Minimum Two-Field Validation Threshold: The Floor of Semantic Structure

Mechanism

Each agent declares, as part of its canonical schema, exactly two fields designated as state-transition controls. The fields must be of distinct semantic types as defined by the agent's schema registry, where "distinct" means that the two fields are not derived from the same upstream signal and do not share a common provenance node within a configurable depth of the lineage graph. This independence requirement is enforced at schema validation, not at runtime; an agent whose two control fields are derivable from one another is rejected before instantiation.

Each control field carries a threshold value and a hysteresis band. The threshold is the level at which the field is considered to have crossed; the hysteresis band is the symmetric or asymmetric interval around the threshold within which the field's crossing direction is held constant. A field's crossing direction is updated only when the observed value departs the band on the opposite side from the prior direction. While the value lies within the band, the prior crossing direction is retained.

A state transition is permitted only when both control fields are simultaneously in their post-threshold direction for the duration of the debounce interval. "Simultaneously" is evaluated against the agent's monotonic clock, and "for the duration" requires that both fields remain in the post-threshold direction throughout the interval, not merely at its endpoints. If either field returns to its pre-threshold direction at any point during the debounce, the interval restarts. The transition fires at the trailing edge of the debounce, not the leading edge, which means the system commits to a state change only after stable corroboration.

Once a transition fires, the agent enters a refractory period during which further transitions are suppressed regardless of field values. The refractory period is distinct from the debounce: debounce filters spurious entry to a state, and refractory filters spurious exit. Together, the two intervals define a minimum dwell time per state, which bounds the worst-case rate at which the agent may oscillate.

Hysteresis is computed independently per field and is asymmetric by default. The width of the band on the entering side of a transition may differ from the width on the exiting side; the asymmetry permits the agent to enter a state more readily than it exits, or vice versa, depending on the safety profile of the controlled behavior. Both widths are committed to the agent's schema and are not modifiable at runtime; modification requires schema revision and re-validation.

Every transition, every aborted debounce, and every refractory suppression is recorded in the agent's lineage chain. The record names the two control fields, their values at the moment of evaluation, the threshold and hysteresis parameters in effect, the debounce and refractory intervals, and the resulting state. The record is the artifact by which an auditor reconstructs the agent's trajectory through state space; it is not a log entry but a chain entry, ordered and immutable.

Operating Parameters

The two fields are required; one field is rejected at schema validation. Three or more fields are permitted as ancillary observations but only two may be designated as transition controls. The two-field minimum is the floor of semantic structure: a single observation cannot distinguish a real transition from sensor drift, and three or more observations introduce undecidable cases when the observations disagree.

The debounce interval is configured per state pair (entry to a target state from a source state) and ranges from one millisecond to ten seconds in the reference embodiment. The default is fifty milliseconds. Values outside the range are rejected at schema validation. The refractory period ranges from zero to sixty seconds with a default of two hundred milliseconds.

Hysteresis band widths are expressed as a fraction of the control field's dynamic range. The default is five percent on each side of the threshold; the permitted range is one half of one percent to twenty-five percent. Values below the lower bound are too narrow to suppress sensor noise; values above the upper bound merge adjacent thresholds and produce ambiguous state assignments.

The independence-depth parameter for control-field provenance defaults to three lineage hops. Two fields whose nearest common provenance ancestor lies within three hops are considered correlated and rejected. The parameter may be tightened to a deeper graph for safety-critical agents.

Threshold values may be static (committed in the schema), parametric (functions of declared agent state), or contextual (functions of declared environmental observations). In all cases the function must be deterministic and must be committed to the schema; runtime threshold modification is forbidden.

Alternative Embodiments

In a first alternative embodiment, the two control fields are continuous-valued and the threshold is a scalar; in a second, the fields are categorical and the threshold is a set membership predicate; in a third, the fields are vector-valued and the threshold is a half-space defined by a hyperplane in the field's vector space. The mechanism is indifferent to field representation so long as the threshold predicate is deterministic and the hysteresis band is well-defined.

The debounce may be embodied as a fixed interval, as an interval drawn from a configurable distribution to break synchrony among many agents, or as an adaptive interval that lengthens under high-load conditions. The hysteresis may be symmetric, asymmetric, or state-dependent, with the latter permitting different band widths for different predecessor states.

The refractory period may be embodied as a hard suppression that ignores all field values, or as a soft suppression that admits transitions only on a substantially stronger signal (for example, both fields exceeding their thresholds by more than three hysteresis widths). The soft variant permits the system to respond to genuine fast-onset events while still rejecting oscillation.

The two-field rule itself may be generalized to an N-of-M rule for agents requiring stronger corroboration; the disclosure contemplates two-of-three and three-of-five embodiments where M designated control fields are evaluated and N must cross to permit transition. The two-field minimum remains the floor for any embodiment.

Composition

The two-field threshold composes upward with the agent's policy evaluation layer: a state transition is the trigger that admits a policy evaluation, and the lineage record of the transition is an input to the policy. Policies cannot reach states that the threshold mechanism has not authorized; the threshold therefore acts as a structural gate on policy applicability.

Downward, the mechanism composes with the agent's observation pipeline. The two fields are populated by the pipeline's canonical observation channels, which are themselves subject to schema validation, integrity checks, and lineage commitment. A control field whose source observation has failed integrity validation is treated as below threshold by default, which means failed observations cannot drive transitions even spuriously.

Laterally, the mechanism composes with multi-agent coordination. When agents publish their state transitions to peers, the lineage record of each transition is sufficient for peers to validate that the transition was authorized under the publisher's schema. Peers do not need to re-evaluate the threshold logic; they need only validate the chain. This permits coordinated state machines among heterogeneous agents without a shared runtime.

Prior-Art Separation

Single-field threshold detectors with hysteresis are well-known in control engineering, dating to Schmitt-trigger circuits and their digital descendants. They suffer from the false-positive problem under sensor drift: a single field cannot distinguish a genuine state change from a slowly drifting baseline. The two-field rule addresses this directly by requiring corroboration from an independent second axis.

Multi-condition state machines in software, such as those expressed in Statecharts or behavior trees, permit arbitrary boolean combinations of conditions to drive transitions. They do not require independence between conditions, do not enforce a minimum number of conditions, and do not couple debounce and hysteresis to the transition logic at the schema level. The two-field threshold is more restrictive than Statecharts in admitting transitions and is therefore not anticipated by them.

Sensor fusion approaches in robotics and avionics combine multiple sensors but typically do so through filtering (Kalman, particle, complementary) that produces a single fused estimate; the threshold is then applied to the estimate. The two-field mechanism deliberately does not fuse the fields prior to thresholding, which preserves the independence property and makes the corroboration requirement legible at audit time.

Database integrity constraints, such as multi-column check constraints, validate static invariants but do not govern state transitions over time and do not implement debounce or hysteresis.

Disclosure Scope

This article discloses the threshold mechanism, the independence requirement on control fields, the debounce and refractory intervals, the hysteresis band semantics, the parameter ranges, and the alternative embodiments sufficient for a person of ordinary skill in distributed agent systems or control engineering to practice the invention. It does not disclose the schema-validation engine, which is described in the agent-schema base disclosure; it does not disclose the lineage commitment cryptography, which is described in companion materials; and it does not disclose specific threshold values for any application domain, which are application-engineering choices outside the scope of the patent. Claims arising from this disclosure are expected to read on the combination of two-field minimum, independence, debounce, hysteresis, and lineage commitment, with dependent claims reaching the N-of-M generalization, asymmetric and state-dependent hysteresis, and the soft-refractory variant.

The disclosure further contemplates that the independence requirement may itself be a first-class object in the schema: the agent may declare not only the two control fields but the independence proof connecting them, expressed as a pointer into the lineage graph identifying the upstream branch point at which the two fields' provenances diverge. The independence proof is checked at validation against the configured depth parameter and is recorded in the agent's manifest. Claims reaching this embodiment cover schemas in which the independence proof is mandatory, optional with a fallback to depth-based search, or optional with a fallback to a cryptographic commitment that the validator could not refute the independence within bounded effort.

The disclosure also contemplates that the debounce and refractory intervals may be coupled to the agent's energy or resource budget: in a constrained-deployment embodiment, the intervals lengthen automatically when the agent's available resources fall below a configured threshold, on the theory that a resource-starved agent should be more reluctant to transition. The coupling is expressed as a deterministic function in the schema and is committed alongside the static interval values; it is not a runtime modification because the function is fixed at schema time. This embodiment is contemplated as a dependent claim where the function's parameters are themselves subject to schema validation and are bounded above and below by the same ranges that govern static intervals.

Finally, the disclosure contemplates that the lineage record of suppressed and aborted transitions is at least as forensically valuable as the record of fired transitions: the trajectory of attempts that did not lead to a state change is the record by which an auditor distinguishes a stable agent from one operating near its thresholds. Claims reaching this aspect cover the requirement that suppressed events be recorded with the same fidelity as fired events, that the records be linkable through a per-state event counter, and that the counter be monotonic across debounce restarts so that no attempt can be silently dropped from the audit record.