---
title: "Sampled Tracking with a Changing Roster"
author: "Guillaume Bolduc"
version: "v0.6"
format: "Derived Markdown edition"
source_tex_sha256: "f4cab13f9f0036193c9a6dc8933e97bea6cbc50f70b359b80b5435449d13d844"
---

# Sampled Tracking with a Changing Roster

**Author:** Guillaume Bolduc  
**Version:** v0.6  
**Status:** certified frozen source frame; matching PDF compiled from the certified v0.6 source

> This Markdown edition was mechanically derived from the selected LaTeX source. LaTeX mathematics and any complex layout commands are intentionally retained where a safe Markdown equivalent was not available. The exact source binding is SHA-256 `f4cab13f9f0036193c9a6dc8933e97bea6cbc50f70b359b80b5435449d13d844`.

## Abstract

We study a sampled reference controller on a finite set of nominal double integrators with changing logical participation. A correct reference service, coherent delayed physical tables, a common clock, and a constrained translation latch are specified as resources. An error estimate accounts for disturbance integrals, goal changes, admission state, snapshot age, and projection error. A weighted event budget gives a tracking bound without requiring participation eventually to become fixed. Separate convex-cell assumptions give continuous separation, speed, and acceleration bounds for all bodies, including inactive bodies. Under a supplied finite service discipline, a delayed-observation gate permits repeated logical reinitialization and readmission of the same bodies without accumulating bodies or workspace. Uniform operational storage additionally requires bounded message production, frame sizes, lifetime, and serviced queues. A convergent quiet tail gives eventual latch freeze under the stated contraction condition. These are conditional results for fixed task coordinates, reserved operating cells, exact local feedback, and correct services; numerical and physical realization remain separate questions.

**Status.** This source revision responds to an additional source-bound review of v0.4 following the separately frozen ENTAIL and FOLIUM reviews. Their shared sources and tooling do not constitute independent human validation. The matched v0.5 source/PDF pair remains the most recent compiled edition; PDF work on this source revision is owner-paused. Human acceptance, numerical certification, and physical realization remain open.

## Problem, source frame, and position relative to prior work

<a id="sec:intro"></a>
A network that changes forever generally has no final consensus target. A physically persistent system also cannot consume a new body or a new parking berth at every change. The question studied here is therefore an infinite-execution question: which information, control, and physical conditions suffice to keep a finite reusable team safe and quantitatively close to its current task while logical membership continues to change?

The supplied foundation [citation: H1] distinguishes consensus from restoration, identifies history-dependent endpoints, and constructs safe finite replacement under separately stated contracts. Its convergence claims require a final fixed-support epoch, and its physical parking construction uses each body once. The disturbance paper [citation: H2] separates common translation from relative geometry. The latch addendum [citation: H3] proves nominal fixed-cohort convergence through an energy contraction and a position projection. The admission addendum [citation: H4] removes a newcomer's physical residual from incumbent feedback and identifies a stale-history release condition. The finite-history paper [citation: H5] counts retained information needed for a specified later query. None of these statements by itself proves their simultaneous operation under endless membership turnover.

This article makes four deliberate model changes. It uses a fixed task alphabet, rather than creating a new task coordinate for every incarnation. It injects a counted current-reference signal into the priority dynamics, rather than asserting mean conservation of plain asynchronous consensus. It constructs a new delayed, constrained latch with pre-admission physical exclusion, rather than claiming that the two supplied addenda can be used together unchanged. Finally, it reuses bodies in permanently assigned disjoint cells, rather than claiming arbitrary entry from free space. These changes are premises of the result, not consequences inherited from the supplied papers. The result is a restricted infinite-execution case under a trusted bounded coordination substrate and reserved workspace. The supplied current reference, coherent tables, commit clock, lifecycle sequencing and deadline service are its main information and timing resources. Removing or distributing components of that substrate requires subsequent results; no such implementation is derived here.

##### Closest external results inspected.

Franceschelli and Frasca [citation: Frasca] already treat indefinite arrivals and departures through contractive open dynamics, bounded movement of a reference trajectory, and bounded joining error. Their open stability framework supplies a direct comparator for the flow-plus-event analysis here. The present proof uses an unnormalized energy on a finite body pool, so deleting coordinates is nonexpansive without a lower population-ratio premise. This does not make the general principle of open stability new.

Hespanha, Liberzon, and Teel [citation: HLT] establish input-to-state stability conditions for impulsive systems and the role of dwell-time restrictions when jumps counteract flow decay. Here removal and exact current-latch minimization are nonexpansive in a particular energy. Admission and goal changes have explicit additive costs, and the delayed latch contributes a quantified perturbation. The scalar comparison argument is elementary and is not claimed as a new ISS theorem.

\c{S}ekercio\u{g}lu, De Carli, and Dimarogonas [citation: Seker] study open double-integrator formations with collision and connectivity constraints, a formation manager, prospective edges, and transition-dependent average dwell time. Their geometry is less restrictive than the reserved-cell construction used here. Our construction instead makes raw history expiry, finite label reuse, a delayed common latch, and a reference-assisted priority layer explicit. Neither paper's guarantees are substituted for the other's. The initial draft lists Gong, Xia, and Lv [citation: Gong] as a further formation/disturbance comparator and reports metadata/supplement inspection. That supplement is not furnished here and its reading was not independently repeated in this revision; no original-body comparison or theorem dependency is asserted for that citation.

Sequence reuse after old traffic has drained is also established protocol practice. RFC~9293 discusses old connection incarnations and quiet time, while RFC~1982 specifies finite serial-number arithmetic [citation: TCP,Serial]. The finite-label lemma below is a proof for the explicitly bounded channel in this paper, not a claim to have invented quarantine.

##### Claim being made.

The object studied here is the specified composition: delayed reference tracking, exclusion from physical centering, a constrained latch, an all-body invariant, and repeated use of bounded operational identities. The proofs identify the assumptions used by each conclusion. No first-publication or comparative superiority claim is needed for these bounds.

## Execution model and the quantities to be controlled

<a id="sec:model"></a>
There are $N\ge2$ physical bodies indexed by a fixed set $\mathcal B=\{1,\ldots,N\}$. Every body exists for all $t\ge0$. Its physical position and velocity are $x_i,v_i\in\R^3$. A body may successively implement different logical incarnations, but birth and retirement do not reset $x_i$ or $v_i$.

Physical commit times are $t_k=kh$, with $h>0$. Between commits the physically admitted set $\core_k$ is fixed and nonempty. The logically participating set $\live_k$ satisfies

$$

 \varnothing\ne\core_k\subseteq\live_k\subseteq\mathcal B.
 <a id="eq:sets"></a>

$$

A logical newcomer may communicate and acquire priorities before entering $\core_k$. Bodies outside $\core_k$ follow a declared standby or approach controller. At most $N$ bodies can enter or leave at one commit, and there are finitely many primitives per sampling cell. Hence infinitely many events cannot accumulate at a finite physical time.

The sets in \eqref{eq:sets} are paired epoch rosters: $\live_k$ is the logical computation roster established at source stage $\sigma_k$, and $\core_k$ is the physical command roster installed at $t_k$. Their inclusion is an index-matched condition. During $[\sigma_k,t_k)$ a logically closed body may still finish its previously held physical command in $\core_{k-1}$. It generates no new logical row after close. This transition does not assert continuous inclusion of the old physical roster in the newly selected logical roster; every body nevertheless remains in the all-body safety model.

The fixed objective alphabet has integer size $m\ge1$. Here $\Delta_m=\{w\in\R^{1\times m}:w\ge0,\ w\mathbf1_m=1\}$. A probability row $w_i(k)\in\Delta_m$ supplies a commanded goal

$$

 q_{i,k}=w_i(k)Z_i,\qquad Z_i\in\R^{m\times3},\qquad
 \max_{i,a}\norm{(Z_i)_{a,:}}\le Q.
 <a id="eq:profiles"></a>

$$

The slot offset $r_i\in\R^3$ and profile $Z_i$ belong to the physical role, not to an ever-growing incarnation index. The closed simplex is used; strict positivity can be imposed on inputs and mixing without changing the norm arguments. Birth is not a new objective coordinate in this model.

A shared translation latch $s_k$ belongs to a nonempty closed convex set $\Sset\subseteq\R^3$. For the finite-workspace theorem $\Sset$ is compact and

$$

 \sup_{s\in\Sset}\norm{s}\le S.
 <a id="eq:latchset"></a>

$$

For each $i\in\core_k$, the plant on $[t_k,t_{k+1})$ is

$$

 \dot x_i=v_i,\qquad
 \dot v_i=K(r_i+q_{i,k}+s_k-x_i)-Cv_i+d_i(t),
 \qquad K,C>0.
 <a id="eq:plant"></a>

$$

Goals and latch are held on that cell. Disturbances are locally integrable. The physical safety construction later specializes to $K=ab$, $C=a+b$, $a,b>0$, and bounded disturbances. The principal tracking inequality itself needs only $K,C>0$.

### Definition: Current command error and physical event cost

Immediately after commit $k$, write

$$

 z_{i,k}=x_i(t_k)-r_i-q_{i,k}-s_k,\qquad
 E_k^2=\sum_{i\in\core_k}\bigl(K\norm{z_{i,k}}^2+\norm{v_i(t_k)}^2\bigr).
 <a id="eq:energy"></a>

$$

This is an unnormalized aggregate error. It does not treat a departing body's disappearance from the performance index as disappearance from physical space. The all-body safety statement uses every element of $\mathcal B$.

##### Information and commit resources.

A correct service establishes the finite current role table and a common commit decision. Before commit $t_k$, it receives complete same-time physical snapshots at an actual source time $\sigma_k\in[t_k-H,t_k]$, where $0\le H<h$. A frame contains the physical slot, live incarnation when applicable, intended commit identity, $x_i(\sigma_k)$, $v_i(\sigma_k)$, and the planned goal/role metadata. The planned $q_{i,k}$ is known before commitment and is used consistently by the service and the body. It need not have been applied by the plant at $\sigma_k$.

##### One epoch and its ordered stages.

For $k\ge1$, logical update epoch $k$ is assigned to physical commit $t_k=kh$. Its source stage is $\sigma_k$; these stages are strictly ordered because $H<h$. First the service applies the predecessor-bound logical close/birth and neutral-row changes selected for epoch $k$, forming $\live_k$ and $\nu_k$. It then computes each continuing $w_i(k)$ from immutable earlier rows, initializes newborn rows from an available reference, and fixes the planned $q_{i,k}=w_i(k)Z_i$. At that same physical source time it samples all required $x_i,v_i$ under the old held physical commands. A causal admission/guard decision uses only this bound table, the planned goals, and the old latch. Delivery, validation, decision computation, and dissemination finish by $t_k$. The old commands continue throughout the intervening flow. At $t_k$, finish that flow, apply the already selected physical removals/admissions, install the planned goals, and hold or recompute the latch. No priority, goal, incarnation, or admission-table version is changed between its source certificate and this commit.

Epoch indices also label raw production/expiry ticks; a physical transport primitive in $(t_{k-1},t_k]$ has the ordered epoch label $k$, and initial primitives at $t_0$ have label zero. Source-row index $r$ names the row's logical generation epoch, not the later epoch of a retransmission. Counter ordering and age comparisons use these labels. The initial commit $k=0$ is supplied coherent data at $t_0=0$: $s_0\in\Sset$, the initial rosters/goals, and the cell-admissible $x_i(0),v_i(0)$. No negative-time physical observation is presumed. Startup priority/reference registers are specified in \cref{sec:priority}. Missing, late, conflicting, or differently bound tables cannot be committed; a hold/rejection policy then defines a different availability class unless it separately satisfies the assumptions of the claimed estimate and liveness bound.

One realization computes the logical update and planned goals at the source stage, collects the table, and disseminates the decision within the remaining $H$ seconds. All local plants continue their old held commands until $t_k$. This is a bounded processing and communication contract with a common clock, not instantaneous global sensing. The paper does not derive it from radio range or from connectivity of an unconsumed graph. Directional delays are allowed inside the contract. Competing epoch frames cannot be combined into one table. A newly admitted incarnation must already be identified at the snapshot source stage. No late, incomplete, or differently bound table is applied.

##### Task reference.

A correct reference service retains one current neutral probability row $a_i(k)$ for each $i\in\live_k$ and forms

$$

 \nu_k=\frac1{|\live_k|}\sum_{i\in\live_k}a_i(k).
 <a id="eq:reference"></a>

$$

Other explicitly supplied probability references could be used. Here birth adds a current row, retirement removes one, and an authorized current update replaces one. The service does not answer arbitrary queries about erased earlier neutral rows. Reference changes are real inputs to the tracking problem.

## Two obstructions that determine the theorem's scope

<a id="sec:obstructions"></a>

### Proposition: Fresh-information and actuation obstruction

<a id="prop:latency"></a>
Consider two admissible tasks whose desired position immediately after an event is respectively $Ru$ and $-Ru$, where $R>0$ and $\norm{u}=1$. Suppose their observations are identical for a latency interval of length $\delta>0$. Every deterministic causal controller has worst-case position error at least $R$ at each time strictly before disclosure. For a body starting at rest at the origin, even immediate disclosure cannot reduce the endpoint error at time $t$ below

$$

 \max\{0,R-\min(Vt,At^2/2)\}
 <a id="eq:reach"></a>

$$

under speed and acceleration bounds $V,A>0$.

**Proof.**
The controller produces the same position $x$ in both hidden executions. The triangle inequality gives $2R\le\norm{x-Ru}+\norm{x+Ru}$, so at least one error is at least $R$. Starting from rest, integration of $\norm{\dot v}\le A$ gives $\norm{x(t)}\le At^2/2$; the speed bound gives $\norm{x(t)}\le Vt$. Reverse triangle inequality proves \eqref{eq:reach}. These are lower bounds, not an asserted optimal rest-to-rest trajectory formula.

Thus an arbitrarily small uniform error guarantee cannot ignore target jump size, available time, or information age. Repeated events can maintain a nonzero tracking error even though all states remain bounded.

### Proposition: A free repeatedly recomputed latch can drift without bound

<a id="prop:drift"></a>
For one body, $r=q=0$, $K=1$, $C=2$, $h=1$, and no constraint on $s$, recompute $s_k=x(t_k)$ at every sample. A constant scalar force $d>0$ produces unbounded common position, while all variables relative to the newly set latch remain bounded.

**Proof.**
Write $v_k=v(t_k)$ and $\Delta x_k=x(t_{k+1})-x(t_k)$. Exact flow from zero initial error to the new latch gives

$$

 v_{k+1}=d e^{-1},\qquad
 \Delta x_k=e^{-1}v_k+d(1-2e^{-1}).
 <a id="eq:drift"></a>

$$

After the first step, $\Delta x_k=d(1-e^{-1})^2>0$. Summing these increments proves unbounded position. The example already has zero communication delay and no membership changes.

A bound on relative shape or command error therefore does not imply finite absolute workspace. The compact set \eqref{eq:latchset} is a mission constraint introduced here. It is not hidden inside the term “translation equivariance.” Translating both the environment and $\Sset$ preserves the coordinate description; holding a fixed world region while translating only the robots is a different task.

## Operational retirement, finite labels, and retained influence

<a id="sec:retirement"></a>

### Definition: Raw lifetime and operational expiry

A raw record is a packet, retransmission, pending callback, uncommitted table, or other object that can still be consumed under its original incarnation identity. Every such copy must cease to exist or become permanently ineligible within $D_{\rm raw}$ clock ticks of its original generation. Forwarding does not refresh generation time. Closing an incarnation at tick $c$ stops all further production under that identity by $c+P$. Operational expiry means that no raw record of that incarnation can later be consumed. It does not mean that every numerical effect of its prior participation has vanished.

### Theorem: Finite-label reuse under bounded raw lifetime

<a id="thm:reuse"></a>
Assume correct endpoints and immutable source/destination bindings, the raw-lifetime contract above, bounded close processing $P$, and a quiet period of $q_{\rm quiet}>P+D_{\rm raw}$ ticks before a physical slot begins its next incarnation. Clear its old per-incarnation buffers and pending operations. Then no raw record from an earlier incarnation of that slot can be mistaken for a record of the new incarnation, for an infinite sequence of reuses. Two alternating incarnation colors suffice. With at most one source-epoch value per tick, a modulo counter of size

$$

 M>2(P+D_{\rm raw}+1)
 <a id="eq:modulus"></a>

$$

can identify the finite actionable epoch window without an ever-growing stored counter.

**Proof.**
Every old raw record is generated no later than $c+P$, so it is permanently ineligible by $c+P+D_{\rm raw}<c+q_{\rm quiet}$. This includes every forwarded or queued copy, by the definition of raw lifetime. A new incarnation therefore begins after all raw traffic from the immediately preceding one has expired; traffic from older ones has expired even earlier. Clearing local pending operations removes delayed callbacks that would otherwise escape the network argument. Induction over successive closes proves the claim for all finite prefixes, hence for every event of an infinite execution.

At an actual receive/use tick, an eligible epoch lies within a finite window shorter than $M/2$. Reducing both tick and generation number modulo $M$ therefore preserves the unique age and its ordering in that window. Equal residues from an earlier wrap are excluded by lifetime, not by a probabilistic argument. The analysis may use an unbounded integer tick index without the controller retaining that integer. A periodic clock phase, modulo epoch, bounded timers, and the two colors implement the required discrete state. More than one frame per source/tick requires a separately bounded within-epoch index.

### Remark: The premise includes storage and retransmission

A delivery bound for packets that happen to be delivered is not a raw-lifetime bound. Nor does a timer that is restarted on forwarding establish the theorem. A malicious endpoint retaining an old signed message indefinitely is outside this compliant model. Byzantine agreement, cryptographic freshness, crash-recovery clock reconstruction, and arbitrary network partitions are not proved here.

### Proposition: Expiry is not erasure of incorporated influence

<a id="prop:noterasure"></a>
Operational expiry does not imply that a retired participant has no causal effect on later numerical state. For example, a retained latch that was previously set using that participant remains a function of the old data after every packet expires. Likewise a scalar state updated as $y_{k+1}=\alpha y_k+(1-\alpha)b$, $0<\alpha<1$, retains coefficient $\alpha^k>0$ on its initial value at every finite $k$.

**Proof.**
Holding the latch does not modify its value. Iterating the scalar recurrence gives $y_k=\alpha^ky_0+(1-\alpha^k)b$. These statements do not depend on a remaining raw record.

Accordingly, this article does not use “causal death” to mean total noninfluence. It proves exclusion of stale operational identities and explicitly permits influence already incorporated into current priorities, physical state, or an authorized summary. The historical-memory lower bounds in [citation: H1,H5] are consistent with this distinction.

## Delayed priority tracking without a final fixed roster

<a id="sec:priority"></a>
Let $D\ge1$ be the maximum age in logical update ticks. For a continuing live incarnation, use

$$

 w_i(k)=(1-\zeta)\sum_{(j,r)\in\mathcal A_{i,k}}\alpha_{i,j,r}(k)w_j(r)
                   +\zeta\widehat\nu_{i,k}+e^{\rm rnd}_{i,k},
 \quad 0<\zeta\le1.
 <a id="eq:priority"></a>

$$

Coefficients are nonnegative and sum to one. Every used row has $k-D\le r\le k-1$ and an eligible incarnation. The body can use its own preceding row when no remote row is available. The reference is a probability row and satisfies

$$

 \norm{\widehat\nu_{i,k}-\nu_{s(i,k)}}_1\le\epsilon_\nu,
 \qquad k-D\le s(i,k)\le k.
 <a id="eq:refage"></a>

$$

The optional post-computation rounding preserves the simplex and has $\norm{e^{\rm rnd}_{i,k}}_1\le\epsilon_w$. A newborn initializes directly from an eligible reference, with the same rounding guarantee; it does not inherit the previous incarnation's local row as an unmarked bootstrap. Every continuing live body updates at every logical tick. A schedule with less frequent updates needs its own blocking bound.

Set

$$

 e_k=\max_{i\in\live_k}\norm{w_i(k)-\nu_k}_1,\qquad
 V_k=\sum_{\ell=k-D+1}^{k}\norm{\nu_\ell-\nu_{\ell-1}}_1,
 \quad \epsilon=\epsilon_\nu+\epsilon_w.
 <a id="eq:priorityerror"></a>

$$

Before the first update, supply probability references $\nu_{-D},\ldots,\nu_0$ and a finite set of initial source registers indexed by $r\in\{-D,\ldots,0\}$. Each register is either an actual immutable row of an incarnation live at its source index, with its then-reference, or a specifically declared startup row at a negative index. Every index-zero register must equal the installed $w_i(0)$ of an incarnation in $\live_0$; an additional synthetic index-zero value is not eligible. A constant extension $\nu_r=\nu_0$, negative-index startup rows equal to $\nu_0$, and current rows initialized from $\nu_0$ is one admissible convention. Every startup row and its error bound is part of the initial input; it is not an undeclared past execution. For negative indices define $e_r$ as the maximum startup/source-register error at that index (zero for an unused empty index); $e_0$ remains the actual live-row maximum in \eqref{eq:priorityerror}. Let $e_{\rm init}$ bound these negative-index errors and $e_0$. Thus the first $V_k$ and every initial delayed window are defined.

An actionable numerical source row must be bound to the incarnation actually live at its generation index $r$, its immutable value $w_j(r)$, and the reference $\nu_r$, except for the explicitly supplied startup registers. A source removed at close cannot generate a new logical row outside $\live_r$ for use in \eqref{eq:priority}. Close processing may send or forward copies of a previously valid immutable row until its transport deadline; it does not replace the row's source index by the copy time. Destination incarnation, current task metadata, raw lifetime, and the $D$-epoch source age are checked separately. A later slot reuse never reinterprets a prior row as the new incarnation's state. These conditions are what permit the proof to bound each consumed row by $e_r$.

### Theorem: Reference-assisted tracking under perpetual logical turnover

<a id="thm:priority"></a>
Under \eqref{eq:priority}--\eqref{eq:priorityerror},

$$

 e_k\le(1-\zeta)\max_{k-D\le r<k}e_r+V_k+\epsilon.
 <a id="eq:pi-rec"></a>

$$

In particular, $V_k+\epsilon\le\beta$ for all $k\ge1$ gives

$$

 e_k\le c+(1-\zeta)^{\lfloor k/D\rfloor}\pospart{e_{\rm init}-c},
 \qquad c=\beta/\zeta.
 <a id="eq:pi-tube"></a>

$$

The trivial simplex bound $e_k\le2$ may be intersected with this estimate. Exact reference representation, zero rounding, and $V_k\to0$ imply $e_k\to0$, even without a final fixed live set. Also $\norm{w_i(k)-w_j(k)}_1\le2e_k$ for current live rows.

**Proof.**
For any eligible source time $r$, telescoping yields
$\norm{\nu_r-\nu_k}_1\le V_k$. The same inequality holds for the reference time $s(i,k)$. Subtract $\nu_k$ from \eqref{eq:priority}, use convexity, and add the two bounded representation errors. The total coefficient on reference-time variation is one, which gives \eqref{eq:pi-rec}. A newborn has error at most $V_k+\epsilon$, so the same upper bound applies. Deleting rows from the current maximum does not increase it.

Subtract $c=\beta/\zeta$ and take positive parts. The sequence $f_k=(e_k-c)_+$ satisfies $f_k\le(1-\zeta)\max_{k-D\le r<k}f_r$. In every block of $D$ updates all members of the actionable error window are replaced by values at most $1-\zeta$ times the preceding block maximum. Induction proves \eqref{eq:pi-tube}. For vanishing $V_k$ and $\epsilon_\nu=\epsilon_w=0$, apply that estimate to an arbitrarily late tail with arbitrarily small $\beta$; the finite preceding history decays. The pair inequality is the triangle inequality through $\nu_k$. For $\zeta=1$, continuing rows depend only on the reference and rounding; the same conclusion follows directly, with the usual convention for a zero power at the initial block.

A nonzero reference-representation error cannot be dropped from the recovery premise. With constant $\nu=(1/2,1/2)$ and injected $\widehat\nu=(3/5,2/5)$, a self-mixing row converges to $\widehat\nu$, with limiting error $1/5$, even with exact arithmetic and no reference variation. Exact recovery therefore uses $\epsilon_\nu=\epsilon_w=0$; time-varying bounds tending to zero give the same conclusion by the tail argument.

The service \eqref{eq:reference} is a counted informational resource. No connectivity hypothesis is needed for \cref{thm:priority} because every live node receives reference injection, not because disconnected plain consensus has acquired a new property. Dynamic objective supports and proportional conditioning would require different transport/reset estimates. They are not silently absorbed into a fixed-simplex theorem.

For an entrant with neutral row $a$ and $n$ prior live rows, one has

$$

 \nu^+-\nu^-=(a-\nu^-)/(n+1).
 <a id="eq:refjoin"></a>

$$

For a departure from $n>1$ live rows,

$$

 \nu^+-\nu^-=(\nu^- -a)/(n-1).
 <a id="eq:refleave"></a>

$$

These are actual event-size identities, obtained by expanding the two means. Several operations are composed in their declared order. They show why event count alone does not determine reference variation.

## A delayed constrained latch and pre-admission physical exclusion

<a id="sec:latch"></a>
At $t_k$, first complete the old plant flow. Determine departures and proposed physical admissions from the bound source table, install the new goals, and then update the common latch. No position or velocity is reset. Let

$$

 \mathcal R_k=\core_{k-1}\cap\core_k,\qquad
 \mathcal J_k=\core_k\setminus\core_{k-1},\qquad n_k=|\core_k|.
 <a id="eq:changes"></a>

$$

The old latch $s_{k-1}$ is denoted $s_k^-$ at this event. A hold sets $s_k=s_k^-$. A recomputation uses

$$

 s_k=\Proj_{\Sset}\left(\frac1{n_k}\sum_{i\in\core_k}
                      [x_i(\sigma_k)-r_i-q_{i,k}]\right).
 <a id="eq:latch"></a>

$$

A separately quantified implementation residual may replace this by any $s_k\in\Sset$ within distance $\delta_k$ of the displayed projection. Let $b_k\in\{0,1\}$ record recomputation. Nonadmitted physical bodies are excluded from this mean. They may nonetheless affect the logical reference through declared neutral preferences. We call this pre-admission physical exclusion. It is not the earlier common-mode shield of [citation: H4]: every body here already belongs to a bounded reserved cell, and logical participation may still change incumbent goals. No equivalence to that earlier live-admission law is asserted.

The abstract projection is an explicit computation-service resource. For an arbitrary closed convex set, existence and single-valuedness do not supply a finite representation, algorithm, or deadline. A concrete compact option is $\Sset=\ball_S(0)$, $S>0$, with

$$

 \Proj_{\Sset}(a)=\begin{cases}a,&\norm a\le S,\\Sa/\norm a,&\norm a>S.\end{cases}

$$

This formula gives the exact-real service used by the simple realization. With rational inputs and radius, its square root can instead be bracketed to compute an inward admissible output with a certified $\delta_k$; the finite precision, work, and time budget must then be included in the service contract. The general projection theorem is retained without a computability claim for every convex set.

##### A nonvacuous guard family.

The tracking estimate permits any causal sequence of holds and recomputations. For the quiescent-tail result, require a settled-body exclusion: a recomputation is forbidden when every admitted body, in the coherent source table, has error to its planned goal plus the old latch at most $R_g>0$ and speed at most $V_g>0$. Otherwise either branch is allowed. The radial and timer rules in [citation: H3] are a stricter possible policy, but this article does not claim exact callback correspondence. Near a guard threshold, an uncertain measurement requires a stated robust decision rule.

### Lemma: Uniform exact-flow contraction

<a id="lem:flow"></a>
Let

$$

 A=\begin{bmatrix}0&1\\-K&-C\end{bmatrix},\qquad
 P=\operatorname{diag}(K,1),\qquad
 \sigma_h=\norm{P^{1/2}e^{Ah}P^{-1/2}}_2.
 <a id="eq:sigma"></a>

$$

For $K,C,h>0$, $\sigma_h<1$. The value does not depend on cohort size. For a held goal and latch over one cell,

$$

 E(t_k^-)\le\sigma_h E_{k-1}+U_{k-1},\qquad
 U_{k-1}=\int_{t_{k-1}}^{t_k}\norm{\col_{i\in\core_{k-1}}d_i(t)}\dd t.
 <a id="eq:flow-bound"></a>

$$

At any intermediate point in that cell, the corresponding error norm is at most $E_{k-1}+U_{k-1}$.

**Proof.**
For a homogeneous scalar coordinate, differentiation gives
$\frac{\dd}{\dd t}(Kz^2+v^2)=-2Cv^2$. Thus flow is nonexpansive. Equality over a positive interval would force $v=0$ throughout, then $\dot v=-Kz=0$, hence the entire state is zero. The continuous norm ratio therefore has maximum strictly below one on the compact $P$-unit sphere. Repeating the same two-dimensional block for three axes and any number of bodies leaves its operator norm unchanged. The forcing injection $d\mapsto(0,d)$ has energy norm one. Variation of constants, nonexpansion for intermediate flow, and the triangle inequality give both claims.

### Lemma: Current projection and delayed projection defect

<a id="lem:projection"></a>
For any nonempty cohort, fixed $x_i,q_i,r_i,v_i$, and old $s\in\Sset$, replacing $s$ by
$\Proj_{\Sset}(n^{-1}\sum_i(x_i-r_i-q_i))$ cannot increase the error energy. Using a complete older position table at $\sigma\le t$, but the same planned $q_i$, adds at most

$$

 \sqrt K\int_{\sigma}^{t}\norm{\col_i v_i(u)}\dd u
                  +\sqrt{nK}\,\delta
 <a id="eq:projection-error"></a>

$$

to the norm, where $\delta$ bounds the projection implementation residual in Euclidean norm.

**Proof.**
Put $a_i=x_i-r_i-q_i$ and $\bar a=n^{-1}\sum_i a_i$. The identity
$\sum_i\norm{a_i-s}^2=\sum_i\norm{a_i-\bar a}^2+n\norm{\bar a-s}^2$
reduces minimization to Euclidean projection on $\Sset$. Velocities are unchanged. Projection onto a closed convex set is nonexpansive: its variational inequalities at projections $p,p'$ of $a,a'$ give
$\norm{p-p'}^2\le(p-p')^\top(a-a')\le\norm{p-p'}\norm{a-a'}$.
The current and old means differ by at most
$n^{-1/2}\int_\sigma^t\norm{\col_i v_i(u)}\dd u$.
Repeating a latch difference in $n$ position rows has energy norm $\sqrt{nK}$ times that difference. Combine nonexpansion, the exact minimization property, and the implementation residual.

Define the event costs, using the actual state at $t_k$ before the latch reset,

$$

 P_k&=\sqrt K\norm{\col_{i\in\mathcal R_k}(q_{i,k}-q_{i,k-1})},<a id="eq:goal-cost"></a>\\
 A_k&=\left(\sum_{j\in\mathcal J_k}
       \bigl[K\norm{x_j(t_k)-r_j-q_{j,k}-s_k^-}^2+\norm{v_j(t_k)}^2\bigr]\right)^{1/2},<a id="eq:admission-cost"></a>\\
 W_k&\ge\sup_{u\in[\sigma_k,t_k]}
           \norm{\col_{j\in\mathcal J_k}v_j(u)}.<a id="eq:new-speed"></a>

$$

Empty entrant sets have $A_k=W_k=0$. A certificate may overestimate these quantities, but it cannot omit one merely because it is inconvenient to observe.

### Theorem: Physical exclusion and a uniform latch event inequality

<a id="thm:composition"></a>
Under the stated flow, source coherence, event order, and projection contracts, set $d_H=\sqrt K H$. Every execution satisfies

$$

 E_k&\le(\sigma_h+b_kd_H)E_{k-1}+J_k,<a id="eq:main-rec"></a>\\
 J_k&=(1+b_kd_H)U_{k-1}+P_k+A_k
                 +b_kd_HW_k+b_k\sqrt{n_kK}\,\delta_k.<a id="eq:event-cost"></a>

$$

In particular, $\rho=\sigma_h+d_H<1$ implies

$$

 E_k\le\rho^kE_0+\sum_{\ell=1}^{k}\rho^{k-\ell}J_\ell.
 <a id="eq:convolution"></a>

$$

The bound is independent of the number of prior incarnations. Before physical admission, an excluded body's absolute position and velocity do not occur in incumbent feedback or in the latch mean, conditional on the actual goal, disturbance, commit, and branch signals.

**Proof.**
At the end of the old cell, \cref{lem:flow} bounds the old-cohort error by $\sigma_hE_{k-1}+U_{k-1}$. Deleting departed rows cannot increase this unnormalized norm. Changing the goals of the continuing rows adds at most $P_k$. Appending the entrant rows changes a nonnegative norm $e$ to $\sqrt{e^2+A_k^2}\le e+A_k$. Thus the post-membership, pre-latch error is at most $\sigma_hE_{k-1}+U_{k-1}+P_k+A_k$.

For a recomputation, use \cref{lem:projection}. Since $H<h$, every continuing body was in the preceding physical cohort throughout $[\sigma_k,t_k]$. Its stacked speed is bounded by $E_{k-1}+U_{k-1}$ through \cref{lem:flow}. The entrant contribution is at most $W_k$. The triangle inequality therefore bounds the old-to-current projection defect by $d_H(E_{k-1}+U_{k-1}+W_k)+\sqrt{n_kK}\delta_k$. Adding gives \eqref{eq:main-rec}. A hold has no such term. Iteration with $\sigma_h+b_kd_H\le\rho$ proves \eqref{eq:convolution}. The final claim follows directly from \eqref{eq:plant} and \eqref{eq:latch}: excluded physical coordinates occur in neither expression for an incumbent. It is not a claim against indirect influence through a motion-dependent communication schedule or a goal inferred from that body's position.

The factor $\rho<1$ is sufficient, not necessary. A run with $\rho\ge1$ is uncertified by \eqref{eq:convolution}; this inequality alone does not prove that run unstable. Complete old tables, current local feedback, and the event order are all used. Mixing different source epochs or retaining a departed body's row in the latch is a different controller.

### Event size instead of event count

### Corollary: Windowed event-cost budget

<a id="cor:budget"></a>
Suppose $\rho<1$ and $J_k\le u+\eta_k$, where $u\ge0$, $\eta_k\ge0$, and every $L$-tick window satisfies

$$

 \sum_{j=\max(1,k-L+1)}^k\eta_j\le B_{\rm evt}.
 <a id="eq:window-budget"></a>

$$

Then

$$

 E_k\le\rho^kE_0+\frac{u}{1-\rho}
                         +\frac{B_{\rm evt}}{1-\rho^L}.
 <a id="eq:budget-tube"></a>

$$

A uniformly bounded per-step $J_k$ is sufficient without any requirement that changes eventually stop. Under $J_k\to0$, $E_k\to0$.

**Proof.**
In \eqref{eq:convolution}, the constant input contributes at most $u/(1-\rho)$. Partition the remaining sum backward into blocks of length $L$. Block $r$, counting the most recent as zero, has total input at most $B_{\rm evt}$ and discount at most $\rho^{rL}$. Sum the resulting geometric series. For a vanishing input, split the convolution into a finite prefix, which decays, and a tail bounded by an arbitrarily small constant times $1/(1-\rho)$.

The event part of \eqref{eq:budget-tube} is attained by the scalar comparison recursion at its peaks when an input $B_{\rm evt}$ occurs every $L$ steps. It is not asserted to be attainable by every physical formation. An average event count becomes a useful proxy only after a bound on the size of each corresponding $P_k,A_k,W_k$ has been supplied. The proposed article's earlier dwell-time sketch is therefore replaced by a concrete additive event budget in this construction.

## All-body safety in a finite reusable workspace

<a id="sec:safety"></a>
The performance proof removes retired rows from $E_k$; the safety proof must not remove their bodies. Assume $K=ab$, $C=a+b$, $a,b>0$. Every physical body, including standby and approach bodies, uses

$$

 \dot x_i=v_i,\qquad
 \dot v_i=ab(c_i(t)-x_i)-(a+b)v_i+d_i(t),
 \quad \norm{d_i(t)}\le D_b.
 <a id="eq:allbody"></a>

$$

All possible held or measurable goals satisfy $\norm{c_i(t)-r_i}\le B$, with $B\ge Q+S$ for admitted bodies. Standby goals satisfy the same envelope. Choose

$$

 R\ge B+D_b/(ab),\qquad C_i=r_i+\ball_R(0),\qquad y_i=x_i+v_i/b,
 <a id="eq:cell"></a>

$$

and require $x_i(0),y_i(0)\in C_i$. Each body has radius $r_b>0$. Slot centers obey

$$

 \norm{r_i-r_j}\ge2R+2r_b+\delta_{\rm sep},\qquad \delta_{\rm sep}>0.
 <a id="eq:separation"></a>

$$

There are no other bodies or obstacles in the reserved cells.

### Theorem: Robust safety through arbitrarily many mode changes

<a id="thm:safety"></a>
Under \eqref{eq:allbody}--\eqref{eq:separation}, every physical body remains in its fixed cell for all time, and

$$

 \norm{v_i(t)}&\le V_{\rm cert}:=2bR,<a id="eq:speed-cert"></a>\\
 \norm{u_i(t)}&\le U_{\rm cert}:=ab(B+R)+2b^2R,<a id="eq:command-cert"></a>\\
 \norm{\dot v_i(t)}&\le A_{\rm cert}:=2b(a+b)R\quad\text{a.e.}<a id="eq:acc-cert"></a>

$$

Here $u_i=ab(c_i-x_i)-(a+b)v_i$ is commanded acceleration. All-body center separation is at least $2r_b+\delta_{\rm sep}$. These statements hold independently of the number of retirements, births, or latch changes. They do not require $\rho<1$.

**Proof.**
Transform \eqref{eq:allbody} to

$$

 \dot y_i=a(\widetilde c_i-y_i),\qquad
 \dot x_i=b(y_i-x_i),\qquad
 \widetilde c_i=c_i+d_i/(ab).
 <a id="eq:factor"></a>

$$

The radius condition puts $\widetilde c_i(t)$ in $C_i$ almost everywhere. Variation of constants expresses $y_i(t)$ as a convex average of its initial value and previous values of $\widetilde c_i$. It therefore stays in the closed convex cell. Apply the same argument to $x_i$, with input $y_i$. This proof covers every allowed change in $c_i$ and bounded measurable disturbance, not just samples.

Since $v_i=b(y_i-x_i)$, \eqref{eq:speed-cert} follows. Algebra gives
$u_i=ab(c_i-y_i)+b^2(x_i-y_i)$ and
$\dot v_i=ab(\widetilde c_i-y_i)+b^2(x_i-y_i)$.
The first distance is at most $B+R$ for the command, and at most $2R$ for the effective input. The other distance is at most $2R$. These estimates give \eqref{eq:command-cert}--\eqref{eq:acc-cert}. Finally,
$\norm{x_i-x_j}\ge\norm{r_i-r_j}-2R$ proves separation. The union of finitely many bounded cells is a fixed bounded workspace. No physical state is reset at a mode switch.

Actuators with command capacity at least $U_{\rm cert}$ never saturate on this nominal model. A specified physical acceleration limit must exceed $A_{\rm cert}$. These are sufficient design inequalities, not a treatment of thrust allocation, attitude, gravity estimation, aerodynamic coupling, contacts, or battery depletion. Infinite execution presumes the ideal plant and stated energy/service availability continue to operate. A finite physical workspace is not a claim of infinite energy from finite batteries.

The invariance premise on $y_i$ is substantive. A body at the boundary of its cell with outward velocity cannot remain there under any bounded acceleration merely because its position initially belongs to the cell. The safety region therefore constrains both position and velocity.

## An executable gate and a finite-service recycling construction

<a id="sec:gate"></a>
The stale physical table also contains velocity. The bounds in \cref{thm:safety} are available before admission and do not depend on the tracking certificate. For a proposed entrant $j$, define from its source record

$$

 \widehat z_{j,k}&=x_j(\sigma_k)-r_j-q_{j,k}-s_k^-,<a id="eq:sourcez"></a>\\
 \mathfrak a_{j,k}&=\left[K(\norm{\widehat z_{j,k}}+V_{\rm cert}H)^2
                   +(\norm{v_j(\sigma_k)}+A_{\rm cert}H)^2\right]^{1/2},<a id="eq:gate-a"></a>\\
 \mathfrak w_{j,k}&=\norm{v_j(\sigma_k)}+A_{\rm cert}H.<a id="eq:gate-w"></a>

$$

A numerical implementation needs outward rounding of these certificates; the exact-arithmetic theorem does not assume a floating-point comparison is automatically conservative.

### Theorem: Delayed-observation admission certificate

<a id="thm:gate"></a>
An admission selected at the source stage and committed at $t_k$ satisfies

$$

 A_k\le\left(\sum_{j\in\mathcal J_k}\mathfrak a_{j,k}^2\right)^{1/2},\qquad
 W_k\le\left(\sum_{j\in\mathcal J_k}\mathfrak w_{j,k}^2\right)^{1/2}.
 <a id="eq:gate-cert"></a>

$$

Thus the service can certify specified admission-cost limits without an instantaneous centroid oracle. It must apply only the declared source table and flush or reject all older admission-table versions. Expired or mismatched incarnation records cannot be used to pass the gate.

**Proof.**
Over the source-to-commit interval, integration gives
$\norm{x_j(t_k)-x_j(\sigma_k)}\le V_{\rm cert}H$ and
$\norm{v_j(t_k)-v_j(\sigma_k)}\le A_{\rm cert}H$.
The old latch is fixed over that interval because $H<h$; the planned goal is fixed metadata. Applying these two bounds in \eqref{eq:admission-cost} proves the first claim. The same acceleration estimate holds at every point between source and commit, proving the second. Version and incarnation checks ensure these inequalities are attached to the state and goal that will actually be admitted, rather than a different pending update.

##### Feasibility versus precision.

A gate with an arbitrarily small threshold need not ever pass under persistent forcing or changing goals. This article does not infer liveness from convergence under a hypothetical quiet tail. The following explicit broad threshold is always feasible within the reserved cells:

$$

 a_{\rm broad}=\left[K(R+B+V_{\rm cert}H)^2+
                          (V_{\rm cert}+A_{\rm cert}H)^2\right]^{1/2}.
 <a id="eq:broad"></a>

$$

Indeed $\norm{\widehat z_{j,k}}\le R+B$ and source speed is at most $V_{\rm cert}$. A one-body gate at $a_{\rm broad}$ therefore always passes. A smaller threshold trades a tighter event budget for a separate capture-time obligation. It may be used in a particular certified schedule, but is not granted unlimited-time liveness for free.

### Repeated physical reuse

For this canonical recycling construction, all $N$ bodies are initially physically admitted. A correct reservation service accepts at most one pending lifecycle request per body and processes requests in FIFO order, one at a time. It never removes the final admitted body. For a served body it selects physical exclusion and closes the old logical incarnation at a source stage; at the ensuing commit it removes that body from the physical mean and commands a fixed standby goal in its cell. It waits the quiet period and an optional finite standby dwell, initializes the new color from the reference service, collects the fresh planned-goal/physical table, and applies the broad gate before readmission. Initialization has a declared bound $B_{\rm boot}$ in clock ticks. Closing and reuse do not erase the body's physical state.

A standby dwell can represent entry into a tolerance region, not exact finite-time rest. To make that statement explicit, fix standby goal $c^0_i$ and let
$L_i=R+\norm{c_i^0-r_i}$. For constant standby goal, \eqref{eq:factor} gives

$$

 \norm{y_i(t)-c_i^0}&\le L_i e^{-at}+D_b/(ab),<a id="eq:standby-y"></a>\\
 \norm{x_i(t)-c_i^0}&\le L_i\phi(t)+D_b/(ab),<a id="eq:standby-x"></a>\\
 \norm{v_i(t)}&\le bL_i(e^{-at}+\phi(t))+2D_b/a,<a id="eq:standby-v"></a>\\
 \phi(t)&=e^{-bt}+b\int_0^t e^{-b(t-s)}e^{-as}\dd s\longrightarrow0.\nonumber

$$

These estimates follow by the same convex-filter convolution and $v_i=b(y_i-x_i)$. Therefore tolerances strictly larger than $D_b/(ab)$ in position and $2D_b/a$ in speed admit a finite common dwell for the finite body set. Stronger damping estimates can improve these sufficient margins.

### Theorem: Bounded lifecycle service and finite resource reuse

<a id="thm:liveness"></a>
Assume the channel/initialization contracts, the all-body cell premises, an initially fully admitted physical pool, the serialized FIFO reservation service, a finite chosen standby dwell, and the broad admission gate. Each accepted request finishes in a bounded finite number of ticks. With at most one pending request per body, the waiting plus service time is bounded independently of execution length. An infinite sequence of such accepted requests can be completed by the same $N$ physical bodies in the same fixed workspace. No new berth or body is consumed by a completed request.

**Proof.**
Each listed service phase has a finite fixed bound: next-commit alignment costs at most one tick; close processing and quarantine are covered by the fixed quiet period; standby dwell is fixed; bootstrap costs at most $B_{\rm boot}$; collecting and committing the fresh table costs at most two further tick alignments under $H<h$. For example

$$

 L_{\rm srv}=q_{\rm quiet}+\lceil T_{\rm standby}/h\rceil+B_{\rm boot}+4
 <a id="eq:service"></a>

$$

is a conservative service bound. The broad gate passes by \eqref{eq:broad}. Every completed cycle restores all $N$ bodies to the admitted core. During a cycle only its served body is excluded. Consequently $N\ge2$ preserves at least one admitted body. The initially fully admitted premise is used here; mere nonemptiness would not exclude a last-body deadlock.

There are at most $N$ accepted outstanding requests. Fair FIFO service therefore finishes any accepted request within $N L_{\rm srv}$ ticks. A new request can be accepted when its body's prior request finishes; repeatedly cycling through the body set gives an explicit infinite accepted sequence. \Cref{thm:reuse} supplies safe logical reinitialization at each cycle. \Cref{thm:safety} applies through every physical phase and retains every body. No position, velocity, slot, or reserved region is recreated. The proof does not serve an unbounded external request queue with finite memory: requests beyond the declared capacity are explicitly rejected or deferred outside the accepted queue.

This is resource closure under a supplied finite service discipline: the finite phase, queue and broad-gate premises supply the completion bound, while repeated cycles consume no additional body, berth or operational identity fields. It proves repeated deactivate/reactivate service, with optional standby-tube arrival. It does not prove battery replacement, exact docking, repair of failed hardware, exchanges between different physical cells, or perpetual capacity under arbitrary adversarial requests. Those are different lifecycle contracts.

## Task-space guarantees and an infinite-execution composition

<a id="sec:endtoend"></a>
The physically relevant desired profile at commit $k$ is $r_i+\nu_k Z_i$, up to the shared latch. For $t\in[t_k,t_{k+1})$, let $E(t)$ be the energy relative to the held command. Then

$$

 E(t)\le E_k+U_k.
 <a id="eq:intercell"></a>

$$

The $U_k$ on the right may be replaced by its partial-cell integral for a causal certificate.

### Lemma: Separate relative and common task errors

<a id="lem:task"></a>
For $i,j\in\core_k$ and $t\in[t_k,t_{k+1})$,

$$

 \norm{(x_i-x_j)-(r_i-r_j+\nu_k(Z_i-Z_j))}
       &\le\sqrt{2/K}\,E(t)+2Qe_k,<a id="eq:relative-task"></a>\\
 \norm{\bar x_{\core_k}-\bar r_{\core_k}-s_k-\nu_k\bar Z_{\core_k}}
       &\le E(t)/\sqrt{n_kK}+Qe_k.<a id="eq:common-task"></a>

$$

The common error relative to the same task with zero translation is at most the right side of \eqref{eq:common-task} plus $S$.

**Proof.**
The profile radius gives $\norm{(w_i-\nu_k)Z_i}\le Q\norm{w_i-\nu_k}_1$. Subtract the two actual command-error identities; the common latch cancels, and $\norm{z_i-z_j}\le\sqrt{2}\,(\sum_\core\norm{z_\ell}^2)^{1/2}$. This proves \eqref{eq:relative-task}. Average those identities and use Cauchy--Schwarz to bound $\norm{\bar z}\le E(t)/\sqrt{n_kK}$. Finally add $\norm{s_k}\le S$ for the zero-translation reference.

With shared profiles $Z_i=Z$, the task-dependent term in pair geometry vanishes exactly. With distinct fixed profiles it represents actual task-dependent deformation. Neither observation establishes equality of two different historical priority endpoints.

### Theorem: Persistent operation with finite reusable bodies

<a id="thm:main"></a>
For every supplied infinite execution satisfying all of the following contracts:

- a finite physical pool, a nonempty admitted core, the fixed objective alphabet and bounded profiles;

- correct bounded-age reference and priority service as in \cref{thm:priority};

- complete coherent physical tables, the event order and constrained latch of \cref{thm:composition}, with $\rho<1$;

- the robust cell, initial-state, actuator-capacity and workspace premises of \cref{thm:safety};

- bounded raw lifetime, bounded close/bootstrap service, finite-label quarantine, and the initially fully admitted, capacity-bounded lifecycle scheduler of \cref{thm:liveness};

- declared bounds on rounding and projection residuals.

- for uniform operational storage, a fixed aggregate copy-production cap $F$ per epoch (including retransmissions), bounded simultaneous bursts, bounded frame/within-epoch fields, and bounded serviced queues as specified in \cref{sec:memory}; computation and dissemination meet their declared deadlines under that actual workload.

Then every body exists for all time; position and velocity are continuous; all-body collision separation, speed and acceleration bounds hold; every accepted lifecycle request completes; and a new incarnation cannot consume raw records left over from an earlier one after the stated quarantine. Priority disagreement and physical task errors satisfy \eqref{eq:pi-tube}, \eqref{eq:convolution}, and \eqref{eq:relative-task}--\eqref{eq:common-task}. These conclusions require no final fixed-membership epoch.

All quantities in the uniform physical event bound can be bounded using finite resources. In the exact-projection case,

$$

 U_k&\le h\sqrt N D_b,<a id="eq:uniform-U"></a>\\
 P_k&\le2\sqrt{NK}\,Q,<a id="eq:uniform-P"></a>\\
 A_k&\le\sqrt N\,[K(R+B)^2+V_{\rm cert}^2]^{1/2},<a id="eq:uniform-A"></a>\\
 W_k&\le\sqrt N V_{\rm cert}.<a id="eq:uniform-W"></a>

$$

Consequently $J_k$ has a finite execution-length-independent bound. The event-sensitive certificate \eqref{eq:convolution} and budget \eqref{eq:budget-tube} can be much smaller than this worst-case envelope. Finite operational storage is specified in \cref{sec:memory}; exact real variables are not claimed to have finite bit cost.

**Proof.**
Fix any supplied execution in the stated class, including its disturbance signals, bound tables, ordered events and held commands. On each cell, the linear plant has an absolutely continuous solution for those locally integrable inputs. Concatenating the cell solutions preserves position and velocity at commits; there are only finitely many commits in any finite-time interval. This is a pathwise statement for each compliant execution, not an existence or uniqueness theorem for a coordination or guard policy. The cell invariants prevent physical escape and prove the actuator and separation claims, including for bodies omitted from $E_k$. Bounded lifecycle service and stale-record exclusion follow from \cref{thm:liveness,thm:reuse}.

Each row and reference is a probability vector, so task variation in a finite $D$-tick window is finite and uniformly at most $2D$ even without a tighter signal contract. \Cref{thm:priority} therefore applies at every logical tick. The actual physical events obey \cref{thm:composition}, giving the convolution; \cref{lem:task} transfers the two estimates to the declared task.

For the explicit uniform event bounds, sum the disturbance cap over at most $N$ bodies, use $\norm{q_i}\le Q$ for goal changes, and use $\norm{x_i-r_i}\le R$, $\norm{q_i+s}\le B$, and the certified speed for entrant states. The entrant-speed estimate is valid over the entire source interval, not just at its endpoints. Add $\sqrt{NK}\sup\delta_k$ when projection residuals are present. Thus bounded perpetual operation is not obtained by assuming the final error is bounded. Every needed cost has a prior resource or invariant bound. None of these arguments erases the distinction between admitted and nonadmitted bodies, or between a logical identity and a physical slot.

##### What the theorem buys, and what it does not.

The system can complete endless admitted lifecycle operations and track an explicitly moving task within the stated analytical envelope. Its event-sensitive bound uses the actual discounted disturbance and event costs. A finite numerical certificate separately requires effective input representations and certified evaluation; arbitrary exact-real data or a general projection oracle is not automatically a finite algorithm. Safety follows from a continuous invariant. The price is an explicit reserved physical layout, a bounded common-translation region, and reference/commit infrastructure. These restrictions remain in the abstract and the main theorem. In particular, bounded accepted-request completion is conditional on the supplied service discipline; its resource conclusion is that indefinite repeated reuse does not increase the required physical fleet or workspace.

## Recovery on a quiescent tail

<a id="sec:quiet"></a>

### Theorem: Eventual latch freeze and nominal task recovery

<a id="thm:quiet"></a>
Assume the full tracking/commit frame of \cref{thm:composition} with $\rho=\sigma_h+\sqrt K H<1$. Suppose physical membership becomes fixed after a finite tick, $q_{i,k}\to q_{i,\infty}$, $U_k\to0$, and $\delta_k\to0$. The latch guard has the settled-body exclusion described in \cref{sec:latch}, using exactly the planned goals installed at the ensuing commit. Then there are only finitely many successful recomputations. The retained latch becomes a finite constant $s_\infty\in\Sset$ and

$$

 x_i(t)\longrightarrow r_i+q_{i,\infty}+s_\infty,\qquad
 v_i(t)\longrightarrow0.
 <a id="eq:quiet-limit"></a>

$$

For exact reference representation, zero priority rounding, and a convergent neutral reference with $V_k\to0$, the reference-assisted layer gives $q_{i,\infty}=\nu_\infty Z_i$ for each body in the final physical core.

**Proof.**
On the fixed physical tail, $A_k=W_k=0$. Goal convergence gives $P_k\to0$. Hence $J_k\to0$, so \cref{cor:budget} gives $E_k\to0$, and \eqref{eq:intercell} gives the same conclusion between samples. Speeds at source times vanish. The source error measured with the new planned goal differs from the old held-command error by $q_{i,k}-q_{i,k-1}$; that difference also vanishes. Eventually every source body is strictly inside the two positive settled thresholds. The guard then forbids any further recomputation. Only finitely many earlier samples exist, so the actual last latch is a finite constant. Combining $E(t)\to0$ with $q_{i,k}\to q_{i,\infty}$ yields \eqref{eq:quiet-limit}. The priority assertion follows from \cref{thm:priority} and the fixed linear profiles.

Vanishing increments without convergence of the goals give a tracking statement, not a position endpoint. Bounded nonzero disturbance generally leaves a nonzero error tube. Without the settled-body guard, infinitely many tiny recomputations can continue; $E_k\to0$ alone does not imply convergence of the latch. The endpoint is the actual frozen latch plus the chosen current reference, not the plain delayed-consensus endpoint from a different update law.

## Finite operational memory and representation limits

<a id="sec:memory"></a>
The reference service needs at most $Nm$ current neutral numbers and current role metadata. The priority protocol retains at most a configured finite number of source rows per physical slot within its $D$-tick actionable window, for example $O(NmD)$ numbers network-wide in a central ring representation, or the corresponding replicated amount for per-node buffers. A complete physical source table contains $O(N)$ three-vectors and fixed-size role fields. At most a committed and a pending table are needed under the stated one-commit-per-cell contract. A nondeleting audit recorder is optional external storage; it is not part of this operational-state bound.

For a channel with at most $F$ generated copies per tick, counting retransmissions as copies, raw lifetime $D_{\rm raw}$ bounds the number of raw in-flight/pending records by $F(D_{\rm raw}+1)$, up to a separately specified bounded simultaneous burst. Merely locally finite traffic would not give that uniform bound. The direct-service realization can provision $F$ for the actual $N$, profile payload, reference broadcasts, membership traffic and physical snapshots; lifecycle and data traffic are both counted. No throughput claim is derived from a static communication graph.

##### A bounded direct-service realization.

As a concrete offered-load policy, use one immutable priority row per source/destination pair per epoch (at most $N^2$ messages), with no retry or transport replication. Permit at most $N$ messages in each of eight service classes per epoch: lifecycle requests, role records, acknowledgements, neutral-row updates, reference replies, physical snapshots, commit decisions, and bootstrap replies. Thus $F=N^2+8N$ is a sufficient production cap for this policy; smaller implementations can use their actual count. Bundled decisions contain at most the current $N$ role/goal entries, never an unbounded historical log. Fixed dimensions, bounded per-epoch subindices, and finite slot/colour/modulo fields bound the number of fields per frame, while real-number precision remains separately counted. Overflow is rejected before admission to a finite queue. Accepted traffic is delivered or terminally discarded within the raw lifetime, and required reference/bootstrap/commit traffic is serviced within its stated budget under this load. These last correctness and scheduling guarantees are premises of the direct service, not properties inferred from its static layout or copy cap. With capped production, lifetime, and capacity-bounded requests, the construction has uniform record counts; without them, \cref{thm:composition,thm:safety} may still hold while raw storage peaks grow.

In this operational realization, consumed, terminally rejected, and expired records and callbacks are removed from operational buffers; clearing/disposal work is included in the service budget. Merely marking a record permanently ineligible does not bound its retained bytes. If an audit copy is kept, it belongs to the separately counted external archive and is inaccessible to operational decoding. The general raw-lifetime theorem only requires permanent ineligibility; the stronger disposal/capacity contract is used for the uniform operational-storage conclusion.

Discrete identity fields use physical slot IDs, two incarnation colors, modulo epochs, bounded timers and the fixed-size current role table. They need not grow with completed incarnation count. Stored reference rows, latches and physical coordinates are still exact real variables in the nominal theorem. A fixed number of reals is not a fixed number of bits. A finite probability grid can implement a simplex-preserving quantizer: for $m=2$, rounding the first coordinate to the nearest multiple of $1/L$ and setting the second to its complement gives $\ell^1$ error at most $1/L$. The corresponding nonzero $\epsilon_w$ or $\epsilon_\nu$ is already charged in \cref{thm:priority}. General simplex quantizers need a proved uniform error bound.

The physical projection must likewise keep its output inside $\Sset$ and supply its numerical error $\delta_k$. Quantization alone does not certify a numerical integrator. With local measurement errors $\widetilde x-x=e_x$ and $\widetilde v-v=e_v$, replacing exact feedback by measured feedback introduces the explicit acceleration residual

$$

 d_{\rm eff}=d_{\rm env}-K e_x-C e_v+e_u.
 <a id="eq:residual"></a>

$$

Uniform sensor and actuator-error bounds give $\norm{d_{\rm eff}}\le D_{\rm env}+K\epsilon_x+C\epsilon_v+\epsilon_u$. Applying the cell theorem requires using this full bound and checking the resulting commanded-actuation margin. The existence of such errors and bounds for a particular aircraft is not proved here.

Nothing in this storage result provides arbitrary historical survivor answers after erasure. The task here is current-reference tracking and safe current control. Earlier retained distinctions may legitimately be discarded once raw operational eligibility expires, because this interface does not promise to reconstruct every later counterfactual query. The lower bounds in [citation: H1,H5] apply when that stronger query interface is demanded.

## A parameter example and available checks

<a id="sec:verification"></a>
The supplied initial source reports an experimental package, but its checker, result manifest, metric input, and plotting CSV files are absent from the furnished directory. The original source and its reported counts remain in the review history. Those reports are not treated here as reproduced numerical evidence, and this source no longer depends on the missing files. The earlier supplied PDF remains unchanged in the archive. The matched v0.5 pair is the most recent compiled edition; the present source revision has not been compiled because PDF work is owner-paused.

### An analytic design calculation

Consider six bodies assigned a $3\times2$ grid with nearest slot spacing $0.8$~m. Choose

$$

 a=b=1,\quad h=1\ {\rm s},\quad H=0.02\ {\rm s},\quad
 Q=0.15\ {\rm m},\quad S=0.10\ {\rm m},\quad D_b=0.002\ {\rm m/s^2}.
 <a id="eq:numeric"></a>

$$

Take $B=Q+S=0.25$~m, $R=0.252$~m, body radius $0.04$~m, $m=2$, $D=3$ and $\zeta=0.4$. The radius obeys $R=B+D_b/(ab)$. Use profile rows in $\ball_Q(0)$ and the ball projection above. This is a design calculation under the stipulated service and initial-state conditions, not a reported run.

For the critical plant,

$$

 \sigma_1=e^{-1}(1+\sqrt2)=0.888139536\ldots,\qquad
 \rho=\sigma_1+0.02=0.908139536\ldots<1.
 <a id="eq:numrho"></a>

$$

The conditional all-body bounds evaluate to center separation $0.296$~m, speed $0.504$~m/s, commanded acceleration $1.006$~m/s$^2$, and effective acceleration $1.008$~m/s$^2$. The separation exceeds the $0.08$~m body diameter by $0.216$~m. These values follow directly from \cref{thm:safety}; they do not measure trajectories or establish that a particular communication system meets $H=0.02$~s.

### A persistent-turnover workload with a smaller tracking certificate

<a id="sec:persistent-example"></a>
The coarse bounds in \eqref{eq:uniform-U}--\eqref{eq:uniform-W} prove boundedness but need not improve on compactness of the cells. The following specified workload uses the same six-body physical parameters to give a smaller event-sensitive certificate. It is an analytical construction under the supplied services, not a simulation or a claim for arbitrary churn.

Take $\Sset=\ball_{0.10}(0)$, exact fresh-reference delivery $s(i,k)=k$ and $\widehat\nu_{i,k}=\nu_k$, zero priority rounding, $m=2$, $D=3$, and now $\zeta=1$. Give every physical role the two profile rows $-0.15u$ and $0.15u$ for a fixed unit vector $u$. Every current neutral row equals the supplied $\nu_k=(p_k,1-p_k)$, and every initial/startup priority row equals its then-reference. Thus every live $w_i(k)=\nu_k$, with $e_k=0$, despite changes of the reference. Choose $p_k=0.49$ initially and toggle it between $0.49$ and $0.51$ exactly at commits $k=100n+60$, $n\ge0$. The reference jump has $\ell^1$ size $0.04$; the planned goal changes by $0.006$~m only at those commits, and $\norm{q_{i,k}}=0.003$~m. Between them there is no neutral-reference change. Birth adds the current neutral row and close removes an equal row, so neither operation changes this mean.

Initially all six bodies are admitted and satisfy the cell initial-state premises. In cycle $n$, the FIFO service handles only body $i_n=1+(n\bmod6)$. At the associated source stage $\sigma_{100n+1}$ it selects physical exclusion and closes that body's old logical incarnation, using the ordered logical/source stages in \cref{sec:model}. The body completes its old physical command until commit $100n+1$; physical exclusion and standby control begin at that commit. The standby goal $c^0=r_{i_n}+q^-_{i_n}+s^-$ is chosen from the old held task and latch before close, bound in the source-stage decision, and held from the ensuing commit until readmission. Other bodies remain admitted. Use $P=1$, $D_{\rm raw}=3$, $q_{\rm quiet}=5$, two alternating colours, and modulo size $M=16$. After quiet time, the body receives a new incarnation and its current reference with bootstrap bound $B_{\rm boot}=1$. A chosen 50-second standby dwell and the remaining commit alignments fit inside the conservative 60-tick service envelope \eqref{eq:service}; the fresh readmission table is sampled for commit $100n+60$. Its standby age is at least $58.98$ seconds, hence exceeds 50 seconds. The core therefore has five or six bodies forever and never becomes fixed. At most one lifecycle request is outstanding, so this schedule respects the finite FIFO capacity. The direct-service production cap is $F=84$ copies per epoch, with the same bounded frame, disposal and deadline premises as in \cref{sec:memory}. The recurring role/reference schedule can use a 600-tick clock phase, a six-body cyclic selector and the current two-valued reference; the separate transport epoch uses modulo $M=16$. The unbounded analysis index $n$ need not be stored operationally.

Hold the latch at other commits. At readmission it may be held or recomputed if the settled-body guard permits, with an admissible projection residual at most $10^{-5}$~m. Use settled thresholds $R_g=V_g=10^{-4}$ in their respective position/speed units. We do not require a forbidden recomputation when all admitted bodies are settled. Disturbances on every body may be any measurable signals of norm at most $0.002$~m/s$^2$. Admit the single entrant only when its delayed certificate \eqref{eq:gate-a} is at most $a_*=0.03$~m/s. The next calculation proves that this smaller gate passes on this particular schedule. It does not extend the broad-gate theorem to arbitrary small-threshold requests.

For the following standby calculation, $\tau$ denotes the numerical value of elapsed time in seconds; the displayed expressions give the numerical position and velocity bounds in metres and metres per second. For $\tau\ge40$, the critical-plant homogeneous position and velocity contributions are bounded by

$$

 (0.502+1.006\tau)e^{-\tau},\qquad
 (0.502\tau+0.504(\tau-1))e^{-\tau},
 <a id="eq:workload-transient"></a>

$$

respectively. These bounds use $\norm{x(0)-c^0}\le R+B=0.502$ and $\norm{v(0)}\le0.504$. Variation of constants has position impulse kernel $\tau e^{-\tau}$, of integral one, and velocity kernel $(1-\tau)e^{-\tau}$, of absolute integral $2/e$. The same norm bounds hold for arbitrary three-dimensional bounded forcing. Since $e^{-40}<10^{-17}$ and both displayed envelopes decrease for $\tau\ge40$, the source position error to $c^0$ is below $0.00201$~m and source speed below $0.00148$~m/s. Changing the planned goal at readmission adds at most $0.006$~m. The old latch has remained fixed throughout this standby interval, so

$$

 \mathfrak a_{i_n,k}^2
 \le(0.00801+0.504\cdot0.02)^2
       +(0.00148+1.008\cdot0.02)^2
 =0.0007955377 <0.03^2,
 \qquad \mathfrak w_{i_n,k}<0.022.
 <a id="eq:workload-gate"></a>

$$

This closes the capture-time obligation for the declared schedule, including nonzero disturbance and observation age. The new planned reference is supplied before that source table and is held unchanged through commit.

Using $\sigma_1$ from \eqref{eq:numrho}, a conservative rational contraction bound is $\rho<\bar\rho=0.909$. For every cell $U_k<0.0049$~m/s, so the continuous-input part of $J_k$ is at most $u=1.02\cdot0.0049=0.004998$~m/s. At a readmission there are five continuing bodies. Their goal-change cost is at most $\sqrt5\,0.006$~m/s, the admission cost is at most $0.03$~m/s, the delayed entrant-speed contribution is below $0.02\cdot0.022$~m/s, and the projection residual contribution is at most $\sqrt6\,10^{-5}$~m/s. Therefore the remaining event cost is below $0.04390$~m/s. It is zero at other commits, including physical removal. Every 100-tick window consequently has $B_{\rm evt}=0.04390$~m/s. Applying \cref{cor:budget} with $\bar\rho$ gives

$$

 E_k\le\bar\rho^kE_0+
       \frac{0.004998}{1-0.909}+
       \frac{0.04390}{1-0.909^{100}}
 <\bar\rho^kE_0+0.099\ \mathrm{m/s}.
 <a id="eq:workload-tube"></a>

$$

Here the energy norm has speed units because $K=1$~s$^{-2}$. The certificate is independent of the completed-cycle count. In contrast, the cell bounds alone give

$$

 E_k\le E_{\rm cell}:=
 \sqrt{6[K(R+B)^2+V_{\rm cert}^2]}
 =\sqrt{3.03612}\ \mathrm{m/s}>1.74\ \mathrm{m/s}.
 <a id="eq:workload-cell"></a>

$$

Thus the eventual sampled error ceiling here is more than 17 times smaller than that cell-only ceiling. Between commits the eventual energy bound is below $0.104$~m/s. Since $e_k=0$ and $n_k\ge5$, \cref{lem:task} gives eventual pair-position task error below $0.148$~m and common task error, relative to the actual latch, below $0.047$~m. The corresponding cell-only pair bound is $2R=0.504$~m for these shared profiles. Error relative to zero common translation still includes the separately allowed $S=0.10$~m; it is not dropped from an absolute-position statement.

There is a nonempty parameter family behind this example. Keep the reserved geometry, gains, timing pattern and exact fresh-reference rule fixed, and replace the reference levels by $1/2\pm\alpha$ with $0<\alpha\le0.01$. The same certificate holds for $0\le H\le0.02$, $0\le D_b\le0.002$ and $0\le\delta_k\le10^{-5}$, retaining the same conservative constants. Positive delay, disturbance and projection error are allowed simultaneously. The strict gate and compactness-improvement margins above persist throughout this family. This supplies one quantitative persistent workload; it is not an optimization or evidence that every feasible workload has this accuracy.

### Review diagnostics

The separately frozen review reports in the project's `review` directory identify newly executed bounded diagnostics and their exact scripts. ENTAIL checked 2,000 seeded critical-flow roster/projection events and 200 exact delayed-window steps. FOLIUM checked 4,000 critical-flow events and 8,820 finite-age/quarantine/modulo cases. These checks target formula instances and interface failures, use the project Python environment, and are not replays of the absent original experiment. Floating-point cases are not certified arithmetic or continuous-trajectory verification. The analytical arguments above retain responsibility for their universal conditional statements. A future end-to-end implementation must test actual source/live-state binding, table versions, workload/lifetime bounds, admission decisions, and every body's dynamics together.

## Limitations, reproducibility obligations, and closing source review

<a id="sec:limits"></a>
This paper is a restricted infinite-execution base case under a trusted bounded coordination substrate and reserved workspace. Removing direct reference injection, weakening coherent tables or the commit clock, or replacing permanent cells are separate research questions. A successor must re-establish the affected guarantees when changing those contracts; they do not follow from this paper. The result is not a theorem for the original five programs run simultaneously. It supplies a new composition whose assumptions and modified updates are explicit. In particular, fixed task coordinates, reference injection, complete delayed physical tables, constrained latching and reserved cells cannot be removed while retaining the conclusion. The original support-conditioning problem, source-level simulator callbacks, and delayed relative-force controller keep their own source contracts.

The physically admitted set may change infinitely often, but the reference/commit grid limits how fast actual changes can occur. Several operations can share a commit, yet their costs are added under a fixed nonempty-core convention. The weighted event estimate is not a permission to execute a Zeno event sequence. The general lifecycle resource theorem is for accepted capacity-bounded requests with the broad gate, not arbitrary requests demanding arbitrarily small entry error. The smaller gate in \cref{sec:persistent-example} has a separate proved capture-time margin for its stated workload. Greater geometric freedom, asynchronous uncoordinated physical commits, packet losses without an expiry/availability discipline, and heterogeneous gains require additional analysis.

The main error is relative to a declared moving task and an actual retained latch. Its vanishing is not historical restoration of every former preference, proof of agreement on a true proposition, or a grant of governance authority. Existing numerical influence can persist after raw messages expire. Quarantine closes a protocol path; it does not rewrite physical or informational history.

The prior-work comparisons concern open-system contraction, open formation, impulsive stability, and finite sequence reuse. The current reviews checked the primary open-system and formation sources and the protocol standards at their stated comparison scope. Initial retrieval of the impulsive-stability PDF failed; its alternate author-hosted route subsequently supplied the abstract and stated ISS/dwell-time framework, which support the limited contextual comparison. These are not proof dependencies or evidence that this combination is unprecedented.

##### Reproducibility boundary.

The matched v0.5 source/PDF pair remains the latest compiled edition while PDF work is owner-paused. This v0.6 source-only revision has no matching new PDF yet. Earlier complete editions are archived, and the review history preserves the original source, separately frozen reports, and bounded checks. Missing original experiment/source-manifest files remain explicitly unavailable. The source is self-contained with respect to its TeX inputs. Compilation and page rendering are delivery checks and do not change the mathematical review's scope. The five internal references are identified below by their actual revisions. A prior requested Markdown hash differs from the supplied revision; that unresolved historical discrepancy is recorded without treating either unseen bytes or a filename as a match. No manuscript submission is claimed.

## AI-use disclosure and responsibility

This work was developed with assistance from AI agents operating within the HORTRAME Systems research architecture. Depending on the research stage, these agents contributed to literature analysis, mathematical formulation, proof reconstruction, adversarial review, counterexample search, simulation and code analysis, verification design, reproducibility checks, revision, and manuscript preparation. AI-agent outputs were treated as research artifacts subject to verification and correction rather than as independent authority. G. Bolduc is the human author responsible for the manuscript, its claims, source selection, and publication decisions. AI-agent review does not constitute independent human peer review, proof-assistant certification, experimental validation, or publication acceptance.

The initial draft reports development by one AI assistant, including formulation, proof construction, source inspection, and numerical work; its original numerical companions are unavailable in this delivery. ENTAIL and FOLIUM subsequently produced separately frozen source reviews, compared findings, and revised assumptions, presentation, and evidence statements under the owner's direction. They share mathematical sources and tooling, so their agreement is not independent human validation. No temporary subagents were used in this revision cycle. Guillaume Bolduc is identified as the human project author; final acceptance remains for his review. No proof-assistant certificate, physical experiment, or publication acceptance is claimed.

\appendix

## Model changes and source binding

<a id="app:source"></a>
\begin{longtable}{p{0.21\linewidth}p{0.34\linewidth}p{0.37\linewidth}}
\toprule
Source object & Retained mechanism & Changed or not inherited here\\\midrule
\endhead
Historical restoration [citation: H1] & Delayed history matters; information and physical contracts remain separate. & Fixed task alphabet and injected reference replace the plain variable-support priority recurrence. No original endpoint is silently reused.\

$$
0.4em]
Disturbance recovery [citation: H2] & Equal-gain common/relative separation; exact local feedback. & Stale positions enter discrete latch recomputations, not the parent's continuously held centered-force decoder.\

$$
0.4em]
Sampled latch [citation: H3] & Fixed-cell energy contraction and nonexpansive position recentering. & Projection onto a convex translation set, physical roster changes, and delayed source tables are new. Exact source callback equivalence is not claimed.\

$$
0.4em]
Live admission shield [citation: H4] & Logical membership precedes physical influence; a fresh observation contract is necessary. & Pre-admission physical exclusion replaces the parent's free common-mode admission law; bounded cells and possible logical reference influence remain. No equivalence of shields is claimed. A robust source-stage gate is proved.\

$$
0.4em]
Finite history [citation: H5] & Retained input-dependent information is counted by the promised task. & Only current reference/control service is promised, not arbitrary historical conditional queries.\\\bottomrule
\end{longtable}
The supplied Markdown's actual SHA-256 is
`65afd409ae6302ee6c20d1c435797d9de2f82389a4ef37f0f27256588ab51df2`.
It does not match the earlier requested
`37cb5798311a8d4c76a7adef7754c1f2f9ca9867438335dc9f9dbe2e93f16679`.
This discrepancy is unresolved. The present proofs do not rely on an unseen version matching the requested hash.

## An exact held-input map for the nominal example

For $K=1$, $C=2$, held command $c$ and force $d$, write $z=x-c-d$. For elapsed time $\tau\ge0$,

$$

 x^+&=c+d+e^{-\tau}[(1+\tau)z+\tau v],\\
 v^+&=e^{-\tau}[-\tau z+(1-\tau)v].

$$

Differentiation verifies the plant and the initial values. Splitting a cell into $h-H$ and $H$ therefore gives its source and pre-commit states without interpolating between numerical integrator steps. For this critical plant and the energy with $K=1$, the largest singular value at time $h$ is

$$

 \sigma_h=e^{-h}\bigl(\sqrt{1+h^2}+h\bigr).

$$

This follows by calculating the two singular values of
$e^{-h}\left[\begin{smallmatrix}1+h&h\\-h&1-h\end{smallmatrix}\right]$.
The formula makes the sufficient age limit $H<1-\sigma_h$ explicit in the normalized example. It is a sufficient condition for this proof, not an identified physical stability boundary.

## A dependency map for review

The raw-lifetime assumptions lead to \cref{thm:reuse}, not to erasure of influence. The reference service and bounded eligible ages lead to \cref{thm:priority}, independently of a physical stability claim. The plant and coherent latch give \cref{lem:flow,lem:projection} and then \cref{thm:composition}. The separate all-body cell invariant proves \cref{thm:safety} before its bounds are used in \cref{thm:gate}; this avoids assuming tracking safety to certify the admission that is supposed to establish tracking. The broad gate and a bounded accepted queue give \cref{thm:liveness}. \Cref{thm:main} composes those specific results. The final convergence statement additionally requires the settled-body guard and a genuinely convergent, vanishing-input tail.

\begingroup

## References

1.  G. Bolduc, *Exact Restoration and Historical Memory in Delayed Priority Networks with Three-Dimensional Motion*, HORTRAME Research, supplied Markdown, v0.6, 3 Oct. 2026. Exact Markdown SHA-256 is stated in Appendix~\ref{app:source}.

1.  G. Bolduc, *Translation-Equivariant Disturbance Recovery in Delayed Open Priority Networks*, supplied preprint, v05, 2026. Exact source SHA-256: `165c9b5dda01ae9573a2af28f0b9bd78ec380bce653e594cc4a3ba4662260773`.

1.  G. Bolduc, *A Sampled Common-Translation Latch for Nominal Double Integrators*, supplied addendum, v01, 6 Oct. 2026.

1.  G. Bolduc, *A Common-Mode Shield for Live Admission in Delayed Open Priority Networks*, supplied addendum, v01, 6 Oct. 2026.

1.  G. Bolduc, *Conditional Queries with Finite Historical States and Periodic Replacement*, supplied LaTeX manuscript, v09, 2026. Title and supplied revision are used without asserting publication.

1.  M. Franceschelli and P. Frasca, “Stability of Open Multi-Agent Systems and Applications to Dynamic Consensus,” arXiv:1906.00890, 2019. Version-1 HTML, especially Sec. III and Theorem III.9, inspected. <https://arxiv.org/html/1906.00890v1>.

1.  J. P. Hespanha, D. Liberzon, and A. R. Teel, “Lyapunov conditions for input-to-state stability of impulsive systems,” *Automatica*, vol. 44, no. 11, pp. 2735--2744, 2008. doi:10.1016/j.automatica.2008.03.021. Author-hosted abstract and ISS framework inspected for context. <https://web.ece.ucsb.edu/~hespanha/published/autom-impulsive-iss.pdf>.

1.  P. \c{S}ekercio\u{g}lu, N. De Carli, and D. V. Dimarogonas, “Safe Formation Control of Open Multi-Robot Systems with Connectivity-Preserving Reconfiguration,” arXiv:2609.29939v1, 24 Sep. 2026. Secs. III--IV inspected. <https://arxiv.org/html/2609.29939v1>.

1.  M. Gong, Y. Xia, and Y. Lv, “Time-varying formation for second-order open multi-agent systems with external disturbances,” *IEEE/CAA Journal of Automatica Sinica*, vol. 13, no. 6, pp. 1524--1526, June 2026. doi:10.1109/JAS.2025.125582. Bibliographic metadata retained from the initial draft; original-body and supplement comparison not independently established in this revision. Not a theorem dependency.

1.  W. Eddy, ed., *Transmission Control Protocol (TCP)*, RFC 9293, Aug. 2022, Secs. 3.4.2--3.4.3. <https://www.rfc-editor.org/rfc/rfc9293.html>.

1.  R. Elz and R. Bush, *Serial Number Arithmetic*, RFC 1982, Aug. 1996. <https://www.rfc-editor.org/rfc/rfc1982.html>.

\endgroup