# EPISODE action-binding mechanics preregistration

Date: 2026-07-23

Status: frozen before implementation

## 1. Purpose

MCTFR is closed as a learned mechanism because true-target and shuffled-target
training both produce the same perfect hard quotient. The next board must make
model-owned selection necessary. It must be impossible to pass by propagating
every available transition, activating every operator, or treating the episode
as an unlabeled union graph.

The proposed mechanism is **EPISODE**: Endogenous Predictive Intervention-State
and Operator Discovery Engine. A future neural implementation will compile raw
tokens into competing episode-specific state/action hypotheses, refute
inconsistent hypotheses using their worst contradictory witness, select one
hypothesis once, delete the source, and execute the query only through the
selected binding and ordered operators.

This first CPU board tests the identifiability and anti-shortcut mechanics. It
does not test Shohin, language, or a learned neural mechanism.

## 2. Frozen finite system

Each base system has:

- eight anonymous states;
- three bijective, generally noncommuting physical operators;
- three fresh opaque action tokens;
- eight fresh opaque state tokens;
- a complete set of demonstration transitions;
- one query start state;
- a query word of depth one through six.

Only ordinary integer token IDs and padding are model-visible. Demonstration,
transition, query, and separator markers are ordinary source tokens. Physical
operator identities, latent state identities, action bindings, renderer
provenance, cyclic-orbit membership, target state, and assessor products remain
offline.

The first board uses complete transition demonstrations intentionally. It
isolates episode-local binding and ordered composition before adding sparse
system identification. Passing it is necessary but not sufficient for the full
EPISODE proposal.

## 3. Cyclic action-binding triples

For each base system, construct three variants indexed by
`r in {0, 1, 2}`. Visible action token `a_j` denotes physical operator
`T_(j+r mod 3)` in variant `r`.

The query start state and visible query action word are identical across the
three variants. Generation accepts a query only when the three cyclic bindings
produce three distinct terminal states.

Because every bijective operator is demonstrated once from every state:

- each visible action token occurs equally often in every variant;
- each state token occurs equally often as a demonstration source and target;
- the complete raw-token histogram is identical across the triple;
- erasing action-token identity from demonstrations yields the same ordered
  transition witnesses;
- the unlabeled union of transition graphs is identical;
- query length, start state, query token sequence, padding, and renderer are
  identical;
- the three correct target tokens are distinct.

Any deterministic action-agnostic or all-actions-union method must emit the same
answer on all three variants and therefore has exact accuracy at most `1/3` on
every complete triple.

## 4. Ordered noncommuting twins

For qualifying systems, construct matched queries `ab` and `ba` from the same
start state whenever they have different terminal states. Demonstrations,
query-action histograms, and all non-query tokens are identical. A
query-order-bagging method must emit the same answer for both and is capped at
`1/2`.

## 5. Independent offline oracles

Two independent CPU procedures must agree on every scored episode:

1. **Visible-table executor:** parse the raw demonstration stream into a typed
   `(state token, action token) -> state token` table and execute the ordered
   query.
2. **Binding enumerator:** enumerate all permutations from visible action
   tokens to the assessor's three physical operators that are consistent with
   every demonstration, then execute the query under every surviving binding.

An episode is identifiable only when all surviving bindings yield one terminal
state token. An intentionally underidentified episode must return `ABSTAIN`.
No ambiguous episode may be scored as an ordinary answer.

## 6. Source-deletion contract

A future model may compile and retain only:

- anonymous state slots;
- episode-specific action slots and binding probabilities;
- candidate transition operators;
- the model-proposed ordered query queue;
- competing-hypothesis weights;
- serializer state and a halt/abstain latch.

Before execution it must destroy:

- input token IDs and embeddings;
- transformer residuals and KV cache;
- compiler scratch activations not listed above;
- physical operator and latent state identities;
- renderer, orbit, family, target, and oracle metadata;
- all source-file access.

Post-deletion source poisoning must leave output bit-identical. Scrambling the
selected action binding must sharply reduce exactness. Scrambling discarded
hypotheses must not.

## 7. Mandatory controls

- action-erased union graph;
- every action active simultaneously;
- fixed global action meanings;
- shuffled final targets;
- shuffled demonstration action labels;
- query-order bagging;
- demonstration-order bagging;
- query-only prediction with demonstrations masked;
- frozen random compiler plus trained reader;
- parameter-matched ordinary transformer;
- host-supplied visible transition table as an explicitly labeled ceiling.

## 8. Mechanics-board gates

The CPU generator is qualified only if:

- two independent oracles agree on every generated episode;
- every cyclic triple has three distinct targets;
- every cyclic triple has an identical raw-token histogram;
- every cyclic triple has an identical action-erased transition stream;
- the action-agnostic and all-actions controls are at most `1/3`;
- every order twin has identical query-action histograms and different targets;
- the order-bagging control is at most `1/2`;
- state/action nonce renaming preserves oracle answers under the induced map;
- irrelevant demonstration permutation and padding preserve answers;
- malformed, duplicated, conflicting, truncated, and out-of-domain streams
  fail closed;
- model-visible payloads contain no offline key, physical operator identity,
  latent state identity, binding, target, or orbit membership.

## 9. Neural promotion gates

A neural pilot may be promoted only if, on one unopened manifest:

- exact cyclic-triple accuracy is at least 90%;
- both members are solved in at least 85% of order twins;
- treatment exceeds the action-agnostic control by at least 45 points;
- unseen action and state nonce recoding exactness is at least 90%;
- depth-five/six composition exactness is at least 80%;
- selected-binding scrambling costs at least 40 points;
- discarded-hypothesis scrambling costs at most two points;
- shuffled-target training remains at or below 40%;
- source deletion and tamper evidence pass;
- three fresh model/data seeds reproduce the result before Shohin integration.

Passing establishes bounded raw-token episode-specific binding and ordered
composition. It does not establish unrestricted language reasoning.

## 10. Parameter and continuation boundary

The complete model remains below 200 million parameters. A provisional maximum
budget is:

| Component | Added parameters |
|---|---:|
| token/event adapters | 18M |
| competitive state/action compiler | 16M |
| operator hypernetwork | 18M |
| hypothesis/refutation controller | 9M |
| executor/halt/serializer | 8M |
| **added ceiling** | **69M** |
| protected Shohin base | **125,081,664** |
| **complete ceiling** | **194,081,664** |

The protected base remains
`train/flagship_out/ckpt_0300000.pt`, SHA-256
`211d6b2cddf0c2cf8b12cb0b2d73f9c4440d85f6f531018080c8afd35b2f66a6`.

No trillion-token continuation is authorized merely because this CPU board
passes. The mechanism must first survive neural controls, integrate into the
residual path, and learn under a mixed next-token plus state-transition,
operator-binding, counterfactual, and composition objective. Continuation data
must contain observable before/action/after structure such as code traces,
mathematical transformations, edits, plans, and counterfactual narratives.
Ordinary next-token loss alone is not assumed to train the mechanism.

## 11. Pre-implementation hostile-audit amendment

The following requirements were added before any neural model or corpus score.
They strengthen rather than relax the gates above.

1. **Six-case clusters are indivisible.** Every statistical family contains
   three cyclic action bindings for one query word and the same three bindings
   for a reordered query with the identical action-token bag. The world prefix
   is byte-identical between the two query orders for each binding. Promotion
   scores complete six-case clusters, not six independent examples.
2. **Late query custody is mandatory.** The world is compiled and hash-committed
   before the query suffix is materialized. Query-conditioned compilation of
   the world is prohibited. Multiple queries over one committed world must not
   change its serialized state.
3. **No host-built particles.** The treatment forward receives token IDs and a
   conventional attention mask only. The host may not supply spans,
   demonstration indices, state/action roles, candidate systems, particles,
   chart overlaps, query queues, identifiability flags, renderer IDs, family
   IDs, or latent cardinality.
4. **Surface controls are explicit.** Token bags, token-position histograms,
   lengths, masks, template features, action-erased streams, union graphs,
   path counts, endpoint majorities, sinks, and stationary-distribution
   controls must remain at or below the exact one-third symmetry ceiling.
5. **Particle custody is model-owned.** Particles start exchangeably. Random
   particle reindexing must reindex internal state equivariantly. No
   target-based matching or best-particle evaluator may affect autonomous
   scoring.
6. **Execution is one-shot.** One hard hypothesis selection, one ordered
   rollout, and one answer are scored. Invalid, abstaining, timed-out, and
   malformed cases remain in the denominator; there is no retry, beam rescue,
   repair, set-valued credit, or best-seed selection.
7. **Deletion is process-level for the decisive gate.** A fresh execution
   process receives only the allowlisted serialized workspace. It cannot read
   source tokens, embeddings, residuals, KV cache, compiler scratch,
   environment metadata, or source files.
8. **Fresh semantics, not fresh spelling.** Confirmation holds out complete
   physical operator triples and state conjugacy families in addition to
   renderers, nonces, and composition words.

The initial implementation is authorized only for deterministic CPU mechanics,
two independent oracles, symmetry controls, fail-closed parsing, world/query
commitment, and complete-cluster audits. Neural training remains unauthorized
until those receipts are frozen.

## 12. CPU mechanics result

Commit `1532fe2` was the final source state before the frozen default corpus
was generated. The corpus contains:

- 256 training and 64 development six-case clusters;
- 1,536 training and 384 development packets;
- 1,920/1,920 unique packet digests;
- 1,920/1,920 visible-table/binding-enumerator oracle agreement;
- zero exact packet overlap;
- zero exact physical-operator-family overlap;
- 640/640 cyclic token-histogram invariants;
- 640/640 cyclic action-erasure invariants;
- 960/960 paired late-query world commitments.

The deterministic controls score:

| Control | Correct | Rate | Frozen ceiling |
|---|---:|---:|---:|
| action-agnostic | 250/1,920 | 13.0208% | 33.3333% |
| all-actions union | 262/1,920 | 13.6458% | 33.3333% |
| query-order bagging | 638/1,920 | 33.2292% | 50% |

The model-payload, target-label, and offline-ledger logical SHA-256 values are
respectively
`f975291b22560e07cfa5e636133cb62c5688cfb8b39b8786812ea40610807323`,
`aa0afa01882e24f9c3d708c8cdd2d9f7bb5978a9dae79c2f4c90c5c355972283`,
and
`3ae85435030c80ac58a4ed16cab5d50e28250826994377a588aa1690b7e2ecec`.
The manifest file SHA-256 is
`9eb3289d9d64b09d4886c71f1a9d8dd7167479f5c3d042a6ebb9bd6de4de53ed`.
The atomic bundle passes hash verification.

The focused board/generator suite passes `36/36`. The earlier integrated
ECCR/MCTFR/EPISODE board suite passed `155/155`; the vocabulary-compatibility
gate was added afterward and the focused board now passes `29/29`.

This qualifies the CPU mechanics and corpus custody only. It authorizes design
and testing of the smallest causal residual-workspace slice. It does not
authorize a neural claim, full workspace scale, or trillion-token continuation.