No Log = No Action
Non-Bypassable Execution Invariant

I. Problem Definition: Optional Logging Failure

Traditional computing and control architectures treat logging as a telemetry concern, decoupled from execution by asynchronous buffering, deferred writes, and best-effort delivery semantics. This architectural separation introduces non-determinism between execution and persistence, because the temporal ordering of action completion and log commitment is not enforced by any structural constraint. Actions routinely complete while their corresponding log entries remain in volatile buffers, transit queues, or write-back caches that may be lost to power interruption, process termination, or network partition.

I.2 DMA, MMIO, and IOMMU Insufficiency

Direct hardware manipulation paths, including DMA and memory-mapped I/O, can reach physical actuator control registers without any software-layer awareness or logging. IOMMU protections are insufficient for three documented reasons: early boot gaps where IOMMU translation tables are not yet enabled; deferred DMA attacks exploiting stale mappings after virtual machine destruction; and message-signaled interrupt (MSI) forgery that bypasses IOMMU enforcement entirely by forging interrupt signals outside the DMA transaction path. The conclusion is inescapable: telemetry-grade logging provides observability but not enforcement, and any architecture that permits action without structurally guaranteed prior log commitment cannot provide the evidentiary integrity that Ternary Logic demands.

II. The Invariant: Formal Definition

In the DITL/MT hardware substrate, this invariant is material. The Commit Gate stands physically in-line on the actuation path. The NL=NA write pulse, a voltage pulse on a dedicated hardware wire, is the only mechanism that can transition the Commit Gate to Low Resistance State. No instruction in any processor's ISA, no DMA transfer, no firmware call, and no software privilege level has access to this wire.

II.1 Transition System

The invariant is defined over a transition system TS = (S, Act, T, I, AP, L) where S is the set of system states, Act is the set of actions, T is the transition relation, I is the set of initial states, AP is the set of atomic propositions, and L is the labeling function. Two atomic propositions are distinguished: log(a), which holds when a log entry for action a has been fully committed to durable storage with integrity verified, and exec(a), which holds when action a has produced an externally observable effect or state mutation.

II.2 LTL Specification

II.3 CTL Specification

II.4 Log Completeness: Four Conditions

Log commitment requires all four conditions satisfied simultaneously:

II.5 Inductive Proof Obligations

Let Inv(s) ≡ ∀a ∈ Act : executing(a, s) → ∃e ∈ Log(s) : (e.action = a) ∧ (e.timestamp < exec_time(a, s)) ∧ verified(e.hash, s).

Base case: for all initial states s₀ ∈ I, Inv(s₀) holds; no actions are executing in any initial state.

Inductive step: for all states s and s' such that Inv(s) holds and T(s, a, s') is a valid transition, Inv(s') holds; established by the structural constraint that the transition relation T is physically gated such that no transition producing exec(a) in s' can fire unless log(a) is committed in s before the transition.

Strengthening: Inv(s) implies the safety property AG(∀a : exec(a) → logged(a)).

These obligations are dischargeable through symbolic model checking (BDD-based or SAT-based bounded model checking) encoding the hardware gate logic, the logging subsystem state machine, and the actuator release mechanism.

II.7 The Five-Layer NL=NA Enforcement Stack

Every Proceed (+1) authorization must pass all five independent enforcement layers. Bypassing one does not bypass the others.

III. Cryptographic Actuator Interlock

The Merkle accumulator root serves as the execution capability token, stored in hardware-protected registers modifiable only by the logging subsystem. Actuator release requires three independent cryptographic requirements simultaneously: valid log hash with preimage and collision resistance; hardware-generated attestation quote (TPM or enclave) including PUF binding hash in DITL/MT deployments; and inference containment verification confirming the complete TL decision vector is captured before release.

III.3 Non-Bypassability: From Software to Silicon

A compromised kernel cannot bypass the interlock because the kernel has no write access to the Merkle root register. A compromised hypervisor cannot bypass the interlock because the interlock's trust boundary is independent of the hypervisor's memory management. SMM code cannot bypass the interlock because it is implemented in dedicated hardware, such as an FPGA fabric or ASIC gate, not addressable from the SMM address space.

In DITL/MT deployments, non-bypassability extends to the silicon layer. The Muller C-element cannot generate output without complete verified input from all channels. No timing assumption, clock manipulation, or voltage glitch can advance it past an incomplete input state.

IV. DITL/MT Hardware Substrate

DITL (Delay-Insensitive Ternary Logic) is the asynchronous circuit substrate. MT (Mandated Ternary) is the hardware implementation layer. The named baseline is TSMC N2 CoWoS with embedded TaOx 1T1R ReRAM, 2025 PDK, with Arrhenius-model 20-year retention at 85 degrees C.

IV.2 Voltage Domain and Resistance State Mapping

These are physical conditions in silicon. Governance states cannot be overwritten by any instruction in any privilege ring. They can only be changed by the NL=NA write pulse, which applies a calibrated voltage pulse to the TaOx cell through the dedicated hardware wire.

IV.3 DITL Circuit Architecture and NL=NA Write Pulse

The Muller C-element is the fundamental gate primitive; its output cannot be generated without complete, verified input from all channels. Three-voltage single-wire encoding (Vdd, Vdd/2, GND). No global clock; genuinely asynchronous. Inline (series) topology required: parallel (sidecar) topology creates an alternate path around the enforcement gate and is constitutionally insufficient.

The NL=NA write pulse is a voltage pulse on a dedicated hardware wire. Not a software flag. Not a register write. Not a firmware call. Without the pulse, no TLState transition occurs regardless of any software state. The Window Comparator measures TaOx cell resistance with RC spoof detection at 5 ns threshold. The Commit Gate stands in-line on the actuation path; HRS blocks, LRS permits.

IV.6 Architecture B

V. Hardware Root of Trust

Trust chain: immutable boot ROM (mask ROM or OTP) measuring UEFI firmware and extending into TPM 2.0 PCRs (ISO/IEC 11889); the extend operation PCR_new = Hash(PCR_old ∥ measurement) is irreversible. Intel SGX enclaves and ARM TrustZone Secure World provide isolated execution for logging subsystem operations. Thales Luna 7 HSM (named baseline, FIPS 140-3 Level 3) provides tamper-resistant key storage with immediate zeroization on intrusion detection. PUF provides device-unique identity from post-manufacturing entropy; invasive probing destroys the physical characteristics, preventing extraction. PUF inter-die Hamming distance approximately 49-51% experimentally demonstrated.

Four documented software-only enforcement failure classes: kernel compromise, hypervisor escape, SMM subversion, and supply chain substitution. Hardware enforcement eliminates all four.

VI. Ternary Logic Mapping and Epistemic Hold

Epistemic Hold persists across power cycles without software reinitialization; hardware-semantic persistence of Epistemic Hold in silicon, not in volatile memory, is one of MT's two discontinuous advantages over conventional NVRAM. The Iron Law applies to all three states equally.

VI.2 Solvency Protocol

In financial contexts, Epistemic Hold implements the Solvency Protocol: all pending transactions halt, current positions are preserved without modification, and the complete market state snapshot with the pending transaction queue and triggering conditions is committed to the log. The Solvency Protocol recognizes that financial actions create irreversible obligations that may propagate instability through interconnected networks.

VI.3 Epistemic Hold Trigger Conditions

Mandatory under four conditions: confidence below calibrated threshold; conflicting inputs that cannot be reconciled within the decision cycle; incomplete or stale required data beyond freshness bounds; and out-of-distribution inputs beyond validated distribution envelopes detected through Mahalanobis distance, local outlier factor scores, or isolation forest path lengths.

Forced continuation prevention: Wesolowski VDF cryptographic time-lock (cannot be accelerated by parallel computation); external pressure detection through timing analysis monitoring command arrival rates; complete audit trail of all override attempts committed before any override can be evaluated.

VII. Cryptographic Non-Repudiation

Merkle inclusion proofs O(log n) demonstrate entry existence. Merkle consistency proofs O(log n) confirm no entries deleted or reordered. In DITL/MT deployments, signatures cover canonical serialization, TL state, decision vector, timestamp, monotonic counter, preceding entry hash, and PUF binding hash, binding the log entry inseparably to the specific physical silicon instance. Identity-integrity-logging triad: no component can be satisfied without the other two. Invalid execution states (orphaned action, hash mismatch, signature verification failure) each trigger immediate safe harbor transition.

VIII. Cryptographic Primitives and Adversarial Resistance

Canonicalization: RFC 8785 (JCS) or deterministic CBOR. Merkle accumulators: RFC 9162 (Certificate Transparency v2). Replay protection: hardware-RNG nonces combined with TPM monotonic counters, increment hardware-atomic with the NL=NA write pulse in DITL/MT deployments. Byzantine fault tolerance: PBFT (Castro and Liskov) with 3f+1 minimum nodes. Logres protocol with Isabelle/HOL formal verification providing agreement, completeness, and liveness guarantees. Post-commit immutability: WORM hardware storage combined with SealFS HMAC ratchet chains. Silent action prevention through power consumption correlation; out-of-baseline power during logged-idle periods indicates unlogged computation.

IX. Failure Modes and Safe Harbor States

Fail-closed behavior required across all critical failure modes. In DITL/MT deployments, the Commit Gate defaults to HRS (Refuse -1) in any undefined or error state; no fail-open mode exists in the silicon. For cyber-physical systems: Lyapunov-bounded kinetic energy minimization with convergence time 1/alpha, seven-segment S-curve deceleration with bounded jerk, stable equilibrium verified through Lyapunov criteria. For financial systems: immediate transaction halting and liquidity preservation. Model-checked state machine properties: AG(state in valid set) and AG(Logging_Failure implies AF(Safe_Harbor_Steady)). Manual override requires physical presence, M-of-N authorization (M no less than 2, organizationally independent), and complete logging through a secondary battery-backed channel if the primary is inoperative.

X. Dual-Lane Architecture

The Inference Lane proposes actions, never authorizes them, with no more than 2 ms WCET in FPGA or ASIC programmable logic. The Governance Lane evaluates constitutionally, authorizes or blocks, with no more than 300 ms ceiling. The Commit Gate is the resolution point. Governance Lane failures do not block Inference Lane operation.

Conclusion: Four Pillars of Enforcement

The resulting system does not trust its operators, its software, or its firmware to maintain log integrity. It structurally prevents any of them from violating it.