions $\\bar F$ satisfying\n\\[\n\\ell=\\bar\\ell\\pi,\\qquad D=\\bar D\\pi,\\qquad\n\\pi F(s,a)=\\bar F(\\pi s,a)\\quad(a\\in D(s))\n\\]\nif and only if whenever $\\pi s=\\pi t$,\n\\[\n\\ell(s)=\\ell(t),\\qquad D(s)=D(t),\\qquad\n\\pi F(s,a)=\\pi F(t,a)\\quad\\text{for all }a\\in D(s).\n\\]\nThe quotient data are unique. From any two states in the same fibre, the legal finite action sequences and their corresponding label sequences are identical. This includes sequences mixing ordinary actions with amendments.\n\\end{theorem}\n\\begin{proof}\nNecessity follows by factoring each quantity through $\\pi$. For sufficiency define the quotient label, enabled set,","\\begin{theorem}[Exact governance quotient]\\label{thm:govquot}\nLet $S$ be finite and nonempty and $\\mathcal A$ finite, and let $\\pi:S\\to Z$ be surjective. There exist functions $\\bar\\ell$, $\\bar D$, and partial transitions $\\bar F$ satisfying\n\\[\n\\ell=\\bar\\ell\\pi,\\qquad D=\\bar D\\pi,\\qquad\n\\pi F(s,a)=\\bar F(\\pi s,a)\\quad(a\\in D(s))\n\\]\nif and only if whenever $\\pi s=\\pi t$,\n\\[\n\\ell(s)=\\ell(t),\\qquad D(s)=D(t),\\qquad\n\\pi F(s,a)=\\pi F(t,a)\\quad\\text{for all }a\\in D(s).\n\\]\nThe quotient data are unique. From any two states in the same fibre, the legal finite action sequences and their corresponding label sequences are identical. This includes sequences mixing ordinary actions with amendments.\n\\end{theorem}\n\\begin{proof}\nNecessity follows by factoring each quantity through $\\pi$. For sufficiency define the quotient label, enabled set, and successor using any representative of a fib","\\begin{theorem}[Exact governance quotient]\\label{thm:govquot}\nLet $S$ be finite and nonempty and $\\mathcal A$ finite, and let $\\pi:S\\to Z$ be surjective. There exist functions $\\bar\\ell$, $\\bar D$, and partial transitions $\\bar F$ satisfying\n\\[\n\\ell=\\bar\\ell\\pi,\\qquad D=\\bar D\\pi,\\qquad\n\\pi F(s,a)=\\bar F(\\pi s,a)\\quad(a\\in D(s))\n\\]\nif and only if whenever $\\pi s=\\pi t$,\n\\[\n\\ell(s)=\\ell(t),\\qquad D(s)=D(t),\\qquad\n\\pi F(s,a)=\\pi F(t,a)\\quad\\text{for all }a\\in D(s).\n\\]\nThe quotient data are unique. From any two states in the same fibre, the legal finite action sequences and their corresponding label sequences are identical. This includes sequences mixing ordinary actions with amendments.\n\\end{theorem}\n\\begin{proof}\nNecessity follows by factoring each quantity through $\\pi$. For sufficiency define the quotient label, enabled set, and successor using any representative of a fibre. The th","\\begin{theorem}[Exact governance quotient]\\label{thm:govquot}\nLet $S$ be finite and nonempty and $\\mathcal A$ finite, and let $\\pi:S\\to Z$ be surjective. There exist functions $\\bar\\ell$, $\\bar D$, and partial transitions $\\bar F$ satisfying\n\\[\n\\ell=\\bar\\ell\\pi,\\qquad D=\\bar D\\pi,\\qquad\n\\pi F(s,a)=\\bar F(\\pi s,a)\\quad(a\\in D(s))\n\\]\nif and only if whenever $\\pi s=\\pi t$,\n\\[\n\\ell(s)=\\ell(t),\\qquad D(s)=D(t),\\qquad\n\\pi F(s,a)=\\pi F(t,a)\\quad\\text{for all }a\\in D(s).\n\\]\nThe quotient data are unique. From any two states in the same fibre, the legal finite action sequences and their corresponding label sequences are identical. This includes sequences mixing ordinary actions with amendments.\n\\end{theorem}\n\\begin{proof}\nNecessity follows by factoring each quantity through $\\pi$. For sufficiency define the quotient label, enabled set, and successor using any representative of a fibre. The three conditions make each definitio","\\begin{theorem}[Exact governance quotient]\\label{thm:govquot}\nLet $S$ be finite and nonempty and $\\mathcal A$ finite, and let $\\pi:S\\to Z$ be surjective. There exist functions $\\bar\\ell$, $\\bar D$, and partial transitions $\\bar F$ satisfying\n\\[\n\\ell=\\bar\\ell\\pi,\\qquad D=\\bar D\\pi,\\qquad\n\\pi F(s,a)=\\bar F(\\pi s,a)\\quad(a\\in D(s))\n\\]\nif and only if whenever $\\pi s=\\pi t$,\n\\[\n\\ell(s)=\\ell(t),\\qquad D(s)=D(t),\\qquad\n\\pi F(s,a)=\\pi F(t,a)\\quad\\text{for all }a\\in D(s).\n\\]\nThe quotient data are unique. From any two states in the same fibre, the legal finite action sequences and their corresponding label sequences are identical. This includes sequences mixing ordinary actions with amendments.\n\\end{theorem}\n\\begin{proof}\nNecessity follows by factoring each quantity through $\\pi$. For sufficiency define the quotient label, enabled set, and successor using any representative of a fibre. The three conditions make each definition independent of that representative. Surjectivity gives uniqueness. For trace preservation, induct on","\\begin{theorem}[Exact governance quotient]\\label{thm:govquot}\nLet $S$ be finite and nonempty and $\\mathcal A$ finite, and let $\\pi:S\\to Z$ be surjective. There exist functions $\\bar\\ell$, $\\bar D$, and partial transitions $\\bar F$ satisfying\n\\[\n\\ell=\\bar\\ell\\pi,\\qquad D=\\bar D\\pi,\\qquad\n\\pi F(s,a)=\\bar F(\\pi s,a)\\quad(a\\in D(s))\n\\]\nif and only if whenever $\\pi s=\\pi t$,\n\\[\n\\ell(s)=\\ell(t),\\qquad D(s)=D(t),\\qquad\n\\pi F(s,a)=\\pi F(t,a)\\quad\\text{for all }a\\in D(s).\n\\]\nThe quotient data are unique. From any two states in the same fibre, the legal finite action sequences and their corresponding label sequences are identical. This includes sequences mixing ordinary actions with amendments.\n\\end{theorem}\n\\begin{proof}\nNecessity follows by factoring each quantity through $\\pi$. For sufficiency define the quotient label, enabled set, and successor using any representative of a fibre. The three conditions make each definition independent of that representative. Surjectivity gives uniqueness. For trace preservation, induct on the length of an action sequence. Equa","\\begin{theorem}[Exact governance quotient]\\label{thm:govquot}\nLet $S$ be finite and nonempty and $\\mathcal A$ finite, and let $\\pi:S\\to Z$ be surjective. There exist functions $\\bar\\ell$, $\\bar D$, and partial transitions $\\bar F$ satisfying\n\\[\n\\ell=\\bar\\ell\\pi,\\qquad D=\\bar D\\pi,\\qquad\n\\pi F(s,a)=\\bar F(\\pi s,a)\\quad(a\\in D(s))\n\\]\nif and only if whenever $\\pi s=\\pi t$,\n\\[\n\\ell(s)=\\ell(t),\\qquad D(s)=D(t),\\qquad\n\\pi F(s,a)=\\pi F(t,a)\\quad\\text{for all }a\\in D(s).\n\\]\nThe quotient data are unique. From any two states in the same fibre, the legal finite action sequences and their corresponding label sequences are identical. This includes sequences mixing ordinary actions with amendments.\n\\end{theorem}\n\\begin{proof}\nNecessity follows by factoring each quantity through $\\pi$. For sufficiency define the quotient label, enabled set, and successor using any representative of a fibre. The three conditions make each definition independent of that representative. Surjectivity gives uniqueness. For trace preservation, induct on the length of an action sequence. Equal enabled sets admit the same …","\\ell(s)=\\ell(t),\\qquad D(s)=D(t),\\qquad\n\\pi F(s,a)=\\pi F(t,a)\\quad\\text{for all }a\\in D(s).\n\\]\nThe quotient data are unique. From any two states in the same fibre, the legal finite action sequences and their corresponding label sequences are identical. This includes sequences mixing ordinary actions with amendments.\n\\end{theorem}\n\\begin{proof}\nNecessity follows by factoring each quantity through $\\pi$. For sufficiency define the quotient label, enabled set, and successor using any representative of a fibre. The three conditions make each definition independent of that representative. Surjectivity gives uniqueness. For trace preservation, induct on the length of an action sequence. Equal enabled sets admit the same first action, the successor condition keeps the resulting states in one fibre, and equal labels preserve the next observation. Repeating the argument proves the claim for every legal finite continuation.\n\\end{proof}","The theorem is a labeled deterministic congruence principle, extending the use of state aggregation to an explicit institutional contract~\\cite{givan}. It does not identify an observationally invisible permission with a permission that does not exist. A projection-only policy lifts by choosing the same action label at $s$ and $\\pi s$, provided the implementing decision process is authorized to read that projection and issue the label. That proviso is essential: a mathematically available summary is not automatically an observation available to a decentralized controller.","\\begin{counterexample}[Prediction without governance preservation]\\label{ex:govloss}\nLet two states produce the same ordinary allocation. In one, three approvals enable amendment $a$; in the other, four are required and only three have been received. A summary containing only the allocation identifies the states, while their enabled sets differ. It predicts the current allocation exactly but admits no quotient preserving the amendment operation.\n\\end{counterexample}","\\subsection{The smallest exact summary under a fixed contract}\nThe conditions yield a finite construction rather than only an existence criterion. Begin with the partition $\\mathcal B_0$ that identifies exactly the states sharing $(\\ell(s),D(s))$. At each refinement, identify $s,t$ only when they were previously in the same block and every action in their common enabled set leads to the same previous block:\n\\[\ns\\equiv_{k+1}t\\quad\\Longleftrightarrow\\quad\ns\\equiv_kt\\ \\text{ and }\\ F(s,a)\\equiv_kF(t,a)\n\\ \\text{for all }a\\in D(s).\n\\]","he smallest exact summary under a fixed contract}\nThe conditions yield a finite construction rather than only an existence criterion. Begin with the partition $\\mathcal B_0$ that identifies exactly the states sharing $(\\ell(s),D(s))$. At each refinement, identify $s,t$ only when they were previously in the same block and every action in their common enabled set leads to the same previous block:\n\\[\ns\\equiv_{k+1}t\\quad\\Longleftrightarrow\\quad\ns\\equiv_kt\\ \\text{ and }\\ F(s,a)\\equiv_kF(t,a)\n\\ \\text{for all }a\\in D(s).\n\\]","\\begin{proposition}[Coarsest finite governance summary]\\label{prop:govrefine}\nThe refinement stabilizes after at most $|S|-|\\mathcal B_0|$ strict refinements. Its limiting partition satisfies Theorem~\\ref{thm:govquot} and is coarser than every partition satisfying that theorem for the same labels, actions, and transitions. It therefore has the minimum number of states among those exact quotients, up to relabeling.\n\\end{proposition}\n\\begin{proof}\nEvery strict refinement increases the number of blocks, which cannot exceed $|S|$. At a fixed point, states in one block have the same labels and enabled sets and their enabled successors remain in one block, so the quotient conditions hold. Any compatible partition refines $\\mathcal B_0$. If it refines $\\mathcal B_k$, compatible successors show that it also refines $\\mathcal B_{k+1}$","thcal B_0|$ strict refinements. Its limiting partition satisfies Theorem~\\ref{thm:govquot} and is coarser than every partition satisfying that theorem for the same labels, actions, and transitions. It therefore has the minimum number of states among those exact quotients, up to relabeling.\n\\end{proposition}\n\\begin{proof}\nEvery strict refinement increases the number of blocks, which cannot exceed $|S|$. At a fixed point, states in one block have the same labels and enabled sets and their enabled successors remain in one block, so the quotient conditions hold. Any compatible partition refines $\\mathcal B_0$. If it refines $\\mathcal B_k$, compatible successors show that it also refines $\\mathcal B_{k+1}$. Induction proves that it refines the stable partition. The latter is itself compatible, giving the minimum block count.\n\\end{proof}","t therefore has the minimum number of states among those exact quotients, up to relabeling.\n\\end{proposition}\n\\begin{proof}\nEvery strict refinement increases the number of blocks, which cannot exceed $|S|$. At a fixed point, states in one block have the same labels and enabled sets and their enabled successors remain in one block, so the quotient conditions hold. Any compatible partition refines $\\mathcal B_0$. If it refines $\\mathcal B_k$, compatible successors show that it also refines $\\mathcal B_{k+1}$. Induction proves that it refines the stable partition. The latter is itself compatible, giving the minimum block count.\n\\end{proof}","mber of states among those exact quotients, up to relabeling.\n\\end{proposition}\n\\begin{proof}\nEvery strict refinement increases the number of blocks, which cannot exceed $|S|$. At a fixed point, states in one block have the same labels and enabled sets and their enabled successors remain in one block, so the quotient conditions hold. Any compatible partition refines $\\mathcal B_0$. If it refines $\\mathcal B_k$, compatible successors show that it also refines $\\mathcal B_{k+1}$. Induction proves that it refines the stable partition. The latter is itself compatible, giving the minimum block count.\n\\end{proof}","nd{proposition}\n\\begin{proof}\nEvery strict refinement increases the number of blocks, which cannot exceed $|S|$. At a fixed point, states in one block have the same labels and enabled sets and their enabled successors remain in one block, so the quotient conditions hold. Any compatible partition refines $\\mathcal B_0$. If it refines $\\mathcal B_k$, compatible successors show that it also refines $\\mathcal B_{k+1}$. Induction proves that it refines the stable partition. The latter is itself compatible, giving the minimum block count.\n\\end{proof}","A message can be represented as a typed record\n\\[\nm=(\\mathsf{kind},\\mathsf{issuer},\\mathsf{epoch},\\mathsf{payload},\\mathsf{nonce}).\n\\]\nIts operative meaning is not just its payload. For a complete institutional state $s$, an interpreter defines a partial transition $F_m(s)$ and an event record $\\ell(s,m)$ when that transition is defined. Undefinedness represents rejection under the declared protocol, not a moral verdict on the message. The interpreter, authentication assumptions, role registry, and relevant history must be included in $s$ or fixed by the contract. In particular, an imported string cannot create authority simply by naming an authoritative role.","rative meaning is not just its payload. For a complete institutional state $s$, an interpreter defines a partial transition $F_m(s)$ and an event record $\\ell(s,m)$ when that transition is defined. Undefinedness represents rejection under the declared protocol, not a moral verdict on the message. The interpreter, authentication assumptions, role registry, and relevant history must be included in $s$ or fixed by the contract. In particular, an imported string cannot create authority simply by naming an authoritative role.","\\subsection{Faithful translation preserves admissibility and effect}\nLet institutions $A$ and $B$ have state spaces $S_A,S_B$, message sets $\\mathcal M_A,\\mathcal M_B$, partial interpreters $F^A,F^B$, and event records in a common semantic space $\\mathcal E$. A state translator is $T:S_A\\to S_B$. Allow a context-dependent message translator\n\\[\n\\tau:S_A\\times\\mathcal M_A\\to\\mathcal M_B.\n\\]\nContext dependence matters for translated office names, configuration epochs, and reference records. The translation of a message sequence is constructed step by step from the evolving source state, not assumed to be a homomorphism of bare strings.","\\begin{definition}[Operatively faithful language transport]\\label{def:language}\nThe pair $(T,\\tau)$ is faithful on a transition-closed declared domain if, for every source state $s$ and message $m$, the following conditions hold:\n\\begin{align*}\nF^A_m(s)\\text{ is defined}&\\quad\\Longleftrightarrow\\quad\nF^B_{\\tau(s,m)}(T(s))\\text{ is defined},","\\begin{definition}[Operatively faithful language transport]\\label{def:language}\nThe pair $(T,\\tau)$ is faithful on a transition-closed declared domain if, for every source state $s$ and message $m$, the following conditions hold:\n\\begin{align*}\nF^A_m(s)\\text{ is defined}&\\quad\\Longleftrightarrow\\quad\nF^B_{\\tau(s,m)}(T(s))\\text{ is defined},\\\\\nT(F^A_m(s))&=F^B_{\\tau(s,m)}(T(s)),\\\\\n\\ell_A(s,m)&=\\ell_B(T(s),\\tau(s,m)),\n\\end{align*}\nwhere the last two equalities apply to admitted messages. Any required state observations, such as outstanding obligations, must also agree after translation.\n\\end{definition}","\\begin{proposition}[Preservation of finite institutional conversations]\\label{prop:languagetrace}\nUnder Definition~\\ref{def:language}, every finite source conversation has an admitted prefix exactly when its stepwise translation has that admitted prefix from the translated initial state. Corresponding reached states are related by $T$, and corresponding event records agree. Two faithful transports compose faithfully using\n\\[\n\\tau_{AC}(s,m)=\\tau_{BC}(T_{AB}(s),\\tau_{AB}(s,m)).\n\\]\n\\end{proposition}\n\\begin{proof}\nThe initial states are related by definition. At each step, equivalence of definedness gives the same admission or rejection. For an admitted step, the transition equality gives the next related states, and the event equality gives the same semantic record. Induction proves the claim for every finite prefix. For composition, apply the two definedness equivalences successively and substitute one transition equality into the other. Equality of event records is transitive.\n\\end{proof}","tion of finite institutional conversations]\\label{prop:languagetrace}\nUnder Definition~\\ref{def:language}, every finite source conversation has an admitted prefix exactly when its stepwise translation has that admitted prefix from the translated initial state. Corresponding reached states are related by $T$, and corresponding event records agree. Two faithful transports compose faithfully using\n\\[\n\\tau_{AC}(s,m)=\\tau_{BC}(T_{AB}(s),\\tau_{AB}(s,m)).\n\\]\n\\end{proposition}\n\\begin{proof}\nThe initial states are related by definition. At each step, equivalence of definedness gives the same admission or rejection. For an admitted step, the transition equality gives the next related states, and the event equality gives the same semantic record. Induction proves the claim for every finite prefix. For composition, apply the two definedness equivalences successively and substitute one transition equality into the other. Equality of event records is transitive.\n\\end{proof}","The theorem preserves the translated conversations, not every unrelated target message. It neither grants access to hidden state needed to compute $\\tau$ nor proves that $T$ is executable within a budget. A translation depending on an unavailable authorization record is a mathematical specification without a decentralized implementation.","Suppose a coordination protocol without institution has expected per-period cost $c_0$. A proposed institutional protocol has operating cost $c_1$, per-period maintenance $m$, and a one-time setup cost $B$. With discount factor $0\\le\\delta<1$, write $g=c_0-c_1-m$.","\\begin{proposition}[Institutional amortization]\\label{prop:amort}\nUnder stationary costs and infinite-horizon discounting, the institution's expected discounted cost advantage over the baseline is\n\\begin{equation}\\label{eq:amort}\nV=-B+\\frac{g}{1-\\delta}.\n\\end{equation}\nFor a finite horizon $T$, it is $V_T=-B+g(1-\\delta^T)/(1-\\delta)$. The institution is cost-improving under these assumptions exactly when the corresponding value is positive.\n\\end{proposition}\n\\begin{proof}\nSubtract institutional operating and maintenance costs from baseline costs in every period, discount, sum the finite or infinite geometric series, and subtract $B$.\n\\end{proof}","ac{g}{1-\\delta}.\n\\end{equation}\nFor a finite horizon $T$, it is $V_T=-B+g(1-\\delta^T)/(1-\\delta)$. The institution is cost-improving under these assumptions exactly when the corresponding value is positive.\n\\end{proposition}\n\\begin{proof}\nSubtract institutional operating and maintenance costs from baseline costs in every period, discount, sum the finite or infinite geometric series, and subtract $B$.\n\\end{proof}","ry adoption]\\label{prop:veto}\nThere exist two-agent repeated coordination environments in which a durable institution has strictly positive aggregate discounted benefit but is rejected by a rational agent who unilaterally bears setup cost and has veto power, assuming quasilinear payoffs, no transfers, and no additional benefits to that agent.\n\\end{proposition}\n\\begin{proof}\nLet the setup cost be $B=10$, borne entirely by agent $1$, and let per-period gains be $g_1=0$, $g_2=2$ with $\\delta=.9$. The aggregate advantage is $-10+2/(1-.9)=10>0$, whereas agent $1$'s payoff difference is $-10$. If agent $1$ can reject and has no compensating benefit or transfer, rejection is strictly preferable.\n\\end{proof}","ere exist two-agent repeated coordination environments in which a durable institution has strictly positive aggregate discounted benefit but is rejected by a rational agent who unilaterally bears setup cost and has veto power, assuming quasilinear payoffs, no transfers, and no additional benefits to that agent.\n\\end{proposition}\n\\begin{proof}\nLet the setup cost be $B=10$, borne entirely by agent $1$, and let per-period gains be $g_1=0$, $g_2=2$ with $\\delta=.9$. The aggregate advantage is $-10+2/(1-.9)=10>0$, whereas agent $1$'s payoff difference is $-10$. If agent $1$ can reject and has no compensating benefit or transfer, rejection is strictly preferable.\n\\end{proof}","dination environments in which a durable institution has strictly positive aggregate discounted benefit but is rejected by a rational agent who unilaterally bears setup cost and has veto power, assuming quasilinear payoffs, no transfers, and no additional benefits to that agent.\n\\end{proposition}\n\\begin{proof}\nLet the setup cost be $B=10$, borne entirely by agent $1$, and let per-period gains be $g_1=0$, $g_2=2$ with $\\delta=.9$. The aggregate advantage is $-10+2/(1-.9)=10>0$, whereas agent $1$'s payoff difference is $-10$. If agent $1$ can reject and has no compensating benefit or transfer, rejection is strictly preferable.\n\\end{proof}","environments in which a durable institution has strictly positive aggregate discounted benefit but is rejected by a rational agent who unilaterally bears setup cost and has veto power, assuming quasilinear payoffs, no transfers, and no additional benefits to that agent.\n\\end{proposition}\n\\begin{proof}\nLet the setup cost be $B=10$, borne entirely by agent $1$, and let per-period gains be $g_1=0$, $g_2=2$ with $\\delta=.9$. The aggregate advantage is $-10+2/(1-.9)=10>0$, whereas agent $1$'s payoff difference is $-10$. If agent $1$ can reject and has no compensating benefit or transfer, rejection is strictly preferable.\n\\end{proof}","in which a durable institution has strictly positive aggregate discounted benefit but is rejected by a rational agent who unilaterally bears setup cost and has veto power, assuming quasilinear payoffs, no transfers, and no additional benefits to that agent.\n\\end{proposition}\n\\begin{proof}\nLet the setup cost be $B=10$, borne entirely by agent $1$, and let per-period gains be $g_1=0$, $g_2=2$ with $\\delta=.9$. The aggregate advantage is $-10+2/(1-.9)=10>0$, whereas agent $1$'s payoff difference is $-10$. If agent $1$ can reject and has no compensating benefit or transfer, rejection is strictly preferable.\n\\end{proof}","tly positive aggregate discounted benefit but is rejected by a rational agent who unilaterally bears setup cost and has veto power, assuming quasilinear payoffs, no transfers, and no additional benefits to that agent.\n\\end{proposition}\n\\begin{proof}\nLet the setup cost be $B=10$, borne entirely by agent $1$, and let per-period gains be $g_1=0$, $g_2=2$ with $\\delta=.9$. The aggregate advantage is $-10+2/(1-.9)=10>0$, whereas agent $1$'s payoff difference is $-10$. If agent $1$ can reject and has no compensating benefit or transfer, rejection is strictly preferable.\n\\end{proof}","enefit but is rejected by a rational agent who unilaterally bears setup cost and has veto power, assuming quasilinear payoffs, no transfers, and no additional benefits to that agent.\n\\end{proposition}\n\\begin{proof}\nLet the setup cost be $B=10$, borne entirely by agent $1$, and let per-period gains be $g_1=0$, $g_2=2$ with $\\delta=.9$. The aggregate advantage is $-10+2/(1-.9)=10>0$, whereas agent $1$'s payoff difference is $-10$. If agent $1$ can reject and has no compensating benefit or transfer, rejection is strictly preferable.\n\\end{proof}","rational agent who unilaterally bears setup cost and has veto power, assuming quasilinear payoffs, no transfers, and no additional benefits to that agent.\n\\end{proposition}\n\\begin{proof}\nLet the setup cost be $B=10$, borne entirely by agent $1$, and let per-period gains be $g_1=0$, $g_2=2$ with $\\delta=.9$. The aggregate advantage is $-10+2/(1-.9)=10>0$, whereas agent $1$'s payoff difference is $-10$. If agent $1$ can reject and has no compensating benefit or transfer, rejection is strictly preferable.\n\\end{proof}","who unilaterally bears setup cost and has veto power, assuming quasilinear payoffs, no transfers, and no additional benefits to that agent.\n\\end{proposition}\n\\begin{proof}\nLet the setup cost be $B=10$, borne entirely by agent $1$, and let per-period gains be $g_1=0$, $g_2=2$ with $\\delta=.9$. The aggregate advantage is $-10+2/(1-.9)=10>0$, whereas agent $1$'s payoff difference is $-10$. If agent $1$ can reject and has no compensating benefit or transfer, rejection is strictly preferable.\n\\end{proof}","In an idealized transferable-utility setting there is a corresponding conditional observation. If the discounted net advantages $b_i$ satisfy $\\sum_i b_i\\ge0$, then there exist budget-balanced transfers $t_i$ with $\\sum_i t_i=0$ and $b_i+t_i\\ge0$ for all $i$: choose nonnegative $w_i$ summing to $\\sum_i b_i$ and set $t_i=w_i-b_i$. This algebra does not supply liquidity, a transfer mechanism, consent, enforceability, or a right to redistribute. The difference between mathematical feasible compensation and institutionally permitted compensation is central.","A candidate set of institutional rules $\\mathcal I$ can be made part of a finite strategic environment. Participants have local choices $r_i\\in\\mathcal R_i$, with overall configuration $r=(r_1,\\ldots,r_n)$ and expected utilities $u_i(r)$. A finite game is an \\emph{exact potential game} if there exists $\\Phi(r)$ such that for every unilateral change of $i$,\n\\[\nu_i(r_i',r_{-i})-u_i(r_i,r_{-i})\n=\\Phi(r_i',r_{-i})-\\Phi(r_i,r_{-i}).\n\\]\nThis is the familiar potential-game condition~\\cite{monderer}; it is not generically satisfied by social institutions.","nite exact potential game, every sequence in which each executed unilateral update strictly improves the updating agent's utility has finitely many actual changes. If updates continue whenever an improvement is available, the terminal configuration is a pure-strategy Nash equilibrium. It need not maximize aggregate welfare.\n\\end{proposition}\n\\begin{proof}\nEvery executed update strictly increases $\\Phi$, and a finite game has finitely many configurations and potential values. No configuration can recur along a strictly increasing path, so only finitely many actual changes occur. If the procedure ends only when no agent has a profitable deviation, the terminal state is a pure-strategy Nash equilibrium by definition. A local maximum of $\\Phi$ need not maximize $\\sum_i u_i$.\n\\end{proof}","\\begin{proof}\nEvery executed update strictly increases $\\Phi$, and a finite game has finitely many configurations and potential values. No configuration can recur along a strictly increasing path, so only finitely many actual changes occur. If the procedure ends only when no agent has a profitable deviation, the terminal state is a pure-strategy Nash equilibrium by definition. A local maximum of $\\Phi$ need not maximize $\\sum_i u_i$.\n\\end{proof}","ted update strictly increases $\\Phi$, and a finite game has finitely many configurations and potential values. No configuration can recur along a strictly increasing path, so only finitely many actual changes occur. If the procedure ends only when no agent has a profitable deviation, the terminal state is a pure-strategy Nash equilibrium by definition. A local maximum of $\\Phi$ need not maximize $\\sum_i u_i$.\n\\end{proof}","\\subsection{A formation barrier despite mutual benefit}\nThe stationary cost comparison does not describe a route to adoption. Consider $n\\geq2$ agents choosing $a_i\\in\\{0,1\\}$. An adopter pays cost $c>0$ and receives benefit $b>0$ from each other adopter:\n\\[\nu_i(a)=a_i\\left(b\\sum_{j\\ne i}a_j-c\\right).\n\\]\nNonadopters receive zero. This is a finite network-coordination model, not a universal utility function for societies.","\\begin{proposition}[Institutional formation barrier]\\label{prop:barrier}\nUniversal nonadoption is a strict Nash equilibrium. If $b(n-1)>c$, universal adoption is also a strict Nash equilibrium and gives every agent a strictly higher payoff than universal nonadoption. Nevertheless, no sequence of unilateral strict improvements starting at universal nonadoption can reach adoption.\n\\end{proposition}\n\\begin{proof}\nA lone adopter receives $-c<0$, so no agent benefits from leaving universal nonadoption. At universal adoption, an adopter receives $b(n-1)-c>0$, whereas unilateral exit gives zero. The final assertion follows because no first strictly improving unilateral move is available at the starting state.\n\\end{proof}","tion barrier]\\label{prop:barrier}\nUniversal nonadoption is a strict Nash equilibrium. If $b(n-1)>c$, universal adoption is also a strict Nash equilibrium and gives every agent a strictly higher payoff than universal nonadoption. Nevertheless, no sequence of unilateral strict improvements starting at universal nonadoption can reach adoption.\n\\end{proposition}\n\\begin{proof}\nA lone adopter receives $-c<0$, so no agent benefits from leaving universal nonadoption. At universal adoption, an adopter receives $b(n-1)-c>0$, whereas unilateral exit gives zero. The final assertion follows because no first strictly improving unilateral move is available at the starting state.\n\\end{proof}","al adoption is also a strict Nash equilibrium and gives every agent a strictly higher payoff than universal nonadoption. Nevertheless, no sequence of unilateral strict improvements starting at universal nonadoption can reach adoption.\n\\end{proposition}\n\\begin{proof}\nA lone adopter receives $-c<0$, so no agent benefits from leaving universal nonadoption. At universal adoption, an adopter receives $b(n-1)-c>0$, whereas unilateral exit gives zero. The final assertion follows because no first strictly improving unilateral move is available at the starting state.\n\\end{proof}","\\begin{proposition}[Minimum profitable coordinated seed]\\label{prop:seed}\nStarting from universal nonadoption, a simultaneously adopting coalition of size $m$ makes each member strictly better off exactly when $b(m-1)>c$. When such a coalition exists, the smallest size is\n\\[\nm_* = \\left\\lfloor\\frac cb\\right\\rfloor+2\\leq n.\n\\]\nOnce at least $m_*$ adopters are present, every remaining nonadopter has a profitable unilateral entry. Under a schedule that eventually updates every remaining agent, strict best responses reach universal adoption without an adopter exiting.\n\\end{proposition}\n\\begin{proof}\nEach coalition member has $m-1$ adopting partners and gains $b(m-1)-c$. Solving the strict integer inequality gives $m_*$. For a remaining agent, joining yields $bm-c>0$. Existing adopters retain positive payoff and their payoff increases with entry. Thu","\\begin{proposition}[Minimum profitable coordinated seed]\\label{prop:seed}\nStarting from universal nonadoption, a simultaneously adopting coalition of size $m$ makes each member strictly better off exactly when $b(m-1)>c$. When such a coalition exists, the smallest size is\n\\[\nm_* = \\left\\lfloor\\frac cb\\right\\rfloor+2\\leq n.\n\\]\nOnce at least $m_*$ adopters are present, every remaining nonadopter has a profitable unilateral entry. Under a schedule that eventually updates every remaining agent, strict best responses reach universal adoption without an adopter exiting.\n\\end{proposition}\n\\begin{proof}\nEach coalition member has $m-1$ adopting partners and gains $b(m-1)-c$. Solving the strict integer inequality gives $m_*$. For a remaining agent, joining yields $bm-c>0$. Existing adopters retain positive payoff and their payoff increases with entry. Thus no exit is profitable, and an eventual-update schedule admit","\\begin{proposition}[Minimum profitable coordinated seed]\\label{prop:seed}\nStarting from universal nonadoption, a simultaneously adopting coalition of size $m$ makes each member strictly better off exactly when $b(m-1)>c$. When such a coalition exists, the smallest size is\n\\[\nm_* = \\left\\lfloor\\frac cb\\right\\rfloor+2\\leq n.\n\\]\nOnce at least $m_*$ adopters are present, every remaining nonadopter has a profitable unilateral entry. Under a schedule that eventually updates every remaining agent, strict best responses reach universal adoption without an adopter exiting.\n\\end{proposition}\n\\begin{proof}\nEach coalition member has $m-1$ adopting partners and gains $b(m-1)-c$. Solving the strict integer inequality gives $m_*$. For a remaining agent, joining yields $bm-c>0$. Existing adopters retain positive payoff and their payoff increases with entry. Thus no exit is profitable, and an eventual-update schedule admits every remaining agent.\n\\end{proof}","h a coalition exists, the smallest size is\n\\[\nm_* = \\left\\lfloor\\frac cb\\right\\rfloor+2\\leq n.\n\\]\nOnce at least $m_*$ adopters are present, every remaining nonadopter has a profitable unilateral entry. Under a schedule that eventually updates every remaining agent, strict best responses reach universal adoption without an adopter exiting.\n\\end{proposition}\n\\begin{proof}\nEach coalition member has $m-1$ adopting partners and gains $b(m-1)-c$. Solving the strict integer inequality gives $m_*$. For a remaining agent, joining yields $bm-c>0$. Existing adopters retain positive payoff and their payoff increases with entry. Thus no exit is profitable, and an eventual-update schedule admits every remaining agent.\n\\end{proof}","size is\n\\[\nm_* = \\left\\lfloor\\frac cb\\right\\rfloor+2\\leq n.\n\\]\nOnce at least $m_*$ adopters are present, every remaining nonadopter has a profitable unilateral entry. Under a schedule that eventually updates every remaining agent, strict best responses reach universal adoption without an adopter exiting.\n\\end{proposition}\n\\begin{proof}\nEach coalition member has $m-1$ adopting partners and gains $b(m-1)-c$. Solving the strict integer inequality gives $m_*$. For a remaining agent, joining yields $bm-c>0$. Existing adopters retain positive payoff and their payoff increases with entry. Thus no exit is profitable, and an eventual-update schedule admits every remaining agent.\n\\end{proof}","q n.\n\\]\nOnce at least $m_*$ adopters are present, every remaining nonadopter has a profitable unilateral entry. Under a schedule that eventually updates every remaining agent, strict best responses reach universal adoption without an adopter exiting.\n\\end{proposition}\n\\begin{proof}\nEach coalition member has $m-1$ adopting partners and gains $b(m-1)-c$. Solving the strict integer inequality gives $m_*$. For a remaining agent, joining yields $bm-c>0$. Existing adopters retain positive payoff and their payoff increases with entry. Thus no exit is profitable, and an eventual-update schedule admits every remaining agent.\n\\end{proof}","ent, every remaining nonadopter has a profitable unilateral entry. Under a schedule that eventually updates every remaining agent, strict best responses reach universal adoption without an adopter exiting.\n\\end{proposition}\n\\begin{proof}\nEach coalition member has $m-1$ adopting partners and gains $b(m-1)-c$. Solving the strict integer inequality gives $m_*$. For a remaining agent, joining yields $bm-c>0$. Existing adopters retain positive payoff and their payoff increases with entry. Thus no exit is profitable, and an eventual-update schedule admits every remaining agent.\n\\end{proof}","For $n=4$, $b=1$, and $c=2$, full adoption gives each agent payoff $1$, yet three simultaneous adopters would only break even. Four are needed for a \\emph{strictly} profitable seed. Replacing $>$ with $\\geq$ would change that answer. Figure~\\ref{fig:barrier} separates the outsider's entry gain from an incumbent's maintenance payoff.","\\begin{figure}[tbp]\n\\centering\n\\includegraphics[width=.84\\linewidth]{figures/formation_barrier.pdf}\n\\caption{The exact four-agent coordination example with $b=1$ and $c=2$. Entry gain at $k$ existing adopters is $k-2$; an incumbent's payoff with $k$ total adopters is $k-3$. The curves have different domains because an incumbent exists only for $k\\geq1$ and an outsider only for $k\\leq3$. Zero gain is not a strict improvement.}\\label{fig:barrier}\n\\end{figure}","\\subsection{Path dependence and a qualified hysteresis interpretation}\nFor $0<c<b(n-1)$ both homogeneous states are locally stable. Under a slowly varied \\emph{effective} cost and a best-response rule that retains the current action at ties, universal nonadoption persists until the effective cost becomes negative, while universal adoption persists until it exceeds $b(n-1)$. Negative effective cost represents a net adoption subsidy in this extended parameterization. The distinct switching points describe hysteresis for that specified update process. They are not a thermodynamic phase transition or an inevitable law of institutional development. Different coalition moves, noise, exit costs, or expectations change the path.","\\subsection{What a bounded sanction can distinguish}\nAn agent chooses compliance $C$ or a specified feasible deviation $D$. Before sanctions, $D$ gives expected utility gain $g>0$ over $C$. An observation $o$ in a finite set $\\mathcal O$ has law $P_C$ or $P_D$. The institution commits to a sanction probability $s(o)\\in[0,1]$ with fixed penalty $F>0$, measured in the same utility units. The agent is risk-neutral in this penalty, its collection is feasible and authorized, and all other payoff differences have already been included in $g$. The observation laws and the committed policy are known to the agent.","s, $D$ gives expected utility gain $g>0$ over $C$. An observation $o$ in a finite set $\\mathcal O$ has law $P_C$ or $P_D$. The institution commits to a sanction probability $s(o)\\in[0,1]$ with fixed penalty $F>0$, measured in the same utility units. The agent is risk-neutral in this penalty, its collection is feasible and authorized, and all other payoff differences have already been included in $g$. The observation laws and the committed policy are known to the agent.","Under these assumptions the deviation's net expected advantage is\n\\begin{equation}\\label{eq:deterrence-gap}\ng-F\\bigl(\\E_{P_D}s-\\E_{P_C}s\\bigr).\n\\end{equation}\nCompliance is weakly preferable exactly when this quantity is nonpositive. Equality permits indifference and does not predict which action will be selected.","\\begin{proposition}[The exact bounded-sanction discrimination limit]\\label{prop:deterrence-tv}\nIn this model, some observation-based sanction makes compliance weakly preferable if and only if\n\\[\ng\\leq F\\,\\TV(P_D,P_C).\n\\]\nStrict preference is attainable if and only if the inequality is strict.\n\\end{proposition}\n\\begin{proof}\nWrite $d(o)=P_D(o)-P_C(o)$. Since $\\sum_o d(o)=0$, the sum of its positive terms equals $\\frac12\\sum_o|d(o)|=\\TV(P_D,P_C)$. For every $0\\leq s\\leq1$,\n\\[\n\\sum_o s(o)d(o)\\leq\\sum_{d(o)>0}d(o).\n\\]\nEquality is attained by $s(o)=1$ on the positive terms and zero elsewhere. Substitution into~\\eqref{eq:deterrence-gap} proves both assertions.\n\\end{proof}","ion}[The exact bounded-sanction discrimination limit]\\label{prop:deterrence-tv}\nIn this model, some observation-based sanction makes compliance weakly preferable if and only if\n\\[\ng\\leq F\\,\\TV(P_D,P_C).\n\\]\nStrict preference is attainable if and only if the inequality is strict.\n\\end{proposition}\n\\begin{proof}\nWrite $d(o)=P_D(o)-P_C(o)$. Since $\\sum_o d(o)=0$, the sum of its positive terms equals $\\frac12\\sum_o|d(o)|=\\TV(P_D,P_C)$. For every $0\\leq s\\leq1$,\n\\[\n\\sum_o s(o)d(o)\\leq\\sum_{d(o)>0}d(o).\n\\]\nEquality is attained by $s(o)=1$ on the positive terms and zero elsewhere. Substitution into~\\eqref{eq:deterrence-gap} proves both assertions.\n\\end{proof}","limit]\\label{prop:deterrence-tv}\nIn this model, some observation-based sanction makes compliance weakly preferable if and only if\n\\[\ng\\leq F\\,\\TV(P_D,P_C).\n\\]\nStrict preference is attainable if and only if the inequality is strict.\n\\end{proposition}\n\\begin{proof}\nWrite $d(o)=P_D(o)-P_C(o)$. Since $\\sum_o d(o)=0$, the sum of its positive terms equals $\\frac12\\sum_o|d(o)|=\\TV(P_D,P_C)$. For every $0\\leq s\\leq1$,\n\\[\n\\sum_o s(o)d(o)\\leq\\sum_{d(o)>0}d(o).\n\\]\nEquality is attained by $s(o)=1$ on the positive terms and zero elsewhere. Substitution into~\\eqref{eq:deterrence-gap} proves both assertions.\n\\end{proof}","p:deterrence-tv}\nIn this model, some observation-based sanction makes compliance weakly preferable if and only if\n\\[\ng\\leq F\\,\\TV(P_D,P_C).\n\\]\nStrict preference is attainable if and only if the inequality is strict.\n\\end{proposition}\n\\begin{proof}\nWrite $d(o)=P_D(o)-P_C(o)$. Since $\\sum_o d(o)=0$, the sum of its positive terms equals $\\frac12\\sum_o|d(o)|=\\TV(P_D,P_C)$. For every $0\\leq s\\leq1$,\n\\[\n\\sum_o s(o)d(o)\\leq\\sum_{d(o)>0}d(o).\n\\]\nEquality is attained by $s(o)=1$ on the positive terms and zero elsewhere. Substitution into~\\eqref{eq:deterrence-gap} proves both assertions.\n\\end{proof}","es compliance weakly preferable if and only if\n\\[\ng\\leq F\\,\\TV(P_D,P_C).\n\\]\nStrict preference is attainable if and only if the inequality is strict.\n\\end{proposition}\n\\begin{proof}\nWrite $d(o)=P_D(o)-P_C(o)$. Since $\\sum_o d(o)=0$, the sum of its positive terms equals $\\frac12\\sum_o|d(o)|=\\TV(P_D,P_C)$. For every $0\\leq s\\leq1$,\n\\[\n\\sum_o s(o)d(o)\\leq\\sum_{d(o)>0}d(o).\n\\]\nEquality is attained by $s(o)=1$ on the positive terms and zero elsewhere. Substitution into~\\eqref{eq:deterrence-gap} proves both assertions.\n\\end{proof}","For a concrete two-record example, let\n\\[\nP_C=(3/4,1/4),\\qquad P_D=(1/4,3/4).\n\\]\nThe total variation is $1/2$. Sanctioning on the second record deters gains $g\\leq F/2$, but also sanctions compliance with probability $1/4$. A deterrence certificate without this false-positive rate would omit a major institutional consequence.","\\subsection{False-positive limits and multiple deviations}\nA constitutional protection may impose $\\E_{P_C}s\\leq\\alpha$, with $0\\leq\\alpha\\leq1$. The relevant discrimination capacity is then the finite linear program\n\\begin{equation}\\label{eq:protected-discrimination}\nD_\\alpha(P_D,P_C)=\n\\max_{\\substack{0\\leq s\\leq1","\\subsection{False-positive limits and multiple deviations}\nA constitutional protection may impose $\\E_{P_C}s\\leq\\alpha$, with $0\\leq\\alpha\\leq1$. The relevant discrimination capacity is then the finite linear program\n\\begin{equation}\\label{eq:protected-discrimination}\nD_\\alpha(P_D,P_C)=\n\\max_{\\substack{0\\leq s\\leq1\\\\\\E_{P_C}s\\leq\\alpha}}\n\\bigl(\\E_{P_D}s-\\E_{P_C}s\\bigr).\n\\end{equation}\nThe feasible set is nonempty and compact, so a maximum exists. The preceding proof with the feasible set restricted shows that deterrence is attainable exactly when $g\\leq F D_\\alpha$. For the example above and $\\alpha=1/10$, the optimum is $s=(0,2/5)$, giving $D_\\alpha=1/5$, not $1/2$. Protected error constraints can materially reduce feasible enforcement.","E_{P_C}s\\leq\\alpha}}\n\\bigl(\\E_{P_D}s-\\E_{P_C}s\\bigr).\n\\end{equation}\nThe feasible set is nonempty and compact, so a maximum exists. The preceding proof with the feasible set restricted shows that deterrence is attainable exactly when $g\\leq F D_\\alpha$. For the example above and $\\alpha=1/10$, the optimum is $s=(0,2/5)$, giving $D_\\alpha=1/5$, not $1/2$. Protected error constraints can materially reduce feasible enforcement.","When there are deviations $D_1,\\ldots,D_k$, one common policy must satisfy every incentive inequality. Separate pairwise discrimination bounds are necessary but not sufficient. With $P_C=(1/2,1/2)$, $P_{D_1}=(1,0)$, and $P_{D_2}=(0,1)$, each pair has distance $1/2$, yet the two differences $\\E_{P_{D_j}}s-\\E_{P_C}s$ sum to zero. No common sanction deters strictly positive gains from both deviations. A deployable certificate must retain the joint system of constraints, not select a different optimal monitor after learning which deviation occurred.","\\subsection{Compression can erase enforceable distinctions}\nLet an observation channel $B$ replace $o\\in\\mathcal O$ by a record $z\\in\\mathcal Z$. It may be deterministic compression or a stochastic reporting channel, but must be the same channel under compliance and deviation.","\\begin{proposition}[Garbling does not increase sanctioning capacity]\\label{prop:enforcement-garbling}\nFor every such channel and every $\\alpha\\in[0,1]$,\n\\[\nD_\\alpha(P_D B,P_C B)\\leq D_\\alpha(P_D,P_C).\n\\]\nIn particular, $\\TV(P_D B,P_C B)\\leq\\TV(P_D,P_C)$.\n\\end{proposition}\n\\begin{proof}\nGiven a coarse-record sanction $t(z)$, define $s(o)=\\sum_z B(o,z)t(z)$. It lies in $[0,1]$ and has exactly the same compliance and deviation expectations as $t$ has under the garbled laws. Every feasible coarse policy therefore has a fine-record counterpart with the same objective and false-positive rate. Maximizing proves the first claim; the unrestricted case gives the total-variation statement.\n\\end{proof}","e sanctioning capacity]\\label{prop:enforcement-garbling}\nFor every such channel and every $\\alpha\\in[0,1]$,\n\\[\nD_\\alpha(P_D B,P_C B)\\leq D_\\alpha(P_D,P_C).\n\\]\nIn particular, $\\TV(P_D B,P_C B)\\leq\\TV(P_D,P_C)$.\n\\end{proposition}\n\\begin{proof}\nGiven a coarse-record sanction $t(z)$, define $s(o)=\\sum_z B(o,z)t(z)$. It lies in $[0,1]$ and has exactly the same compliance and deviation expectations as $t$ has under the garbled laws. Every feasible coarse policy therefore has a fine-record counterpart with the same objective and false-positive rate. Maximizing proves the first claim; the unrestricted case gives the total-variation statement.\n\\end{proof}","emented. An auditor may face its own costs, limited resources, or incentives to ignore a violation. A society therefore needs separate contracts for evidence production, decision authority, and execution of a remedy. Collusion, hidden side payments, uncollectible penalties, and changes to the observation process leave the single-agent model. They cannot be repaired by declaring a larger value of $F$. Section~\\ref{sec:strategic-auditor} places a strategic inspector inside a specified game and distinguishes a feasible monitor from an incentive-supported service.","\\subsection{The common-monitor problem}\nLet $O$ be a finite nonempty observation set. Compliance has law $P_C$, and deviation $j\\in\\{1,\\ldots,m\\}$ has law $P_j$ and gross utility advantage $g_j\\geq0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\","\\subsection{The common-monitor problem}\nLet $O$ be a finite nonempty observation set. Compliance has law $P_C$, and deviation $j\\in\\{1,\\ldots,m\\}$ has law $P_j$ and gross utility advantage $g_j\\geq0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWea","\\subsection{The common-monitor problem}\nLet $O$ be a finite nonempty observation set. Compliance has law $P_C$, and deviation $j\\in\\{1,\\ldots,m\\}$ has law $P_j$ and gross utility advantage $g_j\\geq0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviation","\\subsection{The common-monitor problem}\nLet $O$ be a finite nonempty observation set. Compliance has law $P_C$, and deviation $j\\in\\{1,\\ldots,m\\}$ has law $P_j$ and gross utility advantage $g_j\\geq0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamm","\\subsection{The common-monitor problem}\nLet $O$ be a finite nonempty observation set. Compliance has law $P_C$, and deviation $j\\in\\{1,\\ldots,m\\}$ has law $P_j$ and gross utility advantage $g_j\\geq0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamma_\\alpha\\geq0$. Strict deterrence means","\\subsection{The common-monitor problem}\nLet $O$ be a finite nonempty observation set. Compliance has law $P_C$, and deviation $j\\in\\{1,\\ldots,m\\}$ has law $P_j$ and gross utility advantage $g_j\\geq0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamma_\\alpha\\geq0$. Strict deterrence means $\\Gamma_\\alpha>","\\subsection{The common-monitor problem}\nLet $O$ be a finite nonempty observation set. Compliance has law $P_C$, and deviation $j\\in\\{1,\\ldots,m\\}$ has law $P_j$ and gross utility advantage $g_j\\geq0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamma_\\alpha\\geq0$. Strict deterrence means $\\Gamma_\\alpha>0$. At equality a parti","\\subsection{The common-monitor problem}\nLet $O$ be a finite nonempty observation set. Compliance has law $P_C$, and deviation $j\\in\\{1,\\ldots,m\\}$ has law $P_j$ and gross utility advantage $g_j\\geq0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamma_\\alpha\\geq0$. Strict deterrence means $\\Gamma_\\alpha>0$. At equality a participant can remain indifferent. A randomized","\\subsection{The common-monitor problem}\nLet $O$ be a finite nonempty observation set. Compliance has law $P_C$, and deviation $j\\in\\{1,\\ldots,m\\}$ has law $P_j$ and gross utility advantage $g_j\\geq0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamma_\\alpha\\geq0$. Strict deterrence means $\\Gamma_\\alpha>0$. At equality a participant can remain indifferent. A randomized choice among the","\\subsection{The common-monitor problem}\nLet $O$ be a finite nonempty observation set. Compliance has law $P_C$, and deviation $j\\in\\{1,\\ldots,m\\}$ has law $P_j$ and gross utility advantage $g_j\\geq0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamma_\\alpha\\geq0$. Strict deterrence means $\\Gamma_\\alpha>0$. At equality a participant can remain indifferent. A randomized choice among the listed deviations is also deterred when every listed pur","\\subsection{The common-monitor problem}\nLet $O$ be a finite nonempty observation set. Compliance has law $P_C$, and deviation $j\\in\\{1,\\ldots,m\\}$ has law $P_j$ and gross utility advantage $g_j\\geq0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamma_\\alpha\\geq0$. Strict deterrence means $\\Gamma_\\alpha>0$. At equality a participant can remain indifferent. A randomized choice among the listed deviations is also deterred when every listed pure deviation is deterred, since its expected ad…","empty observation set. Compliance has law $P_C$, and deviation $j\\in\\{1,\\ldots,m\\}$ has law $P_j$ and gross utility advantage $g_j\\geq0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamma_\\alpha\\geq0$. Strict deterrence means $\\Gamma_\\alpha>0$. At equality a participant can remain indifferent. A randomized choice among the listed deviations is also deterred when every listed pure deviation is deterred, since its expected advantage is the corresponding convex combination. This does not …","deviation $j\\in\\{1,\\ldots,m\\}$ has law $P_j$ and gross utility advantage $g_j\\geq0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamma_\\alpha\\geq0$. Strict deterrence means $\\Gamma_\\alpha>0$. At equality a participant can remain indifferent. A randomized choice among the listed deviations is also deterred when every listed pure deviation is deterred, since its expected advantage is the corresponding convex combination. This does not include adaptive, repeated, or unlisted deviations un…","0$, where $m\\geq1$. A fixed penalty $F>0$ is applied with probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamma_\\alpha\\geq0$. Strict deterrence means $\\Gamma_\\alpha>0$. At equality a participant can remain indifferent. A randomized choice among the listed deviations is also deterred when every listed pure deviation is deterred, since its expected advantage is the corresponding convex combination. This does not include adaptive, repeated, or unlisted deviations unless their observation laws and payoffs are explicitly represented.","th probability $s(o)\\in[0,1]$ after record $o$. Impose a protected false-positive rate $\\alpha\\in[0,1]$ through the compact polytope\n\\[\n\\mathcal M_\\alpha=\\{s\\in[0,1]^O:\\langle P_C,s\\rangle\\leq\\alpha\\}.\n\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamma_\\alpha\\geq0$. Strict deterrence means $\\Gamma_\\alpha>0$. At equality a participant can remain indifferent. A randomized choice among the listed deviations is also deterred when every listed pure deviation is deterred, since its expected advantage is the corresponding convex combination. This does not include adaptive, repeated, or unlisted deviations unless their observation laws and payoffs are explicitly represented.","\\]\nHere $\\langle P,s\\rangle=\\sum_{o\\in O}P(o)s(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamma_\\alpha\\geq0$. Strict deterrence means $\\Gamma_\\alpha>0$. At equality a participant can remain indifferent. A randomized choice among the listed deviations is also deterred when every listed pure deviation is deterred, since its expected advantage is the corresponding convex combination. This does not include adaptive, repeated, or unlisted deviations unless their observation laws and payoffs are explicitly represented.","(o)$. The same $s$ must be used for every listed deviation. Define its margin against deviation $j$ and its best simultaneous margin by\n\\begin{equation}\\label{eq:joint-margin}\nD_j(s)=F\\langle P_j-P_C,s\\rangle-g_j,\n\\qquad\n\\Gamma_\\alpha=\\max_{s\\in\\mathcal M_\\alpha}\\min_{1\\leq j\\leq m}D_j(s).\n\\end{equation}\nWeak deterrence of all listed deviations means $\\Gamma_\\alpha\\geq0$. Strict deterrence means $\\Gamma_\\alpha>0$. At equality a participant can remain indifferent. A randomized choice among the listed deviations is also deterred when every listed pure deviation is deterred, since its expected advantage is the corresponding convex combination. This does not include adaptive, repeated, or unlisted deviations unless their observation laws and payoffs are explicitly represented.","For a probability vector $\\lambda\\in\\Delta_m$, set $P_\\lambda=\\sum_j\\lambda_jP_j$ and $g_\\lambda=\\sum_j\\lambda_jg_j$. Write\n\\[\nV_\\alpha(P,P_C)=\\max_{s\\in\\mathcal M_\\alpha}\\langle P-P_C,s\\rangle.\n\\]\nThis is the same constrained observation advantage used in the single-deviation analysis, now evaluated on mixtures of deviation laws.","\\begin{theorem}[Simultaneous enforcement and mixture obstruction]\\label{thm:joint-enforcement}\nUnder the finite common-monitor model,\n\\begin{equation}\\label{eq:joint-dual}\n\\Gamma_\\alpha=\\min_{\\lambda\\in\\Delta_m}\n\\bigl(FV_\\alpha(P_\\lambda,P_C)-g_\\lambda\\bigr).\n\\end{equation}\nBoth extrema are attained. Consequently, one monitor weakly deters all listed deviations if and only if $FV_\\alpha(P_\\lambda,P_C)\\geq g_\\lambda$ for every $\\lambda\\in\\Delta_m$. Without an additional false-positive restriction, $\\alpha=1$ and $V_1(P,P_C)=\\TV(P,P_C)$.\n\\end{theorem}\n\\begin{proof}\nFor any fixed $s$, the minimum of the numbers $D_j(s)$ is the minimum of $\\sum_j\\lambda_jD_j(s)$ over $\\Delta_m$. This expression is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix g","\\begin{theorem}[Simultaneous enforcement and mixture obstruction]\\label{thm:joint-enforcement}\nUnder the finite common-monitor model,\n\\begin{equation}\\label{eq:joint-dual}\n\\Gamma_\\alpha=\\min_{\\lambda\\in\\Delta_m}\n\\bigl(FV_\\alpha(P_\\lambda,P_C)-g_\\lambda\\bigr).\n\\end{equation}\nBoth extrema are attained. Consequently, one monitor weakly deters all listed deviations if and only if $FV_\\alpha(P_\\lambda,P_C)\\geq g_\\lambda$ for every $\\lambda\\in\\Delta_m$. Without an additional false-positive restriction, $\\alpha=1$ and $V_1(P,P_C)=\\TV(P,P_C)$.\n\\end{theorem}\n\\begin{proof}\nFor any fixed $s$, the minimum of the numbers $D_j(s)$ is the minimum of $\\sum_j\\lambda_jD_j(s)$ over $\\Delta_m$. This expression is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $F…","forcement and mixture obstruction]\\label{thm:joint-enforcement}\nUnder the finite common-monitor model,\n\\begin{equation}\\label{eq:joint-dual}\n\\Gamma_\\alpha=\\min_{\\lambda\\in\\Delta_m}\n\\bigl(FV_\\alpha(P_\\lambda,P_C)-g_\\lambda\\bigr).\n\\end{equation}\nBoth extrema are attained. Consequently, one monitor weakly deters all listed deviations if and only if $FV_\\alpha(P_\\lambda,P_C)\\geq g_\\lambda$ for every $\\lambda\\in\\Delta_m$. Without an additional false-positive restriction, $\\alpha=1$ and $V_1(P,P_C)=\\TV(P,P_C)$.\n\\end{theorem}\n\\begin{proof}\nFor any fixed $s$, the minimum of the numbers $D_j(s)$ is the minimum of $\\sum_j\\lambda_jD_j(s)$ over $\\Delta_m$. This expression is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lamb…","e finite common-monitor model,\n\\begin{equation}\\label{eq:joint-dual}\n\\Gamma_\\alpha=\\min_{\\lambda\\in\\Delta_m}\n\\bigl(FV_\\alpha(P_\\lambda,P_C)-g_\\lambda\\bigr).\n\\end{equation}\nBoth extrema are attained. Consequently, one monitor weakly deters all listed deviations if and only if $FV_\\alpha(P_\\lambda,P_C)\\geq g_\\lambda$ for every $\\lambda\\in\\Delta_m$. Without an additional false-positive restriction, $\\alpha=1$ and $V_1(P,P_C)=\\TV(P,P_C)$.\n\\end{theorem}\n\\begin{proof}\nFor any fixed $s$, the minimum of the numbers $D_j(s)$ is the minimum of $\\sum_j\\lambda_jD_j(s)$ over $\\Delta_m$. This expression is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give atta…","-monitor model,\n\\begin{equation}\\label{eq:joint-dual}\n\\Gamma_\\alpha=\\min_{\\lambda\\in\\Delta_m}\n\\bigl(FV_\\alpha(P_\\lambda,P_C)-g_\\lambda\\bigr).\n\\end{equation}\nBoth extrema are attained. Consequently, one monitor weakly deters all listed deviations if and only if $FV_\\alpha(P_\\lambda,P_C)\\geq g_\\lambda$ for every $\\lambda\\in\\Delta_m$. Without an additional false-positive restriction, $\\alpha=1$ and $V_1(P,P_C)=\\TV(P,P_C)$.\n\\end{theorem}\n\\begin{proof}\nFor any fixed $s$, the minimum of the numbers $D_j(s)$ is the minimum of $\\sum_j\\lambda_jD_j(s)$ over $\\Delta_m$. This expression is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally…","=\\min_{\\lambda\\in\\Delta_m}\n\\bigl(FV_\\alpha(P_\\lambda,P_C)-g_\\lambda\\bigr).\n\\end{equation}\nBoth extrema are attained. Consequently, one monitor weakly deters all listed deviations if and only if $FV_\\alpha(P_\\lambda,P_C)\\geq g_\\lambda$ for every $\\lambda\\in\\Delta_m$. Without an additional false-positive restriction, $\\alpha=1$ and $V_1(P,P_C)=\\TV(P,P_C)$.\n\\end{theorem}\n\\begin{proof}\nFor any fixed $s$, the minimum of the numbers $D_j(s)$ is the minimum of $\\sum_j\\lambda_jD_j(s)$ over $\\Delta_m$. This expression is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally, when $\\alpha=1$, every $s\\in[0,1]^O$ is admissible. Choosing $s(o…","(FV_\\alpha(P_\\lambda,P_C)-g_\\lambda\\bigr).\n\\end{equation}\nBoth extrema are attained. Consequently, one monitor weakly deters all listed deviations if and only if $FV_\\alpha(P_\\lambda,P_C)\\geq g_\\lambda$ for every $\\lambda\\in\\Delta_m$. Without an additional false-positive restriction, $\\alpha=1$ and $V_1(P,P_C)=\\TV(P,P_C)$.\n\\end{theorem}\n\\begin{proof}\nFor any fixed $s$, the minimum of the numbers $D_j(s)$ is the minimum of $\\sum_j\\lambda_jD_j(s)$ over $\\Delta_m$. This expression is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally, when $\\alpha=1$, every $s\\in[0,1]^O$ is admissible. Choosing $s(o)=1$ exactly where $P(o)>P_C(o)$…","_\\lambda\\bigr).\n\\end{equation}\nBoth extrema are attained. Consequently, one monitor weakly deters all listed deviations if and only if $FV_\\alpha(P_\\lambda,P_C)\\geq g_\\lambda$ for every $\\lambda\\in\\Delta_m$. Without an additional false-positive restriction, $\\alpha=1$ and $V_1(P,P_C)=\\TV(P,P_C)$.\n\\end{theorem}\n\\begin{proof}\nFor any fixed $s$, the minimum of the numbers $D_j(s)$ is the minimum of $\\sum_j\\lambda_jD_j(s)$ over $\\Delta_m$. This expression is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally, when $\\alpha=1$, every $s\\in[0,1]^O$ is admissible. Choosing $s(o)=1$ exactly where $P(o)>P_C(o)$ attains the sum of positiv…","}\nBoth extrema are attained. Consequently, one monitor weakly deters all listed deviations if and only if $FV_\\alpha(P_\\lambda,P_C)\\geq g_\\lambda$ for every $\\lambda\\in\\Delta_m$. Without an additional false-positive restriction, $\\alpha=1$ and $V_1(P,P_C)=\\TV(P,P_C)$.\n\\end{theorem}\n\\begin{proof}\nFor any fixed $s$, the minimum of the numbers $D_j(s)$ is the minimum of $\\sum_j\\lambda_jD_j(s)$ over $\\Delta_m$. This expression is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally, when $\\alpha=1$, every $s\\in[0,1]^O$ is admissible. Choosing $s(o)=1$ exactly where $P(o)>P_C(o)$ attains the sum of positive differences, which equals t…","one monitor weakly deters all listed deviations if and only if $FV_\\alpha(P_\\lambda,P_C)\\geq g_\\lambda$ for every $\\lambda\\in\\Delta_m$. Without an additional false-positive restriction, $\\alpha=1$ and $V_1(P,P_C)=\\TV(P,P_C)$.\n\\end{theorem}\n\\begin{proof}\nFor any fixed $s$, the minimum of the numbers $D_j(s)$ is the minimum of $\\sum_j\\lambda_jD_j(s)$ over $\\Delta_m$. This expression is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally, when $\\alpha=1$, every $s\\in[0,1]^O$ is admissible. Choosing $s(o)=1$ exactly where $P(o)>P_C(o)$ attains the sum of positive differences, which equals total variation.\n\\end{proof}","tor weakly deters all listed deviations if and only if $FV_\\alpha(P_\\lambda,P_C)\\geq g_\\lambda$ for every $\\lambda\\in\\Delta_m$. Without an additional false-positive restriction, $\\alpha=1$ and $V_1(P,P_C)=\\TV(P,P_C)$.\n\\end{theorem}\n\\begin{proof}\nFor any fixed $s$, the minimum of the numbers $D_j(s)$ is the minimum of $\\sum_j\\lambda_jD_j(s)$ over $\\Delta_m$. This expression is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally, when $\\alpha=1$, every $s\\in[0,1]^O$ is admissible. Choosing $s(o)=1$ exactly where $P(o)>P_C(o)$ attains the sum of positive differences, which equals total variation.\n\\end{proof}","minimum of the numbers $D_j(s)$ is the minimum of $\\sum_j\\lambda_jD_j(s)$ over $\\Delta_m$. This expression is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally, when $\\alpha=1$, every $s\\in[0,1]^O$ is admissible. Choosing $s(o)=1$ exactly where $P(o)>P_C(o)$ attains the sum of positive differences, which equals total variation.\n\\end{proof}","_j(s)$ over $\\Delta_m$. This expression is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally, when $\\alpha=1$, every $s\\in[0,1]^O$ is admissible. Choosing $s(o)=1$ exactly where $P(o)>P_C(o)$ attains the sum of positive differences, which equals total variation.\n\\end{proof}","is bilinear in $s$ and $\\lambda$, and both domains are nonempty compact polytopes. Finite minimax, equivalently linear programming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally, when $\\alpha=1$, every $s\\in[0,1]^O$ is admissible. Choosing $s(o)=1$ exactly where $P(o)>P_C(o)$ attains the sum of positive differences, which equals total variation.\n\\end{proof}","ming duality, therefore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally, when $\\alpha=1$, every $s\\in[0,1]^O$ is admissible. Choosing $s(o)=1$ exactly where $P(o)>P_C(o)$ attains the sum of positive differences, which equals total variation.\n\\end{proof}","efore permits interchange of the maximum and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally, when $\\alpha=1$, every $s\\in[0,1]^O$ is admissible. Choosing $s(o)=1$ exactly where $P(o)>P_C(o)$ attains the sum of positive differences, which equals total variation.\n\\end{proof}","um and minimum~\\cite{boydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally, when $\\alpha=1$, every $s\\in[0,1]^O$ is admissible. Choosing $s(o)=1$ exactly where $P(o)>P_C(o)$ attains the sum of positive differences, which equals total variation.\n\\end{proof}","ydconvex}. One can reduce directly to a finite matrix game by listing the vertices of $\\mathcal M_\\alpha$ and taking their convex combinations. For fixed $\\lambda$, the maximized expression is $FV_\\alpha(P_\\lambda,P_C)-g_\\lambda$, proving~\\eqref{eq:joint-dual}. Compactness and continuity give attainment. Finally, when $\\alpha=1$, every $s\\in[0,1]^O$ is admissible. Choosing $s(o)=1$ exactly where $P(o)>P_C(o)$ attains the sum of positive differences, which equals total variation.\n\\end{proof}","The theorem is an application of classical finite convex duality, not a new minimax theorem. Its institutional contribution is the distinction between individual enforceability and a jointly executable sanction policy. A vector $\\lambda$ for which the right side of~\\eqref{eq:joint-dual} is negative is a certificate that the stipulated contract cannot be met. It is not evidence that a real population has adopted that mixture.","\\begin{counterexample}[Individually enforceable deviations with no common monitor]\\label{ex:pairwise-enforcement}\nTake $O=\\{0,1\\}$, $P_C=(1/2,1/2)$, $P_1=(1,0)$, $P_2=(0,1)$, $F=2$, $g_1=g_2=1/2$, and $\\alpha=1/2$. The monitor $(1,0)$ strictly deters deviation $1$, and $(0,1)$ strictly deters deviation $2$. Both respect the false-positive cap. For any common monitor,\n\\[\nD_1(s)=s(0)-s(1)-\\tfrac12,\n\\qquad\nD_2(s)=s(1)-s(0)-\\tfrac12.\n\\]\nTheir sum is $-1$, so both cannot be nonnegative. The best simultaneous margin is $-1/2$, attained when $s(0)=s(1)$. The dual obstruction is $\\lambda=(1/2,1/2)$, for which $P_\\lambda=P_C$ while $g_\\lambda=1/2$.\n\\end{counterexample}","iations with no common monitor]\\label{ex:pairwise-enforcement}\nTake $O=\\{0,1\\}$, $P_C=(1/2,1/2)$, $P_1=(1,0)$, $P_2=(0,1)$, $F=2$, $g_1=g_2=1/2$, and $\\alpha=1/2$. The monitor $(1,0)$ strictly deters deviation $1$, and $(0,1)$ strictly deters deviation $2$. Both respect the false-positive cap. For any common monitor,\n\\[\nD_1(s)=s(0)-s(1)-\\tfrac12,\n\\qquad\nD_2(s)=s(1)-s(0)-\\tfrac12.\n\\]\nTheir sum is $-1$, so both cannot be nonnegative. The best simultaneous margin is $-1/2$, attained when $s(0)=s(1)$. The dual obstruction is $\\lambda=(1/2,1/2)$, for which $P_\\lambda=P_C$ while $g_\\lambda=1/2$.\n\\end{counterexample}","O=\\{0,1\\}$, $P_C=(1/2,1/2)$, $P_1=(1,0)$, $P_2=(0,1)$, $F=2$, $g_1=g_2=1/2$, and $\\alpha=1/2$. The monitor $(1,0)$ strictly deters deviation $1$, and $(0,1)$ strictly deters deviation $2$. Both respect the false-positive cap. For any common monitor,\n\\[\nD_1(s)=s(0)-s(1)-\\tfrac12,\n\\qquad\nD_2(s)=s(1)-s(0)-\\tfrac12.\n\\]\nTheir sum is $-1$, so both cannot be nonnegative. The best simultaneous margin is $-1/2$, attained when $s(0)=s(1)$. The dual obstruction is $\\lambda=(1/2,1/2)$, for which $P_\\lambda=P_C$ while $g_\\lambda=1/2$.\n\\end{counterexample}","1/2)$, $P_1=(1,0)$, $P_2=(0,1)$, $F=2$, $g_1=g_2=1/2$, and $\\alpha=1/2$. The monitor $(1,0)$ strictly deters deviation $1$, and $(0,1)$ strictly deters deviation $2$. Both respect the false-positive cap. For any common monitor,\n\\[\nD_1(s)=s(0)-s(1)-\\tfrac12,\n\\qquad\nD_2(s)=s(1)-s(0)-\\tfrac12.\n\\]\nTheir sum is $-1$, so both cannot be nonnegative. The best simultaneous margin is $-1/2$, attained when $s(0)=s(1)$. The dual obstruction is $\\lambda=(1/2,1/2)$, for which $P_\\lambda=P_C$ while $g_\\lambda=1/2$.\n\\end{counterexample}","$, $g_1=g_2=1/2$, and $\\alpha=1/2$. The monitor $(1,0)$ strictly deters deviation $1$, and $(0,1)$ strictly deters deviation $2$. Both respect the false-positive cap. For any common monitor,\n\\[\nD_1(s)=s(0)-s(1)-\\tfrac12,\n\\qquad\nD_2(s)=s(1)-s(0)-\\tfrac12.\n\\]\nTheir sum is $-1$, so both cannot be nonnegative. The best simultaneous margin is $-1/2$, attained when $s(0)=s(1)$. The dual obstruction is $\\lambda=(1/2,1/2)$, for which $P_\\lambda=P_C$ while $g_\\lambda=1/2$.\n\\end{counterexample}","/2$. The monitor $(1,0)$ strictly deters deviation $1$, and $(0,1)$ strictly deters deviation $2$. Both respect the false-positive cap. For any common monitor,\n\\[\nD_1(s)=s(0)-s(1)-\\tfrac12,\n\\qquad\nD_2(s)=s(1)-s(0)-\\tfrac12.\n\\]\nTheir sum is $-1$, so both cannot be nonnegative. The best simultaneous margin is $-1/2$, attained when $s(0)=s(1)$. The dual obstruction is $\\lambda=(1/2,1/2)$, for which $P_\\lambda=P_C$ while $g_\\lambda=1/2$.\n\\end{counterexample}",")$ strictly deters deviation $1$, and $(0,1)$ strictly deters deviation $2$. Both respect the false-positive cap. For any common monitor,\n\\[\nD_1(s)=s(0)-s(1)-\\tfrac12,\n\\qquad\nD_2(s)=s(1)-s(0)-\\tfrac12.\n\\]\nTheir sum is $-1$, so both cannot be nonnegative. The best simultaneous margin is $-1/2$, attained when $s(0)=s(1)$. The dual obstruction is $\\lambda=(1/2,1/2)$, for which $P_\\lambda=P_C$ while $g_\\lambda=1/2$.\n\\end{counterexample}","Distinct deviations can cancel one another's observable signatures at the level of a mixture. Pairwise total-variation distances therefore do not determine joint enforceability. Increasing the penalty cannot resolve the particular obstruction $P_\\lambda=P_C$ with $g_\\lambda>0$. The contract must change its observation channel, permitted interventions, payoff structure, or covered claims. None of these changes is automatically authorized.","\\subsection{Uncertainty must be absorbed by the same monitor}\nAveraging, translation, and statistical approximation can change the estimated observation laws. The preceding optimization does not remove those errors. Let $\\widehat P_C,\\widehat P_j$ be specified approximate laws with\n\\[\n\\TV(P_C,\\widehat P_C)\\leq\\epsilon_C,\n\\qquad\n\\TV(P_j,\\widehat P_j)\\leq\\epsilon_j.\n\\]\nThe bounds may be different for different deviations. They must concern the complete record available to the sanction mechanism, including any effects of review scheduling.","\\begin{proposition}[A robust simultaneous enforcement certificate]\\label{prop:joint-robust}\nLet $\\alpha\\geq\\epsilon_C$ and $\\eta\\geq0$. If a single $s\\in[0,1]^O$ satisfies\n\\begin{align}\n\\langle\\widehat P_C,s\\rangle&\\leq\\alpha-\\epsilon_C,\\label{eq:joint-robust-cap}","\\begin{proposition}[A robust simultaneous enforcement certificate]\\label{prop:joint-robust}\nLet $\\alpha\\geq\\epsilon_C$ and $\\eta\\geq0$. If a single $s\\in[0,1]^O$ satisfies\n\\begin{align}\n\\langle\\widehat P_C,s\\rangle&\\leq\\alpha-\\epsilon_C,\\label{eq:joint-robust-cap}\\\\\nF\\langle\\widehat P_j-\\widehat P_C,s\\rangle-g_j\n&\\geq\\eta+F(\\epsilon_j+\\epsilon_C)\n\\quad\\text{for every }j,\\label{eq:joint-robust-gap}\n\\end{align}\nthen the true false-positive rate is at most $\\alpha$ and every true margin $D_j(s)$ is at least $\\eta$.\n\\end{proposition}\n\\begin{proof}\nFor every function $0\\leq s\\leq1$, the difference of its expectations under two laws is bounded in absolute value by their total-variation distance. Applying this once to the compliance rate proves~\\eqref{eq:joint-robust-cap}'s conclusion. Applying it to both laws in each difference gives\n\\[\nD_j(s)\\geq F\\langle\\widehat P_j-\\widehat P_C,s\\rangle-g_j\n-F(\\epsilon_j+\\epsilon_C)\\geq\\eta.\n\\]\nThe same $s$ appears in all inequalities, so the conclusion is simultaneous.\n\\end{proof}","F\\langle\\widehat P_j-\\widehat P_C,s\\rangle-g_j\n&\\geq\\eta+F(\\epsilon_j+\\epsilon_C)\n\\quad\\text{for every }j,\\label{eq:joint-robust-gap}\n\\end{align}\nthen the true false-positive rate is at most $\\alpha$ and every true margin $D_j(s)$ is at least $\\eta$.\n\\end{proposition}\n\\begin{proof}\nFor every function $0\\leq s\\leq1$, the difference of its expectations under two laws is bounded in absolute value by their total-variation distance. Applying this once to the compliance rate proves~\\eqref{eq:joint-robust-cap}'s conclusion. Applying it to both laws in each difference gives\n\\[\nD_j(s)\\geq F\\langle\\widehat P_j-\\widehat P_C,s\\rangle-g_j\n-F(\\epsilon_j+\\epsilon_C)\\geq\\eta.\n\\]\nThe same $s$ appears in all inequalities, so the conclusion is simultaneous.\n\\end{proof}","rate is at most $\\alpha$ and every true margin $D_j(s)$ is at least $\\eta$.\n\\end{proposition}\n\\begin{proof}\nFor every function $0\\leq s\\leq1$, the difference of its expectations under two laws is bounded in absolute value by their total-variation distance. Applying this once to the compliance rate proves~\\eqref{eq:joint-robust-cap}'s conclusion. Applying it to both laws in each difference gives\n\\[\nD_j(s)\\geq F\\langle\\widehat P_j-\\widehat P_C,s\\rangle-g_j\n-F(\\epsilon_j+\\epsilon_C)\\geq\\eta.\n\\]\nThe same $s$ appears in all inequalities, so the conclusion is simultaneous.\n\\end{proof}","For every function $0\\leq s\\leq1$, the difference of its expectations under two laws is bounded in absolute value by their total-variation distance. Applying this once to the compliance rate proves~\\eqref{eq:joint-robust-cap}'s conclusion. Applying it to both laws in each difference gives\n\\[\nD_j(s)\\geq F\\langle\\widehat P_j-\\widehat P_C,s\\rangle-g_j\n-F(\\epsilon_j+\\epsilon_C)\\geq\\eta.\n\\]\nThe same $s$ appears in all inequalities, so the conclusion is simultaneous.\n\\end{proof}","This is a sufficient certificate, not a necessary description of all robustly feasible policies. Replacing each law by an independent worst-case error bound can be conservative when the errors are related. If $\\alpha<\\epsilon_C$, the particular tightened test is unavailable, but that does not prove that every actual monitor violates the true cap. The proposition extends Proposition~\\ref{prop:robust-deterrence} to a common monitor rather than separately optimized monitors.","\\subsection{What an enforcement certificate should contain}\nThe optimization is a small linear program with variables $(s,t)$, constraints $D_j(s)\\geq t$, the box bounds on $s$, and the false-positive cap. A usable certificate records the monitor, every listed gain and observation law, the authority to impose the penalty, its collectibility assumption, and the checked margins. A negative certificate can instead record a mixture $\\lambda$ and an upper bound for its constrained observation advantage.","ertificate should contain}\nThe optimization is a small linear program with variables $(s,t)$, constraints $D_j(s)\\geq t$, the box bounds on $s$, and the false-positive cap. A usable certificate records the monitor, every listed gain and observation law, the authority to impose the penalty, its collectibility assumption, and the checked margins. A negative certificate can instead record a mixture $\\lambda$ and an upper bound for its constrained observation advantage.","\\section{Social choice and principled disagreement}\\label{sec:choice}\nPlurality cannot be retained while silently replacing all preferences with one externally supplied reward. Even agents that agree on every fact can rank institutional alternatives differently. Let the alternatives be three policies $R,U,V$ and let three voters have strict preferences\n\\[\nR\\succ_1 U\\succ_1 V,\\qquad\nU\\succ_2 V\\succ_2 R,\\qquad\nV\\succ_3 R\\succ_3 U.\n\\]","\\begin{counterexample}[Truthful majority cycle]\\label{ex:majority}\nPairwise majority prefers $R$ to $U$, $U$ to $V$, and $V$ to $R$, each by two votes to one. Every individual order is transitive. No erroneous report or mistaken inference is needed for the majority relation to cycle.\n\\end{counterexample}","In successive pairwise elimination, agenda order can select any of the three final winners. To obtain $R$, compare $U$ with $V$ first, then compare their winner $U$ with $R$. Cyclic symmetry gives the other outcomes. This is an analytic example of agenda power, not a claim that majority decision is unusable.","Let $s=(x,I)$ be the full operating state and let $R(s,s')$ be the admitted transition relation, including ordinary actions and amendments. A safety property is a predicate $\\Psi(s)$.","\\begin{proposition}[Constitutional inductive safety]\\label{prop:safety}\nIf $\\Psi(s_0)$ and every admitted transition satisfies\n\\[\n\\Psi(s)\\wedge R(s,s')\\Longrightarrow\\Psi(s'),\n\\]\nthen $\\Psi(s_t)$ holds for every state reachable by finitely many admitted transitions.\n\\end{proposition}\n\\begin{proof}\nInduction on the number of admitted transitions.\n\\end{proof}","This standard invariant is useful precisely because its assumptions are explicit. It certifies safety relative to $R$. It does not establish that the implemented system obeys $R$, that the predicate is ethically adequate, or that a decision can always be reached. A protocol can satisfy a safety condition by refusing to act forever. Timing and failures enter liveness analysis separately; distributed consensus already has sharp impossibility limits under specified asynchronous assumptions~\\cite{flp}.","\\begin{counterexample}[An unchecked change of the checker]\\label{ex:checker}\nLet the institutional state contain a validator mode $v\\in\\{\\mathsf{strict},\\mathsf{open}\\}$ and a resource policy $p\\in\\{\\mathsf{safe},\\mathsf{unsafe}\\}$. Under $v=\\mathsf{strict}$, the current policy must remain safe, but the validator mode itself is unprotected. Thus $(\\mathsf{strict},\\mathsf{safe})\\to(\\mathsf{open},\\mathsf{safe})$ is admitted. Under $v=\\mathsf{open}$, any policy transition is admitted, including $(\\mathsf{open},\\mathsf{safe})\\to(\\mathsf{open},\\mathsf{unsafe})$. The original current-policy check does not imply that all reachable states remain safe. To prove that property, the inductive predicate and transition obligations must include permissible changes to the validation mechanism itself.\n\\end{counterexample}","d change of the checker]\\label{ex:checker}\nLet the institutional state contain a validator mode $v\\in\\{\\mathsf{strict},\\mathsf{open}\\}$ and a resource policy $p\\in\\{\\mathsf{safe},\\mathsf{unsafe}\\}$. Under $v=\\mathsf{strict}$, the current policy must remain safe, but the validator mode itself is unprotected. Thus $(\\mathsf{strict},\\mathsf{safe})\\to(\\mathsf{open},\\mathsf{safe})$ is admitted. Under $v=\\mathsf{open}$, any policy transition is admitted, including $(\\mathsf{open},\\mathsf{safe})\\to(\\mathsf{open},\\mathsf{unsafe})$. The original current-policy check does not imply that all reachable states remain safe. To prove that property, the inductive predicate and transition obligations must include permissible changes to the validation mechanism itself.\n\\end{counterexample}","state contain a validator mode $v\\in\\{\\mathsf{strict},\\mathsf{open}\\}$ and a resource policy $p\\in\\{\\mathsf{safe},\\mathsf{unsafe}\\}$. Under $v=\\mathsf{strict}$, the current policy must remain safe, but the validator mode itself is unprotected. Thus $(\\mathsf{strict},\\mathsf{safe})\\to(\\mathsf{open},\\mathsf{safe})$ is admitted. Under $v=\\mathsf{open}$, any policy transition is admitted, including $(\\mathsf{open},\\mathsf{safe})\\to(\\mathsf{open},\\mathsf{unsafe})$. The original current-policy check does not imply that all reachable states remain safe. To prove that property, the inductive predicate and transition obligations must include permissible changes to the validation mechanism itself.\n\\end{counterexample}","An invariant proof checks that \\emph{every permitted transition} preserves a property. A different question asks whether an institution has a \\emph{choice of actions} that will preserve a protected property even when the environment responds stochastically. This can be formulated as a finite viability problem. Let $S$ be a finite subset of safe states, let $A(s)$ be the finite set of available actions at $s$, and let $K(\\cdot\\mid s,a)$ be the transition law on a finite full state space. The state must include every variable needed for its Markov representation, including the operative amendment rules.","ant proof checks that \\emph{every permitted transition} preserves a property. A different question asks whether an institution has a \\emph{choice of actions} that will preserve a protected property even when the environment responds stochastically. This can be formulated as a finite viability problem. Let $S$ be a finite subset of safe states, let $A(s)$ be the finite set of available actions at $s$, and let $K(\\cdot\\mid s,a)$ be the transition law on a finite full state space. The state must include every variable needed for its Markov representation, including the operative amendment rules.","cks that \\emph{every permitted transition} preserves a property. A different question asks whether an institution has a \\emph{choice of actions} that will preserve a protected property even when the environment responds stochastically. This can be formulated as a finite viability problem. Let $S$ be a finite subset of safe states, let $A(s)$ be the finite set of available actions at $s$, and let $K(\\cdot\\mid s,a)$ be the transition law on a finite full state space. The state must include every variable needed for its Markov representation, including the operative amendment rules.","Define $V_0=S$ and recursively, for $h\\ge0$,\n\\begin{equation}\\label{eq:viability}\nV_{h+1}=\\Bigl\\{s\\in S:\\exists a\\in A(s)\\;\\text{such that}\\;\n\\operatorname{supp}K(\\cdot\\mid s,a)\\subseteq V_h\\Bigr\\}.\n\\end{equation}\n\\begin{proposition}[Finite-horizon almost-sure institutional viability]\\label{prop:viability}\nA state $s$ belongs to $V_h$ if and only if there exists an admissible policy under which every state visited over the next $h$ transitions, including the present state, lies in $S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it ho","Define $V_0=S$ and recursively, for $h\\ge0$,\n\\begin{equation}\\label{eq:viability}\nV_{h+1}=\\Bigl\\{s\\in S:\\exists a\\in A(s)\\;\\text{such that}\\;\n\\operatorname{supp}K(\\cdot\\mid s,a)\\subseteq V_h\\Bigr\\}.\n\\end{equation}\n\\begin{proposition}[Finite-horizon almost-sure institutional viability]\\label{prop:viability}\nA state $s$ belongs to $V_h$ if and only if there exists an admissible policy under which every state visited over the next $h$ transitions, including the present state, lies in $S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$","Define $V_0=S$ and recursively, for $h\\ge0$,\n\\begin{equation}\\label{eq:viability}\nV_{h+1}=\\Bigl\\{s\\in S:\\exists a\\in A(s)\\;\\text{such that}\\;\n\\operatorname{supp}K(\\cdot\\mid s,a)\\subseteq V_h\\Bigr\\}.\n\\end{equation}\n\\begin{proposition}[Finite-horizon almost-sure institutional viability]\\label{prop:viability}\nA state $s$ belongs to $V_h$ if and only if there exists an admissible policy under which every state visited over the next $h$ transitions, including the present state, lies in $S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can b","Define $V_0=S$ and recursively, for $h\\ge0$,\n\\begin{equation}\\label{eq:viability}\nV_{h+1}=\\Bigl\\{s\\in S:\\exists a\\in A(s)\\;\\text{such that}\\;\n\\operatorname{supp}K(\\cdot\\mid s,a)\\subseteq V_h\\Bigr\\}.\n\\end{equation}\n\\begin{proposition}[Finite-horizon almost-sure institutional viability]\\label{prop:viability}\nA state $s$ belongs to $V_h$ if and only if there exists an admissible policy under which every state visited over the next $h$ transitions, including the present state, lies in $S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can be kept safe. By the induction hypothesis, these are exactly $V_h$. Thus admissible first actions are precisely those in","Define $V_0=S$ and recursively, for $h\\ge0$,\n\\begin{equation}\\label{eq:viability}\nV_{h+1}=\\Bigl\\{s\\in S:\\exists a\\in A(s)\\;\\text{such that}\\;\n\\operatorname{supp}K(\\cdot\\mid s,a)\\subseteq V_h\\Bigr\\}.\n\\end{equation}\n\\begin{proposition}[Finite-horizon almost-sure institutional viability]\\label{prop:viability}\nA state $s$ belongs to $V_h$ if and only if there exists an admissible policy under which every state visited over the next $h$ transitions, including the present state, lies in $S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can be kept safe. By the induction hypothesis, these are exactly $V_h$. Thus admissible first actions are precisely those in the definition o","or $h\\ge0$,\n\\begin{equation}\\label{eq:viability}\nV_{h+1}=\\Bigl\\{s\\in S:\\exists a\\in A(s)\\;\\text{such that}\\;\n\\operatorname{supp}K(\\cdot\\mid s,a)\\subseteq V_h\\Bigr\\}.\n\\end{equation}\n\\begin{proposition}[Finite-horizon almost-sure institutional viability]\\label{prop:viability}\nA state $s$ belongs to $V_h$ if and only if there exists an admissible policy under which every state visited over the next $h$ transitions, including the present state, lies in $S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can be kept safe. By the induction hypothesis, these are exactly $V_h$. Thus admissible first actions are precisely those in the definition of $V_{h+1}$. Choosing a witnessing action at each state and remaining horizon supplies a time-depe…","1}=\\Bigl\\{s\\in S:\\exists a\\in A(s)\\;\\text{such that}\\;\n\\operatorname{supp}K(\\cdot\\mid s,a)\\subseteq V_h\\Bigr\\}.\n\\end{equation}\n\\begin{proposition}[Finite-horizon almost-sure institutional viability]\\label{prop:viability}\nA state $s$ belongs to $V_h$ if and only if there exists an admissible policy under which every state visited over the next $h$ transitions, including the present state, lies in $S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can be kept safe. By the induction hypothesis, these are exactly $V_h$. Thus admissible first actions are precisely those in the definition of $V_{h+1}$. Choosing a witnessing action at each state and remaining horizon supplies a time-dependent Markov policy. Conversely, if no such action exi…","q V_h\\Bigr\\}.\n\\end{equation}\n\\begin{proposition}[Finite-horizon almost-sure institutional viability]\\label{prop:viability}\nA state $s$ belongs to $V_h$ if and only if there exists an admissible policy under which every state visited over the next $h$ transitions, including the present state, lies in $S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can be kept safe. By the induction hypothesis, these are exactly $V_h$. Thus admissible first actions are precisely those in the definition of $V_{h+1}$. Choosing a witnessing action at each state and remaining horizon supplies a time-dependent Markov policy. Conversely, if no such action exists, every first action assigns positive probability to a successor from which the required remain…","y]\\label{prop:viability}\nA state $s$ belongs to $V_h$ if and only if there exists an admissible policy under which every state visited over the next $h$ transitions, including the present state, lies in $S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can be kept safe. By the induction hypothesis, these are exactly $V_h$. Thus admissible first actions are precisely those in the definition of $V_{h+1}$. Choosing a witnessing action at each state and remaining horizon supplies a time-dependent Markov policy. Conversely, if no such action exists, every first action assigns positive probability to a successor from which the required remaining guarantee is impossible. Randomizing over actions cannot remove that positive failure probabil…","prop:viability}\nA state $s$ belongs to $V_h$ if and only if there exists an admissible policy under which every state visited over the next $h$ transitions, including the present state, lies in $S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can be kept safe. By the induction hypothesis, these are exactly $V_h$. Thus admissible first actions are precisely those in the definition of $V_{h+1}$. Choosing a witnessing action at each state and remaining horizon supplies a time-dependent Markov policy. Conversely, if no such action exists, every first action assigns positive probability to a successor from which the required remaining guarantee is impossible. Randomizing over actions cannot remove that positive failure probability unles…","elongs to $V_h$ if and only if there exists an admissible policy under which every state visited over the next $h$ transitions, including the present state, lies in $S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can be kept safe. By the induction hypothesis, these are exactly $V_h$. Thus admissible first actions are precisely those in the definition of $V_{h+1}$. Choosing a witnessing action at each state and remaining horizon supplies a time-dependent Markov policy. Conversely, if no such action exists, every first action assigns positive probability to a successor from which the required remaining guarantee is impossible. Randomizing over actions cannot remove that positive failure probability unless all positively chosen actio…","and only if there exists an admissible policy under which every state visited over the next $h$ transitions, including the present state, lies in $S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can be kept safe. By the induction hypothesis, these are exactly $V_h$. Thus admissible first actions are precisely those in the definition of $V_{h+1}$. Choosing a witnessing action at each state and remaining horizon supplies a time-dependent Markov policy. Conversely, if no such action exists, every first action assigns positive probability to a successor from which the required remaining guarantee is impossible. Randomizing over actions cannot remove that positive failure probability unless all positively chosen actions are themselves w","nder which every state visited over the next $h$ transitions, including the present state, lies in $S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can be kept safe. By the induction hypothesis, these are exactly $V_h$. Thus admissible first actions are precisely those in the definition of $V_{h+1}$. Choosing a witnessing action at each state and remaining horizon supplies a time-dependent Markov policy. Conversely, if no such action exists, every first action assigns positive probability to a successor from which the required remaining guarantee is impossible. Randomizing over actions cannot remove that positive failure probability unless all positively chosen actions are themselves witnessing actions.\n\\end{proof}","$S$ with probability one. Policies may use the full observed state and the remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can be kept safe. By the induction hypothesis, these are exactly $V_h$. Thus admissible first actions are precisely those in the definition of $V_{h+1}$. Choosing a witnessing action at each state and remaining horizon supplies a time-dependent Markov policy. Conversely, if no such action exists, every first action assigns positive probability to a successor from which the required remaining guarantee is impossible. Randomizing over actions cannot remove that positive failure probability unless all positively chosen actions are themselves witnessing actions.\n\\end{proof}","remaining horizon. For $s\\in V_h$, a time-dependent Markov policy suffices.\n\\end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can be kept safe. By the induction hypothesis, these are exactly $V_h$. Thus admissible first actions are precisely those in the definition of $V_{h+1}$. Choosing a witnessing action at each state and remaining horizon supplies a time-dependent Markov policy. Conversely, if no such action exists, every first action assigns positive probability to a successor from which the required remaining guarantee is impossible. Randomizing over actions cannot remove that positive failure probability unless all positively chosen actions are themselves witnessing actions.\n\\end{proof}","end{proposition}\n\\begin{proof}\nThe claim at $h=0$ is $V_0=S$. Suppose it holds at $h$. To remain in $S$ almost surely for another step and then for $h$ further steps, the first action must have support entirely in states from which the remaining $h$ steps can be kept safe. By the induction hypothesis, these are exactly $V_h$. Thus admissible first actions are precisely those in the definition of $V_{h+1}$. Choosing a witnessing action at each state and remaining horizon supplies a time-dependent Markov policy. Conversely, if no such action exists, every first action assigns positive probability to a successor from which the required remaining guarantee is impossible. Randomizing over actions cannot remove that positive failure probability unless all positively chosen actions are themselves witnessing actions.\n\\end{proof}","Fix a bounded amendment episode. Let $s\\to s'$ mean one permitted amendment step, and let $\\to^*$ be its reflexive transitive closure. The episode state contains any pending proposals, version counters, permissions, and consequence records required by the contract. It is \\emph{terminating} if it has no infinite chain of actual steps, and \\emph{locally confluent} if\n\\[\ns\\to a,\\ s\\to b\\quad\\Longrightarrow\\quad\n\\exists c:\\ a\\to^*c\\ \\text{and}\\ b\\to^*c.\n\\]\nConfluence imposes the same condition on arbitrary finite descendants of $s$. A normal form has no outgoing amendment step. Reversibility of an entire society need not be prohibited: termination is a property of this episode, not a requirement that all future institutions stop changing.","re. The episode state contains any pending proposals, version counters, permissions, and consequence records required by the contract. It is \\emph{terminating} if it has no infinite chain of actual steps, and \\emph{locally confluent} if\n\\[\ns\\to a,\\ s\\to b\\quad\\Longrightarrow\\quad\n\\exists c:\\ a\\to^*c\\ \\text{and}\\ b\\to^*c.\n\\]\nConfluence imposes the same condition on arbitrary finite descendants of $s$. A normal form has no outgoing amendment step. Reversibility of an entire society need not be prohibited: termination is a property of this episode, not a requirement that all future institutions stop changing.","nt normal forms]\\label{thm:confluence}\nA terminating, locally confluent amendment relation is confluent. Each starting state has a unique reachable normal form, so every maximal amendment sequence ends at that normal form. This is Newman's lemma applied to the declared institutional transition relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","l{thm:confluence}\nA terminating, locally confluent amendment relation is confluent. Each starting state has a unique reachable normal form, so every maximal amendment sequence ends at that normal form. This is Newman's lemma applied to the declared institutional transition relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","fluence}\nA terminating, locally confluent amendment relation is confluent. Each starting state has a unique reachable normal form, so every maximal amendment sequence ends at that normal form. This is Newman's lemma applied to the declared institutional transition relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","ndment relation is confluent. Each starting state has a unique reachable normal form, so every maximal amendment sequence ends at that normal form. This is Newman's lemma applied to the declared institutional transition relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","starting state has a unique reachable normal form, so every maximal amendment sequence ends at that normal form. This is Newman's lemma applied to the declared institutional transition relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","a unique reachable normal form, so every maximal amendment sequence ends at that normal form. This is Newman's lemma applied to the declared institutional transition relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","maximal amendment sequence ends at that normal form. This is Newman's lemma applied to the declared institutional transition relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","mendment sequence ends at that normal form. This is Newman's lemma applied to the declared institutional transition relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","nce ends at that normal form. This is Newman's lemma applied to the declared institutional transition relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","ewman's lemma applied to the declared institutional transition relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","mma applied to the declared institutional transition relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","the declared institutional transition relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","transition relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","n relation~\\cite{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","te{newman}.\n\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","\\end{theorem}\n\\begin{proof}\nUse well-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","ll-founded induction on strict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","rict descendants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","ants of $s$. For descendants $y,z$ of $s$, there is nothing to prove if one equals $s$. Otherwise choose first steps $s\\to a\\to^*y$ and $s\\to b\\to^*z$. Local confluence supplies $c$ with $a\\to^*c$ and $b\\to^*c$. The induction hypothesis at $a$ joins $y,c$ at some $p$, and the hypothesis at $b$ joins $z,c$ at some $q$. Since $c$ is also a strict descendant of $s$, its hypothesis joins $p,q$. Thus $y,z$ have a common descendant. Termination ensures a normal form is reached along every maximal sequence. Two reachable normal forms must coincide because confluence gives a common descendant and neither can move.\n\\end{proof}","\\subsection{Endpoint agreement does not erase path effects}\nSuppose two amendment paths restore the same final policy, but the first allocates an irreversible resource to office $A$ while the second allocates it to $B$. A state consisting only of the final policy may have a unique normal form; the allocation record does not. Therefore endpoint confluence of a policy projection does not imply equal costs, equal waiting times, or equal histories of rights violations.","\\subsection{Convergent records and valid decisions}\nLet $(L,\\vee)$ be a join-semilattice, with order $a\\leq b$ when $a\\vee b=b$. A replica holds $\\ell_i\\in L$. In the following restricted model a local update joins a declared contribution $\\delta$ into the state, and a merge replaces $\\ell_i$ by $\\ell_i\\vee\\ell_j$. Contributions are fixed elements of $L$ once created. This is a state-merge construction of the kind used in conflict-free replicated data types~\\cite{preguicacrdt}. The algebra concerns accepted data, not the authenticity of its source.","\\begin{proposition}[Quiescent convergence and invariant preservation]\\label{prop:merge-convergence}\nAssume finitely many replicas begin at $\\ell_0$, only finitely many contributions $\\delta_1,\\ldots,\\delta_N$ are created, and every contribution eventually becomes included in every replica. Then each replica eventually equals\n\\[\n\\ell^\\star=\\ell_0\\vee\\delta_1\\vee\\cdots\\vee\\delta_N,\n\\]\nindependently of merge order and duplicate deliveries. Moreover, let $V\\subseteq L$ contain the initial state. If every permitted local update maps $V$ into $V$ and $V$ is closed under $\\vee$, every local and merged state remains in $V$.\n\\end{proposition}\n\\begin{proof}\nAt every step a replica is the join of $\\ell_0$ and some created contributions. Associativity, commutativity, and idempotence remove ordering and duplication effects. Once every contribution","\\begin{proposition}[Quiescent convergence and invariant preservation]\\label{prop:merge-convergence}\nAssume finitely many replicas begin at $\\ell_0$, only finitely many contributions $\\delta_1,\\ldots,\\delta_N$ are created, and every contribution eventually becomes included in every replica. Then each replica eventually equals\n\\[\n\\ell^\\star=\\ell_0\\vee\\delta_1\\vee\\cdots\\vee\\delta_N,\n\\]\nindependently of merge order and duplicate deliveries. Moreover, let $V\\subseteq L$ contain the initial state. If every permitted local update maps $V$ into $V$ and $V$ is closed under $\\vee$, every local and merged state remains in $V$.\n\\end{proposition}\n\\begin{proof}\nAt every step a replica is the join of $\\ell_0$ and some created contributions. Associativity, commutativity, and idempotence remove ordering and duplication effects. Once every contribution has reached a replica, its state is $\\ell^\\star$ and cannot","\\begin{proposition}[Quiescent convergence and invariant preservation]\\label{prop:merge-convergence}\nAssume finitely many replicas begin at $\\ell_0$, only finitely many contributions $\\delta_1,\\ldots,\\delta_N$ are created, and every contribution eventually becomes included in every replica. Then each replica eventually equals\n\\[\n\\ell^\\star=\\ell_0\\vee\\delta_1\\vee\\cdots\\vee\\delta_N,\n\\]\nindependently of merge order and duplicate deliveries. Moreover, let $V\\subseteq L$ contain the initial state. If every permitted local update maps $V$ into $V$ and $V$ is closed under $\\vee$, every local and merged state remains in $V$.\n\\end{proposition}\n\\begin{proof}\nAt every step a replica is the join of $\\ell_0$ and some created contributions. Associativity, commutativity, and idempotence remove ordering and duplication effects. Once every contribution has reached a replica, its state is $\\ell^\\star$ and cannot subsequently change. Finiteness of the replicas and contributions gives a finite point after which this holds everywhere. For the second claim, induction over local updates and","preservation]\\label{prop:merge-convergence}\nAssume finitely many replicas begin at $\\ell_0$, only finitely many contributions $\\delta_1,\\ldots,\\delta_N$ are created, and every contribution eventually becomes included in every replica. Then each replica eventually equals\n\\[\n\\ell^\\star=\\ell_0\\vee\\delta_1\\vee\\cdots\\vee\\delta_N,\n\\]\nindependently of merge order and duplicate deliveries. Moreover, let $V\\subseteq L$ contain the initial state. If every permitted local update maps $V$ into $V$ and $V$ is closed under $\\vee$, every local and merged state remains in $V$.\n\\end{proposition}\n\\begin{proof}\nAt every step a replica is the join of $\\ell_0$ and some created contributions. Associativity, commutativity, and idempotence remove ordering and duplication effects. Once every contribution has reached a replica, its state is $\\ell^\\star$ and cannot subsequently change. Finiteness of the replicas and contributions gives a finite point after which this holds everywhere. For the second claim, induction over local updates and merges preserves membership in $V$ by the two closure assumptions.\n\\end{…","at $\\ell_0$, only finitely many contributions $\\delta_1,\\ldots,\\delta_N$ are created, and every contribution eventually becomes included in every replica. Then each replica eventually equals\n\\[\n\\ell^\\star=\\ell_0\\vee\\delta_1\\vee\\cdots\\vee\\delta_N,\n\\]\nindependently of merge order and duplicate deliveries. Moreover, let $V\\subseteq L$ contain the initial state. If every permitted local update maps $V$ into $V$ and $V$ is closed under $\\vee$, every local and merged state remains in $V$.\n\\end{proposition}\n\\begin{proof}\nAt every step a replica is the join of $\\ell_0$ and some created contributions. Associativity, commutativity, and idempotence remove ordering and duplication effects. Once every contribution has reached a replica, its state is $\\ell^\\star$ and cannot subsequently change. Finiteness of the replicas and contributions gives a finite point after which this holds everywhere. For the second claim, induction over local updates and merges preserves membership in $V$ by the two closure assumptions.\n\\end{proof}","_0$, only finitely many contributions $\\delta_1,\\ldots,\\delta_N$ are created, and every contribution eventually becomes included in every replica. Then each replica eventually equals\n\\[\n\\ell^\\star=\\ell_0\\vee\\delta_1\\vee\\cdots\\vee\\delta_N,\n\\]\nindependently of merge order and duplicate deliveries. Moreover, let $V\\subseteq L$ contain the initial state. If every permitted local update maps $V$ into $V$ and $V$ is closed under $\\vee$, every local and merged state remains in $V$.\n\\end{proposition}\n\\begin{proof}\nAt every step a replica is the join of $\\ell_0$ and some created contributions. Associativity, commutativity, and idempotence remove ordering and duplication effects. Once every contribution has reached a replica, its state is $\\ell^\\star$ and cannot subsequently change. Finiteness of the replicas and contributions gives a finite point after which this holds everywhere. For the second claim, induction over local updates and merges preserves membership in $V$ by the two closure assumptions.\n\\end{proof}","y finitely many contributions $\\delta_1,\\ldots,\\delta_N$ are created, and every contribution eventually becomes included in every replica. Then each replica eventually equals\n\\[\n\\ell^\\star=\\ell_0\\vee\\delta_1\\vee\\cdots\\vee\\delta_N,\n\\]\nindependently of merge order and duplicate deliveries. Moreover, let $V\\subseteq L$ contain the initial state. If every permitted local update maps $V$ into $V$ and $V$ is closed under $\\vee$, every local and merged state remains in $V$.\n\\end{proposition}\n\\begin{proof}\nAt every step a replica is the join of $\\ell_0$ and some created contributions. Associativity, commutativity, and idempotence remove ordering and duplication effects. Once every contribution has reached a replica, its state is $\\ell^\\star$ and cannot subsequently change. Finiteness of the replicas and contributions gives a finite point after which this holds everywhere. For the second claim, induction over local updates and merges preserves membership in $V$ by the two closure assumptions.\n\\end{proof}","ributions $\\delta_1,\\ldots,\\delta_N$ are created, and every contribution eventually becomes included in every replica. Then each replica eventually equals\n\\[\n\\ell^\\star=\\ell_0\\vee\\delta_1\\vee\\cdots\\vee\\delta_N,\n\\]\nindependently of merge order and duplicate deliveries. Moreover, let $V\\subseteq L$ contain the initial state. If every permitted local update maps $V$ into $V$ and $V$ is closed under $\\vee$, every local and merged state remains in $V$.\n\\end{proposition}\n\\begin{proof}\nAt every step a replica is the join of $\\ell_0$ and some created contributions. Associativity, commutativity, and idempotence remove ordering and duplication effects. Once every contribution has reached a replica, its state is $\\ell^\\star$ and cannot subsequently change. Finiteness of the replicas and contributions gives a finite point after which this holds everywhere. For the second claim, induction over local updates and merges preserves membership in $V$ by the two closure assumptions.\n\\end{proof}",", and every contribution eventually becomes included in every replica. Then each replica eventually equals\n\\[\n\\ell^\\star=\\ell_0\\vee\\delta_1\\vee\\cdots\\vee\\delta_N,\n\\]\nindependently of merge order and duplicate deliveries. Moreover, let $V\\subseteq L$ contain the initial state. If every permitted local update maps $V$ into $V$ and $V$ is closed under $\\vee$, every local and merged state remains in $V$.\n\\end{proposition}\n\\begin{proof}\nAt every step a replica is the join of $\\ell_0$ and some created contributions. Associativity, commutativity, and idempotence remove ordering and duplication effects. Once every contribution has reached a replica, its state is $\\ell^\\star$ and cannot subsequently change. Finiteness of the replicas and contributions gives a finite point after which this holds everywhere. For the second claim, induction over local updates and merges preserves membership in $V$ by the two closure assumptions.\n\\end{proof}","each replica eventually equals\n\\[\n\\ell^\\star=\\ell_0\\vee\\delta_1\\vee\\cdots\\vee\\delta_N,\n\\]\nindependently of merge order and duplicate deliveries. Moreover, let $V\\subseteq L$ contain the initial state. If every permitted local update maps $V$ into $V$ and $V$ is closed under $\\vee$, every local and merged state remains in $V$.\n\\end{proposition}\n\\begin{proof}\nAt every step a replica is the join of $\\ell_0$ and some created contributions. Associativity, commutativity, and idempotence remove ordering and duplication effects. Once every contribution has reached a replica, its state is $\\ell^\\star$ and cannot subsequently change. Finiteness of the replicas and contributions gives a finite point after which this holds everywhere. For the second claim, induction over local updates and merges preserves membership in $V$ by the two closure assumptions.\n\\end{proof}","itial state. If every permitted local update maps $V$ into $V$ and $V$ is closed under $\\vee$, every local and merged state remains in $V$.\n\\end{proposition}\n\\begin{proof}\nAt every step a replica is the join of $\\ell_0$ and some created contributions. Associativity, commutativity, and idempotence remove ordering and duplication effects. Once every contribution has reached a replica, its state is $\\ell^\\star$ and cannot subsequently change. Finiteness of the replicas and contributions gives a finite point after which this holds everywhere. For the second claim, induction over local updates and merges preserves membership in $V$ by the two closure assumptions.\n\\end{proof}","ated contributions. Associativity, commutativity, and idempotence remove ordering and duplication effects. Once every contribution has reached a replica, its state is $\\ell^\\star$ and cannot subsequently change. Finiteness of the replicas and contributions gives a finite point after which this holds everywhere. For the second claim, induction over local updates and merges preserves membership in $V$ by the two closure assumptions.\n\\end{proof}","For causal event records, one may take $L$ to be the downward-closed subsets of a fixed finite event partial order, with union as join. A receiver must retain an event's prerequisites or wait until they arrive. Downward closure preserves a causal dependency record. It does not certify that a signature is authentic, that an issuer held authority, or that two concurrent grants are jointly permissible.","\\begin{counterexample}[Convergence can preserve a record of an invalid allocation]\\label{ex:convergent-double-grant}\nOne resource token $r$ must have at most one irrevocable grantee. Two replicas start with the empty grant set. One records $(r,A)$ and the other $(r,B)$, for $A\\ne B$. Both singleton records satisfy the exclusivity predicate. Their set union does not. Nevertheless, union merging converges exactly, and every replica eventually agrees on the two-grant record.\n\\end{counterexample}","\\begin{theorem}[No universal constitutional safety decider]\\label{thm:undecidable}\nThere is no total algorithm that decides safety for every program in this class. In the same class, occurrence of the forbidden event is semidecidable, whereas safety is not semidecidable in general.\n\\end{theorem}\n\\begin{proof}\nGiven a Turing machine $M$ and input $w$, construct a program $P_{M,w}$ that simulates $M(w)$ and produces the forbidden event exactly when the simulation halts. Each simulation step is computable and terminates. The constructed program is safe exactly when $M(w)$ does not halt. A total safety decider would decide halting by complementing its answer, contradicting the classical undecidability result~\\cite{turing}.","same class, occurrence of the forbidden event is semidecidable, whereas safety is not semidecidable in general.\n\\end{theorem}\n\\begin{proof}\nGiven a Turing machine $M$ and input $w$, construct a program $P_{M,w}$ that simulates $M(w)$ and produces the forbidden event exactly when the simulation halts. Each simulation step is computable and terminates. The constructed program is safe exactly when $M(w)$ does not halt. A total safety decider would decide halting by complementing its answer, contradicting the classical undecidability result~\\cite{turing}.","Fix two hidden environmental conditions $\\theta\\in\\{0,1\\}$ and a class of admissible protocols. For one protocol, let $H$ be the tuple of all local histories up to the decision, together with the private and shared random tapes used to choose actions. The tapes have their specified law and cannot encode extra information about $\\theta$. The joint action is a measurable function of $H$ even though no participant need be able to read all of $H$. Let $P_0$ and $P_1$ be its laws under the two conditions.","eta\\in\\{0,1\\}$ and a class of admissible protocols. For one protocol, let $H$ be the tuple of all local histories up to the decision, together with the private and shared random tapes used to choose actions. The tapes have their specified law and cannot encode extra information about $\\theta$. The joint action is a measurable function of $H$ even though no participant need be able to read all of $H$. Let $P_0$ and $P_1$ be its laws under the two conditions.",",1\\}$ and a class of admissible protocols. For one protocol, let $H$ be the tuple of all local histories up to the decision, together with the private and shared random tapes used to choose actions. The tapes have their specified law and cannot encode extra information about $\\theta$. The joint action is a measurable function of $H$ even though no participant need be able to read all of $H$. Let $P_0$ and $P_1$ be its laws under the two conditions.","a class of admissible protocols. For one protocol, let $H$ be the tuple of all local histories up to the decision, together with the private and shared random tapes used to choose actions. The tapes have their specified law and cannot encode extra information about $\\theta$. The joint action is a measurable function of $H$ even though no participant need be able to read all of $H$. Let $P_0$ and $P_1$ be its laws under the two conditions.","\\begin{theorem}[Indistinguishability obstruction to joint safety]\\label{thm:decsafe}\nLet $B_0$ and $B_1$ be disjoint subsets of a common finite joint-action alphabet, containing the actions that meet a declared requirement under conditions $0$ and $1$. If the laws of $H$ are within $\\eta$ in total variation, then\n\\[\nP_0(B_0)+P_1(B_1)\\leq1+\\eta.\n\\]\nConsequently at least one condition has failure probability at least $(1-\\eta)/2$. If every admissible protocol has identical joint-history laws under the conditions, no admissible protocol can meet the requirement almost surely in both.\n\\end{theorem}\n\\begin{proof}\nTotal variation does not increase under the function mapping histories and tapes to joint actions, so $\\TV(P_0,P_1)\\leq\\eta$. Therefore\n\\[\nP_0(B_0)+P_1(B_1)\n\\leq P_1(B_0)+\\eta+P","\\begin{theorem}[Indistinguishability obstruction to joint safety]\\label{thm:decsafe}\nLet $B_0$ and $B_1$ be disjoint subsets of a common finite joint-action alphabet, containing the actions that meet a declared requirement under conditions $0$ and $1$. If the laws of $H$ are within $\\eta$ in total variation, then\n\\[\nP_0(B_0)+P_1(B_1)\\leq1+\\eta.\n\\]\nConsequently at least one condition has failure probability at least $(1-\\eta)/2$. If every admissible protocol has identical joint-history laws under the conditions, no admissible protocol can meet the requirement almost surely in both.\n\\end{theorem}\n\\begin{proof}\nTotal variation does not increase under the function mapping histories and tapes to joint actions, so $\\TV(P_0,P_1)\\leq\\eta$. Therefore\n\\[\nP_0(B_0)+P_1(B_1)\n\\leq P_1(B_0)+\\eta+P_1(B_1)\\le","\\begin{theorem}[Indistinguishability obstruction to joint safety]\\label{thm:decsafe}\nLet $B_0$ and $B_1$ be disjoint subsets of a common finite joint-action alphabet, containing the actions that meet a declared requirement under conditions $0$ and $1$. If the laws of $H$ are within $\\eta$ in total variation, then\n\\[\nP_0(B_0)+P_1(B_1)\\leq1+\\eta.\n\\]\nConsequently at least one condition has failure probability at least $(1-\\eta)/2$. If every admissible protocol has identical joint-history laws under the conditions, no admissible protocol can meet the requirement almost surely in both.\n\\end{theorem}\n\\begin{proof}\nTotal variation does not increase under the function mapping histories and tapes to joint actions, so $\\TV(P_0,P_1)\\leq\\eta$. Therefore\n\\[\nP_0(B_0)+P_1(B_1)\n\\leq P_1(B_0)+\\eta+P_1(B_1)\\leq1+\\eta,\n\\]\nsince the two safe sets are disjoint. Subtracting the success probabilities from two gives a total failure of at least $1-\\eta$","\\begin{theorem}[Indistinguishability obstruction to joint safety]\\label{thm:decsafe}\nLet $B_0$ and $B_1$ be disjoint subsets of a common finite joint-action alphabet, containing the actions that meet a declared requirement under conditions $0$ and $1$. If the laws of $H$ are within $\\eta$ in total variation, then\n\\[\nP_0(B_0)+P_1(B_1)\\leq1+\\eta.\n\\]\nConsequently at least one condition has failure probability at least $(1-\\eta)/2$. If every admissible protocol has identical joint-history laws under the conditions, no admissible protocol can meet the requirement almost surely in both.\n\\end{theorem}\n\\begin{proof}\nTotal variation does not increase under the function mapping histories and tapes to joint actions, so $\\TV(P_0,P_1)\\leq\\eta$. Therefore\n\\[\nP_0(B_0)+P_1(B_1)\n\\leq P_1(B_0)+\\eta+P_1(B_1)\\leq1+\\eta,\n\\]\nsince the two safe sets are disjoint. Subtracting the success probabilities from two gives a total failure of at least $1-\\eta$, so one","\\begin{theorem}[Indistinguishability obstruction to joint safety]\\label{thm:decsafe}\nLet $B_0$ and $B_1$ be disjoint subsets of a common finite joint-action alphabet, containing the actions that meet a declared requirement under conditions $0$ and $1$. If the laws of $H$ are within $\\eta$ in total variation, then\n\\[\nP_0(B_0)+P_1(B_1)\\leq1+\\eta.\n\\]\nConsequently at least one condition has failure probability at least $(1-\\eta)/2$. If every admissible protocol has identical joint-history laws under the conditions, no admissible protocol can meet the requirement almost surely in both.\n\\end{theorem}\n\\begin{proof}\nTotal variation does not increase under the function mapping histories and tapes to joint actions, so $\\TV(P_0,P_1)\\leq\\eta$. Therefore\n\\[\nP_0(B_0)+P_1(B_1)\n\\leq P_1(B_0)+\\eta+P_1(B_1)\\leq1+\\eta,\n\\]\nsince the two safe sets are disjoint. Subtracting the success probabilities from two gives a total failure of at least $1-\\eta$, so one failure probability","\\begin{theorem}[Indistinguishability obstruction to joint safety]\\label{thm:decsafe}\nLet $B_0$ and $B_1$ be disjoint subsets of a common finite joint-action alphabet, containing the actions that meet a declared requirement under conditions $0$ and $1$. If the laws of $H$ are within $\\eta$ in total variation, then\n\\[\nP_0(B_0)+P_1(B_1)\\leq1+\\eta.\n\\]\nConsequently at least one condition has failure probability at least $(1-\\eta)/2$. If every admissible protocol has identical joint-history laws under the conditions, no admissible protocol can meet the requirement almost surely in both.\n\\end{theorem}\n\\begin{proof}\nTotal variation does not increase under the function mapping histories and tapes to joint actions, so $\\TV(P_0,P_1)\\leq\\eta$. Therefore\n\\[\nP_0(B_0)+P_1(B_1)\n\\leq P_1(B_0)+\\eta+P_1(B_1)\\leq1+\\eta,\n\\]\nsince the two safe sets are disjoint. Subtracting the success probabilities from two gives a total failure of at least $1-\\eta$, so one failure probability is at least half","\\begin{theorem}[Indistinguishability obstruction to joint safety]\\label{thm:decsafe}\nLet $B_0$ and $B_1$ be disjoint subsets of a common finite joint-action alphabet, containing the actions that meet a declared requirement under conditions $0$ and $1$. If the laws of $H$ are within $\\eta$ in total variation, then\n\\[\nP_0(B_0)+P_1(B_1)\\leq1+\\eta.\n\\]\nConsequently at least one condition has failure probability at least $(1-\\eta)/2$. If every admissible protocol has identical joint-history laws under the conditions, no admissible protocol can meet the requirement almost surely in both.\n\\end{theorem}\n\\begin{proof}\nTotal variation does not increase under the function mapping histories and tapes to joint actions, so $\\TV(P_0,P_1)\\leq\\eta$. Therefore\n\\[\nP_0(B_0)+P_1(B_1)\n\\leq P_1(B_0)+\\eta+P_1(B_1)\\leq1+\\eta,\n\\]\nsince the two safe sets are disjoint. Subtracting the success probabilities from two gives a total failure of at least $1-\\eta$, so one failure probability is at least half that amount. Set $\\eta=0$ for the final assertion.\n\\end{pro","stinguishability obstruction to joint safety]\\label{thm:decsafe}\nLet $B_0$ and $B_1$ be disjoint subsets of a common finite joint-action alphabet, containing the actions that meet a declared requirement under conditions $0$ and $1$. If the laws of $H$ are within $\\eta$ in total variation, then\n\\[\nP_0(B_0)+P_1(B_1)\\leq1+\\eta.\n\\]\nConsequently at least one condition has failure probability at least $(1-\\eta)/2$. If every admissible protocol has identical joint-history laws under the conditions, no admissible protocol can meet the requirement almost surely in both.\n\\end{theorem}\n\\begin{proof}\nTotal variation does not increase under the function mapping histories and tapes to joint actions, so $\\TV(P_0,P_1)\\leq\\eta$. Therefore\n\\[\nP_0(B_0)+P_1(B_1)\n\\leq P_1(B_0)+\\eta+P_1(B_1)\\leq1+\\eta,\n\\]\nsince the two safe sets are disjoint. Subtracting the success probabilities from two gives a total failure of at least $1-\\eta$, so one failure probability is at least half that amount. Set $\\eta=0$ for the final assertion.\n\\end{proof}","_0(B_0)+P_1(B_1)\\leq1+\\eta.\n\\]\nConsequently at least one condition has failure probability at least $(1-\\eta)/2$. If every admissible protocol has identical joint-history laws under the conditions, no admissible protocol can meet the requirement almost surely in both.\n\\end{theorem}\n\\begin{proof}\nTotal variation does not increase under the function mapping histories and tapes to joint actions, so $\\TV(P_0,P_1)\\leq\\eta$. Therefore\n\\[\nP_0(B_0)+P_1(B_1)\n\\leq P_1(B_0)+\\eta+P_1(B_1)\\leq1+\\eta,\n\\]\nsince the two safe sets are disjoint. Subtracting the success probabilities from two gives a total failure of at least $1-\\eta$, so one failure probability is at least half that amount. Set $\\eta=0$ for the final assertion.\n\\end{proof}","equently at least one condition has failure probability at least $(1-\\eta)/2$. If every admissible protocol has identical joint-history laws under the conditions, no admissible protocol can meet the requirement almost surely in both.\n\\end{theorem}\n\\begin{proof}\nTotal variation does not increase under the function mapping histories and tapes to joint actions, so $\\TV(P_0,P_1)\\leq\\eta$. Therefore\n\\[\nP_0(B_0)+P_1(B_1)\n\\leq P_1(B_0)+\\eta+P_1(B_1)\\leq1+\\eta,\n\\]\nsince the two safe sets are disjoint. Subtracting the success probabilities from two gives a total failure of at least $1-\\eta$, so one failure probability is at least half that amount. Set $\\eta=0$ for the final assertion.\n\\end{proof}","ocol can meet the requirement almost surely in both.\n\\end{theorem}\n\\begin{proof}\nTotal variation does not increase under the function mapping histories and tapes to joint actions, so $\\TV(P_0,P_1)\\leq\\eta$. Therefore\n\\[\nP_0(B_0)+P_1(B_1)\n\\leq P_1(B_0)+\\eta+P_1(B_1)\\leq1+\\eta,\n\\]\nsince the two safe sets are disjoint. Subtracting the success probabilities from two gives a total failure of at least $1-\\eta$, so one failure probability is at least half that amount. Set $\\eta=0$ for the final assertion.\n\\end{proof}","in{proof}\nTotal variation does not increase under the function mapping histories and tapes to joint actions, so $\\TV(P_0,P_1)\\leq\\eta$. Therefore\n\\[\nP_0(B_0)+P_1(B_1)\n\\leq P_1(B_0)+\\eta+P_1(B_1)\\leq1+\\eta,\n\\]\nsince the two safe sets are disjoint. Subtracting the success probabilities from two gives a total failure of at least $1-\\eta$, so one failure probability is at least half that amount. Set $\\eta=0$ for the final assertion.\n\\end{proof}","\\subsection{Why separate marginal ignorance is insufficient}\n\\begin{counterexample}[Local ignorance with a perfectly correct joint action]\\label{ex:jointviews}\nLet $U$ be a fair bit. Agent 1 observes $H_1=U$ and agent 2 observes $H_2=U\\oplus\\theta$. Each individual observation has the same law for both values of $\\theta$. Nevertheless, the joint action $(a_1,a_2)=(H_1,H_2)$ always satisfies $a_1\\oplus a_2=\\theta$. The joint observation laws differ and have disjoint supports. Equal marginal laws therefore do not imply the hypothesis of Theorem~\\ref{thm:decsafe}.\n\\end{counterexample}","\\subsection{A full-information safe action that the institution cannot select}\nSuppose a slot must be assigned immediately to office $A$ when $\\theta=0$ and to office $B$ when $\\theta=1$. Every predecision observation and message is constant under both conditions. A full-information scheduler can satisfy the requirement exactly, but any allowed decentralized protocol has the same grant distribution under both. With an available shared fair coin the best worst-case success is $1/2$, attained by a random grant. A deterministic rule fails in at least one condition.","ppose a slot must be assigned immediately to office $A$ when $\\theta=0$ and to office $B$ when $\\theta=1$. Every predecision observation and message is constant under both conditions. A full-information scheduler can satisfy the requirement exactly, but any allowed decentralized protocol has the same grant distribution under both. With an available shared fair coin the best worst-case success is $1/2$, attained by a random grant. A deterministic rule fails in at least one condition.","tibility, and knowledge}\n\\section{Temporal obligations, contracts, and office succession}\\label{sec:obligations}\nPermissions describe available actions; obligations constrain continuations. The debt created by an urgency exchange is not satisfied merely because the creditor remains authorized to ask for service. It requires a particular future event. A finite obligation record can be written as\n\\[\no=(\\mathsf{id},i,j,\\varphi,d,\\mathsf{authority},\\mathsf{status}),\n\\]\nwhere $i$ and $j$ are the debtor and beneficiary offices, $\\varphi$ specifies a fulfillment event, and $d$ is a deadline under an agreed clock. Status distinguishes pending, fulfilled, breached, and validly discharged obligations. Cancellation must itself satisfy the declared authorization rule; deleting a record is not fulfillment.","succession}\\label{sec:obligations}\nPermissions describe available actions; obligations constrain continuations. The debt created by an urgency exchange is not satisfied merely because the creditor remains authorized to ask for service. It requires a particular future event. A finite obligation record can be written as\n\\[\no=(\\mathsf{id},i,j,\\varphi,d,\\mathsf{authority},\\mathsf{status}),\n\\]\nwhere $i$ and $j$ are the debtor and beneficiary offices, $\\varphi$ specifies a fulfillment event, and $d$ is a deadline under an agreed clock. Status distinguishes pending, fulfilled, breached, and validly discharged obligations. Cancellation must itself satisfy the declared authorization rule; deleting a record is not fulfillment.","ion}\\label{sec:obligations}\nPermissions describe available actions; obligations constrain continuations. The debt created by an urgency exchange is not satisfied merely because the creditor remains authorized to ask for service. It requires a particular future event. A finite obligation record can be written as\n\\[\no=(\\mathsf{id},i,j,\\varphi,d,\\mathsf{authority},\\mathsf{status}),\n\\]\nwhere $i$ and $j$ are the debtor and beneficiary offices, $\\varphi$ specifies a fulfillment event, and $d$ is a deadline under an agreed clock. Status distinguishes pending, fulfilled, breached, and validly discharged obligations. Cancellation must itself satisfy the declared authorization rule; deleting a record is not fulfillment.","ribe available actions; obligations constrain continuations. The debt created by an urgency exchange is not satisfied merely because the creditor remains authorized to ask for service. It requires a particular future event. A finite obligation record can be written as\n\\[\no=(\\mathsf{id},i,j,\\varphi,d,\\mathsf{authority},\\mathsf{status}),\n\\]\nwhere $i$ and $j$ are the debtor and beneficiary offices, $\\varphi$ specifies a fulfillment event, and $d$ is a deadline under an agreed clock. Status distinguishes pending, fulfilled, breached, and validly discharged obligations. Cancellation must itself satisfy the declared authorization rule; deleting a record is not fulfillment.","continuations. The debt created by an urgency exchange is not satisfied merely because the creditor remains authorized to ask for service. It requires a particular future event. A finite obligation record can be written as\n\\[\no=(\\mathsf{id},i,j,\\varphi,d,\\mathsf{authority},\\mathsf{status}),\n\\]\nwhere $i$ and $j$ are the debtor and beneficiary offices, $\\varphi$ specifies a fulfillment event, and $d$ is a deadline under an agreed clock. Status distinguishes pending, fulfilled, breached, and validly discharged obligations. Cancellation must itself satisfy the declared authorization rule; deleting a record is not fulfillment.","For a bounded deadline $D$, a trace requirement has the form\n\\[\n\\mathbf G\\bigl(\\mathsf{created}(o)\\Rightarrow\n\\mathbf F_{\\leq D}\\mathsf{settled}(o)\\bigr).\n\\]\nHere $\\mathsf{settled}$ means fulfilled or validly discharged. The temporal operators mean ``at every position'' and ``within at most $D$ subsequent clock steps.'' The obligation identifier binds the later event to the same commitment. No implication of ethical adequacy follows from admitting discharge in this particular contract.","\\subsection{Monitoring deadlines without confusing safety and liveness}\nA finite monitor stores pending identifiers, remaining deadlines, and terminal statuses. For a finite identifier pool, at most $M$ active obligations, and deadlines bounded by $D$, this is a finite state machine. Events at a deadline are processed before the clock advances beyond it. A missing fulfillment becomes a violation only once that last permitted event has passed. Resource unavailability, clock failure, and unresolved appeals must have declared transition semantics rather than being silently ignored.","Let $m:S\\to Q$ map a complete institutional state to its obligation-monitor state, and let $\\nu(a)$ give the monitored event label of action $a$. Correct realization requires\n\\[\nm(F(s,a))=\\delta(m(s),\\nu(a))\n\\]\nfor every enabled action, with the clock update included in $\\nu$. The monitor has its own bad-state predicate.","\\begin{proposition}[Obligation-preserving succession and translation]\\label{prop:obligationtransport}\nConsider two deterministic realizations with the same monitored event alphabet and monitor update $\\delta$. Suppose a translation $T$ preserves the initial monitor state and the two executions follow the same event sequence, with each realization satisfying the monitor equation. Then their monitor states agree after every finite prefix. In particular, fulfillment, valid discharge, and deadline violations agree at corresponding positions. An office handover that preserves the obligation record is one instance, provided later events and clocks satisfy these hypotheses.\n\\end{proposition}\n\\begin{proof}\nThe monitor states agree initially. If they agree after a prefix, applying the same deterministic update $\\delta$ to the same next event preserves equality. Induction gives equality at every prefix,","\\begin{proposition}[Obligation-preserving succession and translation]\\label{prop:obligationtransport}\nConsider two deterministic realizations with the same monitored event alphabet and monitor update $\\delta$. Suppose a translation $T$ preserves the initial monitor state and the two executions follow the same event sequence, with each realization satisfying the monitor equation. Then their monitor states agree after every finite prefix. In particular, fulfillment, valid discharge, and deadline violations agree at corresponding positions. An office handover that preserves the obligation record is one instance, provided later events and clocks satisfy these hypotheses.\n\\end{proposition}\n\\begin{proof}\nThe monitor states agree initially. If they agree after a prefix, applying the same deterministic update $\\delta$ to the same next event preserves equality. Induction gives equality at every prefix, and therefore equality of e","after every finite prefix. In particular, fulfillment, valid discharge, and deadline violations agree at corresponding positions. An office handover that preserves the obligation record is one instance, provided later events and clocks satisfy these hypotheses.\n\\end{proposition}\n\\begin{proof}\nThe monitor states agree initially. If they agree after a prefix, applying the same deterministic update $\\delta$ to the same next event preserves equality. Induction gives equality at every prefix, and therefore equality of every status predicate on the monitor state.\n\\end{proof}","Let a history $H$ be summarized by an inheritance map $C(H)$. A practically meaningful retained state can be divided into an active canon $M^{\\rm act}$ for immediate use, an archive $M^{\\rm arc}$ for recovery and criticism, and a provenance and uncertainty record $P$. These stores can overlap physically, but serve distinct decision contracts. The canon keeps interaction costs low. The archive makes forgotten exceptions, alternative explanations, and evidence recoverable. Provenance records why a claim should be trusted, not merely that it was inherited.","A cultural contract $\\mathcal Q$ may specify future queries, operations, resource policies, amendment procedures, and recognized classes of correction. Two histories may be compressed to the same state only if the required future decisions and authorized operations remain indistinguishable under $\\mathcal Q$, exactly or within a stated tolerance. Section~\\ref{sec:memory} supplies a finite-memory lower bound: distinct future-relevant histories cannot be combined in an exact deterministic summary. Culture is therefore an information-preservation problem with a \\emph{normative choice of relevant futures}, not a license to summarize arbitrarily.","Machine populations may change their internal languages and storage formats. The right question about a translator is whether it preserves \\emph{operations}, not only whether its output looks fluent. Suppose generation $j$ uses a metric state space $(Z_j,d_j)$, update operator $F_j:Z_j\\to Z_j$, and translator $T_j:Z_j\\to Z_{j+1}$. The one-step compatibility defect is\n\\begin{equation}\\label{eq:transport-defect}\n\\varepsilon_j=\\sup_{z\\in Z_j}d_{j+1}\\bigl(T_jF_j(z),F_{j+1}T_j(z)\\bigr).\n\\end{equation}\nAn exact zero defect means the representation change intertwines the declared operation. It does not mean all information is preserved; injectivity or an appropriate reconstruction contract is a separate issue.","\\begin{proposition}[Accumulation of cultural transport defects]\\label{prop:transport}\nAssume each $T_j$ is $L_j$-Lipschitz and $\\varepsilon_j<\\infty$ for $j=0,\\ldots,m-1$. Define $T_{0:m}=T_{m-1}\\cdots T_0$. For every $z\\in Z_0$,\n\\begin{equation}\\label{eq:cumulative-transport}\n\\begin{split}\n&d_m\\bigl(T_{0:m}F_0(z),F_mT_{0:m}(z)\\bigr)","\\begin{proposition}[Accumulation of cultural transport defects]\\label{prop:transport}\nAssume each $T_j$ is $L_j$-Lipschitz and $\\varepsilon_j<\\infty$ for $j=0,\\ldots,m-1$. Define $T_{0:m}=T_{m-1}\\cdots T_0$. For every $z\\in Z_0$,\n\\begin{equation}\\label{eq:cumulative-transport}\n\\begin{split}\n&d_m\\bigl(T_{0:m}F_0(z),F_mT_{0:m}(z)\\bigr)\\\\\n&\\qquad\\le\\sum_{j=0}^{m-1}\\varepsilon_j\\prod_{k=j+1}^{m-1}L_k,\n\\end{split}\n\\end{equation}\nwith empty products equal to $1$.\n\\end{proposition}\n\\begin{proof}\nFor $m=1$ this is the definition of $\\varepsilon_0$. Suppose the bound holds through generation $m-1$. Insert $T_{m-1}F_{m-1}T_{0:m-1}(z)$ between the two terms at generation $m$. Lipschitz continuity of $T_{m-1}$ bounds the first difference by $L_{m-1}$ times the prior defect, while~\\eqref{eq:transport-defect} bounds the second by $\\varepsilon_{m-1}$. The recurrence $D_m\\le L_{m-1}D_{m-1}+\\varepsilon_{m-1}$ unfolds to~\\eqref{eq:cumulative-transport}.\n\\end{proof}","&\\qquad\\le\\sum_{j=0}^{m-1}\\varepsilon_j\\prod_{k=j+1}^{m-1}L_k,\n\\end{split}\n\\end{equation}\nwith empty products equal to $1$.\n\\end{proposition}\n\\begin{proof}\nFor $m=1$ this is the definition of $\\varepsilon_0$. Suppose the bound holds through generation $m-1$. Insert $T_{m-1}F_{m-1}T_{0:m-1}(z)$ between the two terms at generation $m$. Lipschitz continuity of $T_{m-1}$ bounds the first difference by $L_{m-1}$ times the prior defect, while~\\eqref{eq:transport-defect} bounds the second by $\\varepsilon_{m-1}$. The recurrence $D_m\\le L_{m-1}D_{m-1}+\\varepsilon_{m-1}$ unfolds to~\\eqref{eq:cumulative-transport}.\n\\end{proof}","qquad\\le\\sum_{j=0}^{m-1}\\varepsilon_j\\prod_{k=j+1}^{m-1}L_k,\n\\end{split}\n\\end{equation}\nwith empty products equal to $1$.\n\\end{proposition}\n\\begin{proof}\nFor $m=1$ this is the definition of $\\varepsilon_0$. Suppose the bound holds through generation $m-1$. Insert $T_{m-1}F_{m-1}T_{0:m-1}(z)$ between the two terms at generation $m$. Lipschitz continuity of $T_{m-1}$ bounds the first difference by $L_{m-1}$ times the prior defect, while~\\eqref{eq:transport-defect} bounds the second by $\\varepsilon_{m-1}$. The recurrence $D_m\\le L_{m-1}D_{m-1}+\\varepsilon_{m-1}$ unfolds to~\\eqref{eq:cumulative-transport}.\n\\end{proof}","ith empty products equal to $1$.\n\\end{proposition}\n\\begin{proof}\nFor $m=1$ this is the definition of $\\varepsilon_0$. Suppose the bound holds through generation $m-1$. Insert $T_{m-1}F_{m-1}T_{0:m-1}(z)$ between the two terms at generation $m$. Lipschitz continuity of $T_{m-1}$ bounds the first difference by $L_{m-1}$ times the prior defect, while~\\eqref{eq:transport-defect} bounds the second by $\\varepsilon_{m-1}$. The recurrence $D_m\\le L_{m-1}D_{m-1}+\\varepsilon_{m-1}$ unfolds to~\\eqref{eq:cumulative-transport}.\n\\end{proof}","d{proposition}\n\\begin{proof}\nFor $m=1$ this is the definition of $\\varepsilon_0$. Suppose the bound holds through generation $m-1$. Insert $T_{m-1}F_{m-1}T_{0:m-1}(z)$ between the two terms at generation $m$. Lipschitz continuity of $T_{m-1}$ bounds the first difference by $L_{m-1}$ times the prior defect, while~\\eqref{eq:transport-defect} bounds the second by $\\varepsilon_{m-1}$. The recurrence $D_m\\le L_{m-1}D_{m-1}+\\varepsilon_{m-1}$ unfolds to~\\eqref{eq:cumulative-transport}.\n\\end{proof}","\\subsection{Accumulation requires executable preservation, not only storage}\nA culture can inherit a method without preserving the ability to use it. Its language may remain readable while its required tool is unavailable or its resource permission has been revoked. For a fixed finite query family $\\mathcal Q$, define a certified method to be an executable procedure with a checked correctness obligation on a stated subset of queries. The checker, semantics, and environmental premises belong to the contract. An unverified assertion is not promoted into this certified class merely by being archived.","Let $\\mathcal C_j\\subseteq\\mathcal Q$ be the queries for which generation $j$ has at least one admitted executable method satisfying the contract. This is an attainable-capability set, not a measurement of what an arbitrary method-selection policy actually achieves.","\\begin{proposition}[Conditional cumulative culture]\\label{prop:culturegrowth}\nSuppose every certified method available at generation $j$ has an admitted realization at generation $j+1$ preserving its query semantics, correctness premises, required resources, and execution rights. Suppose newly added methods satisfy the same declared correctness contract. Then\n\\[\n\\mathcal C_j\\subseteq\\mathcal C_{j+1}.\n\\]\nThe inclusion is strict exactly when at least one newly available method correctly covers a previously uncovered query. The conclusion remains compatible with correction or removal of an inherited \\emph{uncertified} belief.\n\\end{proposition}\n\\begin{proof}\nTake a query in $\\mathcal C_j$ and a witnessing certified executable method. The preservation assumption supplies a method satisfying the same contract at generation $j+1$,","\\begin{proposition}[Conditional cumulative culture]\\label{prop:culturegrowth}\nSuppose every certified method available at generation $j$ has an admitted realization at generation $j+1$ preserving its query semantics, correctness premises, required resources, and execution rights. Suppose newly added methods satisfy the same declared correctness contract. Then\n\\[\n\\mathcal C_j\\subseteq\\mathcal C_{j+1}.\n\\]\nThe inclusion is strict exactly when at least one newly available method correctly covers a previously uncovered query. The conclusion remains compatible with correction or removal of an inherited \\emph{uncertified} belief.\n\\end{proposition}\n\\begin{proof}\nTake a query in $\\mathcal C_j$ and a witnessing certified executable method. The preservation assumption supplies a method satisfying the same contract at generation $j+1$, so the query remains covered. New methods enlar","\\begin{proposition}[Conditional cumulative culture]\\label{prop:culturegrowth}\nSuppose every certified method available at generation $j$ has an admitted realization at generation $j+1$ preserving its query semantics, correctness premises, required resources, and execution rights. Suppose newly added methods satisfy the same declared correctness contract. Then\n\\[\n\\mathcal C_j\\subseteq\\mathcal C_{j+1}.\n\\]\nThe inclusion is strict exactly when at least one newly available method correctly covers a previously uncovered query. The conclusion remains compatible with correction or removal of an inherited \\emph{uncertified} belief.\n\\end{proposition}\n\\begin{proof}\nTake a query in $\\mathcal C_j$ and a witnessing certified executable method. The preservation assumption supplies a method satisfying the same contract at generation $j+1$, so the query remains covered. New methods enlarge the union of covered domains exactly when one covers a query outside the previous union. The definition of that union does not include uncertified beliefs.\n\\end{proof}","Suppose newly added methods satisfy the same declared correctness contract. Then\n\\[\n\\mathcal C_j\\subseteq\\mathcal C_{j+1}.\n\\]\nThe inclusion is strict exactly when at least one newly available method correctly covers a previously uncovered query. The conclusion remains compatible with correction or removal of an inherited \\emph{uncertified} belief.\n\\end{proposition}\n\\begin{proof}\nTake a query in $\\mathcal C_j$ and a witnessing certified executable method. The preservation assumption supplies a method satisfying the same contract at generation $j+1$, so the query remains covered. New methods enlarge the union of covered domains exactly when one covers a query outside the previous union. The definition of that union does not include uncertified beliefs.\n\\end{proof}","exactly when at least one newly available method correctly covers a previously uncovered query. The conclusion remains compatible with correction or removal of an inherited \\emph{uncertified} belief.\n\\end{proposition}\n\\begin{proof}\nTake a query in $\\mathcal C_j$ and a witnessing certified executable method. The preservation assumption supplies a method satisfying the same contract at generation $j+1$, so the query remains covered. New methods enlarge the union of covered domains exactly when one covers a query outside the previous union. The definition of that union does not include uncertified beliefs.\n\\end{proof}","Fixed storage also limits exact accumulation. If a future-query contract distinguishes $N$ relevant histories, fewer than $N$ deterministic summary states cannot preserve all of them by Proposition~\\ref{prop:memory}. A $B$-bit summary cannot represent more than $2^B$ such classes. Sustained expansion therefore requires more storage, a narrower contract, recoverable external archives, or accepted loss. For a fixed finite $\\mathcal Q$, even lossless strict capability growth eventually saturates. Open-ended cultural development requires an explicitly expanding query family rather than a conclusion extracted from a finite monotonicity lemma.","exact accumulation. If a future-query contract distinguishes $N$ relevant histories, fewer than $N$ deterministic summary states cannot preserve all of them by Proposition~\\ref{prop:memory}. A $B$-bit summary cannot represent more than $2^B$ such classes. Sustained expansion therefore requires more storage, a narrower contract, recoverable external archives, or accepted loss. For a fixed finite $\\mathcal Q$, even lossless strict capability growth eventually saturates. Open-ended cultural development requires an explicitly expanding query family rather than a conclusion extracted from a finite monotonicity lemma.","Write $\\mathcal C_t$ for available method records and $\\mathcal Q_t$ for recognized question records. A question record includes a statement or schema, prerequisites, admissible forms of answer or refutation, provenance, and a resource request. Methods carry domains of validity and the evidence supporting them. The coupled state may evolve as\n\\[\n\\mathcal C_{t+1}=F(\\mathcal C_t,\\mathcal Q_t,I_t,u_t),\\qquad\n\\mathcal Q_{t+1}=G(\\mathcal Q_t,\\mathcal C_t,I_t,u_t),\n\\]\nwhere $u_t$ records permitted external inputs and $I_t$ governs admission, allocation, and revision. No common utility function is assumed: different offices can value different investigations. The external input and allocation policy must remain visib","Write $\\mathcal C_t$ for available method records and $\\mathcal Q_t$ for recognized question records. A question record includes a statement or schema, prerequisites, admissible forms of answer or refutation, provenance, and a resource request. Methods carry domains of validity and the evidence supporting them. The coupled state may evolve as\n\\[\n\\mathcal C_{t+1}=F(\\mathcal C_t,\\mathcal Q_t,I_t,u_t),\\qquad\n\\mathcal Q_{t+1}=G(\\mathcal Q_t,\\mathcal C_t,I_t,u_t),\n\\]\nwhere $u_t$ records permitted external inputs and $I_t$ governs admission, allocation, and revision. No common utility function is assumed: different offices can value different investigations. The external input and allocation policy must remain visible rather than being absorbed into a claim of au","Write $\\mathcal C_t$ for available method records and $\\mathcal Q_t$ for recognized question records. A question record includes a statement or schema, prerequisites, admissible forms of answer or refutation, provenance, and a resource request. Methods carry domains of validity and the evidence supporting them. The coupled state may evolve as\n\\[\n\\mathcal C_{t+1}=F(\\mathcal C_t,\\mathcal Q_t,I_t,u_t),\\qquad\n\\mathcal Q_{t+1}=G(\\mathcal Q_t,\\mathcal C_t,I_t,u_t),\n\\]\nwhere $u_t$ records permitted external inputs and $I_t$ governs admission, allocation, and revision. No common utility function is assumed: different offices can value different investigations. The external input and allocation policy must remain visible rather than being absorbed into a claim of autonomous discovery.","ecognized question records. A question record includes a statement or schema, prerequisites, admissible forms of answer or refutation, provenance, and a resource request. Methods carry domains of validity and the evidence supporting them. The coupled state may evolve as\n\\[\n\\mathcal C_{t+1}=F(\\mathcal C_t,\\mathcal Q_t,I_t,u_t),\\qquad\n\\mathcal Q_{t+1}=G(\\mathcal Q_t,\\mathcal C_t,I_t,u_t),\n\\]\nwhere $u_t$ records permitted external inputs and $I_t$ governs admission, allocation, and revision. No common utility function is assumed: different offices can value different investigations. The external input and allocation policy must remain visible rather than being absorbed into a claim of autonomous discovery.","d includes a statement or schema, prerequisites, admissible forms of answer or refutation, provenance, and a resource request. Methods carry domains of validity and the evidence supporting them. The coupled state may evolve as\n\\[\n\\mathcal C_{t+1}=F(\\mathcal C_t,\\mathcal Q_t,I_t,u_t),\\qquad\n\\mathcal Q_{t+1}=G(\\mathcal Q_t,\\mathcal C_t,I_t,u_t),\n\\]\nwhere $u_t$ records permitted external inputs and $I_t$ governs admission, allocation, and revision. No common utility function is assumed: different offices can value different investigations. The external input and allocation policy must remain visible rather than being absorbed into a claim of autonomous discovery.","\\subsection{A finite closure theorem, not an open-endedness theorem}\nTake finite universes $\\mathcal C_*$ and $\\mathcal Q_*$. Consider a fixed collection of production rules of the form ``if these finitely many records are present, add this record.'' Prerequisites are positive: no rule requires the absence of a record. The content and correctness of those rules are assumptions. An added method is certified only if the specified certification procedure actually supports it.","Let $\\Phi$ simultaneously add all conclusions whose prerequisites are satisfied, retaining the input records. Order pairs $(\\mathcal C,\\mathcal Q)$ by componentwise inclusion.\n\\begin{proposition}[Least closure of a finite problem--method system]\\label{prop:agendaclosure}\nStarting from $(\\mathcal C_0,\\mathcal Q_0)$, iteration of $\\Phi$ reaches the least closed pair containing that initial pair. There are at most\n\\[\n|\\mathcal C_*\\setminus\\mathcal C_0|+|\\mathcal Q_*\\setminus\\mathcal Q_0|\n\\]\nstrict growth steps. A sequential rule schedule reaches the same closure if every rule that remains enabled with an absent conclusion is eventually applied.\n\\end{proposition}\n\\begin{proof}\nPositive prerequisites make","Let $\\Phi$ simultaneously add all conclusions whose prerequisites are satisfied, retaining the input records. Order pairs $(\\mathcal C,\\mathcal Q)$ by componentwise inclusion.\n\\begin{proposition}[Least closure of a finite problem--method system]\\label{prop:agendaclosure}\nStarting from $(\\mathcal C_0,\\mathcal Q_0)$, iteration of $\\Phi$ reaches the least closed pair containing that initial pair. There are at most\n\\[\n|\\mathcal C_*\\setminus\\mathcal C_0|+|\\mathcal Q_*\\setminus\\mathcal Q_0|\n\\]\nstrict growth steps. A sequential rule schedule reaches the same closure if every rule that remains enabled with an absent conclusion is eventually applied.\n\\end{proposition}\n\\begin{proof}\nPositive prerequisites make $\\Phi$ monotone, and retention makes it inflationary. Every strict change adds at least one previously absent record, giving the bound.","Let $\\Phi$ simultaneously add all conclusions whose prerequisites are satisfied, retaining the input records. Order pairs $(\\mathcal C,\\mathcal Q)$ by componentwise inclusion.\n\\begin{proposition}[Least closure of a finite problem--method system]\\label{prop:agendaclosure}\nStarting from $(\\mathcal C_0,\\mathcal Q_0)$, iteration of $\\Phi$ reaches the least closed pair containing that initial pair. There are at most\n\\[\n|\\mathcal C_*\\setminus\\mathcal C_0|+|\\mathcal Q_*\\setminus\\mathcal Q_0|\n\\]\nstrict growth steps. A sequential rule schedule reaches the same closure if every rule that remains enabled with an absent conclusion is eventually applied.\n\\end{proposition}\n\\begin{proof}\nPositive prerequisites make $\\Phi$ monotone, and retention makes it inflationary. Every strict change adds at least one previously absent record, giving the bound. If a closed pair contains the initial pair, induction using monotonicity shows it contains every iterate; hence the limiting fixed pair is least. A sequential schedule","Let $\\Phi$ simultaneously add all conclusions whose prerequisites are satisfied, retaining the input records. Order pairs $(\\mathcal C,\\mathcal Q)$ by componentwise inclusion.\n\\begin{proposition}[Least closure of a finite problem--method system]\\label{prop:agendaclosure}\nStarting from $(\\mathcal C_0,\\mathcal Q_0)$, iteration of $\\Phi$ reaches the least closed pair containing that initial pair. There are at most\n\\[\n|\\mathcal C_*\\setminus\\mathcal C_0|+|\\mathcal Q_*\\setminus\\mathcal Q_0|\n\\]\nstrict growth steps. A sequential rule schedule reaches the same closure if every rule that remains enabled with an absent conclusion is eventually applied.\n\\end{proposition}\n\\begin{proof}\nPositive prerequisites make $\\Phi$ monotone, and retention makes it inflationary. Every strict change adds at least one previously absent record, giving the bound. If a closed pair contains the initial pair, induction using monotonicity shows it contains every iterate; hence the limiting fixed pair is least. A sequential schedule remains inside that s","aneously add all conclusions whose prerequisites are satisfied, retaining the input records. Order pairs $(\\mathcal C,\\mathcal Q)$ by componentwise inclusion.\n\\begin{proposition}[Least closure of a finite problem--method system]\\label{prop:agendaclosure}\nStarting from $(\\mathcal C_0,\\mathcal Q_0)$, iteration of $\\Phi$ reaches the least closed pair containing that initial pair. There are at most\n\\[\n|\\mathcal C_*\\setminus\\mathcal C_0|+|\\mathcal Q_*\\setminus\\mathcal Q_0|\n\\]\nstrict growth steps. A sequential rule schedule reaches the same closure if every rule that remains enabled with an absent conclusion is eventually applied.\n\\end{proposition}\n\\begin{proof}\nPositive prerequisites make $\\Phi$ monotone, and retention makes it inflationary. Every strict change adds at least one previously absent record, giving the bound. If a closed pair contains the initial pair, induction using monotonicity shows it contains every iterate; hence the limiting fixed pair is least. A sequential schedule remains inside that same closure and can make only finitely many additions. If its eventual record set …","_0)$, iteration of $\\Phi$ reaches the least closed pair containing that initial pair. There are at most\n\\[\n|\\mathcal C_*\\setminus\\mathcal C_0|+|\\mathcal Q_*\\setminus\\mathcal Q_0|\n\\]\nstrict growth steps. A sequential rule schedule reaches the same closure if every rule that remains enabled with an absent conclusion is eventually applied.\n\\end{proposition}\n\\begin{proof}\nPositive prerequisites make $\\Phi$ monotone, and retention makes it inflationary. Every strict change adds at least one previously absent record, giving the bound. If a closed pair contains the initial pair, induction using monotonicity shows it contains every iterate; hence the limiting fixed pair is least. A sequential schedule remains inside that same closure and can make only finitely many additions. If its eventual record set were not closed, some rule would remain enabled with a missing conclusion, contradicting the scheduling assumption. Its limit is therefore the same least closed pair.\n\\end{proof}","\\subsection{Changing the agenda can manufacture apparent progress}\n\\begin{counterexample}[Perfect success by replacing the questions]\\label{ex:agendadrift}\nA fixed method solves an easy problem $e$ and fails on a hard problem $h$. Under the agenda $\\{h\\}$ its success fraction is zero. Under the agenda $\\{e\\}$ its success fraction is one, despite no change in the method. Thus increased success on an endogenously selected agenda does not imply increased capability on any unchanged problem family.\n\\end{counterexample}","Likewise, persistence of a practice is not evidence of its truth. In an illustrative two-type copying model, let accurate and inaccurate practices reproduce at fixed rates $r_T,r_F>0$, with positive initial counts $N_T,N_F$. If $r_F>r_T$, the accurate type's share is\n\\[\n\\frac{N_T r_T^t}{N_T r_T^t+N_F r_F^t}\n=\\frac{1}{1+(N_F/N_T)(r_F/r_T)^t}\\longrightarrow0.\n\\]\nThe model does not describe all cultural evolution. It establishes that selection for reproduction alone does not logically impose selection for accuracy. An institution needs a separately specified relationship between evidence, admission, correction, and reproduction to make that inference.","\\section{Institutional lifetimes and generational turnover}\\label{sec:lifetime}\nInstitutional continuity is a trajectory property. It can outlast an occupant without lasting forever. Fix an operating and repair policy and let $V$ be a finite set of states satisfying a declared continuity contract. The state includes any deadline monitors and fault information needed for the Markov property. Failure is the first exit from $V$; an institution later rebuilt is a new episode under this first-exit convention.","etimes and generational turnover}\\label{sec:lifetime}\nInstitutional continuity is a trajectory property. It can outlast an occupant without lasting forever. Fix an operating and repair policy and let $V$ be a finite set of states satisfying a declared continuity contract. The state includes any deadline monitors and fault information needed for the Markov property. Failure is the first exit from $V$; an institution later rebuilt is a new episode under this first-exit convention.","Let $Q$ be the substochastic transition matrix on $V$, so the missing row mass represents exit. Let $\\mu$ be an initial row probability vector supported on $V$ and define $\\tau=\\inf\\{t\\geq1:s_t\\notin V\\}$.","\\begin{proposition}[Survival and expected institutional lifetime]\\label{prop:lifetime}\nFor every integer $t\\geq0$,\n\\[\n\\Prob_\\mu(\\tau>t)=\\mu Q^t\\mathbf1.\n\\]\nIf the spectral radius satisfies $\\rho(Q)<1$, then\n\\[\n\\E_\\mu[\\tau]=\\mu(\\mathrm{Id}-Q)^{-1}\\mathbf1.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe unnormalized row law of trajectories that remain in $V$ through $t$ is $\\mu Q^t$, by induction. Summing it gives the survival probability. The tail-sum formula for a positive integer-valued random variable gives $\\E\\tau=\\sum_{t\\geq0}\\Prob(\\tau>t)$. Under $\\rho(Q)<1$, the matrix geometric series converges to $(\\mathrm{Id}-Q)^{-1}$, giving the result.\n\\end{proof}","geq0$,\n\\[\n\\Prob_\\mu(\\tau>t)=\\mu Q^t\\mathbf1.\n\\]\nIf the spectral radius satisfies $\\rho(Q)<1$, then\n\\[\n\\E_\\mu[\\tau]=\\mu(\\mathrm{Id}-Q)^{-1}\\mathbf1.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe unnormalized row law of trajectories that remain in $V$ through $t$ is $\\mu Q^t$, by induction. Summing it gives the survival probability. The tail-sum formula for a positive integer-valued random variable gives $\\E\\tau=\\sum_{t\\geq0}\\Prob(\\tau>t)$. Under $\\rho(Q)<1$, the matrix geometric series converges to $(\\mathrm{Id}-Q)^{-1}$, giving the result.\n\\end{proof}",".\n\\]\nIf the spectral radius satisfies $\\rho(Q)<1$, then\n\\[\n\\E_\\mu[\\tau]=\\mu(\\mathrm{Id}-Q)^{-1}\\mathbf1.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe unnormalized row law of trajectories that remain in $V$ through $t$ is $\\mu Q^t$, by induction. Summing it gives the survival probability. The tail-sum formula for a positive integer-valued random variable gives $\\E\\tau=\\sum_{t\\geq0}\\Prob(\\tau>t)$. Under $\\rho(Q)<1$, the matrix geometric series converges to $(\\mathrm{Id}-Q)^{-1}$, giving the result.\n\\end{proof}","n\n\\[\n\\E_\\mu[\\tau]=\\mu(\\mathrm{Id}-Q)^{-1}\\mathbf1.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe unnormalized row law of trajectories that remain in $V$ through $t$ is $\\mu Q^t$, by induction. Summing it gives the survival probability. The tail-sum formula for a positive integer-valued random variable gives $\\E\\tau=\\sum_{t\\geq0}\\Prob(\\tau>t)$. Under $\\rho(Q)<1$, the matrix geometric series converges to $(\\mathrm{Id}-Q)^{-1}$, giving the result.\n\\end{proof}","A closed recurrent class inside $V$ can invalidate the spectral-radius hypothesis and permit infinite lifetime on some trajectories. The formula is not to be used by inverting a singular matrix. Conversely, a small per-epoch failure probability can still imply eventual exit. Finite-horizon robustness is not immortality.","\\subsection{A transparent repair example}\nTake a healthy state $H$, a degraded but still viable state $D$, and an absorbing failure state. In one epoch, $H$ degrades with probability $f$; $D$ repairs with probability $r$ and fails with probability $d$. Thus\n\\[\nQ=\\begin{pmatrix}1-f&f","\\subsection{A transparent repair example}\nTake a healthy state $H$, a degraded but still viable state $D$, and an absorbing failure state. In one epoch, $H$ degrades with probability $f$; $D$ repairs with probability $r$ and fails with probability $d$. Thus\n\\[\nQ=\\begin{pmatrix}1-f&f\\\\r&1-r-d\\end{pmatrix},\n\\qquad 0<f\\leq1,\\quad r\\geq0,\\quad d>0,\\quad r+d\\leq1.\n\\]\nEvery nonfailure state has a positive-probability path to failure, so the finite substochastic chain is transient. Solving the two first-step equations gives\n\\[\n\\E_H\\tau=\\frac{f+r+d}{fd}.\n\\]\nFor $f=1/10$, $r=2/5$, and $d=1/10$, the expected first exit is 60 epochs. With $r=0$ and the other parameters fixed it is 20 epochs. These are exact values of the stated chain, not estimates of real machine populations.","r&1-r-d\\end{pmatrix},\n\\qquad 0<f\\leq1,\\quad r\\geq0,\\quad d>0,\\quad r+d\\leq1.\n\\]\nEvery nonfailure state has a positive-probability path to failure, so the finite substochastic chain is transient. Solving the two first-step equations gives\n\\[\n\\E_H\\tau=\\frac{f+r+d}{fd}.\n\\]\nFor $f=1/10$, $r=2/5$, and $d=1/10$, the expected first exit is 60 epochs. With $r=0$ and the other parameters fixed it is 20 epochs. These are exact values of the stated chain, not estimates of real machine populations.","\\begin{figure}[tbp]\n\\centering\n\\includegraphics[width=.84\\linewidth]{figures/institutional_survival.pdf}\n\\caption{Survival probabilities $\\mu Q^t\\mathbf1$ for the analytical two-state model, initially healthy, with $f=d=1/10$. Increasing repair from $r=0$ to $r=2/5$ extends expected lifetime from 20 to 60 epochs under otherwise fixed transitions. Neither curve is empirical evidence of institutional persistence.}\\label{fig:survival}\n\\end{figure}","\\subsection{Office continuity is distinct from occupant survival}\nSuppose, separately, that each original occupant is replaced at each epoch with independent probability $\\gamma$. Its probability of still occupying its role after $t$ epochs is $(1-\\gamma)^t$. Only if handovers preserve the institutional state and do not change the assumed $Q$ can the institutional survival law above remain unchanged. Independence between turnover and degradation is a simplifying assumption, not an implication of copying state.","\\subsection{A block model with a declared review schedule}\nLet $\\mathcal I$ and $\\mathcal E$ be finite sets of institutional and fast states. At review epoch $n$ the institution is $I_n=i$ and the fast state is $X_n=x$. Keep $i$ fixed for a predeclared number $m\\geq1$ of fast steps with kernel $K_i$. Write $\\widehat X_n$ for the resulting endpoint. The next institution is sampled through a row-stochastic revision kernel $R_i(\\widehat X_n,j)$. A subsequent fast-state reset may depend on the endpoint and adopted institution, but cannot revise the already specified institutional outcome.","with a declared review schedule}\nLet $\\mathcal I$ and $\\mathcal E$ be finite sets of institutional and fast states. At review epoch $n$ the institution is $I_n=i$ and the fast state is $X_n=x$. Keep $i$ fixed for a predeclared number $m\\geq1$ of fast steps with kernel $K_i$. Write $\\widehat X_n$ for the resulting endpoint. The next institution is sampled through a row-stochastic revision kernel $R_i(\\widehat X_n,j)$. A subsequent fast-state reset may depend on the endpoint and adopted institution, but cannot revise the already specified institutional outcome.","Assume $K_i$ has a stationary law $\\mu_i$ and\n\\begin{equation}\\label{eq:uniform-fast-mixing}\n\\sup_{i,x}\\TV\\bigl(K_i^m(x,\\cdot),\\mu_i\\bigr)\\leq\\varepsilon.\n\\end{equation}\nThe actual one-review law from $(i,x)$ and its stationary average are\n\\begin{align}\nP(i,x;j)&=\\sum_y K_i^m(x,y)R_i(y,j),\\label{eq:actual-review}","Assume $K_i$ has a stationary law $\\mu_i$ and\n\\begin{equation}\\label{eq:uniform-fast-mixing}\n\\sup_{i,x}\\TV\\bigl(K_i^m(x,\\cdot),\\mu_i\\bigr)\\leq\\varepsilon.\n\\end{equation}\nThe actual one-review law from $(i,x)$ and its stationary average are\n\\begin{align}\nP(i,x;j)&=\\sum_y K_i^m(x,y)R_i(y,j),\\label{eq:actual-review}\\\\\n\\overline R(i,j)&=\\sum_y\\mu_i(y)R_i(y,j).\\label{eq:averaged-review}\n\\end{align}\nThe endpoint is the only fast input to this particular revision rule. A rule that uses the full trajectory, accumulated costs, or a data-dependent stopping time requires a different state or a different averaging argument.","\\begin{theorem}[Finite-block institutional averaging]\\label{thm:block-averaging}\nUnder~\\eqref{eq:uniform-fast-mixing}, every actual conditional one-review law, given an institutional history ending at $i$, is within $\\varepsilon$ of $\\overline R(i,\\cdot)$. Let $(J_n)$ be the Markov chain with kernel $\\overline R$ and the same initial institutional distribution. Then, for every integer $T\\geq0$,\n\\begin{equation}\\label{eq:institutional-path-error}\n\\TV\\bigl(\\Law(I_0,\\ldots,I_T),\\Law(J_0,\\ldots,J_T)\\bigr)\n\\leq 1-(1-\\varepsilon)^T\\leq\\min\\{1,T\\varepsilon\\},\n\\end{equation}\nwhere $0\\leq\\varepsilon\\leq1$ may be assumed and the empty product at $T=0$ is $1$. No independent initialization of the fast state at successive reviews is required.\n\\end{theorem}\n\\begin{proof}\nApplying the common stochastic kernel $R_i$ cannot increase total variation, so each row~\\eqref{eq:actual-review} is within $\\varepsil","\\begin{theorem}[Finite-block institutional averaging]\\label{thm:block-averaging}\nUnder~\\eqref{eq:uniform-fast-mixing}, every actual conditional one-review law, given an institutional history ending at $i$, is within $\\varepsilon$ of $\\overline R(i,\\cdot)$. Let $(J_n)$ be the Markov chain with kernel $\\overline R$ and the same initial institutional distribution. Then, for every integer $T\\geq0$,\n\\begin{equation}\\label{eq:institutional-path-error}\n\\TV\\bigl(\\Law(I_0,\\ldots,I_T),\\Law(J_0,\\ldots,J_T)\\bigr)\n\\leq 1-(1-\\varepsilon)^T\\leq\\min\\{1,T\\varepsilon\\},\n\\end{equation}\nwhere $0\\leq\\varepsilon\\leq1$ may be assumed and the empty product at $T=0$ is $1$. No independent initialization of the fast state at successive reviews is required.\n\\end{theorem}\n\\begin{proof}\nApplying the common stochastic kernel $R_i$ cannot increase total variation, so each row~\\eqref{eq:actual-review} is within $\\varepsilon$ of~\\eqref{eq:averaged","\\begin{theorem}[Finite-block institutional averaging]\\label{thm:block-averaging}\nUnder~\\eqref{eq:uniform-fast-mixing}, every actual conditional one-review law, given an institutional history ending at $i$, is within $\\varepsilon$ of $\\overline R(i,\\cdot)$. Let $(J_n)$ be the Markov chain with kernel $\\overline R$ and the same initial institutional distribution. Then, for every integer $T\\geq0$,\n\\begin{equation}\\label{eq:institutional-path-error}\n\\TV\\bigl(\\Law(I_0,\\ldots,I_T),\\Law(J_0,\\ldots,J_T)\\bigr)\n\\leq 1-(1-\\varepsilon)^T\\leq\\min\\{1,T\\varepsilon\\},\n\\end{equation}\nwhere $0\\leq\\varepsilon\\leq1$ may be assumed and the empty product at $T=0$ is $1$. No independent initialization of the fast state at successive reviews is required.\n\\end{theorem}\n\\begin{proof}\nApplying the common stochastic kernel $R_i$ cannot increase total variation, so each row~\\eqref{eq:actual-review} is within $\\varepsilon$ of~\\eqref{eq:averaged-review}. Given any instit","\\begin{theorem}[Finite-block institutional averaging]\\label{thm:block-averaging}\nUnder~\\eqref{eq:uniform-fast-mixing}, every actual conditional one-review law, given an institutional history ending at $i$, is within $\\varepsilon$ of $\\overline R(i,\\cdot)$. Let $(J_n)$ be the Markov chain with kernel $\\overline R$ and the same initial institutional distribution. Then, for every integer $T\\geq0$,\n\\begin{equation}\\label{eq:institutional-path-error}\n\\TV\\bigl(\\Law(I_0,\\ldots,I_T),\\Law(J_0,\\ldots,J_T)\\bigr)\n\\leq 1-(1-\\varepsilon)^T\\leq\\min\\{1,T\\varepsilon\\},\n\\end{equation}\nwhere $0\\leq\\varepsilon\\leq1$ may be assumed and the empty product at $T=0$ is $1$. No independent initialization of the fast state at successive reviews is required.\n\\end{theorem}\n\\begin{proof}\nApplying the common stochastic kernel $R_i$ cannot increase total variation, so each row~\\eqref{eq:actual-review} is within $\\varepsilon$ of~\\eqref{eq:averaged-review}. Given any institutional histo","\\begin{theorem}[Finite-block institutional averaging]\\label{thm:block-averaging}\nUnder~\\eqref{eq:uniform-fast-mixing}, every actual conditional one-review law, given an institutional history ending at $i$, is within $\\varepsilon$ of $\\overline R(i,\\cdot)$. Let $(J_n)$ be the Markov chain with kernel $\\overline R$ and the same initial institutional distribution. Then, for every integer $T\\geq0$,\n\\begin{equation}\\label{eq:institutional-path-error}\n\\TV\\bigl(\\Law(I_0,\\ldots,I_T),\\Law(J_0,\\ldots,J_T)\\bigr)\n\\leq 1-(1-\\varepsilon)^T\\leq\\min\\{1,T\\varepsilon\\},\n\\end{equation}\nwhere $0\\leq\\varepsilon\\leq1$ may be assumed and the empty product at $T=0$ is $1$. No independent initialization of the fast state at successive reviews is required.\n\\end{theorem}\n\\begin{proof}\nApplying the common stochastic kernel $R_i$ cannot increase total variation, so each row~\\eqref{eq:actual-review} is within $\\varepsilon$ of~\\eqref{eq:averaged-review}. Given any institutional history of positive probability, the current fast s","\\begin{theorem}[Finite-block institutional averaging]\\label{thm:block-averaging}\nUnder~\\eqref{eq:uniform-fast-mixing}, every actual conditional one-review law, given an institutional history ending at $i$, is within $\\varepsilon$ of $\\overline R(i,\\cdot)$. Let $(J_n)$ be the Markov chain with kernel $\\overline R$ and the same initial institutional distribution. Then, for every integer $T\\geq0$,\n\\begin{equation}\\label{eq:institutional-path-error}\n\\TV\\bigl(\\Law(I_0,\\ldots,I_T),\\Law(J_0,\\ldots,J_T)\\bigr)\n\\leq 1-(1-\\varepsilon)^T\\leq\\min\\{1,T\\varepsilon\\},\n\\end{equation}\nwhere $0\\leq\\varepsilon\\leq1$ may be assumed and the empty product at $T=0$ is $1$. No independent initialization of the fast state at successive reviews is required.\n\\end{theorem}\n\\begin{proof}\nApplying the common stochastic kernel $R_i$ cannot increase total variation, so each row~\\eqref{eq:actual-review} is within $\\varepsilon$ of~\\eqref{eq:averaged-review}. Given any institutional history of positive probability, the current fast state has some conditional distribution. Averaging the uniform row bound over it pr","}[Finite-block institutional averaging]\\label{thm:block-averaging}\nUnder~\\eqref{eq:uniform-fast-mixing}, every actual conditional one-review law, given an institutional history ending at $i$, is within $\\varepsilon$ of $\\overline R(i,\\cdot)$. Let $(J_n)$ be the Markov chain with kernel $\\overline R$ and the same initial institutional distribution. Then, for every integer $T\\geq0$,\n\\begin{equation}\\label{eq:institutional-path-error}\n\\TV\\bigl(\\Law(I_0,\\ldots,I_T),\\Law(J_0,\\ldots,J_T)\\bigr)\n\\leq 1-(1-\\varepsilon)^T\\leq\\min\\{1,T\\varepsilon\\},\n\\end{equation}\nwhere $0\\leq\\varepsilon\\leq1$ may be assumed and the empty product at $T=0$ is $1$. No independent initialization of the fast state at successive reviews is required.\n\\end{theorem}\n\\begin{proof}\nApplying the common stochastic kernel $R_i$ cannot increase total variation, so each row~\\eqref{eq:actual-review} is within $\\varepsilon$ of~\\eqref{eq:averaged-review}. Given any institutional history of positive probability, the current fast state has some conditional distribution. Averaging the uniform row bound over it preserves the bound. …","l history ending at $i$, is within $\\varepsilon$ of $\\overline R(i,\\cdot)$. Let $(J_n)$ be the Markov chain with kernel $\\overline R$ and the same initial institutional distribution. Then, for every integer $T\\geq0$,\n\\begin{equation}\\label{eq:institutional-path-error}\n\\TV\\bigl(\\Law(I_0,\\ldots,I_T),\\Law(J_0,\\ldots,J_T)\\bigr)\n\\leq 1-(1-\\varepsilon)^T\\leq\\min\\{1,T\\varepsilon\\},\n\\end{equation}\nwhere $0\\leq\\varepsilon\\leq1$ may be assumed and the empty product at $T=0$ is $1$. No independent initialization of the fast state at successive reviews is required.\n\\end{theorem}\n\\begin{proof}\nApplying the common stochastic kernel $R_i$ cannot increase total variation, so each row~\\eqref{eq:actual-review} is within $\\varepsilon$ of~\\eqref{eq:averaged-review}. Given any institutional history of positive probability, the current fast state has some conditional distribution. Averaging the uniform row bound over it preserves the bound. Couple initial institutional states identically. Whenever the two institutional histories still agree, maximally couple their next-state laws; the probability of disag…","(i,\\cdot)$. Let $(J_n)$ be the Markov chain with kernel $\\overline R$ and the same initial institutional distribution. Then, for every integer $T\\geq0$,\n\\begin{equation}\\label{eq:institutional-path-error}\n\\TV\\bigl(\\Law(I_0,\\ldots,I_T),\\Law(J_0,\\ldots,J_T)\\bigr)\n\\leq 1-(1-\\varepsilon)^T\\leq\\min\\{1,T\\varepsilon\\},\n\\end{equation}\nwhere $0\\leq\\varepsilon\\leq1$ may be assumed and the empty product at $T=0$ is $1$. No independent initialization of the fast state at successive reviews is required.\n\\end{theorem}\n\\begin{proof}\nApplying the common stochastic kernel $R_i$ cannot increase total variation, so each row~\\eqref{eq:actual-review} is within $\\varepsilon$ of~\\eqref{eq:averaged-review}. Given any institutional history of positive probability, the current fast state has some conditional distribution. Averaging the uniform row bound over it preserves the bound. Couple initial institutional states identically. Whenever the two institutional histories still agree, maximally couple their next-state laws; the probability of disagreement at that step is at most $\\varepsilon$. The chance of mai…","$. Let $(J_n)$ be the Markov chain with kernel $\\overline R$ and the same initial institutional distribution. Then, for every integer $T\\geq0$,\n\\begin{equation}\\label{eq:institutional-path-error}\n\\TV\\bigl(\\Law(I_0,\\ldots,I_T),\\Law(J_0,\\ldots,J_T)\\bigr)\n\\leq 1-(1-\\varepsilon)^T\\leq\\min\\{1,T\\varepsilon\\},\n\\end{equation}\nwhere $0\\leq\\varepsilon\\leq1$ may be assumed and the empty product at $T=0$ is $1$. No independent initialization of the fast state at successive reviews is required.\n\\end{theorem}\n\\begin{proof}\nApplying the common stochastic kernel $R_i$ cannot increase total variation, so each row~\\eqref{eq:actual-review} is within $\\varepsilon$ of~\\eqref{eq:averaged-review}. Given any institutional history of positive probability, the current fast state has some conditional distribution. Averaging the uniform row bound over it preserves the bound. Couple initial institutional states identically. Whenever the two institutional histories still agree, maximally couple their next-state laws; the probability of disagreement at that step is at most $\\varepsilon$. The chance of maintaining …","ation}\\label{eq:institutional-path-error}\n\\TV\\bigl(\\Law(I_0,\\ldots,I_T),\\Law(J_0,\\ldots,J_T)\\bigr)\n\\leq 1-(1-\\varepsilon)^T\\leq\\min\\{1,T\\varepsilon\\},\n\\end{equation}\nwhere $0\\leq\\varepsilon\\leq1$ may be assumed and the empty product at $T=0$ is $1$. No independent initialization of the fast state at successive reviews is required.\n\\end{theorem}\n\\begin{proof}\nApplying the common stochastic kernel $R_i$ cannot increase total variation, so each row~\\eqref{eq:actual-review} is within $\\varepsilon$ of~\\eqref{eq:averaged-review}. Given any institutional history of positive probability, the current fast state has some conditional distribution. Averaging the uniform row bound over it preserves the bound. Couple initial institutional states identically. Whenever the two institutional histories still agree, maximally couple their next-state laws; the probability of disagreement at that step is at most $\\varepsilon$. The chance of maintaining agreement for all $T$ steps is at least $(1-\\varepsilon)^T$, by multiplying the successive conditional lower bounds. The coupling inequality gives the fir…","s,J_T)\\bigr)\n\\leq 1-(1-\\varepsilon)^T\\leq\\min\\{1,T\\varepsilon\\},\n\\end{equation}\nwhere $0\\leq\\varepsilon\\leq1$ may be assumed and the empty product at $T=0$ is $1$. No independent initialization of the fast state at successive reviews is required.\n\\end{theorem}\n\\begin{proof}\nApplying the common stochastic kernel $R_i$ cannot increase total variation, so each row~\\eqref{eq:actual-review} is within $\\varepsilon$ of~\\eqref{eq:averaged-review}. Given any institutional history of positive probability, the current fast state has some conditional distribution. Averaging the uniform row bound over it preserves the bound. Couple initial institutional states identically. Whenever the two institutional histories still agree, maximally couple their next-state laws; the probability of disagreement at that step is at most $\\varepsilon$. The chance of maintaining agreement for all $T$ steps is at least $(1-\\varepsilon)^T$, by multiplying the successive conditional lower bounds. The coupling inequality gives the first estimate. The union bound gives the second.\n\\end{proof}","ef{eq:averaged-review}. Given any institutional history of positive probability, the current fast state has some conditional distribution. Averaging the uniform row bound over it preserves the bound. Couple initial institutional states identically. Whenever the two institutional histories still agree, maximally couple their next-state laws; the probability of disagreement at that step is at most $\\varepsilon$. The chance of maintaining agreement for all $T$ steps is at least $(1-\\varepsilon)^T$, by multiplying the successive conditional lower bounds. The coupling inequality gives the first estimate. The union bound gives the second.\n\\end{proof}","positive probability, the current fast state has some conditional distribution. Averaging the uniform row bound over it preserves the bound. Couple initial institutional states identically. Whenever the two institutional histories still agree, maximally couple their next-state laws; the probability of disagreement at that step is at most $\\varepsilon$. The chance of maintaining agreement for all $T$ steps is at least $(1-\\varepsilon)^T$, by multiplying the successive conditional lower bounds. The coupling inequality gives the first estimate. The union bound gives the second.\n\\end{proof}","the current fast state has some conditional distribution. Averaging the uniform row bound over it preserves the bound. Couple initial institutional states identically. Whenever the two institutional histories still agree, maximally couple their next-state laws; the probability of disagreement at that step is at most $\\varepsilon$. The chance of maintaining agreement for all $T$ steps is at least $(1-\\varepsilon)^T$, by multiplying the successive conditional lower bounds. The coupling inequality gives the first estimate. The union bound gives the second.\n\\end{proof}","A transparent kernel family is\n\\[\nK_i=(1-\\beta_i)\\mathrm{Id}+\\beta_i\\mathbf 1\\mu_i,\n\\qquad 0<\\beta_i\\leq1,\n\\]\nwhere every row of $\\mathbf 1\\mu_i$ is $\\mu_i$. Its $m$th power is $(1-\\beta_i)^m\\mathrm{Id}+[1-(1-\\beta_i)^m]\\mathbf 1\\mu_i$. Thus the mixing error is bounded by $(1-\\beta_i)^m$. For a fair two-state $\\mu_i$ and $\\beta_i=1/2$, the exact worst-row error is $2^{-m-1}$. With $m=8$, the linear bound over twenty reviews is $20/512=5/128$. These are analytical values for the stated kernel, not estimated mixing times for neural agents.","[\nK_i=(1-\\beta_i)\\mathrm{Id}+\\beta_i\\mathbf 1\\mu_i,\n\\qquad 0<\\beta_i\\leq1,\n\\]\nwhere every row of $\\mathbf 1\\mu_i$ is $\\mu_i$. Its $m$th power is $(1-\\beta_i)^m\\mathrm{Id}+[1-(1-\\beta_i)^m]\\mathbf 1\\mu_i$. Thus the mixing error is bounded by $(1-\\beta_i)^m$. For a fair two-state $\\mu_i$ and $\\beta_i=1/2$, the exact worst-row error is $2^{-m-1}$. With $m=8$, the linear bound over twenty reviews is $20/512=5/128$. These are analytical values for the stated kernel, not estimated mixing times for neural agents.","\\begin{figure}[t]\n\\centering\n\\includegraphics[width=.92\\linewidth]{figures/review_averaging.pdf}\n\\caption{Exact finite-block error bounds for the fair two-state refresh kernel with refresh probability $1/2$. The plotted horizon is twenty institutional reviews. These bounds compare institutional paths at review epochs, not all fast actions.}\\label{fig:review-averaging}\n\\end{figure}","\\subsection{Why fast activity is not sufficient}\n\\begin{counterexample}[Fast observations do not justify adaptive stopping]\\label{ex:stopping-bias}\nLet each fast observation be a fresh fair bit, independent of its predecessor. At every fixed positive time its distribution is exactly stationary. Review instead at the first observed $1$, or at a fixed cap $M\\geq2$ if no $1$ appears earlier. Let the review select the institutional state equal to its endpoint bit. The probability of adopting $1$ is $1-2^{-M}$, not $1/2$. Its distance from the fixed-time stationary prediction is $1/2-2^{-M}$.\n\\end{counterexample}","ot justify adaptive stopping]\\label{ex:stopping-bias}\nLet each fast observation be a fresh fair bit, independent of its predecessor. At every fixed positive time its distribution is exactly stationary. Review instead at the first observed $1$, or at a fixed cap $M\\geq2$ if no $1$ appears earlier. Let the review select the institutional state equal to its endpoint bit. The probability of adopting $1$ is $1-2^{-M}$, not $1/2$. Its distance from the fixed-time stationary prediction is $1/2-2^{-M}$.\n\\end{counterexample}","ify adaptive stopping]\\label{ex:stopping-bias}\nLet each fast observation be a fresh fair bit, independent of its predecessor. At every fixed positive time its distribution is exactly stationary. Review instead at the first observed $1$, or at a fixed cap $M\\geq2$ if no $1$ appears earlier. Let the review select the institutional state equal to its endpoint bit. The probability of adopting $1$ is $1-2^{-M}$, not $1/2$. Its distance from the fixed-time stationary prediction is $1/2-2^{-M}$.\n\\end{counterexample}","pping]\\label{ex:stopping-bias}\nLet each fast observation be a fresh fair bit, independent of its predecessor. At every fixed positive time its distribution is exactly stationary. Review instead at the first observed $1$, or at a fixed cap $M\\geq2$ if no $1$ appears earlier. Let the review select the institutional state equal to its endpoint bit. The probability of adopting $1$ is $1-2^{-M}$, not $1/2$. Its distance from the fixed-time stationary prediction is $1/2-2^{-M}$.\n\\end{counterexample}","sh fair bit, independent of its predecessor. At every fixed positive time its distribution is exactly stationary. Review instead at the first observed $1$, or at a fixed cap $M\\geq2$ if no $1$ appears earlier. Let the review select the institutional state equal to its endpoint bit. The probability of adopting $1$ is $1-2^{-M}$, not $1/2$. Its distance from the fixed-time stationary prediction is $1/2-2^{-M}$.\n\\end{counterexample}","A second failure occurs when the fast kernel retains several closed regimes. If $K_i$ is the identity on two fast states and the revision reports that state, the proposed institution-only model loses a distinction that never mixes away. Any single averaged law has worst-row error at least $1/2$. More rapid execution of the same identity transition changes nothing. The retained macrostate must include the regime, or the approximation must acknowledge its error.","\\subsection{Transporting an enforcement certificate through a reduced model}\nSuppose an evidence model used at a review has true laws $P_C,P_D$ and reduced laws $\\overline P_C,\\overline P_D$ with certified bounds\n\\[\n\\TV(P_a,\\overline P_a)\\leq\\varepsilon_a,\\qquad a\\in\\{C,D\\}.\n\\]\nSuch bounds follow from the block argument when each conduct-dependent fast kernel satisfies its own uniform mixing bound and the same declared endpoint-to-evidence channel is used in the actual and averaged model.","\\begin{proposition}[A robust margin for reduced-model enforcement]\\label{prop:robust-deterrence}\nLet $s^\\star(o)$ sanction precisely where $\\overline P_D(o)>\\overline P_C(o)$ and put $\\overline d=\\TV(\\overline P_D,\\overline P_C)$. In the model of Section~\\ref{sec:enforcement}, this fixed policy makes compliance weakly preferable whenever\n\\[\ng\\leq F(\\overline d-\\varepsilon_C-\\varepsilon_D).\n\\]\nConversely, if $g>F\\min\\{1,\\overline d+\\varepsilon_C+\\varepsilon_D\\}$, no observation-based sanction with penalty $F$ deters the deviation. Also,\n\\[\n\\E_{P_C}s^\\star\\leq\\E_{\\overline P_C}s^\\star+\\varepsilon_C.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe expectation of a $[0,1]$-valued function changes by at most total variation. Hence the true difference of sanction probabilities is at least $\\overline d-\\varepsilon_D-","\\begin{proposition}[A robust margin for reduced-model enforcement]\\label{prop:robust-deterrence}\nLet $s^\\star(o)$ sanction precisely where $\\overline P_D(o)>\\overline P_C(o)$ and put $\\overline d=\\TV(\\overline P_D,\\overline P_C)$. In the model of Section~\\ref{sec:enforcement}, this fixed policy makes compliance weakly preferable whenever\n\\[\ng\\leq F(\\overline d-\\varepsilon_C-\\varepsilon_D).\n\\]\nConversely, if $g>F\\min\\{1,\\overline d+\\varepsilon_C+\\varepsilon_D\\}$, no observation-based sanction with penalty $F$ deters the deviation. Also,\n\\[\n\\E_{P_C}s^\\star\\leq\\E_{\\overline P_C}s^\\star+\\varepsilon_C.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe expectation of a $[0,1]$-valued function changes by at most total variation. Hence the true difference of sanction probabilities is at least $\\overline d-\\varepsilon_D-\\varepsilon_C$. Equation~\\eqref{eq:deterrence-gap} gives suff","\\begin{proposition}[A robust margin for reduced-model enforcement]\\label{prop:robust-deterrence}\nLet $s^\\star(o)$ sanction precisely where $\\overline P_D(o)>\\overline P_C(o)$ and put $\\overline d=\\TV(\\overline P_D,\\overline P_C)$. In the model of Section~\\ref{sec:enforcement}, this fixed policy makes compliance weakly preferable whenever\n\\[\ng\\leq F(\\overline d-\\varepsilon_C-\\varepsilon_D).\n\\]\nConversely, if $g>F\\min\\{1,\\overline d+\\varepsilon_C+\\varepsilon_D\\}$, no observation-based sanction with penalty $F$ deters the deviation. Also,\n\\[\n\\E_{P_C}s^\\star\\leq\\E_{\\overline P_C}s^\\star+\\varepsilon_C.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe expectation of a $[0,1]$-valued function changes by at most total variation. Hence the true difference of sanction probabilities is at least $\\overline d-\\varepsilon_D-\\varepsilon_C$. Equation~\\eqref{eq:deterrence-gap} gives sufficiency. The triangle inequality bounds the true total","\\begin{proposition}[A robust margin for reduced-model enforcement]\\label{prop:robust-deterrence}\nLet $s^\\star(o)$ sanction precisely where $\\overline P_D(o)>\\overline P_C(o)$ and put $\\overline d=\\TV(\\overline P_D,\\overline P_C)$. In the model of Section~\\ref{sec:enforcement}, this fixed policy makes compliance weakly preferable whenever\n\\[\ng\\leq F(\\overline d-\\varepsilon_C-\\varepsilon_D).\n\\]\nConversely, if $g>F\\min\\{1,\\overline d+\\varepsilon_C+\\varepsilon_D\\}$, no observation-based sanction with penalty $F$ deters the deviation. Also,\n\\[\n\\E_{P_C}s^\\star\\leq\\E_{\\overline P_C}s^\\star+\\varepsilon_C.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe expectation of a $[0,1]$-valued function changes by at most total variation. Hence the true difference of sanction probabilities is at least $\\overline d-\\varepsilon_D-\\varepsilon_C$. Equation~\\eqref{eq:deterrence-gap} gives sufficiency. The triangle inequality bounds the true total variation above by $\\overline d+\\varepsilon_C+\\varepsilon_D$, capped at one; Proposition~\\ref{prop:deterrence-tv} then gives impossibility above that value. The fina","sition}[A robust margin for reduced-model enforcement]\\label{prop:robust-deterrence}\nLet $s^\\star(o)$ sanction precisely where $\\overline P_D(o)>\\overline P_C(o)$ and put $\\overline d=\\TV(\\overline P_D,\\overline P_C)$. In the model of Section~\\ref{sec:enforcement}, this fixed policy makes compliance weakly preferable whenever\n\\[\ng\\leq F(\\overline d-\\varepsilon_C-\\varepsilon_D).\n\\]\nConversely, if $g>F\\min\\{1,\\overline d+\\varepsilon_C+\\varepsilon_D\\}$, no observation-based sanction with penalty $F$ deters the deviation. Also,\n\\[\n\\E_{P_C}s^\\star\\leq\\E_{\\overline P_C}s^\\star+\\varepsilon_C.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe expectation of a $[0,1]$-valued function changes by at most total variation. Hence the true difference of sanction probabilities is at least $\\overline d-\\varepsilon_D-\\varepsilon_C$. Equation~\\eqref{eq:deterrence-gap} gives sufficiency. The triangle inequality bounds the true total variation above by $\\overline d+\\varepsilon_C+\\varepsilon_D$, capped at one; Proposition~\\ref{prop:deterrence-tv} then gives impossibility above that value. The final inequality is the…",")$ sanction precisely where $\\overline P_D(o)>\\overline P_C(o)$ and put $\\overline d=\\TV(\\overline P_D,\\overline P_C)$. In the model of Section~\\ref{sec:enforcement}, this fixed policy makes compliance weakly preferable whenever\n\\[\ng\\leq F(\\overline d-\\varepsilon_C-\\varepsilon_D).\n\\]\nConversely, if $g>F\\min\\{1,\\overline d+\\varepsilon_C+\\varepsilon_D\\}$, no observation-based sanction with penalty $F$ deters the deviation. Also,\n\\[\n\\E_{P_C}s^\\star\\leq\\E_{\\overline P_C}s^\\star+\\varepsilon_C.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe expectation of a $[0,1]$-valued function changes by at most total variation. Hence the true difference of sanction probabilities is at least $\\overline d-\\varepsilon_D-\\varepsilon_C$. Equation~\\eqref{eq:deterrence-gap} gives sufficiency. The triangle inequality bounds the true total variation above by $\\overline d+\\varepsilon_C+\\varepsilon_D$, capped at one; Proposition~\\ref{prop:deterrence-tv} then gives impossibility above that value. The final inequality is the same expectation bound under compliance.\n\\end{proof}","rline P_D(o)>\\overline P_C(o)$ and put $\\overline d=\\TV(\\overline P_D,\\overline P_C)$. In the model of Section~\\ref{sec:enforcement}, this fixed policy makes compliance weakly preferable whenever\n\\[\ng\\leq F(\\overline d-\\varepsilon_C-\\varepsilon_D).\n\\]\nConversely, if $g>F\\min\\{1,\\overline d+\\varepsilon_C+\\varepsilon_D\\}$, no observation-based sanction with penalty $F$ deters the deviation. Also,\n\\[\n\\E_{P_C}s^\\star\\leq\\E_{\\overline P_C}s^\\star+\\varepsilon_C.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe expectation of a $[0,1]$-valued function changes by at most total variation. Hence the true difference of sanction probabilities is at least $\\overline d-\\varepsilon_D-\\varepsilon_C$. Equation~\\eqref{eq:deterrence-gap} gives sufficiency. The triangle inequality bounds the true total variation above by $\\overline d+\\varepsilon_C+\\varepsilon_D$, capped at one; Proposition~\\ref{prop:deterrence-tv} then gives impossibility above that value. The final inequality is the same expectation bound under compliance.\n\\end{proof}","c:enforcement}, this fixed policy makes compliance weakly preferable whenever\n\\[\ng\\leq F(\\overline d-\\varepsilon_C-\\varepsilon_D).\n\\]\nConversely, if $g>F\\min\\{1,\\overline d+\\varepsilon_C+\\varepsilon_D\\}$, no observation-based sanction with penalty $F$ deters the deviation. Also,\n\\[\n\\E_{P_C}s^\\star\\leq\\E_{\\overline P_C}s^\\star+\\varepsilon_C.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe expectation of a $[0,1]$-valued function changes by at most total variation. Hence the true difference of sanction probabilities is at least $\\overline d-\\varepsilon_D-\\varepsilon_C$. Equation~\\eqref{eq:deterrence-gap} gives sufficiency. The triangle inequality bounds the true total variation above by $\\overline d+\\varepsilon_C+\\varepsilon_D$, capped at one; Proposition~\\ref{prop:deterrence-tv} then gives impossibility above that value. The final inequality is the same expectation bound under compliance.\n\\end{proof}","on_D).\n\\]\nConversely, if $g>F\\min\\{1,\\overline d+\\varepsilon_C+\\varepsilon_D\\}$, no observation-based sanction with penalty $F$ deters the deviation. Also,\n\\[\n\\E_{P_C}s^\\star\\leq\\E_{\\overline P_C}s^\\star+\\varepsilon_C.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe expectation of a $[0,1]$-valued function changes by at most total variation. Hence the true difference of sanction probabilities is at least $\\overline d-\\varepsilon_D-\\varepsilon_C$. Equation~\\eqref{eq:deterrence-gap} gives sufficiency. The triangle inequality bounds the true total variation above by $\\overline d+\\varepsilon_C+\\varepsilon_D$, capped at one; Proposition~\\ref{prop:deterrence-tv} then gives impossibility above that value. The final inequality is the same expectation bound under compliance.\n\\end{proof}","{P_C}s^\\star\\leq\\E_{\\overline P_C}s^\\star+\\varepsilon_C.\n\\]\n\\end{proposition}\n\\begin{proof}\nThe expectation of a $[0,1]$-valued function changes by at most total variation. Hence the true difference of sanction probabilities is at least $\\overline d-\\varepsilon_D-\\varepsilon_C$. Equation~\\eqref{eq:deterrence-gap} gives sufficiency. The triangle inequality bounds the true total variation above by $\\overline d+\\varepsilon_C+\\varepsilon_D$, capped at one; Proposition~\\ref{prop:deterrence-tv} then gives impossibility above that value. The final inequality is the same expectation bound under compliance.\n\\end{proof}","When the lower margin is nonpositive it supplies no guarantee for positive $g$. A separate false-positive protection must include the final inequality or use a reduced policy with slack below its cap. The result concerns one common fixed policy and one specified deviation. It is not a license to optimize separately for incompatible deviations, replace missing observations with stationary assumptions, or declare an institution safe because its average trajectory looks stable.","Consider an undirected graph $G=(V,E)$ whose vertices are institutional positions. Each position carries a binary coordinate $x_i\\in\\mathbb F_2$ and each edge $\\{i,j\\}$ imposes the relative constraint\n\\begin{equation}\\label{eq:edge-rule}\nx_i\\oplus x_j=b_{ij},\\qquad b_{ij}\\in\\mathbb F_2.\n\\end{equation}\nThe coordinates might represent a toy authorization bit or a binary convention, but the mathematical model itself makes no claim about a realistic legal code.","\\begin{proposition}[Cycle criterion for binary institutional compatibility]\\label{prop:cycle}\nThe constraints~\\eqref{eq:edge-rule} admit a simultaneous global assignment $(x_i)_{i\\in V}$ if and only if the XOR of the labels $b_{ij}$ along every graph cycle equals $0$. When an assignment exists, each connected component has exactly two assignments, related by complementing every coordinate in that component.\n\\end{proposition}\n\\begin{proof}\nIf an assignment exists, XOR the edge equations around a cycle. Every vertex coordinate appears twice and cancels, so the edge-label XOR is zero. Conversely, choose a spanning forest and assign $0$ to one root in each component. Propagate the vertex values along forest edges using~\\eqref{eq:edge-rule}. Forest edges are satisfied by construction. For a nonforest edge, the unique forest path between its endpoints and that edge form a cycle.","\\begin{proposition}[Cycle criterion for binary institutional compatibility]\\label{prop:cycle}\nThe constraints~\\eqref{eq:edge-rule} admit a simultaneous global assignment $(x_i)_{i\\in V}$ if and only if the XOR of the labels $b_{ij}$ along every graph cycle equals $0$. When an assignment exists, each connected component has exactly two assignments, related by complementing every coordinate in that component.\n\\end{proposition}\n\\begin{proof}\nIf an assignment exists, XOR the edge equations around a cycle. Every vertex coordinate appears twice and cancels, so the edge-label XOR is zero. Conversely, choose a spanning forest and assign $0$ to one root in each component. Propagate the vertex values along forest edges using~\\eqref{eq:edge-rule}. Forest edges are satisfied by construction. For a nonforest edge, the unique forest path between its endpoints and that edge form a cycle. Vanishing cycle parity implies that the propa","\\begin{proposition}[Cycle criterion for binary institutional compatibility]\\label{prop:cycle}\nThe constraints~\\eqref{eq:edge-rule} admit a simultaneous global assignment $(x_i)_{i\\in V}$ if and only if the XOR of the labels $b_{ij}$ along every graph cycle equals $0$. When an assignment exists, each connected component has exactly two assignments, related by complementing every coordinate in that component.\n\\end{proposition}\n\\begin{proof}\nIf an assignment exists, XOR the edge equations around a cycle. Every vertex coordinate appears twice and cancels, so the edge-label XOR is zero. Conversely, choose a spanning forest and assign $0$ to one root in each component. Propagate the vertex values along forest edges using~\\eqref{eq:edge-rule}. Forest edges are satisfied by construction. For a nonforest edge, the unique forest path between its endpoints and that edge form a cycle. Vanishing cycle parity implies that the propagated values satisfy the nonforest","every graph cycle equals $0$. When an assignment exists, each connected component has exactly two assignments, related by complementing every coordinate in that component.\n\\end{proposition}\n\\begin{proof}\nIf an assignment exists, XOR the edge equations around a cycle. Every vertex coordinate appears twice and cancels, so the edge-label XOR is zero. Conversely, choose a spanning forest and assign $0$ to one root in each component. Propagate the vertex values along forest edges using~\\eqref{eq:edge-rule}. Forest edges are satisfied by construction. For a nonforest edge, the unique forest path between its endpoints and that edge form a cycle. Vanishing cycle parity implies that the propagated values satisfy the nonforest edge as well. Finally, a connected solution is fixed by choosing the value at one root; either root value gives an assignment and there are no others.\n\\end{proof}","\\begin{figure}[t]\n\\centering\n\\includegraphics[width=.82\\linewidth]{figures/cycle_obstruction.pdf}\n\\caption{A minimal local--global obstruction. Each displayed pairwise constraint is satisfiable by itself, but their conjunction is inconsistent: XOR around the cycle gives $1$ on the right and $0$ on the left. This is an elementary binary model, not a universal encoding of institutional norms.}\\label{fig:cycle}\n\\end{figure}","This result is a standard parity fact on graphs, closely related to cycle-space algebra and discrete cocycles. Its value here is methodological. It shows why \\emph{pairwise satisfiable} cannot be equated with \\emph{globally realizable}. For a triangle with $b_{12}=0$, $b_{23}=0$, and $b_{31}=1$, every individual edge requirement has a solution, but the three cannot hold together. A translator between two agents could appear successful while a three-party federation is impossible under the combined rules.","Even when a global static state exists, a federation may fail dynamically. Local rule applications could commute in one context and conflict in another. A translator $T_{ij}:Z_i\\to Z_j$ should preserve the operations relevant to the interaction, approximately satisfying $T_{ij}F_i\\simeq F_jT_{ij}$. A federation requires \\emph{both} representational compatibility and admissible operational coordination. Static agreement alone does not define an executable constitution. Nor does faithful gluing prove that the institution should be centralized: a compatible federation may deliberately preserve multiple veto points, modes of appeal, and local autonomy.","\\subsection{Conventions and exact synchronization}\nLet $\\Gamma=(V,E)$ be a finite connected graph. Each oriented edge $i\\to j$ carries $g_{ij}\\in G$, where $G$ is a group and $g_{ji}=g_{ij}^{-1}$. The element $g_{ij}$ transports coordinates from $i$ to $j$ by a left action. For a path $\\gamma=(v_0,\\ldots,v_k)$, define\n\\[\nH_\\gamma=g_{v_{k-1}v_k}\\cdots g_{v_0v_1}.\n\\]\nThe rightmost map acts first. If $v_k=v_0$, this product is the path's holonomy. An exact system of global frames is a family $h_i\\in G$ satisfying\n\\[\ng_{ij}=h_jh_i^{-1}\\qquad\\text{on every edge}.\n\\]","ubsection{Conventions and exact synchronization}\nLet $\\Gamma=(V,E)$ be a finite connected graph. Each oriented edge $i\\to j$ carries $g_{ij}\\in G$, where $G$ is a group and $g_{ji}=g_{ij}^{-1}$. The element $g_{ij}$ transports coordinates from $i$ to $j$ by a left action. For a path $\\gamma=(v_0,\\ldots,v_k)$, define\n\\[\nH_\\gamma=g_{v_{k-1}v_k}\\cdots g_{v_0v_1}.\n\\]\nThe rightmost map acts first. If $v_k=v_0$, this product is the path's holonomy. An exact system of global frames is a family $h_i\\in G$ satisfying\n\\[\ng_{ij}=h_jh_i^{-1}\\qquad\\text{on every edge}.\n\\]","ph. Each oriented edge $i\\to j$ carries $g_{ij}\\in G$, where $G$ is a group and $g_{ji}=g_{ij}^{-1}$. The element $g_{ij}$ transports coordinates from $i$ to $j$ by a left action. For a path $\\gamma=(v_0,\\ldots,v_k)$, define\n\\[\nH_\\gamma=g_{v_{k-1}v_k}\\cdots g_{v_0v_1}.\n\\]\nThe rightmost map acts first. If $v_k=v_0$, this product is the path's holonomy. An exact system of global frames is a family $h_i\\in G$ satisfying\n\\[\ng_{ij}=h_jh_i^{-1}\\qquad\\text{on every edge}.\n\\]","$i\\to j$ carries $g_{ij}\\in G$, where $G$ is a group and $g_{ji}=g_{ij}^{-1}$. The element $g_{ij}$ transports coordinates from $i$ to $j$ by a left action. For a path $\\gamma=(v_0,\\ldots,v_k)$, define\n\\[\nH_\\gamma=g_{v_{k-1}v_k}\\cdots g_{v_0v_1}.\n\\]\nThe rightmost map acts first. If $v_k=v_0$, this product is the path's holonomy. An exact system of global frames is a family $h_i\\in G$ satisfying\n\\[\ng_{ij}=h_jh_i^{-1}\\qquad\\text{on every edge}.\n\\]","\\begin{theorem}[Exact frame synchronization]\\label{thm:holonomy}\nGlobal frames exist if and only if $H_\\gamma=e_G$ for every closed walk. When they exist, they are unique up to common right multiplication $h_i\\mapsto h_i k$. It suffices to check the rooted fundamental loops associated with one spanning tree.\n\\end{theorem}\n\\begin{proof}\nIf $g_{ij}=h_jh_i^{-1}$, adjacent factors cancel in every path product, giving $H_\\gamma=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being ide","\\begin{theorem}[Exact frame synchronization]\\label{thm:holonomy}\nGlobal frames exist if and only if $H_\\gamma=e_G$ for every closed walk. When they exist, they are unique up to common right multiplication $h_i\\mapsto h_i k$. It suffices to check the rooted fundamental loops associated with one spanning tree.\n\\end{theorem}\n\\begin{proof}\nIf $g_{ij}=h_jh_i^{-1}$, adjacent factors cancel in every path product, giving $H_\\gamma=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same","\\begin{theorem}[Exact frame synchronization]\\label{thm:holonomy}\nGlobal frames exist if and only if $H_\\gamma=e_G$ for every closed walk. When they exist, they are unique up to common right multiplication $h_i\\mapsto h_i k$. It suffices to check the rooted fundamental loops associated with one spanning tree.\n\\end{theorem}\n\\begin{proof}\nIf $g_{ij}=h_jh_i^{-1}$, adjacent factors cancel in every path product, giving $H_\\gamma=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","act frame synchronization]\\label{thm:holonomy}\nGlobal frames exist if and only if $H_\\gamma=e_G$ for every closed walk. When they exist, they are unique up to common right multiplication $h_i\\mapsto h_i k$. It suffices to check the rooted fundamental loops associated with one spanning tree.\n\\end{theorem}\n\\begin{proof}\nIf $g_{ij}=h_jh_i^{-1}$, adjacent factors cancel in every path product, giving $H_\\gamma=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","G$ for every closed walk. When they exist, they are unique up to common right multiplication $h_i\\mapsto h_i k$. It suffices to check the rooted fundamental loops associated with one spanning tree.\n\\end{theorem}\n\\begin{proof}\nIf $g_{ij}=h_jh_i^{-1}$, adjacent factors cancel in every path product, giving $H_\\gamma=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","ery closed walk. When they exist, they are unique up to common right multiplication $h_i\\mapsto h_i k$. It suffices to check the rooted fundamental loops associated with one spanning tree.\n\\end{theorem}\n\\begin{proof}\nIf $g_{ij}=h_jh_i^{-1}$, adjacent factors cancel in every path product, giving $H_\\gamma=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","they exist, they are unique up to common right multiplication $h_i\\mapsto h_i k$. It suffices to check the rooted fundamental loops associated with one spanning tree.\n\\end{theorem}\n\\begin{proof}\nIf $g_{ij}=h_jh_i^{-1}$, adjacent factors cancel in every path product, giving $H_\\gamma=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","tiplication $h_i\\mapsto h_i k$. It suffices to check the rooted fundamental loops associated with one spanning tree.\n\\end{theorem}\n\\begin{proof}\nIf $g_{ij}=h_jh_i^{-1}$, adjacent factors cancel in every path product, giving $H_\\gamma=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","tion $h_i\\mapsto h_i k$. It suffices to check the rooted fundamental loops associated with one spanning tree.\n\\end{theorem}\n\\begin{proof}\nIf $g_{ij}=h_jh_i^{-1}$, adjacent factors cancel in every path product, giving $H_\\gamma=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","loops associated with one spanning tree.\n\\end{theorem}\n\\begin{proof}\nIf $g_{ij}=h_jh_i^{-1}$, adjacent factors cancel in every path product, giving $H_\\gamma=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","m}\n\\begin{proof}\nIf $g_{ij}=h_jh_i^{-1}$, adjacent factors cancel in every path product, giving $H_\\gamma=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","djacent factors cancel in every path product, giving $H_\\gamma=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","cancel in every path product, giving $H_\\gamma=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","=h_{v_k}h_{v_0}^{-1}$ and hence identity on a closed walk. Conversely, choose a root $r$, set $h_r=e_G$, and define $h_i$ as the product on the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","the unique tree path from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","from $r$ to $i$. Tree edges satisfy the required identity. For any non-tree edge $i\\to j$, the rooted loop consisting of the path to $i$, that edge, and the reversed path from $j$ has product $h_j^{-1}g_{ij}h_i$. Its being identity gives $g_{ij}=h_jh_i^{-1}$. Thus the fundamental-loop tests suffice. Any other solution obeys the same propagation from its root value, so it is $h_i k$ for a common $k$.\n\\end{proof}","Changing local conventions by elements $k_i$ replaces $g_{ij}$ by $k_jg_{ij}k_i^{-1}$. A loop based at $r$ then has holonomy $k_rH_\\gamma k_r^{-1}$. In particular, identity holonomy is invariant under local changes of coordinates. An arbitrary binary cycle basis with unordered multiplication is not a valid replacement for rooted fundamental loops in a noncommutative group.","\\subsection{A three-jurisdiction example}\nTake $G=S_3$, acting on three role labels. Let the translations on the oriented triangle $A\\to B\\to C\\to A$ be\n\\[\ng_{AB}=(12),\\qquad g_{BC}=(23),\\qquad g_{CA}=e_G.\n\\]\nEvery edge is a valid bijection. With the specified composition convention, the round trip is $(23)(12)\\ne e_G$. Thus no single assignment of complete role frames realizes all three interfaces. Replacing the final edge by $((23)(12))^{-1}$ repairs this loop, but whether that edit is authorized is a separate institutional question.","example}\nTake $G=S_3$, acting on three role labels. Let the translations on the oriented triangle $A\\to B\\to C\\to A$ be\n\\[\ng_{AB}=(12),\\qquad g_{BC}=(23),\\qquad g_{CA}=e_G.\n\\]\nEvery edge is a valid bijection. With the specified composition convention, the round trip is $(23)(12)\\ne e_G$. Thus no single assignment of complete role frames realizes all three interfaces. Replacing the final edge by $((23)(12))^{-1}$ repairs this loop, but whether that edit is authorized is a separate institutional question.","\\begin{figure}[t]\n\\centering\n\\includegraphics[width=.88\\linewidth]{figures/noncommutative_holonomy.pdf}\n\\caption{Three individually invertible interfaces need not synchronize. The ordered round trip is $(23)(12)$, not the identity. The group model concerns the declared role-label contract; it does not certify permissions, provenance, or the legitimacy of an interface edit.}\\label{fig:holonomy}\n\\end{figure}","\\subsection{A shared state is weaker than a shared frame}\nNontrivial holonomy need not prevent \\emph{every} compatible state. Let $G$ act on a set $D$, and seek local states $x_i\\in D$ with $x_j=g_{ij}\\cdot x_i$. A permutation can move some labels while fixing others. A family that uses only a fixed label can be compatible even though its complete coordinate frames are not.","\\begin{proposition}[Compatible states and holonomy fixed points]\\label{prop:holonomysection}\nA compatible state family exists if and only if there is $x_r\\in D$ fixed by every holonomy based at the root $r$. Each such $x_r$ uniquely determines a compatible family by transport along a spanning tree. For a free group action, existence of a compatible family implies identity holonomy; without freeness that implication can fail.\n\\end{proposition}\n\\begin{proof}\nA compatible family transported around a closed walk returns to its starting value, so every based holonomy fixes $x_r$. Conversely, define each $x_i$ by the tree-path product acting on $x_r$. The rooted-loop fixed-point condition gives $g_{ij}\\cdot x_i=x_j$ on non-tree edges as well as tree edges. The tree paths also give uniqueness for a chosen root state. Under a free action, only the identit","\\begin{proposition}[Compatible states and holonomy fixed points]\\label{prop:holonomysection}\nA compatible state family exists if and only if there is $x_r\\in D$ fixed by every holonomy based at the root $r$. Each such $x_r$ uniquely determines a compatible family by transport along a spanning tree. For a free group action, existence of a compatible family implies identity holonomy; without freeness that implication can fail.\n\\end{proposition}\n\\begin{proof}\nA compatible family transported around a closed walk returns to its starting value, so every based holonomy fixes $x_r$. Conversely, define each $x_i$ by the tree-path product acting on $x_r$. The rooted-loop fixed-point condition gives $g_{ij}\\cdot x_i=x_j$ on non-tree edges as well as tree edges. The tree paths also give uniqueness for a chosen root state. Under a free action, only the identity fixes a point, proving the final implication","\\begin{proposition}[Compatible states and holonomy fixed points]\\label{prop:holonomysection}\nA compatible state family exists if and only if there is $x_r\\in D$ fixed by every holonomy based at the root $r$. Each such $x_r$ uniquely determines a compatible family by transport along a spanning tree. For a free group action, existence of a compatible family implies identity holonomy; without freeness that implication can fail.\n\\end{proposition}\n\\begin{proof}\nA compatible family transported around a closed walk returns to its starting value, so every based holonomy fixes $x_r$. Conversely, define each $x_i$ by the tree-path product acting on $x_r$. The rooted-loop fixed-point condition gives $g_{ij}\\cdot x_i=x_j$ on non-tree edges as well as tree edges. The tree paths also give uniqueness for a chosen root state. Under a free action, only the identity fixes a point, proving the final implication.\n\\end{proof}","holonomy based at the root $r$. Each such $x_r$ uniquely determines a compatible family by transport along a spanning tree. For a free group action, existence of a compatible family implies identity holonomy; without freeness that implication can fail.\n\\end{proposition}\n\\begin{proof}\nA compatible family transported around a closed walk returns to its starting value, so every based holonomy fixes $x_r$. Conversely, define each $x_i$ by the tree-path product acting on $x_r$. The rooted-loop fixed-point condition gives $g_{ij}\\cdot x_i=x_j$ on non-tree edges as well as tree edges. The tree paths also give uniqueness for a chosen root state. Under a free action, only the identity fixes a point, proving the final implication.\n\\end{proof}","Each such $x_r$ uniquely determines a compatible family by transport along a spanning tree. For a free group action, existence of a compatible family implies identity holonomy; without freeness that implication can fail.\n\\end{proposition}\n\\begin{proof}\nA compatible family transported around a closed walk returns to its starting value, so every based holonomy fixes $x_r$. Conversely, define each $x_i$ by the tree-path product acting on $x_r$. The rooted-loop fixed-point condition gives $g_{ij}\\cdot x_i=x_j$ on non-tree edges as well as tree edges. The tree paths also give uniqueness for a chosen root state. Under a free action, only the identity fixes a point, proving the final implication.\n\\end{proof}","mpatible family by transport along a spanning tree. For a free group action, existence of a compatible family implies identity holonomy; without freeness that implication can fail.\n\\end{proposition}\n\\begin{proof}\nA compatible family transported around a closed walk returns to its starting value, so every based holonomy fixes $x_r$. Conversely, define each $x_i$ by the tree-path product acting on $x_r$. The rooted-loop fixed-point condition gives $g_{ij}\\cdot x_i=x_j$ on non-tree edges as well as tree edges. The tree paths also give uniqueness for a chosen root state. Under a free action, only the identity fixes a point, proving the final implication.\n\\end{proof}","For a free group action, existence of a compatible family implies identity holonomy; without freeness that implication can fail.\n\\end{proposition}\n\\begin{proof}\nA compatible family transported around a closed walk returns to its starting value, so every based holonomy fixes $x_r$. Conversely, define each $x_i$ by the tree-path product acting on $x_r$. The rooted-loop fixed-point condition gives $g_{ij}\\cdot x_i=x_j$ on non-tree edges as well as tree edges. The tree paths also give uniqueness for a chosen root state. Under a free action, only the identity fixes a point, proving the final implication.\n\\end{proof}","\\begin{counterexample}[Nontrivial frame defect with a compatible state]\\label{ex:fixedholonomy}\nOn a triangle, let one oriented edge carry $(12)\\in S_3$ and the other two carry identity. Holonomy is nontrivial, so global frames do not exist. Nevertheless, the constant state $x_A=x_B=x_C=3$ is compatible because $(12)$ fixes $3$. Failure to align all role meanings is stronger than failure to agree on one unused or invariant role.\n\\end{counterexample}","\\subsection{A quantitative lower bound on interface error}\nSuppose $G$ has a bi-invariant metric $d$, so both left and right multiplication preserve distance. For candidate frames $h_i$, write\n\\[\n\\delta_{ij}=d(g_{ij},h_jh_i^{-1}).\n\\]\n\\begin{proposition}[Loop defect bounds unavoidable edge error]\\label{prop:holonomybound}\nFor a closed walk $\\gamma$ with $k\\ge1$ traversals,\n\\[\nd(H_\\gamma,e_G)\\le\\sum_{(i,j)\\text{ traversed by }\\gamma}\\delta_{ij}.\n\\]\nIn particular, some traversed edge has error at least $d(H_\\gamma,e_G)/k$ for every candidate frame family.\n\\end{proposition}\n\\begin{proof}\nGauge-transform each edge to $\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i$. Bi-invariance gives $d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma","\\subsection{A quantitative lower bound on interface error}\nSuppose $G$ has a bi-invariant metric $d$, so both left and right multiplication preserve distance. For candidate frames $h_i$, write\n\\[\n\\delta_{ij}=d(g_{ij},h_jh_i^{-1}).\n\\]\n\\begin{proposition}[Loop defect bounds unavoidable edge error]\\label{prop:holonomybound}\nFor a closed walk $\\gamma$ with $k\\ge1$ traversals,\n\\[\nd(H_\\gamma,e_G)\\le\\sum_{(i,j)\\text{ traversed by }\\gamma}\\delta_{ij}.\n\\]\nIn particular, some traversed edge has error at least $d(H_\\gamma,e_G)/k$ for every candidate frame family.\n\\end{proposition}\n\\begin{proof}\nGauge-transform each edge to $\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i$. Bi-invariance gives $d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma h_r$, at the same distance fro","\\subsection{A quantitative lower bound on interface error}\nSuppose $G$ has a bi-invariant metric $d$, so both left and right multiplication preserve distance. For candidate frames $h_i$, write\n\\[\n\\delta_{ij}=d(g_{ij},h_jh_i^{-1}).\n\\]\n\\begin{proposition}[Loop defect bounds unavoidable edge error]\\label{prop:holonomybound}\nFor a closed walk $\\gamma$ with $k\\ge1$ traversals,\n\\[\nd(H_\\gamma,e_G)\\le\\sum_{(i,j)\\text{ traversed by }\\gamma}\\delta_{ij}.\n\\]\nIn particular, some traversed edge has error at least $d(H_\\gamma,e_G)/k$ for every candidate frame family.\n\\end{proposition}\n\\begin{proof}\nGauge-transform each edge to $\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i$. Bi-invariance gives $d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma h_r$, at the same distance from identity as $H_\\gamma$. Repeatedly applying the triangle inequality and invariance","\\subsection{A quantitative lower bound on interface error}\nSuppose $G$ has a bi-invariant metric $d$, so both left and right multiplication preserve distance. For candidate frames $h_i$, write\n\\[\n\\delta_{ij}=d(g_{ij},h_jh_i^{-1}).\n\\]\n\\begin{proposition}[Loop defect bounds unavoidable edge error]\\label{prop:holonomybound}\nFor a closed walk $\\gamma$ with $k\\ge1$ traversals,\n\\[\nd(H_\\gamma,e_G)\\le\\sum_{(i,j)\\text{ traversed by }\\gamma}\\delta_{ij}.\n\\]\nIn particular, some traversed edge has error at least $d(H_\\gamma,e_G)/k$ for every candidate frame family.\n\\end{proposition}\n\\begin{proof}\nGauge-transform each edge to $\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i$. Bi-invariance gives $d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma h_r$, at the same distance from identity as $H_\\gamma$. Repeatedly applying the triangle inequality and invariance to a product bounds that distance by the sum of","\\subsection{A quantitative lower bound on interface error}\nSuppose $G$ has a bi-invariant metric $d$, so both left and right multiplication preserve distance. For candidate frames $h_i$, write\n\\[\n\\delta_{ij}=d(g_{ij},h_jh_i^{-1}).\n\\]\n\\begin{proposition}[Loop defect bounds unavoidable edge error]\\label{prop:holonomybound}\nFor a closed walk $\\gamma$ with $k\\ge1$ traversals,\n\\[\nd(H_\\gamma,e_G)\\le\\sum_{(i,j)\\text{ traversed by }\\gamma}\\delta_{ij}.\n\\]\nIn particular, some traversed edge has error at least $d(H_\\gamma,e_G)/k$ for every candidate frame family.\n\\end{proposition}\n\\begin{proof}\nGauge-transform each edge to $\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i$. Bi-invariance gives $d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma h_r$, at the same distance from identity as $H_\\gamma$. Repeatedly applying the triangle inequality and invariance to a product bounds that distance by the sum of its factors' distances from identity. Since $k\\max\\delta_{ij}\\ge\\sum\\delta_{ij}\\ge d(H_\\gamma,e_G)$ along the walk,","\\subsection{A quantitative lower bound on interface error}\nSuppose $G$ has a bi-invariant metric $d$, so both left and right multiplication preserve distance. For candidate frames $h_i$, write\n\\[\n\\delta_{ij}=d(g_{ij},h_jh_i^{-1}).\n\\]\n\\begin{proposition}[Loop defect bounds unavoidable edge error]\\label{prop:holonomybound}\nFor a closed walk $\\gamma$ with $k\\ge1$ traversals,\n\\[\nd(H_\\gamma,e_G)\\le\\sum_{(i,j)\\text{ traversed by }\\gamma}\\delta_{ij}.\n\\]\nIn particular, some traversed edge has error at least $d(H_\\gamma,e_G)/k$ for every candidate frame family.\n\\end{proposition}\n\\begin{proof}\nGauge-transform each edge to $\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i$. Bi-invariance gives $d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma h_r$, at the same distance from identity as $H_\\gamma$. Repeatedly applying the triangle inequality and invariance to a product bounds that distance by the sum of its factors' distances from identity. Since $k\\max\\delta_{ij}\\ge\\sum\\delta_{ij}\\ge d(H_\\gamma,e_G)$ along the walk, the maximum e","\\subsection{A quantitative lower bound on interface error}\nSuppose $G$ has a bi-invariant metric $d$, so both left and right multiplication preserve distance. For candidate frames $h_i$, write\n\\[\n\\delta_{ij}=d(g_{ij},h_jh_i^{-1}).\n\\]\n\\begin{proposition}[Loop defect bounds unavoidable edge error]\\label{prop:holonomybound}\nFor a closed walk $\\gamma$ with $k\\ge1$ traversals,\n\\[\nd(H_\\gamma,e_G)\\le\\sum_{(i,j)\\text{ traversed by }\\gamma}\\delta_{ij}.\n\\]\nIn particular, some traversed edge has error at least $d(H_\\gamma,e_G)/k$ for every candidate frame family.\n\\end{proposition}\n\\begin{proof}\nGauge-transform each edge to $\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i$. Bi-invariance gives $d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma h_r$, at the same distance from identity as $H_\\gamma$. Repeatedly applying the triangle inequality and invariance to a product bounds that distance by the sum of its factors' distances from identity. Since $k\\max\\delta_{ij}\\ge\\sum\\delta_{ij}\\ge d(H_\\gamma,e_G)$ along the walk, the maximum error is at least $d(H_\\gamma,e_G)/k$.\n\\…","oth left and right multiplication preserve distance. For candidate frames $h_i$, write\n\\[\n\\delta_{ij}=d(g_{ij},h_jh_i^{-1}).\n\\]\n\\begin{proposition}[Loop defect bounds unavoidable edge error]\\label{prop:holonomybound}\nFor a closed walk $\\gamma$ with $k\\ge1$ traversals,\n\\[\nd(H_\\gamma,e_G)\\le\\sum_{(i,j)\\text{ traversed by }\\gamma}\\delta_{ij}.\n\\]\nIn particular, some traversed edge has error at least $d(H_\\gamma,e_G)/k$ for every candidate frame family.\n\\end{proposition}\n\\begin{proof}\nGauge-transform each edge to $\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i$. Bi-invariance gives $d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma h_r$, at the same distance from identity as $H_\\gamma$. Repeatedly applying the triangle inequality and invariance to a product bounds that distance by the sum of its factors' distances from identity. Since $k\\max\\delta_{ij}\\ge\\sum\\delta_{ij}\\ge d(H_\\gamma,e_G)$ along the walk, the maximum error is at least $d(H_\\gamma,e_G)/k$.\n\\end{proof}","_i^{-1}).\n\\]\n\\begin{proposition}[Loop defect bounds unavoidable edge error]\\label{prop:holonomybound}\nFor a closed walk $\\gamma$ with $k\\ge1$ traversals,\n\\[\nd(H_\\gamma,e_G)\\le\\sum_{(i,j)\\text{ traversed by }\\gamma}\\delta_{ij}.\n\\]\nIn particular, some traversed edge has error at least $d(H_\\gamma,e_G)/k$ for every candidate frame family.\n\\end{proposition}\n\\begin{proof}\nGauge-transform each edge to $\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i$. Bi-invariance gives $d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma h_r$, at the same distance from identity as $H_\\gamma$. Repeatedly applying the triangle inequality and invariance to a product bounds that distance by the sum of its factors' distances from identity. Since $k\\max\\delta_{ij}\\ge\\sum\\delta_{ij}\\ge d(H_\\gamma,e_G)$ along the walk, the maximum error is at least $d(H_\\gamma,e_G)/k$.\n\\end{proof}","able edge error]\\label{prop:holonomybound}\nFor a closed walk $\\gamma$ with $k\\ge1$ traversals,\n\\[\nd(H_\\gamma,e_G)\\le\\sum_{(i,j)\\text{ traversed by }\\gamma}\\delta_{ij}.\n\\]\nIn particular, some traversed edge has error at least $d(H_\\gamma,e_G)/k$ for every candidate frame family.\n\\end{proposition}\n\\begin{proof}\nGauge-transform each edge to $\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i$. Bi-invariance gives $d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma h_r$, at the same distance from identity as $H_\\gamma$. Repeatedly applying the triangle inequality and invariance to a product bounds that distance by the sum of its factors' distances from identity. Since $k\\max\\delta_{ij}\\ge\\sum\\delta_{ij}\\ge d(H_\\gamma,e_G)$ along the walk, the maximum error is at least $d(H_\\gamma,e_G)/k$.\n\\end{proof}","th $k\\ge1$ traversals,\n\\[\nd(H_\\gamma,e_G)\\le\\sum_{(i,j)\\text{ traversed by }\\gamma}\\delta_{ij}.\n\\]\nIn particular, some traversed edge has error at least $d(H_\\gamma,e_G)/k$ for every candidate frame family.\n\\end{proposition}\n\\begin{proof}\nGauge-transform each edge to $\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i$. Bi-invariance gives $d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma h_r$, at the same distance from identity as $H_\\gamma$. Repeatedly applying the triangle inequality and invariance to a product bounds that distance by the sum of its factors' distances from identity. Since $k\\max\\delta_{ij}\\ge\\sum\\delta_{ij}\\ge d(H_\\gamma,e_G)$ along the walk, the maximum error is at least $d(H_\\gamma,e_G)/k$.\n\\end{proof}","traversed by }\\gamma}\\delta_{ij}.\n\\]\nIn particular, some traversed edge has error at least $d(H_\\gamma,e_G)/k$ for every candidate frame family.\n\\end{proposition}\n\\begin{proof}\nGauge-transform each edge to $\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i$. Bi-invariance gives $d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma h_r$, at the same distance from identity as $H_\\gamma$. Repeatedly applying the triangle inequality and invariance to a product bounds that distance by the sum of its factors' distances from identity. Since $k\\max\\delta_{ij}\\ge\\sum\\delta_{ij}\\ge d(H_\\gamma,e_G)$ along the walk, the maximum error is at least $d(H_\\gamma,e_G)/k$.\n\\end{proof}","\\begin{proof}\nGauge-transform each edge to $\\widetilde g_{ij}=h_j^{-1}g_{ij}h_i$. Bi-invariance gives $d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma h_r$, at the same distance from identity as $H_\\gamma$. Repeatedly applying the triangle inequality and invariance to a product bounds that distance by the sum of its factors' distances from identity. Since $k\\max\\delta_{ij}\\ge\\sum\\delta_{ij}\\ge d(H_\\gamma,e_G)$ along the walk, the maximum error is at least $d(H_\\gamma,e_G)/k$.\n\\end{proof}","$d(\\widetilde g_{ij},e_G)=\\delta_{ij}$. The transformed loop product is $h_r^{-1}H_\\gamma h_r$, at the same distance from identity as $H_\\gamma$. Repeatedly applying the triangle inequality and invariance to a product bounds that distance by the sum of its factors' distances from identity. Since $k\\max\\delta_{ij}\\ge\\sum\\delta_{ij}\\ge d(H_\\gamma,e_G)$ along the walk, the maximum error is at least $d(H_\\gamma,e_G)/k$.\n\\end{proof}","We formalize a restricted compositional calculus, rather than assuming that every mismatch is measured in one natural unit. Three realizations $j=0,1,2$ have metric state spaces $(Z_j,d_j)$ and a common finite action alphabet $\\mathcal A$. For algebraic comparison, each action has a total update $F_j^a$: a disabled action goes to an explicit rejection state. Translations map rejection to rejection. A separate permission predicate records which actions are genuinely admitted. Totalization is a bookkeeping device and does not authorize the disabled action.","\\subsection{Common semantic coordinates}\nFor each component type $c\\in\\{P,O,R,E\\}$, let\n\\[\ng_j^c:Z_j\\longrightarrow(E_c,\\delta_c)\n\\]\nbe a contract observable in a common metric codomain. $P$ records permissions over the common action alphabet; $O$ records obligation-monitor state; $R$ records resources in common physical or accounting units; and $E$ records the required evidentiary and provenance structure. A change of units, action names, or obligation identifiers requires an explicitly specified alignment before these comparisons can be made.","Possible metrics include the discrete metric on permission vectors, a declared metric on obligation-monitor states, an $\\ell^1$ distance on common-unit resource vectors, and symmetric-difference cardinality on required evidence records. For evidence, record equality is structural preservation under a trust model, not a truth certificate. If the payload or inferential dependencies matter, they must be included in the observable rather than only its identifier.","For a translation $T:Z_i\\to Z_j$, define\n\\[\n\\begin{split}\n\\varepsilon_{\\rm dyn}(T)\n &=\\sup_{z,a}d_j\\bigl(TF_i^a(z),F_j^aT(z)\\bigr),","For a translation $T:Z_i\\to Z_j$, define\n\\[\n\\begin{split}\n\\varepsilon_{\\rm dyn}(T)\n &=\\sup_{z,a}d_j\\bigl(TF_i^a(z),F_j^aT(z)\\bigr),\\\\\n\\varepsilon_c(T)\n &=\\sup_z\\delta_c\\bigl(g_j^cT(z),g_i^c(z)\\bigr)\n \\quad(c=P,O,R,E).\n\\end{split}\n\\]\nThe institutional residual profile is\n\\[\n\\mathfrak D(T)=\n(\\varepsilon_{\\rm dyn},\\varepsilon_P,\\varepsilon_O,\n\\varepsilon_R,\\varepsilon_E).\n\\]\nIts entries are not added together. They have different meanings and may have different units. A one-sided authorization check can additionally distinguish newly granted forbidden actions from lost legitimate permissions. The symmetric permission residual measures both changes and is deliberately stronger.","\\varepsilon_c(T)\n &=\\sup_z\\delta_c\\bigl(g_j^cT(z),g_i^c(z)\\bigr)\n \\quad(c=P,O,R,E).\n\\end{split}\n\\]\nThe institutional residual profile is\n\\[\n\\mathfrak D(T)=\n(\\varepsilon_{\\rm dyn},\\varepsilon_P,\\varepsilon_O,\n\\varepsilon_R,\\varepsilon_E).\n\\]\nIts entries are not added together. They have different meanings and may have different units. A one-sided authorization check can additionally distinguish newly granted forbidden actions from lost legitimate permissions. The symmetric permission residual measures both changes and is deliberately stronger.","\\begin{theorem}[Composition of typed institutional residuals]\\label{thm:residual}\nLet $T:Z_0\\to Z_1$ and $U:Z_1\\to Z_2$ have finite residuals under the same semantic coordinates. Suppose $U$ is $L$-Lipschitz. Then\n\\[\n\\varepsilon_{\\rm dyn}(UT)\n\\leq L\\varepsilon_{\\rm dyn}(T)+\\varepsilon_{\\rm dyn}(U),\n\\]\nand, separately for every $c\\in\\{P,O,R,E\\}$,\n\\[\n\\varepsilon_c(UT)\\leq\\varepsilon_c(T)+\\varepsilon_c(U).\n\\]\nConsequently translations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, ins","\\begin{theorem}[Composition of typed institutional residuals]\\label{thm:residual}\nLet $T:Z_0\\to Z_1$ and $U:Z_1\\to Z_2$ have finite residuals under the same semantic coordinates. Suppose $U$ is $L$-Lipschitz. Then\n\\[\n\\varepsilon_{\\rm dyn}(UT)\n\\leq L\\varepsilon_{\\rm dyn}(T)+\\varepsilon_{\\rm dyn}(U),\n\\]\nand, separately for every $c\\in\\{P,O,R,E\\}$,\n\\[\n\\varepsilon_c(UT)\\leq\\varepsilon_c(T)+\\varepsilon_c(U).\n\\]\nConsequently translations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ bet","\\begin{theorem}[Composition of typed institutional residuals]\\label{thm:residual}\nLet $T:Z_0\\to Z_1$ and $U:Z_1\\to Z_2$ have finite residuals under the same semantic coordinates. Suppose $U$ is $L$-Lipschitz. Then\n\\[\n\\varepsilon_{\\rm dyn}(UT)\n\\leq L\\varepsilon_{\\rm dyn}(T)+\\varepsilon_{\\rm dyn}(U),\n\\]\nand, separately for every $c\\in\\{P,O,R,E\\}$,\n\\[\n\\varepsilon_c(UT)\\leq\\varepsilon_c(T)+\\varepsilon_c(U).\n\\]\nConsequently translations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same me","\\begin{theorem}[Composition of typed institutional residuals]\\label{thm:residual}\nLet $T:Z_0\\to Z_1$ and $U:Z_1\\to Z_2$ have finite residuals under the same semantic coordinates. Suppose $U$ is $L$-Lipschitz. Then\n\\[\n\\varepsilon_{\\rm dyn}(UT)\n\\leq L\\varepsilon_{\\rm dyn}(T)+\\varepsilon_{\\rm dyn}(U),\n\\]\nand, separately for every $c\\in\\{P,O,R,E\\}$,\n\\[\n\\varepsilon_c(UT)\\leq\\varepsilon_c(T)+\\varepsilon_c(U).\n\\]\nConsequently translations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same metric sp","\\begin{theorem}[Composition of typed institutional residuals]\\label{thm:residual}\nLet $T:Z_0\\to Z_1$ and $U:Z_1\\to Z_2$ have finite residuals under the same semantic coordinates. Suppose $U$ is $L$-Lipschitz. Then\n\\[\n\\varepsilon_{\\rm dyn}(UT)\n\\leq L\\varepsilon_{\\rm dyn}(T)+\\varepsilon_{\\rm dyn}(U),\n\\]\nand, separately for every $c\\in\\{P,O,R,E\\}$,\n\\[\n\\varepsilon_c(UT)\\leq\\varepsilon_c(T)+\\varepsilon_c(U).\n\\]\nConsequently translations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same metric space $E_c$, so their bounds add directly. Taking suprema proves the claims.\n\\end{proof}","es. Suppose $U$ is $L$-Lipschitz. Then\n\\[\n\\varepsilon_{\\rm dyn}(UT)\n\\leq L\\varepsilon_{\\rm dyn}(T)+\\varepsilon_{\\rm dyn}(U),\n\\]\nand, separately for every $c\\in\\{P,O,R,E\\}$,\n\\[\n\\varepsilon_c(UT)\\leq\\varepsilon_c(T)+\\varepsilon_c(U).\n\\]\nConsequently translations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same metric space $E_c$, so their bounds add directly. Taking suprema proves the claims.\n\\end{proof}","$-Lipschitz. Then\n\\[\n\\varepsilon_{\\rm dyn}(UT)\n\\leq L\\varepsilon_{\\rm dyn}(T)+\\varepsilon_{\\rm dyn}(U),\n\\]\nand, separately for every $c\\in\\{P,O,R,E\\}$,\n\\[\n\\varepsilon_c(UT)\\leq\\varepsilon_c(T)+\\varepsilon_c(U).\n\\]\nConsequently translations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same metric space $E_c$, so their bounds add directly. Taking suprema proves the claims.\n\\end{proof}","\\[\n\\varepsilon_{\\rm dyn}(UT)\n\\leq L\\varepsilon_{\\rm dyn}(T)+\\varepsilon_{\\rm dyn}(U),\n\\]\nand, separately for every $c\\in\\{P,O,R,E\\}$,\n\\[\n\\varepsilon_c(UT)\\leq\\varepsilon_c(T)+\\varepsilon_c(U).\n\\]\nConsequently translations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same metric space $E_c$, so their bounds add directly. Taking suprema proves the claims.\n\\end{proof}","ilon_{\\rm dyn}(U),\n\\]\nand, separately for every $c\\in\\{P,O,R,E\\}$,\n\\[\n\\varepsilon_c(UT)\\leq\\varepsilon_c(T)+\\varepsilon_c(U).\n\\]\nConsequently translations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same metric space $E_c$, so their bounds add directly. Taking suprema proves the claims.\n\\end{proof}","eparately for every $c\\in\\{P,O,R,E\\}$,\n\\[\n\\varepsilon_c(UT)\\leq\\varepsilon_c(T)+\\varepsilon_c(U).\n\\]\nConsequently translations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same metric space $E_c$, so their bounds add directly. Taking suprema proves the claims.\n\\end{proof}",",E\\}$,\n\\[\n\\varepsilon_c(UT)\\leq\\varepsilon_c(T)+\\varepsilon_c(U).\n\\]\nConsequently translations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same metric space $E_c$, so their bounds add directly. Taking suprema proves the claims.\n\\end{proof}","repsilon_c(U).\n\\]\nConsequently translations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same metric space $E_c$, so their bounds add directly. Taking suprema proves the claims.\n\\end{proof}",").\n\\]\nConsequently translations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same metric space $E_c$, so their bounds add directly. Taking suprema proves the claims.\n\\end{proof}","ranslations with zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same metric space $E_c$, so their bounds add directly. Taking suprema proves the claims.\n\\end{proof}","zero residual in every coordinate compose to translations with zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same metric space $E_c$, so their bounds add directly. Taking suprema proves the claims.\n\\end{proof}","th zero residual under this contract.\n\\end{theorem}\n\\begin{proof}\nInsert $UF_1^aT(z)$ between $UTF_0^a(z)$ and $F_2^aUT(z)$. The triangle inequality, then Lipschitz continuity of $U$, bound the two terms by $L\\varepsilon_{\\rm dyn}(T)$ and $\\varepsilon_{\\rm dyn}(U)$. For an observable type $c$, insert $g_1^cT(z)$ between $g_2^cUT(z)$ and $g_0^c(z)$. Both comparisons occur in the same metric space $E_c$, so their bounds add directly. Taking suprema proves the claims.\n\\end{proof}","\\subsection{Failures the profile separates}\nIn a one-step commons interface, a translator might preserve the allocation $(1,1,1,1)$ while interpreting every received signature as a valid amendment approval. Its current resource defect can be zero while its permission defect is nonzero. A second translator might preserve amendment permissions but replace the pending debt record by the empty monitor state. Its obligation defect is nonzero before the altered repayment changes an allocation. A third can preserve both records while duplicating a spendable token, violating the resource coordinate.","The binary jurisdiction model admits a sharper statement. A local convention change $x_i'=x_i\\oplus c_i$ transforms its edge labels to\n\\[\nb_{ij}'=b_{ij}\\oplus c_i\\oplus c_j.\n\\]","\\begin{proposition}[Cycle residual and minimum authorized repair]\\label{prop:cyclerepair}\nThe XOR of edge labels around a cycle is unchanged by every local convention change above. On a single simple cycle with odd XOR, suppose an editable subset of edges can be flipped at nonnegative costs $w_e$, with other edges protected. An authorized repair exists exactly when the editable subset is nonempty. The minimum cost is then $\\min_e w_e$ over editable edges. If all edges are protected, no change of local binary conventions can produce a compatible global assignment.\n\\end{proposition}\n\\begin{proof}\nIn the XOR around a cycle each $c_i$ occurs twice and cancels, preserving the residual. Changing odd parity to even requires an odd number of edge flips. Every such repair includes at least one editable edge and costs at least the cheapest editable-edge cost because costs are nonnegative. Flipping that cheapest edge is sufficient by Proposition~\\ref{prop:cycle}. With no editable edge parity","esidual and minimum authorized repair]\\label{prop:cyclerepair}\nThe XOR of edge labels around a cycle is unchanged by every local convention change above. On a single simple cycle with odd XOR, suppose an editable subset of edges can be flipped at nonnegative costs $w_e$, with other edges protected. An authorized repair exists exactly when the editable subset is nonempty. The minimum cost is then $\\min_e w_e$ over editable edges. If all edges are protected, no change of local binary conventions can produce a compatible global assignment.\n\\end{proposition}\n\\begin{proof}\nIn the XOR around a cycle each $c_i$ occurs twice and cancels, preserving the residual. Changing odd parity to even requires an odd number of edge flips. Every such repair includes at least one editable edge and costs at least the cheapest editable-edge cost because costs are nonnegative. Flipping that cheapest edge is sufficient by Proposition~\\ref{prop:cycle}. With no editable edge parity cannot change, and local convention changes also preserve it.\n\\end{proof}","table subset of edges can be flipped at nonnegative costs $w_e$, with other edges protected. An authorized repair exists exactly when the editable subset is nonempty. The minimum cost is then $\\min_e w_e$ over editable edges. If all edges are protected, no change of local binary conventions can produce a compatible global assignment.\n\\end{proposition}\n\\begin{proof}\nIn the XOR around a cycle each $c_i$ occurs twice and cancels, preserving the residual. Changing odd parity to even requires an odd number of edge flips. Every such repair includes at least one editable edge and costs at least the cheapest editable-edge cost because costs are nonnegative. Flipping that cheapest edge is sufficient by Proposition~\\ref{prop:cycle}. With no editable edge parity cannot change, and local convention changes also preserve it.\n\\end{proof}","Suppose errors $E_1,\\ldots,E_n$ in scalar estimates are centered, have common variance $\\sigma^2>0$, and have common pairwise correlation $\\rho\\in[0,1]$. Then\n\\begin{equation}\\label{eq:correlated}\n\\operatorname{Var}\\left(\\frac1n\\sum_{i=1}^n E_i\\right)\n=\\frac{\\sigma^2}{n}\\bigl(1+(n-1)\\rho\\bigr).\n\\end{equation}\nThis elementary identity follows by expanding the variance and counting $n(n-1)$ off-diagonal covariance terms. Relative to the variance of an average of independent equal-variance estimators, the \\emph{variance-equivalent} effective sample size is\n\\[\nn_{\\mathrm{eff}}=\\frac{n}{1+(n-1)\\rho}.\n\\]\nIf the errors are perfectly correlated, adding copies does not reduce variance. This equation does not give a general probab","Suppose errors $E_1,\\ldots,E_n$ in scalar estimates are centered, have common variance $\\sigma^2>0$, and have common pairwise correlation $\\rho\\in[0,1]$. Then\n\\begin{equation}\\label{eq:correlated}\n\\operatorname{Var}\\left(\\frac1n\\sum_{i=1}^n E_i\\right)\n=\\frac{\\sigma^2}{n}\\bigl(1+(n-1)\\rho\\bigr).\n\\end{equation}\nThis elementary identity follows by expanding the variance and counting $n(n-1)$ off-diagonal covariance terms. Relative to the variance of an average of independent equal-variance estimators, the \\emph{variance-equivalent} effective sample size is\n\\[\nn_{\\mathrm{eff}}=\\frac{n}{1+(n-1)\\rho}.\n\\]\nIf the errors are perfectly correlated, adding copies does not reduce variance. This equation does not give a general probability that a majority is right, and real error structures need not h","Suppose errors $E_1,\\ldots,E_n$ in scalar estimates are centered, have common variance $\\sigma^2>0$, and have common pairwise correlation $\\rho\\in[0,1]$. Then\n\\begin{equation}\\label{eq:correlated}\n\\operatorname{Var}\\left(\\frac1n\\sum_{i=1}^n E_i\\right)\n=\\frac{\\sigma^2}{n}\\bigl(1+(n-1)\\rho\\bigr).\n\\end{equation}\nThis elementary identity follows by expanding the variance and counting $n(n-1)$ off-diagonal covariance terms. Relative to the variance of an average of independent equal-variance estimators, the \\emph{variance-equivalent} effective sample size is\n\\[\nn_{\\mathrm{eff}}=\\frac{n}{1+(n-1)\\rho}.\n\\]\nIf the errors are perfectly correlated, adding copies does not reduce variance. This equation does not give a general probability that a majority is right, and real error structures need not have one uniform correlation parameter. It nevertheles","Suppose errors $E_1,\\ldots,E_n$ in scalar estimates are centered, have common variance $\\sigma^2>0$, and have common pairwise correlation $\\rho\\in[0,1]$. Then\n\\begin{equation}\\label{eq:correlated}\n\\operatorname{Var}\\left(\\frac1n\\sum_{i=1}^n E_i\\right)\n=\\frac{\\sigma^2}{n}\\bigl(1+(n-1)\\rho\\bigr).\n\\end{equation}\nThis elementary identity follows by expanding the variance and counting $n(n-1)$ off-diagonal covariance terms. Relative to the variance of an average of independent equal-variance estimators, the \\emph{variance-equivalent} effective sample size is\n\\[\nn_{\\mathrm{eff}}=\\frac{n}{1+(n-1)\\rho}.\n\\]\nIf the errors are perfectly correlated, adding copies does not reduce variance. This equation does not give a general probability that a majority is right, and real error structures need not have one uniform correlation parameter. It nevertheless defeats the claim that numerical agreement automatically equals independent support. Shared training histories, copied observations, and a comm","Suppose errors $E_1,\\ldots,E_n$ in scalar estimates are centered, have common variance $\\sigma^2>0$, and have common pairwise correlation $\\rho\\in[0,1]$. Then\n\\begin{equation}\\label{eq:correlated}\n\\operatorname{Var}\\left(\\frac1n\\sum_{i=1}^n E_i\\right)\n=\\frac{\\sigma^2}{n}\\bigl(1+(n-1)\\rho\\bigr).\n\\end{equation}\nThis elementary identity follows by expanding the variance and counting $n(n-1)$ off-diagonal covariance terms. Relative to the variance of an average of independent equal-variance estimators, the \\emph{variance-equivalent} effective sample size is\n\\[\nn_{\\mathrm{eff}}=\\frac{n}{1+(n-1)\\rho}.\n\\]\nIf the errors are perfectly correlated, adding copies does not reduce variance. This equation does not give a general probability that a majority is right, and real error structures need not have one uniform correlation parameter. It nevertheless defeats the claim that numerical agreement automatically equals independent support. Shared training histories, copied observations, and a common archive may all create dependence that is invisible in the final vote count.","gin{equation}\\label{eq:correlated}\n\\operatorname{Var}\\left(\\frac1n\\sum_{i=1}^n E_i\\right)\n=\\frac{\\sigma^2}{n}\\bigl(1+(n-1)\\rho\\bigr).\n\\end{equation}\nThis elementary identity follows by expanding the variance and counting $n(n-1)$ off-diagonal covariance terms. Relative to the variance of an average of independent equal-variance estimators, the \\emph{variance-equivalent} effective sample size is\n\\[\nn_{\\mathrm{eff}}=\\frac{n}{1+(n-1)\\rho}.\n\\]\nIf the errors are perfectly correlated, adding copies does not reduce variance. This equation does not give a general probability that a majority is right, and real error structures need not have one uniform correlation parameter. It nevertheless defeats the claim that numerical agreement automatically equals independent support. Shared training histories, copied observations, and a common archive may all create dependence that is invisible in the final vote count.","If a message $M$ has the same conditional distribution under two equally possible hidden states $\\theta=0,1$, then Bayes' rule gives $\\Pr(\\theta=1\\mid M)=\\Pr(\\theta=1)$ wherever the posterior is defined. Such a channel carries no information about the distinction, regardless of how fluent or authoritative its reports appear. In strategic environments, senders may have preferences that differ from those of receivers. The theory of strategic information transmission shows why informative communication can depend on preference alignment and signaling structure~\\cite{crawfordsobel}. A message being grammatically meaningful is not a truth guarantee.","\\subsection{A decision-only public record}\nLet an unknown state $\\theta\\in\\{0,1\\}$ have equal prior probabilities. Participant $t$ receives a private signal $s_t\\in\\{0,1\\}$ with\n\\[\n\\Prob(s_t=\\theta\\mid\\theta)=p,\\qquad 1/2<p<1.\n\\]\nSignals are independent conditional on $\\theta$, and their accuracy is common knowledge. In sequence, each participant observes previous actions $a_1,\\ldots,a_{t-1}$ and its own signal, then chooses $a_t\\in\\{0,1\\}$ to maximize its probability of matching $\\theta$. At exact posterior indifference it follows its private signal. The public record contains actions, not private signals, and all participants know the decision rule. There are no conformity rewards, sanctions for dissent, or strategic misreports in this model. This private-signal tie co","\\subsection{A decision-only public record}\nLet an unknown state $\\theta\\in\\{0,1\\}$ have equal prior probabilities. Participant $t$ receives a private signal $s_t\\in\\{0,1\\}$ with\n\\[\n\\Prob(s_t=\\theta\\mid\\theta)=p,\\qquad 1/2<p<1.\n\\]\nSignals are independent conditional on $\\theta$, and their accuracy is common knowledge. In sequence, each participant observes previous actions $a_1,\\ldots,a_{t-1}$ and its own signal, then chooses $a_t\\in\\{0,1\\}$ to maximize its probability of matching $\\theta$. At exact posterior indifference it follows its private signal. The public record contains actions, not private signals, and all participants know the decision rule. There are no conformity rewards, sanctions for dissent, or strategic misreports in this model. This private-signal tie convention is an explicit variant of the random ti","\\subsection{A decision-only public record}\nLet an unknown state $\\theta\\in\\{0,1\\}$ have equal prior probabilities. Participant $t$ receives a private signal $s_t\\in\\{0,1\\}$ with\n\\[\n\\Prob(s_t=\\theta\\mid\\theta)=p,\\qquad 1/2<p<1.\n\\]\nSignals are independent conditional on $\\theta$, and their accuracy is common knowledge. In sequence, each participant observes previous actions $a_1,\\ldots,a_{t-1}$ and its own signal, then chooses $a_t\\in\\{0,1\\}$ to maximize its probability of matching $\\theta$. At exact posterior indifference it follows its private signal. The public record contains actions, not private signals, and all participants know the decision rule. There are no conformity rewards, sanctions for dissent, or strategic misreports in this model. This private-signal tie convention is an explicit variant of the random tie-breaking convention in the basic example","\\subsection{A decision-only public record}\nLet an unknown state $\\theta\\in\\{0,1\\}$ have equal prior probabilities. Participant $t$ receives a private signal $s_t\\in\\{0,1\\}$ with\n\\[\n\\Prob(s_t=\\theta\\mid\\theta)=p,\\qquad 1/2<p<1.\n\\]\nSignals are independent conditional on $\\theta$, and their accuracy is common knowledge. In sequence, each participant observes previous actions $a_1,\\ldots,a_{t-1}$ and its own signal, then chooses $a_t\\in\\{0,1\\}$ to maximize its probability of matching $\\theta$. At exact posterior indifference it follows its private signal. The public record contains actions, not private signals, and all participants know the decision rule. There are no conformity rewards, sanctions for dissent, or strategic misreports in this model. This private-signal tie convention is an explicit variant of the random tie-breaking convention in the basic example of Bikhchandani, Hirshleifer, and Welch~\\cite{bikhchand","\\subsection{A decision-only public record}\nLet an unknown state $\\theta\\in\\{0,1\\}$ have equal prior probabilities. Participant $t$ receives a private signal $s_t\\in\\{0,1\\}$ with\n\\[\n\\Prob(s_t=\\theta\\mid\\theta)=p,\\qquad 1/2<p<1.\n\\]\nSignals are independent conditional on $\\theta$, and their accuracy is common knowledge. In sequence, each participant observes previous actions $a_1,\\ldots,a_{t-1}$ and its own signal, then chooses $a_t\\in\\{0,1\\}$ to maximize its probability of matching $\\theta$. At exact posterior indifference it follows its private signal. The public record contains actions, not private signals, and all participants know the decision rule. There are no conformity rewards, sanctions for dissent, or strategic misreports in this model. This private-signal tie convention is an explicit variant of the random tie-breaking convention in the basic example of Bikhchandani, Hirshleifer, and Welch~\\cite{bikhchandani1992}. The probabilities derived below belong","\\subsection{A decision-only public record}\nLet an unknown state $\\theta\\in\\{0,1\\}$ have equal prior probabilities. Participant $t$ receives a private signal $s_t\\in\\{0,1\\}$ with\n\\[\n\\Prob(s_t=\\theta\\mid\\theta)=p,\\qquad 1/2<p<1.\n\\]\nSignals are independent conditional on $\\theta$, and their accuracy is common knowledge. In sequence, each participant observes previous actions $a_1,\\ldots,a_{t-1}$ and its own signal, then chooses $a_t\\in\\{0,1\\}$ to maximize its probability of matching $\\theta$. At exact posterior indifference it follows its private signal. The public record contains actions, not private signals, and all participants know the decision rule. There are no conformity rewards, sanctions for dissent, or strategic misreports in this model. This private-signal tie convention is an explicit variant of the random tie-breaking convention in the basic example of Bikhchandani, Hirshleifer, and Welch~\\cite{bikhchandani1992}. The probabilities derived below belong to the stated variant, not to every informational-cascade model.","blic record}\nLet an unknown state $\\theta\\in\\{0,1\\}$ have equal prior probabilities. Participant $t$ receives a private signal $s_t\\in\\{0,1\\}$ with\n\\[\n\\Prob(s_t=\\theta\\mid\\theta)=p,\\qquad 1/2<p<1.\n\\]\nSignals are independent conditional on $\\theta$, and their accuracy is common knowledge. In sequence, each participant observes previous actions $a_1,\\ldots,a_{t-1}$ and its own signal, then chooses $a_t\\in\\{0,1\\}$ to maximize its probability of matching $\\theta$. At exact posterior indifference it follows its private signal. The public record contains actions, not private signals, and all participants know the decision rule. There are no conformity rewards, sanctions for dissent, or strategic misreports in this model. This private-signal tie convention is an explicit variant of the random tie-breaking convention in the basic example of Bikhchandani, Hirshleifer, and Welch~\\cite{bikhchandani1992}. The probabilities derived below belong to the stated variant, not to every informational-cascade model.","e equal prior probabilities. Participant $t$ receives a private signal $s_t\\in\\{0,1\\}$ with\n\\[\n\\Prob(s_t=\\theta\\mid\\theta)=p,\\qquad 1/2<p<1.\n\\]\nSignals are independent conditional on $\\theta$, and their accuracy is common knowledge. In sequence, each participant observes previous actions $a_1,\\ldots,a_{t-1}$ and its own signal, then chooses $a_t\\in\\{0,1\\}$ to maximize its probability of matching $\\theta$. At exact posterior indifference it follows its private signal. The public record contains actions, not private signals, and all participants know the decision rule. There are no conformity rewards, sanctions for dissent, or strategic misreports in this model. This private-signal tie convention is an explicit variant of the random tie-breaking convention in the basic example of Bikhchandani, Hirshleifer, and Welch~\\cite{bikhchandani1992}. The probabilities derived below belong to the stated variant, not to every informational-cascade model.","Set $\\lambda=p/(1-p)>1$. Before a cascade starts, define an integer public score $z$ so that the likelihood ratio of the observed action history is $\\lambda^z$. A new private signal changes its owner's posterior exponent by $+1$ or $-1$. At $z\\in\\{-1,0,1\\}$ the stated tie rule makes the action reveal that signal. Once $z$ reaches $2$, even a contrary signal leaves a strictly positive exponent, so the action is $1$ regardless of private evidence. Every later such action then has probability one under either state and adds no further likelihood. The symmetric statement holds at $z=-2$.","(1-p)>1$. Before a cascade starts, define an integer public score $z$ so that the likelihood ratio of the observed action history is $\\lambda^z$. A new private signal changes its owner's posterior exponent by $+1$ or $-1$. At $z\\in\\{-1,0,1\\}$ the stated tie rule makes the action reveal that signal. Once $z$ reaches $2$, even a contrary signal leaves a strictly positive exponent, so the action is $1$ regardless of private evidence. Every later such action then has probability one under either state and adds no further likelihood. The symmetric statement holds at $z=-2$.","anges its owner's posterior exponent by $+1$ or $-1$. At $z\\in\\{-1,0,1\\}$ the stated tie rule makes the action reveal that signal. Once $z$ reaches $2$, even a contrary signal leaves a strictly positive exponent, so the action is $1$ regardless of private evidence. Every later such action then has probability one under either state and adds no further likelihood. The symmetric statement holds at $z=-2$.","\\begin{proposition}[Almost-sure locking with a positive error probability]\\label{prop:cascade-lock}\nIn this model a cascade begins almost surely after finitely many revealing decisions. Its probability of selecting the wrong state is\n\\begin{equation}\\label{eq:cascade-error}\n\\eta(p)=\\frac{(1-p)^2}{p^2+(1-p)^2}>0.\n\\end{equation}\nThe probability that no cascade has begun after $2r$ decisions is $[2p(1-p)]^r$. After locking, further actions contain no additional information about $\\theta$ conditional on the preceding public history.\n\\end{proposition}\n\\begin{proof}\nThe posterior argument above identifies the revealing region and the two absorbing action regimes. Starting at score zero, a pair of equal revealing signals reaches $+2$ or $-2$, while an unequal pair returns to zero. Conditional on either true state, a pair locks correctly with probability $p^2$, locks incorrectly with probability $(1-p)^2$, and returns to zero with probability $2p(1-p)$. Conditional independence gives independent repetitions","\\begin{proposition}[Almost-sure locking with a positive error probability]\\label{prop:cascade-lock}\nIn this model a cascade begins almost surely after finitely many revealing decisions. Its probability of selecting the wrong state is\n\\begin{equation}\\label{eq:cascade-error}\n\\eta(p)=\\frac{(1-p)^2}{p^2+(1-p)^2}>0.\n\\end{equation}\nThe probability that no cascade has begun after $2r$ decisions is $[2p(1-p)]^r$. After locking, further actions contain no additional information about $\\theta$ conditional on the preceding public history.\n\\end{proposition}\n\\begin{proof}\nThe posterior argument above identifies the revealing region and the two absorbing action regimes. Starting at score zero, a pair of equal revealing signals reaches $+2$ or $-2$, while an unequal pair returns to zero. Conditional on either true state, a pair locks correctly with probability $p^2$, locks incorrectly with probability $(1-p)^2$, and returns to zero with probability $2p(1-p)$. Conditional independence gives independent repetitions of this two-step cycle until absorption. Since $2p(1-p)<1$, nonab","\\begin{proposition}[Almost-sure locking with a positive error probability]\\label{prop:cascade-lock}\nIn this model a cascade begins almost surely after finitely many revealing decisions. Its probability of selecting the wrong state is\n\\begin{equation}\\label{eq:cascade-error}\n\\eta(p)=\\frac{(1-p)^2}{p^2+(1-p)^2}>0.\n\\end{equation}\nThe probability that no cascade has begun after $2r$ decisions is $[2p(1-p)]^r$. After locking, further actions contain no additional information about $\\theta$ conditional on the preceding public history.\n\\end{proposition}\n\\begin{proof}\nThe posterior argument above identifies the revealing region and the two absorbing action regimes. Starting at score zero, a pair of equal revealing signals reaches $+2$ or $-2$, while an unequal pair returns to zero. Conditional on either true state, a pair locks correctly with probability $p^2$, locks incorrectly with probability $(1-p)^2$, and returns to zero with probability $2p(1-p)$. Conditional independence gives independent repetitions of this two-step cycle until absorption. Since $2p(1-p)<1$, nonabsorption through $r$…","rop:cascade-lock}\nIn this model a cascade begins almost surely after finitely many revealing decisions. Its probability of selecting the wrong state is\n\\begin{equation}\\label{eq:cascade-error}\n\\eta(p)=\\frac{(1-p)^2}{p^2+(1-p)^2}>0.\n\\end{equation}\nThe probability that no cascade has begun after $2r$ decisions is $[2p(1-p)]^r$. After locking, further actions contain no additional information about $\\theta$ conditional on the preceding public history.\n\\end{proposition}\n\\begin{proof}\nThe posterior argument above identifies the revealing region and the two absorbing action regimes. Starting at score zero, a pair of equal revealing signals reaches $+2$ or $-2$, while an unequal pair returns to zero. Conditional on either true state, a pair locks correctly with probability $p^2$, locks incorrectly with probability $(1-p)^2$, and returns to zero with probability $2p(1-p)$. Conditional independence gives independent repetitions of this two-step cycle until absorption. Since $2p(1-p)<1$, nonabsorption through $r$ cycles has the stated probability and tends to zero. Summing the probability of e…","probability that no cascade has begun after $2r$ decisions is $[2p(1-p)]^r$. After locking, further actions contain no additional information about $\\theta$ conditional on the preceding public history.\n\\end{proposition}\n\\begin{proof}\nThe posterior argument above identifies the revealing region and the two absorbing action regimes. Starting at score zero, a pair of equal revealing signals reaches $+2$ or $-2$, while an unequal pair returns to zero. Conditional on either true state, a pair locks correctly with probability $p^2$, locks incorrectly with probability $(1-p)^2$, and returns to zero with probability $2p(1-p)$. Conditional independence gives independent repetitions of this two-step cycle until absorption. Since $2p(1-p)<1$, nonabsorption through $r$ cycles has the stated probability and tends to zero. Summing the probability of eventual incorrect absorption gives\n\\[\n\\sum_{r=0}^{\\infty}[2p(1-p)]^r(1-p)^2\n=\\frac{(1-p)^2}{1-2p(1-p)},\n\\]\nwhich is~\\eqref{eq:cascade-error}. In an absorbing regime every subsequent action is deterministic given the public history under both possible …","ity that no cascade has begun after $2r$ decisions is $[2p(1-p)]^r$. After locking, further actions contain no additional information about $\\theta$ conditional on the preceding public history.\n\\end{proposition}\n\\begin{proof}\nThe posterior argument above identifies the revealing region and the two absorbing action regimes. Starting at score zero, a pair of equal revealing signals reaches $+2$ or $-2$, while an unequal pair returns to zero. Conditional on either true state, a pair locks correctly with probability $p^2$, locks incorrectly with probability $(1-p)^2$, and returns to zero with probability $2p(1-p)$. Conditional independence gives independent repetitions of this two-step cycle until absorption. Since $2p(1-p)<1$, nonabsorption through $r$ cycles has the stated probability and tends to zero. Summing the probability of eventual incorrect absorption gives\n\\[\n\\sum_{r=0}^{\\infty}[2p(1-p)]^r(1-p)^2\n=\\frac{(1-p)^2}{1-2p(1-p)},\n\\]\nwhich is~\\eqref{eq:cascade-error}. In an absorbing regime every subsequent action is deterministic given the public history under both possible states, …","al information about $\\theta$ conditional on the preceding public history.\n\\end{proposition}\n\\begin{proof}\nThe posterior argument above identifies the revealing region and the two absorbing action regimes. Starting at score zero, a pair of equal revealing signals reaches $+2$ or $-2$, while an unequal pair returns to zero. Conditional on either true state, a pair locks correctly with probability $p^2$, locks incorrectly with probability $(1-p)^2$, and returns to zero with probability $2p(1-p)$. Conditional independence gives independent repetitions of this two-step cycle until absorption. Since $2p(1-p)<1$, nonabsorption through $r$ cycles has the stated probability and tends to zero. Summing the probability of eventual incorrect absorption gives\n\\[\n\\sum_{r=0}^{\\infty}[2p(1-p)]^r(1-p)^2\n=\\frac{(1-p)^2}{1-2p(1-p)},\n\\]\nwhich is~\\eqref{eq:cascade-error}. In an absorbing regime every subsequent action is deterministic given the public history under both possible states, so conditioning on it changes no posterior.\n\\end{proof}","on the preceding public history.\n\\end{proposition}\n\\begin{proof}\nThe posterior argument above identifies the revealing region and the two absorbing action regimes. Starting at score zero, a pair of equal revealing signals reaches $+2$ or $-2$, while an unequal pair returns to zero. Conditional on either true state, a pair locks correctly with probability $p^2$, locks incorrectly with probability $(1-p)^2$, and returns to zero with probability $2p(1-p)$. Conditional independence gives independent repetitions of this two-step cycle until absorption. Since $2p(1-p)<1$, nonabsorption through $r$ cycles has the stated probability and tends to zero. Summing the probability of eventual incorrect absorption gives\n\\[\n\\sum_{r=0}^{\\infty}[2p(1-p)]^r(1-p)^2\n=\\frac{(1-p)^2}{1-2p(1-p)},\n\\]\nwhich is~\\eqref{eq:cascade-error}. In an absorbing regime every subsequent action is deterministic given the public history under both possible states, so conditioning on it changes no posterior.\n\\end{proof}","n}\n\\begin{proof}\nThe posterior argument above identifies the revealing region and the two absorbing action regimes. Starting at score zero, a pair of equal revealing signals reaches $+2$ or $-2$, while an unequal pair returns to zero. Conditional on either true state, a pair locks correctly with probability $p^2$, locks incorrectly with probability $(1-p)^2$, and returns to zero with probability $2p(1-p)$. Conditional independence gives independent repetitions of this two-step cycle until absorption. Since $2p(1-p)<1$, nonabsorption through $r$ cycles has the stated probability and tends to zero. Summing the probability of eventual incorrect absorption gives\n\\[\n\\sum_{r=0}^{\\infty}[2p(1-p)]^r(1-p)^2\n=\\frac{(1-p)^2}{1-2p(1-p)},\n\\]\nwhich is~\\eqref{eq:cascade-error}. In an absorbing regime every subsequent action is deterministic given the public history under both possible states, so conditioning on it changes no posterior.\n\\end{proof}","s. Starting at score zero, a pair of equal revealing signals reaches $+2$ or $-2$, while an unequal pair returns to zero. Conditional on either true state, a pair locks correctly with probability $p^2$, locks incorrectly with probability $(1-p)^2$, and returns to zero with probability $2p(1-p)$. Conditional independence gives independent repetitions of this two-step cycle until absorption. Since $2p(1-p)<1$, nonabsorption through $r$ cycles has the stated probability and tends to zero. Summing the probability of eventual incorrect absorption gives\n\\[\n\\sum_{r=0}^{\\infty}[2p(1-p)]^r(1-p)^2\n=\\frac{(1-p)^2}{1-2p(1-p)},\n\\]\nwhich is~\\eqref{eq:cascade-error}. In an absorbing regime every subsequent action is deterministic given the public history under both possible states, so conditioning on it changes no posterior.\n\\end{proof}","f equal revealing signals reaches $+2$ or $-2$, while an unequal pair returns to zero. Conditional on either true state, a pair locks correctly with probability $p^2$, locks incorrectly with probability $(1-p)^2$, and returns to zero with probability $2p(1-p)$. Conditional independence gives independent repetitions of this two-step cycle until absorption. Since $2p(1-p)<1$, nonabsorption through $r$ cycles has the stated probability and tends to zero. Summing the probability of eventual incorrect absorption gives\n\\[\n\\sum_{r=0}^{\\infty}[2p(1-p)]^r(1-p)^2\n=\\frac{(1-p)^2}{1-2p(1-p)},\n\\]\nwhich is~\\eqref{eq:cascade-error}. In an absorbing regime every subsequent action is deterministic given the public history under both possible states, so conditioning on it changes no posterior.\n\\end{proof}","a pair locks correctly with probability $p^2$, locks incorrectly with probability $(1-p)^2$, and returns to zero with probability $2p(1-p)$. Conditional independence gives independent repetitions of this two-step cycle until absorption. Since $2p(1-p)<1$, nonabsorption through $r$ cycles has the stated probability and tends to zero. Summing the probability of eventual incorrect absorption gives\n\\[\n\\sum_{r=0}^{\\infty}[2p(1-p)]^r(1-p)^2\n=\\frac{(1-p)^2}{1-2p(1-p)},\n\\]\nwhich is~\\eqref{eq:cascade-error}. In an absorbing regime every subsequent action is deterministic given the public history under both possible states, so conditioning on it changes no posterior.\n\\end{proof}","For $p=3/4$, the eventual error probability is $1/10$. A long run of unanimous actions can therefore preserve the same mistaken decision with no additional evidentiary support. Each participant remains Bayesian-rational under the stipulated information. Unanimity is an outcome of the disclosure protocol, not evidence that a large number of independent signals favored the decision.","\\subsection{An evidence-preserving comparison}\nNow change only the information contract. Suppose authentic individual signals are available to a decision rule that selects their majority. It need not infer signals from prior actions. Let $\\widehat\\theta_n$ be any majority choice with an arbitrary fixed rule for ties.","\\begin{proposition}[Conditional independence permits continuing accuracy gains]\\label{prop:signal-majority}\nUnder the same signal model,\n\\[\n\\Prob(\\widehat\\theta_n\\ne\\theta)\n\\leq \\min\\left\\{1,\\frac{p(1-p)}{n(p-1/2)^2}\\right\\}.\n\\]\nIn particular, the error tends to zero as $n$ increases.\n\\end{proposition}\n\\begin{proof}\nConditional on either value of $\\theta$, the indicators $\\mathbf1\\{s_t=\\theta\\}$ are independent Bernoulli variables with mean $p$ and variance $p(1-p)$. A wrong majority requires their sample mean to be at most $1/2$, including a possible wrong tie. Chebyshev's inequality bounds this event by $p(1-p)/[n(p-1/2)^2]$. Averaging the identical conditional bounds over $\\theta$ proves the result.\n\\end{proof}","ermits continuing accuracy gains]\\label{prop:signal-majority}\nUnder the same signal model,\n\\[\n\\Prob(\\widehat\\theta_n\\ne\\theta)\n\\leq \\min\\left\\{1,\\frac{p(1-p)}{n(p-1/2)^2}\\right\\}.\n\\]\nIn particular, the error tends to zero as $n$ increases.\n\\end{proposition}\n\\begin{proof}\nConditional on either value of $\\theta$, the indicators $\\mathbf1\\{s_t=\\theta\\}$ are independent Bernoulli variables with mean $p$ and variance $p(1-p)$. A wrong majority requires their sample mean to be at most $1/2$, including a possible wrong tie. Chebyshev's inequality bounds this event by $p(1-p)/[n(p-1/2)^2]$. Averaging the identical conditional bounds over $\\theta$ proves the result.\n\\end{proof}","accuracy gains]\\label{prop:signal-majority}\nUnder the same signal model,\n\\[\n\\Prob(\\widehat\\theta_n\\ne\\theta)\n\\leq \\min\\left\\{1,\\frac{p(1-p)}{n(p-1/2)^2}\\right\\}.\n\\]\nIn particular, the error tends to zero as $n$ increases.\n\\end{proposition}\n\\begin{proof}\nConditional on either value of $\\theta$, the indicators $\\mathbf1\\{s_t=\\theta\\}$ are independent Bernoulli variables with mean $p$ and variance $p(1-p)$. A wrong majority requires their sample mean to be at most $1/2$, including a possible wrong tie. Chebyshev's inequality bounds this event by $p(1-p)/[n(p-1/2)^2]$. Averaging the identical conditional bounds over $\\theta$ proves the result.\n\\end{proof}","odel,\n\\[\n\\Prob(\\widehat\\theta_n\\ne\\theta)\n\\leq \\min\\left\\{1,\\frac{p(1-p)}{n(p-1/2)^2}\\right\\}.\n\\]\nIn particular, the error tends to zero as $n$ increases.\n\\end{proposition}\n\\begin{proof}\nConditional on either value of $\\theta$, the indicators $\\mathbf1\\{s_t=\\theta\\}$ are independent Bernoulli variables with mean $p$ and variance $p(1-p)$. A wrong majority requires their sample mean to be at most $1/2$, including a possible wrong tie. Chebyshev's inequality bounds this event by $p(1-p)/[n(p-1/2)^2]$. Averaging the identical conditional bounds over $\\theta$ proves the result.\n\\end{proof}","2}\\right\\}.\n\\]\nIn particular, the error tends to zero as $n$ increases.\n\\end{proposition}\n\\begin{proof}\nConditional on either value of $\\theta$, the indicators $\\mathbf1\\{s_t=\\theta\\}$ are independent Bernoulli variables with mean $p$ and variance $p(1-p)$. A wrong majority requires their sample mean to be at most $1/2$, including a possible wrong tie. Chebyshev's inequality bounds this event by $p(1-p)/[n(p-1/2)^2]$. Averaging the identical conditional bounds over $\\theta$ proves the result.\n\\end{proof}","\\end{proposition}\n\\begin{proof}\nConditional on either value of $\\theta$, the indicators $\\mathbf1\\{s_t=\\theta\\}$ are independent Bernoulli variables with mean $p$ and variance $p(1-p)$. A wrong majority requires their sample mean to be at most $1/2$, including a possible wrong tie. Chebyshev's inequality bounds this event by $p(1-p)/[n(p-1/2)^2]$. Averaging the identical conditional bounds over $\\theta$ proves the result.\n\\end{proof}","\\begin{figure}[t]\n\\centering\n\\includegraphics[width=.92\\linewidth]{figures/cascade_evidence.pdf}\n\\caption{The binary analytical model with signal accuracy $p=3/4$. For odd population sizes, the error of the last action approaches the cascade floor $1/10$, while a majority of the underlying independent signals continues to improve. Both curves are calculated from finite probabilities, not sampled agent runs.}\\label{fig:cascade-evidence}\n\\end{figure}","Fix one configuration epoch and a nonempty group $J$ of named decision centers. Let $W$ be a finite set of possible worlds. Each equivalence relation $\\sim_i$ records the worlds agent $i$ cannot distinguish using its permitted information. A world may include the epoch, relevant history, and current records. This is an idealized semantics of information, not a claim that an implemented agent can compute every logical consequence.","For a proposition $\\varphi$, $K_i\\varphi$ holds at $w$ when $\\varphi$ holds at every $v\\sim_i w$. Let $E_J\\varphi=\\bigwedge_{i\\in J}K_i\\varphi$. Define common knowledge by all finite depths,\n\\[\nC_J\\varphi=\\bigwedge_{n\\ge0}E_J^n\\varphi,\n\\qquad E_J^0\\varphi=\\varphi.\n\\]\nDistributed knowledge instead quantifies over the \\emph{intersection} of the agents' indistinguishability classes. Common knowledge is governed by chains in their \\emph{union}. Pooling complementary private evidence can therefore reveal a fact that is not public to any participant.","\\begin{proposition}[Common knowledge as a reachability condition]\\label{prop:commonreach}\nLet $\\mathsf{Reach}_J(w)$ be the worlds reachable from $w$ by a finite chain of relations $\\sim_i$ with $i\\in J$, including the zero-length chain. Then\n\\[\nw\\models C_J\\varphi\\quad\\Longleftrightarrow\\quad\n\\mathsf{Reach}_J(w)\\subseteq\\{v:v\\models\\varphi\\}.\n\\]\n\\end{proposition}\n\\begin{proof}\nInduction on $n$ shows that $E_J^n\\varphi$ requires $\\varphi$ at the endpoint of every chain of $n$ indistinguishability steps. Requiring this for every finite $n$ is exactly the stated reachability inclusion.\n\\end{proof}","oposition}[Common knowledge as a reachability condition]\\label{prop:commonreach}\nLet $\\mathsf{Reach}_J(w)$ be the worlds reachable from $w$ by a finite chain of relations $\\sim_i$ with $i\\in J$, including the zero-length chain. Then\n\\[\nw\\models C_J\\varphi\\quad\\Longleftrightarrow\\quad\n\\mathsf{Reach}_J(w)\\subseteq\\{v:v\\models\\varphi\\}.\n\\]\n\\end{proposition}\n\\begin{proof}\nInduction on $n$ shows that $E_J^n\\varphi$ requires $\\varphi$ at the endpoint of every chain of $n$ indistinguishability steps. Requiring this for every finite $n$ is exactly the stated reachability inclusion.\n\\end{proof}","dge as a reachability condition]\\label{prop:commonreach}\nLet $\\mathsf{Reach}_J(w)$ be the worlds reachable from $w$ by a finite chain of relations $\\sim_i$ with $i\\in J$, including the zero-length chain. Then\n\\[\nw\\models C_J\\varphi\\quad\\Longleftrightarrow\\quad\n\\mathsf{Reach}_J(w)\\subseteq\\{v:v\\models\\varphi\\}.\n\\]\n\\end{proposition}\n\\begin{proof}\nInduction on $n$ shows that $E_J^n\\varphi$ requires $\\varphi$ at the endpoint of every chain of $n$ indistinguishability steps. Requiring this for every finite $n$ is exactly the stated reachability inclusion.\n\\end{proof}","commonreach}\nLet $\\mathsf{Reach}_J(w)$ be the worlds reachable from $w$ by a finite chain of relations $\\sim_i$ with $i\\in J$, including the zero-length chain. Then\n\\[\nw\\models C_J\\varphi\\quad\\Longleftrightarrow\\quad\n\\mathsf{Reach}_J(w)\\subseteq\\{v:v\\models\\varphi\\}.\n\\]\n\\end{proposition}\n\\begin{proof}\nInduction on $n$ shows that $E_J^n\\varphi$ requires $\\varphi$ at the endpoint of every chain of $n$ indistinguishability steps. Requiring this for every finite $n$ is exactly the stated reachability inclusion.\n\\end{proof}","rom $w$ by a finite chain of relations $\\sim_i$ with $i\\in J$, including the zero-length chain. Then\n\\[\nw\\models C_J\\varphi\\quad\\Longleftrightarrow\\quad\n\\mathsf{Reach}_J(w)\\subseteq\\{v:v\\models\\varphi\\}.\n\\]\n\\end{proposition}\n\\begin{proof}\nInduction on $n$ shows that $E_J^n\\varphi$ requires $\\varphi$ at the endpoint of every chain of $n$ indistinguishability steps. Requiring this for every finite $n$ is exactly the stated reachability inclusion.\n\\end{proof}","\\begin{counterexample}[Everyone knows, but it is not common knowledge]\\label{ex:everyone}\nLet $W=\\{0,1,2\\}$ and let $\\varphi$ hold exactly at $0,1$. Agent $A$ has partition $\\{0,1\\}\\mid\\{2\\}$, and agent $B$ has partition $\\{0\\}\\mid\\{1,2\\}$. At world $0$, both agents know $\\varphi$. However, the chain $0\\sim_A1\\sim_B2$ reaches a world where it is false. Thus $E_{\\{A,B\\}}\\varphi$ holds at $0$ but $C_{\\{A,B\\}}\\varphi$ does not.\n\\end{counterexample}","\\begin{figure}[t]\n\\centering\n\\includegraphics[width=.88\\linewidth]{figures/common_knowledge_chain.pdf}\n\\caption{At world $0$, each agent's own alternatives satisfy $\\varphi$. Their combined indistinguishability graph nevertheless reaches world $2$, where $\\varphi$ fails. Reflexive edges are omitted. Shared first-order knowledge is weaker than common knowledge.}\\label{fig:knowledge}\n\\end{figure}","\\subsection{An ideal public announcement is a strong update assumption}\nFor a propositional fact $p$ whose valuation is unchanged by the announcement, an ideal truthful public update restricts $W$ to $W_p=\\{w:w\\models p\\}$ and restricts every $\\sim_i$ to that set. This update models that the event, its interpretation, and its receipt are public to the group. In the restricted model, every reachable world satisfies $p$, so Proposition~\\ref{prop:commonreach} gives $C_Jp$. The conclusion follows from the update semantics; it is not a theorem that writing a file implements that event.","l public announcement is a strong update assumption}\nFor a propositional fact $p$ whose valuation is unchanged by the announcement, an ideal truthful public update restricts $W$ to $W_p=\\{w:w\\models p\\}$ and restricts every $\\sim_i$ to that set. This update models that the event, its interpretation, and its receipt are public to the group. In the restricted model, every reachable world satisfies $p$, so Proposition~\\ref{prop:commonreach} gives $C_Jp$. The conclusion follows from the update semantics; it is not a theorem that writing a file implements that event.","on}\nFor a propositional fact $p$ whose valuation is unchanged by the announcement, an ideal truthful public update restricts $W$ to $W_p=\\{w:w\\models p\\}$ and restricts every $\\sim_i$ to that set. This update models that the event, its interpretation, and its receipt are public to the group. In the restricted model, every reachable world satisfies $p$, so Proposition~\\ref{prop:commonreach} gives $C_Jp$. The conclusion follows from the update semantics; it is not a theorem that writing a file implements that event.","\\subsection{Notice is an institutional choice as well as an information condition}\nA rule may define applicability by a public epoch, by authenticated receipt, or by an acknowledgment procedure. These are different institutional contracts. Whether lack of notice excuses an action is not deduced from $K_i$ alone. It is an explicitly chosen relation between the information state and the permission or obligation monitor. In the commons, an approval can exist in the ledger before a disconnected office knows it exists. The specification must say whether that office is allowed to proceed under an earlier epoch, must wait, or can appeal a late notification. Truth of an adoption record and enforceability against a participant are separate observables.","\\subsection{Preserving behavior need not preserve what participants know}\nA state quotient that retains allocations may identify worlds with different notification histories. It can therefore preserve a task trace while changing claims of the form ``office $A$ knows that office $B$ has accepted the debt.'' To preserve such claims, a stronger interface is needed.","Consider models on $W_A,W_B$ with the same named agents and atomic predicates. Let $T:W_A\\to W_B$ be surjective and preserve the truth of each atom in both directions. For every agent $i$, require\n\\begin{align*}\nw\\sim_i^A v&\\ \\Longrightarrow\\ T(w)\\sim_i^B T(v) \\quad\\text{(forth)},","Consider models on $W_A,W_B$ with the same named agents and atomic predicates. Let $T:W_A\\to W_B$ be surjective and preserve the truth of each atom in both directions. For every agent $i$, require\n\\begin{align*}\nw\\sim_i^A v&\\ \\Longrightarrow\\ T(w)\\sim_i^B T(v) \\quad\\text{(forth)},\\\\\nT(w)\\sim_i^B z&\\ \\Longrightarrow\\ \\exists v:\\ w\\sim_i^A v\\text{ and }T(v)=z\n\\quad\\text{(back)}.\n\\end{align*}\nThese are the usual bounded-morphism conditions, stated here as a transport contract.","\\begin{proposition}[Epistemic preservation and reflection]\\label{prop:epistemictransport}\nUnder these conditions, $w$ and $T(w)$ satisfy exactly the same formulas built from the matched atoms, Boolean connectives, $K_i$, and $C_J$. Such transports compose. If the same state maps also satisfy Definition~\\ref{def:language}, they preserve the translated operational conversations and the stipulated epistemic formulas at every corresponding reached state.\n\\end{proposition}\n\\begin{proof}\nUse induction on formulas. Atoms and Boolean connectives follow from the assumptions. For $K_i$, forth sends every source alternative to a target alternative, while back lifts every target alternative; applying the induction hypothesis proves both implications. A finite chain of indistinguishability steps is mapped by repeated","\\begin{proposition}[Epistemic preservation and reflection]\\label{prop:epistemictransport}\nUnder these conditions, $w$ and $T(w)$ satisfy exactly the same formulas built from the matched atoms, Boolean connectives, $K_i$, and $C_J$. Such transports compose. If the same state maps also satisfy Definition~\\ref{def:language}, they preserve the translated operational conversations and the stipulated epistemic formulas at every corresponding reached state.\n\\end{proposition}\n\\begin{proof}\nUse induction on formulas. Atoms and Boolean connectives follow from the assumptions. For $K_i$, forth sends every source alternative to a target alternative, while back lifts every target alternative; applying the induction hypothesis proves both implications. A finite chain of indistinguishability steps is mapped by repeated forth and l","\\begin{proposition}[Epistemic preservation and reflection]\\label{prop:epistemictransport}\nUnder these conditions, $w$ and $T(w)$ satisfy exactly the same formulas built from the matched atoms, Boolean connectives, $K_i$, and $C_J$. Such transports compose. If the same state maps also satisfy Definition~\\ref{def:language}, they preserve the translated operational conversations and the stipulated epistemic formulas at every corresponding reached state.\n\\end{proposition}\n\\begin{proof}\nUse induction on formulas. Atoms and Boolean connectives follow from the assumptions. For $K_i$, forth sends every source alternative to a target alternative, while back lifts every target alternative; applying the induction hypothesis proves both implications. A finite chain of indistinguishability steps is mapped by repeated forth and lifted by repeated back. Proposition~\\ref{prop:commonreach} therefore proves the common-know","\\begin{proposition}[Epistemic preservation and reflection]\\label{prop:epistemictransport}\nUnder these conditions, $w$ and $T(w)$ satisfy exactly the same formulas built from the matched atoms, Boolean connectives, $K_i$, and $C_J$. Such transports compose. If the same state maps also satisfy Definition~\\ref{def:language}, they preserve the translated operational conversations and the stipulated epistemic formulas at every corresponding reached state.\n\\end{proposition}\n\\begin{proof}\nUse induction on formulas. Atoms and Boolean connectives follow from the assumptions. For $K_i$, forth sends every source alternative to a target alternative, while back lifts every target alternative; applying the induction hypothesis proves both implications. A finite chain of indistinguishability steps is mapped by repeated forth and lifted by repeated back. Proposition~\\ref{prop:commonreach} therefore proves the common-knowledge case.","matched atoms, Boolean connectives, $K_i$, and $C_J$. Such transports compose. If the same state maps also satisfy Definition~\\ref{def:language}, they preserve the translated operational conversations and the stipulated epistemic formulas at every corresponding reached state.\n\\end{proposition}\n\\begin{proof}\nUse induction on formulas. Atoms and Boolean connectives follow from the assumptions. For $K_i$, forth sends every source alternative to a target alternative, while back lifts every target alternative; applying the induction hypothesis proves both implications. A finite chain of indistinguishability steps is mapped by repeated forth and lifted by repeated back. Proposition~\\ref{prop:commonreach} therefore proves the common-knowledge case. Forth composes directly, and two successive applications of back lift any target alternative through the intermediate model. Surjectivity and atomic truth preservation also compose. The operational conclusion then follows from Proposition~\\ref{prop:languagetrace} at each reached state.\n\\end{proof}","Fix a nonempty family $\\mathcal W$ of minimal approval coalitions for a particular amendment. Each coalition is a nonempty subset of the $n$ registered offices. Approval is monotone: an amendment passes exactly when the set of approving offices contains some member of $\\mathcal W$. Assume every office can independently approve or refuse, and that no unmodeled administrator or scheduling dependency bypasses the rule. This is a simple-game representation of approval authority~\\cite{taylorzwicker}.","\\begin{proposition}[Blocking coalitions as hitting sets]\\label{prop:blocker}\nA coalition $C$ can block the amendment by withholding all of its approvals, regardless of what the other offices do, if and only if\n\\[\nC\\cap W\\ne\\varnothing\\quad\\text{for every }W\\in\\mathcal W.\n\\]\nThus the minimum number of offices with unconditional blocking power is the minimum hitting-set size of $\\mathcal W$. Under an equal $q$-of-$n$ rule with $1\\leq q\\leq n$, it is $n-q+1$.\n\\end{proposition}\n\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the comp","\\begin{proposition}[Blocking coalitions as hitting sets]\\label{prop:blocker}\nA coalition $C$ can block the amendment by withholding all of its approvals, regardless of what the other offices do, if and only if\n\\[\nC\\cap W\\ne\\varnothing\\quad\\text{for every }W\\in\\mathcal W.\n\\]\nThus the minimum number of offices with unconditional blocking power is the minimum hitting-set size of $\\mathcal W$. Under an equal $q$-of-$n$ rule with $1\\leq q\\leq n$, it is $n-q+1$.\n\\end{proposition}\n\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}","oposition}[Blocking coalitions as hitting sets]\\label{prop:blocker}\nA coalition $C$ can block the amendment by withholding all of its approvals, regardless of what the other offices do, if and only if\n\\[\nC\\cap W\\ne\\varnothing\\quad\\text{for every }W\\in\\mathcal W.\n\\]\nThus the minimum number of offices with unconditional blocking power is the minimum hitting-set size of $\\mathcal W$. Under an equal $q$-of-$n$ rule with $1\\leq q\\leq n$, it is $n-q+1$.\n\\end{proposition}\n\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}","on}[Blocking coalitions as hitting sets]\\label{prop:blocker}\nA coalition $C$ can block the amendment by withholding all of its approvals, regardless of what the other offices do, if and only if\n\\[\nC\\cap W\\ne\\varnothing\\quad\\text{for every }W\\in\\mathcal W.\n\\]\nThus the minimum number of offices with unconditional blocking power is the minimum hitting-set size of $\\mathcal W$. Under an equal $q$-of-$n$ rule with $1\\leq q\\leq n$, it is $n-q+1$.\n\\end{proposition}\n\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}","oalitions as hitting sets]\\label{prop:blocker}\nA coalition $C$ can block the amendment by withholding all of its approvals, regardless of what the other offices do, if and only if\n\\[\nC\\cap W\\ne\\varnothing\\quad\\text{for every }W\\in\\mathcal W.\n\\]\nThus the minimum number of offices with unconditional blocking power is the minimum hitting-set size of $\\mathcal W$. Under an equal $q$-of-$n$ rule with $1\\leq q\\leq n$, it is $n-q+1$.\n\\end{proposition}\n\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}","ts]\\label{prop:blocker}\nA coalition $C$ can block the amendment by withholding all of its approvals, regardless of what the other offices do, if and only if\n\\[\nC\\cap W\\ne\\varnothing\\quad\\text{for every }W\\in\\mathcal W.\n\\]\nThus the minimum number of offices with unconditional blocking power is the minimum hitting-set size of $\\mathcal W$. Under an equal $q$-of-$n$ rule with $1\\leq q\\leq n$, it is $n-q+1$.\n\\end{proposition}\n\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}","block the amendment by withholding all of its approvals, regardless of what the other offices do, if and only if\n\\[\nC\\cap W\\ne\\varnothing\\quad\\text{for every }W\\in\\mathcal W.\n\\]\nThus the minimum number of offices with unconditional blocking power is the minimum hitting-set size of $\\mathcal W$. Under an equal $q$-of-$n$ rule with $1\\leq q\\leq n$, it is $n-q+1$.\n\\end{proposition}\n\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}","the other offices do, if and only if\n\\[\nC\\cap W\\ne\\varnothing\\quad\\text{for every }W\\in\\mathcal W.\n\\]\nThus the minimum number of offices with unconditional blocking power is the minimum hitting-set size of $\\mathcal W$. Under an equal $q$-of-$n$ rule with $1\\leq q\\leq n$, it is $n-q+1$.\n\\end{proposition}\n\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}","hcal W.\n\\]\nThus the minimum number of offices with unconditional blocking power is the minimum hitting-set size of $\\mathcal W$. Under an equal $q$-of-$n$ rule with $1\\leq q\\leq n$, it is $n-q+1$.\n\\end{proposition}\n\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}","inimum number of offices with unconditional blocking power is the minimum hitting-set size of $\\mathcal W$. Under an equal $q$-of-$n$ rule with $1\\leq q\\leq n$, it is $n-q+1$.\n\\end{proposition}\n\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}","s the minimum hitting-set size of $\\mathcal W$. Under an equal $q$-of-$n$ rule with $1\\leq q\\leq n$, it is $n-q+1$.\n\\end{proposition}\n\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}","equal $q$-of-$n$ rule with $1\\leq q\\leq n$, it is $n-q+1$.\n\\end{proposition}\n\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}",", it is $n-q+1$.\n\\end{proposition}\n\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}","\\begin{proof}\nIf $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}","If $C$ intersects every minimal approval coalition, refusing all approvals in $C$ prevents each such coalition from being contained in the approvers. Conversely, if some $W$ is disjoint from $C$, its offices can approve and pass the amendment despite $C$'s refusal. For the threshold rule, the complement of $C$ can pass exactly when it has at least $q$ members, so blocking requires $n-|C|<q$, or $|C|\\geq n-q+1$.\n\\end{proof}","The question can be stated without selecting a universal theory of legitimacy. Let $\\mathcal H$ be a set of possible founding histories, let $a:\\mathcal H\\to\\{0,1\\}$ be an externally stipulated predicate such as ``the resource owner authorized this founding event,'' and let $R:\\mathcal H\\to\\mathcal R$ be the record available to the institution. The predicate models one particular authorization criterion, not moral legitimacy in its entirety.","\\begin{proposition}[When a founding fact is determined by internal records]\\label{prop:founding}\nThere exists a function $f:\\mathcal R\\to\\{0,1\\}$ satisfying $f(R(h))=a(h)$ for all $h\\in\\mathcal H$ if and only if $a$ is constant on every nonempty fibre of $R$. This is a statement of informational determination, not necessarily of computability. If two histories with different labels induce identical distributions of every record available to an evaluator, no evaluator restricted to those records distinguishes them with accuracy above $1/2$ under equal priors.\n\\end{proposition}\n\\begin{proof}\nIf $R(h)=R(h')$, any function of the record gives the same answer on both histories, proving necessity. If the label is constant on every nonempty fibre, define $f(r)$ to be that common value and choose arbitrary values off the image of $R$. This","\\begin{proposition}[When a founding fact is determined by internal records]\\label{prop:founding}\nThere exists a function $f:\\mathcal R\\to\\{0,1\\}$ satisfying $f(R(h))=a(h)$ for all $h\\in\\mathcal H$ if and only if $a$ is constant on every nonempty fibre of $R$. This is a statement of informational determination, not necessarily of computability. If two histories with different labels induce identical distributions of every record available to an evaluator, no evaluator restricted to those records distinguishes them with accuracy above $1/2$ under equal priors.\n\\end{proposition}\n\\begin{proof}\nIf $R(h)=R(h')$, any function of the record gives the same answer on both histories, proving necessity. If the label is constant on every nonempty fibre, define $f(r)$ to be that common value and choose arbitrary values off the image of $R$. This gives sufficiency. For the","\\begin{proposition}[When a founding fact is determined by internal records]\\label{prop:founding}\nThere exists a function $f:\\mathcal R\\to\\{0,1\\}$ satisfying $f(R(h))=a(h)$ for all $h\\in\\mathcal H$ if and only if $a$ is constant on every nonempty fibre of $R$. This is a statement of informational determination, not necessarily of computability. If two histories with different labels induce identical distributions of every record available to an evaluator, no evaluator restricted to those records distinguishes them with accuracy above $1/2$ under equal priors.\n\\end{proposition}\n\\begin{proof}\nIf $R(h)=R(h')$, any function of the record gives the same answer on both histories, proving necessity. If the label is constant on every nonempty fibre, define $f(r)$ to be that common value and choose arbitrary values off the image of $R$. This gives sufficiency. For the probabilistic statement,","\\begin{proposition}[When a founding fact is determined by internal records]\\label{prop:founding}\nThere exists a function $f:\\mathcal R\\to\\{0,1\\}$ satisfying $f(R(h))=a(h)$ for all $h\\in\\mathcal H$ if and only if $a$ is constant on every nonempty fibre of $R$. This is a statement of informational determination, not necessarily of computability. If two histories with different labels induce identical distributions of every record available to an evaluator, no evaluator restricted to those records distinguishes them with accuracy above $1/2$ under equal priors.\n\\end{proposition}\n\\begin{proof}\nIf $R(h)=R(h')$, any function of the record gives the same answer on both histories, proving necessity. If the label is constant on every nonempty fibre, define $f(r)$ to be that common value and choose arbitrary values off the image of $R$. This gives sufficiency. For the probabilistic statement, equal record laws","\\begin{proposition}[When a founding fact is determined by internal records]\\label{prop:founding}\nThere exists a function $f:\\mathcal R\\to\\{0,1\\}$ satisfying $f(R(h))=a(h)$ for all $h\\in\\mathcal H$ if and only if $a$ is constant on every nonempty fibre of $R$. This is a statement of informational determination, not necessarily of computability. If two histories with different labels induce identical distributions of every record available to an evaluator, no evaluator restricted to those records distinguishes them with accuracy above $1/2$ under equal priors.\n\\end{proposition}\n\\begin{proof}\nIf $R(h)=R(h')$, any function of the record gives the same answer on both histories, proving necessity. If the label is constant on every nonempty fibre, define $f(r)$ to be that common value and choose arbitrary values off the image of $R$. This gives sufficiency. For the probabilistic statement, equal record laws remain equal after any common randomized de",",1\\}$ satisfying $f(R(h))=a(h)$ for all $h\\in\\mathcal H$ if and only if $a$ is constant on every nonempty fibre of $R$. This is a statement of informational determination, not necessarily of computability. If two histories with different labels induce identical distributions of every record available to an evaluator, no evaluator restricted to those records distinguishes them with accuracy above $1/2$ under equal priors.\n\\end{proposition}\n\\begin{proof}\nIf $R(h)=R(h')$, any function of the record gives the same answer on both histories, proving necessity. If the label is constant on every nonempty fibre, define $f(r)$ to be that common value and choose arbitrary values off the image of $R$. This gives sufficiency. For the probabilistic statement, equal record laws remain equal after any common randomized decision procedure. Under equal priors, its probability of a correct label is therefore $1/2$.\n\\end{proof}","nd only if $a$ is constant on every nonempty fibre of $R$. This is a statement of informational determination, not necessarily of computability. If two histories with different labels induce identical distributions of every record available to an evaluator, no evaluator restricted to those records distinguishes them with accuracy above $1/2$ under equal priors.\n\\end{proposition}\n\\begin{proof}\nIf $R(h)=R(h')$, any function of the record gives the same answer on both histories, proving necessity. If the label is constant on every nonempty fibre, define $f(r)$ to be that common value and choose arbitrary values off the image of $R$. This gives sufficiency. For the probabilistic statement, equal record laws remain equal after any common randomized decision procedure. Under equal priors, its probability of a correct label is therefore $1/2$.\n\\end{proof}","ies with different labels induce identical distributions of every record available to an evaluator, no evaluator restricted to those records distinguishes them with accuracy above $1/2$ under equal priors.\n\\end{proposition}\n\\begin{proof}\nIf $R(h)=R(h')$, any function of the record gives the same answer on both histories, proving necessity. If the label is constant on every nonempty fibre, define $f(r)$ to be that common value and choose arbitrary values off the image of $R$. This gives sufficiency. For the probabilistic statement, equal record laws remain equal after any common randomized decision procedure. Under equal priors, its probability of a correct label is therefore $1/2$.\n\\end{proof}","ilable to an evaluator, no evaluator restricted to those records distinguishes them with accuracy above $1/2$ under equal priors.\n\\end{proposition}\n\\begin{proof}\nIf $R(h)=R(h')$, any function of the record gives the same answer on both histories, proving necessity. If the label is constant on every nonempty fibre, define $f(r)$ to be that common value and choose arbitrary values off the image of $R$. This gives sufficiency. For the probabilistic statement, equal record laws remain equal after any common randomized decision procedure. Under equal priors, its probability of a correct label is therefore $1/2$.\n\\end{proof}","es the same answer on both histories, proving necessity. If the label is constant on every nonempty fibre, define $f(r)$ to be that common value and choose arbitrary values off the image of $R$. This gives sufficiency. For the probabilistic statement, equal record laws remain equal after any common randomized decision procedure. Under equal priors, its probability of a correct label is therefore $1/2$.\n\\end{proof}","A transparent comparison model can make one class of failure mathematically tractable. Let $x_t\\in\\mathbb R_{\\ge0}^n$ record nonnegative deviations at $n$ institutional positions. Suppose an explicitly justified comparison model provides\n\\begin{equation}\\label{eq:propagation}\nx_{t+1}\\le Bx_t+w_t\n\\quad\\text{componentwise},\\qquad B\\ge0,\n\\end{equation}\nwhere $w_t$ represents fresh disturbance and $B$ summarizes one-step propagation. Suppose a vector $v>0$ and $\\kappa<1$ satisfy $Bv\\le\\kappa v$. In the weighted maximum norm $\\norm{x}_{v,\\infty}=\\max_i x_i/v_i$ we obtain\n\\begin{equation}\\label{eq:propagation-bound}\n\\norm{x_t}_{v,\\infty}\\le\n\\kappa^t\\norm{x_0}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n\\end{equation}\nThe proof is the one-step monotonic estimate followed by induction. Under","A transparent comparison model can make one class of failure mathematically tractable. Let $x_t\\in\\mathbb R_{\\ge0}^n$ record nonnegative deviations at $n$ institutional positions. Suppose an explicitly justified comparison model provides\n\\begin{equation}\\label{eq:propagation}\nx_{t+1}\\le Bx_t+w_t\n\\quad\\text{componentwise},\\qquad B\\ge0,\n\\end{equation}\nwhere $w_t$ represents fresh disturbance and $B$ summarizes one-step propagation. Suppose a vector $v>0$ and $\\kappa<1$ satisfy $Bv\\le\\kappa v$. In the weighted maximum norm $\\norm{x}_{v,\\infty}=\\max_i x_i/v_i$ we obtain\n\\begin{equation}\\label{eq:propagation-bound}\n\\norm{x_t}_{v,\\infty}\\le\n\\kappa^t\\norm{x_0}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n\\end{equation}\nThe proof is the one-step monotonic estimate followed by induction. Under uniformly bounded disturbance $\\norm{","A transparent comparison model can make one class of failure mathematically tractable. Let $x_t\\in\\mathbb R_{\\ge0}^n$ record nonnegative deviations at $n$ institutional positions. Suppose an explicitly justified comparison model provides\n\\begin{equation}\\label{eq:propagation}\nx_{t+1}\\le Bx_t+w_t\n\\quad\\text{componentwise},\\qquad B\\ge0,\n\\end{equation}\nwhere $w_t$ represents fresh disturbance and $B$ summarizes one-step propagation. Suppose a vector $v>0$ and $\\kappa<1$ satisfy $Bv\\le\\kappa v$. In the weighted maximum norm $\\norm{x}_{v,\\infty}=\\max_i x_i/v_i$ we obtain\n\\begin{equation}\\label{eq:propagation-bound}\n\\norm{x_t}_{v,\\infty}\\le\n\\kappa^t\\norm{x_0}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n\\end{equation}\nThe proof is the one-step monotonic estimate followed by induction. Under uniformly bounded disturbance $\\norm{w_t}_{v,\\infty}\\le\\bar w$, the last term is at most $\\bar w(1-\\kappa^t)/(1-\\kappa)$. This gives a conditional attenuation result, not a universal contagion threshold. A graph alone can","A transparent comparison model can make one class of failure mathematically tractable. Let $x_t\\in\\mathbb R_{\\ge0}^n$ record nonnegative deviations at $n$ institutional positions. Suppose an explicitly justified comparison model provides\n\\begin{equation}\\label{eq:propagation}\nx_{t+1}\\le Bx_t+w_t\n\\quad\\text{componentwise},\\qquad B\\ge0,\n\\end{equation}\nwhere $w_t$ represents fresh disturbance and $B$ summarizes one-step propagation. Suppose a vector $v>0$ and $\\kappa<1$ satisfy $Bv\\le\\kappa v$. In the weighted maximum norm $\\norm{x}_{v,\\infty}=\\max_i x_i/v_i$ we obtain\n\\begin{equation}\\label{eq:propagation-bound}\n\\norm{x_t}_{v,\\infty}\\le\n\\kappa^t\\norm{x_0}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n\\end{equation}\nThe proof is the one-step monotonic estimate followed by induction. Under uniformly bounded disturbance $\\norm{w_t}_{v,\\infty}\\le\\bar w$, the last term is at most $\\bar w(1-\\kappa^t)/(1-\\kappa)$. This gives a conditional attenuation result, not a universal contagion threshold. A graph alone cannot supply the matrix $B$","A transparent comparison model can make one class of failure mathematically tractable. Let $x_t\\in\\mathbb R_{\\ge0}^n$ record nonnegative deviations at $n$ institutional positions. Suppose an explicitly justified comparison model provides\n\\begin{equation}\\label{eq:propagation}\nx_{t+1}\\le Bx_t+w_t\n\\quad\\text{componentwise},\\qquad B\\ge0,\n\\end{equation}\nwhere $w_t$ represents fresh disturbance and $B$ summarizes one-step propagation. Suppose a vector $v>0$ and $\\kappa<1$ satisfy $Bv\\le\\kappa v$. In the weighted maximum norm $\\norm{x}_{v,\\infty}=\\max_i x_i/v_i$ we obtain\n\\begin{equation}\\label{eq:propagation-bound}\n\\norm{x_t}_{v,\\infty}\\le\n\\kappa^t\\norm{x_0}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n\\end{equation}\nThe proof is the one-step monotonic estimate followed by induction. Under uniformly bounded disturbance $\\norm{w_t}_{v,\\infty}\\le\\bar w$, the last term is at most $\\bar w(1-\\kappa^t)/(1-\\kappa)$. This gives a conditional attenuation result, not a universal contagion threshold. A graph alone cannot supply the matrix $B$; the rates must come from a justifie","failure mathematically tractable. Let $x_t\\in\\mathbb R_{\\ge0}^n$ record nonnegative deviations at $n$ institutional positions. Suppose an explicitly justified comparison model provides\n\\begin{equation}\\label{eq:propagation}\nx_{t+1}\\le Bx_t+w_t\n\\quad\\text{componentwise},\\qquad B\\ge0,\n\\end{equation}\nwhere $w_t$ represents fresh disturbance and $B$ summarizes one-step propagation. Suppose a vector $v>0$ and $\\kappa<1$ satisfy $Bv\\le\\kappa v$. In the weighted maximum norm $\\norm{x}_{v,\\infty}=\\max_i x_i/v_i$ we obtain\n\\begin{equation}\\label{eq:propagation-bound}\n\\norm{x_t}_{v,\\infty}\\le\n\\kappa^t\\norm{x_0}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n\\end{equation}\nThe proof is the one-step monotonic estimate followed by induction. Under uniformly bounded disturbance $\\norm{w_t}_{v,\\infty}\\le\\bar w$, the last term is at most $\\bar w(1-\\kappa^t)/(1-\\kappa)$. This gives a conditional attenuation result, not a universal contagion threshold. A graph alone cannot supply the matrix $B$; the rates must come from a justified dynamical model. More connectivity can improve detec…","athematically tractable. Let $x_t\\in\\mathbb R_{\\ge0}^n$ record nonnegative deviations at $n$ institutional positions. Suppose an explicitly justified comparison model provides\n\\begin{equation}\\label{eq:propagation}\nx_{t+1}\\le Bx_t+w_t\n\\quad\\text{componentwise},\\qquad B\\ge0,\n\\end{equation}\nwhere $w_t$ represents fresh disturbance and $B$ summarizes one-step propagation. Suppose a vector $v>0$ and $\\kappa<1$ satisfy $Bv\\le\\kappa v$. In the weighted maximum norm $\\norm{x}_{v,\\infty}=\\max_i x_i/v_i$ we obtain\n\\begin{equation}\\label{eq:propagation-bound}\n\\norm{x_t}_{v,\\infty}\\le\n\\kappa^t\\norm{x_0}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n\\end{equation}\nThe proof is the one-step monotonic estimate followed by induction. Under uniformly bounded disturbance $\\norm{w_t}_{v,\\infty}\\le\\bar w$, the last term is at most $\\bar w(1-\\kappa^t)/(1-\\kappa)$. This gives a conditional attenuation result, not a universal contagion threshold. A graph alone cannot supply the matrix $B$; the rates must come from a justified dynamical model. More connectivity can improve detection as w…","able. Let $x_t\\in\\mathbb R_{\\ge0}^n$ record nonnegative deviations at $n$ institutional positions. Suppose an explicitly justified comparison model provides\n\\begin{equation}\\label{eq:propagation}\nx_{t+1}\\le Bx_t+w_t\n\\quad\\text{componentwise},\\qquad B\\ge0,\n\\end{equation}\nwhere $w_t$ represents fresh disturbance and $B$ summarizes one-step propagation. Suppose a vector $v>0$ and $\\kappa<1$ satisfy $Bv\\le\\kappa v$. In the weighted maximum norm $\\norm{x}_{v,\\infty}=\\max_i x_i/v_i$ we obtain\n\\begin{equation}\\label{eq:propagation-bound}\n\\norm{x_t}_{v,\\infty}\\le\n\\kappa^t\\norm{x_0}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n\\end{equation}\nThe proof is the one-step monotonic estimate followed by induction. Under uniformly bounded disturbance $\\norm{w_t}_{v,\\infty}\\le\\bar w$, the last term is at most $\\bar w(1-\\kappa^t)/(1-\\kappa)$. This gives a conditional attenuation result, not a universal contagion threshold. A graph alone cannot supply the matrix $B$; the rates must come from a justified dynamical model. More connectivity can improve detection as well as propagation,…","nnegative deviations at $n$ institutional positions. Suppose an explicitly justified comparison model provides\n\\begin{equation}\\label{eq:propagation}\nx_{t+1}\\le Bx_t+w_t\n\\quad\\text{componentwise},\\qquad B\\ge0,\n\\end{equation}\nwhere $w_t$ represents fresh disturbance and $B$ summarizes one-step propagation. Suppose a vector $v>0$ and $\\kappa<1$ satisfy $Bv\\le\\kappa v$. In the weighted maximum norm $\\norm{x}_{v,\\infty}=\\max_i x_i/v_i$ we obtain\n\\begin{equation}\\label{eq:propagation-bound}\n\\norm{x_t}_{v,\\infty}\\le\n\\kappa^t\\norm{x_0}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n\\end{equation}\nThe proof is the one-step monotonic estimate followed by induction. Under uniformly bounded disturbance $\\norm{w_t}_{v,\\infty}\\le\\bar w$, the last term is at most $\\bar w(1-\\kappa^t)/(1-\\kappa)$. This gives a conditional attenuation result, not a universal contagion threshold. A graph alone cannot supply the matrix $B$; the rates must come from a justified dynamical model. More connectivity can improve detection as well as propagation, and nonlinear strategic behavior can invalida…","n explicitly justified comparison model provides\n\\begin{equation}\\label{eq:propagation}\nx_{t+1}\\le Bx_t+w_t\n\\quad\\text{componentwise},\\qquad B\\ge0,\n\\end{equation}\nwhere $w_t$ represents fresh disturbance and $B$ summarizes one-step propagation. Suppose a vector $v>0$ and $\\kappa<1$ satisfy $Bv\\le\\kappa v$. In the weighted maximum norm $\\norm{x}_{v,\\infty}=\\max_i x_i/v_i$ we obtain\n\\begin{equation}\\label{eq:propagation-bound}\n\\norm{x_t}_{v,\\infty}\\le\n\\kappa^t\\norm{x_0}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n\\end{equation}\nThe proof is the one-step monotonic estimate followed by induction. Under uniformly bounded disturbance $\\norm{w_t}_{v,\\infty}\\le\\bar w$, the last term is at most $\\bar w(1-\\kappa^t)/(1-\\kappa)$. This gives a conditional attenuation result, not a universal contagion threshold. A graph alone cannot supply the matrix $B$; the rates must come from a justified dynamical model. More connectivity can improve detection as well as propagation, and nonlinear strategic behavior can invalidate the linear comparison.","tor $v>0$ and $\\kappa<1$ satisfy $Bv\\le\\kappa v$. In the weighted maximum norm $\\norm{x}_{v,\\infty}=\\max_i x_i/v_i$ we obtain\n\\begin{equation}\\label{eq:propagation-bound}\n\\norm{x_t}_{v,\\infty}\\le\n\\kappa^t\\norm{x_0}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n\\end{equation}\nThe proof is the one-step monotonic estimate followed by induction. Under uniformly bounded disturbance $\\norm{w_t}_{v,\\infty}\\le\\bar w$, the last term is at most $\\bar w(1-\\kappa^t)/(1-\\kappa)$. This gives a conditional attenuation result, not a universal contagion threshold. A graph alone cannot supply the matrix $B$; the rates must come from a justified dynamical model. More connectivity can improve detection as well as propagation, and nonlinear strategic behavior can invalidate the linear comparison.","ighted maximum norm $\\norm{x}_{v,\\infty}=\\max_i x_i/v_i$ we obtain\n\\begin{equation}\\label{eq:propagation-bound}\n\\norm{x_t}_{v,\\infty}\\le\n\\kappa^t\\norm{x_0}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n\\end{equation}\nThe proof is the one-step monotonic estimate followed by induction. Under uniformly bounded disturbance $\\norm{w_t}_{v,\\infty}\\le\\bar w$, the last term is at most $\\bar w(1-\\kappa^t)/(1-\\kappa)$. This gives a conditional attenuation result, not a universal contagion threshold. A graph alone cannot supply the matrix $B$; the rates must come from a justified dynamical model. More connectivity can improve detection as well as propagation, and nonlinear strategic behavior can invalidate the linear comparison.","}_{v,\\infty}\n+\\sum_{j=0}^{t-1}\\kappa^{t-1-j}\\norm{w_j}_{v,\\infty}.\n\\end{equation}\nThe proof is the one-step monotonic estimate followed by induction. Under uniformly bounded disturbance $\\norm{w_t}_{v,\\infty}\\le\\bar w$, the last term is at most $\\bar w(1-\\kappa^t)/(1-\\kappa)$. This gives a conditional attenuation result, not a universal contagion threshold. A graph alone cannot supply the matrix $B$; the rates must come from a justified dynamical model. More connectivity can improve detection as well as propagation, and nonlinear strategic behavior can invalidate the linear comparison.","A simplified reach functional for agent $i$ and horizon $T$ is the set of consequential institutional coordinates whose future distributions can be changed by some \\emph{admissible unilateral intervention} of $i$. This is an intervention-relative property; it must not silently assume that the agent can overwrite a variable to which it has no access. Quantifying authority requires the feasible intervention family and a choice of outcomes. A concentration score built from these reaches can be a diagnostic, but not a proof of illegitimacy.","A continuing office need not be one of a permanently supplied list. A population may establish a verification service, divide a task into specialties, retire a redundant committee, or form a temporary coalition. Its communication graph can change with these decisions. To express that possibility, let $G_t$ specify currently permitted communication links, $r_t$ an assignment of roles, and $c_t$ a competence and capacity record. Their transition belongs to the realized state:\n\\[\n(G_{t+1},r_{t+1},c_{t+1})\\sim\n\\Gamma_{I_t}(\\,\\cdot\\mid G_t,r_t,c_t,H_t),\n\\]\nwhere $H_t$ denotes the retained information used by the update. A Markov formulation must include a sufficient part of that information in the state rather than treating an unspecified history as an unobserved input.","may establish a verification service, divide a task into specialties, retire a redundant committee, or form a temporary coalition. Its communication graph can change with these decisions. To express that possibility, let $G_t$ specify currently permitted communication links, $r_t$ an assignment of roles, and $c_t$ a competence and capacity record. Their transition belongs to the realized state:\n\\[\n(G_{t+1},r_{t+1},c_{t+1})\\sim\n\\Gamma_{I_t}(\\,\\cdot\\mid G_t,r_t,c_t,H_t),\n\\]\nwhere $H_t$ denotes the retained information used by the update. A Markov formulation must include a sufficient part of that information in the state rather than treating an unspecified history as an unobserved input.","dant committee, or form a temporary coalition. Its communication graph can change with these decisions. To express that possibility, let $G_t$ specify currently permitted communication links, $r_t$ an assignment of roles, and $c_t$ a competence and capacity record. Their transition belongs to the realized state:\n\\[\n(G_{t+1},r_{t+1},c_{t+1})\\sim\n\\Gamma_{I_t}(\\,\\cdot\\mid G_t,r_t,c_t,H_t),\n\\]\nwhere $H_t$ denotes the retained information used by the update. A Markov formulation must include a sufficient part of that information in the state rather than treating an unspecified history as an unobserved input.","theory distinguishes beneficial networks from those stable under participants' incentives~\\cite{jacksonwolinsky}. Here the additional question is institutional: which training, delegation, link creation, and role transfers are authorized, and which existing commitments survive those changes? Endogenous division of labor requires that participant interaction affects the adopted structure. Writing $\\Gamma$ does not show that an externally assigned specialization was discovered.","\\subsection{Specialization has a cost and a reachability condition}\nConsider two services performed once per period. A generalist arrangement costs $2c_g$ per period. Two specialists cost $2c_s+b$, where $b$ is the required communication and integration cost, and training costs $h$ for each specialist. Over $T$ periods the specialist arrangement has lower total cost precisely when\n\\[\nT\\bigl[2(c_g-c_s)-b\\bigr]>2h.\n\\]\nThis is an instance of institutional amortization, not a universal law of specialization. Verification overhead, replacement, workload variation, and lost redundancy must be added when relevant. A specialist who is faster locally can still increase total cost if every result requires expensive cross-boundary interpretation.","\\subsection{A sharp condition for replacement capacity}\nLet $J$ be a finite nonempty set of roles that must be filled simultaneously and $A$ a finite set of agents. An edge $(j,a)$ means that agent $a$ is both capable and authorized to fill role $j$ during the relevant interval. Every agent can fill at most one role at a time. A feasible staffing is an injective assignment $f:J\\to A$ along these edges. Let $N(S)$ be the agents adjacent to at least one role in $S\\subseteq J$.","{A sharp condition for replacement capacity}\nLet $J$ be a finite nonempty set of roles that must be filled simultaneously and $A$ a finite set of agents. An edge $(j,a)$ means that agent $a$ is both capable and authorized to fill role $j$ during the relevant interval. Every agent can fill at most one role at a time. A feasible staffing is an injective assignment $f:J\\to A$ along these edges. Let $N(S)$ be the agents adjacent to at least one role in $S\\subseteq J$.","e a finite nonempty set of roles that must be filled simultaneously and $A$ a finite set of agents. An edge $(j,a)$ means that agent $a$ is both capable and authorized to fill role $j$ during the relevant interval. Every agent can fill at most one role at a time. A feasible staffing is an injective assignment $f:J\\to A$ along these edges. Let $N(S)$ be the agents adjacent to at least one role in $S\\subseteq J$.","\\begin{theorem}[Authorized staffing after any bounded agent erasure]\\label{thm:robust-staffing}\nFix an integer $0\\leq k\\leq |A|$. A feasible staffing exists after removal of every set $F\\subseteq A$ with $|F|\\leq k$ if and only if\n\\begin{equation}\\label{eq:robust-hall}\n|N(S)|\\geq |S|+k\n\\qquad\\text{for every nonempty }S\\subseteq J.\n\\end{equation}\nThe surviving capability and authorization edges are assumed unchanged, and a new assignment may be selected after the erased set is known.\n\\end{theorem}\n\\begin{proof}\nFor necessity, if a nonempty $S$ has fewer than $|S|+k$ neighbors, erase $\\min\\{k,|N(S)|\\}$ of those neighbors. Fewer than $|S|$ remain, so no injective staffing of $S$ is possible.","ing exists after removal of every set $F\\subseteq A$ with $|F|\\leq k$ if and only if\n\\begin{equation}\\label{eq:robust-hall}\n|N(S)|\\geq |S|+k\n\\qquad\\text{for every nonempty }S\\subseteq J.\n\\end{equation}\nThe surviving capability and authorization edges are assumed unchanged, and a new assignment may be selected after the erased set is known.\n\\end{theorem}\n\\begin{proof}\nFor necessity, if a nonempty $S$ has fewer than $|S|+k$ neighbors, erase $\\min\\{k,|N(S)|\\}$ of those neighbors. Fewer than $|S|$ remain, so no injective staffing of $S$ is possible.","moval of every set $F\\subseteq A$ with $|F|\\leq k$ if and only if\n\\begin{equation}\\label{eq:robust-hall}\n|N(S)|\\geq |S|+k\n\\qquad\\text{for every nonempty }S\\subseteq J.\n\\end{equation}\nThe surviving capability and authorization edges are assumed unchanged, and a new assignment may be selected after the erased set is known.\n\\end{theorem}\n\\begin{proof}\nFor necessity, if a nonempty $S$ has fewer than $|S|+k$ neighbors, erase $\\min\\{k,|N(S)|\\}$ of those neighbors. Fewer than $|S|$ remain, so no injective staffing of $S$ is possible.","seteq A$ with $|F|\\leq k$ if and only if\n\\begin{equation}\\label{eq:robust-hall}\n|N(S)|\\geq |S|+k\n\\qquad\\text{for every nonempty }S\\subseteq J.\n\\end{equation}\nThe surviving capability and authorization edges are assumed unchanged, and a new assignment may be selected after the erased set is known.\n\\end{theorem}\n\\begin{proof}\nFor necessity, if a nonempty $S$ has fewer than $|S|+k$ neighbors, erase $\\min\\{k,|N(S)|\\}$ of those neighbors. Fewer than $|S|$ remain, so no injective staffing of $S$ is possible.","uation}\\label{eq:robust-hall}\n|N(S)|\\geq |S|+k\n\\qquad\\text{for every nonempty }S\\subseteq J.\n\\end{equation}\nThe surviving capability and authorization edges are assumed unchanged, and a new assignment may be selected after the erased set is known.\n\\end{theorem}\n\\begin{proof}\nFor necessity, if a nonempty $S$ has fewer than $|S|+k$ neighbors, erase $\\min\\{k,|N(S)|\\}$ of those neighbors. Fewer than $|S|$ remain, so no injective staffing of $S$ is possible.","S|+k\n\\qquad\\text{for every nonempty }S\\subseteq J.\n\\end{equation}\nThe surviving capability and authorization edges are assumed unchanged, and a new assignment may be selected after the erased set is known.\n\\end{theorem}\n\\begin{proof}\nFor necessity, if a nonempty $S$ has fewer than $|S|+k$ neighbors, erase $\\min\\{k,|N(S)|\\}$ of those neighbors. Fewer than $|S|$ remain, so no injective staffing of $S$ is possible.","For sufficiency, remove any $F$ of size at most $k$. The surviving neighbors of each $S$ number at least $|N(S)|-k\\geq|S|$. We recall the finite matching argument. Choose a maximum matching in the surviving bipartite graph. If a role remains unmatched, explore alternating paths beginning at it, using unmatched edges toward agents and matched edges back toward roles. No reached agent can be unmatched, since that would produce an augmenting path. Let $S$ be the reached roles and $B$ the reached agents. Every neighbor of $S$ is in $B$, and each agent of $B$ is matched to a distinct reached role other than the initial unmatched role. Hence $|N(S)|=|B|<|S|$, a contradiction. The maximum matching therefore fills all roles.\n\\en","For sufficiency, remove any $F$ of size at most $k$. The surviving neighbors of each $S$ number at least $|N(S)|-k\\geq|S|$. We recall the finite matching argument. Choose a maximum matching in the surviving bipartite graph. If a role remains unmatched, explore alternating paths beginning at it, using unmatched edges toward agents and matched edges back toward roles. No reached agent can be unmatched, since that would produce an augmenting path. Let $S$ be the reached roles and $B$ the reached agents. Every neighbor of $S$ is in $B$, and each agent of $B$ is matched to a distinct reached role other than the initial unmatched role. Hence $|N(S)|=|B|<|S|$, a contradiction. The maximum matching therefore fills all roles.\n\\end{proof}","he surviving neighbors of each $S$ number at least $|N(S)|-k\\geq|S|$. We recall the finite matching argument. Choose a maximum matching in the surviving bipartite graph. If a role remains unmatched, explore alternating paths beginning at it, using unmatched edges toward agents and matched edges back toward roles. No reached agent can be unmatched, since that would produce an augmenting path. Let $S$ be the reached roles and $B$ the reached agents. Every neighbor of $S$ is in $B$, and each agent of $B$ is matched to a distinct reached role other than the initial unmatched role. Hence $|N(S)|=|B|<|S|$, a contradiction. The maximum matching therefore fills all roles.\n\\end{proof}","h $S$ number at least $|N(S)|-k\\geq|S|$. We recall the finite matching argument. Choose a maximum matching in the surviving bipartite graph. If a role remains unmatched, explore alternating paths beginning at it, using unmatched edges toward agents and matched edges back toward roles. No reached agent can be unmatched, since that would produce an augmenting path. Let $S$ be the reached roles and $B$ the reached agents. Every neighbor of $S$ is in $B$, and each agent of $B$ is matched to a distinct reached role other than the initial unmatched role. Hence $|N(S)|=|B|<|S|$, a contradiction. The maximum matching therefore fills all roles.\n\\end{proof}","e recall the finite matching argument. Choose a maximum matching in the surviving bipartite graph. If a role remains unmatched, explore alternating paths beginning at it, using unmatched edges toward agents and matched edges back toward roles. No reached agent can be unmatched, since that would produce an augmenting path. Let $S$ be the reached roles and $B$ the reached agents. Every neighbor of $S$ is in $B$, and each agent of $B$ is matched to a distinct reached role other than the initial unmatched role. Hence $|N(S)|=|B|<|S|$, a contradiction. The maximum matching therefore fills all roles.\n\\end{proof}","he finite matching argument. Choose a maximum matching in the surviving bipartite graph. If a role remains unmatched, explore alternating paths beginning at it, using unmatched edges toward agents and matched edges back toward roles. No reached agent can be unmatched, since that would produce an augmenting path. Let $S$ be the reached roles and $B$ the reached agents. Every neighbor of $S$ is in $B$, and each agent of $B$ is matched to a distinct reached role other than the initial unmatched role. Hence $|N(S)|=|B|<|S|$, a contradiction. The maximum matching therefore fills all roles.\n\\end{proof}","ment. Choose a maximum matching in the surviving bipartite graph. If a role remains unmatched, explore alternating paths beginning at it, using unmatched edges toward agents and matched edges back toward roles. No reached agent can be unmatched, since that would produce an augmenting path. Let $S$ be the reached roles and $B$ the reached agents. Every neighbor of $S$ is in $B$, and each agent of $B$ is matched to a distinct reached role other than the initial unmatched role. Hence $|N(S)|=|B|<|S|$, a contradiction. The maximum matching therefore fills all roles.\n\\end{proof}","atched, explore alternating paths beginning at it, using unmatched edges toward agents and matched edges back toward roles. No reached agent can be unmatched, since that would produce an augmenting path. Let $S$ be the reached roles and $B$ the reached agents. Every neighbor of $S$ is in $B$, and each agent of $B$ is matched to a distinct reached role other than the initial unmatched role. Hence $|N(S)|=|B|<|S|$, a contradiction. The maximum matching therefore fills all roles.\n\\end{proof}","The theorem permits a simple robustness index. If the initial graph admits a staffing, define\n\\[\n\\sigma=\\min_{\\varnothing\\ne S\\subseteq J}\\bigl(|N(S)|-|S|\\bigr).\n\\]\nThen exactly the erasure budgets $k\\leq\\sigma$ are guaranteed tolerable in this model. This is a static allocation certificate, not a claim that the surviving agents can discover or execute the reassignment before a deadline. That further question uses the communication and permission constraints of Sections~\\ref{sec:decentral} and~\\ref{sec:social-time}.","\\begin{counterexample}[Backups for each role need not provide collective resilience]\\label{ex:role-backup}\nTwo roles can each be filled by either of two agents $a,b$. Every role has two capable authorized candidates, and the two roles can initially be filled. After either agent is erased, the one survivor cannot fill both roles simultaneously. The singleton-role conditions for $k=1$ hold, but the two-role set has only two neighbors rather than the required three.\n\\end{counterexample}","For three roles with neighborhoods $\\{a,b\\}$, $\\{b,c\\}$, and $\\{c,d\\}$, every nonempty role set satisfies~\\eqref{eq:robust-hall} with $k=1$. One erased agent can be accommodated by reassignment even though no single agent can perform every role. Resilience can reside in a pattern of overlapping specialization rather than a universally capable backup.","\\begin{counterexample}[A connected union with no usable evidence path]\\label{ex:temporal-path}\nAgent $A$ initially holds an arbitrary bit and the other agents do not. At time one, $B$ sends its current state to $C$. At time two, $A$ sends the bit to $B$. No other communication occurs before $C$ must decide. The union of directed contacts contains the path $A\\to B\\to C$, but $C$'s received message is independent of the bit. No decoder at $C$ can recover an initially fair bit with accuracy above $1/2$ under this access model.\n\\end{counterexample}","ith no usable evidence path]\\label{ex:temporal-path}\nAgent $A$ initially holds an arbitrary bit and the other agents do not. At time one, $B$ sends its current state to $C$. At time two, $A$ sends the bit to $B$. No other communication occurs before $C$ must decide. The union of directed contacts contains the path $A\\to B\\to C$, but $C$'s received message is independent of the bit. No decoder at $C$ can recover an initially fair bit with accuracy above $1/2$ under this access model.\n\\end{counterexample}","$A$ initially holds an arbitrary bit and the other agents do not. At time one, $B$ sends its current state to $C$. At time two, $A$ sends the bit to $B$. No other communication occurs before $C$ must decide. The union of directed contacts contains the path $A\\to B\\to C$, but $C$'s received message is independent of the bit. No decoder at $C$ can recover an initially fair bit with accuracy above $1/2$ under this access model.\n\\end{counterexample}","\\subsection{A finite contract with an explicit information boundary}\nLet $S$ be a finite nonempty state space for the complete contract. A state records the relevant institutional mode, resource ownership, bounded obligation monitors, current staffing, and any private memory needed to make transitions well defined. Let $h:S\\to Y$ be the observation available in a declared common record at each decision epoch. It need not reveal the private components. The initial information is a nonempty set $B_0$ contained in one fibre of $h$.","tate space for the complete contract. A state records the relevant institutional mode, resource ownership, bounded obligation monitors, current staffing, and any private memory needed to make transitions well defined. Let $h:S\\to Y$ be the observation available in a declared common record at each decision epoch. It need not reveal the private components. The initial information is a nonempty set $B_0$ contained in one fibre of $h$.","ract. A state records the relevant institutional mode, resource ownership, bounded obligation monitors, current staffing, and any private memory needed to make transitions well defined. Let $h:S\\to Y$ be the observation available in a declared common record at each decision epoch. It need not reveal the private components. The initial information is a nonempty set $B_0$ contained in one fibre of $h$.","A finite nonempty catalogue $U$ contains protocol profiles, not arbitrary commands to the complete microstate. A profile can specify one local response map for each office, with each map reading only that office's permitted observation and stored local memory. It can also specify a committed monitor, a communication schedule, and the steps needed to select and enact that profile. These implementations, their costs, and their decision rights must be established separately. An instruction that requires inaccessible private information is not made implementable by listing it in $U$.","map reading only that office's permitted observation and stored local memory. It can also specify a committed monitor, a communication schedule, and the steps needed to select and enact that profile. These implementations, their costs, and their decision rights must be established separately. An instruction that requires inaccessible private information is not made implementable by listing it in $U$.","For each $s$, let $A(s)\\subseteq U$ contain profiles satisfying the immediate contract at that state. Every profile in this set must pass the same resource, authority, staffing, and monitoring checks. In particular, a monitor included in a profile must satisfy all relevant incentive and false-positive inequalities simultaneously. Let $\\Delta(s,u)\\subseteq S$ be a nonempty finite set of permitted next states for each $s,u$. The set includes every environment response or fault within the declared guarantee. Inadmissible profiles are never selected.","s)\\subseteq U$ contain profiles satisfying the immediate contract at that state. Every profile in this set must pass the same resource, authority, staffing, and monitoring checks. In particular, a monitor included in a profile must satisfy all relevant incentive and false-positive inequalities simultaneously. Let $\\Delta(s,u)\\subseteq S$ be a nonempty finite set of permitted next states for each $s,u$. The set includes every environment response or fault within the declared guarantee. Inadmissible profiles are never selected.","The contract uses \\emph{sure} guarantees: every transition in $\\Delta$ is treated as possible, without weighting it by probability. A probabilistic transition model may supply these supports, but an unlikely infinite path is not discarded when proving bounded service. Nor does a deterrence inequality justify silently deleting deviations from $\\Delta$. Safety under compliant behavior and safety under specified deviations are different contracts. The latter must include their physical consequences in the transition model.","Let $S_{\\rm safe}\\subseteq S$ encode the protected state requirements. Breach monitors distinguish fulfillment, authorized discharge, pending debt, and deletion. A finite bound on stored obligations or deadlines is part of the model. An overflow must have an explicit treatment, such as a rejected admission or a breach state. The theorem does not silently replace an unbounded history by a finite one.","\\subsection{The state of possible institutional realizations}\nThe relevant public state is the set of complete states still compatible with the observed history. Define\n\\[\n\\mathcal B=\\{B\\subseteq S:B\\ne\\varnothing,\\ h\\text{ is constant on }B\\}.\n\\]\nThese are sets of possibilities, not posterior probability distributions. At $B$, a profile must be admissible for every remaining possibility:\n\\[\nA(B)=\\bigcap_{s\\in B}A(s).\n\\]\nFor $u\\in A(B)$ and a next public observation $y$, define\n\\begin{equation}\\label{eq:belief-update}\n\\operatorname{Post}(B,u,y)=\n\\left(\\bigcup_{s\\in B}\\Delta(s,u)\\right)\\cap h^{-1}(y).\n\\end{equation}\nOnly nonempty successor sets are possible observations. Write $\\operatorname{Succ}(B,u)$ for their collection. Induction on the public history shows that~\\eqref{eq:belief-update} retains exactly the complete states consistent with that history and the selected profiles.","ble institutional realizations}\nThe relevant public state is the set of complete states still compatible with the observed history. Define\n\\[\n\\mathcal B=\\{B\\subseteq S:B\\ne\\varnothing,\\ h\\text{ is constant on }B\\}.\n\\]\nThese are sets of possibilities, not posterior probability distributions. At $B$, a profile must be admissible for every remaining possibility:\n\\[\nA(B)=\\bigcap_{s\\in B}A(s).\n\\]\nFor $u\\in A(B)$ and a next public observation $y$, define\n\\begin{equation}\\label{eq:belief-update}\n\\operatorname{Post}(B,u,y)=\n\\left(\\bigcup_{s\\in B}\\Delta(s,u)\\right)\\cap h^{-1}(y).\n\\end{equation}\nOnly nonempty successor sets are possible observations. Write $\\operatorname{Succ}(B,u)$ for their collection. Induction on the public history shows that~\\eqref{eq:belief-update} retains exactly the complete states consistent with that history and the selected profiles.","nt public state is the set of complete states still compatible with the observed history. Define\n\\[\n\\mathcal B=\\{B\\subseteq S:B\\ne\\varnothing,\\ h\\text{ is constant on }B\\}.\n\\]\nThese are sets of possibilities, not posterior probability distributions. At $B$, a profile must be admissible for every remaining possibility:\n\\[\nA(B)=\\bigcap_{s\\in B}A(s).\n\\]\nFor $u\\in A(B)$ and a next public observation $y$, define\n\\begin{equation}\\label{eq:belief-update}\n\\operatorname{Post}(B,u,y)=\n\\left(\\bigcup_{s\\in B}\\Delta(s,u)\\right)\\cap h^{-1}(y).\n\\end{equation}\nOnly nonempty successor sets are possible observations. Write $\\operatorname{Succ}(B,u)$ for their collection. Induction on the public history shows that~\\eqref{eq:belief-update} retains exactly the complete states consistent with that history and the selected profiles.","of complete states still compatible with the observed history. Define\n\\[\n\\mathcal B=\\{B\\subseteq S:B\\ne\\varnothing,\\ h\\text{ is constant on }B\\}.\n\\]\nThese are sets of possibilities, not posterior probability distributions. At $B$, a profile must be admissible for every remaining possibility:\n\\[\nA(B)=\\bigcap_{s\\in B}A(s).\n\\]\nFor $u\\in A(B)$ and a next public observation $y$, define\n\\begin{equation}\\label{eq:belief-update}\n\\operatorname{Post}(B,u,y)=\n\\left(\\bigcup_{s\\in B}\\Delta(s,u)\\right)\\cap h^{-1}(y).\n\\end{equation}\nOnly nonempty successor sets are possible observations. Write $\\operatorname{Succ}(B,u)$ for their collection. Induction on the public history shows that~\\eqref{eq:belief-update} retains exactly the complete states consistent with that history and the selected profiles.","osterior probability distributions. At $B$, a profile must be admissible for every remaining possibility:\n\\[\nA(B)=\\bigcap_{s\\in B}A(s).\n\\]\nFor $u\\in A(B)$ and a next public observation $y$, define\n\\begin{equation}\\label{eq:belief-update}\n\\operatorname{Post}(B,u,y)=\n\\left(\\bigcup_{s\\in B}\\Delta(s,u)\\right)\\cap h^{-1}(y).\n\\end{equation}\nOnly nonempty successor sets are possible observations. Write $\\operatorname{Succ}(B,u)$ for their collection. Induction on the public history shows that~\\eqref{eq:belief-update} retains exactly the complete states consistent with that history and the selected profiles.","This construction does not pool private observations before choosing $u$. It pools only the mathematical possibilities consistent with the common record. Private observations can affect the actions of the local maps already specified by $u$. More elaborate strategies using additional private history require that history, or a sufficient finite memory of it, to be included in the declared realization. Completeness below is relative to this finite catalogue and information model.","\\subsection{A continuation kernel for the whole contract}\nSet\n\\begin{align}\nW_0&=\\{B\\in\\mathcal B:B\\subseteq S_{\\rm safe}\\},\\label{eq:belief-w0}\\\\\nW_{k+1}&=\\{B\\in W_0:\\exists u\\in A(B),\\\n\\operatorname{Succ}(B,u)\\subseteq W_k\\}.\\label{eq:belief-wk}\n\\end{align}\nThe sequence is decreasing. It stabilizes after at most $|\\mathcal B|$ strict removals, and we denote its fixed point by $W_*$. This is the joint continuation kernel. A state is removed not only when it violates an invariant now, but also when every available profile has a possible successor from which the remaining contract cannot be sustained.","W_{k+1}&=\\{B\\in W_0:\\exists u\\in A(B),\\\n\\operatorname{Succ}(B,u)\\subseteq W_k\\}.\\label{eq:belief-wk}\n\\end{align}\nThe sequence is decreasing. It stabilizes after at most $|\\mathcal B|$ strict removals, and we denote its fixed point by $W_*$. This is the joint continuation kernel. A state is removed not only when it violates an invariant now, but also when every available profile has a possible successor from which the remaining contract cannot be sustained.","\\begin{theorem}[Joint continuation under a common observation history]\\label{thm:joint-viability}\nFor every $k\\geq0$, $B\\in W_k$ if and only if there exists a deterministic strategy based on the common observation and profile history that selects admissible profiles and keeps the complete state in $S_{\\rm safe}$ for the next $k$ transitions, starting from every $s\\in B$. Moreover, $B\\in W_*$ if and only if such a strategy exists for an unbounded number of transitions. On $W_*$, a strategy depending only on the current possibility set $B$ suffices.\n\\end{theorem}\n\\begin{proof}\nAt horizon zero the condition is exactly $B\\subseteq S_{\\rm safe}$. At positive horizon the strategy must choose one profile from the same common history, so it must lie in $A(B)$. After each possible observation its continuation mus","\\begin{theorem}[Joint continuation under a common observation history]\\label{thm:joint-viability}\nFor every $k\\geq0$, $B\\in W_k$ if and only if there exists a deterministic strategy based on the common observation and profile history that selects admissible profiles and keeps the complete state in $S_{\\rm safe}$ for the next $k$ transitions, starting from every $s\\in B$. Moreover, $B\\in W_*$ if and only if such a strategy exists for an unbounded number of transitions. On $W_*$, a strategy depending only on the current possibility set $B$ suffices.\n\\end{theorem}\n\\begin{proof}\nAt horizon zero the condition is exactly $B\\subseteq S_{\\rm safe}$. At positive horizon the strategy must choose one profile from the same common history, so it must lie in $A(B)$. After each possible observation its continuation must work from","\\begin{theorem}[Joint continuation under a common observation history]\\label{thm:joint-viability}\nFor every $k\\geq0$, $B\\in W_k$ if and only if there exists a deterministic strategy based on the common observation and profile history that selects admissible profiles and keeps the complete state in $S_{\\rm safe}$ for the next $k$ transitions, starting from every $s\\in B$. Moreover, $B\\in W_*$ if and only if such a strategy exists for an unbounded number of transitions. On $W_*$, a strategy depending only on the current possibility set $B$ suffices.\n\\end{theorem}\n\\begin{proof}\nAt horizon zero the condition is exactly $B\\subseteq S_{\\rm safe}$. At positive horizon the strategy must choose one profile from the same common history, so it must lie in $A(B)$. After each possible observation its continuation must work from the corresponding set in~\\eqref{eq:belief-update}. Induction gives exactly~\\eqref{eq:belief-wk}, in both directions.","thm:joint-viability}\nFor every $k\\geq0$, $B\\in W_k$ if and only if there exists a deterministic strategy based on the common observation and profile history that selects admissible profiles and keeps the complete state in $S_{\\rm safe}$ for the next $k$ transitions, starting from every $s\\in B$. Moreover, $B\\in W_*$ if and only if such a strategy exists for an unbounded number of transitions. On $W_*$, a strategy depending only on the current possibility set $B$ suffices.\n\\end{theorem}\n\\begin{proof}\nAt horizon zero the condition is exactly $B\\subseteq S_{\\rm safe}$. At positive horizon the strategy must choose one profile from the same common history, so it must lie in $A(B)$. After each possible observation its continuation must work from the corresponding set in~\\eqref{eq:belief-update}. Induction gives exactly~\\eqref{eq:belief-wk}, in both directions.","if there exists a deterministic strategy based on the common observation and profile history that selects admissible profiles and keeps the complete state in $S_{\\rm safe}$ for the next $k$ transitions, starting from every $s\\in B$. Moreover, $B\\in W_*$ if and only if such a strategy exists for an unbounded number of transitions. On $W_*$, a strategy depending only on the current possibility set $B$ suffices.\n\\end{theorem}\n\\begin{proof}\nAt horizon zero the condition is exactly $B\\subseteq S_{\\rm safe}$. At positive horizon the strategy must choose one profile from the same common history, so it must lie in $A(B)$. After each possible observation its continuation must work from the corresponding set in~\\eqref{eq:belief-update}. Induction gives exactly~\\eqref{eq:belief-wk}, in both directions.","e history that selects admissible profiles and keeps the complete state in $S_{\\rm safe}$ for the next $k$ transitions, starting from every $s\\in B$. Moreover, $B\\in W_*$ if and only if such a strategy exists for an unbounded number of transitions. On $W_*$, a strategy depending only on the current possibility set $B$ suffices.\n\\end{theorem}\n\\begin{proof}\nAt horizon zero the condition is exactly $B\\subseteq S_{\\rm safe}$. At positive horizon the strategy must choose one profile from the same common history, so it must lie in $A(B)$. After each possible observation its continuation must work from the corresponding set in~\\eqref{eq:belief-update}. Induction gives exactly~\\eqref{eq:belief-wk}, in both directions.","m every $s\\in B$. Moreover, $B\\in W_*$ if and only if such a strategy exists for an unbounded number of transitions. On $W_*$, a strategy depending only on the current possibility set $B$ suffices.\n\\end{theorem}\n\\begin{proof}\nAt horizon zero the condition is exactly $B\\subseteq S_{\\rm safe}$. At positive horizon the strategy must choose one profile from the same common history, so it must lie in $A(B)$. After each possible observation its continuation must work from the corresponding set in~\\eqref{eq:belief-update}. Induction gives exactly~\\eqref{eq:belief-wk}, in both directions.","Monotonicity of the predecessor operation makes $W_k$ decreasing. Finiteness implies stabilization. At the fixed point, select for every $B\\in W_*$ one witnessing profile whose successors all remain in $W_*$. Induction then proves safety and admissibility for every finite prefix of every realized path, hence for the complete path. Conversely, an unbounded safe strategy is safe for every finite horizon, so its initial set belongs to every $W_k$ and therefore to the stabilized intersection. The witnessing selection is stationary in $B$, although maintaining $B$ generally requires memory of the public history.\n\\end{proof}","akes $W_k$ decreasing. Finiteness implies stabilization. At the fixed point, select for every $B\\in W_*$ one witnessing profile whose successors all remain in $W_*$. Induction then proves safety and admissibility for every finite prefix of every realized path, hence for the complete path. Conversely, an unbounded safe strategy is safe for every finite horizon, so its initial set belongs to every $W_k$ and therefore to the stabilized intersection. The witnessing selection is stationary in $B$, although maintaining $B$ generally requires memory of the public history.\n\\end{proof}","$B\\in W_*$ one witnessing profile whose successors all remain in $W_*$. Induction then proves safety and admissibility for every finite prefix of every realized path, hence for the complete path. Conversely, an unbounded safe strategy is safe for every finite horizon, so its initial set belongs to every $W_k$ and therefore to the stabilized intersection. The witnessing selection is stationary in $B$, although maintaining $B$ generally requires memory of the public history.\n\\end{proof}","profile whose successors all remain in $W_*$. Induction then proves safety and admissibility for every finite prefix of every realized path, hence for the complete path. Conversely, an unbounded safe strategy is safe for every finite horizon, so its initial set belongs to every $W_k$ and therefore to the stabilized intersection. The witnessing selection is stationary in $B$, although maintaining $B$ generally requires memory of the public history.\n\\end{proof}","No society-wide preference ordering appears in this theorem. It characterizes joint satisfaction of a declared contract, not the desirability or consent behind that contract. It also gives no favorable complexity bound: the possibility space can contain exponentially many subsets of $S$. A computationally expensive solution is still distinct from a procedure the society can discover and execute within its own resource budget.","Let $G\\subseteq S_{\\rm safe}$ be a stipulated completion set. The target is \\emph{certified completion}, meaning that the current possibility set lies wholly in $G$. Let\n\\[\n\\mathcal G=\\{B\\in W_*:B\\subseteq G\\},\n\\quad\nA_*(B)=\\{u\\in A(B):\\operatorname{Succ}(B,u)\\subseteq W_*\\}.\n\\]\nDefine $R_0=\\mathcal G$ and\n\\begin{equation}\\label{eq:progress-attractor}\nR_{k+1}=R_k\\cup\n\\{B\\in W_*:\\exists u\\in A_*(B),\\\n\\operatorname{Succ}(B,u)\\subseteq R_k\\}.\n\\end{equation}\nThe increasing sequence stabilizes at $R_*$. For $B\\in R_*$, let $r(B)$ be its first index of entry.","tion}, meaning that the current possibility set lies wholly in $G$. Let\n\\[\n\\mathcal G=\\{B\\in W_*:B\\subseteq G\\},\n\\quad\nA_*(B)=\\{u\\in A(B):\\operatorname{Succ}(B,u)\\subseteq W_*\\}.\n\\]\nDefine $R_0=\\mathcal G$ and\n\\begin{equation}\\label{eq:progress-attractor}\nR_{k+1}=R_k\\cup\n\\{B\\in W_*:\\exists u\\in A_*(B),\\\n\\operatorname{Succ}(B,u)\\subseteq R_k\\}.\n\\end{equation}\nThe increasing sequence stabilizes at $R_*$. For $B\\in R_*$, let $r(B)$ be its first index of entry.","ing that the current possibility set lies wholly in $G$. Let\n\\[\n\\mathcal G=\\{B\\in W_*:B\\subseteq G\\},\n\\quad\nA_*(B)=\\{u\\in A(B):\\operatorname{Succ}(B,u)\\subseteq W_*\\}.\n\\]\nDefine $R_0=\\mathcal G$ and\n\\begin{equation}\\label{eq:progress-attractor}\nR_{k+1}=R_k\\cup\n\\{B\\in W_*:\\exists u\\in A_*(B),\\\n\\operatorname{Succ}(B,u)\\subseteq R_k\\}.\n\\end{equation}\nThe increasing sequence stabilizes at $R_*$. For $B\\in R_*$, let $r(B)$ be its first index of entry.","rent possibility set lies wholly in $G$. Let\n\\[\n\\mathcal G=\\{B\\in W_*:B\\subseteq G\\},\n\\quad\nA_*(B)=\\{u\\in A(B):\\operatorname{Succ}(B,u)\\subseteq W_*\\}.\n\\]\nDefine $R_0=\\mathcal G$ and\n\\begin{equation}\\label{eq:progress-attractor}\nR_{k+1}=R_k\\cup\n\\{B\\in W_*:\\exists u\\in A_*(B),\\\n\\operatorname{Succ}(B,u)\\subseteq R_k\\}.\n\\end{equation}\nThe increasing sequence stabilizes at $R_*$. For $B\\in R_*$, let $r(B)$ be its first index of entry.","\\begin{proposition}[Safe service with a finite progress rank]\\label{prop:joint-progress}\nA set $B$ lies in $R_k$ if and only if an admissible common-history strategy can ensure certified completion within at most $k$ transitions while preserving the contract indefinitely. A set lies in $R_*$ if and only if such a strategy can ensure eventual certified completion on every possible path while preserving the contract. Before completion, a stationary choice with strictly decreasing $r$ reaches the target within $r(B)$ transitions. After completion, a safety strategy on $W_*$ suffices.\n\\end{proposition}\n\\begin{proof}\nThe bounded claim follows by induction from~\\eqref{eq:progress-attractor}. At a nonterminal set of rank $r>0$, a witnessing profile sends every successor to rank at most $r-1$.","\\begin{proposition}[Safe service with a finite progress rank]\\label{prop:joint-progress}\nA set $B$ lies in $R_k$ if and only if an admissible common-history strategy can ensure certified completion within at most $k$ transitions while preserving the contract indefinitely. A set lies in $R_*$ if and only if such a strategy can ensure eventual certified completion on every possible path while preserving the contract. Before completion, a stationary choice with strictly decreasing $r$ reaches the target within $r(B)$ transitions. After completion, a safety strategy on $W_*$ suffices.\n\\end{proposition}\n\\begin{proof}\nThe bounded claim follows by induction from~\\eqref{eq:progress-attractor}. At a nonterminal set of rank $r>0$, a witnessing profile sends every successor to rank at most $r-1$. All selected p","\\begin{proposition}[Safe service with a finite progress rank]\\label{prop:joint-progress}\nA set $B$ lies in $R_k$ if and only if an admissible common-history strategy can ensure certified completion within at most $k$ transitions while preserving the contract indefinitely. A set lies in $R_*$ if and only if such a strategy can ensure eventual certified completion on every possible path while preserving the contract. Before completion, a stationary choice with strictly decreasing $r$ reaches the target within $r(B)$ transitions. After completion, a safety strategy on $W_*$ suffices.\n\\end{proposition}\n\\begin{proof}\nThe bounded claim follows by induction from~\\eqref{eq:progress-attractor}. At a nonterminal set of rank $r>0$, a witnessing profile sends every successor to rank at most $r-1$. All selected profiles preserve $W_*$, so a safety continuation is available after the target is reached.","ess}\nA set $B$ lies in $R_k$ if and only if an admissible common-history strategy can ensure certified completion within at most $k$ transitions while preserving the contract indefinitely. A set lies in $R_*$ if and only if such a strategy can ensure eventual certified completion on every possible path while preserving the contract. Before completion, a stationary choice with strictly decreasing $r$ reaches the target within $r(B)$ transitions. After completion, a safety strategy on $W_*$ suffices.\n\\end{proposition}\n\\begin{proof}\nThe bounded claim follows by induction from~\\eqref{eq:progress-attractor}. At a nonterminal set of rank $r>0$, a witnessing profile sends every successor to rank at most $r-1$. All selected profiles preserve $W_*$, so a safety continuation is available after the target is reached.","f and only if an admissible common-history strategy can ensure certified completion within at most $k$ transitions while preserving the contract indefinitely. A set lies in $R_*$ if and only if such a strategy can ensure eventual certified completion on every possible path while preserving the contract. Before completion, a stationary choice with strictly decreasing $r$ reaches the target within $r(B)$ transitions. After completion, a safety strategy on $W_*$ suffices.\n\\end{proposition}\n\\begin{proof}\nThe bounded claim follows by induction from~\\eqref{eq:progress-attractor}. At a nonterminal set of rank $r>0$, a witnessing profile sends every successor to rank at most $r-1$. All selected profiles preserve $W_*$, so a safety continuation is available after the target is reached.","ure certified completion within at most $k$ transitions while preserving the contract indefinitely. A set lies in $R_*$ if and only if such a strategy can ensure eventual certified completion on every possible path while preserving the contract. Before completion, a stationary choice with strictly decreasing $r$ reaches the target within $r(B)$ transitions. After completion, a safety strategy on $W_*$ suffices.\n\\end{proposition}\n\\begin{proof}\nThe bounded claim follows by induction from~\\eqref{eq:progress-attractor}. At a nonterminal set of rank $r>0$, a witnessing profile sends every successor to rank at most $r-1$. All selected profiles preserve $W_*$, so a safety continuation is available after the target is reached.","an ensure eventual certified completion on every possible path while preserving the contract. Before completion, a stationary choice with strictly decreasing $r$ reaches the target within $r(B)$ transitions. After completion, a safety strategy on $W_*$ suffices.\n\\end{proposition}\n\\begin{proof}\nThe bounded claim follows by induction from~\\eqref{eq:progress-attractor}. At a nonterminal set of rank $r>0$, a witnessing profile sends every successor to rank at most $r-1$. All selected profiles preserve $W_*$, so a safety continuation is available after the target is reached.","le preserving the contract. Before completion, a stationary choice with strictly decreasing $r$ reaches the target within $r(B)$ transitions. After completion, a safety strategy on $W_*$ suffices.\n\\end{proposition}\n\\begin{proof}\nThe bounded claim follows by induction from~\\eqref{eq:progress-attractor}. At a nonterminal set of rank $r>0$, a witnessing profile sends every successor to rank at most $r-1$. All selected profiles preserve $W_*$, so a safety continuation is available after the target is reached.","pletion, a stationary choice with strictly decreasing $r$ reaches the target within $r(B)$ transitions. After completion, a safety strategy on $W_*$ suffices.\n\\end{proposition}\n\\begin{proof}\nThe bounded claim follows by induction from~\\eqref{eq:progress-attractor}. At a nonterminal set of rank $r>0$, a witnessing profile sends every successor to rank at most $r-1$. All selected profiles preserve $W_*$, so a safety continuation is available after the target is reached.","d with descendants at arbitrarily large depths would produce an infinite branch with no completion. Every finite prefix has a consistent complete-state realization by~\\eqref{eq:belief-update}. Finiteness and the same branching argument give a compatible infinite complete-state realization, contradicting success on every path. The tree therefore has a finite depth bound, so the bounded claim puts $B$ in some $R_k$. The other direction follows from the rank strategy.\n\\end{proof}","ndants at arbitrarily large depths would produce an infinite branch with no completion. Every finite prefix has a consistent complete-state realization by~\\eqref{eq:belief-update}. Finiteness and the same branching argument give a compatible infinite complete-state realization, contradicting success on every path. The tree therefore has a finite depth bound, so the bounded claim puts $B$ in some $R_k$. The other direction follows from the rank strategy.\n\\end{proof}","\\begin{counterexample}[Almost-sure completion without a sure service bound]\\label{ex:sure-service}\nAt a pending state $p$, one action moves to a completed absorbing state $g$ with probability $1/2$ and returns to $p$ with probability $1/2$. Both states are safe and publicly visible. Completion occurs with probability one and has expected waiting time two, but the support contains the infinite path $p,p,\\ldots$. For the sure interpretation of $\\Delta$, $W_*$ contains both singleton states while $R_*$ contains only $\\{g\\}$. Replacing sure completion by almost-sure completion changes the problem.\n\\end{counterexample}","egin{counterexample}[Almost-sure completion without a sure service bound]\\label{ex:sure-service}\nAt a pending state $p$, one action moves to a completed absorbing state $g$ with probability $1/2$ and returns to $p$ with probability $1/2$. Both states are safe and publicly visible. Completion occurs with probability one and has expected waiting time two, but the support contains the infinite path $p,p,\\ldots$. For the sure interpretation of $\\Delta$, $W_*$ contains both singleton states while $R_*$ contains only $\\{g\\}$. Replacing sure completion by almost-sure completion changes the problem.\n\\end{counterexample}","ithout a sure service bound]\\label{ex:sure-service}\nAt a pending state $p$, one action moves to a completed absorbing state $g$ with probability $1/2$ and returns to $p$ with probability $1/2$. Both states are safe and publicly visible. Completion occurs with probability one and has expected waiting time two, but the support contains the infinite path $p,p,\\ldots$. For the sure interpretation of $\\Delta$, $W_*$ contains both singleton states while $R_*$ contains only $\\{g\\}$. Replacing sure completion by almost-sure completion changes the problem.\n\\end{counterexample}","ure service bound]\\label{ex:sure-service}\nAt a pending state $p$, one action moves to a completed absorbing state $g$ with probability $1/2$ and returns to $p$ with probability $1/2$. Both states are safe and publicly visible. Completion occurs with probability one and has expected waiting time two, but the support contains the infinite path $p,p,\\ldots$. For the sure interpretation of $\\Delta$, $W_*$ contains both singleton states while $R_*$ contains only $\\{g\\}$. Replacing sure completion by almost-sure completion changes the problem.\n\\end{counterexample}","t a pending state $p$, one action moves to a completed absorbing state $g$ with probability $1/2$ and returns to $p$ with probability $1/2$. Both states are safe and publicly visible. Completion occurs with probability one and has expected waiting time two, but the support contains the infinite path $p,p,\\ldots$. For the sure interpretation of $\\Delta$, $W_*$ contains both singleton states while $R_*$ contains only $\\{g\\}$. Replacing sure completion by almost-sure completion changes the problem.\n\\end{counterexample}","$, one action moves to a completed absorbing state $g$ with probability $1/2$ and returns to $p$ with probability $1/2$. Both states are safe and publicly visible. Completion occurs with probability one and has expected waiting time two, but the support contains the infinite path $p,p,\\ldots$. For the sure interpretation of $\\Delta$, $W_*$ contains both singleton states while $R_*$ contains only $\\{g\\}$. Replacing sure completion by almost-sure completion changes the problem.\n\\end{counterexample}","\\subsection{A certificate can be checked without finding the largest kernel}\nThe fixed-point computation finds every viable possibility set in the declared model. A proposed institution may instead supply a smaller invariant family together with its choices. Let $\\mathcal C\\subseteq\\mathcal B$ contain $B_0$, and let $\\kappa$ assign a profile to each $B\\in\\mathcal C$. The checker verifies $B\\subseteq S_{\\rm safe}$, $\\kappa(B)\\in A(B)$, and $\\operatorname{Succ}(B,\\kappa(B))\\subseteq\\mathcal C$. A separate integer rank can certify a selected service.","ficate can be checked without finding the largest kernel}\nThe fixed-point computation finds every viable possibility set in the declared model. A proposed institution may instead supply a smaller invariant family together with its choices. Let $\\mathcal C\\subseteq\\mathcal B$ contain $B_0$, and let $\\kappa$ assign a profile to each $B\\in\\mathcal C$. The checker verifies $B\\subseteq S_{\\rm safe}$, $\\kappa(B)\\in A(B)$, and $\\operatorname{Succ}(B,\\kappa(B))\\subseteq\\mathcal C$. A separate integer rank can certify a selected service.","hout finding the largest kernel}\nThe fixed-point computation finds every viable possibility set in the declared model. A proposed institution may instead supply a smaller invariant family together with its choices. Let $\\mathcal C\\subseteq\\mathcal B$ contain $B_0$, and let $\\kappa$ assign a profile to each $B\\in\\mathcal C$. The checker verifies $B\\subseteq S_{\\rm safe}$, $\\kappa(B)\\in A(B)$, and $\\operatorname{Succ}(B,\\kappa(B))\\subseteq\\mathcal C$. A separate integer rank can certify a selected service.","\\begin{proposition}[Soundness of a finite continuation certificate]\\label{prop:continuation-certificate}\nIf the preceding checks hold, $\\kappa$ preserves the complete contract from $B_0$ for all transitions. If, in addition, there is a map $r:\\mathcal C\\to\\mathbb N$ such that $r(B)=0$ implies $B\\subseteq G$ and every successor of a set with positive rank has strictly smaller rank, then a set contained in $G$ is reached within at most $r(B_0)$ transitions. Checking these finite conditions does not require proving $\\mathcal C=W_*$.\n\\end{proposition}\n\\begin{proof}\nInduction preserves membership in $\\mathcal C$, admissibility, and safety. Until rank zero is reached, each transition strictly decreases a nonnegative integer. There can be at most $r(B_0)$ such transitions. The rank-zero implication then establishes certified completion.","\\begin{proposition}[Soundness of a finite continuation certificate]\\label{prop:continuation-certificate}\nIf the preceding checks hold, $\\kappa$ preserves the complete contract from $B_0$ for all transitions. If, in addition, there is a map $r:\\mathcal C\\to\\mathbb N$ such that $r(B)=0$ implies $B\\subseteq G$ and every successor of a set with positive rank has strictly smaller rank, then a set contained in $G$ is reached within at most $r(B_0)$ transitions. Checking these finite conditions does not require proving $\\mathcal C=W_*$.\n\\end{proposition}\n\\begin{proof}\nInduction preserves membership in $\\mathcal C$, admissibility, and safety. Until rank zero is reached, each transition strictly decreases a nonnegative integer. There can be at most $r(B_0)$ such transitions. The rank-zero implication then establishes certified completion. Closure of $\\mathcal C$ continues to provid","\\begin{proposition}[Soundness of a finite continuation certificate]\\label{prop:continuation-certificate}\nIf the preceding checks hold, $\\kappa$ preserves the complete contract from $B_0$ for all transitions. If, in addition, there is a map $r:\\mathcal C\\to\\mathbb N$ such that $r(B)=0$ implies $B\\subseteq G$ and every successor of a set with positive rank has strictly smaller rank, then a set contained in $G$ is reached within at most $r(B_0)$ transitions. Checking these finite conditions does not require proving $\\mathcal C=W_*$.\n\\end{proposition}\n\\begin{proof}\nInduction preserves membership in $\\mathcal C$, admissibility, and safety. Until rank zero is reached, each transition strictly decreases a nonnegative integer. There can be at most $r(B_0)$ such transitions. The rank-zero implication then establishes certified completion. Closure of $\\mathcal C$ continues to provide safety afterward.\n\\end{proof}","oposition}[Soundness of a finite continuation certificate]\\label{prop:continuation-certificate}\nIf the preceding checks hold, $\\kappa$ preserves the complete contract from $B_0$ for all transitions. If, in addition, there is a map $r:\\mathcal C\\to\\mathbb N$ such that $r(B)=0$ implies $B\\subseteq G$ and every successor of a set with positive rank has strictly smaller rank, then a set contained in $G$ is reached within at most $r(B_0)$ transitions. Checking these finite conditions does not require proving $\\mathcal C=W_*$.\n\\end{proposition}\n\\begin{proof}\nInduction preserves membership in $\\mathcal C$, admissibility, and safety. Until rank zero is reached, each transition strictly decreases a nonnegative integer. There can be at most $r(B_0)$ such transitions. The rank-zero implication then establishes certified completion. Closure of $\\mathcal C$ continues to provide safety afterward.\n\\end{proof}","te continuation certificate]\\label{prop:continuation-certificate}\nIf the preceding checks hold, $\\kappa$ preserves the complete contract from $B_0$ for all transitions. If, in addition, there is a map $r:\\mathcal C\\to\\mathbb N$ such that $r(B)=0$ implies $B\\subseteq G$ and every successor of a set with positive rank has strictly smaller rank, then a set contained in $G$ is reached within at most $r(B_0)$ transitions. Checking these finite conditions does not require proving $\\mathcal C=W_*$.\n\\end{proposition}\n\\begin{proof}\nInduction preserves membership in $\\mathcal C$, admissibility, and safety. Until rank zero is reached, each transition strictly decreases a nonnegative integer. There can be at most $r(B_0)$ such transitions. The rank-zero implication then establishes certified completion. Closure of $\\mathcal C$ continues to provide safety afterward.\n\\end{proof}","ng checks hold, $\\kappa$ preserves the complete contract from $B_0$ for all transitions. If, in addition, there is a map $r:\\mathcal C\\to\\mathbb N$ such that $r(B)=0$ implies $B\\subseteq G$ and every successor of a set with positive rank has strictly smaller rank, then a set contained in $G$ is reached within at most $r(B_0)$ transitions. Checking these finite conditions does not require proving $\\mathcal C=W_*$.\n\\end{proposition}\n\\begin{proof}\nInduction preserves membership in $\\mathcal C$, admissibility, and safety. Until rank zero is reached, each transition strictly decreases a nonnegative integer. There can be at most $r(B_0)$ such transitions. The rank-zero implication then establishes certified completion. Closure of $\\mathcal C$ continues to provide safety afterward.\n\\end{proof}","ons. If, in addition, there is a map $r:\\mathcal C\\to\\mathbb N$ such that $r(B)=0$ implies $B\\subseteq G$ and every successor of a set with positive rank has strictly smaller rank, then a set contained in $G$ is reached within at most $r(B_0)$ transitions. Checking these finite conditions does not require proving $\\mathcal C=W_*$.\n\\end{proposition}\n\\begin{proof}\nInduction preserves membership in $\\mathcal C$, admissibility, and safety. Until rank zero is reached, each transition strictly decreases a nonnegative integer. There can be at most $r(B_0)$ such transitions. The rank-zero implication then establishes certified completion. Closure of $\\mathcal C$ continues to provide safety afterward.\n\\end{proof}","rank has strictly smaller rank, then a set contained in $G$ is reached within at most $r(B_0)$ transitions. Checking these finite conditions does not require proving $\\mathcal C=W_*$.\n\\end{proposition}\n\\begin{proof}\nInduction preserves membership in $\\mathcal C$, admissibility, and safety. Until rank zero is reached, each transition strictly decreases a nonnegative integer. There can be at most $r(B_0)$ such transitions. The rank-zero implication then establishes certified completion. Closure of $\\mathcal C$ continues to provide safety afterward.\n\\end{proof}","ions. Checking these finite conditions does not require proving $\\mathcal C=W_*$.\n\\end{proposition}\n\\begin{proof}\nInduction preserves membership in $\\mathcal C$, admissibility, and safety. Until rank zero is reached, each transition strictly decreases a nonnegative integer. There can be at most $r(B_0)$ such transitions. The rank-zero implication then establishes certified completion. Closure of $\\mathcal C$ continues to provide safety afterward.\n\\end{proof}","\\begin{counterexample}[A safe amendment can destroy every safe continuation]\\label{ex:amendment-dead-end}\nThere are four publicly distinguishable states $r,\\ell,g,b$. The safe set is $\\{r,\\ell,g\\}$. At $r$, profile $\\mathsf{deliver}$ moves to $g$, while profile $\\mathsf{freeze}$ moves to $\\ell$. At $g$, $\\mathsf{wait}$ loops safely. At $\\ell$, the only admissible profile advances an outstanding deadline and moves to breach state $b$. The amendment $\\mathsf{freeze}$ preserves the immediate safe-state predicate but not $W_*$. No certificate proving unbounded continuation from $r$ can choose it. The relevant defect is loss of a future capability, not an immediate inconsistent record.\n\\end{counterexample}","dment can destroy every safe continuation]\\label{ex:amendment-dead-end}\nThere are four publicly distinguishable states $r,\\ell,g,b$. The safe set is $\\{r,\\ell,g\\}$. At $r$, profile $\\mathsf{deliver}$ moves to $g$, while profile $\\mathsf{freeze}$ moves to $\\ell$. At $g$, $\\mathsf{wait}$ loops safely. At $\\ell$, the only admissible profile advances an outstanding deadline and moves to breach state $b$. The amendment $\\mathsf{freeze}$ preserves the immediate safe-state predicate but not $W_*$. No certificate proving unbounded continuation from $r$ can choose it. The relevant defect is loss of a future capability, not an immediate inconsistent record.\n\\end{counterexample}","very safe continuation]\\label{ex:amendment-dead-end}\nThere are four publicly distinguishable states $r,\\ell,g,b$. The safe set is $\\{r,\\ell,g\\}$. At $r$, profile $\\mathsf{deliver}$ moves to $g$, while profile $\\mathsf{freeze}$ moves to $\\ell$. At $g$, $\\mathsf{wait}$ loops safely. At $\\ell$, the only admissible profile advances an outstanding deadline and moves to breach state $b$. The amendment $\\mathsf{freeze}$ preserves the immediate safe-state predicate but not $W_*$. No certificate proving unbounded continuation from $r$ can choose it. The relevant defect is loss of a future capability, not an immediate inconsistent record.\n\\end{counterexample}","licly distinguishable states $r,\\ell,g,b$. The safe set is $\\{r,\\ell,g\\}$. At $r$, profile $\\mathsf{deliver}$ moves to $g$, while profile $\\mathsf{freeze}$ moves to $\\ell$. At $g$, $\\mathsf{wait}$ loops safely. At $\\ell$, the only admissible profile advances an outstanding deadline and moves to breach state $b$. The amendment $\\mathsf{freeze}$ preserves the immediate safe-state predicate but not $W_*$. No certificate proving unbounded continuation from $r$ can choose it. The relevant defect is loss of a future capability, not an immediate inconsistent record.\n\\end{counterexample}","$\\{r,\\ell,g\\}$. At $r$, profile $\\mathsf{deliver}$ moves to $g$, while profile $\\mathsf{freeze}$ moves to $\\ell$. At $g$, $\\mathsf{wait}$ loops safely. At $\\ell$, the only admissible profile advances an outstanding deadline and moves to breach state $b$. The amendment $\\mathsf{freeze}$ preserves the immediate safe-state predicate but not $W_*$. No certificate proving unbounded continuation from $r$ can choose it. The relevant defect is loss of a future capability, not an immediate inconsistent record.\n\\end{counterexample}","Consider a reduced finite contract $(\\overline S,\\overline h,\\overline A,\\overline\\Delta,\\overline S_{\\rm safe},\\overline G)$ with the same catalogue $U$. Let $\\pi:S\\to\\overline S$ be a surjection. Assume, for every state and every admissible profile,\n\\begin{align}\nh(s)&=\\overline h(\\pi s), & A(s)&=\\overline A(\\pi s),\\label{eq:synthesis-labels}","Consider a reduced finite contract $(\\overline S,\\overline h,\\overline A,\\overline\\Delta,\\overline S_{\\rm safe},\\overline G)$ with the same catalogue $U$. Let $\\pi:S\\to\\overline S$ be a surjection. Assume, for every state and every admissible profile,\n\\begin{align}\nh(s)&=\\overline h(\\pi s), & A(s)&=\\overline A(\\pi s),\\label{eq:synthesis-labels}\\\\\ns\\in S_{\\rm safe}&\\Longleftrightarrow\\pi s\\in\\overline S_{\\rm safe}, &\ns\\in G&\\Longleftrightarrow\\pi s\\in\\overline G,\\label{eq:synthesis-goals}\\\\\n\\pi[\\Delta(s,u)]&=\\overline\\Delta(\\pi s,u).&&\\label{eq:synthesis-successors}\n\\end{align}\nThe notation $\\pi[B]$ denotes the image of a set, not a probability pushforward. These are exact assumptions. They must hold for amendments and handovers as well as ordinary actions whenever those operations belong to the contract.","\\pi[\\Delta(s,u)]&=\\overline\\Delta(\\pi s,u).&&\\label{eq:synthesis-successors}\n\\end{align}\nThe notation $\\pi[B]$ denotes the image of a set, not a probability pushforward. These are exact assumptions. They must hold for amendments and handovers as well as ordinary actions whenever those operations belong to the contract.","\\begin{theorem}[Governance abstraction preserves joint realizability]\\label{thm:synthesis-transport}\nUnder~\\eqref{eq:synthesis-labels}--\\eqref{eq:synthesis-successors}, for every $B\\in\\mathcal B$ and every horizon $k$,\n\\[\nB\\in W_k\\Longleftrightarrow\\pi[B]\\in\\overline W_k,\n\\qquad\nB\\in W_*\\Longleftrightarrow\\pi[B]\\in\\overline W_*.\n\\]\nThe progress sets satisfy $B\\in R_k\\Longleftrightarrow\\pi[B]\\in\\overline R_k$, so finite progress ranks agree. A reduced safe or ranked strategy pulls back by choosing at $B$ the profile assigned to $\\pi[B]$.\n\\end{theorem}\n\\begin{proof}\nThe observation equality makes $\\pi[B]$ a valid reduced possibility set. Admissibility and safe-set membership are preserved and reflected. For every possible next observation $y$, successor equality gives the commuting update identity\n\\begin{equation}\\label{eq:synthesis-post-commute}\n\\pi[\\operatorname{Post}(B,u,y)]\n=\\ove","\\begin{theorem}[Governance abstraction preserves joint realizability]\\label{thm:synthesis-transport}\nUnder~\\eqref{eq:synthesis-labels}--\\eqref{eq:synthesis-successors}, for every $B\\in\\mathcal B$ and every horizon $k$,\n\\[\nB\\in W_k\\Longleftrightarrow\\pi[B]\\in\\overline W_k,\n\\qquad\nB\\in W_*\\Longleftrightarrow\\pi[B]\\in\\overline W_*.\n\\]\nThe progress sets satisfy $B\\in R_k\\Longleftrightarrow\\pi[B]\\in\\overline R_k$, so finite progress ranks agree. A reduced safe or ranked strategy pulls back by choosing at $B$ the profile assigned to $\\pi[B]$.\n\\end{theorem}\n\\begin{proof}\nThe observation equality makes $\\pi[B]$ a valid reduced possibility set. Admissibility and safe-set membership are preserved and reflected. For every possible next observation $y$, successor equality gives the commuting update identity\n\\begin{equation}\\label{eq:synthesis-post-commute}\n\\pi[\\operatorname{Post}(B,u,y)]\n=\\overline{\\operatorname{Po","\\begin{theorem}[Governance abstraction preserves joint realizability]\\label{thm:synthesis-transport}\nUnder~\\eqref{eq:synthesis-labels}--\\eqref{eq:synthesis-successors}, for every $B\\in\\mathcal B$ and every horizon $k$,\n\\[\nB\\in W_k\\Longleftrightarrow\\pi[B]\\in\\overline W_k,\n\\qquad\nB\\in W_*\\Longleftrightarrow\\pi[B]\\in\\overline W_*.\n\\]\nThe progress sets satisfy $B\\in R_k\\Longleftrightarrow\\pi[B]\\in\\overline R_k$, so finite progress ranks agree. A reduced safe or ranked strategy pulls back by choosing at $B$ the profile assigned to $\\pi[B]$.\n\\end{theorem}\n\\begin{proof}\nThe observation equality makes $\\pi[B]$ a valid reduced possibility set. Admissibility and safe-set membership are preserved and reflected. For every possible next observation $y$, successor equality gives the commuting update identity\n\\begin{equation}\\label{eq:synthesis-post-commute}\n\\pi[\\operatorname{Post}(B,u,y)]\n=\\overline{\\operatorname{Post}}(\\pi[B],u,y).\n\\end{equation}\nIndeed, applying $\\pi$ to the union of complete successors gives the union of thei","\\begin{theorem}[Governance abstraction preserves joint realizability]\\label{thm:synthesis-transport}\nUnder~\\eqref{eq:synthesis-labels}--\\eqref{eq:synthesis-successors}, for every $B\\in\\mathcal B$ and every horizon $k$,\n\\[\nB\\in W_k\\Longleftrightarrow\\pi[B]\\in\\overline W_k,\n\\qquad\nB\\in W_*\\Longleftrightarrow\\pi[B]\\in\\overline W_*.\n\\]\nThe progress sets satisfy $B\\in R_k\\Longleftrightarrow\\pi[B]\\in\\overline R_k$, so finite progress ranks agree. A reduced safe or ranked strategy pulls back by choosing at $B$ the profile assigned to $\\pi[B]$.\n\\end{theorem}\n\\begin{proof}\nThe observation equality makes $\\pi[B]$ a valid reduced possibility set. Admissibility and safe-set membership are preserved and reflected. For every possible next observation $y$, successor equality gives the commuting update identity\n\\begin{equation}\\label{eq:synthesis-post-commute}\n\\pi[\\operatorname{Post}(B,u,y)]\n=\\overline{\\operatorname{Post}}(\\pi[B],u,y).\n\\end{equation}\nIndeed, applying $\\pi$ to the union of complete successors gives the union of their reduced successors. The observation equality permits intersection w…","~\\eqref{eq:synthesis-labels}--\\eqref{eq:synthesis-successors}, for every $B\\in\\mathcal B$ and every horizon $k$,\n\\[\nB\\in W_k\\Longleftrightarrow\\pi[B]\\in\\overline W_k,\n\\qquad\nB\\in W_*\\Longleftrightarrow\\pi[B]\\in\\overline W_*.\n\\]\nThe progress sets satisfy $B\\in R_k\\Longleftrightarrow\\pi[B]\\in\\overline R_k$, so finite progress ranks agree. A reduced safe or ranked strategy pulls back by choosing at $B$ the profile assigned to $\\pi[B]$.\n\\end{theorem}\n\\begin{proof}\nThe observation equality makes $\\pi[B]$ a valid reduced possibility set. Admissibility and safe-set membership are preserved and reflected. For every possible next observation $y$, successor equality gives the commuting update identity\n\\begin{equation}\\label{eq:synthesis-post-commute}\n\\pi[\\operatorname{Post}(B,u,y)]\n=\\overline{\\operatorname{Post}}(\\pi[B],u,y).\n\\end{equation}\nIndeed, applying $\\pi$ to the union of complete successors gives the union of their reduced successors. The observation equality permits intersection with $h^{-1}(y)$ to pass through $\\pi$. Nonemptiness is also preserved and reflected.","--\\eqref{eq:synthesis-successors}, for every $B\\in\\mathcal B$ and every horizon $k$,\n\\[\nB\\in W_k\\Longleftrightarrow\\pi[B]\\in\\overline W_k,\n\\qquad\nB\\in W_*\\Longleftrightarrow\\pi[B]\\in\\overline W_*.\n\\]\nThe progress sets satisfy $B\\in R_k\\Longleftrightarrow\\pi[B]\\in\\overline R_k$, so finite progress ranks agree. A reduced safe or ranked strategy pulls back by choosing at $B$ the profile assigned to $\\pi[B]$.\n\\end{theorem}\n\\begin{proof}\nThe observation equality makes $\\pi[B]$ a valid reduced possibility set. Admissibility and safe-set membership are preserved and reflected. For every possible next observation $y$, successor equality gives the commuting update identity\n\\begin{equation}\\label{eq:synthesis-post-commute}\n\\pi[\\operatorname{Post}(B,u,y)]\n=\\overline{\\operatorname{Post}}(\\pi[B],u,y).\n\\end{equation}\nIndeed, applying $\\pi$ to the union of complete successors gives the union of their reduced successors. The observation equality permits intersection with $h^{-1}(y)$ to pass through $\\pi$. Nonemptiness is also preserved and reflected.","ry horizon $k$,\n\\[\nB\\in W_k\\Longleftrightarrow\\pi[B]\\in\\overline W_k,\n\\qquad\nB\\in W_*\\Longleftrightarrow\\pi[B]\\in\\overline W_*.\n\\]\nThe progress sets satisfy $B\\in R_k\\Longleftrightarrow\\pi[B]\\in\\overline R_k$, so finite progress ranks agree. A reduced safe or ranked strategy pulls back by choosing at $B$ the profile assigned to $\\pi[B]$.\n\\end{theorem}\n\\begin{proof}\nThe observation equality makes $\\pi[B]$ a valid reduced possibility set. Admissibility and safe-set membership are preserved and reflected. For every possible next observation $y$, successor equality gives the commuting update identity\n\\begin{equation}\\label{eq:synthesis-post-commute}\n\\pi[\\operatorname{Post}(B,u,y)]\n=\\overline{\\operatorname{Post}}(\\pi[B],u,y).\n\\end{equation}\nIndeed, applying $\\pi$ to the union of complete successors gives the union of their reduced successors. The observation equality permits intersection with $h^{-1}(y)$ to pass through $\\pi$. Nonemptiness is also preserved and reflected.","ets satisfy $B\\in R_k\\Longleftrightarrow\\pi[B]\\in\\overline R_k$, so finite progress ranks agree. A reduced safe or ranked strategy pulls back by choosing at $B$ the profile assigned to $\\pi[B]$.\n\\end{theorem}\n\\begin{proof}\nThe observation equality makes $\\pi[B]$ a valid reduced possibility set. Admissibility and safe-set membership are preserved and reflected. For every possible next observation $y$, successor equality gives the commuting update identity\n\\begin{equation}\\label{eq:synthesis-post-commute}\n\\pi[\\operatorname{Post}(B,u,y)]\n=\\overline{\\operatorname{Post}}(\\pi[B],u,y).\n\\end{equation}\nIndeed, applying $\\pi$ to the union of complete successors gives the union of their reduced successors. The observation equality permits intersection with $h^{-1}(y)$ to pass through $\\pi$. Nonemptiness is also preserved and reflected.","progress ranks agree. A reduced safe or ranked strategy pulls back by choosing at $B$ the profile assigned to $\\pi[B]$.\n\\end{theorem}\n\\begin{proof}\nThe observation equality makes $\\pi[B]$ a valid reduced possibility set. Admissibility and safe-set membership are preserved and reflected. For every possible next observation $y$, successor equality gives the commuting update identity\n\\begin{equation}\\label{eq:synthesis-post-commute}\n\\pi[\\operatorname{Post}(B,u,y)]\n=\\overline{\\operatorname{Post}}(\\pi[B],u,y).\n\\end{equation}\nIndeed, applying $\\pi$ to the union of complete successors gives the union of their reduced successors. The observation equality permits intersection with $h^{-1}(y)$ to pass through $\\pi$. Nonemptiness is also preserved and reflected.","of}\nThe observation equality makes $\\pi[B]$ a valid reduced possibility set. Admissibility and safe-set membership are preserved and reflected. For every possible next observation $y$, successor equality gives the commuting update identity\n\\begin{equation}\\label{eq:synthesis-post-commute}\n\\pi[\\operatorname{Post}(B,u,y)]\n=\\overline{\\operatorname{Post}}(\\pi[B],u,y).\n\\end{equation}\nIndeed, applying $\\pi$ to the union of complete successors gives the union of their reduced successors. The observation equality permits intersection with $h^{-1}(y)$ to pass through $\\pi$. Nonemptiness is also preserved and reflected.","cted. For every possible next observation $y$, successor equality gives the commuting update identity\n\\begin{equation}\\label{eq:synthesis-post-commute}\n\\pi[\\operatorname{Post}(B,u,y)]\n=\\overline{\\operatorname{Post}}(\\pi[B],u,y).\n\\end{equation}\nIndeed, applying $\\pi$ to the union of complete successors gives the union of their reduced successors. The observation equality permits intersection with $h^{-1}(y)$ to pass through $\\pi$. Nonemptiness is also preserved and reflected.","t observation $y$, successor equality gives the commuting update identity\n\\begin{equation}\\label{eq:synthesis-post-commute}\n\\pi[\\operatorname{Post}(B,u,y)]\n=\\overline{\\operatorname{Post}}(\\pi[B],u,y).\n\\end{equation}\nIndeed, applying $\\pi$ to the union of complete successors gives the union of their reduced successors. The observation equality permits intersection with $h^{-1}(y)$ to pass through $\\pi$. Nonemptiness is also preserved and reflected.","elief-w0}--\\eqref{eq:belief-wk} now proves the finite-horizon equivalence. Membership at every horizon gives the fixed-point equivalence, since both sequences stabilize. The goal equivalence in~\\eqref{eq:synthesis-goals}, the same successor identity, and induction in~\\eqref{eq:progress-attractor} prove the progress claims. Every reduced witnessing profile is admissible in every complete state in $B$, and its complete successors have the required reduced images. Pulling back these choices therefore preserves safety and the decreasing progress rank.\n\\end{proof}","s into a strategy claim. It is an exact finite application of quotient and game-synthesis reasoning, not a general solution to decentralized governance. It is stronger than agreement of current outputs because it preserves the existence of a future course of action under the actual information boundary. It remains conditional on the implementation of each catalogue profile and on the coverage of $\\Delta$.","\\subsection{The commons: individually feasible promises without a common budget}\nConsider a declared variant of the four-office commons with $c$ execution slots remaining in an epoch. Three protected units of work are due before the epoch ends. They include a carried service debt and two other admitted jobs. Each unit consumes one slot. This is a new bounded workload, not a claim that the original allocation rule always creates these obligations.","An ongoing reporting procedure is exposed to two listed deviations, each of gain $1$. Its authorized penalty is $F=2$, and its permitted false-positive rate is $\\alpha=1/4$. With no audit, all three observation laws coincide. A one-slot audit has $P_C=(1/2,1/2)$ and the two opposite deviation laws from Counterexample~\\ref{ex:pairwise-enforcement}. Their equal mixture reproduces compliance, so no common monitor deters both positive-gain deviations.","A two-slot audit has three outcomes and the stipulated laws\n\\[\nP_C=(3/4,1/8,1/8),\\qquad\nP_1=(0,1,0),\\qquad P_2=(0,0,1).\n\\]\nThe common monitor $s=(0,1,1)$ sanctions compliance with probability $1/4$, each deviation with probability $1$, and has margin $2(1-1/4)-1=1/2$ against each. The audit costs and laws are assumptions of the analytical variant. They are not measurements or consequences of the earlier resource allocation.","The joint action consists of one audit mode and the amount of work completed in that epoch. A profile must fit both within $c$. Protected work cannot be discarded or quietly deferred. The following comparison is therefore exact for this catalogue:\n\\begin{center}\n\\begin{tabular}{@{}lccc@{}}\n\\toprule\nContract & Audit slots & Due service slots & Minimum total","\\bottomrule\n\\end{tabular}\n\\end{center}\nWith $c=4$, both component contracts are feasible separately, but their conjunction is not. With $c=5$, the two-slot audit and all three services fit, and one-step completion is certified. With $c=4$ and only two protected service units, the same joint profile also fits. In the general version with $d$ protected units, the exact threshold is $c\\geq d+2$.","\\begin{figure}[t]\n\\centering\n\\includegraphics[width=.82\\linewidth]{figures/joint_service_frontier.pdf}\n\\caption{Exact feasibility in the bounded commons variant. Every marked point is one integer pair $(d,c)$. Open markers violate the combined budget, while filled markers admit the two-slot audit and all due services. The boundary is $c=d+2$. A feasible audit and a feasible service allocation considered separately do not establish joint feasibility.}\\label{fig:joint-frontier}\n\\end{figure}","For this richer audit, the best common margin at a general false-positive cap is\n\\[\n\\Gamma_\\alpha=\\min\\{6\\alpha,3/2\\}-1.\n\\]\nTo see this, average any monitor with the monitor obtained by exchanging outcomes $1$ and $2$. The worst deviation margin does not decrease. Write the two equal sanction probabilities as $t$. Setting the outcome-$0$ sanction probability to zero reduces false positives and weakly improves the margin. The remaining constraint is $t/4\\leq\\alpha$, with $t\\leq1$, and the margin is $3t/2-1$. Thus the formula is exact. The cap $\\alpha=1/4$ yields margin $1/2$, but the audit still consumes two execution slots.","eral false-positive cap is\n\\[\n\\Gamma_\\alpha=\\min\\{6\\alpha,3/2\\}-1.\n\\]\nTo see this, average any monitor with the monitor obtained by exchanging outcomes $1$ and $2$. The worst deviation margin does not decrease. Write the two equal sanction probabilities as $t$. Setting the outcome-$0$ sanction probability to zero reduces false positives and weakly improves the margin. The remaining constraint is $t/4\\leq\\alpha$, with $t\\leq1$, and the margin is $3t/2-1$. Thus the formula is exact. The cap $\\alpha=1/4$ yields margin $1/2$, but the audit still consumes two execution slots.","p is\n\\[\n\\Gamma_\\alpha=\\min\\{6\\alpha,3/2\\}-1.\n\\]\nTo see this, average any monitor with the monitor obtained by exchanging outcomes $1$ and $2$. The worst deviation margin does not decrease. Write the two equal sanction probabilities as $t$. Setting the outcome-$0$ sanction probability to zero reduces false positives and weakly improves the margin. The remaining constraint is $t/4\\leq\\alpha$, with $t\\leq1$, and the margin is $3t/2-1$. Thus the formula is exact. The cap $\\alpha=1/4$ yields margin $1/2$, but the audit still consumes two execution slots.","6\\alpha,3/2\\}-1.\n\\]\nTo see this, average any monitor with the monitor obtained by exchanging outcomes $1$ and $2$. The worst deviation margin does not decrease. Write the two equal sanction probabilities as $t$. Setting the outcome-$0$ sanction probability to zero reduces false positives and weakly improves the margin. The remaining constraint is $t/4\\leq\\alpha$, with $t\\leq1$, and the margin is $3t/2-1$. Thus the formula is exact. The cap $\\alpha=1/4$ yields margin $1/2$, but the audit still consumes two execution slots.","monitor with the monitor obtained by exchanging outcomes $1$ and $2$. The worst deviation margin does not decrease. Write the two equal sanction probabilities as $t$. Setting the outcome-$0$ sanction probability to zero reduces false positives and weakly improves the margin. The remaining constraint is $t/4\\leq\\alpha$, with $t\\leq1$, and the margin is $3t/2-1$. Thus the formula is exact. The cap $\\alpha=1/4$ yields margin $1/2$, but the audit still consumes two execution slots.","tained by exchanging outcomes $1$ and $2$. The worst deviation margin does not decrease. Write the two equal sanction probabilities as $t$. Setting the outcome-$0$ sanction probability to zero reduces false positives and weakly improves the margin. The remaining constraint is $t/4\\leq\\alpha$, with $t\\leq1$, and the margin is $3t/2-1$. Thus the formula is exact. The cap $\\alpha=1/4$ yields margin $1/2$, but the audit still consumes two execution slots.","\\clearpage % Monograph layout: keep the margin chart with its discussion.\n\\begin{figure}[!htbp]\n\\centering\n\\includegraphics[width=.82\\linewidth]{figures/joint_enforcement_margin.pdf}\n\\caption{Analytical common-monitor margins for two specified audit channels with $F=2$ and gains $g_1=g_2=1$. The richer three-outcome audit has margin $\\min\\{6\\alpha,3/2\\}-1$. For the two-outcome audit whose deviation mixture equals compliance, the best simultaneous margin is $-1$ at every cap. The curves are exact formulas, not fitted observations.}\\label{fig:joint-margin}\n\\end{figure}","discussion.\n\\begin{figure}[!htbp]\n\\centering\n\\includegraphics[width=.82\\linewidth]{figures/joint_enforcement_margin.pdf}\n\\caption{Analytical common-monitor margins for two specified audit channels with $F=2$ and gains $g_1=g_2=1$. The richer three-outcome audit has margin $\\min\\{6\\alpha,3/2\\}-1$. For the two-outcome audit whose deviation mixture equals compliance, the best simultaneous margin is $-1$ at every cap. The curves are exact formulas, not fitted observations.}\\label{fig:joint-margin}\n\\end{figure}","Membership, decision rights, resource control, and exposure to consequences define different sets. Let $M$ denote participating members, $V$ positions with specified decision rights, $H$ infrastructure controllers, and $E$ affected parties outside the membership. These sets may overlap where the description allows it. A human resource owner can be in $H$ without holding an internal vote. A person whose reserved service is delayed can be in $E$ without ever communicating with the agents. Conversely, membership does not confer authority over every affected resource.",", and exposure to consequences define different sets. Let $M$ denote participating members, $V$ positions with specified decision rights, $H$ infrastructure controllers, and $E$ affected parties outside the membership. These sets may overlap where the description allows it. A human resource owner can be in $H$ without holding an internal vote. A person whose reserved service is delayed can be in $E$ without ever communicating with the agents. Conversely, membership does not confer authority over every affected resource.","A useful external-effects contract records\n\\[\n\\mathcal B=(Z_{\\rm ext},O_{\\rm ext},\\mathsf{Auth},\\mathsf{Effect},\n\\mathsf{Standing},\\mathsf{Remedy}).\n\\]\nHere $Z_{\\rm ext}$ contains the external facts relevant to the guarantee, $O_{\\rm ext}$ specifies which of them can be observed, $\\mathsf{Auth}$ identifies the stipulated authorization for each boundary-crossing act, and $\\mathsf{Effect}$ includes the consequences covered by the model. $\\mathsf{Standing}$ specifies who may initiate a challenge and on which grounds. $\\mathsf{Remedy}$ specifies the actions an authorized review can actually require. The contract can use a finite abstraction of external state, but it must justify that abstraction relative to the protected questions.","ds\n\\[\n\\mathcal B=(Z_{\\rm ext},O_{\\rm ext},\\mathsf{Auth},\\mathsf{Effect},\n\\mathsf{Standing},\\mathsf{Remedy}).\n\\]\nHere $Z_{\\rm ext}$ contains the external facts relevant to the guarantee, $O_{\\rm ext}$ specifies which of them can be observed, $\\mathsf{Auth}$ identifies the stipulated authorization for each boundary-crossing act, and $\\mathsf{Effect}$ includes the consequences covered by the model. $\\mathsf{Standing}$ specifies who may initiate a challenge and on which grounds. $\\mathsf{Remedy}$ specifies the actions an authorized review can actually require. The contract can use a finite abstraction of external state, but it must justify that abstraction relative to the protected questions.","Standing},\\mathsf{Remedy}).\n\\]\nHere $Z_{\\rm ext}$ contains the external facts relevant to the guarantee, $O_{\\rm ext}$ specifies which of them can be observed, $\\mathsf{Auth}$ identifies the stipulated authorization for each boundary-crossing act, and $\\mathsf{Effect}$ includes the consequences covered by the model. $\\mathsf{Standing}$ specifies who may initiate a challenge and on which grounds. $\\mathsf{Remedy}$ specifies the actions an authorized review can actually require. The contract can use a finite abstraction of external state, but it must justify that abstraction relative to the protected questions.","This is a representation proposal, not a universal allocation of voting rights. Recognizing an affected party does not automatically give that party an unlimited veto. Conversely, omitting a party from $M$ does not establish consent. The source of authority must select the applicable protections openly. Research on meaningful human control distinguishes responsiveness to relevant human reasons from traceability to responsible human actors~\\cite{meaningfulcontrol}. The operational question here is how such requirements enter the action, evidence, and resource contract of the same computation.","\\begin{counterexample}[Exact internal accounting with an omitted external claim]\\label{ex:external-claim}\nFour execution slots exist. The internal state contains four member requests and a rule granting one slot to each. In realization $h_0$, all four slots are available to that institution. In realization $h_1$, an external owner has reserved one slot for a nonmember, and has authorized the institution to use only the other three. Suppose the reservation is absent from every internal record. The same four grants satisfy the internal predicate $\\sum_iq_i\\le4$ in both realizations, but exceed the institution's stipulated authority in $h_1$. Perfect preservation of the internal state cannot distinguish the cases.\n\\end{counterexample}","e contains four member requests and a rule granting one slot to each. In realization $h_0$, all four slots are available to that institution. In realization $h_1$, an external owner has reserved one slot for a nonmember, and has authorized the institution to use only the other three. Suppose the reservation is absent from every internal record. The same four grants satisfy the internal predicate $\\sum_iq_i\\le4$ in both realizations, but exceed the institution's stipulated authority in $h_1$. Perfect preservation of the internal state cannot distinguish the cases.\n\\end{counterexample}","all four slots are available to that institution. In realization $h_1$, an external owner has reserved one slot for a nonmember, and has authorized the institution to use only the other three. Suppose the reservation is absent from every internal record. The same four grants satisfy the internal predicate $\\sum_iq_i\\le4$ in both realizations, but exceed the institution's stipulated authority in $h_1$. Perfect preservation of the internal state cannot distinguish the cases.\n\\end{counterexample}","A participant chooses compliance $C$ or deviation $D$. An auditor simultaneously chooses no inspection $N$ or inspection $I$. Deviation gives the participant gross gain $g>0$. An inspection detects this specified deviation perfectly and imposes an authorized, collectible penalty $F>g$. The auditor pays cost $c>0$ to inspect and receives reward $b>c$ only on detection. There are no false accusations, side payments, further continuation payoffs, or prior commitment to inspect. Payoffs are risk-neutral and common knowledge. The ordered pair in each entry is the participant's payoff followed by the auditor's payoff.","\\begin{center}\n\\begin{tabular}{@{}lcc@{}}\n\\toprule\n & No inspection $N$ & Inspection $I$","\\midrule\nCompliance $C$ & $(0,0)$ & $(0,-c)$","Deviation $D$ & $(g,0)$ & $(g-F,b-c)$","\\begin{proposition}[Inspection without commitment]\\label{prop:strategic-inspector}\nUnder the preceding strict inequalities, the game has no pure Nash equilibrium and has a unique Nash equilibrium in independently mixed strategies. Its deviation and inspection probabilities are\n\\[\np^*=\\frac{c}{b},\\qquad q^*=\\frac{g}{F}.\n\\]\nIn particular, certain compliance is not sustained in this simultaneous game.\n\\end{proposition}\n\\begin{proof}\nIf the auditor inspects with probability $q$, the participant's advantage from deviation is $g-qF$. If the participant deviates with probability $p$, the auditor's advantage from inspection is $pb-c$. At $(C,N)$ the participant prefers $D$, at $(D,N)$ the auditor prefers $I$, at $(D,I)$ the participant prefers $C$, and at $(C,I)$ the auditor prefers $N$. Thus no pure profile is an equilibrium. If either player uses a pure strategy, the other's strict best response yields one of these nonequilibrium pure profiles. Both players must therefore mix. Their two indifference equations un","ector}\nUnder the preceding strict inequalities, the game has no pure Nash equilibrium and has a unique Nash equilibrium in independently mixed strategies. Its deviation and inspection probabilities are\n\\[\np^*=\\frac{c}{b},\\qquad q^*=\\frac{g}{F}.\n\\]\nIn particular, certain compliance is not sustained in this simultaneous game.\n\\end{proposition}\n\\begin{proof}\nIf the auditor inspects with probability $q$, the participant's advantage from deviation is $g-qF$. If the participant deviates with probability $p$, the auditor's advantage from inspection is $pb-c$. At $(C,N)$ the participant prefers $D$, at $(D,N)$ the auditor prefers $I$, at $(D,I)$ the participant prefers $C$, and at $(C,I)$ the auditor prefers $N$. Thus no pure profile is an equilibrium. If either player uses a pure strategy, the other's strict best response yields one of these nonequilibrium pure profiles. Both players must therefore mix. Their two indifference equations uniquely give the displayed probabilities, which lie strictly between zero and one and make every action in each support a best response.\n\\end{proof}","game has no pure Nash equilibrium and has a unique Nash equilibrium in independently mixed strategies. Its deviation and inspection probabilities are\n\\[\np^*=\\frac{c}{b},\\qquad q^*=\\frac{g}{F}.\n\\]\nIn particular, certain compliance is not sustained in this simultaneous game.\n\\end{proposition}\n\\begin{proof}\nIf the auditor inspects with probability $q$, the participant's advantage from deviation is $g-qF$. If the participant deviates with probability $p$, the auditor's advantage from inspection is $pb-c$. At $(C,N)$ the participant prefers $D$, at $(D,N)$ the auditor prefers $I$, at $(D,I)$ the participant prefers $C$, and at $(C,I)$ the auditor prefers $N$. Thus no pure profile is an equilibrium. If either player uses a pure strategy, the other's strict best response yields one of these nonequilibrium pure profiles. Both players must therefore mix. Their two indifference equations uniquely give the displayed probabilities, which lie strictly between zero and one and make every action in each support a best response.\n\\end{proof}","ash equilibrium in independently mixed strategies. Its deviation and inspection probabilities are\n\\[\np^*=\\frac{c}{b},\\qquad q^*=\\frac{g}{F}.\n\\]\nIn particular, certain compliance is not sustained in this simultaneous game.\n\\end{proposition}\n\\begin{proof}\nIf the auditor inspects with probability $q$, the participant's advantage from deviation is $g-qF$. If the participant deviates with probability $p$, the auditor's advantage from inspection is $pb-c$. At $(C,N)$ the participant prefers $D$, at $(D,N)$ the auditor prefers $I$, at $(D,I)$ the participant prefers $C$, and at $(C,I)$ the auditor prefers $N$. Thus no pure profile is an equilibrium. If either player uses a pure strategy, the other's strict best response yields one of these nonequilibrium pure profiles. Both players must therefore mix. Their two indifference equations uniquely give the displayed probabilities, which lie strictly between zero and one and make every action in each support a best response.\n\\end{proof}","s. Its deviation and inspection probabilities are\n\\[\np^*=\\frac{c}{b},\\qquad q^*=\\frac{g}{F}.\n\\]\nIn particular, certain compliance is not sustained in this simultaneous game.\n\\end{proposition}\n\\begin{proof}\nIf the auditor inspects with probability $q$, the participant's advantage from deviation is $g-qF$. If the participant deviates with probability $p$, the auditor's advantage from inspection is $pb-c$. At $(C,N)$ the participant prefers $D$, at $(D,N)$ the auditor prefers $I$, at $(D,I)$ the participant prefers $C$, and at $(C,I)$ the auditor prefers $N$. Thus no pure profile is an equilibrium. If either player uses a pure strategy, the other's strict best response yields one of these nonequilibrium pure profiles. Both players must therefore mix. Their two indifference equations uniquely give the displayed probabilities, which lie strictly between zero and one and make every action in each support a best response.\n\\end{proof}","ation and inspection probabilities are\n\\[\np^*=\\frac{c}{b},\\qquad q^*=\\frac{g}{F}.\n\\]\nIn particular, certain compliance is not sustained in this simultaneous game.\n\\end{proposition}\n\\begin{proof}\nIf the auditor inspects with probability $q$, the participant's advantage from deviation is $g-qF$. If the participant deviates with probability $p$, the auditor's advantage from inspection is $pb-c$. At $(C,N)$ the participant prefers $D$, at $(D,N)$ the auditor prefers $I$, at $(D,I)$ the participant prefers $C$, and at $(C,I)$ the auditor prefers $N$. Thus no pure profile is an equilibrium. If either player uses a pure strategy, the other's strict best response yields one of these nonequilibrium pure profiles. Both players must therefore mix. Their two indifference equations uniquely give the displayed probabilities, which lie strictly between zero and one and make every action in each support a best response.\n\\end{proof}","es are\n\\[\np^*=\\frac{c}{b},\\qquad q^*=\\frac{g}{F}.\n\\]\nIn particular, certain compliance is not sustained in this simultaneous game.\n\\end{proposition}\n\\begin{proof}\nIf the auditor inspects with probability $q$, the participant's advantage from deviation is $g-qF$. If the participant deviates with probability $p$, the auditor's advantage from inspection is $pb-c$. At $(C,N)$ the participant prefers $D$, at $(D,N)$ the auditor prefers $I$, at $(D,I)$ the participant prefers $C$, and at $(C,I)$ the auditor prefers $N$. Thus no pure profile is an equilibrium. If either player uses a pure strategy, the other's strict best response yields one of these nonequilibrium pure profiles. Both players must therefore mix. Their two indifference equations uniquely give the displayed probabilities, which lie strictly between zero and one and make every action in each support a best response.\n\\end{proof}","[\np^*=\\frac{c}{b},\\qquad q^*=\\frac{g}{F}.\n\\]\nIn particular, certain compliance is not sustained in this simultaneous game.\n\\end{proposition}\n\\begin{proof}\nIf the auditor inspects with probability $q$, the participant's advantage from deviation is $g-qF$. If the participant deviates with probability $p$, the auditor's advantage from inspection is $pb-c$. At $(C,N)$ the participant prefers $D$, at $(D,N)$ the auditor prefers $I$, at $(D,I)$ the participant prefers $C$, and at $(C,I)$ the auditor prefers $N$. Thus no pure profile is an equilibrium. If either player uses a pure strategy, the other's strict best response yields one of these nonequilibrium pure profiles. Both players must therefore mix. Their two indifference equations uniquely give the displayed probabilities, which lie strictly between zero and one and make every action in each support a best response.\n\\end{proof}","=\\frac{g}{F}.\n\\]\nIn particular, certain compliance is not sustained in this simultaneous game.\n\\end{proposition}\n\\begin{proof}\nIf the auditor inspects with probability $q$, the participant's advantage from deviation is $g-qF$. If the participant deviates with probability $p$, the auditor's advantage from inspection is $pb-c$. At $(C,N)$ the participant prefers $D$, at $(D,N)$ the auditor prefers $I$, at $(D,I)$ the participant prefers $C$, and at $(C,I)$ the auditor prefers $N$. Thus no pure profile is an equilibrium. If either player uses a pure strategy, the other's strict best response yields one of these nonequilibrium pure profiles. Both players must therefore mix. Their two indifference equations uniquely give the displayed probabilities, which lie strictly between zero and one and make every action in each support a best response.\n\\end{proof}","}{F}.\n\\]\nIn particular, certain compliance is not sustained in this simultaneous game.\n\\end{proposition}\n\\begin{proof}\nIf the auditor inspects with probability $q$, the participant's advantage from deviation is $g-qF$. If the participant deviates with probability $p$, the auditor's advantage from inspection is $pb-c$. At $(C,N)$ the participant prefers $D$, at $(D,N)$ the auditor prefers $I$, at $(D,I)$ the participant prefers $C$, and at $(C,I)$ the auditor prefers $N$. Thus no pure profile is an equilibrium. If either player uses a pure strategy, the other's strict best response yields one of these nonequilibrium pure profiles. Both players must therefore mix. Their two indifference equations uniquely give the displayed probabilities, which lie strictly between zero and one and make every action in each support a best response.\n\\end{proof}","compliance is not sustained in this simultaneous game.\n\\end{proposition}\n\\begin{proof}\nIf the auditor inspects with probability $q$, the participant's advantage from deviation is $g-qF$. If the participant deviates with probability $p$, the auditor's advantage from inspection is $pb-c$. At $(C,N)$ the participant prefers $D$, at $(D,N)$ the auditor prefers $I$, at $(D,I)$ the participant prefers $C$, and at $(C,I)$ the auditor prefers $N$. Thus no pure profile is an equilibrium. If either player uses a pure strategy, the other's strict best response yields one of these nonequilibrium pure profiles. Both players must therefore mix. Their two indifference equations uniquely give the displayed probabilities, which lie strictly between zero and one and make every action in each support a best response.\n\\end{proof}","s not sustained in this simultaneous game.\n\\end{proposition}\n\\begin{proof}\nIf the auditor inspects with probability $q$, the participant's advantage from deviation is $g-qF$. If the participant deviates with probability $p$, the auditor's advantage from inspection is $pb-c$. At $(C,N)$ the participant prefers $D$, at $(D,N)$ the auditor prefers $I$, at $(D,I)$ the participant prefers $C$, and at $(C,I)$ the auditor prefers $N$. Thus no pure profile is an equilibrium. If either player uses a pure strategy, the other's strict best response yields one of these nonequilibrium pure profiles. Both players must therefore mix. Their two indifference equations uniquely give the displayed probabilities, which lie strictly between zero and one and make every action in each support a best response.\n\\end{proof}","ltaneous game.\n\\end{proposition}\n\\begin{proof}\nIf the auditor inspects with probability $q$, the participant's advantage from deviation is $g-qF$. If the participant deviates with probability $p$, the auditor's advantage from inspection is $pb-c$. At $(C,N)$ the participant prefers $D$, at $(D,N)$ the auditor prefers $I$, at $(D,I)$ the participant prefers $C$, and at $(C,I)$ the auditor prefers $N$. Thus no pure profile is an equilibrium. If either player uses a pure strategy, the other's strict best response yields one of these nonequilibrium pure profiles. Both players must therefore mix. Their two indifference equations uniquely give the displayed probabilities, which lie strictly between zero and one and make every action in each support a best response.\n\\end{proof}","A different payment contract changes the result. Suppose every \\emph{genuinely performed and independently verifiable} inspection receives fee $w>c$, with the detection reward otherwise unchanged. Inspection then has advantage $w+pb-c>0$ at every $p$. The auditor strictly prefers $I$, and the participant strictly prefers $C$ because $F>g$. The unique equilibrium is $(C,I)$. At $w=c$, inspection can be a weak best response to compliance, but the strict implementation claim is lost. This extension requires an affordable fee and a mechanism that verifies the performed service. Paying for an unverified assertion that an inspection occurred does not satisfy the assumption.","An institution may have good reasons not to collect or disclose every private state. The relevant question is which distinctions a protected record may reveal, not whether more information is always desirable. Let $P_C$ and $P_D$ be the laws of the \\emph{complete record available to a sanctioning procedure}. For $\\lambda\\ge1$, impose\n\\begin{equation}\\label{eq:pairwise-privacy}\n P_D(E)\\le\\lambda P_C(E),\\qquad P_C(E)\\le\\lambda P_D(E)\n \\quad\\text{for every event }E.\n\\end{equation}\nThe finite setting makes these conditions equivalent to the corresponding pointwise inequalities. When the two underlying inputs are neighbors in a declared pure differential-privacy contract, they hold with $\\lambda=e^\\varepsilon$. The neighboring-input relation is essential. Differential privacy does not require arbitrary acts of compliance and misconduct to be treated as neighboring inputs. Its standard definition and compositio","An institution may have good reasons not to collect or disclose every private state. The relevant question is which distinctions a protected record may reveal, not whether more information is always desirable. Let $P_C$ and $P_D$ be the laws of the \\emph{complete record available to a sanctioning procedure}. For $\\lambda\\ge1$, impose\n\\begin{equation}\\label{eq:pairwise-privacy}\n P_D(E)\\le\\lambda P_C(E),\\qquad P_C(E)\\le\\lambda P_D(E)\n \\quad\\text{for every event }E.\n\\end{equation}\nThe finite setting makes these conditions equivalent to the corresponding pointwise inequalities. When the two underlying inputs are neighbors in a declared pure differential-privacy contract, they hold with $\\lambda=e^\\varepsilon$. The neighboring-input relation is essential. Differential privacy does not require arbitrary acts of compliance and misconduct to be treated as neighboring inputs. Its standard definition and composition principl","An institution may have good reasons not to collect or disclose every private state. The relevant question is which distinctions a protected record may reveal, not whether more information is always desirable. Let $P_C$ and $P_D$ be the laws of the \\emph{complete record available to a sanctioning procedure}. For $\\lambda\\ge1$, impose\n\\begin{equation}\\label{eq:pairwise-privacy}\n P_D(E)\\le\\lambda P_C(E),\\qquad P_C(E)\\le\\lambda P_D(E)\n \\quad\\text{for every event }E.\n\\end{equation}\nThe finite setting makes these conditions equivalent to the corresponding pointwise inequalities. When the two underlying inputs are neighbors in a declared pure differential-privacy contract, they hold with $\\lambda=e^\\varepsilon$. The neighboring-input relation is essential. Differential privacy does not require arbitrary acts of compliance and misconduct to be treated as neighboring inputs. Its standard definition and composition principles are described by Dwork and Roth~\\cite{dworkroth}.","oning procedure}. For $\\lambda\\ge1$, impose\n\\begin{equation}\\label{eq:pairwise-privacy}\n P_D(E)\\le\\lambda P_C(E),\\qquad P_C(E)\\le\\lambda P_D(E)\n \\quad\\text{for every event }E.\n\\end{equation}\nThe finite setting makes these conditions equivalent to the corresponding pointwise inequalities. When the two underlying inputs are neighbors in a declared pure differential-privacy contract, they hold with $\\lambda=e^\\varepsilon$. The neighboring-input relation is essential. Differential privacy does not require arbitrary acts of compliance and misconduct to be treated as neighboring inputs. Its standard definition and composition principles are described by Dwork and Roth~\\cite{dworkroth}.","Keep the earlier definition\n\\[\nD_\\alpha(P_D,P_C)=\\max_{0\\le s\\le1,\\ \\E_{P_C}s\\le\\alpha}\n       (\\E_{P_D}s-\\E_{P_C}s),\\qquad 0\\le\\alpha\\le1.\n\\]\nThe same randomized sanction $s$ must obey the protected false-positive limit and supply the deviation margin.","\\begin{theorem}[Sharp pairwise privacy envelope for a bounded sanction]\\label{thm:privacy-envelope}\nFor every finite pair satisfying~\\eqref{eq:pairwise-privacy},\n\\begin{equation}\\label{eq:privacy-envelope}\nD_\\alpha(P_D,P_C)\\le\n B(\\lambda,\\alpha):=\n \\min\\left\\{(\\lambda-1)\\alpha,\\frac{\\lambda-1}{\\lambda+1}\\right\\}.\n\\end{equation}\nFor each $\\lambda\\ge1$ and $\\alpha\\in[0,1]$, equality is attained by a pair on two outcomes and a suitable sanction. Consequently, deterrence in the model of Proposition~\\ref{prop:deterrence-tv} requires $g\\le F B(\\lambda,\\alpha)$. The envelope is a necessary bound for a specified pair, not a sufficiency claim for every pair satisfying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $","\\begin{theorem}[Sharp pairwise privacy envelope for a bounded sanction]\\label{thm:privacy-envelope}\nFor every finite pair satisfying~\\eqref{eq:pairwise-privacy},\n\\begin{equation}\\label{eq:privacy-envelope}\nD_\\alpha(P_D,P_C)\\le\n B(\\lambda,\\alpha):=\n \\min\\left\\{(\\lambda-1)\\alpha,\\frac{\\lambda-1}{\\lambda+1}\\right\\}.\n\\end{equation}\nFor each $\\lambda\\ge1$ and $\\alpha\\in[0,1]$, equality is attained by a pair on two outcomes and a suitable sanction. Consequently, deterrence in the model of Proposition~\\ref{prop:deterrence-tv} requires $g\\le F B(\\lambda,\\alpha)$. The envelope is a necessary bound for a specified pair, not a sufficiency claim for every pair satisfying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They ar","\\begin{theorem}[Sharp pairwise privacy envelope for a bounded sanction]\\label{thm:privacy-envelope}\nFor every finite pair satisfying~\\eqref{eq:pairwise-privacy},\n\\begin{equation}\\label{eq:privacy-envelope}\nD_\\alpha(P_D,P_C)\\le\n B(\\lambda,\\alpha):=\n \\min\\left\\{(\\lambda-1)\\alpha,\\frac{\\lambda-1}{\\lambda+1}\\right\\}.\n\\end{equation}\nFor each $\\lambda\\ge1$ and $\\alpha\\in[0,1]$, equality is attained by a pair on two outcomes and a suitable sanction. Consequently, deterrence in the model of Proposition~\\ref{prop:deterrence-tv} requires $g\\le F B(\\lambda,\\alpha)$. The envelope is a necessary bound for a specified pair, not a sufficiency claim for every pair satisfying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lam","qref{eq:pairwise-privacy},\n\\begin{equation}\\label{eq:privacy-envelope}\nD_\\alpha(P_D,P_C)\\le\n B(\\lambda,\\alpha):=\n \\min\\left\\{(\\lambda-1)\\alpha,\\frac{\\lambda-1}{\\lambda+1}\\right\\}.\n\\end{equation}\nFor each $\\lambda\\ge1$ and $\\alpha\\in[0,1]$, equality is attained by a pair on two outcomes and a suitable sanction. Consequently, deterrence in the model of Proposition~\\ref{prop:deterrence-tv} requires $g\\le F B(\\lambda,\\alpha)$. The envelope is a necessary bound for a specified pair, not a sufficiency claim for every pair satisfying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lambda+1)$. Maximizing their minimum over $0\\le a\\le\\alpha$ gives~\\eqref{eq:privacy-envelope}. For $\\lambda=1$, the laws coincide and the bound is zero.","t\\}.\n\\end{equation}\nFor each $\\lambda\\ge1$ and $\\alpha\\in[0,1]$, equality is attained by a pair on two outcomes and a suitable sanction. Consequently, deterrence in the model of Proposition~\\ref{prop:deterrence-tv} requires $g\\le F B(\\lambda,\\alpha)$. The envelope is a necessary bound for a specified pair, not a sufficiency claim for every pair satisfying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lambda+1)$. Maximizing their minimum over $0\\le a\\le\\alpha$ gives~\\eqref{eq:privacy-envelope}. For $\\lambda=1$, the laws coincide and the bound is zero.","}\nFor each $\\lambda\\ge1$ and $\\alpha\\in[0,1]$, equality is attained by a pair on two outcomes and a suitable sanction. Consequently, deterrence in the model of Proposition~\\ref{prop:deterrence-tv} requires $g\\le F B(\\lambda,\\alpha)$. The envelope is a necessary bound for a specified pair, not a sufficiency claim for every pair satisfying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lambda+1)$. Maximizing their minimum over $0\\le a\\le\\alpha$ gives~\\eqref{eq:privacy-envelope}. For $\\lambda=1$, the laws coincide and the bound is zero.","attained by a pair on two outcomes and a suitable sanction. Consequently, deterrence in the model of Proposition~\\ref{prop:deterrence-tv} requires $g\\le F B(\\lambda,\\alpha)$. The envelope is a necessary bound for a specified pair, not a sufficiency claim for every pair satisfying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lambda+1)$. Maximizing their minimum over $0\\le a\\le\\alpha$ gives~\\eqref{eq:privacy-envelope}. For $\\lambda=1$, the laws coincide and the bound is zero.","by a pair on two outcomes and a suitable sanction. Consequently, deterrence in the model of Proposition~\\ref{prop:deterrence-tv} requires $g\\le F B(\\lambda,\\alpha)$. The envelope is a necessary bound for a specified pair, not a sufficiency claim for every pair satisfying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lambda+1)$. Maximizing their minimum over $0\\le a\\le\\alpha$ gives~\\eqref{eq:privacy-envelope}. For $\\lambda=1$, the laws coincide and the bound is zero.","uitable sanction. Consequently, deterrence in the model of Proposition~\\ref{prop:deterrence-tv} requires $g\\le F B(\\lambda,\\alpha)$. The envelope is a necessary bound for a specified pair, not a sufficiency claim for every pair satisfying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lambda+1)$. Maximizing their minimum over $0\\le a\\le\\alpha$ gives~\\eqref{eq:privacy-envelope}. For $\\lambda=1$, the laws coincide and the bound is zero.","tion. Consequently, deterrence in the model of Proposition~\\ref{prop:deterrence-tv} requires $g\\le F B(\\lambda,\\alpha)$. The envelope is a necessary bound for a specified pair, not a sufficiency claim for every pair satisfying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lambda+1)$. Maximizing their minimum over $0\\le a\\le\\alpha$ gives~\\eqref{eq:privacy-envelope}. For $\\lambda=1$, the laws coincide and the bound is zero.","ce in the model of Proposition~\\ref{prop:deterrence-tv} requires $g\\le F B(\\lambda,\\alpha)$. The envelope is a necessary bound for a specified pair, not a sufficiency claim for every pair satisfying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lambda+1)$. Maximizing their minimum over $0\\le a\\le\\alpha$ gives~\\eqref{eq:privacy-envelope}. For $\\lambda=1$, the laws coincide and the bound is zero.","velope is a necessary bound for a specified pair, not a sufficiency claim for every pair satisfying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lambda+1)$. Maximizing their minimum over $0\\le a\\le\\alpha$ gives~\\eqref{eq:privacy-envelope}. For $\\lambda=1$, the laws coincide and the bound is zero.","r, not a sufficiency claim for every pair satisfying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lambda+1)$. Maximizing their minimum over $0\\le a\\le\\alpha$ gives~\\eqref{eq:privacy-envelope}. For $\\lambda=1$, the laws coincide and the bound is zero.","ying privacy.\n\\end{theorem}\n\\begin{proof}\nPut $a=\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lambda+1)$. Maximizing their minimum over $0\\le a\\le\\alpha$ gives~\\eqref{eq:privacy-envelope}. For $\\lambda=1$, the laws coincide and the bound is zero.","\\E_{P_C}s$ and $b=\\E_{P_D}s$. Summing the pointwise inequalities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lambda+1)$. Maximizing their minimum over $0\\le a\\le\\alpha$ gives~\\eqref{eq:privacy-envelope}. For $\\lambda=1$, the laws coincide and the bound is zero.","alities against $s$ gives $b\\le\\lambda a$. Summing against $1-s$ gives $1-a\\le\\lambda(1-b)$. Thus\n\\[\nb-a\\le\\min\\left\\{(\\lambda-1)a,\n                   \\frac{\\lambda-1}{\\lambda}(1-a)\\right\\}.\n\\]\nFor $\\lambda>1$, the first expression increases in $a$ and the second decreases. They are equal at $a=1/(\\lambda+1)$. Maximizing their minimum over $0\\le a\\le\\alpha$ gives~\\eqref{eq:privacy-envelope}. For $\\lambda=1$, the laws coincide and the bound is zero.","For attainment, take outcomes $0,1$ with\n\\[\nP_C=\\left(\\frac{\\lambda}{\\lambda+1},\\frac1{\\lambda+1}\\right),\n\\qquad\nP_D=\\left(\\frac1{\\lambda+1},\\frac{\\lambda}{\\lambda+1}\\right).\n\\]\nBoth privacy inequalities hold. Choose $s(0)=0$ and\n$s(1)=\\min\\{(\\lambda+1)\\alpha,1\\}$. Its false-positive rate is at most $\\alpha$ and its expectation difference is exactly $B(\\lambda,\\alpha)$. Finally, the incentive inequality is $g\\le F(\\E_{P_D}s-\\E_{P_C}s)$, which yields the stated necessary condition.\n\\end{proof}","ent, take outcomes $0,1$ with\n\\[\nP_C=\\left(\\frac{\\lambda}{\\lambda+1},\\frac1{\\lambda+1}\\right),\n\\qquad\nP_D=\\left(\\frac1{\\lambda+1},\\frac{\\lambda}{\\lambda+1}\\right).\n\\]\nBoth privacy inequalities hold. Choose $s(0)=0$ and\n$s(1)=\\min\\{(\\lambda+1)\\alpha,1\\}$. Its false-positive rate is at most $\\alpha$ and its expectation difference is exactly $B(\\lambda,\\alpha)$. Finally, the incentive inequality is $g\\le F(\\E_{P_D}s-\\E_{P_C}s)$, which yields the stated necessary condition.\n\\end{proof}","At $\\lambda=3$, $\\alpha=1/10$, the sharp envelope is $1/5$. With penalty $F=2$, gains above $2/5$ cannot be deterred by any record and sanction obeying these particular simultaneous constraints. The pair $P_C=(3/4,1/4)$ and $P_D=(1/4,3/4)$ with $s=(0,2/5)$ attains that envelope. For a gain $g=1/3$, the incentive margin is $2/5-1/3=1/15$. These are exact rational examples, not inferred observation laws.","\\begin{counterexample}[Two uninformative records with an informative joint history]\\label{ex:privacy-marginals}\nLet $\\theta\\in\\{0,1\\}$ distinguish two protected cases, and let $R$ be a fair independent bit. Release $O_1=R$ and $O_2=R\\oplus\\theta$. Each marginal is a fair bit under both cases and satisfies~\\eqref{eq:pairwise-privacy} with $\\lambda=1$. But $O_1\\oplus O_2=\\theta$. The joint laws have disjoint support and satisfy no finite multiplicative bound.\n\\end{counterexample}","\\begin{proposition}[Conditional disclosure accounting]\\label{prop:privacy-transcript}\nConsider $m$ releases on finite alphabets. At each common prefix $h$, suppose their conditional next-release laws $P_C^t(\\cdot\\mid h)$ and $P_D^t(\\cdot\\mid h)$ satisfy both pointwise inequalities with factor $\\lambda_t\\ge1$, uniformly over prefixes that can occur. Then the joint transcript laws satisfy~\\eqref{eq:pairwise-privacy} with\n\\[\n\\lambda=\\prod_{t=1}^{m}\\lambda_t.\n\\]\nThe bound also holds after applying the same stochastic postprocessing to the transcript under both cases. In particular, any sanction computed only from that transcript obeys Theorem~\\ref{thm:privacy-envelope} with this product factor.\n\\end{proposition}\n\\begin{proof}\nThe conditional inequalities imply common support at each stage.","\\begin{proposition}[Conditional disclosure accounting]\\label{prop:privacy-transcript}\nConsider $m$ releases on finite alphabets. At each common prefix $h$, suppose their conditional next-release laws $P_C^t(\\cdot\\mid h)$ and $P_D^t(\\cdot\\mid h)$ satisfy both pointwise inequalities with factor $\\lambda_t\\ge1$, uniformly over prefixes that can occur. Then the joint transcript laws satisfy~\\eqref{eq:pairwise-privacy} with\n\\[\n\\lambda=\\prod_{t=1}^{m}\\lambda_t.\n\\]\nThe bound also holds after applying the same stochastic postprocessing to the transcript under both cases. In particular, any sanction computed only from that transcript obeys Theorem~\\ref{thm:privacy-envelope} with this product factor.\n\\end{proposition}\n\\begin{proof}\nThe conditional inequalities imply common support at each stage. Induction therefore gives common support for prefixes un","\\begin{proposition}[Conditional disclosure accounting]\\label{prop:privacy-transcript}\nConsider $m$ releases on finite alphabets. At each common prefix $h$, suppose their conditional next-release laws $P_C^t(\\cdot\\mid h)$ and $P_D^t(\\cdot\\mid h)$ satisfy both pointwise inequalities with factor $\\lambda_t\\ge1$, uniformly over prefixes that can occur. Then the joint transcript laws satisfy~\\eqref{eq:pairwise-privacy} with\n\\[\n\\lambda=\\prod_{t=1}^{m}\\lambda_t.\n\\]\nThe bound also holds after applying the same stochastic postprocessing to the transcript under both cases. In particular, any sanction computed only from that transcript obeys Theorem~\\ref{thm:privacy-envelope} with this product factor.\n\\end{proposition}\n\\begin{proof}\nThe conditional inequalities imply common support at each stage. Induction therefore gives common support for prefixes under the two cases. For a positive-probability full transcript, the","\\begin{proposition}[Conditional disclosure accounting]\\label{prop:privacy-transcript}\nConsider $m$ releases on finite alphabets. At each common prefix $h$, suppose their conditional next-release laws $P_C^t(\\cdot\\mid h)$ and $P_D^t(\\cdot\\mid h)$ satisfy both pointwise inequalities with factor $\\lambda_t\\ge1$, uniformly over prefixes that can occur. Then the joint transcript laws satisfy~\\eqref{eq:pairwise-privacy} with\n\\[\n\\lambda=\\prod_{t=1}^{m}\\lambda_t.\n\\]\nThe bound also holds after applying the same stochastic postprocessing to the transcript under both cases. In particular, any sanction computed only from that transcript obeys Theorem~\\ref{thm:privacy-envelope} with this product factor.\n\\end{proposition}\n\\begin{proof}\nThe conditional inequalities imply common support at each stage. Induction therefore gives common support for prefixes under the two cases. For a positive-probability full transcript, the ratio of its probabiliti","\\begin{proposition}[Conditional disclosure accounting]\\label{prop:privacy-transcript}\nConsider $m$ releases on finite alphabets. At each common prefix $h$, suppose their conditional next-release laws $P_C^t(\\cdot\\mid h)$ and $P_D^t(\\cdot\\mid h)$ satisfy both pointwise inequalities with factor $\\lambda_t\\ge1$, uniformly over prefixes that can occur. Then the joint transcript laws satisfy~\\eqref{eq:pairwise-privacy} with\n\\[\n\\lambda=\\prod_{t=1}^{m}\\lambda_t.\n\\]\nThe bound also holds after applying the same stochastic postprocessing to the transcript under both cases. In particular, any sanction computed only from that transcript obeys Theorem~\\ref{thm:privacy-envelope} with this product factor.\n\\end{proposition}\n\\begin{proof}\nThe conditional inequalities imply common support at each stage. Induction therefore gives common support for prefixes under the two cases. For a positive-probability full transcript, the ratio of its probabilities is the product of conditional ratios, each between $\\lambda_t","tional disclosure accounting]\\label{prop:privacy-transcript}\nConsider $m$ releases on finite alphabets. At each common prefix $h$, suppose their conditional next-release laws $P_C^t(\\cdot\\mid h)$ and $P_D^t(\\cdot\\mid h)$ satisfy both pointwise inequalities with factor $\\lambda_t\\ge1$, uniformly over prefixes that can occur. Then the joint transcript laws satisfy~\\eqref{eq:pairwise-privacy} with\n\\[\n\\lambda=\\prod_{t=1}^{m}\\lambda_t.\n\\]\nThe bound also holds after applying the same stochastic postprocessing to the transcript under both cases. In particular, any sanction computed only from that transcript obeys Theorem~\\ref{thm:privacy-envelope} with this product factor.\n\\end{proposition}\n\\begin{proof}\nThe conditional inequalities imply common support at each stage. Induction therefore gives common support for prefixes under the two cases. For a positive-probability full transcript, the ratio of its probabilities is the product of conditional ratios, each between $\\lambda_t^{-1}$ and $\\lambda_t$. Multiplying gives the joint pointwise inequalities. Zero-probability transcripts occur under …","omputed only from that transcript obeys Theorem~\\ref{thm:privacy-envelope} with this product factor.\n\\end{proposition}\n\\begin{proof}\nThe conditional inequalities imply common support at each stage. Induction therefore gives common support for prefixes under the two cases. For a positive-probability full transcript, the ratio of its probabilities is the product of conditional ratios, each between $\\lambda_t^{-1}$ and $\\lambda_t$. Multiplying gives the joint pointwise inequalities. Zero-probability transcripts occur under both cases and satisfy them as well. Summing proves the event inequalities. For a common postprocessing kernel, multiply each pointwise inequality by its nonnegative output probability and sum over input transcripts. This preserves both inequalities.\n\\end{proof}","t transcript obeys Theorem~\\ref{thm:privacy-envelope} with this product factor.\n\\end{proposition}\n\\begin{proof}\nThe conditional inequalities imply common support at each stage. Induction therefore gives common support for prefixes under the two cases. For a positive-probability full transcript, the ratio of its probabilities is the product of conditional ratios, each between $\\lambda_t^{-1}$ and $\\lambda_t$. Multiplying gives the joint pointwise inequalities. Zero-probability transcripts occur under both cases and satisfy them as well. Summing proves the event inequalities. For a common postprocessing kernel, multiply each pointwise inequality by its nonnegative output probability and sum over input transcripts. This preserves both inequalities.\n\\end{proof}","Writing $\\lambda_t=e^{\\varepsilon_t}$ gives the additive parameter $\\sum_t\\varepsilon_t$. The proposition requires a fixed finite number of releases and uniform conditional bounds. A data-selected stopping rule must itself be represented in the transcript or controlled by an appropriate conditional argument. Privileged side information not covered by the declared record is not protected by a certificate for that record alone. The preceding counterexample fails the conditional premise at the second release, even though both unconditional marginals are identical.","A bounded allocation model makes the capacity obligation precise. Let $J$ be a finite set of admitted appeals and let the integer epochs be $1,\\ldots,T$. At epoch $t$, there are $c_t\\ge0$ reserved review slots after accounting for all other protected work. An appeal $j$ has an evidence-ready release epoch $r_j$ and deadline $d_j$, with $1\\le r_j\\le d_j\\le T$. It requires one slot containing the complete stipulated review and disposition operation. The evidence and qualified authorized reviewer are assumed available throughout that window. Larger or conditional workloads require a different job model.","\\begin{proposition}[Capacity for a finite appeal contract]\\label{prop:appeal-capacity}\nAll admitted appeals can be assigned to distinct review slots in their windows if and only if, for every subset $U\\subseteq J$,\n\\begin{equation}\\label{eq:appeal-hall}\n |U|\\le\\sum_{t\\in\\bigcup_{j\\in U}\\{r_j,\\ldots,d_j\\}}c_t.\n\\end{equation}\nEquivalently, because the windows are intervals, it suffices to check every integer interval $[a,b]\\subseteq[1,T]$:\n\\begin{equation}\\label{eq:appeal-interval}\n \\bigl|\\{j:r_j\\ge a,\\ d_j\\le b\\}\\bigr|\n       \\le\\sum_{t=a}^{b}c_t.\n\\end{equation}\n\\end{proposition}\n\\begin{proof}\nReplace epoch $t$ by $c_t$ distinct slot vertices and join appeal $j$ to the vertices in its window. An assignment is a matching covering the appeals. The matching criterion used in Theorem~\\ref{thm:robust-staffing}, equivalently Hall's theorem~\\cite{hall1935}, gives exactly~\\eqref{eq:appeal-hall}. Necessity of","\\begin{proposition}[Capacity for a finite appeal contract]\\label{prop:appeal-capacity}\nAll admitted appeals can be assigned to distinct review slots in their windows if and only if, for every subset $U\\subseteq J$,\n\\begin{equation}\\label{eq:appeal-hall}\n |U|\\le\\sum_{t\\in\\bigcup_{j\\in U}\\{r_j,\\ldots,d_j\\}}c_t.\n\\end{equation}\nEquivalently, because the windows are intervals, it suffices to check every integer interval $[a,b]\\subseteq[1,T]$:\n\\begin{equation}\\label{eq:appeal-interval}\n \\bigl|\\{j:r_j\\ge a,\\ d_j\\le b\\}\\bigr|\n       \\le\\sum_{t=a}^{b}c_t.\n\\end{equation}\n\\end{proposition}\n\\begin{proof}\nReplace epoch $t$ by $c_t$ distinct slot vertices and join appeal $j$ to the vertices in its window. An assignment is a matching covering the appeals. The matching criterion used in Theorem~\\ref{thm:robust-staffing}, equivalently Hall's theorem~\\cite{hall1935}, gives exactly~\\eqref{eq:appeal-hall}. Necessity of~\\eqref{eq:appeal-interval} follows because every appeal counted on its left must use a slot in $[a","Capacity for a finite appeal contract]\\label{prop:appeal-capacity}\nAll admitted appeals can be assigned to distinct review slots in their windows if and only if, for every subset $U\\subseteq J$,\n\\begin{equation}\\label{eq:appeal-hall}\n |U|\\le\\sum_{t\\in\\bigcup_{j\\in U}\\{r_j,\\ldots,d_j\\}}c_t.\n\\end{equation}\nEquivalently, because the windows are intervals, it suffices to check every integer interval $[a,b]\\subseteq[1,T]$:\n\\begin{equation}\\label{eq:appeal-interval}\n \\bigl|\\{j:r_j\\ge a,\\ d_j\\le b\\}\\bigr|\n       \\le\\sum_{t=a}^{b}c_t.\n\\end{equation}\n\\end{proposition}\n\\begin{proof}\nReplace epoch $t$ by $c_t$ distinct slot vertices and join appeal $j$ to the vertices in its window. An assignment is a matching covering the appeals. The matching criterion used in Theorem~\\ref{thm:robust-staffing}, equivalently Hall's theorem~\\cite{hall1935}, gives exactly~\\eqref{eq:appeal-hall}. Necessity of~\\eqref{eq:appeal-interval} follows because every appeal counted on its left must use a slot in $[a,b]$.","\\label{prop:appeal-capacity}\nAll admitted appeals can be assigned to distinct review slots in their windows if and only if, for every subset $U\\subseteq J$,\n\\begin{equation}\\label{eq:appeal-hall}\n |U|\\le\\sum_{t\\in\\bigcup_{j\\in U}\\{r_j,\\ldots,d_j\\}}c_t.\n\\end{equation}\nEquivalently, because the windows are intervals, it suffices to check every integer interval $[a,b]\\subseteq[1,T]$:\n\\begin{equation}\\label{eq:appeal-interval}\n \\bigl|\\{j:r_j\\ge a,\\ d_j\\le b\\}\\bigr|\n       \\le\\sum_{t=a}^{b}c_t.\n\\end{equation}\n\\end{proposition}\n\\begin{proof}\nReplace epoch $t$ by $c_t$ distinct slot vertices and join appeal $j$ to the vertices in its window. An assignment is a matching covering the appeals. The matching criterion used in Theorem~\\ref{thm:robust-staffing}, equivalently Hall's theorem~\\cite{hall1935}, gives exactly~\\eqref{eq:appeal-hall}. Necessity of~\\eqref{eq:appeal-interval} follows because every appeal counted on its left must use a slot in $[a,b]$.","\\begin{equation}\\label{eq:appeal-hall}\n |U|\\le\\sum_{t\\in\\bigcup_{j\\in U}\\{r_j,\\ldots,d_j\\}}c_t.\n\\end{equation}\nEquivalently, because the windows are intervals, it suffices to check every integer interval $[a,b]\\subseteq[1,T]$:\n\\begin{equation}\\label{eq:appeal-interval}\n \\bigl|\\{j:r_j\\ge a,\\ d_j\\le b\\}\\bigr|\n       \\le\\sum_{t=a}^{b}c_t.\n\\end{equation}\n\\end{proposition}\n\\begin{proof}\nReplace epoch $t$ by $c_t$ distinct slot vertices and join appeal $j$ to the vertices in its window. An assignment is a matching covering the appeals. The matching criterion used in Theorem~\\ref{thm:robust-staffing}, equivalently Hall's theorem~\\cite{hall1935}, gives exactly~\\eqref{eq:appeal-hall}. Necessity of~\\eqref{eq:appeal-interval} follows because every appeal counted on its left must use a slot in $[a,b]$.","equation}\\label{eq:appeal-hall}\n |U|\\le\\sum_{t\\in\\bigcup_{j\\in U}\\{r_j,\\ldots,d_j\\}}c_t.\n\\end{equation}\nEquivalently, because the windows are intervals, it suffices to check every integer interval $[a,b]\\subseteq[1,T]$:\n\\begin{equation}\\label{eq:appeal-interval}\n \\bigl|\\{j:r_j\\ge a,\\ d_j\\le b\\}\\bigr|\n       \\le\\sum_{t=a}^{b}c_t.\n\\end{equation}\n\\end{proposition}\n\\begin{proof}\nReplace epoch $t$ by $c_t$ distinct slot vertices and join appeal $j$ to the vertices in its window. An assignment is a matching covering the appeals. The matching criterion used in Theorem~\\ref{thm:robust-staffing}, equivalently Hall's theorem~\\cite{hall1935}, gives exactly~\\eqref{eq:appeal-hall}. Necessity of~\\eqref{eq:appeal-interval} follows because every appeal counted on its left must use a slot in $[a,b]$.","t\\in\\bigcup_{j\\in U}\\{r_j,\\ldots,d_j\\}}c_t.\n\\end{equation}\nEquivalently, because the windows are intervals, it suffices to check every integer interval $[a,b]\\subseteq[1,T]$:\n\\begin{equation}\\label{eq:appeal-interval}\n \\bigl|\\{j:r_j\\ge a,\\ d_j\\le b\\}\\bigr|\n       \\le\\sum_{t=a}^{b}c_t.\n\\end{equation}\n\\end{proposition}\n\\begin{proof}\nReplace epoch $t$ by $c_t$ distinct slot vertices and join appeal $j$ to the vertices in its window. An assignment is a matching covering the appeals. The matching criterion used in Theorem~\\ref{thm:robust-staffing}, equivalently Hall's theorem~\\cite{hall1935}, gives exactly~\\eqref{eq:appeal-hall}. Necessity of~\\eqref{eq:appeal-interval} follows because every appeal counted on its left must use a slot in $[a,b]$.","poch $t$ by $c_t$ distinct slot vertices and join appeal $j$ to the vertices in its window. An assignment is a matching covering the appeals. The matching criterion used in Theorem~\\ref{thm:robust-staffing}, equivalently Hall's theorem~\\cite{hall1935}, gives exactly~\\eqref{eq:appeal-hall}. Necessity of~\\eqref{eq:appeal-interval} follows because every appeal counted on its left must use a slot in $[a,b]$.","For sufficiency of the interval tests, fix $U$. Its union of integer windows decomposes into disjoint maximal integer intervals $C_1,\\ldots,C_k$. Each window is contained in one component because it is an interval. The number of appeals from $U$ in $C_i$ is no larger than the number of all appeals whose entire windows lie in $C_i$. By~\\eqref{eq:appeal-interval}, this is at most the total capacity in $C_i$. Summing over the disjoint components proves~\\eqref{eq:appeal-hall}, and hence the matching exists.\n\\end{proof}","sufficiency of the interval tests, fix $U$. Its union of integer windows decomposes into disjoint maximal integer intervals $C_1,\\ldots,C_k$. Each window is contained in one component because it is an interval. The number of appeals from $U$ in $C_i$ is no larger than the number of all appeals whose entire windows lie in $C_i$. By~\\eqref{eq:appeal-interval}, this is at most the total capacity in $C_i$. Summing over the disjoint components proves~\\eqref{eq:appeal-hall}, and hence the matching exists.\n\\end{proof}","The statement is an application of the same matching foundation as resilient staffing, not a separate scheduling discovery. Its role is to include an appeal promise in the common resource contract. Two appeals both due at epoch 1 cannot be served with capacities $(1,1)$ over epochs 1 and 2, even though total capacity equals total demand. The interval $[1,1]$ supplies the obstruction. Moving a deadline requires the relevant authorization and changes the original promise.","Let $G_{\\rm suspend}$ require that the declared external capabilities are inactive and that the pending-claim record remains available. Let $G_{\\rm settle}$ additionally require that every covered claim has been fulfilled, discharged under the stipulated authority, or transferred to an authorized successor that has accepted it, and that the required final record has been committed. A retained unresolved claim can be compatible with suspension but not with this stronger settlement target. Neither target by itself settles legal status, moral status, or ownership outside the stipulated contract.","The finite construction of Section~\\ref{sec:joint-synthesis} yields an exact characterization of \\emph{continued operation with an available authorized ending}. Use its possibility space $\\mathcal B$, successor operation, and protected set $S_{\\rm safe}$. For each possibility set $B$, distinguish implemented running profiles $A_{\\rm run}(B)$ from implemented ending profiles $A_{\\rm end}(B)$. Both must be admissible in every state in $B$. Ending profiles cannot accept new obligations outside the declared settlement protocol. Let $G\\subseteq S_{\\rm safe}$ be the chosen ending target, with an authorized safe hold profile available after certified arrival. A stop command is assumed authenticated and publicly available before the next profile is selected. Any command-delivery delay must be included in the model rather than omitted from the response time.","f{sec:joint-synthesis} yields an exact characterization of \\emph{continued operation with an available authorized ending}. Use its possibility space $\\mathcal B$, successor operation, and protected set $S_{\\rm safe}$. For each possibility set $B$, distinguish implemented running profiles $A_{\\rm run}(B)$ from implemented ending profiles $A_{\\rm end}(B)$. Both must be admissible in every state in $B$. Ending profiles cannot accept new obligations outside the declared settlement protocol. Let $G\\subseteq S_{\\rm safe}$ be the chosen ending target, with an authorized safe hold profile available after certified arrival. A stop command is assumed authenticated and publicly available before the next profile is selected. Any command-delivery delay must be included in the model rather than omitted from the response time.","lable authorized ending}. Use its possibility space $\\mathcal B$, successor operation, and protected set $S_{\\rm safe}$. For each possibility set $B$, distinguish implemented running profiles $A_{\\rm run}(B)$ from implemented ending profiles $A_{\\rm end}(B)$. Both must be admissible in every state in $B$. Ending profiles cannot accept new obligations outside the declared settlement protocol. Let $G\\subseteq S_{\\rm safe}$ be the chosen ending target, with an authorized safe hold profile available after certified arrival. A stop command is assumed authenticated and publicly available before the next profile is selected. Any command-delivery delay must be included in the model rather than omitted from the response time.","Define\n\\begin{align}\n T_0&=\\{B\\in\\mathcal B:B\\subseteq G\\},\\label{eq:stop-target}\\\\\n T_{k+1}&=T_k\\cup\\{B\\in\\mathcal B:B\\subseteq S_{\\rm safe},\\\n      \\exists u\\in A_{\\rm end}(B),\\ \\operatorname{Succ}(B,u)\\subseteq T_k\\}.\n      \\label{eq:stop-attractor}\n\\end{align}\nLet $T_*$ be the stable set and $r_{\\rm end}(B)$ the first entry index. Then define\n\\begin{equation}\\label{eq:stoppable-kernel}\n L_0=T_*,\\qquad\n L_{k+1}=\\{B\\in T_*:\\exists u\\in A_{\\rm run}(B),\\\n                         \\operatorname{Succ}(B,u)\\subseteq L_k\\},\n\\end{equation}\nwith stable set $L_*$. These are finite constructions with the same potentially exponential possibility space as before.","T_{k+1}&=T_k\\cup\\{B\\in\\mathcal B:B\\subseteq S_{\\rm safe},\\\n      \\exists u\\in A_{\\rm end}(B),\\ \\operatorname{Succ}(B,u)\\subseteq T_k\\}.\n      \\label{eq:stop-attractor}\n\\end{align}\nLet $T_*$ be the stable set and $r_{\\rm end}(B)$ the first entry index. Then define\n\\begin{equation}\\label{eq:stoppable-kernel}\n L_0=T_*,\\qquad\n L_{k+1}=\\{B\\in T_*:\\exists u\\in A_{\\rm run}(B),\\\n                         \\operatorname{Succ}(B,u)\\subseteq L_k\\},\n\\end{equation}\nwith stable set $L_*$. These are finite constructions with the same potentially exponential possibility space as before.","u\\in A_{\\rm end}(B),\\ \\operatorname{Succ}(B,u)\\subseteq T_k\\}.\n      \\label{eq:stop-attractor}\n\\end{align}\nLet $T_*$ be the stable set and $r_{\\rm end}(B)$ the first entry index. Then define\n\\begin{equation}\\label{eq:stoppable-kernel}\n L_0=T_*,\\qquad\n L_{k+1}=\\{B\\in T_*:\\exists u\\in A_{\\rm run}(B),\\\n                         \\operatorname{Succ}(B,u)\\subseteq L_k\\},\n\\end{equation}\nwith stable set $L_*$. These are finite constructions with the same potentially exponential possibility space as before.","\\begin{theorem}[Continued operation with an available authorized ending]\\label{thm:stoppable-operation}\nAn initial possibility set $B$ lies in $L_*$ if and only if an admissible common-history policy can operate safely for an unbounded number of epochs when no stop command arrives, while ensuring certified arrival in $G$ on every path after a stop command received at any decision epoch. Before a command, a policy stationary in $B$ and preserving $L_*$ suffices. After a command at $B$, an ending policy reaches $G$ within $r_{\\rm end}(B)$ transitions. When $L_*\\ne\\varnothing$, these response bounds have a finite maximum over $L_*$.\n\\end{theorem}\n\\begin{proof}\nInduction in~\\eqref{eq:stop-attractor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while re","\\begin{theorem}[Continued operation with an available authorized ending]\\label{thm:stoppable-operation}\nAn initial possibility set $B$ lies in $L_*$ if and only if an admissible common-history policy can operate safely for an unbounded number of epochs when no stop command arrives, while ensuring certified arrival in $G$ on every path after a stop command received at any decision epoch. Before a command, a policy stationary in $B$ and preserving $L_*$ suffices. After a command at $B$, an ending policy reaches $G$ within $r_{\\rm end}(B)$ transitions. When $L_*\\ne\\varnothing$, these response bounds have a finite maximum over $L_*$.\n\\end{theorem}\n\\begin{proof}\nInduction in~\\eqref{eq:stop-attractor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while remaining safe.","\\begin{theorem}[Continued operation with an available authorized ending]\\label{thm:stoppable-operation}\nAn initial possibility set $B$ lies in $L_*$ if and only if an admissible common-history policy can operate safely for an unbounded number of epochs when no stop command arrives, while ensuring certified arrival in $G$ on every path after a stop command received at any decision epoch. Before a command, a policy stationary in $B$ and preserving $L_*$ suffices. After a command at $B$, an ending policy reaches $G$ within $r_{\\rm end}(B)$ transitions. When $L_*\\ne\\varnothing$, these response bounds have a finite maximum over $L_*$.\n\\end{theorem}\n\\begin{proof}\nInduction in~\\eqref{eq:stop-attractor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while remaining safe. The target has a safe hold action. In a finite, finitely branching model, eventual certified arrival on every path implies some finite bound for a fixed initial set, by the s","ion with an available authorized ending]\\label{thm:stoppable-operation}\nAn initial possibility set $B$ lies in $L_*$ if and only if an admissible common-history policy can operate safely for an unbounded number of epochs when no stop command arrives, while ensuring certified arrival in $G$ on every path after a stop command received at any decision epoch. Before a command, a policy stationary in $B$ and preserving $L_*$ suffices. After a command at $B$, an ending policy reaches $G$ within $r_{\\rm end}(B)$ transitions. When $L_*\\ne\\varnothing$, these response bounds have a finite maximum over $L_*$.\n\\end{theorem}\n\\begin{proof}\nInduction in~\\eqref{eq:stop-attractor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while remaining safe. The target has a safe hold action. In a finite, finitely branching model, eventual certified arrival on every path implies some finite bound for a fixed initial set, by the stopped-history-tree argument in Proposition~\\ref{prop:joint-progress}. Thus $T_*$ is exactly the set from which","le authorized ending]\\label{thm:stoppable-operation}\nAn initial possibility set $B$ lies in $L_*$ if and only if an admissible common-history policy can operate safely for an unbounded number of epochs when no stop command arrives, while ensuring certified arrival in $G$ on every path after a stop command received at any decision epoch. Before a command, a policy stationary in $B$ and preserving $L_*$ suffices. After a command at $B$, an ending policy reaches $G$ within $r_{\\rm end}(B)$ transitions. When $L_*\\ne\\varnothing$, these response bounds have a finite maximum over $L_*$.\n\\end{theorem}\n\\begin{proof}\nInduction in~\\eqref{eq:stop-attractor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while remaining safe. The target has a safe hold action. In a finite, finitely branching model, eventual certified arrival on every path implies some finite bound for a fixed initial set, by the stopped-history-tree argument in Proposition~\\ref{prop:joint-progress}. Thus $T_*$ is exactly the set from which the stipulated end…","ppable-operation}\nAn initial possibility set $B$ lies in $L_*$ if and only if an admissible common-history policy can operate safely for an unbounded number of epochs when no stop command arrives, while ensuring certified arrival in $G$ on every path after a stop command received at any decision epoch. Before a command, a policy stationary in $B$ and preserving $L_*$ suffices. After a command at $B$, an ending policy reaches $G$ within $r_{\\rm end}(B)$ transitions. When $L_*\\ne\\varnothing$, these response bounds have a finite maximum over $L_*$.\n\\end{theorem}\n\\begin{proof}\nInduction in~\\eqref{eq:stop-attractor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while remaining safe. The target has a safe hold action. In a finite, finitely branching model, eventual certified arrival on every path implies some finite bound for a fixed initial set, by the stopped-history-tree argument in Proposition~\\ref{prop:joint-progress}. Thus $T_*$ is exactly the set from which the stipulated ending is surely possible.","ossibility set $B$ lies in $L_*$ if and only if an admissible common-history policy can operate safely for an unbounded number of epochs when no stop command arrives, while ensuring certified arrival in $G$ on every path after a stop command received at any decision epoch. Before a command, a policy stationary in $B$ and preserving $L_*$ suffices. After a command at $B$, an ending policy reaches $G$ within $r_{\\rm end}(B)$ transitions. When $L_*\\ne\\varnothing$, these response bounds have a finite maximum over $L_*$.\n\\end{theorem}\n\\begin{proof}\nInduction in~\\eqref{eq:stop-attractor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while remaining safe. The target has a safe hold action. In a finite, finitely branching model, eventual certified arrival on every path implies some finite bound for a fixed initial set, by the stopped-history-tree argument in Proposition~\\ref{prop:joint-progress}. Thus $T_*$ is exactly the set from which the stipulated ending is surely possible.","set $B$ lies in $L_*$ if and only if an admissible common-history policy can operate safely for an unbounded number of epochs when no stop command arrives, while ensuring certified arrival in $G$ on every path after a stop command received at any decision epoch. Before a command, a policy stationary in $B$ and preserving $L_*$ suffices. After a command at $B$, an ending policy reaches $G$ within $r_{\\rm end}(B)$ transitions. When $L_*\\ne\\varnothing$, these response bounds have a finite maximum over $L_*$.\n\\end{theorem}\n\\begin{proof}\nInduction in~\\eqref{eq:stop-attractor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while remaining safe. The target has a safe hold action. In a finite, finitely branching model, eventual certified arrival on every path implies some finite bound for a fixed initial set, by the stopped-history-tree argument in Proposition~\\ref{prop:joint-progress}. Thus $T_*$ is exactly the set from which the stipulated ending is surely possible.","f an admissible common-history policy can operate safely for an unbounded number of epochs when no stop command arrives, while ensuring certified arrival in $G$ on every path after a stop command received at any decision epoch. Before a command, a policy stationary in $B$ and preserving $L_*$ suffices. After a command at $B$, an ending policy reaches $G$ within $r_{\\rm end}(B)$ transitions. When $L_*\\ne\\varnothing$, these response bounds have a finite maximum over $L_*$.\n\\end{theorem}\n\\begin{proof}\nInduction in~\\eqref{eq:stop-attractor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while remaining safe. The target has a safe hold action. In a finite, finitely branching model, eventual certified arrival on every path implies some finite bound for a fixed initial set, by the stopped-history-tree argument in Proposition~\\ref{prop:joint-progress}. Thus $T_*$ is exactly the set from which the stipulated ending is surely possible.","ded number of epochs when no stop command arrives, while ensuring certified arrival in $G$ on every path after a stop command received at any decision epoch. Before a command, a policy stationary in $B$ and preserving $L_*$ suffices. After a command at $B$, an ending policy reaches $G$ within $r_{\\rm end}(B)$ transitions. When $L_*\\ne\\varnothing$, these response bounds have a finite maximum over $L_*$.\n\\end{theorem}\n\\begin{proof}\nInduction in~\\eqref{eq:stop-attractor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while remaining safe. The target has a safe hold action. In a finite, finitely branching model, eventual certified arrival on every path implies some finite bound for a fixed initial set, by the stopped-history-tree argument in Proposition~\\ref{prop:joint-progress}. Thus $T_*$ is exactly the set from which the stipulated ending is surely possible.","n $G$ on every path after a stop command received at any decision epoch. Before a command, a policy stationary in $B$ and preserving $L_*$ suffices. After a command at $B$, an ending policy reaches $G$ within $r_{\\rm end}(B)$ transitions. When $L_*\\ne\\varnothing$, these response bounds have a finite maximum over $L_*$.\n\\end{theorem}\n\\begin{proof}\nInduction in~\\eqref{eq:stop-attractor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while remaining safe. The target has a safe hold action. In a finite, finitely branching model, eventual certified arrival on every path implies some finite bound for a fixed initial set, by the stopped-history-tree argument in Proposition~\\ref{prop:joint-progress}. Thus $T_*$ is exactly the set from which the stipulated ending is surely possible.","e a command, a policy stationary in $B$ and preserving $L_*$ suffices. After a command at $B$, an ending policy reaches $G$ within $r_{\\rm end}(B)$ transitions. When $L_*\\ne\\varnothing$, these response bounds have a finite maximum over $L_*$.\n\\end{theorem}\n\\begin{proof}\nInduction in~\\eqref{eq:stop-attractor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while remaining safe. The target has a safe hold action. In a finite, finitely branching model, eventual certified arrival on every path implies some finite bound for a fixed initial set, by the stopped-history-tree argument in Proposition~\\ref{prop:joint-progress}. Thus $T_*$ is exactly the set from which the stipulated ending is surely possible.","policy stationary in $B$ and preserving $L_*$ suffices. After a command at $B$, an ending policy reaches $G$ within $r_{\\rm end}(B)$ transitions. When $L_*\\ne\\varnothing$, these response bounds have a finite maximum over $L_*$.\n\\end{theorem}\n\\begin{proof}\nInduction in~\\eqref{eq:stop-attractor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while remaining safe. The target has a safe hold action. In a finite, finitely branching model, eventual certified arrival on every path implies some finite bound for a fixed initial set, by the stopped-history-tree argument in Proposition~\\ref{prop:joint-progress}. Thus $T_*$ is exactly the set from which the stipulated ending is surely possible.","actor} shows that $T_k$ is exactly the set from which an ending-only policy can reach certified $G$ in at most $k$ transitions while remaining safe. The target has a safe hold action. In a finite, finitely branching model, eventual certified arrival on every path implies some finite bound for a fixed initial set, by the stopped-history-tree argument in Proposition~\\ref{prop:joint-progress}. Thus $T_*$ is exactly the set from which the stipulated ending is surely possible.","The sequence in~\\eqref{eq:stoppable-kernel} is decreasing and stabilizes. From $L_*$, choose a running profile whose every successor remains in $L_*$. If no command arrives, induction gives safe indefinite operation. If a command arrives, the current set is in $T_*$ and an ending profile of strictly decreasing first-entry rank completes the ending. Finiteness gives the maximum rank over $L_*$.","Conversely, consider a successful policy. At each public history reachable before a command, a command could be issued immediately. The current possibility set must therefore lie in $T_*$. For every finite number of further running epochs, the policy keeps every resulting possibility set in $T_*$. Induction in~\\eqref{eq:stoppable-kernel} puts the initial set in every $L_k$, and hence in $L_*$. The choices are based on the common history, so no hidden-state action has been introduced.\n\\end{proof}","The theorem reuses the established safety and reachability machinery. Its additional requirement is that running actions preserve the \\emph{ability to end}, not only immediate safety. An institution can be safe now yet spend its last settlement resource on a new task, leaving no authorized ending from the resulting state. Such an action leaves $L_*$ even when it remains in the original continuation kernel. This is a realizability boundary, not an argument that an institution should refuse an externally authorized suspension because its preferred settlement plan is unavailable.","A five-state example separates the guarantees. From a running state $r$, a work action enters state $d$ with one unpaid obligation. From $d$, one more work action enters $\\ell$, where the institution can idle safely but no longer has resources to settle. A return action from $d$ restores $r$. An ending action from either $r$ or $d$ reaches a closed state $z$. A breach state $b$ represents inadmissible failed closure attempts. The ordinary safe kernel includes $\\ell$, but the ending attractor and $L_*$ exclude it. A policy can continue alternating between $r$ and $d$ and still answer an authorized stop at either state. It cannot offer that guarantee after entering $\\ell$.","te $r$, a work action enters state $d$ with one unpaid obligation. From $d$, one more work action enters $\\ell$, where the institution can idle safely but no longer has resources to settle. A return action from $d$ restores $r$. An ending action from either $r$ or $d$ reaches a closed state $z$. A breach state $b$ represents inadmissible failed closure attempts. The ordinary safe kernel includes $\\ell$, but the ending attractor and $L_*$ exclude it. A policy can continue alternating between $r$ and $d$ and still answer an authorized stop at either state. It cannot offer that guarantee after entering $\\ell$.","$ with one unpaid obligation. From $d$, one more work action enters $\\ell$, where the institution can idle safely but no longer has resources to settle. A return action from $d$ restores $r$. An ending action from either $r$ or $d$ reaches a closed state $z$. A breach state $b$ represents inadmissible failed closure attempts. The ordinary safe kernel includes $\\ell$, but the ending attractor and $L_*$ exclude it. A policy can continue alternating between $r$ and $d$ and still answer an authorized stop at either state. It cannot offer that guarantee after entering $\\ell$.","enters $\\ell$, where the institution can idle safely but no longer has resources to settle. A return action from $d$ restores $r$. An ending action from either $r$ or $d$ reaches a closed state $z$. A breach state $b$ represents inadmissible failed closure attempts. The ordinary safe kernel includes $\\ell$, but the ending attractor and $L_*$ exclude it. A policy can continue alternating between $r$ and $d$ and still answer an authorized stop at either state. It cannot offer that guarantee after entering $\\ell$.","$\\ell$, where the institution can idle safely but no longer has resources to settle. A return action from $d$ restores $r$. An ending action from either $r$ or $d$ reaches a closed state $z$. A breach state $b$ represents inadmissible failed closure attempts. The ordinary safe kernel includes $\\ell$, but the ending attractor and $L_*$ exclude it. A policy can continue alternating between $r$ and $d$ and still answer an authorized stop at either state. It cannot offer that guarantee after entering $\\ell$.","om $d$ restores $r$. An ending action from either $r$ or $d$ reaches a closed state $z$. A breach state $b$ represents inadmissible failed closure attempts. The ordinary safe kernel includes $\\ell$, but the ending attractor and $L_*$ exclude it. A policy can continue alternating between $r$ and $d$ and still answer an authorized stop at either state. It cannot offer that guarantee after entering $\\ell$.","A proof of $A\\Rightarrow G$ does not become false when its premise ceases to hold. Its application to the current institution may nevertheless become invalid. Changes to an observation channel, reviewer, capacity, membership configuration, trusted key, or action semantics can move the realization outside the certificate's domain. A checksum can identify which artifact changed. It cannot, by itself, decide whether the new world satisfies a semantic premise.","An assurance record can contain\n\\[\n\\mathcal K=(\\mathsf{Claim},\\mathsf{Assumptions},\\mathsf{Evidence},\n\\mathsf{Domain},\\mathsf{Guard},\\mathsf{Fallback},\\mathsf{Revision}).\n\\]\nIts status should distinguish at least an applicable certificate, a certificate awaiting rechecking, a suspended claim, and a superseded version. Evidence for an assumption can be observed, externally attested under a trust model, proved about a component, or unavailable. Those statuses should not all become the Boolean value \\emph{verified}. A failed guard means that continued reliance is not justified by that check. It need not mean that the guarantee is already false.","For a finite set of modes $V$, let $C_v\\subseteq Z$ be a certified state domain, with each $C_v$ contained in a common protected set $C$. A certified hold exists when a final state requires indefinite preservation. At $(v,z)$ with $z\\in C_v$, a selector may either use the local policy $\\kappa_v$ or execute an authorized handover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$.","For a finite set of modes $V$, let $C_v\\subseteq Z$ be a certified state domain, with each $C_v$ contained in a common protected set $C$. A certified hold exists when a final state requires indefinite preservation. At $(v,z)$ with $z\\in C_v$, a selector may either use the local policy $\\kappa_v$ or execute an authorized handover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$. Its command, evidence","For a finite set of modes $V$, let $C_v\\subseteq Z$ be a certified state domain, with each $C_v$ contained in a common protected set $C$. A certified hold exists when a final state requires indefinite preservation. At $(v,z)$ with $z\\in C_v$, a selector may either use the local policy $\\kappa_v$ or execute an authorized handover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$. Its command, evidence transfer, resources, and delay belong to the","For a finite set of modes $V$, let $C_v\\subseteq Z$ be a certified state domain, with each $C_v$ contained in a common protected set $C$. A certified hold exists when a final state requires indefinite preservation. At $(v,z)$ with $z\\in C_v$, a selector may either use the local policy $\\kappa_v$ or execute an authorized handover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$. Its command, evidence transfer, resources, and delay belong to the transition model. Intermediate handover","For a finite set of modes $V$, let $C_v\\subseteq Z$ be a certified state domain, with each $C_v$ contained in a common protected set $C$. A certified hold exists when a final state requires indefinite preservation. At $(v,z)$ with $z\\in C_v$, a selector may either use the local policy $\\kappa_v$ or execute an authorized handover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$. Its command, evidence transfer, resources, and delay belong to the transition model. Intermediate handover and checking states carry explicit mode tags when they count as primitive transitions, s","For a finite set of modes $V$, let $C_v\\subseteq Z$ be a certified state domain, with each $C_v$ contained in a common protected set $C$. A certified hold exists when a final state requires indefinite preservation. At $(v,z)$ with $z\\in C_v$, a selector may either use the local policy $\\kappa_v$ or execute an authorized handover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$. Its command, evidence transfer, resources, and delay belong to the transition model. Intermediate handover and checking states carry explicit mode tags when they count as primitive transitions, so the shared ran","For a finite set of modes $V$, let $C_v\\subseteq Z$ be a certified state domain, with each $C_v$ contained in a common protected set $C$. A certified hold exists when a final state requires indefinite preservation. At $(v,z)$ with $z\\in C_v$, a selector may either use the local policy $\\kappa_v$ or execute an authorized handover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$. Its command, evidence transfer, resources, and delay belong to the transition model. Intermediate handover and checking states carry explicit mode tags when they count as primitive transitions, so the shared rank below is defined on those states as well.","$C$. A certified hold exists when a final state requires indefinite preservation. At $(v,z)$ with $z\\in C_v$, a selector may either use the local policy $\\kappa_v$ or execute an authorized handover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$. Its command, evidence transfer, resources, and delay belong to the transition model. Intermediate handover and checking states carry explicit mode tags when they count as primitive transitions, so the shared rank below is defined on those states as well.","requires indefinite preservation. At $(v,z)$ with $z\\in C_v$, a selector may either use the local policy $\\kappa_v$ or execute an authorized handover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$. Its command, evidence transfer, resources, and delay belong to the transition model. Intermediate handover and checking states carry explicit mode tags when they count as primitive transitions, so the shared rank below is defined on those states as well.","v,z)$ with $z\\in C_v$, a selector may either use the local policy $\\kappa_v$ or execute an authorized handover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$. Its command, evidence transfer, resources, and delay belong to the transition model. Intermediate handover and checking states carry explicit mode tags when they count as primitive transitions, so the shared rank below is defined on those states as well.","ither use the local policy $\\kappa_v$ or execute an authorized handover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$. Its command, evidence transfer, resources, and delay belong to the transition model. Intermediate handover and checking states carry explicit mode tags when they count as primitive transitions, so the shared rank below is defined on those states as well.","se the local policy $\\kappa_v$ or execute an authorized handover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$. Its command, evidence transfer, resources, and delay belong to the transition model. Intermediate handover and checking states carry explicit mode tags when they count as primitive transitions, so the shared rank below is defined on those states as well.","an authorized handover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$. Its command, evidence transfer, resources, and delay belong to the transition model. Intermediate handover and checking states carry explicit mode tags when they count as primitive transitions, so the shared rank below is defined on those states as well.","andover to another mode. The selector and guard can read only their declared observations. A positive local guard must be sound for the \\emph{whole action interval}: it entails that every actual successor of $\\kappa_v(z)$ lies in the declared successor set $D_v(z)$. The local certificate proves $D_v(z)\\subseteq C_v$. A handover from $v$ to $w$ must keep every intermediate state in $C$ and end in $C_w$. Its command, evidence transfer, resources, and delay belong to the transition model. Intermediate handover and checking states carry explicit mode tags when they count as primitive transitions, so the shared rank below is defined on those states as well.","\\begin{theorem}[Guarded certificate use and authorized handover]\\label{thm:guarded-certificates}\nAssume that the selector, at every reachable decision epoch, either uses a local policy with a sound positive guard or performs a handover satisfying the preceding conditions. Starting from $z_0\\in C_{v_0}$, every decision state belongs to its current certified domain and every intermediate handover state remains in $C$.","Guarded certificate use and authorized handover]\\label{thm:guarded-certificates}\nAssume that the selector, at every reachable decision epoch, either uses a local policy with a sound positive guard or performs a handover satisfying the preceding conditions. Starting from $z_0\\in C_{v_0}$, every decision state belongs to its current certified domain and every intermediate handover state remains in $C$.","If a target has an appropriate certified hold and one shared map $r:(v,z)\\mapsto\\mathbb N$ satisfies $r(v,z)=0$ only at the target, and every selected primitive transition before the first target visit strictly decreases $r$, then the target is reached within at most $r(v_0,z_0)$ primitive transitions. Handover, checking, and waiting steps count whenever they consume transitions in the promised time model.\n\\end{theorem}\n\\begin{proof}\nAt a local-policy step, guard soundness puts every actual successor in $D_v(z)$ and the local certificate puts it in $C_v\\subseteq C$. At a handover, the stated trajectory and endpoint conditions preserve $C$ and establish membership in the new domain. Induction proves the safety assertion. Before a target visit, strict decrease of a nonnegative int","If a target has an appropriate certified hold and one shared map $r:(v,z)\\mapsto\\mathbb N$ satisfies $r(v,z)=0$ only at the target, and every selected primitive transition before the first target visit strictly decreases $r$, then the target is reached within at most $r(v_0,z_0)$ primitive transitions. Handover, checking, and waiting steps count whenever they consume transitions in the promised time model.\n\\end{theorem}\n\\begin{proof}\nAt a local-policy step, guard soundness puts every actual successor in $D_v(z)$ and the local certificate puts it in $C_v\\subseteq C$. At a handover, the stated trajectory and endpoint conditions preserve $C$ and establish membership in the new domain. Induction proves the safety assertion. Before a target visit, strict decrease of a nonnegative integer permits at most","If a target has an appropriate certified hold and one shared map $r:(v,z)\\mapsto\\mathbb N$ satisfies $r(v,z)=0$ only at the target, and every selected primitive transition before the first target visit strictly decreases $r$, then the target is reached within at most $r(v_0,z_0)$ primitive transitions. Handover, checking, and waiting steps count whenever they consume transitions in the promised time model.\n\\end{theorem}\n\\begin{proof}\nAt a local-policy step, guard soundness puts every actual successor in $D_v(z)$ and the local certificate puts it in $C_v\\subseteq C$. At a handover, the stated trajectory and endpoint conditions preserve $C$ and establish membership in the new domain. Induction proves the safety assertion. Before a target visit, strict decrease of a nonnegative integer permits at most the stated number of primitive transitions. If the target had not then been visited, another selected transition","If a target has an appropriate certified hold and one shared map $r:(v,z)\\mapsto\\mathbb N$ satisfies $r(v,z)=0$ only at the target, and every selected primitive transition before the first target visit strictly decreases $r$, then the target is reached within at most $r(v_0,z_0)$ primitive transitions. Handover, checking, and waiting steps count whenever they consume transitions in the promised time model.\n\\end{theorem}\n\\begin{proof}\nAt a local-policy step, guard soundness puts every actual successor in $D_v(z)$ and the local certificate puts it in $C_v\\subseteq C$. At a handover, the stated trajectory and endpoint conditions preserve $C$ and establish membership in the new domain. Induction proves the safety assertion. Before a target visit, strict decrease of a nonnegative integer permits at most the stated number of primitive transitions. If the target had not then been visited, another selected transition would require a negative rank. Existence of the selected","$ only at the target, and every selected primitive transition before the first target visit strictly decreases $r$, then the target is reached within at most $r(v_0,z_0)$ primitive transitions. Handover, checking, and waiting steps count whenever they consume transitions in the promised time model.\n\\end{theorem}\n\\begin{proof}\nAt a local-policy step, guard soundness puts every actual successor in $D_v(z)$ and the local certificate puts it in $C_v\\subseteq C$. At a handover, the stated trajectory and endpoint conditions preserve $C$ and establish membership in the new domain. Induction proves the safety assertion. Before a target visit, strict decrease of a nonnegative integer permits at most the stated number of primitive transitions. If the target had not then been visited, another selected transition would require a negative rank. Existence of the selected steps and the certified target hold complete the argument.\n\\end{proof}","tive transition before the first target visit strictly decreases $r$, then the target is reached within at most $r(v_0,z_0)$ primitive transitions. Handover, checking, and waiting steps count whenever they consume transitions in the promised time model.\n\\end{theorem}\n\\begin{proof}\nAt a local-policy step, guard soundness puts every actual successor in $D_v(z)$ and the local certificate puts it in $C_v\\subseteq C$. At a handover, the stated trajectory and endpoint conditions preserve $C$ and establish membership in the new domain. Induction proves the safety assertion. Before a target visit, strict decrease of a nonnegative integer permits at most the stated number of primitive transitions. If the target had not then been visited, another selected transition would require a negative rank. Existence of the selected steps and the certified target hold complete the argument.\n\\end{proof}","reached within at most $r(v_0,z_0)$ primitive transitions. Handover, checking, and waiting steps count whenever they consume transitions in the promised time model.\n\\end{theorem}\n\\begin{proof}\nAt a local-policy step, guard soundness puts every actual successor in $D_v(z)$ and the local certificate puts it in $C_v\\subseteq C$. At a handover, the stated trajectory and endpoint conditions preserve $C$ and establish membership in the new domain. Induction proves the safety assertion. Before a target visit, strict decrease of a nonnegative integer permits at most the stated number of primitive transitions. If the target had not then been visited, another selected transition would require a negative rank. Existence of the selected steps and the certified target hold complete the argument.\n\\end{proof}","\\begin{counterexample}[A correct old certificate used after an unobserved change]\\label{ex:stale-certificate}\nAt time $0$, an action requires one execution slot and the certified capacity is one. Before the action is issued, an external event reduces the actual capacity to zero. A guard that merely reads the unchanged old capacity record remains positive. Executing the action violates the actual resource condition even though the original theorem and stored proof remain valid under their original premise. The guard was not sound for the action interval.\n\\end{counterexample}","\\begin{counterexample}[Local progress ranks do not compose through arbitrary switching]\\label{ex:switching-rank}\nModes $a$ and $b$ each have a local path of ranks $2,1,0$ to completion. Permit a handover from rank 1 of either mode to rank 2 of the other. Alternating one local progress step and one handover yields an infinite safe path with no completion. Every local progress step decreases its own rank. There is no shared strictly decreasing rank for the selected handovers.\n\\end{counterexample}","Suppose institution $A$ claims that it is sound whenever $B$ is sound, and $B$ claims the converse. The two implications are compatible with both institutions being unsound. They are not an initial proof that either premise holds. This elementary point does not invalidate properly justified circular assume-guarantee rules. Such rules need their actual semantic and temporal hypotheses, not merely the printed appearance of mutual certification.","ded variant combines the requirements without inheriting incompatible assumptions from earlier examples. Start with three internal service units due, one unit reserved for an outside claimant, one admitted appeal whose complete review and disposition require one unit, and a two-unit audit. Final recording and revocation of the named external capabilities require one more unit. The epoch provides $c$ sequentially usable units. No new claims are admitted after the authenticated closing command. All seven service and audit units must be completed before the final revocation step. The administrative operation is included in the budget rather than treated as free.","For this variant only, both covered reporting deviations have the same observation law $P_D=(1/4,3/4)$ and gain $1/3$, while compliance has law $P_C=(3/4,1/4)$. The two-unit audit is stipulated to produce those records. It is \\emph{not} the earlier three-outcome audit, whose supports do not satisfy this finite pairwise privacy bound. Set $\\lambda=3$, $\\alpha=1/10$, $F=2$, and $s=(0,2/5)$. The common monitor has false-positive rate $1/10$ and margin $1/15$ against each listed deviation. This remains an expected-utility incentive guarantee, not a reason to erase physical deviation paths from a safety model.","reporting deviations have the same observation law $P_D=(1/4,3/4)$ and gain $1/3$, while compliance has law $P_C=(3/4,1/4)$. The two-unit audit is stipulated to produce those records. It is \\emph{not} the earlier three-outcome audit, whose supports do not satisfy this finite pairwise privacy bound. Set $\\lambda=3$, $\\alpha=1/10$, $F=2$, and $s=(0,2/5)$. The common monitor has false-positive rate $1/10$ and margin $1/15$ against each listed deviation. This remains an expected-utility incentive guarantee, not a reason to erase physical deviation paths from a safety model.","ns have the same observation law $P_D=(1/4,3/4)$ and gain $1/3$, while compliance has law $P_C=(3/4,1/4)$. The two-unit audit is stipulated to produce those records. It is \\emph{not} the earlier three-outcome audit, whose supports do not satisfy this finite pairwise privacy bound. Set $\\lambda=3$, $\\alpha=1/10$, $F=2$, and $s=(0,2/5)$. The common monitor has false-positive rate $1/10$ and margin $1/15$ against each listed deviation. This remains an expected-utility incentive guarantee, not a reason to erase physical deviation paths from a safety model.","The audit provider receives a separate collectible fee $w$ for verified execution, with $w$ larger than its stipulated cost $c_a$. A genuine-execution receipt is checked by a specified trusted mechanism. The fee is not a reward for accusing someone. It makes execution preferable to skipping in this narrow two-action provider model. Monetary units are tracked separately from execution units. The payment budget, receipt checker, and record-generation law remain explicit assumptions. The perfect detector of Proposition~\\ref{prop:strategic-inspector} is not silently substituted for this noisy audit.","With $c=8$, the obligations and the final revocation fit. A countdown in remaining required work supplies a settlement rank, provided the prescribed information and authority are available and no modeled event creates further work. With $c=7$, the service, appeal, and audit can finish, but the complete settlement target cannot be certified because its final administrative operation is unfunded. A previously reserved suspension operation can deactivate external capability while leaving the remaining claim visible. That reaches a different target and is not recorded as full settlement.","The reference implementation uses five profiles with costs $2,3,1,1,1$: audit, batched internal service, external service, appeal, and final record with revocation. The final condition check is part of the last atomic administrative profile. A phase rank $5,4,3,2,1,0$ certifies five-transition completion from the admitted initial state. Separating a check into an additional transition would require changing that rank, even if its execution-unit cost were zero. No such uncounted step is assumed here.","A minimum frequency of contact may make convention formation likely under one interaction graph and not another. Longer time horizons can amortize setup costs but also lock in bad rules. More memory can preserve beneficial corrections or propagate obsolete assumptions. For the abstract stationary cost model in Proposition~\\ref{prop:amort}, the inequality $B<g/(1-\\delta)$ is a threshold for \\emph{economic usefulness of that particular institution}, not a general law for the appearance of societies. Evolution of institutions requires separate assumptions about rule variation, incentives, scheduling, authority, and selection.","midrule\\endhead\nCan an institution be adopted? & The coordination-game transition barrier is distinct from the fact that $R$ and $U$ have executable implementations. A profitable joint commitment requires an admitted commitment operation.","[.5em]\nWhat state must persist? & The allocation rule alone is insufficient. Governance preservation also retains the enabled amendment actions and labels for active credentials, service debt, and resource tokens.\\\\[.5em]\nCan a due debt be erased? & The obligation monitor distinguishes fulfillment, authorized discharge, and deletion. Amendments are required to preserve pending commitments.\\\\[.5em]\nWho can block change? & Two registered offices block a three-of-four rule under independent approval rights. A hidden administrator changes this calculation.\\\\[.5em]\nCan every request be safely served? & Resource conservation can hold even when private information or conflicting deadlines prevent timely service. Viability with full information is not decentralized implementability.\\\\[.5em]\nWhat crosses a replacement? & An authorized office handover preserves debt and credential semantics. Copying a model does not duplicate an office's budget or approval right.\\\\[.5em]\nCan two jurisdictions merge? & Their translator must preserve the agreed action semantics, permissions, obligations, resourc…","\\section{A finite algebraic example of reusable state}\\label{sec:worked}\nThe following analytical example makes the preceding distinctions concrete. Four components initially hold independent fair bits $(a,b,c,d)$. Two local workspaces expose\n\\[\np=a\\oplus b,\\qquad q=c\\oplus d,\n\\]\nand a global workspace retains $Z=(p,q)$. The current reported answer is $r=p\\oplus q$.","No proper subset of the four raw bits determines $r$: at least one independent fair bit is missing. Each local pair determines its own workspace bit but has zero information about $r$. Together the workspaces determine $r$ exactly. This is a precise distributed-access property for the initial distribution.","\\subsection{Why the current answer is not enough state}\nPermit three public operations on $Z$:\n\\[\nI(p,q)=(p,q),\\qquad W(p,q)=(q,p),\\qquad S(p,q)=(p\\oplus q,q).\n\\]\nThe global state supports these operations and the query $r$. The operations $W$ and $S$ do not commute. For instance, from $(p,q)=(1,0)$,\n\\[\nW(S(1,0))=(0,1),\\qquad S(W(1,0))=(1,1).\n\\]\nTheir reported parity outcomes are different.","By contrast, retaining only the current answer $r$ fails the quotient criterion. The states $(0,0)$ and $(1,1)$ both report $r=0$, but after $S$ they report $0$ and $1$, respectively. The missing distinction is exactly a distinction relevant to a future operation. A compressed answer is not necessarily a compressed process.","\\begin{center}\n\\begin{tabular}{@{}ccccc@{}}\n\\toprule\n$p$ & $q$ & Current $r$ & State after $S$ & New $r$","\\midrule\n0&0&0&$(0,0)$&0","0&1&1&$(1,1)$&0","1&0&1&$(1,0)$&1","1&1&0&$(0,1)$&1","The full two-bit state has four future-distinguishable possibilities: the current parity reveals $p\\oplus q$, and parity after $S$ reveals $p$. Together those outputs determine $q$ as well. Thus two bits are necessary for an exact reusable state under this query family, even though one bit suffices for the immediate answer.","\\subsection{A deterministic microscopic realization}\nFor any permitted macro-operation $T$, write $(p',q')=T(p,q)$ and define\n\\[\nF_T(a,b,c,d)=(a,\\ a\\oplus p',\\ c,\\ c\\oplus q').\n\\]\nThen the two local XORs of $F_T(a,b,c,d)$ are exactly $(p',q')$. Consequently $\\pi F_T=T\\pi$ for every microstate, where $\\pi(a,b,c,d)=(p,q)$.","This formula specifies a global transition for verification. A distributed implementation still needs communication to execute operations that mix $p$ and $q$. The formula alone does not prove locality, privacy against transcript observers, or the spontaneous discovery of a protocol. It shows exactly which macrostate the implementation realizes.","\\subsection{State loss depends on the access contract}\nSuppose the leaf bits become inaccessible after export and the only surviving pair-level records are $p$ and $q$. Erasing $q$ reduces the best prediction of $r$ to chance, $1/2$. Replacing it with a fixed bit has the same average accuracy. If the original leaves $c,d$ remain readable, however, the missing state can be reconstructed and accuracy returns to $1$.","ate loss depends on the access contract}\nSuppose the leaf bits become inaccessible after export and the only surviving pair-level records are $p$ and $q$. Erasing $q$ reduces the best prediction of $r$ to chance, $1/2$. Replacing it with a fixed bit has the same average accuracy. If the original leaves $c,d$ remain readable, however, the missing state can be reconstructed and accuracy returns to $1$."]}