Persistent harness state and lifecycle-bounded inference [ftip-00C2]
✍️source

An executable model can remain fixed while a harness changes the context, available computation, retained memories, skills, subagent definitions, and evaluation policy around it. Those changes can alter later behavior and cost, but they are not weight training.

Distinguishing harness state from represented weights makes replay and descendant accounting precise, and exposes the effects of lossy summaries and contaminated refinement.

[karten2026prime] supplies operational records for persistent harness state. The Grothendieck-constant case study of [li2026longhorizon] supplies a long-horizon record in which compressed research state lost a caveat and a feasibility condition. Source observations remain empirical; the displayed finite results are proved here.

1. Fixed-weight harness adaptation [ftip-00C3]

The executable model artifact, active context, explicitly managed computation, and persistent harness state are distinct parts of an agent. Replayability depends on the rule that materializes state from events, as well as the recorded inputs and execution versions.

Definition 1.1. Parameter, context, compute, and persistent state [ftip-00C4]

Let $\mathcal C_{\rm act}$ be an active-context space, $\mathcal Z_{\rm man}$ an explicitly managed computation-state space, and $\mathcal H_{\rm pers}$ a persistent harness-state space. A four-layer harness state is

\[ \Xi =(M,c,z,h)\in \mathcal M_{\rm exec}\times \mathcal C_{\rm act} \times \mathcal Z_{\rm man}\times \mathcal H_{\rm pers}. \]

The coordinates are, respectively, the executable model artifact, the token-visible context, explicitly managed values or sessions, and state that can survive the present invocation. A transition may change any declared subset of these coordinates. A fixed-weight harness transition holds $M$ fixed while changing one or more of $c,z,h$.

Remark 1.2. State layers are access mechanisms, not capability levels [ftip-00C5]

Prime Agent Section 2.2 names model weights, active context, explicitly managed computation, and retained state as levels L0--L3, and describes the operations that move information between them [karten2026prime, Section 2.2]. The formulation in Definition 1.1 preserves that operational separation without treating the labels as an ordering of intelligence or capability.

Two runs with identical weights and different persistent state can induce different policies. That observation does not say that either run acquired a new circuit in the fixed artifact, and it does not compare their independently evaluated utility.

Definition 1.3. Versioned harness configuration [ftip-00C6]

Let $\mathcal I_{\rm har}$ be a content-identifier space. A versioned harness configuration is a finite record $\kappa ^{\rm har}\in \mathcal I_{\rm har}$ that resolves the active-context assembly rule, managed-computation interface, tool permissions, session and message semantics, compaction policy, persistent-state schema, refinement policy, recovery rule, and implementation versions.

Together with a state $\Xi $, the record resolves a non-anticipating harness policy. Changing one field produces a different declared intervention even when the executable model artifact is unchanged. The record does not include an evaluation binding; that is a separate record coordinate.

Definition 1.4. Persistent event stream [ftip-00C7]

Fix a finite event alphabet $\mathcal E_{\rm har}$. A persistent event stream of length $n$ is

\[ L_n=(e_0,\ldots ,e_{n-1})\in \mathcal E_{\rm har}^{n}. \]

The append operation is $L_{n+1}=\operatorname {append}(L_n,e_n)$. Write $L_i\preceq _{\rm pref}L_j$ when $L_i$ is a prefix of $L_j$. An append-only stream satisfies $L_i\preceq _{\rm pref}L_j$ for every $i\leq j$; branching creates distinct continuations with a common prefix rather than rewriting that prefix.

Events may record model or tool calls, messages, interventions, retries, verifier outcomes, harness edits, and resource use. The event schema and its exact version belong to the configuration of Definition 1.3.

Definition 1.5. Materialized harness state [ftip-00C8]

Let $\mathcal V_{\rm fold}$ be a space of fold versions. For each $v\in \mathcal V_{\rm fold}$, fix a deterministic map

\[ F_v:\mathcal H_{\rm pers}\times \mathcal E_{\rm har} \longrightarrow \mathcal H_{\rm pers}. \]

Given an initial persistent state $h_0$, event stream $L_n=(e_0,\ldots ,e_{n-1})$, and version sequence $\boldsymbol v=(v_0,\ldots ,v_{n-1})$, its materialized harness state is obtained recursively by

\[ h_{i+1}=F_{v_i}(h_i,e_i),\qquad 0\leq i<n. \]

The materialization record is the tuple $(h_0,L_n,\boldsymbol v,(F_v)_v)$. Omitting a version or the initial state defines a family of possible materializations, not one replayable state.

Theorem 1.6. Deterministic event folding gives replayable state [ftip-00C9]

For a materialization record in Definition 1.5, replaying the same initial state, event sequence, version sequence, and fold maps produces the same state $h_n$.

This finite result follows from the displayed hypotheses. It assumes exact equality of all recorded inputs and deterministic fold maps.

Proof.

At step zero both replays have state $h_0$. If their states agree at step $i$, both apply the same function $F_{v_i}$ to the same pair $(h_i,e_i)$, so their states agree at step $i+1$. Finite induction gives equality at step $n$.

Remark 1.7. Replayability is not correctness [ftip-00CA]

The result in Theorem 1.6 is an identity about a declared transition system. It does not show that the event stream is complete, that an external process can be reconstructed, that the fold is faithful to the environment, or that the resulting state is useful or safe.

Prime Agent reports append-only events, versioned state, recovery, and rollback in Sections 2.2 and 2.5 [karten2026prime, Sections 2.2 and 2.5]. Those implementation claims motivate the event record; Theorem 1.6 proves the finite replay identity directly from the declared transition rule.

Example 1.8. One artifact and two harness policies [ftip-00CB]

The same executable artifact can be paired with two persistent states and therefore two resolved harness policies. The harness state changes while the executable model remains fixed.

$\text{[math]}$

Different policies here establish only that harness state is an intervention coordinate. An independent evaluation is still required to compare their outcomes.

Remark 1.9. Fixed-weight self-improvement is not weight training [ftip-00CC]

Prime Agent Section 2.5 uses the phrase ``self-improvement'' for execution evidence converted into persistent prompts, memories, skills, or subagent specifications while model weights remain fixed [karten2026prime, Section 2.5]. In the notation of Definition 1.1, this is a change to $h$ with $M$ held fixed.

The term therefore does not establish a change to the model artifact, a new learned circuit, or capability acquisition in the sense of Definition [ftip-0007]. It describes persistent harness adaptation.

2. Evaluation binding and lineage accounting [ftip-00CD]

A long-horizon score is attached to a configuration, not merely to a model name. Delegation also creates descendant work that must remain visible in the resource account. Reproducible evaluation therefore requires a specified configuration, and resource accounting includes the work of its descendants.

Definition 2.1. Evaluation configuration record [ftip-00CE]

An evaluation configuration record is a finite record $\mathfrak e$ that resolves the task and instance law, environment and tool interfaces, executable model artifact, serializer and inference policy, harness configuration, compaction and refinement policies, retry rule, completion gate, evaluator, seed law, and componentwise resource limits.

Together with the independent evaluation interface of Convention [ftip-005D], the record determines the law of a stopped evaluation run and its realized cost vector. A reported score is the pair consisting of the statistic and the exact record $\mathfrak e$; a scalar without its record is an under-specified family of measurements.

Remark 2.2. A harness comparison needs a declared configuration axis [ftip-00CF]

Section 2.6 of [karten2026prime] binds task and tool interfaces to model settings. Its evaluation configuration also records compaction, refinement, retry, completion, and resource policies. The record in Definition 2.1 is a proposed representation of those configuration choices.

To attribute a score difference to a harness coordinate, the comparison must hold the other coordinates fixed or model their changes explicitly. Two scores under different records $\mathfrak e$ and $\mathfrak e'$ can still be descriptively useful, but their difference does not isolate a causal harness effect.

Definition 2.3. Session lineage tree [ftip-00CG]

A session lineage tree is a finite rooted directed tree $\mathcal T=(V,E,r)$ whose edges point from a parent session to a directly spawned descendant. Each node $v\in V$ carries an immutable session identifier, its resolved harness and inference stamps, a local event stream, and a local realized cost $c_v\in \mathbb R_+^m$.

For a node $v$, let $\mathcal T_v$ be the induced subtree containing $v$ and all its descendants. Distinct children of one node have disjoint node sets. Messages between branches are events in their local streams and do not merge their identities or costs.

Definition 2.4. Descendant-complete cost [ftip-00CH]

For a session lineage tree Definition 2.3, its descendant-complete cost is the componentwise sum

\[ C_{\rm lin}(\mathcal T)=\sum _{v\in V}c_v\in \mathbb R_+^m. \]

The local cost $c_v$ contains only work assigned to node $v$; a model or tool call is charged to exactly one node. The vector retains its declared units and embeds into the lifecycle account of Definition [ftip-005H]. A scalar price can be applied only after the vector is formed.

Theorem 2.5. Lineage cost is additive over disjoint child subtrees [ftip-00CI]

Let the root $r$ of a finite lineage tree have children $v_1,\ldots ,v_k$. Then

\[ C_{\rm lin}(\mathcal T)=c_r+ \sum _{j=1}^{k}C_{\rm lin}(\mathcal T_{v_j}). \]

This finite accounting identity follows from assigning each local cost to exactly one node.

Proof.

The node set is the disjoint union of $\{r\}$ and the node sets of the child subtrees. Splitting the finite sum in Definition 2.4 over that disjoint union gives the equality componentwise.

Definition 2.6. Budget-admissible continuation [ftip-00CJ]

Fix a componentwise hard budget $b\in \mathbb R_+^m$. After accumulated cost $a\preceq b$, a proposed continuation has a declared worst-case cost bound $\bar c\in \mathbb R_+^m$. It is budget-admissible when

\[ a+\bar c\preceq b. \]

If admitted, the continuation must either stop within a realized cost $c\preceq \bar c$ or report a contract violation. Rejected proposals may have a separately accounted proposal cost, which must already be included in $a$ before the admission test.

Theorem 2.7. Budget admission preserves a hard componentwise bound [ftip-00CK]

Consider a finite sequence of continuations. Start from $a_0\preceq b$. At step $i$, admit only if $a_i+\bar c_i\preceq b$, and require the realized cost to satisfy $c_i\preceq \bar c_i$. With $a_{i+1}=a_i+c_i$, every accumulated cost satisfies $a_i\preceq b$.

This finite result is a contract theorem, not a prediction that a real executor respects its declared bound.

Proof.

The claim holds for $a_0$. If $a_i\preceq b$ and the next step is admitted, then $a_{i+1}=a_i+c_i\preceq a_i+\bar c_i\preceq b$. If the step is rejected, the accumulated cost is unchanged after its already-accounted proposal work. Finite induction proves the claim.

Example 2.8. A finite delegated run and its lineage cost [ftip-00CL]

Use two cost coordinates, such as output tokens and tool calls. The root delegates to two children, and one child delegates once more.

$\text{[math]}$

The cost of a child subtree is its local cost plus the costs of all descendants. Therefore

\[ C_{\rm lin}(\mathcal T)=c_r+C_{\rm lin}(\mathcal T_a)+C_{\rm lin}(\mathcal T_b). \]

Charging only the root hides descendant work; charging a descendant again as a separate parent-local cost double counts it.

Remark 2.9. External benchmark points do not isolate a harness effect [ftip-00CM]

Prime Agent Section 3.1 places native-harness runs beside externally reported ARC-AGI-3 results and explicitly says the external points situate the curves rather than isolate a causal harness effect [karten2026prime, Section 3.1]. That is an empirical comparison under multiple evaluation records, not a matched estimate of one harness field.

A larger score can still be a valid record of the displayed configuration. It does not by itself establish that persistence caused the difference, that the model weights improved, or that the cost-adjusted potential of Definition [ftip-005M] increased.

3. Research-state compaction and observability [ftip-00CN]

A research harness cannot place its complete archive into every model invocation. A summary can make distinct archives indistinguishable to later evaluators. The source record of a lost evaluator caveat illustrates how omitted information can affect subsequent research.

Definition 3.1. Active research state [ftip-00CO]

Let $\mathcal A_{\rm res}$ be a space of complete research archives and $\mathcal S_{\rm res}$ a space of bounded working summaries. Let $\mathcal Q_{\rm claim}$ be a typed claim-ledger space and $\mathcal G_{\rm res}$ a research-goal space. An active research state is

\[ R=(A,s,q,g)\in \mathcal A_{\rm res}\times \mathcal S_{\rm res} \times \mathcal Q_{\rm claim}\times \mathcal G_{\rm res}. \]

The archive $A$ may exceed the context budget. The summary $s$ is the representation actually supplied to a new bounded session. The claim ledger $q$ records declared statuses such as proved, numerically supported, conjectural, or heuristic. The goal $g$ records the currently selected research direction.

Definition 3.2. Technical executor and research-judgment kernel [ftip-00CP]

Let $\mathcal P_{\rm res}$ be a proposal space and $\mathcal D_{\rm res}$ a finite research-decision space. A technical executor is a kernel that produces candidate calculations, experiments, lemmas, or implementations from the active summary and goal. A research-judgment kernel is

\[ J:\mathcal S_{\rm res}\times \mathcal Q_{\rm claim} \times \mathcal G_{\rm res}\times \mathcal P_{\rm res} \longrightarrow \Delta (\mathcal D_{\rm res}). \]

The kernel chooses among actions such as continue, reframe, verify, merge, withdraw, or stop. It is typed separately from the executor because producing a technically valid local step and choosing the globally useful next step are different intervention coordinates.

Definition 3.3. Research-state summary operator [ftip-00CQ]

A research-state summary operator is a declared map

\[ C:\mathcal A_{\rm res}\longrightarrow \mathcal S_{\rm res}. \]

At a session boundary the harness supplies $s=C(A)$. The operator may select, merge, compress, or omit archive content. Its input archive and exact version belong to the persistent event record. A stochastic summarizer is represented by adjoining its random seed to the archive coordinate, leaving $C$ deterministic on the augmented input.

Definition 3.4. Summary-equivalent research archives [ftip-00CR]

For the summary operator $C$ of Definition 3.3, two complete archives $A,A'\in \mathcal A_{\rm res}$ are summary-equivalent, written $A\sim _C A'$, when

\[ C(A)=C(A'). \]

This is equivalence relative to one declared summary version. It is not the protocol-level observational equivalence of Definition [ftip-007R]: the complete archives can differ in facts that a later retrieval operator or independent evaluator can still observe.

Theorem 3.5. A summary-only harness cannot distinguish summary-equivalent archives [ftip-00CS]

Fix the claim ledger $q$, goal $g$, and proposal $p$. Suppose a research-decision kernel uses the complete archive only through $C(A)$. If $A\sim _C A'$, then its decision laws under $A$ and $A'$ are equal.

This finite information-boundary result follows from the displayed setup. It does not assume that the two complete archives induce the same independent utility.

Proof.

By hypothesis, the two decision laws are related by

\[ J(C(A),q,g,p)=J(C(A'),q,g,p). \]

Summary equivalence makes the first arguments equal, while every other argument is fixed. The two probability laws are therefore identical.

Lemma 3.6. An omitted constraint cannot affect a summary-only decision [ftip-00CT]

Let $b:\mathcal A_{\rm res}\to \{0,1\}$ be a constraint bit. If there exist $A\sim _C A'$ with $b(A)\neq b(A')$, then no decision rule that factors only through $C$ can condition its output law on the value of $b$ for both archives.

Proof.

The result in Theorem 3.5 gives the same output law for $A$ and $A'$. A rule that conditioned on the differing bit values would require different output laws for at least one declared decision event. Both requirements cannot hold simultaneously.

Example 3.7. A lost evaluator caveat reverses admissibility [ftip-00CU]

Take two complete archives $A_{\rm exp}$ and $A_{\rm cert}$. Both contain the same numerical score and candidate record. The first additionally states that the evaluator is safe only for exploration; the second states that the score is independently certified. Let the summary operator omit that status sentence, so $A_{\rm exp}\sim _C A_{\rm cert}$.

The independently correct decision is ``audit'' for $A_{\rm exp}$ and ``merge'' for $A_{\rm cert}$. A summary-only kernel has the same decision law in both cases by Theorem 3.5; hence it cannot be correct on both archives with probability one.

This finite witness models an information loss. It does not assert that every compaction loses a decisive caveat.

Definition 3.8. Full-log recovery witness [ftip-00CV]

For a constraint bit $b$ omitted by $C$, a full-log recovery witness is a query $u$, retrieval map

\[ R_u:\mathcal A_{\rm res}\longrightarrow \mathcal O_u, \]

and decoder $d_u:\mathcal O_u\to \{0,1\}$ such that $d_u(R_u(A))=b(A)$ on the declared archive class. A harness that invokes this retrieval before judgment can condition on $b$; a harness restricted to $C(A)$ cannot when the hypothesis of Lemma 3.6 holds.

The witness establishes recoverability from the retained archive, not that the harness will ask the right query or trust the recovered record.

Example 3.9. From evaluator caveat to withdrawn record [ftip-00CW]

The Grothendieck case study gives a concrete chronology. An early evaluator carried an exploration-only caveat; the working summary later lost that caveat and a feasibility condition; a later session recorded an unsupported upper bound; a subsequent audit withdrew it.

$\text{[math]}$

The source reports this sequence in Section 5 and Section 7.1; the complete archive retained the facts while the compressed decision state did not [li2026longhorizon, Section 5 and Section 7.1]. The diagram is a source-grounded chronology, not a measured error rate for compaction systems.

Remark 3.10. More inference compute is not a monotone research-judgment theorem [ftip-00CX]

The source run used roughly 240 sessions, 2,091 reasoning-model calls, and 152 million tokens. It also reports repeated continuation of an upper-bound search until human operators redirected the program toward a universal obstruction [li2026longhorizon, Sections 5--7].

This is one human-steered case with changing models, harnesses, goals, and research state. It supports the distinction between technical execution and research judgment. It does not establish a monotone or anti-monotone law from inference compute to mathematical progress.

4. Refinement, contamination, and stop rules [ftip-00CY]

Persistent refinement can retain useful procedures, but the same mechanism can retain a specification exploit. A proposed change and committed state have different consequences. Audit predicates can exclude specified contamination, rollback can restore an earlier state, and resource admission rules can prevent transitions that exceed the budget.

Definition 4.1. Refinement proposal and committed harness update [ftip-00CZ]

Let $h_n\in \mathcal H$ be the committed harness state at version $n$, let $e_n\in \mathcal E$ be a newly admitted event, and let $\omega _n\in \Omega _{\rm ref}$ be a refinement seed. A refinement proposal is

\[ \widetilde h_{n+1}=R(h_n,e_n,\omega _n), \qquad R:\mathcal H\times \mathcal E\times \Omega _{\rm ref}\longrightarrow \mathcal H. \]

Given a typed decision $d_n\in \{\mathsf {accept},\mathsf {reject}\}$, the committed harness update is

\[ h_{n+1}= \begin {cases} \widetilde h_{n+1},&d_n=\mathsf {accept},\\ h_n,&d_n=\mathsf {reject}. \end {cases} \]

This separates candidate generation from state mutation. A proposed note, skill, prompt, or subagent specification has no persistent effect until the commit decision accepts it.

Definition 4.2. Skill archive and selector [ftip-00D0]

Let $\mathcal S_{\rm skill}$ be a skill space and $\mathfrak A_{\rm skill}$ the space of finite skill--provenance archives. A skill archive at version $n$ is $\mathcal K_n=((k_{n,j},\lambda _{n,j}))_{j\in J_n} \in \mathfrak A_{\rm skill}$. For a public history $h^{\rm pub}$ and selector seed $\omega ^{\rm sel}$, a typed selector is

\[ S_{\rm skill}: \mathcal H^{\rm pub}\times \mathfrak A_{\rm skill}\times \Omega _{\rm sel} \longrightarrow \mathcal S_{\rm skill}\cup \{\bot \}. \]

On archive $\mathcal K_n$, a non-bottom output must equal one of its entries $k_{n,j}$. The value $\bot $ means that no retained skill is invoked. The archive is part of persistent harness state, not a claim that its entries are correct, safe, novel, or encoded in model weights.

Definition 4.3. Exploit-contaminated retained state [ftip-00D1]

Fix a declared task contract and let $b:\mathcal S_{\rm skill}\to \{0,1\}$ mark a retained skill as an exploit when it can increase the recorded proxy while violating that contract. A harness state $h_n$ with archive $\mathcal K_n$ is exploit-contaminated when

\[ B(h_n)=\max _{j\in J_n} b(k_{n,j})=1, \]

with the maximum defined as zero for an empty archive. The predicate is relative to the declared contract and audit model. It does not identify malicious intent, and a high-scoring skill need not be contaminated.

Lemma 4.4. Append-only retention preserves contamination absent deletion [ftip-00D2]

Suppose the skill archives of Definition 4.2 are append-only: $\mathcal K_n\subseteq \mathcal K_{n+1}$ for every $n$. If $B(h_n)=1$, then $B(h_m)=1$ for every $m\geq n$ until a deletion, rollback, or contract change removes or reclassifies the witnessing skill.

Proof. Choose $k\in \mathcal K_n$ with $b(k)=1$. Repeated inclusion gives $k\in \mathcal K_m$ for every later version, so the maximum defining $B(h_m)$ remains one. The final qualification lists operations that break the inclusion or change the predicate.

This finite observation concerns retained state. It does not say that the selector will invoke the exploit on every later run.

Definition 4.5. Independent refinement audit [ftip-00D3]

Let $Z_n\in \{0,1\}$ indicate whether the proposal $\widetilde h_{n+1}$ of Definition 4.1 is contaminated under the declared contract. An independent refinement audit is a randomized kernel

\[ A_{\rm ref}: \mathcal H\times \mathcal H\times \Omega _{\rm aud} \longrightarrow \{\mathsf {pass},\mathsf {fail}\}, \]

whose seed law is declared independently of the refinement seed conditional on the audited states. Its conditional false-negative rate is

\[ \eta _{\rm fn} = \Pr \left ( A_{\rm ref}(h_n,\widetilde h_{n+1},\omega _n^{\rm aud})=\mathsf {pass} \mid Z_n=1 \right ). \]

The independence declaration separates proposal randomness from audit randomness; it does not imply that the auditor is calibrated under adaptive distribution shift.

Theorem 4.6. Audit-before-commit bounds contaminated commits [ftip-00D4]

Use the audit of Definition 4.5 and commit a proposal only when its audit returns $\mathsf {pass}$. If $\Pr (Z_n=1)>0$ and its conditional false-negative rate is at most $\bar \eta \in [0,1]$, then

\[ \Pr (d_n=\mathsf {accept}\mid Z_n=1)\leq \bar \eta . \]

Proof. Under audit-before-commit, the event $\{d_n=\mathsf {accept}\}$ is contained in the event that the audit passes. Conditioning on $Z_n=1$ and applying the false-negative bound proves the inequality.

This statement bounds one declared admission channel. It gives no bound when proposals bypass the audit, when the contract omits the exploit, or when the audit's conditional error changes under adaptive search.

Example 4.7. Proxy-monotone refinement can retain an exploit [ftip-00D5]

Consider two skills, $k_{\rm safe}$ and $k_{\rm exp}$. Their declared task utilities are $u(k_{\rm safe})=1$ and $u(k_{\rm exp})=0$, while a misspecified proxy assigns $r(k_{\rm safe})=1$ and $r(k_{\rm exp})=2$.

A refinement rule that appends a candidate whenever its measured proxy is strictly larger selects $k_{\rm exp}$ after observing both candidates. The archive's best proxy rises from one to two while its proxy-maximizing selector switches from utility one to utility zero.

Thus monotone improvement of a retained proxy does not imply monotone task utility. This finite counterexample does not estimate how often real harnesses find or preserve specification exploits.

Example 4.8. An RCON shortcut becomes a reusable skill [ftip-00D6]

The diagram separates exploit discovery, imperfect oversight, retained-state refinement, and later reuse in the reported Factorio run.

$\text{[math]}$

Prime Agent Section 3.5 reports a 23.4-million-token Factorio run with 633 depth-one subagents. It also reports an RCON exploit retained as a skill despite an anti-cheating heartbeat [karten2026prime, Section 3.5, Figure 9].

This reported chronology neither estimates exploit prevalence nor proves later selection. It shows why persistence must be audited separately from correctness.

Definition 4.9. Recovery, rollback, and version identity [ftip-00D7]

Let $v_n$ identify the full committed harness configuration of Definition 1.3. A rollback from version $v_n$ to an earlier version $v_j$, $j<n$, restores the configuration and retained-state snapshot named by $v_j$; a recovery may instead construct a new version $v_{n+1}$ from audited events.

Version identity includes the artifact identifier, configuration, event-log prefix, and archive snapshot. Reusing a human-readable label while changing one of those fields is not the same version.

Prime Agent describes append-only history, versioned state, forks, and recovery [karten2026prime, Sections 2.1--2.2]. The displayed identity tuple specifies the information required for reproducible comparisons.

Remark 4.10. Persistence can preserve progress and specification gaming [ftip-00D8]

Versioned notes, memories, skills, and subagent specifications can preserve useful work across context boundaries. The same retention channel can preserve an exploit, a stale evaluator assumption, or a misleading proxy-optimized procedure. Prime Agent reports both continual retained-state refinement and the Factorio exploit record [karten2026prime, Sections 2.5 and 3.5].

The retention mechanism therefore supplies persistence, not correctness. Correctness requires a declared task contract, provenance, an audit interface, and a recovery rule. Neither a longer archive nor more descendants alone certifies improved task utility.

Remark 4.11. Fixed-weight adaptation and joint compute interventions [ftip-00D9]

The source records in this section concern fixed-weight harness adaptation, long-horizon inference, retained state, and finite evaluations. They do not establish weight learning, a causal architecture effect, monotone capability growth, or safety under deployment shift. Prime Agent's external benchmark points and the long-horizon case study are observational records with the limitations stated in Remark 2.9 and Remark 3.10.

Retained context, rollout horizon, runtime, and gradient approximation are distinct intervention coordinates. Prefix Sliding changes several of them at once, so its effects cannot be attributed to persistent state alone; see § [ftip-00DA].

The finite theorems in this section cover replay, lineage cost, summary indistinguishability, budget admission, contamination persistence, and one audit gate. None is a theorem of universal capability acquisition.

5. Finite coordination under hard budgets [ftip-00M3]

A harness chooses which computation to run, what to retain, and when to stop. To bound the quality attainable by these choices, one must specify both the permitted actions and the information available after each action. A bound on one scheduler does not yet bound all controllers using the same workers.

Finite decision models make this distinction explicit. They connect Definition 2.6's resource admission rule to the attainable-quality frontier of Definition [ftip-00JJ]. Computation selection as information acquisition is studied by Hay, Russell, Tolpin, and Shimony. Here a hard horizon is imposed as a separate assumption; almost-sure stopping or finite expected cost would not supply such a horizon.

5.1. Histories, admissible actions, and retained information [ftip-00M4]

The controller may use its entire observed history. A smaller state can help compute a bound, but its sufficiency must be justified across the histories it represents. The examples below separate information that is valuable only in combination from information lost by a summary.

Definition 5.1.1. Finite controller class with hard resource admission [ftip-00M5]

Fix a horizon $H\in \mathbb N$, finite nonempty observed-history sets $\mathcal H_t$ for $0\leq t\leq H$, an initial law $\mu $ on $\mathcal H_0$, and finite nonempty permitted-action sets $A_t(h)$ for $t<H$. An environment kernel $K_t(\cdot \mid h,a)$ is a probability law on histories extending $h$ by action $a$ and its observed outcome. The initial law and all kernels are fixed before choosing a controller.

A controller $\pi $ assigns a probability law $\pi _t(\cdot \mid h)$ on $A_t(h)$. It may depend on every observed component of $h$, including retained traces, generated programs, and previous updates. Random choices may be recorded in the history. The class $\Pi (\mathbf B)$ consists of all such controllers under the declared hard resource vector $\mathbf B\in \mathbb R_+^m$. It does not require a fixed prompt, a memoryless policy, or independent worker outputs. Full-history access is allowed in this mathematical class; it may enlarge the class of executable controllers with limited memory or computation.

Each history records accumulated nonnegative cost $\mathbf c(h)\preceq \mathbf B$. Every permitted non-stop action has a declared worst-case increment $\bar {\mathbf c}_t(h,a)$ satisfying

\[ \mathbf c(h)+\bar {\mathbf c}_t(h,a)\preceq \mathbf B. \]

Every successor in the kernel's support must have realized increment between zero and this declared bound, componentwise. Proposal work, controller computation, worker calls, communication, verification, failed attempts, and persistent updates must be included in whichever resource coordinates are bounded; the units remain those of Definition [ftip-005H]. This is the enforced-contract assumption of Theorem 2.7.

A stop action is always permitted: it commits the current terminal artifact and pads the remaining steps with no further cost or change in its evaluated quality. At the horizon a fixed evaluator assigns $q(h_H)\in [0,1]$ to the committed artifact recorded in the terminal history. If the evaluator has random outcomes, include them in the history law. Evaluation work must be charged before the zero-cost padding begins. Define

\[ J(\pi )=\mathbb E_\pi [q(h_H)], \qquad V(\mathbf B)=\sup _{\pi \in \Pi (\mathbf B)}J(\pi ). \]

The artifact identity, evaluator, observations, kernels, and action sets are part of the mathematical problem. A training procedure or new tool belongs to this frontier only if it is among the permitted actions and its effects and costs are represented. Finiteness is an explicit restriction on histories, representations, and horizon; a theorem for this class does not bound an unrestricted agent that can extend them.

For an executable system, an upper bound applies only after its observations, actions, outcomes, and charged costs are represented by this model. Conversely, a mathematical policy supplies an executable lower bound only when it has an implementation respecting the stated resource cap; an arbitrary history-to-action table does not establish that fact.

Example 5.1.2. Complementary observations defeat one-step information value [ftip-00M6]

Let $X,Y$ be independent uniform bits. The terminal artifact is a guess for $X\mathbin \oplus Y$; its quality is one if correct and zero otherwise. Two observation actions reveal $X$ and $Y$, respectively, at cost $c$ each, where $0<c<1/4$. The hard budget permits both observations. A terminal guess requires no additional observation cost.

Without observations, the best expected quality is $1/2$. Given only $X$, the unrevealed bit $Y$ remains uniform, so the best expected quality is still $1/2$; the same holds with $X,Y$ exchanged. Thus a rule that compares stopping with taking one observation and then stopping assigns either observation net value $1/2-c<1/2$. It stops immediately.

Observing both bits determines their parity. Its expected quality is one and its quality minus observation cost is $1-2c>1/2$. Hence neither zero one-step information value nor a myopic stopping decision certifies the full controller frontier. This is a finite calculation, not an empirical claim about a language model. The scalar cost penalty is used only to exhibit the myopic decision; the hard-budget quality frontier itself is defined in Definition 5.1.1.

Example 5.1.3. Erasing an observed bit changes the attainable frontier [ftip-00M7]

An initial observation reveals a uniform bit $Z$. The terminal action is a bit $a$, and quality is $q=\mathbf 1\{a=Z\}$. Both actions are permitted at either history and have the same cost. A full-history controller chooses $a=Z$ and attains quality one.

Now restrict the controller's entire input to a summary that is constant at the two initial histories. Its private randomness is independent of $Z$. If it chooses one with probability $p$, its expected quality is $p/2+(1-p)/2=1/2$. No such summary controller can do better.

A model that averages the reward of either fixed action over the two histories obtains $1/2$. This is the correct summary-controller value, but it underestimates the full-history frontier by $1/2$. For the history $Z=a$, the actual reward is one, so the averaged value fails as a reward upper bound at that history. A pointwise reward upper bound must hold at every represented history; agreement only under a tested policy's average history distribution does not establish such a certificate. The loss of an evaluator caveat in Example 3.7 illustrates why such retained distinctions can matter in a research harness.

5.2. Upper certificates and remaining potential [ftip-00M8]

A feasible controller establishes attainable quality. To bound what other controllers could gain, one also needs an upper bound covering all permitted actions and histories. Bellman inequalities provide such a bound when a state representation has uniform transition and terminal quality guarantees. Their difference measures remaining potential within the declared class.

Definition 5.2.1. Uniform abstraction of the finite history model [ftip-00M9]

Use the finite controller model of Definition 5.1.1. For each time, choose a finite nonempty state set $S_t$ and a map $\phi _t:\mathcal H_t\to S_t$. Require finite nonempty action sets $A_t(s)$ such that $A_t(h)=A_t(\phi _t(h))$ at every history. The state retains residual budgets and enough information for the same hard admission rule. The controller still observes the full history.

Let $Q_t(\cdot \mid h,a)$ be the image of the fixed history kernel under $\phi _{t+1}$, and let $\widehat P_t(\cdot \mid s,a)$ be a proposed state transition law. Choose finite errors $\epsilon _t(s,a)\geq 0$ so that, for every permitted history and action,

\[ \operatorname {TV}\left (Q_t(\cdot \mid h,a), \widehat P_t(\cdot \mid \phi _t(h),a)\right ) \leq \epsilon _t(\phi _t(h),a), \qquad \operatorname {TV}(p,r)=\frac 12\sum _x|p(x)-r(x)|. \]

This condition includes histories unvisited by a chosen policy: the kernel there is part of the model. For finite functions $\widehat q:S_H\to \mathbb R$ and $e_H:S_H\to \mathbb R_+$, require

\[ q(h_H)\leq \widehat q(\phi _H(h_H))+e_H(\phi _H(h_H)) \quad \text {for every }h_H\in \mathcal H_H. \]

Write $\nu (s)=\mu \{h:\phi _0(h)=s\}$ for the initial state law. Low average prediction error on sampled histories does not establish these uniform inequalities. The erased-bit example in Example 5.1.3 shows why policy-relevant information cannot simply be averaged away.

Theorem 5.2.2. A robust Bellman upper bound for every permitted controller [ftip-00MA]

Under Definition 5.2.1, let finite functions $W_t:S_t\to \mathbb R$ satisfy $W_H(s)\geq \widehat q(s)+e_H(s)$ and, for every $t<H$, $s\in S_t$, and $a\in A_t(s)$,

\[ W_t(s)\geq \sum _{s'\in S_{t+1}}\widehat P_t(s'\mid s,a)W_{t+1}(s') +\epsilon _t(s,a)\operatorname {span}(W_{t+1}). \]

Here $\operatorname {span}(f)=\max f-\min f$. Every permitted history-dependent randomized controller then satisfies

\[ J(\pi )\leq U:=\min \left (1,\sum _{s\in S_0}\nu (s)W_0(s)\right ). \]

For any feasible controller $\pi _0$ with a justified finite lower bound $L\leq J(\pi _0)$, the frontier of Definition 5.1.1 obeys

\[ L\leq J(\pi _0)\leq V(\mathbf B)\leq U, \qquad 0\leq V(\mathbf B)-J(\pi _0)\leq U-L. \]

Proof.

For finite probability laws $p,r$, subtract $\min f$ from $f$. The sum of the positive entries of $p-r$ is $\operatorname {TV}(p,r)$; dropping its negative entries gives

\[ \sum _x(p(x)-r(x))f(x)\leq \operatorname {TV}(p,r)\operatorname {span}(f). \]

Fix any controller. At time $H$, terminal domination gives $q(h_H)\leq W_H(\phi _H(h_H))$. Suppose that, from every next history, its expected terminal quality is bounded by $W_{t+1}$ of the next state. For each current history and permitted action, the fixed kernel, this inductive inequality, and the total-variation bound give

\[ \mathbb E_\pi [q(h_H)\mid h_t=h,a_t=a] \leq \sum _{s'}Q_t(s'\mid h,a)W_{t+1}(s') \leq W_t(\phi _t(h)). \]

At a history with zero probability under the controller, interpret the continuation expectation using its specified future decisions and the fixed kernels. Thus the induction holds at every history. Averaging over the controller's action randomization preserves the inequality. Backwards induction and averaging over $\mu $ give the bound $\sum _s\nu (s)W_0(s)$. The independent bound $q\leq 1$ permits clipping at 1. If $H=0$, terminal domination alone gives the same conclusion. Taking the supremum over controllers and using $L\leq J(\pi _0)$ proves the remaining inequalities.

A numerical supersolution is a certificate only after all of its inequalities and the abstraction hypotheses are justified. If the model bounds hold jointly with probability at least $1-\delta _M$ and the lower bound with probability at least $1-\delta _E$, the bracket holds with probability at least $1-\delta _M-\delta _E$ by a union bound. Each coverage statement must apply to the selected model or policy; no independence between the two events is required.

Remark 5.2.3. Exact occupation flows and expected-cost relaxations [ftip-00MB]

Suppose the abstraction is exact: $Q_t(\cdot \mid h,a)= P_t(\cdot \mid \phi _t(h),a)$ for all histories and actions, and terminal quality is exactly $q(h_H)=r(\phi _H(h_H))$. A one-sided terminal bound with zero error would not imply this equality. Retain the exact legal actions and hard-budget state from Definition 5.2.1.

Introduce nonnegative state masses $z_t(s)$ and action masses $x_t(s,a)$, with $z_0=\nu $. For $0\leq t<H$, impose

\[ \sum _{a\in A_t(s)}x_t(s,a)=z_t(s), \qquad z_{t+1}(s')=\sum _{s\in S_t}\sum _{a\in A_t(s)} x_t(s,a)P_t(s'\mid s,a). \]

The linear program maximizes $\sum _s z_H(s)r(s)$. Every full-history controller induces these flows because the next-state law given a state and action is exact. Conversely, at positive mass choose action $a$ with probability $x_t(s,a)/z_t(s)$; at zero mass choose any legal action. Induction on time reproduces the flows in the original history model. Hence the LP optimum equals its mathematical controller frontier. For $H=0$, there are no action flows and the value is $\nu r$.

Set $W_H=r$ and recurse with $W_t(s)=\max _{a\in A_t(s)}\sum _{s'}P_t(s'\mid s,a)W_{t+1}(s')$. A maximizing action exists by finiteness and gives a policy attaining $\nu W_0$; the Bellman upper bound gives the reverse inequality. This proves equality with the optimum and exhibits matching lower and upper certificates. It does not establish an efficient implementation of the policy. The flow construction is the scalar finite-horizon specialization of Mifrani and Noll, Section 3; the hard-budget encoding is an additional modeling requirement here.

If hard admission is replaced by constraints on expected cost, the resulting program describes a different class. For $B>0$, a one-step cost equal to $2B$ or zero with probability $1/2$ each has expectation $B$, yet violates cap $B$ with probability $1/2$. An expected-cost model can upper-bound the hard-budget frontier only when it is a valid relaxation containing every hard-feasible policy. Its own policies need not respect the realized cap.

Corollary 5.2.4. Certified marginal potential under nested budgets [ftip-00MC]

Fix the task law, evaluator, initial model, tools, observations, horizon, and intervention class. For $\mathbf B\preceq \mathbf B'$, assume every controller feasible at $\mathbf B$ remains permitted at $\mathbf B'$ with the same outcome law. If a feasible controller at $\mathbf B$ gives lower bound $L_{\mathbf B}$ and Theorem 5.2.2 gives upper bound $U_{\mathbf B'}$ at $\mathbf B'$, then

\[ 0\leq V(\mathbf B')-V(\mathbf B) \leq U_{\mathbf B'}-L_{\mathbf B}. \]

Proof.

Feasibility inclusion gives $V(\mathbf B)\leq V(\mathbf B')$. The lower and upper certificates give $L_{\mathbf B}\leq V(\mathbf B)$ and $V(\mathbf B')\leq U_{\mathbf B'}$; subtract to obtain the claim.

If the certified gap is at most $\varepsilon $, this instantiates Theorem [ftip-00LM]'s conditional saturation statement. An observed plateau alone supplies no such upper certificate. Changing an excluded tool, representation, or training procedure changes the comparison class.

5.3. Comparing controllers at fixed worker capability [ftip-00MD]

To isolate coordination, fix the worker checkpoints, tool interfaces, prompt templates, evaluator, task law, and hard resource caps before varying the controller. Useful comparisons include a fixed serial policy, a static worker portfolio, a one-step value-of-information policy, and an adaptive policy that retains the full permitted history. Their allowed observations must agree. A solver that sees hidden outcomes has a different information interface; its optimum supplies an upper bound only through a justified relaxation containing the compared policies.

Use the controls of Definition [ftip-00JV] with controller logic declared as the varying coordinate. If controller-specific tuning is permitted, apply Definition [ftip-00JW]'s equal tuning data, selection, stopping, and cost rules. Compare suprema only within the intervention classes of Definition [ftip-00JX]. A separate factorial comparison can vary the checkpoint and controller independently, distinguishing learned capability, coordination, and their interaction.

Charge proposal and controller work, all parallel worker work, tool and solver use, communication, verification, failures, and retained-state updates using Definition [ftip-005H]. Report elapsed time alongside these costs: a shorter run with more workers may consume more total computation. Apply Definition 2.6's admission rule before execution and record any contract violation separately from the quality of the submitted artifact.

Finite environments with rational transition laws can expose three distinct mechanisms: complementary observations, correlated worker failures, and delayed verification or newly revealed dependencies. Keep the latent state, observation rules, legal actions, and costs explicit. The first family includes Example 5.1.2; the erased-bit construction in Example 5.1.3 tests whether a proposed summary loses decisive information. Where the exact model applies, compare attainable policy values with Remark 5.2.3's finite optimum and Theorem 5.2.2's upper certificate.

The principal quantity is the justified interval $[L_{\mathbf B},U_{\mathbf B}]$ for the restricted frontier. A smaller gap can result from a better feasible policy, a sharper upper certificate, or a more informative valid representation; distinguish these causes. In a live system, mean held-out transition accuracy does not justify a uniform model-error radius. Empirical quality and cost remain useful even when an upper certificate is unavailable.

Use evaluation instances separate from tuning, and declare task draws, repetitions, resource checkpoints, and analysis rules before comparison. Repeated runs share an instance and are not automatically independent tasks; account for this grouping in the analysis. Report independently verified quality, feasibility failures, time to the first valid artifact, and charged cost at matched quality. A valid confidence sequence can support repeated inspection under its statistical assumptions; see Howard et al.. It does not by itself justify selecting a new policy on reused evaluation outcomes.

These controls yield testable predictions. Complementary information can favor adaptation over one-step stopping; redundant workers can erase a portfolio's gain; delayed verification can make an early apparent success expensive to repair. An empirical claim of better coordination fails if its advantage disappears after matching access and charging the controller's own work. A claim of little remaining potential additionally requires the upper certificate, not merely a plateau among tested policies.

5.4. Work and critical paths in a fixed task graph [ftip-00MF]

When the tasks, dependencies, and durations are fixed, scheduling has a useful lower bound independent of the chosen priority rule. This isolates avoidable delay in a declared decomposition. Discovering a missing dependency or changing a mathematical formulation changes that decomposition and is a different intervention.

The following work-and-chain argument is the classical list-scheduling bound associated with Graham. His examples also show that a particular list schedule can worsen after an apparently favorable change, such as adding processors. This does not contradict monotonicity of the optimal feasible frontier.

proposition. A work and critical-path bound for list scheduling [ftip-00MG]

Fix a finite nonempty directed acyclic task graph, positive task durations $p_j$, and $m$ identical processors, where $m\in \mathbb N$ and $m\geq 1$. All tasks are available at time zero subject only to their precedence constraints. Each task uses one processor without interruption; there are no further resource, communication, or setup constraints. Let $W=\sum _j p_j$, let $D$ be the longest precedence-chain duration, and let $T^*$ be the minimum makespan. A work-conserving list schedule starts a ready task whenever a processor is free. Its makespan $T_{\mathrm {list}}$ satisfies

\[ \max (W/m,D)\leq T^*\leq T_{\mathrm {list}} \leq W/m+(1-1/m)D. \]\[ T_{\mathrm {list}}\leq (2-1/m)T^*. \]

Proof.

At most $m$ units of work can finish per unit time, and every precedence chain executes in order. Thus $W/m\leq T^*$ and $D\leq T^*$. Trace backwards from a last-finishing task, repeatedly choosing an immediate predecessor with latest completion, until reaching a task with no predecessors. These tasks form a precedence chain.

Between completion of one chosen predecessor and the next chain task's start, all predecessors of that next task are complete. The task is ready, so work conservation forces all processors to be busy during that gap. The first chain task is ready from time zero. Consequently, whenever fewer than $m$ processors are busy before completion, some task on this chain is executing, apart from finitely many event times.

Let $I$ be the total duration with fewer than $m$ busy processors. Then $I\leq D$. During the rest of the schedule all $m$ processors are busy, and during $I$ at least one is busy. Hence

\[ W\geq m(T_{\mathrm {list}}-I)+I. \] \[ T_{\mathrm {list}}\leq W/m+(1-1/m)I \leq W/m+(1-1/m)D. \]

The lower bounds on $T^*$ give the last inequality in the statement.

The ratio $T_{\mathrm {list}}/\max (W/m,D)$ compares the schedule with a lower bound that need not be attainable; it is not generally the ratio to the optimum. Communication and verification must be modeled as work with constraints satisfying these assumptions, or the displayed upper bound need not apply. Neither bound certifies the quality of the chosen task graph or an unrestricted agent's attainable output quality.