Preserving Institutional Judgment Across Time, Systems, and Agents

Publication and Lineage Notice

This paper is an explicit descendant of the locked NULLWORKS Continuity Calculus canon dated July 29, 2026; the V0.6 deployment-readiness implementation lock; and the July 31, 2026 governed-reinterpretation constitutional amendment. It inherits the six-layer constitutional stack and the Continuity Packet notation CP = <D, M, C, A, S, V>. It adds a public prior-art map, consequence-scaled decision records, maintainable institutional judgment, counterfactual boundaries, reconsideration triggers, candidate measurements, and an implementation path.

A separate August 1 predecessor manuscript referenced in planning records was not available to this build. Therefore this release does not claim a sentence-level or claim-by-claim delta against that unseen artifact, does not silently replace it, and does not infer its title, hash, or publication status. Its lineage claim is bounded to the governed canon and implementation records that were actually recovered.

The parent records remain immutable. Corrections to this release must be made as explicit descendants that preserve the source text, challenge, decision authority, changed fields, unchanged fields, resulting version, and effective publication state.

Abstract

Organizations routinely preserve the output of a decision while losing the conditions that made the decision intelligible: the meaning of key terms, the evidence then available, the assumptions that bounded the choice, the authority under which it was made, the state it changed, the definition of completion, and the conditions that should reopen it. This loss is costly in ordinary human workflows and more dangerous in agentic systems, where inherited assumptions can become executable at machine speed. Continuity Calculus is a NULLWORKS method for carrying data, meaning, context, authority, operational state, and verification together across transformations and handoffs. It treats continuity as a constitutional property rather than a storage feature.

The paper formalizes a six-dimensional Continuity Packet, distinguishes history from institutional interpretation and governed reinterpretation, proposes a Minimum Continuity Envelope for consequence-scaled decisions, and introduces the provisional concepts of Counterfactual Boundary, Reconsideration Trigger, Decision Reconstructability, Continuity Loss Vector, and Rework Exposure. It compares the framework with provenance standards, decision records, event sourcing, temporal data, records management, belief revision, privacy principles, and AI risk management. The proposed contribution is not that those disciplines are absent; it is that their partially overlapping concerns can be composed into one bounded handoff and correction contract with explicit human authority, jurisdiction, state transition, and assurance.

The framework remains exploratory. It does not prove universal completeness, semantic correctness, positive return on investment, or regulatory compliance. The V0.6 internal-alpha implementation passed 70 discovered tests on Python 3.11, 3.12, and 3.13 after a false-green test-discovery gap was preserved and repaired. External assurance, production deployment, and field validation remain open gates.

Executive Summary

Most institutions can retrieve a result. Fewer can reconstruct the judgment that produced it. A maintenance instruction remains after the machine, material, staffing, policy, or hazard that justified it has changed. A model inherits a classification label but not the dispute that defined it. A workflow preserves a completed status but not the observable condition that made completion legitimate. Each transfer can be technically correct while the useful whole decays.

Continuity Calculus addresses that decay by treating a handoff as a governed object rather than a payload. The canonical Continuity Packet contains six required dimensions: data and transport; meaning and semantics; context and intent; authority and constraints; operational state and transition; and verification and receipt. A transformation is valid only when the required dimensions survive, every material mutation is declared, the receiver is authorized, the state transition is legitimate, and the result is inspectable.

Preserve the source, but do not confuse source integrity with meaning, legitimacy, or completion.

Carry the minimum sufficient context, not the maximum possible context.

Separate capability from authority and evidence from self-executing permission.

Define completion as an observable state, not a worker's assertion.

Preserve history and original interpretation when later evidence justifies correction.

Scale record depth, retention, review, and independent assurance to consequence.

Keep consequential ambiguity under accountable human authority.

The core descendant idea is maintainable institutional judgment: an institution should be able to explain why a decision fit its original reality, detect when that fit fails, and reopen the decision through legitimate authority without pretending it always knew the corrected answer. This turns correction from an overwrite into an inspectable state transition.

The paper proposes a practical Minimum Continuity Envelope containing decision identity, actor, authority, evidence, material assumptions, rationale, before-state, intended after-state, completion definition, uncertainty, source references, verification, retention class, and a review trigger where consequence warrants it. It also proposes a Counterfactual Boundary: the conditions under which the same legitimate decision-maker would reasonably have chosen differently. Together, the envelope and boundary make future reconsideration possible without requiring an unlimited archive of everything.

The resulting architecture is neither a universal ontology nor a replacement for established disciplines. W3C PROV describes entities, activities, agents, derivations, and responsibility. Architecture Decision Records preserve context and consequences. Event sourcing preserves append-only change history and reconstructable state. Records management addresses trustworthy, usable records and retention. Belief revision studies rational change under new information. NIST AI RMF supplies lifecycle governance, context mapping, measurement, management, and human oversight. Continuity Calculus composes these concerns around a bounded operational question: what must travel with a consequential decision so that another authorized human or system can use, challenge, verify, and, when justified, correct it?

Contents

1. The Operational Problem

2. The Constitutional Architecture

3. Agentic and Technical Consequences

4. Challenge, Measurement, and Formalization

5. Application and Implementation

6. Red-Team Findings, Limits, and Open Questions

Appendix A. Minimum Continuity Envelope

Appendix B. Failure-Mode and Red-Team Catalog

Appendix C. Candidate Formal Model

Appendix D. Implementation Pattern Catalog

Appendix E. Release Audit and References

The Operational Problem

1.1 The output survives; the judgment disappears

Institutional memory is often mistaken for document storage. A document may survive while the usable judgment around it disappears. The record can show what was done without showing why it was reasonable, which evidence was unavailable, whose authority controlled, which alternative was rejected, what state was expected to change, or what future observation should force review. This is not merely a documentation inconvenience. It changes the institution's ability to distinguish a valid inherited control from a ritual, a correction from a cover-up, and a legitimate constraint from an expired assumption.

The loss occurs at seams: between shifts, departments, vendors, software systems, models, agents, generations of workers, policy versions, and institutions. Each participant may receive enough information to continue locally while the global reason gradually decays. By the time a failure becomes visible, the reconstruction burden is distributed across meetings, tickets, escalations, audits, duplicate analysis, emergency work, and blame. The organization may see each activity as necessary work even when the activities are recurring symptoms of the same continuity defect.

1.2 Physical maintenance as the originating lens

The theory emerged from a physical maintenance intuition: when a machine repeatedly fails, replacing the failed component is not enough if the system continues to recreate the condition that damaged it. A broken wire, tripped overload, clogged drain, rejected label, or unstable sensor may be the visible failure. The causal architecture includes the environment, previous repairs, material behavior, hidden workarounds, operating tempo, authority boundaries, and the reason an earlier technician chose a particular intervention. Maintenance practice therefore trains attention on state, sequence, evidence, consequence, and the difference between restoring operation and removing the leak.

The same distinction applies to administrative and digital work. A workflow can be made to pass today while preserving the mechanism that will generate tomorrow's exception. A report can satisfy a template while obscuring the source uncertainty. An AI agent can complete a task exactly as instructed while the instruction is based on a stale assumption. Operational recovery requires more than a correct local action; it requires enough continuity to understand the system that made the action necessary.

1.3 The Rework Tax

Rework Tax is a provisional term for the total avoidable burden created when missing context, defective design, displaced authority, premature closure, or uncorrected assumptions require work to be reconstructed, reversed, repeated, escalated, cleaned up, retrained, or reverified. The word tax is intentionally metaphorical. The burden is not always centrally measured or formally collected; it is paid through fragmented time, delayed outcomes, duplicate effort, interruptions, risk, and lost trust.

1.4 Bureaucracy as normalized rework architecture

A stronger and lower-confidence hypothesis is that some institutions may become structurally dependent on recurring rework. Reconstruction, escalation, reporting, exception handling, and blame transfer can stabilize as job functions rather than remain temporary responses to repairable defects. The hypothesis does not claim that all bureaucracy is wasteful or that governance itself is a defect. Many controls exist because consequences, rights, public accountability, and coordination are real. The challenge is to detect when a control no longer reduces risk but survives because the institution has organized people, incentives, metrics, or authority around the rework it creates.

Normalization of deviance literature offers an adjacent warning: repeated success in the presence of anomalies can cause a system to redefine the anomaly as acceptable. Continuity loss can create a parallel process. When the reason for a workaround disappears, the workaround may remain. When each exception is resolved locally, the recurring architecture may become invisible. Working backward from the surviving procedure - asking what failure, constraint, or fear originally made it rational - is therefore a practical research method, not proof that the procedure is obsolete.

1.5 Why agents change the risk

Agents do not create institutional forgetting, but they can accelerate its consequences. A human may encounter a stale rule intermittently and improvise around it. An agent can retrieve the rule, apply it consistently, call tools, update records, trigger downstream workflows, and repeat the action at scale before the lost assumption is noticed. Speed compresses the time available for informal correction. Consistency can make a wrong rule look authoritative. Tool access can convert interpretation into state change. Multi-agent handoffs can multiply the number of seams at which meaning, authority, or completion drifts.

The relevant distinction is not human good, machine bad. Humans also forget, rationalize, exceed authority, and normalize workarounds. The architectural claim is narrower: when automation increases execution speed, reach, and repeatability, a system should increase the quality of preserved context, authority binding, stop conditions, and receipts rather than relying on slower human friction to catch defects.

The Constitutional Architecture

2.1 Canonical definition

The adjective constitutional does not mean that every implementation resembles public law. It means the architecture specifies non-negotiable relationships among capability, authority, evidence, state, correction, and human control. An implementation can use JSON, databases, paper forms, signed messages, event logs, workflow engines, or human review, but it does not satisfy the method merely by storing a payload or adding an audit log.

2.2 The Continuity Packet

D represents data and transport; M, meaning and semantics; C, context and intent; A, authority and constraints; S, operational state and transition; and V, verification and receipt. The vector notation is a compact schema, not a claim that the dimensions are independent, continuous, or mathematically complete. In practice they interact. Authority determines which context may be disclosed. Meaning affects whether a state transition is valid. Verification depends on the completion definition. A receipt can prove that bytes were signed while leaving the semantic interpretation wrong.

Figure 1. The six constitutional layers of a Continuity Packet.

2.3 Valid transformation and declared mutation

A valid transformation need not preserve every field unchanged. Translation changes representation. Summarization changes detail. Redaction removes disclosed content. A policy decision changes effective state. What the method prohibits is silent material mutation: changing a term, assumption, authority, completion standard, source claim, or state while preserving the appearance of continuity. The receipt must distinguish inherited fields, transformed fields, omitted fields, inferred fields, disputed fields, and newly authorized fields.

This requirement also prevents maximum-context dumping from masquerading as continuity. Context must be relevant, fresh enough for the use, and authorized for the receiver. A packet that exposes every historical detail may violate privacy, overwhelm the worker, and increase the probability that irrelevant context steers the decision. Continuity is minimum sufficient context under consequence and authority, not total recall.

2.4 The Minimum Continuity Envelope

The full Continuity Packet is a constitutional model. The Minimum Continuity Envelope is a provisional implementation pattern: the smallest governed decision record sufficient for a future authorized observer to identify the decision, recover its material basis, understand the authorized state transition, and know when review is required. Its depth should scale with consequence, reversibility, novelty, uncertainty, recurrence, and the number of downstream dependencies.

2.5 Proportionality

A coffee preference and a safety shutdown should not carry identical documentation. Proportionality prevents the method from becoming a universal paperwork generator. The record depth and assurance burden should rise when decisions are hard to reverse, affect rights or safety, propagate widely, depend on volatile assumptions, involve uncertain evidence, or authorize automated state change. Low-consequence ephemeral choices may require only identity, outcome, and a short-lived receipt. High-consequence decisions may require independent review, preserved dissent, explicit counterfactuals, notice, redress, and long-term reconstructability.

2.6 Counterfactual Boundary

A rationale says why a decision was chosen. A Counterfactual Boundary asks what conditions would have caused the same legitimate decision-maker to choose differently. The distinction matters because post-hoc explanations often become unfalsifiable. A decision record that says approve because risk is acceptable provides little help when the definition of acceptable is lost. A boundary might instead record: approval depended on measured load remaining below X, the source identity being authenticated, a named control remaining active, or an affected party receiving notice before execution.

The boundary is provisional and consequence-scaled. It may be infeasible or misleading for creative, exploratory, or highly tacit judgment. It may invite hindsight bias or false precision. For that reason it should capture material conditions known at decision time, not every imaginable alternative. Its value must be empirically tested: does preserving the boundary improve reconstruction, trigger quality, correction speed, or inter-rater agreement beyond ordinary rationale and assumptions?

2.7 Reconsideration Trigger

A Reconsideration Trigger is a detectable change requiring authorized review of an earlier decision. The trigger is not the correction, reversal, appeal, redress, or remediation itself. It is the condition that reopens the question. Candidate trigger classes include a material evidence delta, invalidated assumption, changed authority or jurisdiction, policy amendment, environmental change, consequence escalation, dependency failure, time threshold, repeated anomaly, or changed system state.

2.8 Maintainable institutional judgment

The term shifts the goal from passive institutional memory to an active maintenance capability. Memory can preserve a statement. Judgment maintenance preserves the statement's answerability to evidence, assumptions, authority, consequence, and outcome. The institution can then distinguish four states: the original decision was reasonable and remains valid; the original decision was reasonable but its conditions changed; the original decision was defective under information already available; or the record is insufficient to decide. Each state has different accountability implications.

2.9 History, interpretation, and governed reinterpretation

The July 31 constitutional descendant separates three objects. History is what occurred and what was preserved. Institutional interpretation is what the institution was justified in concluding from the evidence, policy, authority, jurisdiction, and uncertainty available at decision time. Governed reinterpretation is what the institution becomes justified in concluding after a material change in the evidential landscape. The correction path must preserve all three rather than replacing the first two with the newest conclusion.

Figure 2. Decision continuity, reconsideration, and explicit descendant correction.

Evidence does not self-authorize a replacement decision. A remote node, model, analyst, or reviewer may submit authenticated evidence or a correction petition. Local legitimate authority must determine materiality and effective-state change within its jurisdiction. Different legitimate institutions may preserve the same evidence and reach different interpretations under different constitutions or values. The architecture seeks convergence on evidence identity and lineage, not manufactured consensus.

2.10 Correction without historical rewrite

1. Reference the immutable history and original interpretation.

2. Identify the new evidence or invalidated condition as a material delta.

3. Validate the source, custody, relevance, and uncertainty of the delta.

4. Validate jurisdiction and correction authority.

5. Record review, dissent, and the allowed disposition.

6. Create an explicit descendant decision: uphold, clarify, narrow, amend, supersede, withdraw, recant, reopen, remediate, escalate, or defer unresolved.

7. Project the new effective state only after authorization.

8. Link notices, downstream remediation, and independent assurance when required.

9. Preserve the correction as challengeable and supersedable by a later descendant.

Agentic and Technical Consequences

3.1 The agent handoff problem

Modern agent systems divide work among models, tools, services, and human reviewers. The visible transcript is rarely the entire operational state. Tool calls mutate external systems; prompts omit prior constraints; summaries compress dissent; model replacement changes behavior; memory systems retrieve context probabilistically; and authorization is often attached to credentials rather than the purpose for which the credential was granted. A useful handoff therefore needs more than conversation history.

Recent work on event-sourced memory for heterogeneous coding agents and agent-specific extensions of W3C provenance confirms that agent continuity, traceability, and cross-tool handoff are active research problems. Those approaches overlap strongly with the transport, lineage, and reconstructability concerns of Continuity Calculus. The additional NULLWORKS claim is that provenance and memory must be bound to constitutional authority, explicit state transitions, completion definitions, correction lineage, and final human control when consequences require it.

3.2 Capability is not authority

An agent may possess a token that can update a database, send an email, deploy code, or purchase a service. Technical capability answers can it execute? Constitutional authority answers may it execute this action, for this purpose, on this target, during this time, under these constraints, with this consequence owner, and with what stop conditions? Treating credentials as complete authority collapses these questions. The result is overbroad delegation and ambiguous accountability.

The packet should therefore bind grants and prohibitions to identity, tenant or institution, target, action class, risk class, purpose, context references, expiration, revocation, completion definition, and escalation path. High-consequence ambiguity should fail closed or route to an accountable human. Human authority is not a decorative approval field; it is a constitutional boundary over legitimate state change.

3.3 Completion is an observable contract

Agent systems frequently confuse a successful tool response with a successful outcome. A deployment command returning 200 does not prove the intended site is live. A message being accepted by an API does not prove it reached the intended person. A file being generated does not prove it contains the requested evidence. Continuity Calculus requires explicit completion definitions that connect the action to an observable state and identify the verifier and consequence owner.

3.4 Security, privacy, retention, and selective disclosure

Preserving context can become surveillance if the architecture assumes that more data is always better. The framework must therefore be paired with purpose limitation, data minimization, storage limitation, access control, and deletion or redaction receipts. GDPR Article 5 provides a clear external expression of these principles: personal data should be adequate, relevant, limited to what is necessary, accurate, and retained no longer than necessary for the purpose. Continuity does not override those duties.

The implementation pattern is to separate the existence and integrity of evidence from universal disclosure of its content. A packet may carry a content-addressed reference, classification, retention state, and proof of prior existence while keeping sensitive material in an encrypted evidence vault. A receiver receives the minimum authorized projection. Withheld paths, redactions, and deletion actions leave bounded receipts. Some future decisions may become less reconstructable because lawful deletion is more important than institutional convenience; that loss should be explicit rather than secretly circumvented.

Cryptography can protect transport, custody, and tamper evidence. It cannot by itself prove intended meaning, legitimate jurisdiction, complete context, or moral and legal validity. A signed wrong interpretation is still wrong. A hash can show that a packet did not change after signing; it cannot show that the packet included the evidence or authority it should have included.

3.5 V0.6 implementation evidence

The current NULLWORKS reference implementation is an internal alpha, not a production deployment. Its governed record describes a fail-closed six-layer validator, deterministic packet hashing and governed diffs, append-only packet and receipt persistence, context freshness and minimum-necessary-context checks, capability grants and revocations, replay protection, authenticated federation, constitutional policy compilation, selective disclosure, encrypted transport, key-custody boundaries, certificate lifecycle, deployment gateway, recovery drills, tenant-isolation checks, field-pilot controls, challenge packets, and a human adjudication surface.

The implementation record preserves a false-green assurance failure: an earlier continuous-integration check did not discover the intended full suite. The gap was repaired and retained as evidence that a green status is not proof that the required tests ran. The V0.6 merge records 70 discovered tests passing on Python 3.11, 3.12, and 3.13. This is evidence of the bounded reference suite, not proof of production security, cross-organization interoperability, field benefit, or independent assurance.

Challenge, Measurement, and Formalization

4.1 Relationship to adjacent disciplines

Figure 3. Continuity Calculus as a governed composition of adjacent disciplines.

The framework should therefore avoid the claim that no one has preserved context, provenance, rationale, authority, or correction before. Its defensible research contribution is an explicit constitutional integration: a decision handoff object that treats meaning, minimum context, jurisdiction, operational state, verification, and future reconsideration as jointly required dimensions whose depth is scaled by consequence.

4.2 Candidate Continuity Loss Vector

The vector makes one practical point: a handoff can be strong in one dimension and dangerously weak in another. A cryptographically protected packet may have q_D near one while q_C or q_A is low. A detailed narrative may preserve context but fail state or verification. Collapsing the vector into a single score can hide veto conditions, so any aggregate should retain fail-closed rules for authority, prohibited state transitions, source integrity, and required assurance.

4.3 Decision Reconstructability

Decision Reconstructability is the degree to which an authorized future observer can recover the evidence, rationale, assumptions, authority, state transition, and conditions for review. A useful test is not whether the observer agrees with the decision, but whether the observer can reproduce the decision problem as it was understood at the time, identify where uncertainty or discretion entered, and distinguish later knowledge from original knowledge.

A reconstructability test can be performed by a blinded authorized reviewer who receives the preserved envelope but not the original conclusion. The reviewer attempts to identify the option set, material evidence, authority, likely action, and review conditions. Agreement, time-to-reconstruction, missing-field count, and confidence calibration provide telemetry. A high DR score does not prove the decision was good; it shows that the decision remains inspectable.

4.4 Rework Exposure

Rework Exposure is prospective, not a claim of certain savings. The formula is useful only if recurrence probabilities and costs can be estimated without treating every future activity as avoidable. It should include uncertainty ranges, avoid double counting, and compare the repair cost of better continuity against the expected loss. Some defects should be monitored rather than repaired because the envelope cost exceeds likely lifetime rework. Others should be fixed immediately because they create catastrophic or cascading risk.

4.5 Telemetry that does not reward theater

Correction count is especially ambiguous. A system with more corrections may be learning well, discovering more defects, or producing more errors. A system with few corrections may be stable, opaque, suppressing challenges, or unable to reopen decisions. Measurement must compare correction quality, consequence, baseline error, review access, and state outcomes rather than treating one count as governance success.

4.6 Falsification and challenge conditions

The paper should be weakened, revised, or rejected where evidence shows that its extra structure does not improve decision reconstruction, challenge quality, correction legitimacy, or operational outcomes relative to simpler alternatives. Specific falsification conditions include:

A consequential class of decisions remains reliably reconstructable and corrigible from data integrity and ordinary audit logs alone.

The Counterfactual Boundary adds no value beyond rationale and assumptions, or systematically invites post-hoc rationalization.

The Minimum Continuity Envelope creates more burden and privacy risk than the rework or consequence it prevents.

The six dimensions cannot coherently classify observed continuity failures without distortion or duplication.

Independent reviewers cannot apply the layer definitions consistently enough for operational use.

The correction lineage preserves history but makes present effective state ambiguous or unsafe.

Human authority gates become ceremonial bottlenecks rather than accountable consequence ownership.

Agent systems with simpler provenance and authorization controls perform as well under adversarial and field tests.

Application and Implementation

5.1 Use cases

5.2 Implementation path

1. Select one bounded workflow with recurring handoffs, meaningful consequence, and observable outcomes.

2. Inventory current decisions, artifacts, authority paths, state transitions, failure modes, retention duties, and hidden workarounds.

3. Define canonical terms and one authoritative completion contract.

4. Design a consequence-scaled Minimum Continuity Envelope; explicitly exclude unnecessary context.

5. Bind actor identity, authority, jurisdiction, prohibitions, expiry, stop conditions, and consequence ownership.

6. Preserve source references, evidence classes, before-state, after-state, and append-only receipts.

7. Define reconsideration triggers and permitted descendant dispositions.

8. Run adversarial fixtures: stale context, lexical drift, unauthorized action, replay, false completion, missing evidence, remote coercion, history overwrite, and false assurance.

9. Measure reconstruction time, missing material fields, state mismatch, correction latency, rework recurrence, and privacy burden against a baseline.

10. Escalate the architecture only where the evidence supports additional cost; preserve failures and rejected hypotheses.

5.3 Reference implementation patterns

Structured decision envelope with typed evidence, authority, state, and verification fields.

Content-addressed evidence references and immutable event receipts.

Minimum-necessary context projection and selective disclosure.

Tiered retention, encrypted evidence vaults, deletion receipts, and proof of prior existence.

Parent-descendant lineage with explicit changed and unchanged fields.

Challenge ledger with attribution, quotation permission, conflict, and disposition.

Materiality gate and jurisdiction validation before effective-state change.

Effective-state projection separated from the append-only historical log.

Review-trigger monitor and decision-reconstruction tests.

Independent challenge packets that exclude private material and preserve truth boundaries.

5.4 Publication as an implementation test

This paper itself should obey the architecture it proposes. Its parent records are named. Its claims are classified. Unsupported novelty and mathematical completeness are prohibited. The V0.6 implementation evidence is separated from external assurance. Provisional concepts are visibly provisional. The missing predecessor manuscript remains unresolved rather than reconstructed. Challenges should produce public or private receipts according to permission, and accepted changes should appear as explicit descendants rather than silent edits.

Red-Team Findings, Limits, and Open Questions

6.1 Internal red-team findings

6.2 Limitations

The framework originates in NULLWORKS operational doctrine and one internal-alpha implementation lineage; it lacks independent field replication.

The six-layer model is a useful current constitution, not a demonstrated universal decomposition of institutional judgment.

The proposed measurements have not been calibrated across domains or shown to predict outcomes.

The paper does not resolve conflicts among transparency, privacy, deletion, intellectual property, privilege, and security.

Human authority can be unjust, incompetent, unavailable, or structurally conflicted; preserving authority does not prove legitimacy.

A reconstructable decision can still be wrong, discriminatory, unsafe, or unlawful.

Some tacit, embodied, creative, or relational judgment may resist formal envelopes without destructive simplification.

The architecture may be too expensive for low-consequence work and too weak for regulated high-consequence domains without additional controls.

The exact August 1 predecessor manuscript remains unavailable, so the release cannot claim a complete paper-to-paper delta.

6.3 Open research questions

1. Can independent reviewers apply the six dimensions with acceptable agreement?

2. What is the smallest envelope that materially improves reconstruction for each consequence tier?

3. Does a captured Counterfactual Boundary improve trigger precision and correction quality?

4. How should lawful deletion affect proofs of prior existence and future reconstructability?

5. When should local interpretive divergence be preserved, escalated, or resolved?

6. How can authority quality and conflict be assessed without allowing the system to manufacture legitimacy?

7. What baseline distinguishes productive iteration from avoidable rework?

8. Which continuity failures are leading indicators of downstream incidents?

9. Can agentic provenance standards be extended with portable authority, completion, and correction semantics?

10. How should non-deterministic model behavior be represented in decision reconstruction and cross-version comparison?

11. What external assurance protocol is appropriate for a method that combines technical and institutional claims?

12. Does the six-layer constitution require a descendant amendment after hostile cross-domain use?

6.4 Conclusion

Institutions do not fail only because they lack data. They fail because data is separated from meaning, meaning from context, context from authority, authority from state, and state from proof. The result is a record that can be transported but not legitimately used, repeated but not challenged, corrected but not historically understood, or automated without the judgment that once bounded it.

Continuity Calculus proposes that the useful whole should travel together, in proportion to consequence. A Continuity Packet preserves the dimensions required for a bounded handoff. A Minimum Continuity Envelope keeps that requirement practical. A Counterfactual Boundary and Reconsideration Trigger make long-lived decisions maintainable. Governed reinterpretation lets an institution learn without rewriting the past. Receipts preserve bounded evidence without claiming universal truth. Human authority remains final where ambiguity creates consequence.

The theory is not finished, and it should not pretend to be. Its next legitimate step is not a larger claim. It is a bounded external test: compare a real workflow with and without the envelope; measure reconstructability, state mismatch, correction quality, rework, privacy burden, and operator experience; submit the result to hostile review; preserve the failures; and create the next explicit descendant.

Appendix A. Minimum Continuity Envelope - Reference Schema

Appendix B. Failure-Mode and Red-Team Catalog

Appendix C. Candidate Formal Model

The following notation is an operational research scaffold. It does not establish mathematical completeness, independence of dimensions, calibrated measurement, or a universal calculus.

Each I_i is an invariant set for the corresponding constitutional dimension. A transformation can be accepted only if mandatory invariants pass or the packet fails closed with a receipt. Domain policy determines which invariants are mandatory and which may remain unresolved.

q_t is an assessment vector, not an objective physical quantity. Scores may be ordinal, categorical, or probabilistic. Veto conditions should not be averaged away.

R_t is the set of candidate reconsideration triggers: changes in evidence, assumptions, authority, jurisdiction, policy, environment, consequence, system state, or time. A trigger opens review; it does not itself authorize state change.

GR is governed reinterpretation. It requires an immutable parent, inspectable evidence delta, materiality assessment, valid authority and jurisdiction, review record, allowed disposition, and effective-state receipt.

Decision Reconstructability and Rework Exposure are candidate measurements. The first assesses recoverability of the decision problem; the second estimates future burden from identified continuity defects. Both require domain-specific validation and uncertainty reporting.

Appendix D. Implementation Pattern Catalog

Appendix E. Release Audit

References

[1] NULLWORKS. Continuity Calculus Canon v0.1. Governed internal record, July 29, 2026. Git commit lineage includes 47675312059e387c69dcbe188f79dad6f5e49dc0; locked record blob SHA 3250823905f29cfd20254a146363a443f828025a.

[2] NULLWORKS. Continuity Calculus V0.6 current pointer and deployment-readiness truth boundary. Governed internal record, July 29, 2026; merge commit 7e89828f221eba85f648e82aa77468da4230a704.

[3] NULLWORKS. Governed Reinterpretation and Inspectable Correction - Constitutional Amendment V0.7. Governed internal descendant, July 31, 2026; blob SHA 93df95522b981ffa5d58c8a67c567d3348637b47.

[4] Moreau, L., Missier, P., et al. PROV-DM: The PROV Data Model. W3C Recommendation, 2013.

[5] Tabassi, E. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1, National Institute of Standards and Technology, 2023. doi:10.6028/NIST.AI.100-1.

[6] National Institute of Standards and Technology. NIST SP 800-171 Rev. 3 and SP 800-171A Rev. 3: audit record content and assessment evidence, 2024.

[7] National Archives and Records Administration. NARA Bulletin 2025-01: Metadata Guidance for the Transfer of Classified Electronic Records, January 22, 2025.

[8] National Archives and Records Administration. Guidance on Managing Web Records: trustworthy records, content, context, structure, reliability, authenticity, integrity, and usability.

[9] European Union. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 5: purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

[10] Microsoft. Event Sourcing Pattern. Azure Architecture Center, current documentation accessed August 1, 2026.

[11] Nygard, M.; Architecture Decision Record community. Architecture Decision Records: documenting important decisions with context and consequences.

[12] Alchourrón, C. E., Gärdenfors, P., and Makinson, D. On the Logic of Theory Change: Partial Meet Contraction and Revision Functions. Journal of Symbolic Logic 50(2), 1985, pp. 510-530.

[13] Vaughan, D. The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA. University of Chicago Press, 1996; enlarged edition 2016.

[14] U.S. Government Accountability Office. Reports and testimony on knowledge transfer, phased retirement, workforce succession, and institutional knowledge, including GAO-17-536 and GAO-19-696T.

[15] Souza, R., et al. PROV-AGENT: Unified Provenance for Tracking AI Agent Interactions in Agentic Workflows. arXiv:2508.02866, 2025.

[16] dos Santos Filho, E. B. ESAA-Conversational: An Event-Sourced Memory Layer for Continuity, Handoff, and Curation Across Heterogeneous LLM Coding Agents. arXiv:2606.23752, 2026.

[17] Operational Recovery Series, NULLWORKS. The Workflow on Paper Was Never the Workflow v0.6; From Runtime Truth to Operational Recovery v0.4; TAC OPS: A Governed Label Recovery Architecture v0.4. Final red-team boundary packet, July 27, 2026.

Source Links

W3C PROV-DM

NIST AI RMF 1.0

NIST AI RMF Core

NARA Bulletin 2025-01

NARA trustworthy web records guidance

GDPR Article 5

Azure Event Sourcing Pattern

Architecture Decision Record examples

PROV-AGENT

ESAA-Conversational

Release Receipt

NO RECEIPT, NO SYNC. NO FAKE FINISH LINES. HUMAN AUTHORITY REMAINS FINAL.