1. A Refusal That Leaves No Trace
A supervisory controller on a packaging cell reaches an interlock decision and the guard-position input did not arrive this cycle. A protection relay reaches a trip decision while its telemetry channel is silent. Neither machine acts. The question that matters afterward is not whether declining was correct, but what the record says happened.
Often the record says a number. The absent guard position became the last held sample; a missing estimate became a conservative constant chosen when the module was written. Downstream, a threshold comparison consumed that value and produced a Boolean, and the command that followed sits in the log looking like one made on real data.
The opposite failure is at least as familiar. Where absence is recorded, it tends to be recorded as fault: a watchdog increments, a channel is marked unhealthy, a redundancy voter treats the abstaining channel as an outvoted minority. The subsystem holding the least information is charged for saying so, which pushes the engineering incentive toward emitting something plausible rather than nothing.
Distributed autonomy adds a failure no single program can fix. Where parties on either side of an organizational boundary run their own decision logic, one party's choice to stop performing a class of actions reaches the other only as silence. Deliberate withholding and a crashed process arrive identically.
2. Why Existing Approaches Stall
The techniques ordinarily reached for differ widely in sophistication and share a structural property: none supplies a representation of "no answer" that a consuming computation cannot turn into an answer.
Sentinel values are the plainest case. A not-a-number, a negative one, a maximum-range constant: each lives in the same value domain as a real measurement, so arithmetic on it is well defined and comparison against a threshold yields a Boolean. What keeps a sentinel from being read as data is a convention among the engineers who wrote each stage, and conventions are not carried by the code. A stage added later inherits none of it.
Degraded and fail-operational modes operate at the wrong granularity. A mode is a property of a subsystem; unavailability is a property of one input at one determination stage. Collapsing many distinct absences into a single mode transition discards the distinction an investigation later needs.
Health scores and confidence quantities turn absence into magnitude by construction, and a fallen magnitude tends to be read as a reason to trust the reporting component less. Logging beside the data path splits the record from the computation, and the artifact that determined behavior is the data path.
Timeouts resolve non-response against the non-responder, which is what a timeout is for. But the party unable to answer is charged either way, whether it went quiet because it broke or because it correctly determined that it should not act.
3. What the Filing Discloses
Chapter 5 of the filed provisional, "Adverse-to-No-Party Abstention and the Conversion Bar," sets out the construct. Its named elements are a degradation map (500), a conversion bar (502), a non-execution attestation (504), an abstention type (506), and an abstention propagation chain (508).
The invariant comes first. Where an input required by a determination is unavailable, incomplete, or unresolvable, the determination emits an outcome entry of a recorded abstention class identifying the unavailable input, and emits no outcome adverse to the semantic agent (100), to an asserting party (118), or to a counterparty. It holds at each stage at which an input is required, irrespective of the cause. One exception is recited: the reason-type-unresolved path, at which an unresolvable reason-type instead produces a modification bounded to the non-zero minimum declared in the signed policy object (112).
The degradation map enumerates, for each determination stage, the input required, the abstention outcome produced upon unavailability, and the consequence foreclosed. Seven paths are disclosed: lineage-unavailable, policy-unresolved, reason-type-unresolved, non-response, class-unresolved, register-unavailable, and counterparty-absence. The lineage-unavailable path forecloses the rejected determination (124); the non-response path forecloses resolution of the matter against the non-responding party.
An abstention outcome is appended to the append-only lineage field (104) as a first-class entry comprising the abstention class, the stage that produced it, the unavailable input, and a recorded time. A determination that consumes one emits an abstention outcome of its own recorded class, and no stage replaces, resolves, or defaults it, so the identity of the unavailable input stays recoverable by following the chain.
Enforcement is the conversion bar. It forecloses a consuming determination from converting an abstention outcome into a scalar value, a default value, an operand of a threshold comparison (510), or a consequence adverse to any party. The foreclosure is affirmative rather than an absence of defined behavior: an outcome entry and a magnitude are values of disjoint types, and no total function maps the former to the latter. A threshold comparison of an outcome entry emits an outcome of the recorded abstention class and no Boolean; an accumulation over a set containing one emits an abstention outcome, not a sum over the remaining members. In an embodiment the type discipline is enforced statically on the agent's instructions before they execute, so a determination attempting the conversion is not constructible.
One construct crosses the boundary between parties. An agent that has written its authorization gate (300) to the withheld state (310) for an enumerated set of action classes, and has transitioned into the non-executing cognitive mode (302), emits a non-execution attestation. Its payload carries the withheld action-class enumeration, an enumerated evidentiary basis, an attested epoch drawn from the agent's own hash chain rather than from a host clock, an abstention-class type marker of the abstention type, and an express non-determination designation stating that the attestation is neither a determination nor a denial of any dispatch.
4. Applying It in Safety-Critical Autonomy
Follow a missing input through the architecture. The stage that required it emits an outcome entry of a recorded abstention class naming that input, rather than a conservative constant. Which input, which abstention class, and which consequence is foreclosed are not runtime choices; the degradation map records them, so fallback policy stops being a scattering of constants and hold logic and becomes one enumerated table.
The consuming stage does not compute on a substitute. It emits an abstention outcome of its own recorded class, and so does every stage after it, the chain accumulating in the append-only lineage field. An investigator today works backward, hunting for the moment a plausible number stopped being a measurement. Here the investigator starts at the final determination and follows the propagation chain back to the unavailable input.
At the actuation boundary, the conversion bar does the work convention used to do. A threshold comparison over an abstention outcome emits an abstention outcome, so no command is derived from an absence by way of a Boolean. The disclosed accumulation rule reaches the filtering stages: an accumulation over a window containing an abstention emits an abstention rather than a value computed over the surviving samples, so a smoothing stage cannot quietly close the gap it was asked to report. Because an abstention outcome increments no counter and moves no value of the scoped integrity vector (106), a component that abstains does not lose standing for abstaining, and the incentive described earlier is answered in the data structures rather than by policy.
Across an organizational boundary the change is larger. A supplier agent that has withheld a set of action classes announces the withholding rather than going dark. The receiving agent verifies the authority credential and continuity hash, tests the attested epoch as a valid successor, and checks that the abstention-class marker resolves within the closed enumeration declared in its own signed policy object (112). It then writes a carried abstention entry as a value of the abstention type, the designation adopted as received rather than re-derived. Thereafter its dispatch-authority predicate fails for those classes toward that party alone, recorded as a positive abstention naming the withheld dispatch, the action-class identifier, and the entry relied upon, with no determination that the dispatch was impermissible and no fault of either agent. Other classes, other counterparties, and the receiver's own execution are unaffected.
Four negative limitations hold the carried entry in place. No conversion to a scalar, a default, or a threshold operand, so no availability score, health quantity, suspicion level, or failure rate takes it as an input. No counter of the disclosing agent is incremented, the refusal counter (304) included, and nothing adverse is appended to its counterparty identity record (114). Subsequent non-response within a withheld class is recorded as a not-determinable outcome naming that class as the unavailable input, resolving nothing against either party however often it recurs.
Release is by express condition: an unmarked execution record in that class, a superseding attestation omitting it, or elapse of the time-to-live field, which is stated to be no evidence of restoration. A dispatch already in transit at admission is neither recalled nor canceled but recorded as an in-flight dispatch abstention record.
The counterparty-absence path covers a case practitioners recognize: the qualified party policy requires is not there, and no admissible remote operator or recorded member of the class exists. Such a case commonly resolves through a timeout into proceed-anyway or hard-stop, neither recorded as what it was. The disclosed third outcome is neither. The agent transitions into the non-executing cognitive mode, evaluates delegation alternatives without committing state changes, emits a structured inquiry to its principal naming the absent class and the alternatives that would satisfy it, appends the absence to the per-partition lineage record, and contracts the partition capability envelope through coupled fields until the absence is cured.
5. Limits and Deployment Realities
The architecture records absence truthfully. It does not make an absent input present, and nothing here recovers a lost sensor return.
Nor does it decide which stages ought to abstain. Some determinations must produce a bounded output at a fixed cadence whatever the input state, and placing the abstention boundary relative to the actuation layer is design work no type discipline performs for you. A map in which every stage abstains has not been designed conservatively; it has not been designed.
Propagation is contagious by construction. That is the point of it, and the thing to plan around, because a single unavailable input can terminate a pipeline. The disclosed response is the third outcome, the structured inquiry, and contraction of the capability envelope, rather than a default reintroduced at the end. Persistent unavailability is meant to reach a person: an abstention-attribution count kept per counterparty, expressly not adverse, produces a structured inquiry to the principal on exceeding a declared bound.
Static enforcement is invasive to retrofit. Disjoint types are natural in a codebase designed around them and substantial work in one that passes floating-point values through every interface. That cost is also the guarantee.
The cross-party machinery presupposes governance infrastructure rather than a message format: authority credentials, continuity hash fields, the successor-continuity test, counterparty identity records, and a signed policy object declaring the closed enumeration of abstention classes.
Two limits belong on the record. The chapter recites no timing bounds, latency figures, or real-time guarantees. And nothing here asserts conformance with any safety certification or regulatory regime; whether a lineage record satisfies a given regime is for the parties responsible under it.
6. Disclosure Scope
The mechanisms described here are disclosed in U.S. Provisional Application No. 64/117,812, Chapter 5, "Adverse-to-No-Party Abstention and the Conversion Bar," at Sections 5.1 through 5.11, together with the further embodiments at Section 10.8.
Disclosed: the adverse-to-no-party invariant, applying at each determination stage irrespective of cause, with its single reason-type-unresolved exception; the degradation map and its seven paths, each associating a stage with a required input, an abstention outcome, and a foreclosed consequence; the abstention outcome as a first-class lineage entry propagating along the abstention propagation chain without replacement, resolution, or defaulting; the conversion bar as an affirmative type-level foreclosure of conversion into a scalar, a default, a threshold operand, or an adverse consequence, including static enforcement rendering a converting determination not constructible; the third outcome upon absence of an admissible counterparty class, with the non-executing cognitive mode, the structured inquiry, and coupled contraction and restoration of the partition capability envelope; the non-execution attestation and its payload elements; admission of a carried abstention entry as a value of the abstention type, the designation adopted as received; the cross-boundary conversion bar and its four negative limitations; and the dispatch-authority predicate failing as a positive abstention, with its release conditions. Further embodiments include relay attestations, revocation objects, widening supersession, in-flight dispatch abstention records, staleness outcomes, the abstention-attribution count, and the introduction protocol curing counterparty absence.
Disclaimed: any claim to safety engineering practice at large, to fail-safe or fail-operational design as such, to sentinel values, watchdog timers, health metrics, redundancy voting, or degraded-mode management as such, and to any particular sensor, vehicle, controller, or certification process. This article applies a disclosed architecture to a domain. It asserts no infringement by any party and states no licensing requirement, and the referenced filing is a pending application.
