The 6:41 A.M. Stop She Cannot Reconstruct
The safety case owner at a mid-size builder of autonomous yard tractors gets the call on an ordinary Tuesday, about an event that happened the previous Tuesday at 6:41 in the morning. One of her tractors was moving a loaded chassis between container stacks in low light. Something entered the lane between stacks four and five. The tractor braked, but not to a full stop. It slowed, held a reduced speed, passed the gap, and continued. A dockworker filed a report saying the machine came closer than it should have.
Nobody was hurt. That much she is sure about.
She pulls the vehicle log. It contains a timestamped brake command at a commanded deceleration below the tractor's maximum. It contains the perception frame that preceded it. It does not contain the thing she needs, which is what her tractor believed about that lane in the instant before it committed, and why the reduced deceleration was the output rather than the maximum. Her controller wrote down what it did. In her build, it did not write down what it was weighing.
The terminal operator wants an answer before the next shift plan is signed. Her regulator wants an answer that survives being read aloud. Her own engineering director wants to know whether the same input next Tuesday produces the same output. She has one week of retained sensor data, a brake command, and no path between them.
What She Loses, and Why the Week Does Not Come Back
What she loses at the outset is the deceleration itself. For her tractor, braking is not a decision that can be taken back. It is reversible in the sense that the vehicle can accelerate again, and irreversible in the sense that the elapsed seconds and the stopping distance the tractor consumed in stacks four and five are spent. Whatever margin the machine had in that gap, it has already been allocated. She cannot re-run the moment with a different setting and see what would have happened, because the moment consumed the margin it was deciding about.
What she loses next is the explanation, and this is the loss that compounds for her. The evidence her tractor was reasoning over lived in working memory at 6:41 and was overwritten by 6:42. In her deployment, the state that would let her say "it braked at reduced magnitude because the lane observation was thin and the vehicle preferred a path it could still amend" was not committed to storage. She is not looking at a corrupted record. She is looking at the absence of one, and none of her retained video recreates a confidence value her stack did not serialize.
What that costs her is specific. She cannot certify the behavior, because certifying it would mean asserting a rule the machine followed, and she cannot demonstrate the rule. She cannot fix the behavior, because she cannot tell whether her tractor made a defensible judgment under thin evidence or made an arbitrary one. She cannot defend the behavior either, and defending it badly is worse for her than not defending it. So the tractors go to a supervised mode with a human walking ahead of them, which her terminal customer will tolerate for about a month, and her funding case for the next site rests on a claim about explainability she can no longer make.
Six weeks later she will still not know what her machine was thinking at 6:41. That week is closed.
Structurally, Her Controller Has No Middle
Her problem is not that the tractor braked. Her problem is the shape of the decision as her stack is built today.
In her build, the actuator interface accepts a deceleration value and executes it. Everything upstream that produced the value is inference, and inference in her pipeline is transient by construction. So the boundary where her machine touches the physical world is exactly the boundary where her record thins out. The further downstream she looks, the more consequential the event and the less she knows about it.
She has tried to solve this at the two ends. Were her tractors configured to stop hard on any ambiguous return, her customer's terminal would shut down inside an hour, because that yard produces ambiguous returns continuously through a working shift, and one of her tractors panic-stopping under a crane would be its own hazard to the tractor behind it. Were they configured to proceed under anything short of a confirmed obstacle, she would be in the conversation she is in now, with worse facts. Her tuning work lives between those two failures, and the tuning is a scalar she picks and cannot justify.
The middle is where her actual answer lives, and her architecture does not represent the middle as anything she can point at. Her tractor did in fact do something in between at 6:41. It braked partially. But for her purposes that partial brake is indistinguishable from a full brake that underperformed, from a controller fault, and from a coincidence, because in her setup the chosen magnitude carries no statement of what it was chosen instead of.
There is a second structural edge she keeps hitting. Her tractors do not tell each other anything about what they just did. The tractor following forty meters behind at 6:41 learned about the deceleration by observing the gap close, which is the slowest channel available to it. For her fleet, every braking event is a private event that its neighbors have to rediscover through physics.
What the Filed Mechanism Puts Between Decision and Actuator
Chapter 6 of U.S. Provisional Application No. 64/049,409 discloses a confidence-governed execution primitive in which a physical actuation is treated as a governed mutation rather than as a command. In embodiments described there, a proposed actuation specifying an actuator, an actuation command, and actuation parameters is ingested and evaluated through a composite admissibility evaluator before execution, jointly with governed observations consumed from the governed mesh, the dispositional field, forecasting observations, and the capability envelope.
One described element that bears on the middle she cannot point at is a graduated-actuation mode selector. The disclosure describes a plurality of governance-policy-defined actuation modes, selected per actuator class and per admissibility-determination output, including a disabled mode, a simulated mode, an advisory mode that records what would have been done without physical effect, a consultative mode that emits a consultation request to a human operator or higher-authority agent and awaits confirmation, a partial mode executing at fractional magnitude or reduced rate, a constrained mode executing subject to additional limits, a stage-gated mode executing in stages with admissibility re-evaluation between them, a deferred mode, a full mode at nominal magnitude, and an emergency-accelerated mode. The disclosure describes the selector as producing a continuous and bounded mapping from the composite admissibility determination to the selected mode, transitioning toward more autonomous modes as admissibility rises and toward less autonomous modes as it falls, and supporting de-escalation of an actuation already in progress when a newly consumed observation reduces admissibility.
The thresholds that gate each mode are described as per-actuator and governance-policy-defined, with a high-consequence actuator requiring elevated composite admissibility across multiple contributing factors for execution at full mode while a low-consequence actuator requires baseline admissibility. In described embodiments a threshold-modulation engine combines dispositional, forecast-uncertainty, and capability-envelope modifiers, so that an actuator operating in a region with elevated forecast uncertainty or a depleted capability envelope operates under elevated thresholds.
Reversibility is handled explicitly. The disclosure describes a reversibility-aware commitment-point evaluator that classifies a proposed actuation into reversibility classes, including partially reversible actuations, and gives braking as an example of an actuation reversible in kinematic effect but irreversible in elapsed time and consumed stopping distance. A commitment-point detector identifies the point in the actuation chain beyond which continuation becomes irreversible, and a path-preference engine is described as preferring reversible paths among admissible candidates of comparable projected outcome.
Where no available path avoids harm, a harm-minimization deviation mechanism is described: candidate actuation paths are generated from the unit's kinematic state and capability envelope, composite expected harm is projected across entities using a governance-policy-defined entity-class harm ordering, and the path with the most favorable composite harm-admissibility score is selected, with the candidate set and the per-path projections recorded.
Two further elements bear on reconstruction. The actuation chain includes pre-execution lineage recording, in which the selected mode, the evaluation inputs, and the evaluation determinations are written to the lineage field prior to the actuator command. And a post-actuation verification mechanism compares observed effects against an expected-effect specification, producing a discrepancy metric and classifying each discrepancy as nominal, degraded-actuator, degraded-observation, environmental-perturbation, adversarial-interference, or another governance-policy-defined class. Each executed actuation is also emitted as a governed actuation-state observation carrying the selected mode and the composite-admissibility determination, which neighboring units may consume.
Where This Would Still Leave Her Work Undone
The disclosed architecture would not choose her thresholds for her. The confidence thresholds, the entity-class harm ordering, the reversibility classes, and the mode mapping per actuator class are described as governance-policy-defined, which means her organization would still be the one to write them and to stand behind them for her terminal.
It would not tell her whether her tractor's perception was right at 6:41. The evaluation described operates over governed observations and their credentials and weights, so if her lane sensing were degraded in a way that produced a confident but wrong observation, a governed record of that reasoning would show her a well-formed decision made on bad evidence. That is more than she has now, and it is not the same as correctness.
It would not give her back the second she spent. Nothing in the disclosure makes a partially reversible actuation reversible; it classifies the actuation so that her thresholds can respond to the classification before commitment.
It would also not solve her retention problem by itself. Lineage records described in the disclosure are records, and for her deployment the questions of how long she keeps them, who at the terminal may read them, and how she indexes them against a specific 6:41 event would remain her engineering work to do.
Disclosure Scope
This article is a technical description of subject matter disclosed in U.S. Provisional Application No. 64/049,409, "Governed Spatial Mesh for Physical-World Perception, Coordination, and Actuation." Mechanisms described here appear in that filing as embodiments. Nothing in this article characterizes the scope of any claim, present or future, and nothing here is an admission regarding the state of the art. Descriptions of outcomes follow the filing's own conditioning: where the disclosure conditions a behavior on a governance-policy-defined threshold, budget, or classification, that condition applies.
