Stability contract
Five explicit states, safe holds, retry safety, and a signed record around every maintained run.
UNLOCKED means no ordinary acquisition has been consumed. IDENTIFYING means the local writable response or the confirmation window is still being established. CONVERGED means the declared tolerance held for the complete confirmation window. DEGRADED means the contract is not confirmed while correction or a safe hold remains active. DECLINED is terminal for that session.
Every client 0.5.1 start and step carries an idempotency identifier. A transport retry replays the original response and advances state once, including concurrent duplicate delivery. Reusing an identifier with a different payload is rejected.
The layer keeps the last configuration observed inside tolerance. An in-tolerance acquisition is held while confirmation completes. A stale acquisition is held without a controller update. Repeated misses of a caller-declared acquisition deadline decline the session and return the safest known configuration.
Conditions expose stable codes, summaries, capped affected-channel lists, numeric evidence, remedies, and evidence tiers. They do not expose private controller constants or the hosted update mechanism.
opt = SWCOptimizer(key, n=len(x0), mode="regulation", target=target)
x = opt.start(x0)
for _ in range(rounds):
x = opt.step(measure(x), target=target)
proof = opt.end()Controls and observables may differ
n is the number of observed responses. Set n_controls and assign when several writable controls serve each observable. Every control maps to exactly one observable, and every observable must be served. The 18-control, 6-observable assignment used in the manuscript is accepted directly.
Shared and per-control configuration bounds are supported. A structured bounds object carries explicit units; a bare pair is labeled as caller-declared configuration units. Configuration bounds live in writable-configuration space, not response space.
Roles and declared detector boundaries
Setpoint is the default role for a sole writer. Use map with writer shared when another workload owns the commands, or observer when the layer must report without writing. The shipped client keeps these roles explicit and rejects a shared-writer setpoint contract.
The layer never assumes that arbitrary response values are normalized. Drift, response-slope, and response-boundary declines activate only when you declare drift_envelope, minimum_response_slope, or response_bounds in meaningful units. Otherwise the corresponding quantities remain diagnostics rather than universal thresholds.
Attestation
end() returns an Ed25519-signed record by default. It contains the session fingerprint, key fingerprint, declared geometry, tolerance, confirmation window, state transitions, scalar RMS trajectory, conditions, active family member, resource class, and runtime, contract, registry, build, and machine identifiers.
The record excludes the raw key, session token, measurement vectors, target vector, and configuration vectors. Verify it through the public verification endpoint or with the published Ed25519 public key from /api/runtime/status.
The record attests what the deployed layer observed and enforced. It does not convert deployment behavior into a manuscript experiment or guarantee an untested hardware instance.
Run preflight, inspect the evidence scope, then compare the active default and your incumbent under one measured budget.