Hysteretic Confidence Recovery

Mechanism

Hysteretic Confidence Recovery, as defined in Chapter 5 of the cognition patent, replaces the single-threshold confidence gate with an asymmetric pair: a collapse threshold and a recovery threshold, with the recovery threshold strictly greater than the collapse threshold. The agent's operational scope is governed by a state variable that takes one of two values, expanded or contracted, and the transitions between the two values are gated by the asymmetric thresholds.

Starting in the expanded state, the agent's scope contracts when measured confidence falls below the collapse threshold. Once contracted, the scope does not re-expand at the collapse threshold; it re-expands only when confidence rises above the recovery threshold. The interval between the two thresholds is the deadband. While confidence sits in the deadband, the scope variable retains its current value, regardless of which side of the deadband confidence approaches from. The result is a state machine whose transitions are path-dependent in a precisely controlled way.

The asymmetry is essential. A symmetric single-threshold gate is mathematically vulnerable to oscillation: when confidence is dominated by noise around the threshold value, the gate flips on every cycle, and the agent's scope flickers. Flickering scope is operationally worse than either steady state, because each transition is itself a load on downstream consumers, on lineage storage, and on any external systems that observe the scope. The asymmetric pair eliminates flickering by construction: a single excursion below the collapse threshold contracts the scope, and confidence must then climb past the higher recovery threshold before the scope re-expands. Noise that does not span the entire deadband cannot induce a transition.

The recovery transition is further subject to a minimum dwell time in the recovered state of confidence above the recovery threshold. The dwell time prevents an instantaneous spike past the recovery threshold from triggering re-expansion; only a sustained recovery does. The dwell time, the collapse threshold, and the recovery threshold are all declarative policy parameters. The state variable, the threshold crossings, the dwell-timer state, and the resulting transitions are all recorded in lineage, so that an auditor can reconstruct the scope trajectory from the policy and the confidence trace.

Operating Parameters

The collapse threshold defines the confidence value below which the scope contracts. The recovery threshold defines the confidence value above which the scope may re-expand, subject to dwell. The deadband width is the difference between the two thresholds and is the primary tuning knob for the trade-off between responsiveness and stability. A narrow deadband yields fast re-expansion at the cost of vulnerability to noise; a wide deadband yields stability at the cost of slow recovery from genuine improvements.

The dwell time defines how long confidence must remain above the recovery threshold before re-expansion is permitted. A zero dwell makes the recovery transition instantaneous on threshold crossing; a positive dwell requires sustained recovery. The dwell may be configured in wall-clock units or in cognitive-cycle units; lineage records which. Per-domain configurations are supported: a high-stakes domain may use a wide deadband and a long dwell, while a low-stakes domain may use a narrow deadband and a short dwell, on the same agent and within the same policy reference.

Operators may also configure the threshold-pair under a constraint that the deadband never closes: any policy update that would set the recovery threshold below the collapse threshold, or that would set the two equal, is rejected at policy-load time rather than silently accepted. This constraint is enforced structurally, so the agent cannot enter a degenerate single-threshold configuration through misconfiguration. Lineage records include both the policy version under which a transition occurred and the threshold values that the policy specified, so that retrospective analysis distinguishes transitions caused by genuine confidence movement from transitions whose interpretation depends on an interim policy revision.

Optional parameters control the behavior of the scope variable when the agent is first instantiated and has no prior lineage. The cold-start scope, the cold-start confidence floor, and the cold-start dwell are all separately configurable and prevent the agent from beginning operation in an under-defined state.

Alternative Embodiments

In one embodiment, the scope variable is binary, taking only the values expanded and contracted. In another embodiment, the scope variable is multi-level, with several intermediate scopes between fully expanded and fully contracted, and an asymmetric threshold pair gating each adjacent transition. The multi-level embodiment requires a vector of collapse thresholds, a vector of recovery thresholds, and a corresponding vector of dwell times.

In a further embodiment, the deadband is fixed in width but slides along the confidence axis on the basis of a long-running confidence baseline. As the baseline drifts, both thresholds drift together, preserving the deadband width while tracking the baseline. This embodiment is appropriate for agents whose confidence distribution shifts over deployment lifetimes.

In yet another embodiment, the recovery threshold is itself adjusted on the basis of the agent's recent collapse history. After a recent collapse, the recovery threshold is raised further, demanding a stronger recovery signal; the threshold relaxes back to its policy default after a configurable interval without further collapses. This embodiment provides additional protection against intermittent failure modes that produce repeated near-threshold excursions.

A further embodiment couples the dwell timer to a confidence-derivative requirement: re-expansion is permitted not only when confidence has remained above the recovery threshold for the dwell interval but also when the trajectory of confidence over that interval has been non-decreasing. This embodiment guards against a recovery transition that occurs at the apex of an unstable trajectory, where the confidence value briefly clears the recovery threshold but is already turning back toward collapse. In another embodiment, the recovery transition is conditioned on confidence remaining above the recovery threshold across multiple independent confidence inputs, requiring corroborated recovery rather than recovery on a single channel; this embodiment is appropriate when confidence is computed from heterogeneous measurements and individual channels carry measurement-specific failure modes.

Composition with Other Mechanisms

Hysteretic Confidence Recovery composes with the broader confidence-governance machinery of Chapter 5. The confidence value consumed by the mechanism is the canonical confidence produced by the upstream computation; the scope variable produced by the mechanism is consumed by the downstream authorization gate. The mechanism is purely a state machine over confidence; it does not modify the confidence computation itself, and it does not bypass the authorization gate.

The mechanism composes with the capability-awareness machinery of Chapter 6 by producing a scope variable that the capability filter respects: a contracted scope reduces the canonical envelope, which in turn prunes the planner's successor space. The composition is one-directional: confidence governs scope, scope governs envelope, envelope governs planning. There is no return path by which planning outcomes mutate the hysteretic thresholds, which prevents the planner from gaming the gate.

Composition with the lineage subsystem records each scope transition together with the confidence trace that produced it, the policy version that supplied the threshold pair, and the dwell-timer state at the moment of transition. The lineage record supports two distinct downstream uses. The first is incident review: when an agent's behavior is questioned after the fact, the scope-transition record provides a complete causal chain from confidence input to operational consequence. The second is policy evaluation: the threshold-pair and dwell-time settings can be evaluated by replaying past confidence traces against alternate policy versions, allowing operators to estimate how a proposed policy change would have altered scope behavior on real data, without deploying the change to production.

The mechanism additionally composes with notification systems that consume scope transitions as first-class events. Subscribers receive both the transition event and the policy-version context, allowing downstream systems to interpret the transition in light of the same threshold pair the agent was using. This avoids a class of integration bug in which a notification consumer applies its own threshold reasoning, distinct from the agent's, and arrives at a state interpretation that disagrees with the agent's lineage record.

Prior-Art Distinctions

Single-threshold confidence gates, common in conventional safety systems, are vulnerable to chatter when the input signal is noisy near the threshold. Schmitt-trigger circuits in analog electronics solve the same chattering problem with asymmetric thresholds, and the underlying mathematics is well established. The disclosed mechanism is distinct in that the asymmetric pair is applied to a high-level confidence variable in a cognitive architecture, that the thresholds are declarative policy parameters rather than circuit constants, and that the dwell timer is integrated as a third axis alongside the two thresholds.

Rate-limiting and debouncing approaches in software systems suppress oscillation by ignoring transitions for a fixed cooldown after each transition. The disclosed mechanism is distinct in that the cooldown is replaced by a structural deadband: the gate is not blind to the input during a cooldown, but rather sensitive to a different threshold depending on the current state. This produces a state machine whose transitions are path-dependent rather than time-locked.

Reinforcement-learning approaches that learn a recovery policy from operational data encode the recovery rule in opaque weights. The disclosed mechanism's recovery rule is a small, declarative state machine fully reconstructible from policy. Audit and certification of the recovery behavior do not require access to a training distribution.

Disclosure Scope

This disclosure encompasses any confidence-governance mechanism that uses an asymmetric pair of thresholds, with the recovery threshold strictly greater than the collapse threshold, to gate transitions of an operational-scope state variable. The disclosure further encompasses embodiments that augment the asymmetric pair with a dwell timer on the recovery transition, embodiments with multi-level scope variables, embodiments with sliding deadbands tracking a long-running baseline, and embodiments in which the recovery threshold is adjusted on the basis of recent collapse history.

The scope is not limited to any particular confidence computation, any particular scope vocabulary, or any particular dwell unit. The structural invariants, namely that the thresholds are asymmetric in the disclosed direction, that the deadband is a property of the state machine rather than of timing, and that the parameters are declarative and lineage-recorded, define the boundary. Implementations that use a single threshold, that rely on time-locked cooldowns rather than state-dependent thresholds, or that encode the recovery rule in opaque learned weights, fall outside the scope.