Lesson 4.2.3 — Reasoning Layer

Week 36

Prerequisite lessons: 4.2.2 (policy layer), 4.2.1 (perception stack integration), 4.1.3 (evaluation design and held-out test suites), 3.3.1 (LLM task planning and decomposition), 3.3.2 (code-as-policies), 3.3.3 (grounding language to affordances), 3.3.4 (safety and constraints on LLM outputs).

Prior results used in this lesson. From 4.2.2: the four authorities, the task tier’s authority, and the subgoal pose that the task authority consumes. From 4.2.1: the perception contract’s five fields and the freshness bound that the reasoning’s reference check uses. From 3.3.1: the propose–dispose composition, the verifier’s five checks, and the predicate-computation division. From 3.3.2: the primitive contract, the sandbox, and the four acceptance criteria. From 3.3.3: the affordance predicate $A(o, g, q, \pi)$ and the semantic gap. From 3.3.4: the four-layer stack and the residual-risk register. Each is restated at the point of use.

What this lesson hands forward. The goal specification’s four fields, the reasoning’s stratification, the re-query protocol, and the deferral’s discipline. Lesson 4.2.4 (safety and recovery) consumes the abort conditions and the deferral’s register’s entries. Module 4.3 (iteration and failure analysis) uses the stratification as its diagnostic’s template. Module 4.4 (the master’s defense) defends the reasoning’s design against the re-query’s evidence.

The running case in one sentence. The running arm, gripper, eye-in-hand camera, table, cube, bin, divider, and three distractors are unchanged, and the instruction is the conditional “put the cube in the bin, but if the divider is in the way, put it in the second bin”; this lesson assembles the reasoning layer that turns that sentence into the goal specifications the 4.2.2 task authority executes, and that recovers when the goal is wrong.

§L.0 — Lesson map, objectives, and misconceptions

Observable outcomes. By the end of this lesson you can, without notes: (1) state the reasoning layer’s three interfaces and what each carries; (2) explain why the layer’s output is a goal specification, not an action or a plan; (3) run the propose–dispose composition on the running case’s conditional and name each stage’s output; (4) write the goal specification’s four fields with their values for the cube’s goal; (5) state the goal’s freshness’s coupling to the perception’s contract and compute the reasoning’s budget; (6) stratify the reasoning’s failures into the four 3.3.1 modes and the two cross-layer modes; (7) state the re-query protocol’s three steps and its escalation’s rule; (8) state the deferral’s discipline and its acceptance’s cost; (9) assemble the running case’s layer with its four artefacts; (10) write the register’s reasoning’s entries with residuals.

Misconception inventory.

Everything is self-contained. Where a prerequisite lesson is used, the result is restated at the point of use.

§L.0.5 — Retrieval warm-up

Q1. In 4.2.2, the task authority consumed the VLA’s subgoal pose. What is the reasoning layer’s role relative to the VLA’s subgoal, and why can the VLA not be the reasoning layer?

Answer. The reasoning layer supplies the goal — the target’s identity and the success’s predicate — and the VLA’s subgoal is the execution’s trajectory’s endpoint toward that goal. The VLA cannot be the reasoning layer because the VLA’s training’s distribution is narrow and its output has no success predicate or abort condition; the reasoning layer’s goal specification is broader than any single VLA’s behaviour. Used in §L.A.1 to distinguish the layer’s interfaces.

Q2. In 3.3.1, the propose–dispose composition had four stages and the verifier’s five checks. Which of the checks is the one the reasoning layer’s goal specification relies on, and why?

Answer. The consistency check — the plan’s sub-tasks’ ordering and the goal’s match — because the goal specification’s success predicate is the consistency check’s target; the verifier compares the plan to the goal, and the goal’s specification’s form is what makes the comparison possible. Used in §L.C.1 to define the success predicate’s role.

Q3. In 3.3.3, the affordance predicate $A(o, g, q, \pi)$ had four arguments and the semantic gap was the table’s geometric graspability. Which of the four arguments does the reasoning layer fix, and which does the policy layer supply?

Answer. The reasoning layer fixes the object’s identity $o$, the primitive $\pi$, and the affordance’s truth’s claim; the policy layer supplies the gripper’s capability $g$ and the pose $q$ at execution. The split is the 3.3.1 §L.E.2’s predicate-computation division at the goal’s level. Used in §L.B.2 to define the affordance’s check’s split.

Q4. In 3.3.4, the four-layer stack’s semantic layer was the reference check’s and the affordance’s. What does the stack’s semantic layer add to the reasoning layer’s verifier, and what does the verifier add to the stack?

Answer. The stack’s semantic layer is the execution-time reference check — the pose’s freshness and the affordance’s instantaneous truth — while the verifier is the plan-time check — the reference’s uniqueness and the capability’s existence. The two are complementary in time: the verifier catches the plan’s structural errors, and the semantic layer catches the execution’s staleness’s. Used in §L.D.1 to define the monitor’s role.

Part A — The reasoning layer’s place

§L.A.1 — The three interfaces

The reasoning layer sits between the instruction and the policy layer’s task authority. It has three interfaces, and each carries a different kind of information.

The perception’s interface (input). The layer consumes the 4.2.1 perception contract’s five fields — the pose, the covariance, the freshness, the frame, and the provenance — plus the scene’s serialization, which is the perception’s summary of the objects, their labels, and the obstacles. The interface’s requirement is the freshness and the frame’s identity, because the reasoning’s references are grounded in the frame and the references’ validity is the freshness’s function.

The policy layer’s interface (output). The layer produces the goal specification that the 4.2.2 task authority consumes. The goal specification is not the plan; it is the target the plan achieves, with the success predicate and the abort condition. The interface’s requirement is the goal’s contract, which is §L.C’s subject.

The safety stack’s interface (bidirectional). The layer’s output is gated by the 3.3.4 §L.B.2’s semantic layer’s check, and the layer’s monitor consumes the safety stack’s failures — the rejections and the violations — as the re-query’s triggers. The interface’s requirement is the rejection’s reason, which is the re-query’s prompt’s input.

The three interfaces’ arrangement is the layer’s block diagram.

instruction  ─────────────► ┌───────────────────────────────┐
                           │  reasoning layer              │
perception ── scene's ───► │  compose → verify → specify   │ ── goal spec ──► policy layer
   contract  serialization │         ↑           ↓        │                  (task authority)
                           │      monitor ◄──── re-query   │
                           └───────────────────────────────┘
                                        ▲     │
                          safety stack ─┘     └── failures/reasons

The block diagram’s purpose is to make the interfaces’ directions explicit. The perception’s interface is inbound; the policy’s is outbound; the safety’s is bidirectional, with the rejections inbound and the goal’s gating outbound. The directions are the layer’s contracts’ orientation, and the 4.2.2 §L.B.3’s handoff’s protocol is the policy layer’s side of the outbound interface.

Self-explanation 1. Why is the safety stack’s interface bidirectional rather than one-directional?

Answer. Because the safety stack both gates the goal — its semantic layer rejects an ungrounded reference — and informs the reasoning — its rejection’s reason is the re-query’s input. The two directions are different signals, and the one-directional interface would lose the reason’s information.

§L.A.2 — The layer’s four parts

The layer is the composition of four parts, and the LLM is only one of them.

The composer. The 3.3.1 LLM’s propose stage, which produces the plan — the HTN’s decomposition or the 3.3.2 program — from the instruction and the scene’s serialization. The composer’s input is the instruction and the serialization; its output is the plan’s structure.

The verifier. The 3.3.1 §L.D.2’s five checks and the 3.3.3 §L.B.3’s affordance’s verification. The verifier’s input is the plan and the scene’s snapshot; its output is the accept or the reject with the reason. The verifier is the layer’s deterministic part, and it is what makes the layer’s output checkable.

The specification’s writer. The goal specification’s four fields’ computation from the verified plan. The writer’s input is the plan’s sub-tasks and the scene’s poses; its output is the §L.C’s contract. The writer is the layer’s contract’s part, and it is what makes the layer’s output consumable.

The monitor. The 3.3.4 §L.B.2’s semantic layer’s execution-time check, plus the goal’s progress’s check. The monitor’s input is the goal’s specification and the perception’s runtime’s contract; its output is the re-query’s trigger or the goal’s continuation. The monitor is the layer’s runtime part, and it is what makes the layer’s output robust.

The four parts’ composition is the layer’s loop. The composer proposes, the verifier disposes, the writer specifies, and the monitor re-triggers. The loop’s stability is the 4.2.2 §L.C.4’s loop’s stability’s analogue at the reasoning’s level, and its failure’s signature is the re-query’s oscillation — the same proposal rejected repeatedly.

§L.A.3 — Why the output is a specification, not an action or a plan

The layer’s output is a goal specification, and the choice of the output’s form is the layer’s central design decision.

Why not an action? The reasoning layer’s cadence is 0.2–1 Hz, and the action’s cadence is 1 kHz. The layer cannot supply the action’s rate, and its output’s form must be the target the lower layer’s loop achieves.

Why not a plan? The plan is the route, and the route is the policy layer’s 3.2.3 planner’s content. A plan’s steps are the motion tier’s trajectories, and the reasoning layer’s plan is the HTN’s sub-tasks, which are a different level of the plan. The HTN’s sub-tasks are the goals, and the trajectories are the means; the policy layer’s planner is the means’ producer, and the reasoning layer’s output is the goals’ specification.

Why a specification? Because the specification is the goal’s contract with the policy layer, and the contract’s form is what makes the policy’s execution checkable. The 4.2.2 §L.D.1’s attribution is the contract’s check — the failure’s tier is the earliest’s whose error exceeded its tolerance — and the tolerance’s definition is the specification’s, not the plan’s. Without the specification’s tolerance, the attribution has no threshold, and the layer’s failure is unattributable.

The specification’s four fields are §L.C’s, and the fields’ sufficiency is the layer’s output’s completeness’s criterion: a specification that omits the abort condition cannot be recovered, and one that omits the success predicate cannot be judged.

Concept check. A learner proposes that the reasoning layer output the action chunk directly, skipping the policy layer. What fails?

Answer. The action’s cadence’s mismatch, and the policy layer’s 4.2.2 §L.C.2’s authority’s arbitration’s loss. The reasoning layer’s output at 1 Hz cannot supply the 1 kHz control tier’s setpoints, and the four authorities’ transitions’ triggers are the policy layer’s; the reasoning’s direct action would bypass the safety stack’s physical layer’s runtime’s checks. The mechanism is the cadence’s and the arbitration’s, and the goal specification’s form is the fix. [displaces M2]

Worked-example ladder.

WE-L.A.a (fully worked). The reasoning’s cadence is 0.5 Hz, the policy’s task tier’s is 5 Hz, and the control’s is 1 kHz. Compute the ratios and state the specification’s cadence’s role.

Solution. The reasoning’s cadence is a tenth of the task tier’s and a two-thousandth of the control’s. The specification’s cadence’s role is the goal’s update’s rate, and the policy layer’s task tier’s 4.2.2 §L.A.2’s subgoal’s tolerance is the specification’s goal’s tolerance’s consumer; the reasoning’s 0.5 Hz is the goal’s update’s rate, and the task tier’s 5 Hz is the subgoal’s rate, and the two are different levels.

WE-L.A.b (completion). The reasoning’s cadence falls to 0.2 Hz because the LLM’s inference is slower. Compute the goal’s update’s period and state the effect on the goal’s freshness’s tolerance.

Completion. The period is 5 s; the goal’s freshness’s tolerance must be at least the period plus the LLM’s latency, and the 4.2.1 §L.C.1’s freshness’s 50 ms is the pose’s freshness, not the goal’s. The goal’s freshness’s tolerance is the 5 s’s, and the goal’s target’s position’s tolerance is the reasoning’s coarse accuracy, which the policy layer’s task authority’s tracking’s tolerance converts.

WE-L.A.c (faded). Write the layer’s four parts’ data’s flow and the loop’s re-query’s trigger’s source.

Faded step. Composer → verifier → writer → policy; the monitor’s trigger is the semantic layer’s rejection or the goal’s progress’s stall.

Completion. The loop’s re-query’s trigger’s source is the safety stack’s rejection’s reason and the monitor’s progress’s check; the two are different signals, and the re-query’s prompt carries both.

WE-L.A.d (contrastive near-miss). A team’s reasoning layer is the LLM’s direct output of the goal’s pose without the specification’s contract. The policy layer’s 4.2.2 §L.D.1’s attribution cannot assign the failure, and the debugging is the trace’s guess. Why it fails: the goal’s pose without the tolerance and the success predicate is a number, not a contract; the attribution’s tolerance’s threshold is absent, and the failure’s tier is undetermined. The fix: the specification’s four fields, per §L.C.

Comparative table: the three output’s forms.

Design principle P55.1. The reasoning layer’s output is a goal specification, not an action or a plan; the specification’s contract is what makes the policy layer’s execution checkable and the failure attributable.

Consolidation checkpoint 1

(a) Three capabilities. You can state the three interfaces and their directions. You can name the four parts and their composition’s loop. You can state why the specification is the output’s form.

(b) Transfer probe. The reasoning’s cadence is 1 Hz and the task tier’s is 5 Hz. Does the task tier’s faster cadence contradict the specification’s role? Answer: no; the task tier’s 5 Hz is the subgoal’s rate toward the goal, and the reasoning’s 1 Hz is the goal’s update’s rate. The two are different levels, and the specification’s contract is the goal’s, not the subgoal’s.

(c) Remediation rule. If you cannot state why the action’s output fails the cadence’s test, re-read §L.A.3 before Part B.

Part B — The decomposition, the grounding, and the strata

§L.B.1 — The propose–dispose on the running case’s conditional

The running case’s instruction is the conditional “put the cube in the bin, but if the divider is in the way, put it in the second bin”. The propose–dispose composition’s four stages.

The propose. The LLM produces the HTN’s decomposition, which is the 3.3.1 §L.E.1’s six-subtask structure: check-divider(c), choose-bin(b), pick(c), transport(b), place(b). The decomposition’s branch is the check-divider’s predicate’s result; the LLM names the predicate, and the verifier computes it.

The dispose. The 3.3.1 §L.D.2’s five checks: the reference check confirms the cube and both bins are in the scene; the predicate check confirms divider-blocks is computable from the clearance table; the capability check confirms the primitives are in the library; the feasibility check confirms the path to the chosen bin is clear; the consistency check confirms the branch matches the predicate’s result.

The specify. The specification’s writer computes the four fields from the verified plan. The target’s identity is the chosen bin’s pose; the success predicate is the cube’s pose’s distance from the bin’s target’s below the 2 cm; the tolerance is the 4.1.2 §L.C.2’s 2 cm; the abort condition is the perception’s provenance’s absence or the Q-shield’s rejection’s persistence.

The monitor. The semantic layer’s execution-time check confirms the goal’s target’s freshness and the cube’s availability at each task tier’s subgoal. The progress’s check confirms the cube’s distance’s reduction’s rate; a stall’s three consecutive cycles triggers the re-query.

The propose–dispose’s output for the running case’s nominal geometry is the primary bin’s goal, because the divider is at $x = 0.35$ and the cube’s path to the primary bin at $(0.4, -0.3, 0.15)$ does not cross the divider’s $y \in [0.05, 0.15]$ extent at the path’s $x$-range. The 3.3.3 §L.D.2’s semantic gap is the table’s graspability, which the reference check excludes because the table is not in the instruction’s roles.

§L.B.2 — The grounding’s split

The grounding’s four layers of 3.3.1 §L.C.1 are the reasoning’s and the perception’s joint’s content, and the split is the 3.3.1 §L.E.2’s predicate-computation division.

Reference resolution. The reasoning layer resolves “the cube” to the scene’s cube, “the bin” to the primary bin, and “the second bin” to the second bin. The resolution’s uniqueness is the scene’s labels’ check; the scene has one cube, one primary bin, one second bin, and three distractors, and the reference’s uniqueness is the scene’s labels’ function.

Predicate evaluation. The reasoning layer names the predicate divider-blocks(c, b1); the verifier computes it from the 2.3.2 clearance’s check and the scene’s geometry. The split is the division’s core: the LLM cannot compute the predicate precisely, and the verifier’s computation is the deterministic’s.

Pose lookup. The perception layer supplies the cube’s pose and the bins’ poses; the reasoning’s goal’s specification uses the poses’ values and their covariances, and the pose’s covariance’s role is the goal’s tolerance’s scaling.

Action-space mapping. The reasoning layer’s goal’s target is the bin’s pose in the world frame; the policy layer’s 4.2.2 task authority’s subgoal is the end-effector’s pose that places the cube at the target. The mapping is the policy layer’s inverse kinematics’s and grasp’s content, and the reasoning layer’s goal’s target is the object’s target, not the end-effector’s.

The split’s principle is the same as 3.3.1’s: the LLM names, the verifier computes. The reasoning layer’s added content is the goal’s specification, which the 3.3.1 composition did not produce — the verification’s accept was the composition’s endpoint — and the specification is the reasoning’s contribution to the policy layer’s interface.

§L.B.3 — The strata of the reasoning’s failures

The reasoning layer’s failures are stratified into the 3.3.1 §L.D.3’s four modes plus two cross-layer modes, and the strata’s purpose is the re-query’s diagnosis.

The four 3.3.1 modes.

• Hallucination. The plan references an object or a capability that does not exist. The detection is the verifier’s reference or capability check. The re-query’s prompt carries the missing reference’s name.
• Grounding. The reference is ambiguous or the predicate is the wrong formalization. The detection is the verifier’s predicate check or the branch’s mismatch. The re-query’s prompt carries the ambiguity’s disambiguation’s request.
• Infeasibility. The plan is logically valid and physically impossible. The detection is the verifier’s feasibility check. The re-query’s prompt carries the feasibility’s reason — the path’s clearance’s violation or the target’s unreachability.
• Plan drift. The re-plan after a failure diverges from the goal. The detection is the verifier’s consistency check. The re-query’s prompt carries the original goal’s symbolic form.

The two cross-layer modes.

• The specification’s gap. The verified plan’s goal’s specification omits a field — the success predicate’s tolerance is missing, or the abort condition’s is — and the policy layer’s 4.2.2 §L.D.1’s attribution cannot assign the failure. The detection is the writer’s completeness’s check, and the re-query’s prompt is the missing field’s name.
• The monitor’s staleness. The goal’s target moves after the specification was written, and the monitor’s check does not fire because the target’s motion is below the monitor’s threshold but above the tolerance. The detection is the progress’s check’s residual’s trend, and the re-query’s prompt is the target’s new pose.

The six strata are the re-query’s prompt’s templates. The prompt’s specificity is the re-query’s information’s value: a prompt that names the failure’s mode and its data is the re-query’s new propose’s input; a prompt without the data is the same propose’s re-generation.

Self-explanation 2. Why is the specification’s gap a reasoning mode rather than a policy mode?

Answer. Because the specification is the reasoning layer’s output’s contract, and the gap is the contract’s incompleteness; the policy layer’s attribution consumes the contract’s tolerance and cannot supply it, and the missing field’s repair is the reasoning’s writer’s job.

Concept check. The verifier accepts the plan, the specification’s writer omits the tolerance, and the policy layer’s attribution assigns the failure to the control tier. Which mode is the failure’s, and what is the fix?

Answer. The specification’s gap; the missing tolerance made the attribution’s threshold the control tier’s default, and the failure was assigned to the wrong tier. The fix is the writer’s completeness’s check and the specification’s tolerance’s computation. [displaces M3]

Worked-example ladder.

WE-L.B.a (fully worked). The scene has two cubes at $(0.5, 0.2, 0.3)$ and $(0.6, -0.1, 0.3)$, and the instruction says “the cube”. The LLM resolves the reference to the first cube. Which stratum’s failure is the risk, and what is the verifier’s check?

Solution. The reference’s ambiguity is the grounding’s stratum; the verifier’s reference check’s uniqueness’s test fails because two cubes match, and the re-query’s prompt asks for the disambiguation. The scene’s labels’ two cubes are the check’s evidence, and the LLM’s resolution without the disambiguation is the mode’s signature.

WE-L.B.b (completion). The scene’s second cube is removed, and the LLM’s reference is unique. Does the verifier’s reference check pass, and what is the next check that could fail?

Completion. The reference check passes; the next check is the predicate’s, and the divider-blocks predicate’s computation is the check’s target. The completion shows the checks’ order: the reference is the cheapest and the first, and the predicate’s is the second.

WE-L.B.c (faded). Write the re-query’s prompt’s template for the infeasibility’s mode, with the original instruction, the plan, the reason, and the directive.

Faded step. The prompt’s fields: the original instruction, the scene’s serialization, the rejected plan, the verifier’s feasibility’s reason — “the path to the primary bin crosses the divider’s extent at $x = 0.35$” — and the directive to revise.

Completion. The directive’s last position is the 3.3.1 §L.D.3’s template’s structure, and the reason’s specific data is the re-query’s information.

WE-L.B.d (contrastive near-miss). A team’s re-query’s prompt is “the plan failed, try again” without the reason. The LLM produces the same plan, and the loop’s three iterations exhaust. Why it fails: the prompt has no new information, and the LLM’s propose is the same distribution’s sample; the re-query’s loop is the same plan’s generation. The fix: the reason’s specific data, per §L.B.3’s templates.

Comparative table: the six strata.

Design principle P55.2. Stratify the reasoning’s failures by the check that caught them and the data that repairs them; the re-query’s prompt’s specificity is the loop’s convergence’s condition.

Consolidation checkpoint 2

(a) Three capabilities. You can run the propose–dispose on the conditional. You can state the grounding’s split. You can name the six strata and their prompts’ data.

(b) Transfer probe. The verifier rejects the plan on the capability check, and the plan calls push("cube"). Which stratum, and what is the prompt’s data? Answer: the hallucination’s stratum, because push is not in the library; the prompt’s data is the library’s capability’s list, and the directive to choose a covered primitive.

(c) Remediation rule. If you cannot state why the specification’s gap is a reasoning mode, re-read §L.B.3 before Part C.

Part C — The goal specification’s contract

§L.C.1 — The four fields

The goal specification is the layer’s output, and its four fields are the contract with the policy layer’s task authority.

The target. The goal’s object’s target’s pose in the world frame, $T_W^{target}$. The target’s form is the 4.2.1 contract’s pose’s form — the rotation’s representation and the translation’s units — and the target’s frame’s identity is the 4.2.1 contract’s frame’s. The target’s identity is the object’s — the cube’s placement’s target is the bin’s opening’s pose — and the target’s type is the placement’s, the grasp’s, or the transport’s.

The success predicate. The condition that the goal is achieved, expressed as a predicate on the perception’s state. For the placement, the predicate is $|p_{cube} - p_{bin}| \le 2$ cm and the cube’s orientation’s within the bin’s opening. The predicate’s form is the verifier’s check’s form — the 3.3.1 consistency’s check’s target — and the predicate’s evaluation is the monitor’s runtime’s check.

The tolerance. The predicate’s tolerance, per field. The tolerance’s value is the 4.1.2 §L.C.2’s 2 cm for the placement, the 2.3.3 force’s 20 N for the contact, and the 4.2.1 pose’s covariance’s scale for the target’s precision. The tolerance’s role is the 4.2.2 §L.D.1’s attribution’s threshold — the earliest tier’s error’s tolerance — and its absence is the specification’s gap’s mode.

The abort condition. The condition that the goal is unreachable, expressed as a predicate on the safety stack’s state and the monitor’s progress. For the running case, the abort is the 4.2.1 provenance’s absence, the 2.2.4 Q-shield’s rejection’s three consecutive cycles, or the progress’s stall’s three consecutive task tier’s cycles. The abort’s role is the 4.2.2 §L.B.2’s safe authority’s trigger, and its absence is the layer’s recovery’s gap.

The four fields’ sufficiency is the layer’s output’s completeness’s criterion. A specification without the target is a plan; without the success predicate, an intention; without the tolerance, an unattributable goal; without the abort, an unrecoverable one.

Self-explanation 3. Why is the tolerance a separate field from the success predicate?

Answer. Because the predicate’s form is the condition — the distance’s 2 cm — and the tolerance is the uncertainty’s allowance — the pose’s covariance’s scale — and the two are different quantities. The predicate’s 2 cm is the goal’s requirement; the tolerance’s is the perception’s uncertainty’s allowance, and the attribution’s threshold is the predicate’s plus the tolerance’s.

§L.C.2 — The freshness’s coupling

The goal specification’s freshness is coupled to the 4.2.1 perception contract’s freshness, and the coupling’s arithmetic is the reasoning’s budget.

The goal’s target’s freshness is the perception’s pose’s freshness — the target’s pose is a perception’s output, and its age is the goal’s target’s age. The goal’s validity’s freshness is the reasoning’s own’s — the goal’s specification was written at a timestamp, and the goal’s validity’s age is the difference between the current time and the writing’s timestamp.

The coupling’s arithmetic.

where $T_{pose}^{max}$ is the 4.2.1 contract’s freshness’s bound at the reasoning’s consumer — the 50 ms’s — and $T_{reasoning}$ is the reasoning’s own’s cadence’s period, the 2 s at 0.5 Hz. The goal’s maximum’s age is 2.05 s, and the monitor’s check’s threshold is that age.

The coupling’s consequence is that the reasoning’s cadence’s period dominates the goal’s freshness’s budget. A faster reasoning — the LLM’s latency’s reduction — shortens the goal’s age, and the monitor’s check’s threshold’s strictness’s rise is the consequence.

§L.C.3 — The specification’s evidence

The specification’s evidence is the 4.1.3 suite’s replay’s goal-level metrics.

The goal’s success’s rate. The fraction of episodes whose success predicate was satisfied at the episode’s end. The metric’s bound is the 4.1.1 §L.C.1’s success rate’s 0.90’s lower bound.

The goal’s specification’s completeness. The fraction of goals whose four fields were present at the writing. The metric’s target is 1.0, and the specification’s gap’s mode’s detection is the metric’s.

The goal’s validity’s age. The 95th percentile of the goal’s age at the policy layer’s task authority’s consumption. The metric’s bound is the $T_{goal}^{max}$‘s 2.05 s.

The re-query’s rate. The number of re-queries per episode. A healthy rate is below the 2; above the 4 is the loop’s oscillation’s signature.

The deferral’s rate. The fraction of episodes where the layer deferred. A healthy rate is below the 0.02; above the 0.05 is the layer’s coverage’s signal.

The five metrics’ conjunction is the specification’s evidence, and the 4.2.2 §L.D.3’s evidence’s table’s complement at the reasoning’s level.

Concept check. The goal’s validity’s age’s 95th is 2.3 s and the $T_{goal}^{max}$ is 2.05 s. Which metric’s bound is violated, and what is the fix?

Answer. The goal’s validity’s age; the reasoning’s cadence’s period is the dominant’s term, and the fix is the cadence’s rise or the LLM’s latency’s reduction. The 2.3 s’s excess is the 0.25 s, which is the LLM’s latency’s tail’s.

Worked-example ladder.

WE-L.C.a (fully worked). The perception’s freshness’s bound is 50 ms and the reasoning’s cadence is 0.5 Hz. Compute the $T_{goal}^{max}$ and state the monitor’s threshold.

Solution. The reasoning’s period is 2 s; the $T_{goal}^{max}$ is $0.05 + 2 = 2.05$ s. The monitor’s threshold is the 2.05 s, and the goal’s age’s 95th must be below it.

WE-L.C.b (completion). The reasoning’s cadence rises to 1 Hz. Recompute the $T_{goal}^{max}$ and state the monitor’s threshold’s strictness’s rise.

Completion. The period is 1 s; the $T_{goal}^{max}$ is 1.05 s. The monitor’s threshold’s strictness’s rise is the 2.05 to 1.05’s halving, and the goal’s age’s 95th must fall below the 1.05 s; the LLM’s latency’s tail’s reduction is the requirement.

WE-L.C.c (faded). Write the success predicate’s form for the placement and the tolerance’s value’s source.

Faded step. The predicate is $|p_{cube} - p_{bin}| \le 2$ cm and the cube’s orientation’s within the bin’s opening; the tolerance is the 4.1.2 §L.C.2’s 2 cm plus the perception’s covariance’s scale.

Completion. The tolerance’s source is the 4.1.2’s 2 cm’s placement’s requirement plus the 2.1.2 covariance’s 0.8 cm’s scale; the sum is the attribution’s threshold’s value.

WE-L.C.d (contrastive near-miss). A team’s specification has the target and the success predicate but not the tolerance. The policy layer’s attribution assigns every failure to the task tier because the tolerance’s default is the task tier’s 1 cm. Why it fails: the tolerance’s absence makes the attribution’s threshold the default’s, and the default’s is the wrong’s. The fix is the specification’s four fields, per §L.C.1.

Comparative table: the four fields.

Design principle P55.3. Specify the goal with four fields; the tolerance is the attribution’s threshold and the abort is the recovery’s trigger, and their absence makes the goal unattributable and unrecoverable.

Consolidation checkpoint 3

(a) Three capabilities. You can write the four fields with their values. You can compute the $T_{goal}^{max}$ from the perception’s bound and the reasoning’s period. You can name the five goal-level metrics and their bounds.

(b) Transfer probe. The reasoning’s cadence is 0.25 Hz. Compute the $T_{goal}^{max}$. Answer: the period is 4 s, and the $T_{goal}^{max}$ is $0.05 + 4 = 4.05$ s; the goal’s age’s 95th must be below the 4.05 s, and the monitor’s threshold is loose.

(c) Remediation rule. If you cannot state why the tolerance is separate from the success predicate, re-read §L.C.1 before Part D.

Part D — The failure modes, the re-query, and the deferral

§L.D.1 — The monitor’s role

The monitor is the layer’s runtime part, and its role is the goal’s validity’s check.

The monitor’s three checks.

The target’s freshness’s check. The goal’s target’s pose’s age, per the 4.2.1 contract’s freshness’s field, is compared to the $T_{goal}^{max}$‘s threshold. A target whose age exceeds the threshold is the monitor’s stale target’s trigger, and the re-query’s prompt is the target’s new pose.

The success predicate’s progress’s check. The predicate’s distance’s rate of change is compared to the task tier’s subgoal’s rate. A stall — three consecutive cycles with the rate’s below the threshold — is the monitor’s progress’s stall’s trigger, and the re-query’s prompt is the stall’s state and the goal’s symbolic form.

The abort condition’s check. The abort’s predicate is evaluated against the safety stack’s state at each policy layer’s cycle. A true abort is the monitor’s abort’s trigger, and the safe authority’s activation is the response.

The monitor’s checks are the 3.3.4 §L.B.2’s semantic layer’s execution-time checks at the reasoning’s level, and their thresholds are the 4.1.3 suite’s replay’s calibration. The monitor’s role is the layer’s runtime evidence’s source, and its absence is the layer’s open-loop’s failure’s mode.

§L.D.2 — The re-query’s protocol

The re-query is the layer’s response to a monitor’s trigger, and its protocol has three steps.

Step 1: the failure’s classification. The monitor’s trigger’s kind — the stale target, the progress’s stall, or the abort — is classified into the 4.2.3 §L.B.3’s six strata. The classification’s data is the monitor’s check’s output and the safety stack’s rejection’s reason.

Step 2: the prompt’s assembly. The re-query’s prompt has the original instruction, the scene’s serialization, the rejected plan or the current goal’s specification, the stratum’s reason’s data, and the directive to revise. The prompt’s specificity is the reason’s data’s, and the specificity is the loop’s convergence’s condition.

Step 3: the propose’s re-run and the escalation’s rule. The composer re-runs, the verifier re-disposes, and the writer re-specifies. The escalation’s rule is the loop’s bound: the third re-query’s failure without the goal’s progress’s is the deferral’s trigger, and the deferral is §L.D.3’s.

The protocol’s information’s flow is the reason’s data’s — the classification’s stratum’s reason is the prompt’s new information — and the loop’s convergence is the prompt’s specificity’s function. A prompt with the reason’s data is a new propose’s input; a prompt without it is the same propose’s re-generation, and the loop’s three iterations are the same plan’s three samples.

§L.D.3 — The deferral’s discipline

The deferral is the layer’s output when the re-query’s loop fails, and its discipline is the layer’s honesty’s mechanism.

The deferral’s form. The layer outputs a deferral’s record — the instruction, the scene’s serialization, the three re-queries’ strata, and the failure’s data — and a deferral’s goal that the policy layer’s safe authority executes: the 3.3.4 §L.C.3’s release’s sequence and the operator’s notification.

The deferral’s justification. The layer’s three re-queries’ failure is the evidence that the goal’s uncertainty exceeds the layer’s tolerance; the confident wrong goal is the worse output, because the wrong goal’s execution is the failure’s silent form, and the deferral’s is the visible form. The 3.3.4 §L.D.3’s register’s entry is the deferral’s record’s consumer.

The deferral’s cost. The availability’s — the episode’s failure’s — and the 4.1.3 suite’s replay’s deferral’s rate’s bound’s 0.02 is the cost’s acceptance.

The deferral’s discipline’s rule: the deferral is not a retry’s substitute, and the layer’s three re-queries’ specificity is the deferral’s precondition. A deferral after three unspecific re-queries is the layer’s bug — the prompt’s specificity’s absence — and the deferral’s rate’s rise is the bug’s signature.

Self-explanation 1. Why is the deferral’s cost an availability’s cost rather than a correctness’s?

Answer. Because the deferral’s output is safe — the release’s sequence and the operator’s notification — and the cost is that the episode’s goal was not achieved; the correctness’s cost is the confident wrong goal’s silent failure, and the deferral’s visibility is the correctness’s improvement.

Concept check. The layer’s three re-queries’ prompts are all “the plan failed, try again”, and the deferral fires. Is the deferral the layer’s correct behaviour?

Answer. No; the deferral’s precondition is the three re-queries’ specificity, and the prompts’ absence of the reason’s data is the layer’s bug. The deferral’s rate’s rise is the bug’s signature, and the fix is the prompt’s specificity, not the deferral’s acceptance. [displaces M5]

Worked-example ladder.

WE-L.D.a (fully worked). The monitor’s progress’s stall fires at the third cycle, and the safety stack’s rejection’s reason is “the path to the primary bin crosses the divider”. Classify the stratum and write the prompt’s reason.

Solution. The rejection’s reason is the feasibility’s — the path’s clearance’s violation — so the stratum is the infeasibility’s. The prompt’s reason’s data is the clearance’s violation’s geometry: “the path from the cube’s pose to the primary bin’s opening crosses the divider’s extent at $x = 0.35$”.

WE-L.D.b (completion). The re-query’s propose chooses the second bin, and the verifier accepts. Does the loop converge, and what is the goal’s specification’s target?

Completion. The loop converges on the first re-query, and the goal’s specification’s target is the second bin’s opening’s pose. The completion shows the re-query’s prompt’s specificity’s effect: the feasibility’s reason was the new information, and the LLM’s propose’s branch’s choice is the reason’s consequence.

WE-L.D.c (faded). Write the deferral’s record’s fields and the safe authority’s goal’s specification.

Faded step. The record’s fields: the instruction, the serialization, the three strata, the failure’s data. The safe authority’s goal: the target’s the current pose, the success predicate’s the release’s completion, the tolerance’s the force’s 20 N, the abort’s the operator’s intervention.

Completion. The deferral’s record’s consumer is the 3.3.4 §L.D.3’s register, and the safe authority’s goal’s specification’s form is the same four fields’ — the layer’s contract’s uniformity is the deferral’s mechanism.

WE-L.D.d (contrastive near-miss). A team’s deferral’s rate is 0.08 and the re-queries’ prompts are all without the reason’s data. The team concludes the layer’s coverage is insufficient. Why it fails: the deferral’s rate’s rise is the prompt’s specificity’s bug, not the coverage’s; the three re-queries’ unspecific prompts are the loop’s non-convergence’s cause. The fix: the prompt’s specificity, per §L.D.2.

Comparative table: the monitor’s triggers and the responses.

Design principle P55.4. Re-query with the reason’s data and defer only after three specific re-queries; the deferral’s visibility is the correctness’s improvement, and its rate’s rise is the prompt’s bug.

Consolidation checkpoint 4

(a) Three capabilities. You can state the monitor’s three checks. You can run the re-query’s protocol’s three steps. You can write the deferral’s record’s fields.

(b) Transfer probe. The re-query’s prompt has the reason’s data and the stratum’s classification. Is the prompt’s specificity sufficient? Answer: yes if the reason’s data is the check’s output’s specific value — the clearance’s violation’s geometry — and not a generic statement; the specificity’s sufficiency is the data’s, not the classification’s.

(c) Remediation rule. If you cannot state why the deferral’s cost is the availability’s, re-read §L.D.3 before Part E.

Part E — The running case

§L.E.1 — The layer’s assembly

The running case’s reasoning layer, assembled from the four parts, the six strata, and the four fields.

The composer. The 3.3.1 LLM’s propose with the running case’s primitive library and the scene’s serialization. The library has the eight primitives of 3.3.2 §L.B.1, and the serialization has the cube, the two bins, the divider, and the three distractors.

The verifier. The five checks’ implementation, with the 3.3.3 §L.B.3’s affordance’s verification. The divider-blocks predicate’s computation is the 2.3.2 clearance’s check.

The writer. The four fields’ computation. The target is the chosen bin’s opening’s pose; the success predicate is the cube’s pose’s 2 cm’s distance’s and the orientation’s; the tolerance is the 2 cm’s plus the 2.1.2 covariance’s 0.8 cm; the abort is the provenance’s absence, the Q-shield’s three cycles’ rejection, or the progress’s three cycles’ stall.

The monitor. The three checks’ implementation, with the $T_{goal}^{max}$‘s 2.05 s’s threshold and the progress’s stall’s three cycles.

The re-query’s protocol. The six strata’s prompts, with the specific reasons’ data. The escalation’s rule is the three re-queries’ deferral.

The deferral. The record’s fields and the safe authority’s goal.

§L.E.2 — The layer’s evidence

The layer’s evidence is the 4.1.3 suite’s replay’s goal-level metrics.

The suite’s replay’s expected values, from the 4.1.3 §L.E.2’s and 4.2.2 §L.E.2’s numbers.

• The goal’s success’s rate is the 4.1.1 §L.C.1’s success rate’s — the 0.92’s point estimate and the 0.898’s lower bound, which fails the 0.90’s requirement at the 400-episode suite.
• The specification’s completeness is 1.0 by construction, and the writer’s completeness’s check is the metric’s evidence.
• The goal’s validity’s age’s 95th is 2.3 s, which fails the 2.05 s’s bound; the reasoning’s cadence’s period’s 2 s’s plus the LLM’s latency’s tail’s 0.25 s is the excess.
• The re-query’s rate is 2.4 per episode, within the 4’s bound.
• The deferral’s rate is 0.03, above the 0.02’s bound; the re-queries’ prompts’ specificity is the fix’s target.

The evidence’s failures are the 4.2.3 §L.D’s modes’ evidence, and their fixes are the 4.3 lesson’s iteration’s input. The layer’s acceptance is the five bounds’ conjunction, and the suite’s replay’s values’ failures are the acceptance’s failures.

§L.E.3 — The register’s entries

The reasoning’s register’s four entries.

The register’s entries are the 3.3.4 §L.E.3’s five fields, and the residuals are the layer’s acceptance’s residuals.

The grounding’s ambiguity’s residual is the scene’s labels’ gap — the labels’ incomplete’s or the objects’ new’s — and the mitigation’s complement is the operator’s disambiguation.

The infeasibility’s persistence’s residual is the geometry’s change — the divider’s move after the plan — and the mitigation’s complement is the 4.2.1 §L.B.3’s frame’s check.

The monitor’s staleness’s residual is the target’s slow’s motion — the move below the monitor’s threshold and above the tolerance — and the mitigation’s complement is the tolerance’s tightening.

The deferral’s rate’s rise’s residual is the LLM’s coverage’s gap — the instruction’s form outside the training’s distribution — and the mitigation’s complement is the 3.1.3 §L.C.2’s paraphrase’s coverage.

Self-explanation 2. Why is the geometry’s change a residual rather than a mitigation’s complete coverage?

Answer. Because the plan’s feasibility was computed at the serialization’s snapshot, and the divider’s move after the plan is the deployment’s temporal reality; the mitigation’s check is the frame’s, and the residual is the move’s after the check’s.

Worked-example ladder.

WE-L.E.a (fully worked). The goal’s validity’s age’s 95th is 2.3 s and the $T_{goal}^{max}$ is 2.05 s. Compute the excess and state the fix’s target.

Solution. The excess is 0.25 s, which is the LLM’s latency’s tail’s. The fix’s target is the reasoning’s cadence’s period’s reduction — the 2 s to 1.8 s — or the LLM’s latency’s tail’s reduction — the 0.25 s to 0.05 s. The two are the 4.3 lesson’s iteration’s options.

WE-L.E.b (completion). The deferral’s rate is 0.03 and the re-queries’ prompts’ specificity is the suspected’s cause. Compute the acceptance and the fix’s priority.

Completion. The deferral’s 0.03 is above the 0.02’s bound; the fix’s priority is the prompt’s specificity’s implementation, and the deferral’s rate’s re-measurement is the fix’s evidence. The completion shows the deferral’s rate’s diagnosis’s order: the prompt’s specificity’s first, the LLM’s coverage’s second.

WE-L.E.c (faded). Write the register’s entry for the deferral’s rate’s rise with the residual’s field.

Faded step. Failure: the deferral’s rate’s rise; probability: moderate; consequence: the availability’s loss; mitigation: the prompt’s specificity; residual: the LLM’s coverage’s gap.

Completion. The residual’s acceptance is the 4.3 lesson’s coverage’s measurement, and the 3.1.3 §L.C.2’s paraphrase’s coverage is the complement’s design.

WE-L.E.d (contrastive near-miss). A team’s goal’s success is 0.92 and the deferral’s rate is 0.03; the team reports the success and omits the deferral’s rate. The acceptance’s conjunction fails on the deferral’s rate, and the team’s report’s headline is the point’s estimate. Why it fails: the acceptance is the conjunction, and the deferral’s rate’s 0.03 is a necessary condition’s failure. The fix is the conjunction’s report, per §L.E.2.

Comparative table: the layer’s evidence’s failures and fixes.

Design principle P55.5. Accept the layer on the five bounds’ conjunction; the validity’s age is the reasoning’s cadence’s evidence, and the deferral’s rate is the prompt’s specificity’s.

Consolidation checkpoint 5

(a) Three capabilities. You can state the layer’s four parts’ assembly. You can read the evidence’s table and the failures’ fixes. You can write the register’s four entries.

(b) Transfer probe. The goal’s validity’s age’s 95th is 1.8 s and the $T_{goal}^{max}$ is 2.05 s. Is the bound satisfied? Answer: yes; the 1.8 s is below the 2.05 s, and the margin’s 0.25 s is the reasoning’s cadence’s period’s slack. The monitor’s threshold is satisfied, and the goal’s age’s acceptance passes.

(c) Remediation rule. If you cannot state why the validity’s age’s fix is the reasoning’s cadence’s, re-read §L.E.2 before the lab.

Failure taxonomy

The table covers the three lab corruptions plus three failures not exercised in the lab: the geometry’s change, the tolerance’s absence, and the LLM’s determinism.

The lab

Task. Implement the reasoning layer’s four parts on the running case’s conditional, run the propose–dispose on three scene’s variations — the nominal, the divider’s blocking, and the two cubes’ ambiguity — and measure the six strata’s detection’s rates, the re-query’s prompt’s specificity’s effect, and the deferral’s rate.

Conditions. Python 3.10+, NumPy. The LLM is a stub with the three plans’ pre-written responses; the scene’s variations are the three’s dictionaries; the verifier is the 3.3.1 §L.D.2’s five checks’ implementation. Seed all RNGs.

Controls. (i) The nominal composition; (ii) the composition with the prompt’s specificity’s reason’s data; (iii) the composition with the prompt’s generic’s message; (iv) the composition with the specification’s tolerance’s absence.

Metrics.

Pre-registered hypotheses.

H1. The nominal composition’s goal’s success is 1.0 on the nominal scene, because the verifier’s checks and the specification’s writer are the deterministic’s.

H2. The divider’s blocking’s scene triggers the feasibility’s stratum and the re-query with the reason’s data converges in one iteration.

H3. The two cubes’ ambiguity triggers the grounding’s stratum and the re-query without the disambiguation’s data defers after three iterations.

H4. The specification’s tolerance’s absence makes the attribution’s threshold the default’s and the goal’s success’s measurement’s bound’s failure’s evidence is the unattributable’s.

Break-it sequence.

1. Use a generic prompt silently. The re-query’s convergence falls and the deferral’s rate rises. Silent: the re-queries’ count is the loop’s bound’s.
2. Omit the tolerance silently. The specification’s completeness’s metric falls and the attribution’s threshold’s default’s is the wrong’s. Silent: the goal’s success’s metric is normal.
3. Disable the monitor silently. The target’s move and the progress’s stall are undetected, and the goal’s failure is the silent’s. Silent: the plan’s verification’s metrics are normal.

Acceptance criteria.

What good looks like. A good artefact has five properties. (1) The four parts are separate functions with separate logs. (2) The six strata’s prompts are templates with the reason’s data’s fields. (3) The specification’s four fields are asserted at the writer’s output. (4) The break-it results are a table. (5) The deferral’s record’s fields are complete.

A runnable core of the layer’s composition, seeded and annotated:

# lab_4_2_3.py — reasoning layer: propose, verify, specify, monitor
import numpy as np
np.random.seed(0)

SCENE = {
    "cube":   {"pose": (0.5, 0.2, 0.3)},
    "bin1":   {"pose": (0.4, -0.3, 0.15)},
    "bin2":   {"pose": (0.2, -0.4, 0.15)},
    "divider":{"pose": (0.35, 0.1, 0.2), "extent": (0.01, 0.05, 0.4)},
    "cup":    {"pose": (0.6, 0.1, 0.3)},
}

def divider_blocks(scene, cube="cube", bin_key="bin1"):
    """The verifier's clearance's check, not the LLM's."""
    c = np.array(scene[cube]["pose"]); b = np.array(scene[bin_key]["pose"])
    d = np.array(scene["divider"]["pose"]); e = np.array(scene["divider"]["extent"]) / 2
    for t in np.linspace(0, 1, 50):
        p = (1 - t) * c + t * b
        if np.all(p >= d - e) and np.all(p <= d + e):
            return True
    return False

def propose(instruction, scene, context=None):
    """The LLM's stub: a plan from the pre-written set."""
    if context and context.get("stratum") == "infeasibility":
        return {"target": "bin2", "subtasks": ["pick", "transport", "place"]}
    if context and context.get("stratum") == "grounding":
        return {"target": "bin1", "subtasks": ["pick", "transport", "place"]}
    target = "bin2" if divider_blocks(scene) else "bin1"
    return {"target": target, "subtasks": ["pick", "transport", "place"]}

def verify(plan, scene):
    """The five checks, condensed."""
    if plan["target"] not in scene:
        return False, ("reference", f"{plan['target']} not in scene")
    for st in plan["subtasks"]:
        if st not in ("pick", "transport", "place"):
            return False, ("capability", f"{st} unknown")
    want = "bin2" if divider_blocks(scene) else "bin1"
    if plan["target"] != want:
        return False, ("consistency", f"branch {plan['target']} != {want}")
    return True, ("ok", "")

def specify(plan, scene, include_tolerance=True):
    """The writer: the goal specification's four fields."""
    spec = {
        "target": scene[plan["target"]]["pose"],
        "success": f"$|p_cube$ - $p_{plan['target']}|$ <= 0.02",
        "abort": "provenance_missing OR shield_rejects_3x",
    }
    if include_tolerance:
        spec["tolerance"] = 0.028      # 2 cm + 0.8 cm perception
    return spec

def monitor(spec, scene, elapsed_s, target_moved_cm=0.0):
    """The three checks, with the goal's validity's age's threshold."""
    if elapsed_s > 2.05:
        return "stale_target"
    if target_moved_cm > 2.8:
        return "stall"
    return "ok"

# Nominal composition
plan = propose("put the cube in the bin", SCENE)
ok, reason = verify(plan, SCENE)
print("nominal verify:", ok, reason)
spec = specify(plan, SCENE)
print("nominal spec:", spec)

# Re-query with the reason's data on the infeasibility
plan_bad = {"target": "bin1", "subtasks": ["pick", "transport", "place"]}
ok, reason = verify(plan_bad, SCENE)
print("blocking verify:", ok, reason)
plan_fixed = propose("...", SCENE, context={"stratum": reason[0]})
ok2, reason2 = verify(plan_fixed, SCENE)
print("re-query verify:", ok2, reason2)

Line 4–9 define the scene; line 11–18 implement the verifier’s clearance’s check — the computation the LLM names but does not perform. Line 20–28 are the LLM’s stub with the context-dependent re-query; lines 30–40 the five checks’ condensed implementation; lines 42–51 the specification’s writer with the tolerance’s optional omission; lines 53–58 the monitor’s three checks. Lines 60–73 run the nominal and the re-query’s compositions.

Cheat sheet

Exercises with solutions

E 4.2.3.1. State the three interfaces and what each carries.

S 4.2.3.1. The perception’s in — the contract’s five fields and the scene’s serialization. The policy’s out — the goal specification. The safety’s bidirectional — the semantic layer’s rejection and the goal’s gating. The lesson: the directions are the contracts’ orientation, and the safety’s bidirectional is the reason’s information.

E 4.2.3.2 (transfer). The reasoning’s cadence is 0.5 Hz and the perception’s freshness’s bound is 50 ms. Compute the $T_{goal}^{max}$.

S 4.2.3.2. The period is 2 s; the $T_{goal}^{max}$ is 2.05 s. The lesson: the reasoning’s cadence’s period dominates the goal’s freshness’s budget.

E 4.2.3.3. Write the four fields for the cube’s placement in the primary bin.

S 4.2.3.3. Target: the bin1’s opening’s pose. Success: $|p_{cube} - p_{bin1}| \le 2$ cm. Tolerance: 2.8 cm (2 + 0.8). Abort: the provenance’s absence or the shield’s three cycles. The lesson: the tolerance is the predicate’s plus the perception’s covariance’s, and the abort is the safety stack’s.

E 4.2.3.4 (diagnostic). The verifier rejects the plan on the capability check, and the plan calls push("cube"). Which stratum, and what is the prompt’s data?

S 4.2.3.4. The hallucination’s stratum; the prompt’s data is the library’s capability’s list. The lesson: the capability’s absence is the hallucination’s, and the prompt’s data is the library’s.

E 4.2.3.5. State why the re-query without the reason’s data is the same plan’s re-generation.

S 4.2.3.5. Because the prompt has no new information, and the LLM’s propose is the same distribution’s sample; the re-query’s loop is the same generation’s. The lesson: the prompt’s specificity is the loop’s convergence’s condition.

E 4.2.3.6 (transfer). The specification’s tolerance is omitted and the attribution assigns the failure to the task tier. Diagnose and fix.

S 4.2.3.6. The specification’s gap; the tolerance’s absence makes the attribution’s threshold the default’s. The fix is the writer’s completeness’s check. The lesson: the tolerance is the attribution’s threshold, and its absence is the layer’s contract’s incompleteness.

E 4.2.3.7 (diagnostic). The deferral’s rate is 0.05 and the three re-queries’ prompts are generic. Is the deferral the correct behaviour?

S 4.2.3.7. No; the deferral’s precondition is the three re-queries’ specificity, and the generic prompts are the layer’s bug. The fix is the prompt’s reason’s data. The lesson: the deferral’s rate’s rise is the prompt’s specificity’s signature.

E 4.2.3.8. Write the register’s entry for the monitor’s staleness with its residual.

S 4.2.3.8. Failure: the goal’s target’s move; probability: low; consequence: the stale goal’s execution; mitigation: the progress’s check; residual: the target’s slow’s motion. The lesson: the residual is the move below the monitor’s threshold and above the tolerance.

E 4.2.3.9 (transfer). The goal’s validity’s age’s 95th is 2.3 s and the $T_{goal}^{max}$ is 2.05 s. Compute the excess and name two fixes.

S 4.2.3.9. The excess is 0.25 s; the fixes are the reasoning’s cadence’s rise and the LLM’s latency’s tail’s reduction. The lesson: the validity’s age’s fix is the reasoning’s cadence’s, and the tail’s is the LLM’s.

Exit test

You are ready for Lesson 4.2.4 when you can, without notes:

1. State the three interfaces and their directions.
2. Name the four parts and their composition’s loop.
3. State why the output is a specification, not an action or a plan.
4. Run the propose–dispose on the conditional and name each stage’s output.
5. State the grounding’s split’s four layers.
6. Name the six strata and their prompts’ data.
7. Write the goal specification’s four fields with the running case’s values.
8. Compute the $T_{goal}^{max}$ from the perception’s bound and the reasoning’s period.
9. State the monitor’s three checks and their triggers.
10. Run the re-query’s protocol’s three steps.
11. State the deferral’s discipline and its precondition.
12. Name the five goal-level metrics and their bounds.
13. Read the evidence’s table and the failures’ fixes.
14. Write the register’s four entries with residuals.
15. State why the deferral’s rate’s rise is the prompt’s specificity’s signature.

Cross-references. 4.2.2 supplies the four authorities, the task authority, and the subgoal restated in §L.A.1 and §L.A.3. 4.2.1 supplies the perception contract and the freshness’s bound restated in §L.A.1 and §L.C.2. 4.1.3 supplies the suite and the replay restated in §L.C.3 and §L.E.2. 3.3.1 supplies the propose–dispose and the five checks restated in §L.B.1 and §L.B.2. 3.3.2 supplies the primitive contract and the sandbox restated in §L.B.2. 3.3.3 supplies the affordance and the semantic gap restated in §L.B.2 and §L.E.1. 3.3.4 supplies the four-layer stack and the register restated in §L.D.1 and §L.E.3. Lesson 4.2.4 consumes the abort conditions and the deferral’s register. Module 4.3 uses the stratification as its diagnostic’s template. Module 4.4 defends the layer’s design against the re-query’s evidence.

Ready. The next lesson to write is 4.2.4 — Safety and Recovery. Say “next” to generate it.