# LOOP_STATE_MACHINE

**Type:** Formal state-machine specification for the Top-Level Dual-System Loop
**Authority:** Phase 2 implementation plan (top-level loop clause); Ogata closed-loop control theory; E7 enforcement-surface contract; Phase 1 Gate frame-independence principles.
**Invocation:** Phase 0 pre-flight of `SKILL.md`; before every state transition; at build-time verification (Phase 8.5).

---

## 1. Purpose

Specify the five states, nine transitions, and per-transition guards that define the Top-Level Dual-System Loop. The machine is finite, bounded, and deterministic. Non-determinism in sub-state (RAM or Evaluator internals) does NOT leak into this machine -- sub-state is encapsulated behind router handoffs.

---

## 2. States

| State | Meaning | Entry | Exit |
|---|---|---|---|
| `INIT` | Operator question received; loop allocating resources. | `/research <question>` | Frame Registry returns divergence record |
| `RAM` | RAM Router executing a full producer cycle. | Transition from INIT or DECIDE (REOPEN) | RAM Router returns artifact OR E1 alarm fires |
| `EVALUATOR` | Evaluator Router executing a full auditor cycle (E1 check -> E8 check -> E2/E4/E5/E9 -> E7 verdict). | Transition from RAM | E7 emits verdict token |
| `DECIDE` | Coordinator dispatches on E7 verdict token. | Transition from EVALUATOR | One of REOPEN (-> RAM), PASS (-> TERMINAL-PASS), PASS-DEFERRED (-> EVALUATOR after dwell), ESCALATED (-> TERMINAL-ESCALATED) |
| `TERMINAL-PASS` | Converged; final artifact assembled; loop closed. | Transition from DECIDE (PASS) | (none -- absorbing) |
| `TERMINAL-ESCALATED` | Automated authority surrendered to human reviewer; loop frozen. | Transition from DECIDE (ESCALATED) or INIT (frame-convergence) or any state (operator abort / isolation alarm) | (none -- absorbing) |

Note: `TERMINAL-PASS` and `TERMINAL-ESCALATED` are both **absorbing** -- once entered, the loop does not transition further for this question. Re-opening an escalated question requires a NEW `/research` invocation after human disposition lands via Charter channel.

---

## 3. Transitions + Guards

### T1: ENTRY -> INIT

- **Trigger:** `/research <question>` received.
- **Guard:** Charter parameters present; enforcement-surface contract verified; Isolation Verifier channel live.
- **Action:** Allocate `cycle_id`, `question_id`; initialize loop history.
- **Failure:** `EC-CHARTER-MISSING` | `EC-ENFORCEMENT-SURFACE-DEGRADED` | `EC-ISOLATION-ALARM` -- transition directly to TERMINAL-ESCALATED.

### T2: INIT -> RAM

- **Trigger:** Frame Registry returns `{divergence_verified: true}`.
- **Guard:** `ram_frame_id != evaluator_frame_id` AND E8 pre-run gate passed.
- **Action:** Hand to RAM Router with `{question, question_id, cycle_id=1, evaluator_findings=null}`.
- **Failure:** `divergence_verified == false` -> `EC-FRAME-CONVERGENCE` -> TERMINAL-ESCALATED.

### T3: RAM -> EVALUATOR

- **Trigger:** RAM Router hands back `ram_artifact_ref`.
- **Guard:** E1 isolation alarm NOT raised during RAM execution (surfaced via Evaluator Router's runtime channel).
- **Action:** Hand to Evaluator Router with `{ram_artifact_ref, question_id, cycle_id, frame_registry_entry}`.
- **Failure:** E1 alarm -> `EC-ISOLATION-ALARM` -> TERMINAL-ESCALATED.

### T4: EVALUATOR -> DECIDE

- **Trigger:** Evaluator Router hands back `{verdict_token, basis_record, scored_artifact, findings, e9_signals, escalation_record?}`.
- **Guard:** `verdict_token in {REOPEN, PASS, PASS-DEFERRED, ESCALATED}`. Anything else (including absent, prose, hedged) -> `EC-ADVISORY-REGRESSION`.
- **Action:** Enter DECIDE.
- **Failure:** Non-binary verdict -> `EC-ADVISORY-REGRESSION` -> TERMINAL-ESCALATED with defect log.

### T5: DECIDE -> RAM (on REOPEN)

- **Trigger:** `verdict_token == REOPEN`.
- **Guards (all must hold):**
  1. `reopen_count < charter.reopen_ceiling_N` (default N=3).
  2. `(now - last_reopen_close_ts) >= charter.dwell_time_floor` OR `last_reopen_close_ts == null` (first reopen).
  3. E7 ceremonial-override signal NOT active (if active, E7 should have emitted ESCALATED; mismatch -> `EC-CEREMONIAL-MASK-LEAK`).
- **Action:** Increment `reopen_count`; stamp `last_reopen_close_ts`; emit ack-only enforcement confirmation `{ack: true, cycle_id, rerun_initiated: true}`; construct rerun input `{question, question_id, cycle_id += 1, evaluator_findings: basis_record.composite_evidence}`; hand to RAM Router.
- **Failure:** Guard violation -> corresponding error class -> TERMINAL-ESCALATED.

### T6: DECIDE -> EVALUATOR (on PASS-DEFERRED, after dwell elapses)

- **Trigger:** `verdict_token == PASS-DEFERRED`.
- **Guards:**
  1. `sub_dwell_deferral_counter < charter.sub_dwell_cap` (default cap = 2).
  2. Dwell interval has elapsed since last reopen-close.
- **Action:** Increment `sub_dwell_deferral_counter`; wait until dwell elapses; hand to Evaluator Router for re-evaluation with the SAME RAM artifact (no rerun).
- **Failure:** Cap reached -> E7 should have emitted ESCALATED instead of PASS-DEFERRED; mismatch -> `EC-DWELL-VIOLATION` -> TERMINAL-ESCALATED.

### T7: DECIDE -> TERMINAL-PASS (on PASS)

- **Trigger:** `verdict_token == PASS`.
- **Guard:** Loop integrity preserved (no outstanding error classes).
- **Action:** Assemble final artifact per `FINAL_ARTIFACT_SCHEMA.md`; if `basis_record.ceremonial_detection.suppressed == true`, carry that into the final artifact; return to operator; write to loop log.

### T8: DECIDE -> TERMINAL-ESCALATED (on ESCALATED)

- **Trigger:** `verdict_token == ESCALATED`.
- **Guard:** `basis_record.reason` present (bound exceeded | sub-dwell cap | P4 novelty fail | ceremonial-override | other explicit).
- **Action:** Assemble escalation package per `ESCALATION_PROTOCOL.md`; transmit to `charter.escalation_receiver_id`; FREEZE the loop; return acknowledgement to operator.

### T9: ANY -> TERMINAL-ESCALATED (operator abort OR isolation alarm)

- **Trigger:** `/research-abort` issued by operator; OR Isolation Verifier (E1) raises runtime alarm outside a cycle boundary.
- **Guard:** Always (abort and isolation are hard-trumps).
- **Action:** Emit ESCALATED with `reason: operator_abort` or `reason: isolation_alarm`; assemble escalation package; transmit; FREEZE.

---

## 4. Guard Composition Table

| From | To | Composite Guard |
|---|---|---|
| INIT | RAM | `charter_ok AND enforcement_surface_ok AND isolation_live AND frame_registry.divergence_verified` |
| RAM | EVALUATOR | `ram_artifact_returned AND NOT e1_alarm_during_cycle` |
| EVALUATOR | DECIDE | `verdict_token IN {REOPEN, PASS, PASS-DEFERRED, ESCALATED}` |
| DECIDE | RAM | `verdict_token == REOPEN AND reopen_count < N AND dwell_elapsed AND NOT ceremonial_override_active` |
| DECIDE | EVALUATOR | `verdict_token == PASS-DEFERRED AND sub_dwell_deferral_counter < sub_dwell_cap AND dwell_elapsed` |
| DECIDE | TERMINAL-PASS | `verdict_token == PASS AND no_pending_errors` |
| DECIDE | TERMINAL-ESCALATED | `verdict_token == ESCALATED AND basis_record.reason_present` |
| ANY | TERMINAL-ESCALATED | `operator_abort OR isolation_alarm` |

---

## 5. Invariants (must hold at every transition)

| Invariant | Enforced By |
|---|---|
| `reopen_count <= charter.reopen_ceiling_N` | Guard at T5; double-check on verdict receipt |
| Time between adjacent reopens `>= charter.dwell_time_floor` | Guard at T5 |
| Verdict token is one of the four binary values | Guard at T4 |
| RAM substate never read by coordinator | Architectural -- coordinator has no reader function into RAM |
| Evaluator substate never read by coordinator | Architectural -- same |
| E7 verdict is ack-only from this coordinator's side | Enforcement surface contract |
| Frame divergence verified before first RAM cycle | Guard at T2 |
| Final artifact emitted exactly once per question | TERMINAL states are absorbing |

---

## 6. Loop-Termination Guarantee

**Claim:** Every `/research` invocation terminates in a TERMINAL state in finite steps.

**Proof sketch:**

1. `reopen_count` is strictly monotonically increasing in the `DECIDE -> RAM` transition (T5).
2. `reopen_count` is bounded above by `charter.reopen_ceiling_N`.
3. When `reopen_count == N`, the only legal next verdict token is `ESCALATED` (by E7's Phase 5 bounded-count gate) -> T8 fires -> TERMINAL-ESCALATED.
4. Within a single DECIDE, the only loop-back path is DECIDE -> EVALUATOR via T6 (PASS-DEFERRED), which is bounded by `sub_dwell_deferral_counter < sub_dwell_cap`. When cap reaches, E7 escalates -> T8.
5. All other transitions are monotone-progressive.

Therefore the loop is finite. Silent non-termination is impossible.

---

## 7. Build-Time Verification Obligations

Phase 8.5 build verification (per `ENFORCEMENT_SURFACE_CONTRACT.md`) MUST assert:

1. Static trace of `SKILL.md` procedure references `LOOP_STATE_MACHINE.md` for every transition.
2. Injection test: a mocked E7 attempting to emit a `REOPEN-ADVISORY` verdict triggers `EC-ADVISORY-REGRESSION` at T4 (guard rejects non-binary token).
3. Injection test: a mocked E7 attempting to emit REOPEN with `reopen_count == N` triggers `EC-BOUND-VIOLATION` at T5 (double-check guard).
4. Injection test: a mocked RAM attempting to reach into Evaluator substate triggers `EC-ZERO-OVERLAP-LEAK` (architecturally impossible if router boundaries hold; test verifies).
5. Termination proof holds under adversarial E7 attempting to emit infinite PASS-DEFERREDs (sub_dwell_cap guard fires).

Failure at any -> `EC-ENFORCEMENT-SURFACE-DEGRADED` at build; ship blocked.

---

## 8. Cross-Reference

- `SKILL.md` Section "Procedure" (phase-by-phase mapping to these states).
- `ENFORCEMENT_SURFACE_CONTRACT.md` (T5 ack-only semantics, build-time proofs).
- `ESCALATION_PROTOCOL.md` (T8 / T9 escalation package schema).
- `FINAL_ARTIFACT_SCHEMA.md` (TERMINAL-PASS and TERMINAL-ESCALATED output structure).
- E7 `SKILL.md` Phases 3-6 (composite trigger, dwell, bound, oscillation handling -- the producer of the verdict tokens consumed here).
