💻 computer science

Endpoint Sufficiency Behavioral Quotients

This paper establishes a strict hierarchy of behavioral quotients for provenance-decorated generative systems to determine precisely when provenance can be discarded without altering lawful futures, offering canonical refinement procedures that compute the coarsest equivalence relations preserving either finite traces or full branching structure.

Original authors: David Carr

Published 2026-08-10

📖 6 min read🧠 Deep dive

CC0 1.0

Original authors: David Carr

Original paper dedicated to the public domain under CC0 1.0 (http://creativecommons.org/publicdomain/zero/1.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are watching a magician perform a trick. You see the final result: a rabbit appears from a hat. To your eyes, the rabbit is just a rabbit. But the magician knows the rabbit's entire history: was it born in a farm, pulled from a pocket, or conjured from thin air? In the world of computer science, specifically in a field called "formal methods" (which is basically the math of making sure computer programs do exactly what they are supposed to), this question is huge. Computers often build things step-by-step, like a recipe. Sometimes, two different recipes result in the exact same-looking dish. The question is: does the computer need to remember the recipe (the history) to know what happens next, or is the dish (the current state) enough?

This paper tackles a problem where computers generate complex structures, like graphs or code, and we want to know when we can safely throw away the "receipts" or "history logs" (called provenance) without breaking the system. If we forget the history, can the computer still make the right moves? The paper uses a concept called a "transition system," which is just a fancy map of all the possible moves a system can make. It asks: if two things look the same right now, do they have the same future? The answer turns out to be surprisingly complicated. It's not a simple "yes" or "no." It depends on how closely you are watching. Are you just checking if the next move is possible? Or are you checking if the entire branching path of future choices is identical?

The Great Forgetting Game

Imagine you are playing a video game where your character can look like a knight, a wizard, or a rogue. But in this game, your character's "look" (their visible endpoint) doesn't tell the whole story. Maybe your knight looks exactly like another knight, but one of them has a secret scar from a past battle that changes what moves they are allowed to make next.

This is the problem David Carr explores in his paper, "When Is Forgetting Provenance Lawful?" He is studying "generative systems"—computer programs that build things, like drawing graphs or creating code. These systems keep a detailed diary of how they got to their current state (the provenance). But diaries take up space. The paper asks: When is it okay to burn the diary and just look at the character's current face?

The paper discovers that the answer depends entirely on how strict you are about what "the future" means. Carr sets up three different levels of strictness, like three different types of game rules:

The "What Can I Do Right Now?" Level (Enabled Sufficiency): This is the easiest check. If two characters look the same, can they both press the same buttons immediately? If one can jump and the other can't, you definitely can't forget the history.
The "What Can I Do Eventually?" Level (Trace Sufficiency): This is a bit stricter. It asks: "If I press a sequence of buttons, can both characters do it?" Maybe both can jump, but only one can jump then fly. If the list of possible future button sequences is different, the history still matters.
The "Exact Branching" Level (Quotient Sufficiency): This is the hardest, most strict level. It asks: "If I press a button, do both characters end up in a situation that looks exactly the same, with the exact same future choices?" It's not enough that they can do the same things; they must do them in the exact same way, branching off into identical futures.

The Big Discovery: It's Not All or Nothing

The paper proves that these three levels are strictly different. You can have a situation where two things look the same and can do the same immediate moves (Level 1), but they have different future possibilities (Level 2). Or, they can have the same future possibilities (Level 2), but the way those possibilities branch out is different (Level 3).

The most exciting finding is that you don't have to choose between "remember everything" and "forget everything." The paper provides a mathematical recipe to find the perfect middle ground.

The "Trace-Safe" Repair: If you only care about the list of possible future moves (Level 2), the paper shows you how to merge the histories just enough so that the list of moves stays the same, but you still forget the unnecessary details.
The "Branching" Repair: If you need to preserve the exact branching structure (Level 3), the paper gives you a method to find the "greatest safe forgetting." This is the biggest chunk of history you can throw away without changing the game's logic. It's like finding the largest group of players who can be treated as identical without anyone getting an unfair advantage or a broken move.

A Real-World Example from the Paper

To prove this isn't just theory, the paper uses a specific example involving "nested recursive-recombinant generation" (a fancy way of saying a system that builds complex shapes by combining parts).

Imagine two shapes that look identical: a line connecting point A to point B to point C.

Shape 1 was built by stacking blocks one on top of another.
Shape 2 was built by gluing two pieces together at the bottom.

Visually, they are the same. But because of their history, Shape 1 is allowed to have a new block added to the top, while Shape 2 is forbidden from doing so because of the glue joint.

If you just looked at the shape, you'd think they were the same. But the paper shows that a computer algorithm can instantly spot this difference. It separates them in the very first step of its check. The algorithm realizes: "Ah, even though they look the same, their pasts make their futures different."

Why This Matters

The paper concludes with a powerful idea: Provenance is only necessary if it changes the future.

If two things look the same and will behave the same way from this point on, then their history is just "decoration." It's like remembering the brand of paint used on a wall when you only care about whether you can hang a picture on it. If the wall is solid in both cases, the paint brand doesn't matter.

However, if the history does change what you can do next (like the glue joint in the example), then you must keep that piece of history. The paper gives us the exact tools to figure out which pieces of history are "decoration" and which are "structural." It replaces the old "all-or-nothing" rule (keep everything or lose everything) with a precise, mathematical way to forget only what is safe to forget.

In short, the paper tells us that we can be efficient with our memory, but only if we are smart about it. We can forget the past, but only if the future doesn't care.

Technical Summary: When Is Forgetting Provenance Lawful?

Problem Statement
Generative systems often produce objects that can be represented at multiple levels of abstraction. One representation captures only the "visible endpoint" (the final object), while another retains the full "provenance" (ancestry, merge events, dependency structures). While endpoint representations are smaller, they risk being false state descriptions if the system's admissibility laws depend on lineage. The core problem addressed is determining exactly when provenance information can be safely forgotten without altering the system's lawful future behavior. Specifically, the paper asks: When does an endpoint projection retain sufficient information to determine lawful transitions, and what is the maximal amount of provenance that can be discarded?

The paper challenges the informal assumption that "endpoint sufficiency" is a single, uniform concept. It demonstrates that this notion varies depending on the observation level: whether one cares only about immediately enabled rules, finite sequences of rule labels (traces), or the full branching structure of future possibilities.

Methodology
The author formalizes the problem using Lawful Generative Transition Systems (LGTS). An LGTS is defined as a tuple $T = (S, \Sigma, \to, U, X, \cong_X)$ , where:

$S$ is a set of provenance-decorated occurrences.
$\Sigma$ is a set of rule labels.
$\to$ is the lawful labeled transition relation.
$U: S \to X$ is an endpoint projection mapping occurrences to visible objects.
$\cong_X$ is an equivalence relation on visible objects.

The study analyzes the relationship between the endpoint equivalence relation ( $\equiv_U$ , where $s \equiv_U t \iff U(s) \cong_X U(t)$ ) and various behavioral equivalences. The analysis proceeds through three distinct observation levels:

Enabled Sufficiency: Preserving the set of immediately available rule labels.
Trace Sufficiency: Preserving the set of all finite rule-label traces.
Quotient (Branching) Sufficiency: Preserving the branching transition structure modulo endpoint equivalence.

The paper employs standard process semantics tools, including trace equivalence, strong bisimulation, coinduction, and partition refinement, applied specifically to the boundary between endpoint and provenance.

Key Contributions and Results

1. A Strict Three-Level Hierarchy
The paper establishes that the three levels of sufficiency are distinct and form a strict hierarchy:
$\text{Quotient Sufficiency} \implies \text{Trace Sufficiency} \implies \text{Enabled Sufficiency}$

Enabled Sufficiency is the weakest; it only requires that equivalent endpoints have the same set of enabled next moves.
Trace Sufficiency requires that equivalent endpoints generate the same set of finite rule-label sequences.
Quotient Sufficiency is the strongest; it requires that the set of reachable endpoint classes for any label depends only on the current endpoint class, not the specific provenance history.

2. Exact Criteria for Sufficiency
The paper provides precise mathematical criteria for when an endpoint projection is sufficient at each level:

Trace Level: The projection is trace-sufficient if and only if endpoint equivalence is a subset of trace equivalence ( $\equiv_U \subseteq \equiv_{tr}$ ).
Branching Level: The projection is quotient-sufficient if and only if endpoint equivalence is a strong bisimulation equivalence. This means that for any two endpoint-equivalent states, every transition from one can be matched by a transition from the other to a state that is also endpoint-equivalent.

3. Canonical Repairs and Maximal Forgetting
When raw endpoint equivalence fails to be sufficient, the paper proposes two "canonical repairs" that identify the coarsest possible refinement of states that preserves the desired behavior while respecting visible endpoints:

For Linear Time (Traces): The relation $E^U_{tr} = \equiv_U \cap \equiv_{tr}$ is the greatest equivalence relation that respects endpoints and preserves finite traces. It identifies exactly those endpoint-equivalent occurrences whose futures are indistinguishable as rule-label traces.
For Branching Time (Exact Quotients): The relation $\approx_U$ $\approx_{U}$ , defined as the union of all endpoint-respecting strong bisimulations, is the greatest endpoint-respecting strong bisimulation. The quotient system $T / \approx_U$ $T / \approx_{U}$ is the maximally coarse exact branching quotient.
- Universal Property: Every other exact endpoint-respecting quotient refines this canonical quotient. Thus, $\approx_U$ represents the maximal amount of provenance that can be forgotten while maintaining an exact branching semantics.

4. Algorithmic Computation
For finite systems, the paper describes a terminating partition-refinement procedure to compute $\approx_U$ . The algorithm initializes with the partition of endpoint equivalence classes and iteratively refines it based on the "signatures" of successor blocks (the sets of reachable blocks for each label). The procedure stabilizes at the partition corresponding to $\approx_U$ .

5. Application to Nested Recursive-Recombinant Generation (NRRG)
The paper applies these results to a specific framework of provenance-decorated NRRG. It presents a witness where two occurrences ( $e_G$ and $e_H$ ) share the same visible graph endpoint ( $I \to A \to B$ ) but differ in their recombinant ancestry.

In $e_G$ , the ancestry allows a boundary-touching rewrite rule ( $R_B$ ).
In $e_H$ , the ancestry forbids $R_B$ .
Result: The partition refinement algorithm separates $e_G$ and $e_H$ in the first round because their sets of enabled successors differ. This demonstrates that endpoint isomorphism does not imply behavioral equivalence, even at the enabled level, and that the proposed refinement procedure correctly identifies the necessary distinction.

Significance and Claims
The paper claims to replace the "all-or-nothing" demand to either retain all provenance or discard it entirely with an exact criterion for lawful forgetting.

Operational Residue: The difference between raw endpoint classes and the refined classes ( $\approx_U$ or $E^U_{tr}$ ) constitutes the "operational residue" of provenance—historical information that remains active in the future transition space.
Abstraction Exactness: The work reframes the problem of abstraction not merely as soundness (over-approximation) but as exactness for a chosen semantics. A raw quotient that merges states without checking bisimulation can create behaviors (inflation) that are not lawful for specific occurrences.
Domain Agnosticism: The results are presented as formal criteria applicable to any system where admissibility depends on lineage (e.g., software states, legal instruments, scientific claims), provided the system can be modeled as a labeled transition system with an endpoint projection.

The paper concludes that provenance may be erased exactly across those occurrence distinctions that do not alter the chosen lawful future semantics. What remains after maximal safe erasure is not historical decoration, but the true generative state.

The Great Forgetting Game

The Big Discovery: It's Not All or Nothing

A Real-World Example from the Paper

Why This Matters

Technical Summary: When Is Forgetting Provenance Lawful?

More like this