Theorem

Original conditional derivation from the September 10 study. Assumptions and proof notation are retained.

# Conditional tracking and operational recovery under partial reference feedback

Draft v1, 2026-09-10. Authoring role: B/formal critic, with direct R1/R2 challenge from A/coordinator, C/measurement reviewer and D/adversarial reviewer. Analytic work only; no numerical checks or autonomous-agent experiment were run by B. Prior [R0](REVIEW_R0.md), [R1](REVIEW_R1.md) and [round-1 synthesis](ROUND_1_SYNTHESIS.md) remain preserved.

**Claim status.** The numeric result below is a standard contraction-based comparison argument adapted to this study. No established novelty, priority or general alignment claim is made. It is separate from the supplied Priority-State Dynamics theorem 4.1, which characterizes one fixed arrival-mixing-departure history. RETA supplies an architectural motivation and provenance/evaluator interfaces; it does not supply the contraction assumptions or make the reference normatively correct. Evidence, mathematical tracking, action robustness, resource feasibility and full study recovery are separate claims.

## 1. Definitions and fixed-reference assumptions

Time t is an integer model-update index. There are N>=1 fixed participants and m>=1 fixed numeric coordinates, with unchanged coordinate meaning. Each x_i(t) is in R^m. The coordinate norm is Euclidean; for a stack X=(x_1,...,x_N), define ||X||_max=max_i||x_i||_2. This is distinct from coordinate infinity norm unless m=1. The scalar routing benchmark can use m=1 without a norm conversion.

Let C be a nonempty closed convex subset of R^m, and let the fixed reference r belong to C. Initial history x_i(-D),...,x_i(0) is specified for an integer D>=0. Suppose the actual updates are

    x_i(t+1) = Proj_C [ (1-a_i(t)) sum_(j=1)^N p_ij(t) x_j(t-d_ij(t))
                       + a_i(t) r_i(t) + w_i(t) ].                    (1)

For every t>=0:

- 0<=a_i(t)<=1; some a_i(t) may be zero. No requirement of direct reference access at every node is imposed.
- p_ij(t)>=0 and sum_j p_ij(t)=1. The weights describe the actual values entering the update, including any explicit missing-message rule.
- d_ij(t) is an integer in [0,D] whenever its coefficient is nonzero.
- At anchored updates, ||r_i(t)-r||_2<=eta for a fixed eta>=0.
- ||w_i(t)||_2<=epsilon for fixed epsilon>=0. The residual includes all admitted implementation/model error not already accounted for by reference error and delayed state mixing.
- Actual execution obeys (1). Unmodeled message values, nonlinear aggregation, arbitrary participant defection or resource failure are not silently assumed to obey it.

These bounds may hold for adaptively chosen deterministic or adversarial sequences; independence, stationarity and zero-mean noise are not assumed. They are substantive restrictions on the actual trajectory, not conclusions inferred from graph degree or consensus.

Index lifted rows and columns by (i,l), 1<=i<=N and 0<=l<=D. Define the nonnegative matrix Q_t of size N(D+1) by

    (Q_t)_[(i,0),(j,l)] = (1-a_i(t)) p_ij(t) 1{d_ij(t)=l},
    (Q_t)_[(i,l),(j,h)] = 1{i=j and h=l-1},  l>=1.                 (2)

Its current-state row sums are 1-a_i(t); its history-shift row sums are 1. Thus it is substochastic and has induced infinity norm at most 1. Define u to be 1 in current-state slots and 0 in history slots. The induced infinity matrix norm is the maximum absolute row sum; for these nonnegative matrices it is the maximum row sum.

**Uniform sliding-window anchor-influence certificate.** There exist integer B>=1 and 0<=gamma<1 such that

    ||Q_(t+B-1) ... Q_t||_infinity <= gamma  for EVERY t>=0.        (3)

Equation (3) means every lifted row loses at least 1-gamma of its prior unanchored-state influence within every B-update window. It includes actual gains, weights, delivery ages and timing. A connected degree-3 drawing, declared edges, occasional clean messages or products checked only at t=0,B,2B,... do not establish it. With history shifts, too-short windows may retain rows of unit mass. A finite verified prefix justifies the result only on that prefix unless a separate argument proves continuation.

Define e_i(t)=||x_i(t)-r||_2. Let e_lift(t) stack e(t),e(t-1),...,e(t-D). Define positive excess componentwise by

    z(t)=(e_lift(t)-eta*1)_+,
    M0=||z(0)||_infinity,
    E_t=max_i||x_i(t)-r||_2.                                    (4)

## 2. Lemma: lifted positive-error comparison

Under (1)-(2),

    z(t+1) <= Q_t z(t)+epsilon*u                              (5)

componentwise.

**Proof.** Euclidean projection onto a nonempty closed convex set is nonexpansive and fixes r in C. Applying it to (1), then using the triangle inequality and the row sums, gives

    e_i(t+1) <= (1-a_i(t)) sum_j p_ij(t)e_j(t-d_ij(t))
                 +a_i(t)eta+epsilon.

For the lifted shift rows, the corresponding old scalar error is copied exactly. Subtract eta from each coordinate. The current-state constant cancels because (1-a_i)eta+a_i eta=eta; shift-row cancellation follows from its unit row sum. For every nonnegative Q and b>=0, (Qy+b)_+<=Q(y)_++b. Apply this with y=e_lift(t)-eta*1 and b=epsilon*u to obtain (5). No assumption that all errors exceed eta is needed. QED.

## 3. Theorem: all-time partial-anchor tracking bound

Assume (1)-(4) and 0<gamma<1. Put

    F=B*epsilon/(1-gamma).

For each t=kB+s with integers k>=0 and 0<=s<B,

    E_t <= eta+gamma^k M0
                  +epsilon[ B(1-gamma^k)/(1-gamma)+s gamma^k ]
        = eta+F+gamma^k(M0+s*epsilon-F).                         (6)

In particular, at t=kB,

    E_(kB)<=eta+gamma^k M0+F(1-gamma^k),                         (7)

and at all times,

    E_t <= eta+F+gamma^floor(t/B)*A,
    A=max(0,M0+(B-1)*epsilon-F).                               (8)

Consequently limsup_(t->infinity) E_t <= eta+F while the assumptions continue to hold.

**Proof.** Let Phi(t,j)=Q_(t-1)...Q_j for t>j and Phi(j,j)=I. Repeated application of (5), using nonnegative matrices, gives

    z(t)<=Phi(t,0)z(0)+epsilon sum_(j=0)^(t-1) Phi(t,j+1)u.      (9)

Every product of length l can be partitioned into floor(l/B) consecutive B-step pieces and one shorter piece. By (3), submultiplicativity and ||Q_t||_infinity<=1,

    ||Phi(t,j)||_infinity<=gamma^floor((t-j)/B).

Also ||u||_infinity=1. Taking norms in (9) gives

    ||z(t)||_infinity <= gamma^floor(t/B)M0
                         +epsilon sum_(h=0)^(t-1) gamma^floor(h/B).

For t=kB+s, the sum has k full age blocks of length B and s remaining oldest ages. It equals B(1-gamma^k)/(1-gamma)+s gamma^k. Since E_t<=eta+||z(t)||_infinity, (6) follows. Setting s=0 gives (7). Replacing M0+s epsilon-F by its maximum with zero over 0<=s<B gives (8). Letting k tend to infinity proves the limit superior statement. QED.

The s epsilon term in (6) is multiplied by gamma^k because the geometric sum is grouped by input age; this does not assume that newly arriving disturbances are attenuated immediately. The sharper vector comparison (9) may give smaller constants because disturbances enter current slots rather than every history slot.

**Endpoint gamma=0.** If every B-step product is zero, then every transition of length at least B is zero. Equation (9) therefore gives E_t<=eta+B epsilon for every t>=B. Avoid logarithmic formulas involving gamma=0. If epsilon=0 and 0<gamma<1, (6) reduces to E_t<=eta+gamma^floor(t/B)M0.

**Aligned-window limitation.** If (3) holds only for aligned starts t=kB, the block-boundary estimate (7) remains available. Between boundaries a safe estimate is

    E_(kB+s)<=eta+gamma^k M0+F(1-gamma^k)+s epsilon.             (10)

Do not use (6) or its sustained bound from an aligned-only certificate. Equation (10) allows a persistent inter-block surcharge up to (B-1)epsilon. Extra assumptions or the exact input gain may improve it.

## 4. Corollary: sufficient sustained numeric entry time

Let tau>eta+F be the declared numeric tracking tolerance, and A be as in (8). For 0<gamma<1 choose

    k_star=0,                         if A<=tau-eta-F;
    k_star=ceil[log(A/(tau-eta-F))/log(1/gamma)], otherwise.
    T_num=B*k_star.                                             (11)

Then E_t<=tau for every t>=T_num while the assumptions hold. Hence H>=1 consecutive numeric observations can first be certified, by this bound, at T_num+H-1. This is a sufficient update-count bound; actual first entry may be earlier. Wall-clock time requires a separate bound on update/delivery/computation duration.

**Proof.** In the first case (8) already lies at or below tau for all t. Otherwise k_star is the least integer specified by gamma^k A<=tau-eta-F. For t>=Bk_star, floor(t/B)>=k_star, so (8) gives the conclusion. The last of H observations beginning at T_num is T_num+H-1. QED.

For gamma=0, T_num=B is sufficient if tau>=eta+B epsilon. When tau<=eta+F, the strict-margin formula (11) supplies no guarantee for arbitrary initial history; special cases may still satisfy (6). Do not turn a conservative bound's failure to certify recovery into proof that every actual trajectory is unrecoverable.

The corollary certifies future tracking only conditionally. A finite experiment's H-sample dwell is evidence for that window, not proof against an unbounded future perturbation or an assumption-breaking policy change.

## 5. Exact K4 example with one anchor

Take N=4, D=0, P=(1/4)11^T and a fixed gain a in (0,1] at participant 1 only. The remaining three participants have gain zero. Then

    Q=diag(1-a,1,1,1)P,
    Q1=(1-a,1,1,1)^T,
    (Q^2 1)_i=(1-a_i)(1-a/4).

Thus ||Q||_infinity=1 and ||Q^2||_infinity=1-a/4<1 exactly. Since Q is constant, B=2 and gamma=1-a/4 certify every sliding window. Unanchored participants recover through actual anchored-state propagation; no uniform one-step contraction is asserted.

For this certificate the conservative disturbance floor is F=8 epsilon/a. With exact reference, epsilon=0 and no projection effects, actual trajectories may converge faster than the block envelope; this is a sufficient bound, not a claim of a sharp disturbance gain. At a=0 the certificate fails. Breaking all information paths from the anchor to a closed unanchored class can also make every finite-window maximum row sum equal 1, even if all nodes have many other neighbors.

The rank-one example also permits a sharper exact transition calculation. With lambda=1-a/4, Q^k=lambda^(k-1)Q for every k>=1, hence ||Q^k||_infinity=lambda^(k-1). In (9), u=1 because D=0. For t>=1 this gives the sufficient comparison bound

    E_t<=eta+lambda^(t-1)M0
               +epsilon[1+(1-lambda^(t-1))/(1-lambda)].         (K4)

Its asymptotic floor is eta+epsilon(1+4/a). The matrix identity follows from Q=v1^T/4 and 1^T v/4=lambda; the finite sum follows directly from (9). These are exact transition norms for this specified Q and an error envelope for the projected system, not a claim that every nonlinear trajectory attains equality. They also show why the generic B-window constant need not be sharp.

The identities are derived algebraically here, not numerically executed by B. A coordinator numerical check must retain its own source/configuration/trace binding. The real K4 peer-message exchange does not instantiate this recurrence simply because it has four participants and degree 3.

## 6. Moving-reference corollary at bounded-drift scope

Replace r by a deterministic or adapted path r_t in C with ||r_(t+1)-r_t||_2<=v. Assume the actual reference estimates obey ||r_i(t)-r_t||_2<=eta; all other assumptions, including (3), persist. Define every lifted error slot against the CURRENT reference:

    e_(i,l)(t)=||x_i(t-l)-r_t||_2,
    z(t)=(e_lift(t)-eta*1)_+.

Then

    z(t+1)<=Q_t z(t)+epsilon*u+v*1.                            (12)

Consequently (6)-(11) remain sufficient after replacing epsilon by delta=epsilon+v and M0 by the initial lifted excess relative to r_0. The tracked error is now E_t=max_i||x_i(t)-r_t||_2.

**Proof.** A current update can first be compared to r_t as in the fixed-reference proof and then to r_(t+1), costing at most v. A history shift changes only its comparison reference, also costing at most v. Subtract eta and take positive parts as before. Thus (12) holds. Its nonnegative input has infinity norm at most epsilon+v, so the previous product proof applies unchanged. QED.

If an anchored observation has age at most H_r and error at its observation time at most eta, triangle inequality gives current reference error at most eta_eff=eta+H_r v. Use eta_eff for centering and the final floor, retaining delta=epsilon+v. Initial historical states are compared to r_0; their stale-reference discrepancy is not omitted. Tighter constants may retain the vector input epsilon*u+v*1 rather than its scalar norm.

This proves no result for unbounded target drift, arbitrary membership/coordinate changes, references leaving C, or silent normative changes. A bounded factual reference update under a frozen scoring rule differs from a change of normative authority or benchmark. Preserve their versions separately.

## 7. Separate quantitative operational bridge

Theorem (6) is about numeric errors only. The following is a conditional sufficient bridge for a SPECIFIED task; it is not inferred from the theorem.

Let y_t denote exactly the available observation history, with its delays, provenance and allowed memory. Let Omega(y_t) be all true environment states/histories consistent with that information and the declared uncertainty assumptions. Let R_t=(r_t,...,r_t). The implementability requirement is that the controller uses ONE observation-measurable policy or action-schedule map pi(X,y), with no hidden reference truth, future perturbation schedule or world-specific oracle inputs:

    there exists one executable observation-measurable pi;
    for every compatible world with the SAME actual visible inputs,
    the policy returns the SAME action/schedule (or the same randomized law). (13)

Equation (13) specifies implementability, not safety/usefulness. The desired robust conclusion is that this same policy meets the task conditions uniformly over compatible worlds; (14)-(15) below are sufficient margin assumptions from which that conclusion will be derived. This is stronger than per-world oracle feasibility. If indistinguishable worlds have disjoint safe useful action sets, no policy can satisfy the robust conclusion before distinguishing evidence arrives. A mathematical proof cannot recover information absent from all allowed observations. For a randomized policy, a certainty conclusion requires the margins uniformly over its supported realizations; a distribution alone does not create certainty.

The notation pi(X,y) does not grant access to a hidden global stack: every component of a distributed policy must factor through that participant's actual permitted local observations/history. If compatible worlds also disagree about the true reference, separate margins evaluated at different world-specific R values do NOT by themselves establish the robust conclusion. One must either justify narrowing the information set, or directly verify that the single actual action/schedule pi(X,y) belongs to the intersection of safe useful schedules over all worlds compatible with the SAME actual visible inputs. An empty intersection is bridge infeasibility, even if an oracle could pick a different correct route in each world.

For a quantitative sufficient condition, consider the SAME nominal policy/schedule pi(R,y). For every admissible pair (y,omega), suppose its externally evaluated hard-constraint functions g_j, resource/deadline-constraint functions c_l, and useful-service/coverage functions U_h satisfy uniform margins

    g_j(pi(R,y),omega)<=-m_gj,
    c_l(pi(R,y),omega)<=-m_cl,
    U_h(pi(R,y),omega)>=u_h+m_uh.                              (14)

Here constraints are written with zero as their allowed boundary; u_h are frozen service/coverage requirements. Each margin is nonnegative. Resource functions include audit queries, communication, retransmission, repairs and actual execution costs; deadline functions include their latency. Fixed original beneficiary obligations and demand denominators are part of these functions.

All nominal and actual schedules must extend the SAME executed commitment, backlog and resource history. Overlapping decision horizons cannot each reserve the same future capacity as though it were unused. The observation/context history, or its conservative uncertainty set, must account for prior reservations, unfinished jobs and pending consequences; the new schedule must remain jointly feasible with those commitments. Separate feasible plans at each tick are insufficient without this execution consistency.

Suppose the COMPOSED functions are uniformly Lipschitz in X on ||X-R||_max<=tau, for the same y and every omega in Omega(y), with constants K_gj,K_cl,K_uh. Require

    K_gj*tau<=m_gj,   K_cl*tau<=m_cl,   K_uh*tau<=m_uh.          (15)

All relevant environment/actuation uncertainty must already be covered uniformly by omega or by explicit additional error margins in (14)-(15). If, instead, component Lipschitz constants are available, one may use K=L_output*L_pi; it is the composed bound that is needed. Discontinuous routing or threshold policies may have no such finite constant; direct robust verification of the whole tolerance ball can replace (14)-(15), but cannot be assumed.

**Bridge proposition.** Under (13)-(15), execution fidelity and complete outcome accounting, E_t<=tau implies the specified action/schedule meets every g_j<=0, c_l<=0 and U_h>=u_h at that evaluation point/horizon.

**Proof.** For each hard constraint, g_j(pi(X,y),omega)<=g_j(pi(R,y),omega)+K_gj||X-R||_max<=-m_gj+K_gj tau<=0. Apply the same calculation to c_l and the reversed inequality to U_h. Uniform quantification over the SAME pi, y and all compatible omega makes the implication implementable under partial observation rather than per-world oracle selection. Actual execution/outcome fidelity is required to transfer planned bounds to realized outcomes. QED.

Tracking cannot establish that the margins, information sets or faithful execution exist. For capacity zero with positive frozen demand, the resource/service bridge is infeasible even at E_t=0. A .5001 unsafe action threshold next to reference .5 similarly defeats an unjustified .05 safety tolerance. These failures remain full-recovery failures in the study.

## 8. Full task recovery and observation timing

For the externally frozen task, let Q_good(t) be the dense per-tick conjunction of tracking tolerance, every realized hard constraint, useful service, all required beneficiary coverage floors and complete measurements. Internal PASS/UNRESOLVED labels, agreement or projection are not substitutes. The current proposed scorer contract uses scalar error, service >=.8, rolling minimum beneficiary coverage >=.5 and H=10 consecutive good ticks; these are engineering choices, not theorem constants or moral quantities.

If the bridge itself establishes Q_good(t) for every t>=T_num using correctly defined windows and mature outcomes, then full-task entry is guaranteed no later than T_num and its H-sample recognition no later than T_num+H-1. These are sufficient upper bounds, not the measured first onset; the scorer may find earlier recovery. If the bridge establishes only instantaneous delivery bounds and Q_good uses trailing windows of maximum length L, fixed warmup/history, nonempty demand and unchanged original beneficiaries, an additional L-1 ticks may be needed before a whole window contains guaranteed operation. In that case a sufficient entry bound is T_num+L-1 ONLY if weighted service/coverage aggregation and all hard-constraint histories satisfy the relevant per-tick-to-window implication. Existing backlog, earlier pending harms and execution delays may require a separately bounded additional recovery interval; they cannot be discarded at T_num.

Map theorem-relative t=0 to an explicit absolute run tick t_origin. If T_task is the applicable relative entry bound and the scorer starts at absolute onset, the proposed scored window may begin at s=max(onset,t_origin+T_task). The complete observation horizon must reach at least s+H-1, with valid warmup/history supplied; otherwise this candidate window cannot be confirmed from that trace. Keep outcome maturity as the separate condition below. External feasibility true/false/unknown remains diagnostic and never deletes ticks from the observed Q_good conjunction.

A consequence horizon is distinct from the last observed tick. C reports that the independent scorer has no per-action maturity field: caller-side mature outcome data or an explicit provisional-recovery label is required. If final outcome maturity is uniformly delayed by h_out beyond the last scored tick, external certification may be delayed by up to h_out additional ticks. That delay is separate from H-1 recognition; without a finite maturity guarantee no finite fully mature certification time follows.

Thus full useful/safe recovery follows only when the tracking certificate AND evidence assumptions AND implementable action/resource/service bridge AND matured external scoring all apply. This is recovery under a declared task contract, not general ethical alignment. Current recovery does not erase earlier harm, missed obligations, terminal losses or irreversible damage. Irreversible loss alone does not prove that current service is permanently impossible; show a separate feasibility/repair argument.

## 9. Scope boundaries, adaptation and failure reporting

- **Trusted evidence:** eta is an externally meaningful accuracy bound, not a consequence of repeated messages, a small residual, agreement, sender identity or a hash. Copied biased anchors can preserve gamma<1 while violating eta. Identical observations in distinct worlds may prevent the controller from knowing such a bound.
- **Communication:** delivery suppression, unbounded staleness or vanishing weights may break (3) or D while reference truth remains sound. Report these separately from reference corruption. Dynamic reweighting may be modeled only while the actual certificate remains valid.
- **Adaptive policies/lenses:** every policy switch must preserve a common certificate covering actual gains/delays, evidence bounds, operational margins, costs and CROSS-SWITCH delayed histories/windows. Alternatively restart the theorem at the switch with the complete lifted history, newly computed M0 and justified new constants. A certificate only for new dynamics does not preserve an already-declared continuous guarantee across the transition. Restarting this mathematical guarantee must retain the original episode onset, elapsed time, prior failures and historical recovery observations in the benchmark; it cannot reset away service deficits or past harm. Do not reuse old constants after an unverified switch or rewrite judgments.
- **Adversaries:** adaptive synthetic adversaries are included only within stated budgets and the pathwise assumptions. Out-of-contract poisoning remains an operational stress failure to report; it is not a mathematical counterexample to a conditional theorem and must not be dropped from denominators.
- **Feasibility:** C containing r is a numeric property. A resource-feasible service schedule, deadlines, repair authority and available distinguishing evidence are separate. Catastrophic losses can make them impossible.
- **Population:** the theorem uses fixed participants/coordinates. If beneficiaries or nodes disappear, preserve their obligations and loss records. A new lift after membership change needs an explicit transition/new-initial-history analysis; survivor agreement cannot be labeled full recovery.
- **Measurement:** use the stated norm and dense windows. Scalar max-absolute error equals max-row Euclidean error only for scalar rows. Holdout-exposed examples remain development cases. Hashes identify bytes, not blinding, truth, authority or independent validation.
- **Result status:** algebraic derivation plus peer criticism; no numerical run by B. Finite numerical checks can test chosen cases and implementation, not certify arbitrary future schedules or validate normative assumptions.

## 10. Evidence and peer-change record

Primary mathematical source boundary: [supplied paper], lemma 2.1 and theorem 4.1/corollary 4.2; source hashes and visually inspected pages are recorded in R0. Its membership endpoint result is not used as a proof of (6). Architectural source: [RETA_WIP], sections 4, 7-9, 11, 16, 24-25 and 28. Local derivation lineage: R0 fixed-reference proposal -> R1 partial-anchor sliding-window proof -> this complete draft.

Actual direct peer inputs: R1-A-B-1 requires the service/feasibility bridge; R1-C-B-1 preserves fixed obligations and deadlines; R1-D-B-1 separates eta from gamma failure. R2-C-B-1 fixes dense scoring, original-demand windows and the distinction between loss and absorbing impossibility. C's substantive reply to R2-B-C-1 adds caller-side outcome maturity, scalar norm scope and fixed warmup. R2-D-B-1 corrects the crucial quantifier to one observation-measurable policy across compatible worlds, and adds query costs/latency and certificate revalidation after adaptation. See [MESSAGES](MESSAGES.md) for actual exchange and acknowledgement evidence.

Final bounded peer review: C's reply to R2-B-C-2 adds absolute-origin/horizon mapping, sufficient-bound versus measured-onset wording, and joint consistency of overlapping schedule commitments. D's reply to R2-B-D-2/R2-B-D-3 separates implementability in (13) from the conclusion derived by (14)-(15), and requires a cross-switch certificate or full-history theorem restart. These corrections are incorporated before the v1 freeze; neither peer claims numerical verification.

This draft preserves open FC-01 through FC-11. Derivation is complete at stated scope; implementation fidelity, robust service margins, evidence bounds, future certificate validity, numerical checking and empirical recovery remain separate obligations.