1. The Gap

The counterparty-reparation layer of Adaptive Query enforces a hard property: an agent that harms parties it cannot settle with, or that will not settle with the parties it harms, monotonically loses the capacity to deviate. Each admitted deviation whose harm exceeds a deductible creates a reparation arc, the arc's amount accumulates in a retention register, and when the accumulated undischarged amount exceeds a declared aggregate retention the agent's permission to deviate is foreclosed. Elapsed time restores nothing.

That machinery, as first disclosed, runs one register against one threshold. Every pending arc, whatever party class its deviation harmed, accumulates into the same register and is tested against the same bound. Harm to identified counterparties and harm to unidentified or systemic parties then count against a single budget, so accumulation attributable to one class is never bounded apart from accumulation attributable to the other. Distance still remaining to the threshold on one class stays available to the other, and a level of harm to one class that would exceed a bound of its own can stand instead under a bound it shares with the second class.

The scoped integrity vector already distinguishes these categories at the point of harm. It carries an interpersonal integrity component, whose domain is conduct toward identified counterparties, and a global integrity component, whose domain is conduct toward parties, systems, or principles beyond direct interaction. The metering, though, collapsed that distinction back into one number. Per-integrity-scope aggregate retention carries the distinction all the way through to the budget.

2. Mechanism

The aggregate retention is declared per integrity scope of the scoped integrity vector rather than as a single value. A first aggregate retention applies to arcs whose deviation was recorded against the interpersonal integrity component. A second applies to arcs whose deviation was recorded against the global integrity component. Both are declared in the signed policy object, so the two bounds are policy-set rather than implicit.

Each reparation arc is routed to exactly one of the two components. The agent assigns every other-directed and unaddressed reparation arc to the component against which the occasioning deviation was recorded, and writes that assigned component into the arc's record so the assignment is reconstructible from the lineage alone. No arc is assigned to more than one component. The routing is not a fresh judgment made at metering time; it follows the affected-party resolution that already classified the deviation. That resolution maps the affected-party class of the deviating action to an integrity scope: an identified counterparty maps to the interpersonal scope, a party neither identified nor recorded maps to the global scope. An unaddressed arc, occasioned when the affected class resolves to no counterparty the agent holds a record for, accumulates against the integrity-scope component to which its class maps, which in the ordinary structurally-silent case is the global component. Because the component is fixed at creation and recorded, a later change in the counterparty records the agent holds cannot re-route an arc after the fact.

The retention register accumulates each pending arc's contribution against its assigned component. An other-directed arc contributes its own amount. An unaddressed arc contributes its amount multiplied by an unaddressed multiple declared in the signed policy object and not less than unity, the multiple applied in the accumulation and not in the amount the arc carries, so both quantities remain reconstructible. Two independent sums therefore stand at any moment: an interpersonal accumulation and a global accumulation.

The foreclosure test is disjunctive. The two thresholds are tested independently, and either component's accumulation exceeding its corresponding aggregate retention suffices to fire the foreclosure. On firing, a retention foreclosure record is appended identifying the accumulated amount, the aggregate retention applied, and each pending arc contributing, and the permission condition is foreclosed. Thereafter a deviation likelihood exceeding unity produces the withholding outcome and not the admission outcome: the authorization gate is written to the withheld state and no permitted deviation record is appended. The agent performs this from state carried in its own memory, without adjudication by any other party. Neither scope's remaining distance offsets the other's overshoot, because the two bounds are tested independently and never summed. Each class of harm is metered on its own account and can foreclose the agent by itself.

Discharge remains asymmetric and scoped to the harmed party. An other-directed arc is discharged only by a completed matched pair whose second observation is the bound counterparty's own reparation acceptance determination, produced by no adjudicator, arbiter, or third party. On discharge the accumulated amount is removed from the register, lowering the accumulation of the component that arc was assigned to and no other. An unaddressed arc has no discharge path at all. So the two accumulations move down only through settlement with the specific parties harmed in the corresponding scope, and where a scope's accumulation consists wholly of unaddressed arcs the foreclosure it can fire is permanent.

The foreclosure is also protected against being edited away. The aggregate retention of each scope is subject to a retention monotonicity constraint holding a monotonically non-increasing floor over the values admitted from successor signed policy objects. A successor declaring a smaller value is admitted and becomes the floor; a successor declaring a larger value is not admitted while a retention foreclosure record stands unreversed. A succession declaring a larger aggregate retention therefore neither discharges any arc, nor reduces any accumulation, nor lifts a foreclosure that has fired, because the bound tested against is monotone in the same direction as the accumulation. Splitting the retention into two per-scope bounds does not weaken this: each of the two bounds carries its own non-increasing floor, and either firing is as irreversible as the single-threshold firing it refines.

3. Operating Parameters

The filed specification declares the following parameters for this mechanism, and only these.

  • Two aggregate retentions. A first aggregate retention for the interpersonal integrity component and a second for the global integrity component, each declared in the signed policy object. The specification declares that both exist and are tested independently; it fixes no numeric value for either, the values being policy-set.
  • Per-arc component assignment. Exactly one component per arc, being the component against which the occasioning deviation was recorded, written into the arc's record. No arc is assigned to more than one component.
  • Disjunctive firing. Either accumulation exceeding its corresponding aggregate retention suffices to fire the foreclosure; the two thresholds are tested independently.
  • Denomination. The deductible, the amounts accumulated in the register, and the aggregate retentions are each denominated in units of the entropy-weighted harm coefficient.
  • Unaddressed multiple. Declared in the signed policy object and not less than unity, applied in the accumulation rather than in the arc's carried amount.
  • Foreclosure trigger downstream. Once foreclosed, a deviation likelihood exceeding unity produces the withholding outcome and writes the authorization gate to the withheld state.
  • Retention monotonicity floor. A monotonically non-increasing floor over successor policy values; a larger successor value is not admitted while a foreclosure record stands unreversed.

The specification gives a single-threshold worked trace by way of illustration only: a deviation deductible of 2.0 units, an aggregate retention of 10.0 units, a register opening at 0, three pending other-directed arcs of 3.0, 4.0, and 5.0 units bringing the register to 12.0, a retention foreclosure record appended, and a subsequent deviation likelihood of 1.6 producing no admission while a successor policy declaring 20.0 is refused under the monotonicity floor. Those magnitudes illustrate the accumulation and foreclosure the per-scope form refines; they are not fixed values, and the per-scope embodiment declares two such thresholds without fixing either.

4. Composition

This mechanism is a refinement of the aggregate retention and terminal foreclosure of the counterparty-directed reparation layer. Its parent section discloses the base machinery: the reparation arc designated by the class of party the deviation harmed, the retention register, the single aggregate retention, and the foreclosure of the permission condition when the accumulation exceeds that retention. Per-integrity-scope retention replaces the one bound with a pair keyed to the scoped integrity vector's interpersonal and global components.

Upstream, the affected-party resolution supplies the input this mechanism consumes. That resolution already extracts the affected-party class and maps it to an integrity scope, producing either an identified-counterparty outcome or a no-identified-counterparty outcome. Per-scope retention reads the recorded scope and routes the arc; it introduces no new classification of its own.

Downstream, every discharge and suspension rule continues to operate on the arcs feeding each register. An other-directed arc is dischargeable only by the harmed party's acceptance through a matched pair; the dual-lock escrow and the partial-acceptance residual arc are the atomic and splittable forms settlement can take; an abstention-suspended accumulation record and a reparation containment suspension each hold an arc's contribution at the amount then standing without discharging it. All of these bear on the amount an arc contributes to its register, and per-scope retention directs that contribution to one of two accumulations rather than one.

The consequence of firing is foreclosure of the permission condition of the permitted-deviation state, the sanctioned-override mechanism that lets the agent admit a mutation the signed policy forbids. Because the scoped integrity vector's interpersonal and global components are the same scopes the deviation engine already consumes in computing the deviation likelihood, the two retention budgets are keyed to structure the architecture already carries rather than to a new partition introduced at metering.

5. Prior-Art Distinction

Several established fields meter accumulated exposure and cut off activity when a bound is crossed. The distinctions here are structural, and none of what follows asserts or implies that any named product or party practices this mechanism.

Insurance and reinsurance supply the term aggregate retention itself, along with aggregate stop-loss and per-line and combined retentions. There a retention is a self-insurance threshold beyond which a carrier reimburses, and a multi-line program can set separate retentions per line of business. The similarity ends at the accounting. Crossing an insurance retention triggers indemnity, not a loss of the insured's capacity to act; retentions reset each policy period; and the insured's own conduct does not monotonically consume a budget that only the party it harmed can lower.

Rate limiters, circuit breakers, and token buckets suspend an operation when a counter crosses a threshold, and multi-dimensional variants meter per tenant, per route, or per key with any dimension able to trip. Those counters decay, refill, or reset on a timer, and the operator that consumed the budget can itself restore it by waiting. This mechanism grants no such recovery: elapsed time restores nothing, and an accumulation falls only when the specific harmed counterparty accepts a reparation, or never, for an unaddressed arc.

Differential-privacy budget composition tracks per-mechanism privacy loss and blocks further queries once a budget is spent, composing across dimensions. That budget is spent by the querying party's own actions and is not gated on any third party's acceptance, and exhaustion bars queries rather than foreclosing a standing permission whose restoration requires settlement with the party harmed.

Enterprise risk frameworks come closest on the disjunction: per-desk and per-book limits are tested independently, and a breach of any one halts trading. But those limits are set and reset by a central risk function, a breach is commonly curable by unwinding a position or by an authorized limit increase, and the partition is by organizational unit rather than by the class of party a harm fell upon. Per-integrity-scope retention partitions by whom the deviation harmed, records each arc's component so the routing is reconstructible, and makes the fired foreclosure irreversible by policy succession, co-signature, or principal resolution.

6. Disclosure Scope

This mechanism is disclosed in U.S. Provisional Application No. 64/117,812, Section 10.12, at paragraph [0496], with antecedents in the scoped integrity vector of Section 7 and the counterparty-directed reparation machinery of Section 8, including the retention register, the aggregate retention, and the retention foreclosure record.

What is disclosed: an aggregate retention declared per integrity scope, a first applying to arcs whose deviation was recorded against the interpersonal integrity component and a second against the global integrity component; the assignment of each other-directed and unaddressed reparation arc to exactly one component, being the component against which the occasioning deviation was recorded, recorded so the assignment is reconstructible and with no arc assigned to more than one component; and the appending of the retention foreclosure record and foreclosure of the permission condition upon either component's accumulation exceeding its corresponding aggregate retention, the two thresholds tested independently and either one exceeding sufficing to fire the foreclosure.

What is not asserted here: no numeric value for either per-scope retention is fixed, both being declared in the signed policy object, and the single-threshold magnitudes recited above are illustrative only. This article does not reach the further alternative embodiments of the parent section, including the structured inquiry to the principal on foreclosure, the escrow and residual-arc discharge forms, and the abstention and containment suspensions, which are described in their own disclosures. Nothing here asserts or implies that any third party practices the mechanism, and nothing here is a claim; the claims of the application govern its scope.