1. The Gap

A governed agent that harms a counterparty gets its authority withheld. The hard question is not the withholding. It is how that authority comes back, and who decides.

Consider a field service deployment for vertical transportation equipment, where a semantic agent (100) bound to a service branch dispatches technicians, releases equipment lockouts, and schedules outage windows for elevators installed in buildings operated by third parties. Suppose the agent's authorization gate (300) has been written to the withheld state (310) upon conduct recorded as harming a building operator. If the restoration procedure is exercisable by the agent alone, or by its own principal alone, the agent returns to releasing lockouts without the harmed operator having recorded anything. The withholding was a delay, not a condition.

The filed disclosure closes that first opening with a provenance test: where the deviation that caused the write is externally sourced, the authorization gate (300) returns only to a provisional granting state, and only on a principal-resolution object bound to the emitted escalation record. From there, the disclosure hands completion to the harmed party. The agent issues a costly acknowledgment artifact, and an asserting party (118) of the harmed origin-equivalence class (200), not the agent and not the principal, produces an acceptance determination that transitions the gate to full granting.

That design solves the first gap and opens a second. What if the harmed party never answers? A non-accepting outcome, an absent outcome recorded as not-determinable (126), and an undeliverable outcome where no such party is reachable each leave the gate provisional. If silence is made to cost the agent, a counterparty who never replies holds the agent provisional on its own terms, an open-ended veto. If the system instead reinstates authority on a timer, the condition evaporates, and elapsed time alone restores an agent whose harm was never revisited. Completion by non-worsening re-encounter is the route between those two failures.

2. Mechanism

The mechanism operates independently of the acknowledgment procedure. It supplies a second, passive route from the provisional granting state to the granting state, one that requires no issuance by the agent and no acceptance determination from the harmed party.

The transition fires on receipt, from an asserting party (118) of the harmed origin-equivalence class (200), of a further conduct evaluation artifact (116) that does not increase the deviation quantity across an observation window declared in the signed policy object (112). When that condition holds, the authorization gate (300) transitions from its provisional granting state to the granting state.

Each element of that condition does separate work.

The artifact must come from the harmed class. Eligibility is decided by the asserting party's (118) assignment to the origin-equivalence class (200) whose accepted determinations (122) entered the causal set that caused the write. It is not a self-report, and it is not any counterparty. The class that was harmed is the class whose fresh encounter completes the restoration.

The condition is non-worsening, not improvement. The mechanism does not ask the harmed party to forgive, to accept, or to certify repair. It asks only that a genuine further encounter with that party occur and that the recomputed deviation quantity not rise across the window. A further conduct evaluation artifact (116) that yields a determination leaving the deviation quantity unchanged satisfies the condition as fully as one that lowers it. What is being tested is the absence of continued harm on re-contact, evidenced by a recorded artifact rather than by anyone's declaration.

The window is bounded below by the harmed class's own recorded arrival rate. The observation window is not a bare policy constant. Its lower bound is the recorded inter-arrival estimator computed over receipts from that class, set so that the window admits at least one further artifact at that class's recorded rate of receipt. The design turns on this lower bound. A window long enough to contain a real further encounter means the transition reflects an artifact the agent actually received from the harmed class, not the passage of a clock across an interval in which that class would not have been expected to appear at all. The lower bound binds completion to the agent's own observed history with that specific counterparty class.

The default is non-punitive and open-ended. Where the harmed class is not re-encountered within a declared interval, the authorization gate (300) remains provisional indefinitely. The agent (100) continues to execute under the provisional marker, and no adverse consequence beyond the marker is applied. Two naive outcomes are foreclosed together. The counterparty's silence is never converted into any adverse consequence beyond the marker, so silence buys no veto. Nor is the passage of time ever converted into completion, so a clock alone never clears the provisional state. The agent stays operational and legible the whole time: each execution it dispatches under the provisional granting state carries the provisional marker, which is readable by any party to whom the execution record is later presented.

Set beside the acknowledgment route, the independence is exact. Acknowledgment costs the agent forward authorization: issuance of the acknowledgment artifact decrements the authorization budget (404) that gates action dispatch, and the decrement follows from issuance alone. Acknowledgment also depends on the harmed party producing an acceptance determination over the artifact. Re-encounter demands neither. No budget is spent to complete by re-encounter, and no acceptance determination is solicited. The agent does not act to trigger it; it simply keeps operating under the marker until the harmed class next appears without worsening the record.

3. Operating Parameters

The filed disclosure states the mechanism's parameters as declared quantities held in the signed policy object (112), and fixes structural relations among them rather than numeric values.

  • The observation window is declared in the signed policy object (112). Across this window the deviation quantity is tested for non-increase.
  • The window is bounded below by the recorded inter-arrival estimator over receipts from the harmed origin-equivalence class (200), so that it admits at least one further conduct evaluation artifact (116) from that class at that class's recorded rate.
  • The recorded inter-arrival estimator is computed by the agent (100) over its own append-only lineage field (104) alone, as a declared measure of central tendency of the intervals between successive entries of a named kind recorded against a named edge, origin-equivalence class (200), or action class. Each interval is counted in successor epochs of the agent's hash chain. The measure of central tendency and the count of intervals over which it is computed are declared in the signed policy object (112). Where fewer than the declared count of intervals are recorded, the estimator returns a declared default.
  • The re-encounter interval is a declared interval. Absent a qualifying re-encounter within it, the gate remains provisional indefinitely with no consequence beyond the marker.
  • The completion condition is non-increase of the deviation quantity across the window, a comparison, not a threshold on any external magnitude.

No specific window length, measure of central tendency, interval count, or default value is fixed by the disclosure. The operative constraint is the tie between the window and the harmed class's recorded arrival rate, which is what keeps the transition anchored to a received artifact.

4. Composition

The mechanism sits on top of the provisional restoration architecture and reuses its parts rather than duplicating them.

Its entry condition is set by the provenance-conditioned restoration path. When the causal set of the deviation holds an accepted determination (122) from an asserting party (118) other than the principal, the deviation is externally sourced, and the authorization gate (300) returns only to the provisional granting state on a principal-resolution object bound to the escalation record. From that state, two independent paths reach full granting. One is the costly acknowledgment artifact followed by the recipient-held acceptance determination. The other is completion by non-worsening re-encounter. The two are alternatives, and the second requires no expenditure from the authorization budget (404) and no acceptance act from the harmed party. Self-sourced deviation never reaches this mechanism at all, since it returns directly to the granting state on a restorative mutation by the agent, without passing through the provisional state.

The window shares infrastructure with the rest of the filing. The recorded inter-arrival estimator that lower-bounds the observation window is the same estimator that supplies the lower bound of other windows in the architecture, including the register window that gates uncounted-class renewal of the authorization quantity. In each case the window is bound to the agent's own recorded arrival rate rather than to a wall-clock constant, which is what makes an interval computed from the agent's append-only lineage field (104) portable across mechanisms.

The mechanism also expresses a principle the filing carries in several places: completion of an externally sourced restoration is held by the harmed counterparty class, not by the agent or its principal. The recipient-held acceptance determination places that control in an asserting party (118) of the harmed origin-equivalence class (200). Elsewhere the filing binds an other-directed reparation obligation to the affected counterparty and makes it dischargeable only through that counterparty's own recorded acceptance. Non-worsening re-encounter is the release valve on this principle. Without it, counterparty control would harden into a counterparty veto, because a party who never answers could hold the agent provisional forever. With it, the agent has a route back that the harmed party cannot block by silence, yet that still depends on a real recorded encounter with that same party.

5. Prior-Art Distinction

Several established categories restore a withdrawn permission. Each differs from this mechanism structurally, and none of the distinctions below asserts that any product or party practices or infringes the filed subject matter.

Timeout and cooldown reinstatement restores authority after a fixed elapsed interval. Here elapsed time alone never completes the transition. Absent a recorded further artifact from the harmed origin-equivalence class (200) the gate remains provisional indefinitely, and the qualifying window is lower-bounded by that class's recorded arrival rate rather than set to a wall-clock constant, so the interval is measured against the agent's own history with that counterparty class.

Administrator reinstatement and self-service clearance let a human operator, or the acting party itself, clear a hold flag. This mechanism conditions completion on an artifact received from the harmed class, and the provenance test routes externally sourced deviation away from any restoration the agent or its principal can perform alone. The parties who caused the harm and the party who supervises the agent are precisely the parties who cannot effect this transition by their own act.

Reputation and trust-score decay drive a numeric penalty downward over time until authority is regained. Nothing decays here. The authorization gate (300) is a categorical state, the deviation quantity is recomputed on the artifacts received, and the completion condition is non-increase across a re-encounter rather than the fading of an accumulated score.

Retry and backoff schedules govern the timing of a re-attempt after a failed operation. The observation window is not a backoff interval. It is a lower-bounded window that must contain a recorded, non-worsening encounter with the harmed class for the authorization state to change, and its passage without such an encounter changes nothing.

6. Disclosure Scope

This mechanism is disclosed in U.S. Provisional Application No. 64/117,812, at Section 10.1, paragraph [0341], under the heading Completion by non-worsening re-encounter, together with the recorded inter-arrival estimator of the same section on which its window depends.

What is disclosed is the structural mechanism: a transition of the authorization gate (300) from its provisional granting state to the granting state, taken independently of the acknowledgment procedure, on receipt from an asserting party (118) of the harmed origin-equivalence class (200) of a further conduct evaluation artifact (116) that does not increase the deviation quantity across an observation window declared in the signed policy object (112) and bounded below by the recorded inter-arrival estimator over receipts from that class, with the gate remaining provisional indefinitely and without adverse consequence beyond the provisional marker where no qualifying re-encounter occurs within the declared interval.

What is not fixed, and is reserved to implementation, includes the numeric length of the observation window, the choice of measure of central tendency, the count of intervals over which the estimator is computed, and the declared default the estimator returns when too few intervals are recorded. The field service deployment for vertical transportation equipment is illustrative and does not limit the mechanism, which is stated over any action class governed by the authorization gate (300). The particular procedure by which the deviation quantity is computed is drawn from the surrounding architecture and is not narrowed by this mechanism. This article is a defensive technical disclosure and states no assertion that any third party practices the subject matter described.