A Calculus of Execution for Binary Relations: Admissibility Without Choice

1. Introduction

1.1. Problem

Cloud-native and microservice architectures are widely used in contemporary distributed software, alongside an extensive vocabulary of compensation mechanisms — saga transactions, outbox patterns, retry policies, and circuit breakers — for handling failures and inconsistencies after individual operations have been initiated: patched after the fact rather than governed before it. The cost is not speculative: poor software quality cost the United States $2.41 trillion in 2022 alone [42]. What follows locates the gap these patterns compensate for, and closes it.

Execution of discrete systems inherited its vocabulary from set theory: a system has a state space, a transition is a relation on it, a component is a mapping. With the vocabulary came its abstraction, left exactly this way by design: Cantor’s own founding move treats membership as primitive and unanalyzed, sufficient for a foundational theory of collections, not for execution. A set element carries no origin — x ∈ A records that x belongs, never how it came to belong, nor under what condition. A relation carries no history: (x, y) ∈ R holds timelessly. For mathematics this is exactly right; abstraction is what makes structure visible. For execution the same abstraction removes what must be audited.

Two executions may admit the same value under different conditions. In the inherited vocabulary they are the same element and nothing distinguishes them; in execution they are different events, and conflating them is the failure that governance and reproducibility are built to prevent. What execution must retain is what made a candidate possible, what permitted it, and when it happened — three answers the calculus carries with the event rather than reconstructing after the fact.

Example. A payment of $50 admitted because a fraud check passed, and the same $50 admitted later because a manual override was granted after the original check had failed, are the same value by the inherited vocabulary — the same element of the same set. They are not the same event: one carries a fraud-check pass as its reason, the other a human override of a prior failure, and an audit that cannot tell them apart cannot answer the one question it exists to answer. What follows formalizes exactly this difference, for arbitrary binary relations rather than for payments alone.

Two anomalies run through the formalisms surveyed in Section 2 and Section 12, and they are related. First, the condition determining which event may enter the execution sequence is left implicit: transition relations say what may follow, none says under what condition a particular follower is admitted. Second, the resolution of nondeterminism is placed outside the execution process — the sequence exists, but the point of choice does not consult it. Classically, this is exactly where a choice function is invoked to supply what the relation itself does not: Section 1.2 makes that connection precise.

Why the classical apparatus cannot supply it. Neither is a design fault; both follow from what the specification apparatus provides. A binary relation is a set of pairs: it records which transitions are possible and carries nothing that selects among them. A transition function s ↦ f(s), where defined, is local and single-valued; admissibility is history-conditioned. An influence matrix records that one component affects another, never under what condition. The classical transition-machine and stored-program models illustrate the distinction at a different level. A Turing-machine transition rule determines the next local action from the current machine configuration; accumulated history may be encoded in the machine’s storage, but it is not represented as a constitutive admission context together with a separately specified criterion governing whether the next event enters that history. The stored-program architecture likewise supplies explicit operations and control flow — von Neumann’s own central control organ carries out “the specific instructions given for and defining a particular problem,” a genuine ωτ, each instruction an ontologically defined operation the arithmetic unit executes [52] — without making a history-conditioned admission criterion part of the executed object itself: it supplies no constitutive eschatological criterion of the kind defined here. Neither model was designed to provide the particular combination developed here: an append-only causal context, an independently specified ontology, and an admission criterion evaluated over that same context — this is not a defect to be patched at the software layer built on top of them, but the reason such patches have been necessary.

None of the three makes a history-conditioned admission criterion a constitutive object of the execution semantics in the sense defined here. Where such a criterion is required, it must therefore be supplied as additional control structure rather than arising from those formalisms themselves — and what supplies it, in practice, is the controller [1], [2]. The separation of execution from management is not a design decision but the shadow of the formalism.

This gap is not narrow or newly noticed; what follows is not a refinement of the compensating patterns already named, but the criterion whose absence made them necessary. What compensation patches locally, evolutive systems make structural: a service that changes its own admission criterion in response to what it has observed compounds the same unresolved gap at every step it takes, not only at the steps where something visibly fails.

What closing the gap requires. Closing it requires decomposing Cantor’s own abstraction into its constitutive elements — an ontology of what is possible and a criterion of what is admitted — and defining their interaction so that two requirements are met. First, the resulting sequence of admissions must be deterministic and causal. External occurrences may generate candidates through environmental abstractions, but the admission of every candidate is governed internally by the abstraction’s own criterion evaluated against the accumulated context. Only an admitted result extends the execution record. Second, the calculus governing that sequence — including any act that revises the sequence’s own rules — must itself take place within the same abstraction, never from a position outside it. The first requirement is what reproducibility (Section 7.11) delivers; the second is what the collapse of control into execution (Section 7.8) delivers.

The classical binary-relation view is recovered as a reduct of the present one: for an executable abstraction Aτ, R is what remains when the criterion and execution coordinates are forgotten (Section 6.3). The direction claimed here is from the full executable object to its relational reduct; no converse representation theorem for arbitrary binary relations is assumed. This paper does not replace Cantor’s set theory; it maps one presentation of his own intuitive notion — later axiomatized by Zermelo, and refined by Fraenkel, with membership left a primitive, structurally undefined relation — onto a second, structurally-interactional presentation of the same relation, within ZF throughout. Section 5.1 makes this precise at Aτ’s own empty value, the absolute abstraction: forgetting a sequence’s coordinates is trivial and returns Cantor’s own ∅; building the reverse — data into information — is exactly what execution is for. The second presentation is valid for exactly what the first is not: a calculus that is deterministic, causal, and semantically self-contained at the point of admission. External occurrences may trigger candidate generation, but only internally interpreted and admitted events become part of execution. Every concept introduced from here — the sequence, the context, eschatological induction — is a further articulation of this same, single structure, not a new one.

The two results. The calculus makes one move — the criterion is carried within the abstraction and evaluated over the record — and two results follow, argued formally in Section 6 and Section 7 and stated here because everything else in this paper follows from them. Both are offered as formal answers to problems that are current, not settled: neither has had a satisfactory formal account until now. First, control and execution collapse into one act (Section 7.8): a governing abstraction manages the process by admitting into the same record it manages, at a higher eschatological level, not from a separate layer standing outside it — management becomes accountable exactly because it is no longer external to what it manages, the direct answer to the anomalies just named, and the formal reason external oversight architectures cannot keep pace with systems that revise their own criteria, a difficulty current work on evolutive AI safety has identified but not formally resolved. Second, execution becomes reproducible (Section 7.11): because admission is decided by a specified ωτ and τ rather than an external, unrecorded selection, verification replay is deterministic from the recorded execution: the preceding prefix fixes the admission context and the applicable ontology and criterion specifications, while the recorded event preserves the realization whose admission is being verified — a property genuinely lost wherever the selector is external and unrecorded — the formal reason a system whose selector is external and unrecorded cannot reconstruct from its execution record alone why a particular step was taken. What this opens is the execution of evolutive systems: a system that records why it did not proceed can change what is possible. Section 11.1 develops the practical consequences of both results.

Prior result. ZTES [10] established that semantic closure is achievable: one configuration in which nothing exists outside the record. It reached it by extending two formalisms — the DEVS transition, which consumes a state and produces a state, and the M–T ontology, which relates model to component. In ZTES the transition consumes the whole record and appends to it, and the component carries a criterion of admissibility. The two extensions are one: neither prior formalism carries a criterion, and neither carries a record. But the reasons were given at the level of the methods, not of the formalism — which is why admissibility appears there as an axiom rather than a consequence, its origin left open. This paper supplies it. ZTES showed that closure can be achieved; the calculus shows why it must take that form. The pattern this paper names has, in this sense, already been working: Tocher’s kernel has run this way in simulation practice for six decades (Section 11.1), with ZTES’s own theorem the formal record of it — what is new here is not that practice but its formal statement. Disputatio’s relation to the same pattern is functional rather than formal, and correspondingly more limited (Section 1.4).

Application. [35] applies the OEE decomposition developed here to agentic AI safety — a field currently searching for new formal concepts precisely because existing verification formalisms have not resolved its central problem — and shows that any external guardrail architecture, a fixed verification criterion applied to a projection of the execution context, is geometrically incomplete for evolutive agents: the gap cannot be closed by refining the criterion or the projection, because it is a gap in dimension, not in parameters. That paper, from the same research program, is accepted for publication and forthcoming September 2026; it illustrates one domain in which the decomposition developed here yields a concrete safety property (guardrail bypass), following from the same rank structure established in Section 3, applied to a domain this paper does not itself develop.

The same absence appears wherever a formalism must select but provides no selector — here in agent architectures, in systems engineering, and in set theory. Whether it accounts for difficulties reported elsewhere is not examined; the subject of this paper is the correct execution of software.

1.2. Contribution

Both are resolved by making admission constitutive. An abstraction Aτ proposes a candidate; the candidate enters the record only if the criterion holds over what has accumulated: Execute(Aτ, Cⁿ) = eₙ₊₁ iff (Cⁿ, ωτ) ∈ τ, with C⁰ = ∅. The record C is append-only. The ontology ωτ specifies what is possible; the criterion τ decides what is admitted; the record holds what was.

A criterion without a mechanism that resolves it within execution is a condition with no sequence; a mechanism that resolves choice without an explicit criterion has nothing to evaluate. The two are one result, not two.

(i) The criterion is explicit and constitutively separate. The specification ⌜τ⌝ occupies rank ρ(X)+3, above the specification ωτ at ρ(X)+2 and the record at ρ(X)+1 (Section 3). The ordering follows from the pair construction. The criterion is not derivable from the record because this rank separation is combined with its independent specification as a constitutive parameter of the abstraction — supplied rather than inferred.

(ii) Nondeterminism is resolved within execution. Across the active abstractions, the current context may give rise to several candidates; each individual ωτ contributes at most one realization, and its corresponding τ : E^{<ω} × Ω → {true, false} determines whether that realization is admitted — pairs (Cⁿ, ωτ) outside the positive extension of τ correspond to a computed negative admission test and therefore to preemption, not to an admitted rejection event. The atomic decision is not the source of nondeterminism but the locus at which it is resolved.

(iii) Admission requires no choice selector. Each ωτ is single-valued where defined and τ is Boolean: Execute never selects among the members of an arbitrary family of nonempty sets, so no principle of choice is invoked. Every candidate additionally carries its ontological and eschatological address (id_esh, id_ont) before admission. This address constitutes a definable well-ordering across abstractions and instances, usable for identification, attribution, query, and replay once events are recorded (Section 6.5) — but admission itself is not decided by sorting or selecting among addresses: for the fixed invocation, it is determined by the specified ωτ, τ, and C. The instance coordinate id_inst is assigned only once admission occurs, recording where the outcome landed rather than reaching it. Where a single ontology offers several internal possibilities sharing the same address, distinguishing among them is not the address’s job — that is resolved by ωτ’s own determinism (Section 5.2) or, for genuine ties, by the tolerance-class treatment of Section 6.6. Because these coordinates are never discarded, they additionally provide a definable ordering wherever identification or serialization among independently determined abstractions is required — Section 6.2 develops this second, separate role in full, against Russell’s own example of where such an ordering can and cannot be drawn.

(iv) Criteria compose hierarchically, and admission is self-similar. At each level of a purpose decomposition τ′ ⊏ τ a different criterion governs admission, and the composite key records which condition was satisfied at which level.

(v) Design and execution share one record. Every abstraction — whether specifying a criterion, defining an ontology, or realizing an instance — is admitted into the same context C. Software design and software execution are one sequence, distinguished only by coordinate — the collapse of control and execution named in Section 1.1 and formalized as Corollary 5 (Section 7.8), stated here at the level of the contribution rather than the proof.

Where governance is kept apart from execution, the two can diverge. Sharing one record makes divergence impossible rather than merely detectable — and it lets functional, non-functional and ethical requirements be stated as components of the same τ, evaluated at the same boundary.

1.3. Reading Conventions

Six facts hold throughout and are easy to misread on a first pass:

• Cⁿ is not a state and not a timestamp; it is the sequence of everything admitted so far.
• n counts admissions, not clock ticks — it is not a time variable and not Peano succession.
• eₙ₊₁ depends on the whole of Cⁿ, never on eₙ alone.
• ωτ is a partial, deterministic ontological realization yielding at most one candidate for an invocation; for internal abstractions the realization is determined from C, while Section 5.2 states the environmental case. τ, once that realization exists, is a total Boolean function of it — preemption can originate at either stage (Section 5.2, Section 5.3 and Section 5.4), never a computed “false” masquerading as absence.
• Preemption produces no event and does not extend C.
• The binary relation and the classical set element are projections of this structure, not its starting point (Section 6).

The second and third facts together name a precise technical pattern, established as a consequence of Eschatological Induction rather than assumed here: Section 4.3 gives the exact statement and what it does and does not require.

Glossary of symbols and terms.

Symbol / term	Meaning
C, Cⁿ	The execution context: the append-only sequence of everything admitted so far, up to step n. C⁰ = ∅.
Aτ	An abstraction: the bundle (R, ωτ, τ) of a relation, its ontology, and its criterion.
ωτ	Ontological realization: a partial, deterministic function C ⇀ Ω fixing what is possible.
τ	Eschatological criterion: a total Boolean function of (C, ωτ(C)) fixing what is admitted.
R	The classical binary relation: the forgetful projection of Aτ that keeps only pairs (Section 6.3).
Ω	The space of ontological realizations ωτ may select from.
Execute(Aτ, Cⁿ)	The operation that appends a new event to Cⁿ when Axiom 0’s condition holds.
e_ont, e_esh	The ontological and eschatological components of an admitted event’s payload (Section 5.6).
id_inst	The instance coordinate: an event’s position in the append-only record.
Admission	The act of Execute writing a new event into C.
Preemption	Absence of admission: either ωτ(C) undefined (“not yet available”) or τ(C, ωτ(C)) = false.
Epistemic / ontological / eschatological axes	The identity, relation, and decision structure of an abstraction (Section 3.3).
Evolutive	A system whose governing abstraction admits a change to its own ωτ or τ (Section 9.6).

1.4. Scope and Results

The criterion never asks whether a computation will terminate. It asks whether a candidate is admissible now, given what has accumulated — a finite check over a finite prefix. The first is a claim about an infinite future; the second is not.

Each evaluation of τ over a fixed Cⁿ is itself a halting computation, under the effectiveness assumption stated where τ is defined (Section 5.3): a finite check with exactly two outcomes, admit or not this phase, and no third state in which the check is still running. Eschatological preemption is not a computation left executing while it waits; it is a completed evaluation of τ with a negative outcome. Ontological preemption is not itself a completed evaluation of τ at all; it is what keeps τ from being reached in the first place (Section 5.4). A later re-evaluation, once C has grown, is a new invocation of the same criterion over a new argument — the semantics of execution connect the two, not the semantics of a single continued computation. What would correspond to a non-terminating process in the classical sense is not any one evaluation but the retrospective fact that no evaluation of τ has yet succeeded, and, in the eschatological limit of Section 9.5, that none ever will — a fact established after the fact or not at all, never one the calculus must decide in advance of admitting or preempting the step in front of it. The recursion over the whole admissibility space has its own, separate termination criterion (Section 9.5): it halts exactly when no abstraction sharing the context can extend it further, the terminating regime of Section 8.5 — a strictly narrower case than merely being countable. Nothing here is in tension with Gödel’s incompleteness theorems, cited in their proper place in Section 13.1: incompleteness is a fact about what a sufficiently rich formal system can prove of itself, not about whether a single finite admissibility check terminates.

Whether execution is itself a projection of something further is not a question this paper raises.

Remark (historical anticipations). Medieval obligationes provide one of the earliest well-documented examples of a structured practice in which admission or denial is conditioned by what has already been granted during an accumulating disputation [54]. The correspondence offered here is functional, not a claim that Axiom 0 already existed in formal terms: the practice exhibits governed admission against accumulated history, while its formal relation to Axiom 0 is left to separate work. Tocher’s three-phase kernel (1963) [17], later documented in GPSS accounts [41], provides an early software-engineering realization of the same operational pattern (Section 11.1). Neither historical case names a criterion τ as a constitutive object of execution — that is the step formalized here.

Section 2 states the research gap in a page. Section 3 gives the ranked structure of the three OEE objects. Section 4 develops the execution context and eschatological induction. Section 5 states Axiom 0 and admission semantics. Section 6 derives the classical set element and binary relation as projections — of eschatological induction’s own interaction relation, not of ωτ or τ separately — and locates the role of Choice in that projected reading. Section 7 draws the structural consequences of Axiom 0: determinism, coordination, replay. Section 8 develops the admissibility tree and establishes compactness, measurability and the cardinality dichotomy. Section 9 gives convergence by well-foundedness. Section 10 gives five minimal realization conditions and their application across quantum services, system purpose and ethics, and exception handling. Section 11 validates the model through three evidentially distinct kinds of support: practical, methodological and infrastructural, and historical. Section 12 places the calculus in full detail among prior formalisms. Section 13 discusses consequences and limits; Section 14 concludes. Appendix A proves the rank separation Section 3 states; Appendix B locates the abstraction itself in the rank hierarchy and shows separately where the classical choice problem reappears after projection, while Axiom 0 itself constructs or invokes no global choice selector.

1.5. Brief Positioning

The formalisms nearest to this one — Tarski’s fixed-point theorem, Mesarović’s system-as-relation, Tocher’s re-tested conditions, DEVS, ZTES — each solve part of what Section 2 states as the gap: none carries a criterion of admission as a constitutive part of the object being executed.

2. Positioning and Research Gap

(Condensed — the detailed, fully-cited version of this material, including a synthesis of five prior formalizations that each identified one structural component without their combination, is Section 12, deferred so it can be read against the formal apparatus of Section 3, Section 4, Section 5, Section 6, Section 7, Section 8 and Section 9 rather than before it.)

2.1. What Was Solved, and Where It Stopped

The problems of execution did not arise at once, and none of the formalisms below failed at what it set out to do. Each solved a real part of the problem, and each stopped in the same place.

Table 1. (condensed). 

Contribution	What it solved	Where it stopped
Leibniz [4],[5]	Principle of sufficient reason; philosophical precursor of an explicit admission condition	The condition was placed inside the monad, a property of the sequence rather than its governor; no growing sequence C, no orthogonality
Tarski [11],[13]	Satisfaction relative to a sequence; fixed-point existence for monotone operators	Assignment sequence is given and static; Tarski’s fixed-point existence theorem applies under monotonicity
Mesarović [8],[9]	System as relation; subsystem as projection; process as derived	State space, not an append-only record
Tocher [17]	Three-phase kernel: conditions re-tested each cycle	No formal criterion; simulation-specific
Zeigler (DEVS) [16]	Discrete-event semantics	δ_ext performs admission-like work within the transition formalism; no separately named admission criterion over an append-only context
ZTES [10]	Semantic closure in one configuration	Admissibility posited as an axiom, origin left open

(Milner’s π-calculus [18] and CCS/CSP [39], λ-calculus [33], Petri [37]/Dijkstra [38]/Lamport [40], Codd, and event sourcing/CQRS are covered in the full table, Table 4, Section 12.)

Table 1. (condensed). 

Contribution	What it solved	Where it stopped
Leibniz [4],[5]	Principle of sufficient reason; philosophical precursor of an explicit admission condition	The condition was placed inside the monad, a property of the sequence rather than its governor; no growing sequence C, no orthogonality
Tarski [11],[13]	Satisfaction relative to a sequence; fixed-point existence for monotone operators	Assignment sequence is given and static; Tarski’s fixed-point existence theorem applies under monotonicity
Mesarović [8],[9]	System as relation; subsystem as projection; process as derived	State space, not an append-only record
Tocher [17]	Three-phase kernel: conditions re-tested each cycle	No formal criterion; simulation-specific
Zeigler (DEVS) [16]	Discrete-event semantics	δ_ext performs admission-like work within the transition formalism; no separately named admission criterion over an append-only context
ZTES [10]	Semantic closure in one configuration	Admissibility posited as an axiom, origin left open

(Milner’s π-calculus [18] and CCS/CSP [39], λ-calculus [33], Petri [37]/Dijkstra [38]/Lamport [40], Codd, and event sourcing/CQRS are covered in the full table, Table 4, Section 12.)

Each of these solved a real problem, and each stopped in the same place. The ceiling is not in any of them.

Leibniz’s principle deserves the opening position in this list. Nihil est sine ratione — nothing is without a sufficient reason — supplies an early philosophical precursor of an explicit condition on actuality [4], [5]. In OEE terms, it can be reconstructed as an anticipation of an admission criterion: actuality is not treated as reasonless. The comparison is structural rather than historical attribution; Leibniz did not formulate a Boolean execution predicate or an append-only context. What the present calculus adds is the placement of the criterion as a constitutively separate object evaluated over an accumulating record.

2.2. The Common Ceiling

A formalism beginning from	is without	and therefore
the set element	origin	membership carries no provenance
the binary relation	criterion and record	possibility is given, admission is not
the process	its own derivation	steps are postulated, not explained
the state	the record as carrier	the transition replaces; replay is impossible
the record alone	admissibility	a log without governance
the abstraction (this paper)	—	criterion and record are constitutive

A formalism beginning from	is without	and therefore
the set element	origin	membership carries no provenance
the binary relation	criterion and record	possibility is given, admission is not
the process	its own derivation	steps are postulated, not explained
the state	the record as carrier	the transition replaces; replay is impossible
the record alone	admissibility	a log without governance
the abstraction (this paper)	—	criterion and record are constitutive

The calculus begins from the abstraction, of which the other five are projections: forget the criterion and the position and an abstraction becomes a binary relation, exactly as forgetting the coordinates makes an admitted event a set element (Section 6).

Six formalisms, five absences, one common shape: whatever is missing sits one level below all of them, in the same place each time.

2.3. The Research Gap

Among the execution and systems formalisms surveyed here, none closes semantically in the sense defined in this paper: none holds execution, management, and design within a single apparatus in which the criterion governing admission is itself an object admitted into the same record it governs. This is a claim about the comparison class established in Section 2 and developed in Section 12, not a universal claim over every formal system ever proposed. A formalism is semantically closed when the criterion governing its steps is itself an object of the formalism. In every case above the criterion is external to what it governs — the external guardrail in agent architectures, the external controller in systems engineering, the unnamed selection of the process calculi.

One absence, two consequences: nondeterminism is left unresolved, unrecorded and unattributable, and management is separated from execution because something outside must supply what the specification omits. Both close together under the single move stated in Section 1.2.

What is new, stated precisely. The Axiom of Choice guarantees a selection function over any family of nonempty sets without naming a criterion for it [6], [29] — full AC is exactly the shape of the problem, not a solution available to it. The calculus needs no such generality. The dependency structure of Execute(Aτ, Cⁿ) = eₙ₊₁ resembles the local form motivating Dependent Choice [29]: each next step depends on the context produced by prior steps. The difference is decisive here. No choice principle is invoked, because whenever Execute is defined the next admission is determined by the specified ωτ, τ, and recorded context rather than selected existentially from an otherwise unordered family. This is why the eschatological hierarchy τ_leaf ⊏ … ⊏ τ (Section 3.6) is not an architectural add-on: it is what recursive, context-dependent resolution looks like once a criterion is actually named. What none of the formalisms in Table 1 and Section 12’s fuller comparison supplies is this combination specifically: a criterion evaluated over an accumulating causal context that can itself be revised through admission into that same record. That is the precise sense in which nothing surveyed is evolutive: not that each lacks a criterion (some, like MAPE-K architectures, have partial ones), but that none of them accumulates context in a way its own criterion can recursively depend on.

What is not resolved by this paper. Naming τ explicitly and orthogonally does not make it easy to specify correctly: getting a criterion wrong is a different failure mode from leaving it implicit, and this paper is silent on how to author τ well. What the calculus closes is the structural gap — criterion and record in one apparatus, each admission decidable by construction (Section 1.4) — not the practical difficulty of stating good criteria.

3. The Ranked OEE Execution Space

This section establishes the rank ordering the rest of the paper depends on: three objects, strictly separated by type in the cumulative hierarchy of ZF, from which both results named in Section 1.1 ultimately follow, argued fully in Section 6 and Section 7. The calculus is built within ZF throughout this argument; it does not alter, extend, or add to its axioms — what follows is a construction inside the existing foundation, not a new one alongside it.

3.1. Foundational Position

Axiom 0 rests on three objects, and the order in which they can be constructed is not a matter of exposition — it follows from their type in the cumulative hierarchy of ZF. This section states that ordering before any operational definition is given, because the ordering is what licenses everything that follows. Three things depend on it: what τ may and may not be derived from; why ωτ is a constitutive parameter rather than a computed one; and why Axiom 0 is a named structural decomposition rather than an external postulate. This same ordering is what Section 6 and Section 7 turn into the two results named in Section 1.1: the rank-separated triple (C, ωτ, τ) is what makes execution reproducible, and eschatological induction (Section 4.3) — the single recursive mechanism by which any admission, ordinary or governing, extends the same record — is what makes control and execution one act rather than two. Appendix A gives the further reason τ cannot be absorbed into ωτ’s own well-formedness: a definition being well-formed and an interaction succeeding at a given context are different kinds of fact, checked at different stages.

The ordering is stated in the vocabulary of ZF because that is the vocabulary this paper’s proofs use, not because the ordering itself originates there. The constitutive fact is that criterion, specification, and record occupy three levels that cannot collapse into one; ZF rank is a faithful representation of that fact for the results proved here, not its source. Category theory offers a precedent for this relationship: Eilenberg and Mac Lane developed it for its own mathematical purposes [43], while set-theoretic foundations can support its ordinary formal development; Mac Lane gives one explicit universe-based construction [55]. The foundational representation is therefore not confused with the conceptual origin of the theory. The present paper asks for the same modest relationship and no more: a level that sits below ZF for this problem, faithfully representable within it. Should the distinction need to bear more weight than the results here require, it can be developed into a full representation theorem; one level of correspondence is enough for the present purpose. The three ranks fixed here also place the abstraction itself — Appendix B follows that placement, and shows separately where the classical choice problem reappears once the abstraction is projected down to an ordinary binary relation.

3.2. Rank Structure

Let X be a non-empty domain and R ⊆ X × X a binary relation. Each of the three OEE objects has a precise type in the cumulative hierarchy:

• Epistemic axis C. Elements of C are pairs e = (x, y), x, y ∈ X, of rank ρ(e) = ρ(X) + 1. ran(C) ⊆ E at every step, where E is the ontological lattice of all candidate realizations.
• Ontological axis ωτ. ωτ ∈ $𝒫$(X × X), a subset of R encoding which transitions are ontologically valid for the given abstraction: ρ(ωτ) = ρ(X) + 2.
• Eschatological axis τ. ⌜τ⌝, the specification, has rank ρ(⌜τ⌝) = ρ(X) + 3; its positive extension Γ_τ⁺ ⊆ (X × X)^{<ω} × Ω is a separate, much larger object (Appendix A.1).

Theorem 1 (rank separation). ∀e∈C: ρ(e) < ρ(ωτ) < ρ(⌜τ⌝).

Proof. Rank does not decrease under pairing, union or separation applied to objects of rank ≤ α; the criterion is formed one level above the specification it evaluates. The ordering follows from the Kuratowski pair computation under the rank-homogeneity convention Appendix A.1 makes explicit. ∎

Rank separation alone does not yet say that no lower-level object determines a higher one — {x} has higher rank than x and is trivially defined from it, so that further claim needs its own argument, resting on independent specification rather than on rank (Appendix A.2’s Proposition, A.3).

(Full derivation, including the “why the square” argument for why R ⊆ X×X must compose with itself to generate a sequence at all, and the compositional reason exactly three ranks arise — ωτ and τ as two relations sharing C as their common axis, each one level above what it takes as argument — is given in Appendix A. Their interaction is itself a relation, not a third primitive alongside them: it is exactly eschatological induction, Section 4.3, and Section 6.3 states this explicitly.)

3.3. Epistemic, Ontological and Eschatological Objects

The rank ordering is not abstract bookkeeping; it fixes what each object is before Axiom 0 ever operates on it:

• C is the deterministic record of admitted events — the what has been written axis. Its full operational definition is given in Section 4.1, once eschatological induction is available to describe how it grows.
• ωτ is a constitutive parameter of the abstraction Aτ, specifying what the relation means in a given domain — not a projection of C, and not derivable from it (Section 3.4, C2). Its full definition, including the domain restriction that produces preemption, is given in Section 5.2.
• τ is the selection predicate that decides admissibility, total once ωτ has selected a realization; its full definition is given in Section 5.3 and Section 5.4.

Notational note. From Section 5.3 onward, τ’s domain is written E^{<ω} × Ω — finite sequences drawn from the ontological lattice E, not finite subsets: order and position are exactly what a criterion may read (Section 1.2(ii), Section 4.5), so the domain must preserve them. Appendix A works directly from the base relation and writes the same domain as (X × X)^{<ω} × Ω. The two are compatible presentations of the same argument type: E^{<ω} is the restriction of (X × X)^{<ω} to the candidate-event carrier E — Appendix A is deliberately self-contained and does not presuppose E, so it states the argument over the raw relation instead.

3.4. Dependency and Order of Construction

Four consequences follow from rank separation together with independent specification, not from either alone, and independent of any operational reading of Axiom 0:

C1. τ cannot be derived from C. τ sits at a different rank than C’s elements (Section 3.2), and, independently of that, is a specified parameter of the abstraction rather than a value computed from C’s content (Appendix A.2 and Appendix A.3 argue both parts; rank alone is not sufficient). The eschatological criterion must be supplied rather than inferred: τ takes C as its argument at every step, but a predicate over a domain is not reducible to an element of that domain.

C2. ωτ cannot be derived from C, for the same two-part reason: a different rank, and independent specification. Semantics is not a projection of C; it is a constitutive parameter of Aτ.

C3. τ and ωτ are independent. They occupy distinct ranks and are independently specified: τ evaluates over ωτ as an argument but cannot be derived from it, and ωτ cannot be derived from τ. The two components of Aτ = (R, ωτ, τ) are therefore independently specifiable.

C4. Axiom 0 is not an external postulate over R: it names the full ranked structure whose coordinate-forgetting projection is a binary relation. Execute(Aτ, Cⁿ) = eₙ₊₁ is not an arbitrary assumption; it is the explicit statement of the full structure whose coordinate-forgetting projection is the binary relation generated by that abstraction, present in the full object and unnamed in the formalisms surveyed in Section 12. Thus every executable abstraction has a binary-relational reduct; no converse claim that every arbitrary binary relation admits such an executable lifting is required here. Stated as a single result: the epistemic, ontological, and eschatological axes are rank-separated and orthogonal in constitutive role. None can substitute for another’s part — C recording, ωτ specifying possibility, τ specifying the rule of admission. Axiom 0 is their sole dynamic point of intersection: the one place where what is possible, what is required, and what has been recorded jointly determine whether an event is admitted.

Remark (what is not claimed). The three are not pairwise disjoint as sets: every event occurring in C is ontologically valid. The axes are distinguished by level, not by disjointness. What rank separation together with independent specification yields is non-derivability, which is what C1–C3 require.

3.5. Composite Coordinates and Event Forms

Every admitted event e ∈ C carries coord(e) = (id_esh,1, …, id_esh,k, id_ont, id_inst), where id_esh may be a vector when the purpose decomposition has depth k. The payload is assumed to depend on the complete composite key, with no partial or transitive dependency. Determinism of admission guarantees the key is well-defined and unique for each event (Section 5.6); it is this stated dependency structure, not determinism alone, that licenses the 6NF representation given there. Absence of partial and transitive dependency alone would license only up to BCNF. What is claimed for 6NF specifically is a schema property: the payload is atomic, the complete composite coordinate is the sole candidate key, and the event schema admits no non-trivial join dependency; under these constraints the event relation is irreducible and therefore in sixth normal form. The orthogonality of the key’s own components — independently specified and rank-separated (Section 3.4, C1–C4; Appendix A) — is the semantic reason no such dependency is expected to arise, not a formal proof that none could: join dependency is a more general notion than functional reconstructibility, and orthogonality speaks directly only to the latter.

The key distinguishes three levels of specification, existentially dependent on one another. An abstraction that specifies a criterion is recorded as ⟨id_esh, payload⟩. One that specifies an ontology is recorded as ⟨(id_esh, id_ont), payload⟩, because an ontology is existentially dependent on the criterion it serves. An execution of that ontology carries the full key. The position of e in C is assigned by the deterministic append and is not chosen.

The three coordinates are not of one kind. id_ont and id_esh are addresses: they refer to patterns already admitted, fixed before admission. id_inst is computed at admission, once the criterion has been met — the position the event takes in the record. The elements of the key are existentially dependent: the computed coordinate presupposes the addressed ones, which is why the key is well-founded by construction. Address coordinates are drawn from a fixed, canonically well-ordered coding domain — finite tuples of natural numbers, for instance — and are compared lexicographically; every later argument that selects a “least” candidate by address (Section 6.2, Section 8.4 and Section 8.5) relies on this fixed convention, not on any further assumption about the abstractions themselves.

A system is a family of components sharing one record; a component is one binary relation together with the criterion under which it admits. Arity counts domains within one object; dimension counts objects. Neither is what makes a system whole — the shared record is.

Where the key is not shared, decomposition fabricates tuples the original never held — the formal reason a system is not the sum of its components.

3.6. Eschatological Specialization

The specialization relation ⊏ on eschatological conditions: for any two conditions τ′ and τ,

τ′ ⊏ τ iff ∀Cⁿ: (Cⁿ, ωτ′) ∈ τ′ ⟹ (Cⁿ, ωτ) ∈ τ, but ∃Cⁿ: (Cⁿ, ωτ) ∈ τ ∧ (Cⁿ, ωτ′) ∉ τ′.

⊏ is irreflexive, asymmetric, and transitive from the definition of strict specialization. The purpose decomposition an executable abstraction uses is required to be finite, and a finite strict order is well-founded: every descending chain τₙ ⊏ … ⊏ τ₁ ⊏ τ terminates at a leaf. That the leaf exists is a structural fact about the decomposition; whether its condition is satisfiable in the current context is a separate question, settled dynamically by Axiom 0 itself, not guaranteed in advance by the hierarchy. The purpose decomposition chain τ_leaf ⊏ … ⊏ τ forms the eschatological component of the OEE space, and is the formal ground for the fractal self-similarity established in Section 4.3 and for the layered-architecture reading of Section 7.7.

4. Context and Eschatological Induction

This section builds the execution context C itself, through the recursive mechanism — eschatological induction — that later sections show delivers both reproducibility (Section 7.11) and the collapse of control into execution (Section 7.8).

4.1. The Execution Context

Context is the execution sequence growing from ∅ through the recursive application of Execute(Aτ, Cⁿ) = eₙ₊₁. It is the deterministic record of already admitted events. Because Execute(Aτ, Cⁿ) = eₙ₊₁ and C⁰ = ∅, recursive application produces the context as a growing sequence. C is not a timeline or a state snapshot: it is an append-only epistemic sequence whose positions are knowledge increments. Every admitted event adds one fact to system knowledge; its position in C is itself a fact, independently of any clock or elapsed time. No snapshot of C constitutes a state in the sense of state-based formalisms; the sequence as a whole is the complete execution history — a trace of governed admissions, not a system representation.

C⁰ = ⟨⟩, Cⁿ⁺¹ = Cⁿ ⁀ ⟨eₙ₊₁⟩ where Execute(Aτ, Cⁿ) = eₙ₊₁, n ≥ 0

Remark. Anything not written into the context is not part of execution.

Remark. The execution context C is the formal primitive; “database”, “log”, “ledger”, “knowledge base” are informal names for realizations of C. None introduces semantic content beyond this definition. C, together with ωτ and τ, is the triple Section 1.1 and Section 3.1 already name as what makes execution reproducible (Section 7.11): a record replayed against the same ontology and criterion recovers the same outcome, because the recorded prefix fixes the execution context and the applicable ontology and criterion, while each admitted event preserves the realization whose admission is being verified. The empty sequence ⟨⟩ is identified with the empty set ∅ by its standard set-theoretic encoding — a sequence of length zero has no pairs to encode, and so is the empty set under any encoding of sequences as sets. Where the paper writes C⁰ = ∅ it means exactly this identification, not a change of type; C⁰ = ⟨⟩ is not a special case requiring its own construction: Section 5.1 treats it as Aτ’s own absolute value.

4.2. Admission Count and Sequence Position

n counts admissions, not elapsed time. id_inst is computed only at the moment of admission, once (Cⁿ, ωτ) ∈ τ holds — it is the position e takes in the record, assigned by the deterministic append and not chosen. This is distinct from id_esh and id_ont, which are addresses: they refer to patterns already admitted, fixed before admission (Section 3.5). id_inst is the one coordinate of the composite key that is computed rather than addressed, which is why the key is well-founded by construction: the computed coordinate presupposes the addressed ones.

Cⁿ⁺¹ = Cⁿ ⁀ ⟨eₙ₊₁⟩ exists only when the admission was actually performed. n is not a variable ranging over a clock, and its increment is not guaranteed the way Peano succession guarantees S(n) — it is admitted, not postulated (Section 4.3).

4.3. Eschatological Induction

Definition 1 (Eschatological Induction). Eschatological induction is the recursive construction of executable history through successive admissibility resolutions. At each step (Cⁿ, ωτ) is evaluated over the current context; when it holds, the admitted event extends the context recursively; when it does not, the abstraction is preempted and the context is unchanged by it. Base case: C⁰ = ∅. Inductive step: Cⁿ ↦ Cⁿ⁺¹ = Cⁿ ⁀ ⟨eₙ₊₁⟩, defined only when (Cⁿ, ωτ) ∈ τ.

Remark (selection and choice). This recursive growth is, in plain terms, the calculus’s entire mechanism of selection; Section 6 states that fact once, explicitly, and draws its consequence for the Axiom of Choice.

Remark (collapse of control and execution). This is also, and separately, the mechanism Section 1.1 and Section 3.1 name as delivering the collapse of control and execution (Section 7.8): the induction step does not distinguish an ordinary admission from a governing one that revises ωτ or τ itself (Section 9.6) — both are the same recursive application of the same rule, so a governing act is never anything outside the sequence it governs.

Remark (deterministic specification, indeterminate content). ωτ and τ, admitted into C as ontological and eschatological events (Section 5.6), each carry a trivial epistemic check at the level of their own specification — whether each is well formed — and that check is true by construction, independent of any particular C (Appendix A.1). Their payloads’ operational content is a separate matter. For an internal abstraction, the realization produced by ωτ may depend on the accumulated context; for an environmental abstraction, the ontological candidate may instead arise from an external occurrence without consulting that accumulated content. In both cases, eschatological induction resolves whether the resulting candidate becomes part of execution by evaluating the fixed criterion τ against the full current context. The specifications stay fixed while successive admissions turn the available possibilities into one determinate recorded sequence.

Bare Peano succession does not by itself model conditional execution. The successor operation S(n) = n+1 supplies unconditional numerical continuation once its argument is given. The present execution problem is different: the extension Cⁿ ↦ Cⁿ⁺¹ exists for a particular abstraction only when its admissibility condition holds. Where that condition fails, the abstraction contributes no local successor, although the shared context may still grow through another admissible abstraction. In this sense the successor of an execution context is admitted rather than postulated.

Importing Peano succession into execution treats recursive continuation as functionally guaranteed, which suppresses the condition under which recursion actually continues or stops.

This is also where the two differ on termination, not only on continuation. Peano’s successor carries no stopping criterion of its own — S(n) is defined at every n, without exception, by the axiom itself. Eschatological induction does: at every level of τ_leaf ⊏ … ⊏ τ, the same criterion that admits a step is what ends the recursion at that level — Cⁿ ↦ Cⁿ⁺¹ stops, for that abstraction, exactly where (Cⁿ, ωτ) persistently fails, not by a rule added on top of Axiom 0 but by Axiom 0 itself, read at that level (Section 5.4). This is a fact about one abstraction’s local continuation, not a definition of program termination: whether the program as a whole terminates is settled globally, in Section 9.5, independently of any single criterion’s persistent failure — a persistently failing abstraction is simply pending, and pending abstractions neither block nor cause termination.

Two properties follow. The successor is non-local: eₙ₊₁ depends on the whole of Cⁿ, not on eₙ alone. Continuation is not monotone: an abstraction admissible at one step may be preempted at a later one (Section 9.2).

The first property names a precise technical pattern: this is course-of-values recursion in the exact sense of classical recursion theory [50, I.7.1], not primitive recursion or bare Peano succession, whose successor depends only on the immediately preceding value. In that theory, course-of-values recursion is reducible to primitive recursion once the sequence is encoded as a single number — no computational power is gained by the distinction, and none is claimed here. What is gained is conceptual clarity: eₙ₊₁’s dependence on the whole of Cⁿ is modeled explicitly, without encoding, which is exactly what tracking admissibility requires. What the calculus needs, and what this induction is built to supply, is neither more nor less: not greater computational power than primitive recursion already has, nor less than admission genuinely requires. At every step, the check (Cⁿ, ωτ) ∈ τ must satisfy three properties: it is computable (an effective, terminating test over a finite prefix, Section 5.3); deterministic (Axiom 0 yields at most one eₙ₊₁, never several, Section 7.1); and causal (eₙ₊₁ depends on exactly the prefix that precedes it, never on what comes after, Section 4.4). These three must hold not only at one step but across every iteration of the recursion — which is what building an admission context, rather than a bare numerical sequence, actually requires. Less than this could not construct a causally accountable record at all; more than this is not asked for.

The point was never to compute more than a machine already can. It was to compute exactly what admission needs, and no less, at every step, not only the first.

Fractal structure. The macro-structure of an execution is formally identical to the micro-structure of one admission — self-similarity in Mandelbrot’s sense [30], here a consequence of structure rather than geometry. At the micro level, Execute(Aτ, Cⁿ) = eₙ₊₁ names one event and advances the context by one position. At the macro level, the whole execution from C⁰ = ∅ toward the terminal condition specified by its governing criterion is the same operation applied repeatedly under a governing criterion, and the same holds at every level of a specialization hierarchy τ_leaf ⊏ … ⊏ τ₀. This self-similarity is a consequence of rank separation together with independent specification (Section 3.4, C1): τ is not derivable from C, at any scale, for the same two-part reason that holds at every level of the specialization hierarchy. Recursion is not a mechanism added to execution; it is execution repeated at a deeper level of purpose. The sequence stays linear throughout — the hierarchy lives in the event’s composite key, not in any branching of C.

4.4. Contextual Causality

Notational note. Cᵐ ≼ Cᵃ denotes that Cᵐ is a prefix of Cᵃ (equivalently, Cᵃ ⪰ Cᵐ extends Cᵐ) — the relation contexts and passages are ordered by throughout this paper, in place of set inclusion, since C and σ are sequences, not sets.

Definition 2 (CauseContext). For an admitted event e produced by Aτ at the actual invocation Execute(Aτ, Cᵃ) = e, define CauseContext(e) as follows. If τ is monotone (Section 9.1) — once satisfied, always satisfied as C grows — CauseContext(e) := the least Cᵐ ≼ Cᵃ such that (Cᵐ, ωτ) ∈ τ: the earliest point at which the criterion became satisfied. This remains valid all the way to Cᵃ by monotonicity itself, so it is a genuine, stable fact about what admission depended on, not merely a historical curiosity — and it is well-defined independently of when e is actually serialized: two events whose monotone criteria were both already satisfied at the same Cⁿ have CauseContext = Cⁿ each, whether physically written at Cⁿ, Cⁿ⁺¹, or later, because writing other events in between changes nothing that their own criteria needed. If τ is not monotone (Section 9.2 and Section 9.3), CauseContext(e) := Cᵃ itself, the actual context Execute was invoked against: an earlier prefix where the criterion happened to be true first is not guaranteed to still be the relevant one, since a non-monotone criterion can be true, then false, before becoming true again — so no “earliest satisfying prefix” is safe to substitute for the real one.

This is distinct from the literal prefix of C that happens to precede e once e is serialized, in the monotone case where the two can come apart. Two admitted events e, f may have id_inst(e) < id_inst(f) — a fact about where each was written — while their CauseContext values are unrelated to that order, or related in either direction. What CauseContext(e) records is the contextual component of what e’s admission depended on; what id_inst(e) records is where e ended up in the append-only log. Section 7.1 and Section 7.5 establish facts about the second (the fixed, written record); this section is about the first (the contextual component of what admission actually depended on). For an environmental event, the bound realization is preserved by the admitted event itself, not by CauseContext (Section 7.11).

A dependency between two events is settled by a flip, not by inclusion of their CauseContexts: f genuinely depends on e exactly when τⱼ(Cⁿ, ωτⱼ) ≠ true but τⱼ(Cⁿ⌢e, ωτⱼ) = true for the relevant Cⁿ — adding e is what turns f’s criterion from unsatisfied to satisfied. Where instead τⱼ(Cⁿ, ωτⱼ) is already true without e, e’s later presence in the physical record is irrelevant to f, regardless of where e ends up being written.

4.5. Several Admissions Enabled by One Context

Suppose a newly admitted event extends the record to a context Cⁿ in which k ≥ 2 abstractions Aτ₁, …, Aτₖ are independently admissible: τᵢ(Cⁿ, ωτᵢ(Cⁿ)) = true for i = 1, …, k. This is a one-to-many relation between context and admission: one recorded fact may make several independent abstractions admissible. It does not introduce simultaneous execution — the record remains a single sequence and admissions occur one at a time.

After one abstraction is admitted, the context grows, and every remaining abstraction is re-evaluated against the new context, as required by Section 7.6. Independence means precisely that these intervening admissions do not alter the facts on which the remaining admission conditions depend. Hence, although the context grows, each remaining criterion stays satisfied and its event is admitted at a subsequent step.

The original Cⁿ is therefore a common enabling context for all k abstractions, not necessarily the CauseContext of every resulting event under Definition 2. For a monotone criterion, Cⁿ may be the least satisfying prefix and therefore its CauseContext. For a non-monotone criterion, CauseContext remains the actual prefix against which Execute is invoked, even when admissibility has been preserved by the intervening independent writes.

Thus the common Cⁿ is what made all k abstractions admissible, while their actual admissions occupy different later positions in the sequence. Those positions carry no causal meaning among the k events: they record only the order in which independently admissible facts were written. If admission of one event changes whether another remains admissible, the abstractions are not independent, and the case belongs instead to the interaction semantics of Section 5.7 and the non-commutative case of Section 9.3.

Corollary 1 (Sequence position is not causal order). Let e, f ∈ C be produced by abstractions independently enabled by the same context Cⁿ in the sense above, with intervening independent admissions preserving their admissibility. Then id_inst(e) < id_inst(f) does not imply that f causally depends on e, or that e’s admission was a precondition for f’s. For monotone criteria their CauseContexts may coincide with the common enabling context Cⁿ; for non-monotone criteria their CauseContexts may differ, because Definition 2 records the actual invocation prefixes.

Corollary 2 (When order is causal). A direct dependency between e and f is settled by the flip-test of Section 4.4: e is a causal precondition of f when adding e changes f’s criterion from unsatisfied to satisfied at the relevant prefix. If f’s criterion was already satisfied before e and remains satisfied after e, then f’s admission does not causally depend on e, regardless of the later invocation prefix recorded as its CauseContext under Definition 2. This is weaker than saying that swapping their serialization changes nothing downstream. A later abstraction g may itself define a criterion over their relative order or instance coordinates. The result establishes only that the independently enabled admissions do not directly cause one another.

This does not weaken Section 7.1’s determinacy result: the recorded sequence, once written, remains unique and fixed — nothing here proposes that C could have been written differently after the fact. What it adds is that “fixed and unique” is a claim about the record as written, not a claim that every adjacent pair in it stands in a causal relation. Proposition 3 (Section 9.3) is the case where the earlier admission’s effect closes off the later one’s admissibility — f’s admission, unconditional in itself, changes a shared flag that e’s later evaluation depends on — which is exactly the “order is causal” branch above, not a counterexample to it.

Both cases are settled by the same mechanism, evaluated one admission at a time. When several abstractions are independently determined by an unchanged Cⁿ (Corollary 1), their invocation order is not determined by local admissibility alone; once an invocation order occurs or is supplied, ordinary sequential admission records it without introducing an additional admission rule. When they interact — when one’s admissibility genuinely depends on what another has just written, as in the shared-resource case above — the interaction is not a separate mechanism laid over admission. It is what τ_int (Section 5.7) is for, resolved by that same one-at-a-time evaluation using a criterion built to read the interaction it must resolve. Whenever an invocation order is semantically relevant to a later criterion, and not merely incidental, the fact that determined it is not left outside the record: it is itself a governing or environmental admission in C, available to be read like any other (Section 5.2, Section 9.6), so nothing semantically load-bearing enters the sequence unrepresented. No scheduler, queue, or snapshot is required as an additional semantic primitive of the calculus. An implementation may of course use any of these mechanisms to serialize invocations; where the resulting order is semantically relevant, the fact determining that order must itself be represented in C. The execution semantics require only sequential Execute and, where the abstractions interact, a τ specialized enough to evaluate that interaction.

5. Axiom 0 and Admission Semantics

This section states Axiom 0 itself, in full: the two-stage admission rule — ontological realization, then eschatological test — that Section 3’s ranked objects and Section 4’s context jointly compose into.

5.1. Abstraction

An abstraction Aτ is the full execution object whose relational reduct is a binary relation: for a fixed invocation, a deterministic mapping from the execution context C to a candidate event, equipped with an eschatological criterion τ : E^{<ω} × Ω → {true, false} and an ontology ωτ that together define what is selected and whether it is admitted. Aτ is not a separate layer added to R; R is what remains of Aτ once the criterion and the position are forgotten (Section 6.3) — the direction runs from the full object to its reduct, not the other way around. As a purpose-bound candidate mapping over the execution context, an abstraction proposes a candidate event; admission into C is performed only by Execute when (Cⁿ, ωτ) ∈ τ. Bundling R, ωτ, and τ into one object of definition, before any admission, is also what gives Aτ a rank strictly above any of its three components — Appendix B.2 makes this precise.

This reduct relation is the general pattern abstraction takes in algebra, and the principle Axiom 0 itself realizes for execution: a homomorphism corresponds to a congruence, and a reduct is the image of that map, isomorphic to the quotient by it (the First Homomorphism Theorem [53, Thm. 6.12]) — Appendix A.5 develops this correspondence further for U, as a descriptive analogy rather than a verified instance. Many definitions of abstraction exist, from type theory onward; this paper commits to exactly this one, and to no other, because it is the one a deterministic execution can be built from without circularity or an unaccounted source of nondeterminism (Section 6.3).

The absolute abstraction. Aτ is absolute when C⁰ = ⟨⟩, the empty sequence, and every coordinate and the payload are, correspondingly, unpopulated: nothing has yet been named, let alone admitted. Sequence and set are not reciprocal here. A set is data — content without order. A sequence is information — data structured by deterministic, causal order, incremented one admission at a time. Forgetting a sequence’s coordinates is trivial and returns the set beneath it, as Proposition 1 (Section 6.1) formalizes: U(⟨⟩) = ∅; building the reverse cannot be assumed, only constructed, one coordinate at a time, through execution. Axiom 0 is exactly that construction, not a coordinate label: eschatological induction is what turns the empty set’s bare content into the empty sequence’s ordered, causal structure. This is not a separate kind of abstraction — it is Aτ itself, at the one value where structure has not yet been built. The three roles (criterion, ontology, record) are fixed here for the same reason they are fixed for any Aτ, populated or not: Appendix A proves this three-part structure a requirement of the object itself, from rank separation together with independent specification, not a sequence this paper imposes on emptiness. Cantor’s own intuitive notion — a collection of definite, distinct objects — named the empty case but was never formally axiomatized by him; it was Zermelo, and later Fraenkel, who fixed membership as a primitive, structurally undefined relation. What is added here is not content but the proof that structure — exactly these three roles — was already required, and the construction that builds it. Execute(Aτ, C⁰) is accordingly the first genuine computation on it, where the trivial acts of definition (Section 4.3) meet the non-trivial interaction of Section 6.3, and it is this step, not the empty structure preceding it, that begins eschatological induction.

Remark (Terminology). The term “abstraction” is chosen for its double valence. In software engineering, an abstraction is a simplified model of reality valid under specified conditions — a microservice, an agent, a component, a rule. In the present calculus, Aτ is the executable instance of a binary relation: the mathematical object that, for a fixed invocation, maps a context to a candidate event under an explicit admissibility condition. These two meanings coincide.

Canonical form: Conditional on a fixed invocation, Aτ : C ⇀ E is a partial mapping overall, but the partiality has a precise location: Aτ(C) is defined exactly when ωτ(C) is defined and τ(C, ωτ(C)) = true, the two-stage composition Section 5.2, Section 5.3 and Section 5.4 makes precise. Where the paper writes “τ(C, ωτ) = true,” this refers to the second stage, which is total once reached; where it says an abstraction is “preempted,” Section 5.4 identifies which of the two stages that preemption originates in.

Admission status. At a fixed context Cⁿ, an abstraction has one of two operational statuses: Admitted, when Execute is defined — (Cⁿ, ωτ) ∈ τ — or Preempted, when it is not. Retrospectively, a preempted abstraction follows one of two histories: Deferred, if some later Cᵐ ⪰ Cⁿ admits it, or Never, if no such extension exists (the eschatological limit, Section 9.5). When a deferred abstraction is eventually admitted, it enters the ordinary Admitted status at that later context — the preemption–resume cycle is this transition, not a third status alongside the other two.

5.2. Ontological Realization

Canonical form. ωτ : C ⇀ Ω is a partial, deterministic ontological realization function: for a fixed invocation it yields at most one realization. For an internal abstraction, that realization is determined from the accumulated context C, and ωτ(C) remains undefined while the prior facts required for a realization are unavailable. Environmental abstractions retain the same ontological role but may generate their candidate without consulting the accumulated context, as stated below. In either case, once a candidate exists, admission is determined separately by τ over the full current context. This is where the familiar “not yet available” half of preemption lives (Section 5.4): an internal candidate is not preempted because it failed a check, but because there is nothing yet for a check to run on.

Invocation convention. Operational claims in what follows concern a concrete invocation of an abstraction. For an environmental abstraction, the triggering external occurrence is bound to that invocation before ontological realization is evaluated; distinct external occurrences therefore correspond to distinct invocations of the same abstraction specification. Conditional on a fixed invocation, ωτ remains single-valued exactly as in the internal case.

Remark (ωτ is not an external parameter). Despite the functional notation, the specification ωτ is not a value supplied from outside execution and consulted like a constant. The specification itself is admitted into C as an ontological event (Section 5.6) and is recoverable from the record on subsequent evaluations. In the environmental case, what may originate outside the record is the occurrence that triggers an invocation, not the ontology governing how that occurrence is realized. The specification of ωτ is, like τ’s (Section 7.10), agnostic to the language or methodology used to write it; the most common realization today is an ontologically defined API exposed by a stateless microservice (Section 10.1), but nothing in Axiom 0 requires that particular form.

Remark (domain growth for context-dependent realization). For an internal abstraction whose ontological realization depends on the accumulated context, dom(ωτ) is the set of contexts for which the required realization is already determined. Because admission only extends C and never retracts admitted facts, once the contextual requirements for such a realization are present, they remain so at every later extension. Hence context growth alone cannot make that internal realization unavailable. This is a fact about ωτ’s domain in the context-dependent ontological case, related to but distinct from Section 9.1’s result about τ, which concerns whether an already-admitted event stays admitted rather than whether a not-yet-realizable one becomes realizable. Environmental candidate generation may instead be triggered by an external occurrence; once a candidate exists, however, its admission is governed identically by τ over the full current context.

Remark (what is and is not formalized here). The calculus takes ωτ as given. Its type (C ⇀ Ω), its determinism, and its domain behavior under preemption are fixed by this section. But the internal procedure by which a particular ωτ produces its realization — whether from the accumulated context in the internal case or in response to an external occurrence in the environmental case — is not part of the formal system and is not something this paper specifies. This is a deliberate scope boundary, not an omission: Axiom 0 governs how ωτ and τ compose into admission, whatever their internal computation happens to be, in the same way a type signature governs composition without fixing implementation. The two questions this leaves open have existing answers, external to this paper by design: what content ωτ and τ should carry, for a given system, is a methodological question the Mesarović–Takahara system ontology already answers [8], [9]; how such a specification is realized as a running, causally ordered substrate is an infrastructural question ZTES already answers [10]. This paper’s own scope is narrower than either: the formalism connecting any such methodology to any such infrastructure, and the reason that connection must take exactly this form.

The ontological event e_ont records the specification ωτ and its existential dependence on its eschatology (Section 5.6). A particular realization produced by an invocation is different: it is a candidate for admission and does not enter C merely because ωτ has produced it. Only when the eschatological criterion holds over the full current context does Execute append the resulting execution event. The payload of e_ont specifies the ontological content itself — what the realization is, expressed as an ontologically defined API — not the algorithm that will later evaluate it: τ’s own definition belongs to the eschatological record, e_esh, not to e_ont. Keeping the two payloads apart is what keeps τ orthogonal to ωτ (Appendix A.3, C3); if the criterion’s algorithm were carried in the ontological event, the two would no longer be independently specifiable. Ontology always collapses immediately once its argument is available — it is deterministic. The same ontological definition may be instantiated in different contexts; each instantiation receives its own execution event.

Remark (ontological multiplicity). ωτ being single-valued is not the same as the underlying ontology being simple. For an internal abstraction, a rich ontological definition may specify many possible realizations in the abstract and still determine, deterministically, which one — if any — is consistent with a given C. Multiplicity belongs to the specification; each invocation nevertheless yields at most one realization.

Remark (internal and environmental abstractions). Internal and environmental abstractions differ only at the ontological stage. An internal abstraction generates its candidate from the accumulated context C. An environmental abstraction may be triggered by an occurrence outside the execution record, and its own ontology generates the corresponding candidate without consulting the accumulated context. The candidate is not yet an event of execution. In both cases the admission stage is identical: the abstraction’s internal eschatological criterion evaluates the candidate against the full current context C, and only a positive admission appends the resulting event to the record. Thus an external occurrence may generate a candidate, but it acquires executional status only through internal admission.

5.3. Deterministic Boolean Admission Function

Canonical notation. τ : {(C, ω) : ω = ωτ(C) is defined} → {true, false} is a total Boolean function over its actual domain: once ωτ(C) has yielded a realization, τ(C, ω) always evaluates, to true or to false, never to a third thing. τ never “fails to compute” — what looks like non-computation belongs entirely to the earlier, ontological stage (Section 5.2). This separates the three roles that can otherwise be conflated — relation, partial function, and predicate: the partiality is real, but it sits upstream, in ωτ; the eschatological stage, once reached at all, is total. Two notations for it are used interchangeably throughout, by a standard identification: τ(C, ω) = true and (C, ω) ∈ τ, the latter reading τ as denoting also its own positive extension {(C, ω) : τ(C, ω) = true} — canonically determined by, though not set-theoretically identical to, the function itself.

Effectiveness assumption. Totality is a claim about the value τ returns, not about how it is computed; a total function need not be computable. For every executable abstraction, ωτ and τ are assumed given by effective procedures that terminate on every input in their respective domains — this is what makes each individual evaluation, referred to throughout this paper as a “halting computation” (Section 1.4, Section 13.1), an actual, finite, mechanical check rather than merely a well-defined mathematical value. This assumption is local to one evaluation; it says nothing about whether the overall recursion (Section 9.5) terminates, which is a separate question with its own criterion.

τ admits any criterion expressible as a deterministic predicate over (C, ω), and composes hierarchically: τ is the eschatological root of a purpose decomposition chain whose leaves are individual admissibility conditions, τ = Aggregate(P₁, …, P_k), with τ(C, ω) = true iff τⱼ(C, ω) = true for all j = 1..k. Functional, non-functional, and ethical requirements are components of τ on equal formal footing — none is a post-hoc filter, since an admitted event cannot be retracted without violating the append-only property of C (Section 4.1). Ethical admissibility must therefore be placed in τ before Execute is called; it is a constitutive part of the criterion, not an analytical layer applied after the fact. (The full three-way decomposition τΣ = τ_F ∧ τ_N ∧ τ_E for a concrete system is given in Section 10.3.)

5.4. Admission and Preemption

Definition 3 (Collapse). Collapse is the transition of an abstraction from nondeterminism to determinacy upon satisfaction of its eschatological condition: Collapse(Aτ, C) ⟺ ωτ(C) is defined and τ(C, ωτ(C)) = true. Collapse is the unique moment at which the abstraction dimension Aτ and the context dimension C intersect (Section 7.8): the abstraction writes exactly one event into C upon collapse and is thereafter deterministic with respect to that admission. The admitted execution instance, and its id_inst, do not exist before collapse; the ontological realization ωτ(C), once defined, already does.

Preemption is absence of admission and may originate at either stage. Ontological preemption occurs when no realization is available for the current invocation, so the eschatological criterion is not reached. For a context-dependent internal abstraction this may occur because the required facts are not yet present in C. An environmental invocation may instead obtain its candidate from the external occurrence bound to that invocation. Eschatological preemption occurs after a realization exists, when the total Boolean evaluation τ(C, ω) returns false.

Both forms produce no execution event and no extension of C. They need not have the same cause: the first is non-definition at the ontological stage, whereas the second is a computed negative admission decision over the full current context. The compact form of Axiom 0 hides this operational distinction but does not remove it.

Because Collapse resolves once its inputs are fixed at each stage, whether or not those inputs are themselves drawn from C, for a fixed invocation the whole of Collapse can be read, from outside, as a single map from C to {true, false} — which is exactly the compact form Axiom 0 uses (Section 5.5). The two-stage account here is not a different claim from that compact form; it is what makes the compact form precise without leaving either half of “not yet” unexplained.

Axiom 0 is not a state-transition rule. It is the eschatological induction step over the complete generated context. Only successful admission produces an event and a new sequence position.

5.5. Axiom 0

Execute(Aτ, Cⁿ) = eₙ₊₁ iff (Cⁿ, ωτ) ∈ τ, with C⁰ = ∅. 

This is the whole of Axiom 0, stated in the compact form used throughout. In full, the right-hand side unpacks into two stages (Section 5.2, Section 5.3 and Section 5.4): ωτ(Cⁿ) is defined, yielding a realization ω, and τ(Cⁿ, ω) = true. The core admission semantics of Section Section 3, Section 4, Section 5, Section 6 and Section 7 follows from Axiom 0 together with the type structure and independent-specification assumptions of Section 3: the record C, the ontology ωτ, and the criterion τ are not three independent postulates but the constitutive decomposition of a single binary relation R ⊆ X × X into three rank-separated levels (Section 3.4, C4). The results of Section Section 8 and Section 9 additionally use the explicit finiteness, effectiveness, monotonicity or resource, and well-foundedness assumptions stated in those sections. Both results named in Section 1.1 follow from reading this one line two ways: as the static triple (C, ωτ, τ), it is what Section 7.11 shows makes execution reproducible; as a recursive step applied uniformly to every admission, governing or ordinary alike, it is what Section 7.8 shows collapses control into execution.

5.6. Event and Its Three Forms

Definition 4 (Event). An event is the result of executing an abstraction over the current context: Execute(Aτ, Cⁿ) = eₙ₊₁. Three forms exist in C, all generated by the same mechanism:

• e_esh = ⟨id_esh, payload_esh⟩ — eschatology
• e_ont = ⟨(id_esh, id_ont), payload_ont⟩ — ontology
• e_exec = ⟨(id_esh,1, …, id_esh,k, id_ont, id_inst), payload⟩ — execution

The general form of the event as an ordered pair is e = ⟨(id_esh, id_ont, id_inst), payload⟩, where the composite key is a coordinate in the OEE space (Section 3.2, Section 3.3, Section 3.4 and Section 3.5). Under the stated schema, the payload depends on the complete composite key, no proper subset determines it, and the schema is assumed to admit no non-trivial join dependency; under these conditions the event relation is in sixth normal form [7]. The orthogonality of the key components (Section 3.5) provides the semantic motivation for this schema constraint, but does not by itself prove the absence of join dependencies. Determinism of Execute guarantees the key is well-defined and unique; it is the stated dependency structure, not determinism alone, that licenses 6NF.

Existential dependency follows from key structure: an execution event presupposes an ontological event, which presupposes an eschatological event: ∃ e_exec ⇒ ∃ e_ont ∈ C ∧ ∃ e_esh ∈ C, and ∃ e_ont ⇒ ∃ e_esh ∈ C. No admitted execution fact exists outside the context.

Remark (time and parallelism). Time is epistemic: the position n of eₙ in C defines its temporal coordinate — a derived mapping t: ℕ → T from epistemic positions to temporal labels, not an external axis. What appears as parallelism — multiple concurrent threads — is, within the calculus, several abstractions each preempted and independently re-evaluating their own criterion on every write to the shared C (Section 4.5, Section 7.6); no additional “simultaneous” or “parallel” status is assigned to them, and no rule beyond ordinary, one-at-a-time admission is required to resolve what any one of them does. Their apparent concurrency is a temporal projection; their formal status is sequential admission over a shared C.

5.7. Primitive Forms of Abstraction

Four primitive forms: mapping, selection, interaction, recursion. All nondeterminism is eschatological — it reduces to the single atomic admission decision (Cⁿ, ωτ) ∈ τ.

• Mapping — deterministic: transforms context under an already-satisfied purpose and preserves purpose constraints after the write.
• Selection — resolves a branch: nondeterministic until τ_sel(C, ωτ_sel) holds.
• Interaction — resolves a signal or synchronization: nondeterministic until τ_int(C, ωτ_int) holds; its nondeterminism arises solely because one abstraction’s τ waits for an event that is itself the outcome of another abstraction’s atomic evaluation, written into the shared C.

Priority among abstractions in conflict — which of several waiting abstractions is admitted first when their interaction requires an order — is itself a component of τ_int, not a mechanism external to it. An external scheduler making that decision would be exactly the unnamed selector Section 1.1 identifies as the anomaly, only relocated to a different layer. Whatever τ_int needs to decide priority — a registration order, a resource balance, a wait time — is already available from C, since every abstraction’s own eschatological event is admitted there before it can propose anything; which attributes of that record τ_int reads, and in what structure, is a matter of implementation, not of the formalism.

• Recursion — the general mechanism: inherits its parent’s eschatological condition and specializes it (τ′ ⊏ τ), organizing a sequence of atomic selections through dependent-choice steps. Iteration is the degenerate case τ′ = τ at every level (depth one, no specialization) and formally falls outside the specialization relation.

As a formal consequence: if atomic τ-evaluation were removed from the calculus (τ = true everywhere, eliminating suspension), all four forms degrade to deterministic mapping. The nondeterminism of recursion and interaction is therefore not an autonomous property of those mechanisms, but a structural consequence of embedding atomic τ evaluation into their steps.

6. Classical Projections and the Role of Choice

The mechanism, stated once, plainly. ωτ and τ are designed: a specifier fixes, in advance, what is ontologically possible and what criterion governs its admission — static rules, authored once (Section 5.2 and Section 5.3). What is not designed, and cannot be, is which candidate is admitted when: that is settled by the context’s own growth, built step by step through eschatological induction (Section 4.3). At each write to C, ωτ picks out what is currently possible and τ tests it against everything already admitted; the pairing (Cⁿ, ωτ) ∈ τ either holds or does not, and C’s own accumulated state — nothing external to it — is the only input to that test. Selection, in this calculus, is not a further act layered on top of ωτ and τ; it is what the growth of C, against a fixed ωτ and τ, already does. Every worked instance already given — the minimal admission algorithm of Section 7.6, Tocher’s three-phase scan of Section 11.1 — is this same fact under a different name: a candidate that failed becomes admissible not because anything about it changed, but because C did. This is why growing the context is inseparable from performing the selection function classical formalisms leave to an unnamed act of choice: abstract away C’s growth, keep only the static relation R that ωτ and τ jointly project (Section 6.3), and the selection that context once performed has nowhere left to happen — the gap AC is invoked to fill, which the rest of this section makes precise.

6.1. Forgetful Projection (U)

Let U be the forgetful map that discards the coordinates: U(⟨(id_esh, id_ont, id_inst), payload⟩) = payload.

Proposition 1. U carries admitted events to ordinary set elements and admitted pairs to ordinary members of a relation. The classical notions are the image of U.

Proof. Immediate: U deletes the coordinates and leaves the payload, which is exactly what the inherited vocabulary of Section 1.1 kept.

Remark (function as the degenerate case). Functionality is a claim about ontological multiplicity alone: a function f ⊆ X × X — a relation for which every x has at most one y with (x, y) ∈ f — has, for each input, at most one candidate; it says nothing about whether that candidate is admitted. Since ωτ is itself always single-valued (Section 5.2), one abstraction never selects among ontological alternatives on its own — but its criterion τ can remain genuinely non-trivial, gating admission of the one candidate ωτ offers against budget, authorization, timing, or any other condition (Section 5.4): uniqueness of the candidate does not imply admissibility of it. The multiplicity worth resolving arises instead where several abstractions’ own, individually single-valued candidates accumulate into one aggregate set (Cand(σ), Section 8.1, possibly of size greater than one); it is this aggregate, not any one ωτ, that the condition |R*(n)| = 1 (Section 6.6, Section 10.2) narrows. A function, in the fully degenerate case, is where that aggregate itself never exceeds size one — not where τ is trivial, which it need never be even then.

6.2. Admitted Event as the Source of the Set Element

Two executions may admit the same value under different conditions. In the inherited vocabulary they are the same element; in execution they are different events, distinguished only by the coordinates U discards.

A selector over a family of already-admitted, coordinated events is definable: take the event of least id_inst, or of least id_esh — the coordinates are a definable well-ordering, usable for identification, attribution, query, and replay once events are recorded. Over the image of U no such property survives the forgetting: nothing in the projected representation defines a selector, and — for an arbitrary family of nonempty fibers — nothing in ZF alone guarantees that one exists either.

This is Russell’s example. Given infinitely many pairs of shoes, a representative is definable — take the left shoe. Given a family of otherwise indistinguishable pairs, the objects themselves supply no corresponding selection rule; a choice principle may therefore be required to obtain a simultaneous selector, while full AC guarantees such a selector for an arbitrary family of nonempty sets [6].

Observation. The calculus needs no principle of choice for admission because Execute never selects from an arbitrary family of nonempty sets. Retaining the coordinates separately guarantees definable ordering for those later operations — identification, attribution, query, replay, and serialization — that do require one. What follows in Section 6.5 and Section 6.6 extends this same argument, first to where AC’s language survives as a description of the projected reading, then to ties within a tolerance class.

6.3. Abstraction as the Source of the Binary Relation

The same forgetful map applies one level up. An abstraction Aτ maps the execution context C to a candidate event under an explicit criterion τ and ontology ωτ. A third relation is easy to overlook here, precisely because attention falls on ωτ and τ as the two functions that generate it, not on what their interaction constitutes in its own right: ωτ and τ are each functions, but the pairs {(Cⁿ, eₙ₊₁) : (Cⁿ, ωτ) ∈ τ} that eschatological induction (Definition 1) admits are themselves a relation — the interaction of the two, not a third primitive alongside them, but a genuine relation nonetheless, since (Cⁿ, ωτ) ∈ τ is exactly its membership condition. It is this relation, not ωτ or τ taken separately, that the classical binary relation is the projection of. Forget τ and the position, and Aτ becomes an ordinary binary relation R ⊆ X × X: the domain is the space of proposals, the codomain the space of outcomes, and nothing records under what condition a pair was admitted. What “forgetting τ and the position” actually forgets, in other words, is not one function but the interaction of two, recorded — until forgotten — as a relation in its own right. This is Proposition 1 applied one level up: exactly as forgetting the coordinates makes an admitted event a set element, forgetting the criterion and the position makes an abstraction a binary relation.

Remark (structure is deterministic; interaction resolves, it does not describe). ωτ and τ are each deterministic as specifications — well-formed functions, true by construction independent of any C (Appendix A.1) — and remain so whatever content they carry. What is not settled, prior to admission, is the space either one alone leaves open: ωτ’s own potential, unconsulted, does not yet say which candidate will be realized. The third relation above is where this is settled, not merely named: (Cⁿ, ωτ) ∈ τ does not describe an indeterminacy, it resolves one, into a single, causally-ordered admission. Keeping structure and interaction apart, at strictly increasing rank (Section 3.4), is what also keeps the process from folding back on its own well-formedness (Appendix A.1): the check that a specification is well-formed and the fact that an interaction succeeds at a given C are never the same question, asked at the same level, so the collapse that produces self-reference paradoxes elsewhere has no analogue here.

A projection formalizes which events belong to which abstraction once both are in view: π_{Aτ}(C) = ⟨eᵢ ∈ C | id_esh(eᵢ) = id(Aτ)⟩ selects, from the total sequence, only the events written by a given abstraction. A projection does not exist without an abstraction, and does not create a new context — it selects a subsequence from the one that exists. If multiple abstractions write into the same C, their projections are formally disjoint by eschatological coordinate, since each abstraction’s events carry a unique id_esh.

6.4. What Is Lost by Projection

Corollary 3 (Non-Regenerability from Projection). In any multi-abstraction context family in which an event outside A’s projection may vary while A’s own projected events remain fixed, π_A is non-injective: there exist C ≠ C′ with π_A(C) = π_A(C′). Consequently π_A has no global left inverse on that context family.

Proof. Take any two contexts C, C′ that agree on every event written by A but differ in at least one event written by some other abstraction sharing the same C; such C, C′ exist whenever more than one abstraction writes into the context (Section 4.5). Then π_A(C) = π_A(C′), since π_A selects only A’s own events (Section 6.3), yet C ≠ C′. A left inverse r with r∘π_A = id would have to send the single value π_A(C) = π_A(C′) to both C and C′ — impossible unless C = C′. So no such r exists on that context family; the trivial projection π_id(C) = C is the only one for which this obstruction does not arise, and it is not abstraction-specific. ∎

This is why time, state, and architecture — each a particular π_A(C) for some governing abstraction A_time, A_state, A_arch — are useful views but not full executable reality (Section 7.9): none can reconstruct the whole context, because each is exactly the kind of proper projection this corollary covers.

6.5. Role of AC in the Projected Representation

Within the OEE core (Section 3, Section 4 and Section 5), coordinates provide a guaranteed definable ordering over already-admitted, coordinated objects — but admission itself is not decided by sorting or selecting among addresses. Axiom 0 does not select from an unordered family and then invoke a choice principle to justify the selection — it evaluates (Cⁿ, ωτ) ∈ τ, a membership test over the specified ontology and criterion, and writes the unique event that test admits. id_inst plays no part in reaching that admission; it is assigned to the outcome once admission occurs. The calculus needs no principle of choice for exactly this reason: the coordinate-based guarantee is for what follows admission — identification, query, replay — not the mechanism admission itself uses.

The language of AC belongs to the projected, classical reading of this same structure — the one obtained by applying U (Section 6.1) and forgetting the coordinates. Once an abstraction is read as an ordinary binary relation R ⊆ X × X, with no criterion attached, simultaneous selection from an arbitrary family of nonempty fibers has exactly the form to which AC applies. The coordinate-free representation itself neither defines such a selector nor, in ZF alone for an arbitrary family, guarantees that a global one exists; AC supplies that guarantee. That is a fact about what survives projection, not a fact about how Axiom 0 operates. Concretely:

• In the full OEE space, nondeterminism is eschatological: an abstraction is undetermined only until (Cⁿ, ωτ) ∈ τ, at which point exactly one event is admitted. This does not depend on, and is not explained by, any choice principle.
• In the projected, classical reading — the abstraction stripped to R ⊆ X × X, with τ and the coordinates discarded — a selection function over R’s fibers is exactly what AC supplies, and DC-style descriptions (“a local constructive path”) describe the same reduced picture one step at a time.

Stating it this way is not a weaker or hedged version of the claim; it is the claim that was intended. Definitions of nondeterminism and derivations of the “formal chain” of the calculus should not invoke AC as a mechanism — that language describes the classical reduct of Section 6.1, Section 6.2, Section 6.3 and Section 6.4, and belongs here. Appendix B makes the same distinction structurally: the global choice problem belongs to the projected family of relation fibers, whereas Execute itself evaluates only the specified realization and criterion. Nothing at what Execute actually consults calls for it.

6.6. Definable Selection and Equivalence Classes

A total order is not by itself enough to select. Lexicographic comparison descends to the next coordinate exactly when the previous ones are equal, so where an equivalence class carries no internal order, the comparison returns no decision: an indiscernibility class need not carry a canonical definable selector in its own internal structure — Observation (Section 6.2) stated for order rather than for coordinates.

This occurs wherever comparison is up to a tolerance rather than exact: floating-point arithmetic up to ε, measured quantities equal within instrument error, semantic matching up to a distance. In each case candidates within one tolerance class are indiscernible under the criterion, and any order among them is imposed from outside.

Every admitted event carries id_inst, unique by construction. Ties within a tolerance class are resolved, after the fact, by the record itself: among the already-admitted events in that class, the selector takes the least id_inst, definable and reproducible — id_inst breaks a tie for query and replay; it never decided which of the candidates was admitted in the first place. The tolerance belongs to the specification and is admitted with the abstraction, so the class boundary is recorded rather than assumed.

The order on the record is well-founded by construction, since positions are assigned by the append — unlike the order on the reals, which is total but not well-founded, and whose well-ordering exists only under AC and is not definable. Section 6.2’s argument extends unchanged: selection over the record needs no principle of choice, exactly because the record’s coordinates were never discarded. An indiscernibility class supplies no canonical definable selector from its internal structure alone; a choice principle becomes relevant only where a simultaneous selection is required over an arbitrary family of such classes, not where one already-given class yields a single representative.

The calculus does not distinguish among indiscernible candidates because, under its own criterion, there is nothing to distinguish between them — but admission itself still writes one concrete value, never a class. ωτ’s own specification fixes a canonical representative rule — rounding, truncation, or any other rule stated as part of the abstraction — and it is that rule, not an unaccounted choice, that determines which value is written. The record attributes which representative was taken, and under which tolerance, because the rule that produced it is itself part of what was admitted.

7. Structural Consequences of Axiom 0

This section draws out what Axiom 0, once stated, already forces. Eleven consequences follow, of differing weight: most establish structural facts this paper needs at some later point — determinism, coordination, agnosticism to method and substrate. Two are the results named at the outset (Section 1.1): control and execution collapsing into one act (Section 7.8) and execution becoming reproducible (Section 7.11). The rest of this section builds toward those two; it does not merely accompany them.

7.1. Local Functionality

Corollary 4 (Execute is a function). For a fixed invocation of Aτ at a fixed context Cⁿ, Execute(Aτ, Cⁿ) has at most one value.

Proof. (1) C⁰ = ∅ is uniquely determined (Axiom 0). (2) Conditional on the invocation, ωτ yields at most one realization (Section 5.2): defined or not, never two. (3) Once a realization ω exists, τ is a total Boolean function of the pair (Section 5.3): τ(Cⁿ, ω) evaluates to exactly one of true or false. (4) eₙ₊₁ is written only upon Collapse(Aτ, Cⁿ), which requires both stages to resolve in sequence for that invocation — a realization ω defined and τ(Cⁿ, ω) = true (Section 5.4) — and the composition of two single-valued stages is itself single-valued. By induction, if Cⁿ is unique then eₙ₊₁ is uniquely determined and Cⁿ⁺¹ = Cⁿ ⁀ ⟨eₙ₊₁⟩ is unique. ∎

This is local functionality: given a fixed invocation of Aτ at a fixed Cⁿ, the next event is unique. By the same induction, given a fixed sequence of invocations (which abstraction is asked to extend the record, and when), the resulting Cⁿ⁺¹, Cⁿ⁺², … is unique at every step — which is what makes replay deterministic (Section 7.11). It is not a claim that a starting context together with several abstractions enabled by that context determines a unique serialization order. Where several abstractions are independently enabled by the same context, Section 4.5 shows that each remains admissible under the intervening independent writes and may therefore be serialized in any order without introducing a causal dependency among those admissions. Uniqueness of the global sequence is a fact about a fixed invocation order, not a fact this corollary extends to the choice of that order.

7.2. Event as Knowledge Increment

Every new sequence position is a minimal knowledge increment: Position(eₙ₊₁) = n+1, and this holds even when Payload(eₙ₊₁) = ∅ — the increment is guaranteed by position alone, independent of what the event carries.

7.3. Key Hierarchy and Existential Dependency

The composite key’s three coordinates are existentially dependent: an execution event presupposes an ontological event, which presupposes an eschatological event (Section 5.6). This ordering is not imposed by convention — it follows from the fact that id_ont and id_esh are addresses fixed before admission, while id_inst is computed only at admission (Section 4.2), so the computed coordinate cannot exist without the addressed ones already being in place.

7.4. Currently Admissible Abstractions

For a fixed context Cⁿ and a fixed family of active invocations sharing it, the set of abstractions whose criteria are currently satisfied is determined by their fixed realizations together with Cⁿ — this is a derived, observable fact, not a separate mechanism alongside Axiom 0:

𝓕(Cⁿ) = {Aᵢ : (Cⁿ, ωτᵢ) ∈ τᵢ}, where Aᵢ ranges over active invocations, not merely distinct abstraction specifications (Section 8.1 makes this convention explicit for the tree that follows).

This follows directly from Section 7.1 applied to every abstraction sharing the context: each membership test (Cⁿ, ωτᵢ) ∈ τᵢ is a fact about Cⁿ, the invocation’s fixed realization ωτᵢ, and τᵢ, so 𝓕(Cⁿ) is fixed once Cⁿ and the active invocation family are fixed. Nothing about which abstractions happen to satisfy their criteria at once changes how any one of them is admitted: each still enters C through an ordinary, independent application of Execute (Section 4.5 develops what happens when |𝓕(Cⁿ)| > 1, and finds no further rule is needed beyond that).

7.5. Sequence Position and Causal Invariance

Beyond Section 7.1 and Section 7.4, one further fact holds: once written, an event occupies a fixed position in C and cannot be removed or reordered. That is a fact about the record as written — C, once extended, does not change. It is a separate question, addressed in Section 4.4 and Section 4.5, whether two events’ relative position in that fixed record reflects a causal dependency between them or merely the order in which an already-determined set of admissible abstractions happened to be serialized. The two claims do not conflict: the record is unique and fixed (this section), and not every adjacent pair within it stands in a causal relation.

7.6. Coordination Through Shared Context

A suspended abstraction re-evaluates its criterion on every subsequent write to the shared context, and resumes when the criterion becomes satisfied: Suspended(Aτ, C) ⟺ (C, ωτ) ∉ τ; Resume(Aτ, C′) ⟺ (C′, ωτ) ∈ τ ∧ C ≼ C′. No external scheduler is required — each abstraction re-evaluates its own criterion on each context write, and the growth of C is itself the synchronization signal.

Abstractions interact exclusively through the shared execution context: every admitted event may alter the context over which other abstractions evaluate their criteria, and that is the entire interaction primitive. Nothing beyond ordinary, sequential admission is required, whether the abstractions sharing C happen to be independent (Section 4.5) or genuinely depend on one another’s output (Section 5.7, Section 9.3). What classical concurrency theory achieves with a scheduler or message-passing layer is here a structural consequence of the shared epistemic axis and the preemption property of Axiom 0, not a separate coordination layer.

The minimal admission algorithm makes this operational, and is the operational form of the selection mechanism described at the start of Section 6: evaluate τ over C; if not satisfied, the abstraction remains preempted and re-evaluates at the next write; if satisfied, admit the event, extend C, and every other preempted abstraction re-evaluates against the new context; repeat until no preempted abstraction has a satisfied criterion. This corresponds to Tocher’s three-phase structure — signal, commit, re-evaluate. Each step of it is deterministic: Section 7.1 fixes the value of any single admission, Section 7.4 fixes which abstractions are currently satisfied. Whether the process as a whole terminates is a separate question — determinism alone does not decide it, since a deterministic sequence can still be infinite; Section 9.4’s well-founded descent and Section 9.5’s Terminal_{Ω,τ} criterion are what actually settle it.

7.7. Layered Architectures and MAPE-K

Let L = {A₁, …, Aₖ} be a set of abstractions representing the layers of a layered architecture, all sharing one execution context C. Then: no unresolved inter-layer nondeterminism remains in C (nondeterminism belongs to abstractions before admission, Section 6.5); no separate execution contexts exist between layers; the duality of control and execution (Section 7.8) holds at each layer; observability is complete by projection, with no hidden state outside the context; and architectural layers form a purpose decomposition chain, τᵢ ⊏ τ_arch for all Aᵢ ∈ L, possibly non-linear.

MAPE-K [2], [25]. The Monitor, Analyze, Plan, and Execute components are four abstractions sharing one context C, each with its own condition τᵢ ⊏ τ_MAPE-K. Under this calculus there is no inter-component latency from separate contexts, no observability gaps, and the duality of control and execution is collapsed: MAPE-K becomes an eschatologically decomposed execution of a single architectural purpose over a single context.

The same reading extends to any layered architecture — n-tier, microservices, event-driven pipelines: latency between layers becomes preemption (Section 7.6), and nondeterminism does not leak between layers because it belongs to abstraction before collapse, never to the shared context.

7.8. Control and Execution as One Act

A control layer is normally a second system: it observes execution, evaluates policy, and intervenes, with its own state, clock, and view — and the gap between that view and what actually happened is where governance fails. Take Control(Aτ, C) to name exactly this: whatever predicate decides whether the executing process may proceed, however external or observational such a predicate is ordinarily taken to be. No independent formalization of that predicate is given prior to what follows; the claim below is that, in this calculus, no such independent formalization is needed, because there is nothing else for it to be.

Corollary 5 (Duality of Control and Execution). Control(Aτ, C) ≡ Collapse(Aτ, C), and Execution(Aτ, C, e) ≡ Write(e) ∧ Collapse(Aτ, C); hence AdmissibleExecution ≡ ControlledExecution.

Proof. Collapse(Aτ, Cⁿ) is necessary — no event is written without it — and sufficient — when it holds, the event is written — for execution. Whatever predicate a governing layer would need to evaluate to decide whether execution may proceed is, in this calculus, evaluated by the same τ that decides admission itself: no second, separately computed predicate exists for control to consult. The control condition and the execution condition are therefore identified as the same predicate, self-contained in the abstraction’s definition; no predicate external to the calculus is needed to determine admissibility. ∎

Here there is no second system, so there is no such gap: the condition under which an event is admitted is the control condition. This is structurally aligned with the Good Regulator principle (Conant & Ashby [32]): the present setting collapses the gap that principle warns against, without claiming to reproduce its proof in full generality. The collapse of the duality does not eliminate management — it relocates it: a governing abstraction reads the record and, where preemption persists, admits an event that changes the ontology or the criterion. That intervention is itself an ordinary, auditable admission.

7.9. Time, State, Architecture as Projections

Time = π_{A_time}(C), State = π_{A_state}(C), Architecture = π_{A_arch}(C), Process = π_{A_process}(C): each is a subsequence of the one execution sequence originating from ∅, selected by the abstraction whose events carry the corresponding coordinates. None is an independent primitive of execution; each is a derived view, and Section 6.4 already establishes that no such view can reconstruct the whole context. Process, read this way, is a passive projection, not a further ontology: the standard definition in the simulation literature — a chronologically ordered sequence of events tracking one entity from its creation to its termination [41], formalized in workflow terms as event-calculus execution [3] — is exactly π_{A_process}(C), the set of admission-steps an abstraction has already performed, carrying no possibility or criterion of its own beyond what ωτ and τ already supply. Mesarović’s own definition (Section 12.2) isolates exactly this absence — process as derived, prior to and without the context that resolves it. Parallelism (Section 5.6) is not a further primitive alongside these: it is what the time projection looks like when several independently-admitted abstractions’ events cluster near the same t-value under Time = π_{A_time}(C) — an artifact of that one projection, not a further abstraction of its own.

The same treatment extends to semantics itself: whatever external framework is used to interpret what an abstraction’s events mean — game-theoretic, category-theoretic, denotational, or otherwise — is Semantics = π_{A_sem}(C), one further projection selected by whichever abstraction A_sem carries that reading, not a primitive the calculus must itself take a position on. Syntax is agnostic in the same way, for the same reason: the calculus governs when an event is admitted, not which external vocabulary — syntactic or semantic — is used to specify or read it. Neither syntax nor semantics, so read, affects execution itself; both are further abstractions to be admitted or projected like any other, not inputs execution depends on.

Time, state, architecture, process, semantics, and syntax are, in this light, one fact named six times, not six separate facts: each is a single Xᵢ in the decomposition of Section 3.5, realized as its own binary relation Rᵢ = C × Xᵢ sharing the same context C that every other dimension shares, rather than an independent primitive requiring its own treatment. What a system reduces to is not time, or state, or any dimension named here — it is the abstraction Aτᵢ that realizes one such dimension against the shared context. Six dimensions are named because six recur often enough to be worth naming; the decomposition itself places no bound on how many there could be, and rules out none in advance.

The reduction to a shared context holds at the level of elements, not at the level of the axis indices themselves. Each admitted event, whichever Xᵢ it belongs to, is one entry in the one sequence C — that is what “sharing a context” means. An index such as “time” or “state” names a projection reading out one final coordinate; the content it is drawn from may be arbitrarily multidimensional, but the index that selects a single value from it is not, and the two should not be conflated. Underneath every dimension named here there is exactly one recursively-built sequence, not one per dimension: the course-of-values recursion of Section 4.3 operates over that single C, and what looks like several dimensions is several ways of reading one thing, never several things being read.

7.10. Methodological and Infrastructure Agnosticism

Any discretely-defined process representable as a sequence of admitted events growing from ∅ embeds into the calculus: each step becomes an abstraction with an eschatological condition expressing that step’s admissibility criterion, preserving event generation, contextual growth, epistemic position, and abstraction-specific projection. The choice of methodology affects how the relevant relations, ontologies, and criteria are specified, not the admission mechanism itself; in this sense, the calculus is methodologically agnostic.

Symmetrically, any infrastructure preserving four minimal properties — it can generate events, grow the context, preserve causal order, and project by abstraction — correctly implements the calculus regardless of physical realization: no specific technology, protocol, or deployment pattern is required. These four properties are not abstract desiderata: they are concretely achievable, and already achieved by ordinary digital hardware, which is why Section 10 and Section 11 together catalogue realizations across six decades and multiple architectural families. This is a different decomposition from Section 10.1’s five minimal realization conditions, not an inconsistent count of the same list: the four properties here are capabilities an infrastructure must supply; the five in Section 10.1 are the calculus’s own constitutive components (C, Aτ, τ, ωτ, preemption) that any infrastructure with these four capabilities is thereby able to realize.

The scope is representation-based rather than domain-based. A system is within scope whenever its execution can be represented by binary-relational abstractions whose admissions are evaluated against the shared accumulated context C. The set of such relations need not be fixed before execution begins. A governing abstraction may, through an ordinary application of Axiom 0, admit a specification event introducing a new binary relation R′, together with its ontological specification ωτ′ and admissibility criterion τ′. The new abstraction then participates in subsequent execution through the same mechanism as every abstraction already present. Relational dimensionality may therefore evolve during execution, while every introduction and every subsequent admission remains serialized through the single causal sequence C.

Boden’s distinction between exploratory creativity within a fixed possibility space and transformational creativity that changes the space itself [44] provides an illustrative external analogue of the distinction already present here between ordinary admission under fixed (ωτ, τ) and governing admission that changes that specification (Section 9.6). No formal equivalence with the psychological taxonomy is claimed.

The scope of this result is distinct from that of the Church–Turing thesis [33], [60]. Classical computability theory concerns the class of effectively computable functions; the present calculus makes no claim to enlarge that class, and no such claim is required by its results. Its subject is execution: the structure by which relational specifications, their admissibility conditions, their accumulated causal context, and changes to those specifications participate in one executable system. The methodology- and infrastructure-agnostic result established above is therefore a claim about relational execution representation, not about stronger extensional computability. It neither challenges nor depends upon classical computability limits.

7.11. Deterministic Replay

Corollary 6 (Deterministic Replay). Given the same recorded execution, replay deterministically reconstructs the prefix preceding every admitted event and verifies that event’s admission under the ontology and criterion in force at that point. For an admitted environmental event, the recorded realization is sufficient for verification; the originating external occurrence need not be regenerated. Anything not admitted into C is not part of the execution history and therefore does not belong to replay. Generative re-execution is a distinct operation. An environmental abstraction may encounter a different external occurrence and therefore generate a different candidate, so generative re-execution need not reproduce the original execution. Verification replay does not regenerate that environment: it operates on the admitted execution record.

Proof. Let eᵢ₊₁ be an admitted event in the recorded execution and Cⁱ its preceding prefix. Because C is append-only and causally ordered, that prefix is uniquely fixed by e₁, …, eᵢ. The applicable ωτ and τ specifications are themselves admitted into C as ontological and eschatological events (Section 1.2(v)), so the specifications in force at step i are recoverable from the recorded execution. For an internal abstraction, the fixed invocation context together with the single-valued ωτ determines at most one realization. For an admitted environmental event, the recorded event preserves the realization generated at the ontological stage, so replay need not regenerate the originating external occurrence. In either case replay therefore has a fixed prefix Cⁱ, a fixed realization ω, and the applicable fixed criterion τ. Since τ is total and single-valued on (Cⁱ, ω), its evaluation is unique. Hence every recorded admission is deterministically verifiable. ∎

An environmental abstraction — a quantum service, for instance (Section 10.2) — illustrates the distinction directly: its own sample will not repeat under generative re-execution, yet verification replay still re-evaluates τ over the same recorded prefix and finds the same decision, carrying forward the same value once recorded. Two properties do this work: the composite key makes every event carry its own production genealogy, so no external index is required to establish what preceded it. Append-only ordering makes the prefix immutable, so what was consulted cannot have changed. Deterministic replay is therefore a structural consequence of Axiom 0, not a facility added to the runtime.

8. The Admissibility Space

This section steps back from a single execution (Section 4, Section 5, Section 6 and Section 7) to the space of all executions an ontology and criterion could admit, establishing the measurability and cardinality results that make reproducibility (Section 7.11) and evolutivity (Section 9.6) precise claims about a well-defined space.

8.1. Local Execution Versus the Global Space of Executions

The tree constructed in this section is a meta-level representation of all admissible execution records consistent with a given ontology and criterion — it is not the operational semantics of one fixed abstraction stepping under Axiom 0. Axiom 0 (Section 5.5) produces one sequence, deterministically, for one abstraction acting on one context. What follows here asks a different question: across every abstraction and every candidate the ontology could have offered, what does the space of all possible admissible records look like?

Invocation scope of the admissibility tree. The tree constructed in this section is relative to a fixed invocation regime. For each node σ, the active invocations — including any external occurrences already bound to environmental invocations under Section 5.2 — are taken as fixed. Cand(σ) therefore collects the at-most-one realization contributed by each such active invocation. A different generative environment, in which different external occurrences are bound to environmental invocations, induces a different admissibility tree. The finite-branching assumption is correspondingly an assumption that only finitely many active invocation instances contribute candidates at any finite node. No restriction is imposed on the environment globally; Theorem 2 below concerns the execution space generated under the fixed invocation regime being analysed.

Harmonizing remark. τ(e, σ) := τ(σ, e), e ∈ Cand(σ) — the argument order used from here through Section 9 is convenience notation for the canonical τ(σ, ω) of Section 5.3, context first, realization second; it introduces no new function or reversed signature, only a more readable order for the admissibility-space argument that follows. Within this space, τ(e, σ) ∈ {0, 1} is evaluated only for e ∈ Cand(σ) — the realizations some abstraction’s ωτ has already selected at σ. (Cand is written rather than Ω here, to keep this context-indexed set distinct from the codomain Ω of Section 5.3’s τ.). This is consistent with the canonical two-stage form of Section 5.2, Section 5.3 and Section 5.4: outside Cand(σ), e is not a realization any ωτ has produced, so there is no case left over corresponding to “not in domain” — that non-availability is exactly what keeps a candidate out of Cand(σ) in the first place, one stage before τ is ever reached. Totality here is totality of τ over the realizations that do exist; it is not a claim that any single ωτ offers more than one at once — Section 7.1’s single-valuedness still holds per abstraction. Cand(σ) can nonetheless contain several elements, because it collects the (at most one each) realizations of every abstraction sharing σ, exactly the situation Section 4.5 develops.

In the definitions below, Aᵢ ranges over active invocation instances under the fixed invocation regime, rather than merely over distinct abstraction specifications. Thus two invocations of the same abstraction specification are treated as distinct contributors whenever they are distinct invocations in the regime being analysed.

Let X be the carrier generated by eschatological induction from ∅. Write σ = ⟨e₁, …, eₙ⟩ for a finite passage and σ↾i for its prefix of length i — σ is itself the accumulated context, so passage and context are not distinguished notationally. Let Cand(σ) = {ωτᵢ(σ) : Aᵢ shares σ, ωτᵢ(σ)↓} collect, across every abstraction sharing σ, the at-most-one realization each contributes when defined, and Succ(σ) = {ωτᵢ(σ) : Aᵢ shares σ, ωτᵢ(σ)↓, τᵢ(σ, ωτᵢ(σ)) = 1}; since each abstraction contributes at most one element to Cand and τᵢ is a truth value, |Succ(σ)| ≤ |Cand(σ)| always.

The admissibility tree is T = {σ : eᵢ₊₁ ∈ Succ(σ↾i) for all i < |σ|}, with [T] its infinite branches. Finite, terminating executions are not themselves members of [T]: they are terminal nodes of T, Term(T) = {σ ∈ T : ∄η ∈ T, σ ≼ η ∧ σ ≠ η}, where no abstraction sharing the context extends the record further (Section 1.4, Section 9.5). By Lemma 2 (Section 8.3), every level Tₙ = {σ ∈ T : |σ| = n} is finite; hence T = ⋃ₙ<ω Tₙ is countable, and therefore Term(T) ⊆ T is countable. The full space of possible execution outcomes, finite and infinite alike, is Exec(T) = [T] ∪ Term(T); since Term(T) is countable, including it never changes the cardinality Theorem 2 establishes: |Exec(T)| ≤ ℵ₀ or |Exec(T)| = 𝔠, exactly as |[T]| is — the finite case (Exec(T) empty, or exhausted by finitely many terminal nodes with no infinite branch) is not excluded by either bound, only the intermediate infinite cardinalities are. The rest of this section works with [T] specifically because that is where the cardinality dichotomy has content; termination is accounted for separately, in the three regimes of Section 8.5.

Traces record what happened, state spaces what could happen; neither names what was permitted. T does — and reproducibility and governance become claims about it.

8.2. Admissibility Tree

Lemma 1 (T is a tree). If σ ∈ T and m ≤ |σ|, then σ↾m ∈ T.

Proof. Membership σ ∈ T is the conjunction of e_{i+1} ∈ Succ(σ↾i) over i < |σ|. For σ↾m one requires the same conjunction over i < m, and since (σ↾m)↾i = σ↾i for i ≤ m, this is a sub-conjunction of one that already holds. ∎

The proof is short because Axiom 0 has already paid for it: Cand is well-defined at each node from the active invocation instances and their single-valued realizations, τ is evaluated over the accumulated context, and the context is append-only. No retroaction ⟹ locality ⟹ prefix-closure.

8.3. Prefix Closure and Finite Branching

Lemma 2 (finite branching). Succ(σ) is finite for every σ ∈ T.

Two facts suffice: finite dimensionality (only finitely many invocation instances are active at any finite context σ) and single-valuedness (each ωτᵢ contributes at most one realization, per Section 5.2). Finite exogeny remains a substantive condition on any one environmental abstraction’s own offer (a restriction on admission, not on the environment: the receiving abstraction’s own criterion renders any offer discrete), but is no longer needed for this lemma, since Cand(σ) now aggregates at most one contribution per active invocation directly.

Proof. Only finitely many invocation instances are active at the finite context σ, and each ωτᵢ contributes at most one realization to Cand(σ) = {ωτᵢ(σ) : Aᵢ shares σ, ωτᵢ(σ)↓}. Hence Cand(σ) is finite. Since Succ(σ) ⊆ Cand(σ), Succ(σ) is finite. ∎

The ontology may still be infinite as ⋃ₙ Cand(σ↾n) — finite at every step, infinite only in the limit. τ never reads an infinity.

8.4. Compactness and Measurability

Each level of T is finite by induction from Section 8.3, so the set of possible n-th events Aₙ is finite and [T] ⊆ ∏ₙ Aₙ.

Proposition 2 ([T] is closed and compact). [T] is closed in ∏ₙ Aₙ, which is compact.

Proof. If p ∉ [T] then p↾n ∉ T for some n; by Section 8.2 no q ∈ [T] agrees with p on the first n coordinates, so the cylinder [p↾n] misses [T]. Each active abstraction has its pre-admission eschatological and ontological address (id_esh, id_ont), and each ωτᵢ contributes at most one candidate; ordering candidates lexicographically by these pre-admission addresses therefore gives a definable enumeration of each Aₙ, extended lexicographically to finite sequences for the nodes of the tree — the coordinate id_inst is not used here, since it is assigned only after admission. So each Aₙ is definably enumerated and the standard argument applies in ZF, with no choice principle invoked. ∎

Being compact, metrizable and zero-dimensional, [T] is homeomorphic to a closed subset of Cantor space.

Measurability. [T] is Π⁰₁, hence Borel, hence measurable with respect to any Borel measure on the path space (the calculus does not itself supply a measure). Since every level of T is finite (Lemma 2), T has only countably many finite nodes; together with Proposition 2 this yields a second-countable compact path space, with the node enumeration definable from the fixed address coding and no choice principle required for the construction.

8.5. The Dichotomy

The standard equivalence is the one this section uses: [T] is uncountable if and only if [T] contains a nonempty perfect subset if and only if T contains a nonempty perfect pruned subtree — a subtree S ⊆ T, closed under initial segments (σ ∈ S and η ⪯ σ imply η ∈ S), in which every node has two incompatible extensions within S itself, not merely somewhere in the larger cone that contains it.

The perfect kernel of T is obtained by the Cantor–Bendixson derivative: remove, at each stage, every node with no further splitting reachable above it within what remains, and iterate transfinitely. Since each level of T is finite (Lemma 2), T has only countably many nodes; equivalently, the path space is a countable product of finite discrete coordinate sets and is second countable. The sequence of derivatives therefore stabilizes by some countable ordinal; every stage is an explicit, definable operation on the tree constructed so far, and no choice principle is invoked at any of them. What remains at stabilization, T*, is either empty or is itself a nonempty perfect pruned subtree in the sense above: a node surviving every stage of removal must, by construction, have two incompatible extensions that also survive, since a node failing this would have been removed at some stage.

Extension. If T is infinite it has an infinite branch: at each step take the least successor, in the definable well-ordering of X_σ, with infinitely many extensions in T — finite branching guarantees one exists. The usual recursive construction may be phrased as repeated choices; here the least-successor rule is definable, so no choice principle is required.

Theorem 2 (the cardinality dichotomy). Exactly one of the following holds. (a) T contains a nonempty perfect pruned subtree: then [T] contains a perfect set and |[T]| = 𝔠. (b) T contains no nonempty perfect pruned subtree: then [T] is countable.

Proof. [T] is a closed subset of the Polish space ∏ₙ Aₙ (Section 8.4: closed, compact, metrizable). The Cantor–Bendixson theorem [47, Thm. 6.4] applies directly: [T] decomposes uniquely as P ∪ S, where P is perfect and S is countable. Let T* ⊆ T be the pruned subtree whose body is P — the perfect kernel constructed above — and note T*’s existence is exactly what the derivative construction produces.

(a) If T*, the perfect kernel, is nonempty, define φ: 2^{<ω} → T* by recursion: φ(⟨⟩) = the least node of T* in the definable well-ordering; given φ(s) = σ ∈ T*, let σ₀, σ₁ ∈ T* be the two least incompatible proper extensions of σ within T*, in the definable well-ordering — witnessing σ’s branching property, which exist because every node of T* has two incompatible extensions within T* by construction, not necessarily as immediate successors, and not merely somewhere in the larger cone — and set φ(s⌢i) = σᵢ. Every choice is of a least element in a definable well-ordering, so no dependent choice is used. φ is injective and order-preserving, so [T] contains a perfect set and |[T]| = 𝔠.

(b) If T* is empty, the closed set [T] is scattered, and every scattered closed subset of a Polish space is countable — the other half of the Cantor–Bendixson theorem [47] already invoked above. This direction is choice-free for the same reason as the construction: the derivative reaching T* = ∅ is explicit and definable at every stage, and the stabilization ordinal is countable; the theorem itself supplies the passage from scattered to countable, not a further recursion counted here. ∎

In both cases [T] remains closed, compact, Borel and measurable. Countable, however, does not mean terminating: even where T contains no nonempty perfect pruned subtree, [T] may still contain an infinite branch — an abstraction (or a fixed chain of them) that keeps being admitted, unopposed by any competing candidate, forever. Combined with well-founded descent (Section 9.4), the dichotomy resolves into three regimes, not two:

• Terminating regime. T contains no nonempty perfect pruned subtree, and no infinite branch exists: T is well-founded; Section 9.4 gives a concrete sufficient well-founded descent condition that realizes this terminating regime.
• Persistent non-branching regime. T contains no nonempty perfect pruned subtree, but at least one infinite branch exists: countable, by part (b), and no well-founded measure is available for any such branch unless one is supplied (Section 9.5).
• Perfect-splitting regime. T contains a nonempty perfect pruned subtree: [T] contains a perfect set and |[T]| = 𝔠. The system therefore generates persistent incompatible alternatives rather than merely continuing along isolated branches. Evolutive change (Section 9.6) is one possible mechanism capable of contributing to such splitting, but the cardinality result itself does not require that the branching be evolutive.

“Countable” picks out the first two regimes together; only the first of them terminates. Where Section 9.6 and Section 10.2 speak of a countable, terminating regime against a continuum, evolutive one, the countable side of that contrast is this first regime specifically, not countability on its own.

8.6. Depth, Width, and Cardinality Regimes

Depth (id_esh) is the length of the specialization chain τ_leaf ⊏ … ⊏ τ — a determinate, finite system of deterministic functions, complete before execution begins, terminating by construction.

Width (id_ont), written d(σ), is the number of relations that must interact to produce the context a step requires — not specified in advance, but read from the relation between what the ontology demands and what the record already holds. d = 0: everything required is already admitted and only its arrival is awaited. d ≥ 1: the next step’s ontology is itself multi-dimensional, and the context must be produced by decomposition into interacting abstractions, which may or may not succeed. Depth is specified; width is measured. Recursion moves between levels; iteration proceeds within a level.

The record as a coordinate space. Because every admitted event carries a coordinate on each axis that participated in its admission, C can be read as a multi-dimensional coordinate space — a way of reading C, not a mechanism of execution. This differs from a classical transform domain in two respects: the dimensionality is not fixed in advance (each new level of specialization adds a coordinate, growing with the system), and the grid is not uniform (a coordinate exists only where τ was satisfied; an empty coordinate records that no admission occurred there, not missing data). Under an implementation that indexes the record by its composite key, an aggregate which would classically require a transform over a fixed grid becomes a sequence of key-prefix lookups — O(log|C| + |result|) with such an index — since every admitted event carries its complete key, supporting lookup across indexed key prefixes, or across other coordinate subsets for which a suitable secondary index is provided; where a 6NF decomposition [7] is used, the declared component relations can in addition be recombined losslessly by the appropriate join — the complexity bound is a property of the index, not something the calculus or 6NF supplies on their own.

A spectral transform over a segment of C is not an operation of the calculus — it is the payload of a spectral abstraction: an abstraction whose criterion governs when the transform is admitted, whose ontology fixes what is transformed, and whose admitted event carries the result. It is subject to the same replay and audit discipline as any other admission. A spectrum specifically is analysis carried by the record, never a term in the decision that produced it — but this is a claim about spectra, not a general restriction on τ: budgets, quotas, rate limits, and other resource-sensitive criteria (Section 9.1) routinely do read prior payload content, and are not excluded by anything said here. What τ may read is exactly what its own specification declares it reads; nothing in the calculus bars a criterion from consulting the record it governs.

When several abstractions interact, their combined admission pattern over the shared coordinate space carries a structure beyond any one abstraction’s own spectrum: correlation between two axes’ spectra — a convolution in frequency space — can surface a shared pattern neither axis shows alone, including the signature nondeterminism leaves once collapsed into a single admitted path. This cross-level spectral structure, and the K-dimensional FFT it requires over the coordinate space established above, is developed in full elsewhere [35, Appendix C]; what is claimed here is only that this coordinate structure is what makes such analysis well-defined in the first place.

9. Convergence, Order and Evolutivity

Relation to the companion result. What is incompatible with an append-only record is the invalidation of an admission, and a non-monotone criterion does not do that (Section 9.1). The companion work [10] states that criterion monotonicity is required; the requirement is real but was localized to the permission rather than to the record. This section refines that result rather than contradicting it.

9.1. Admission Preservation

Definition 5 (monotone criterion). τ is monotone if τ(e, σ) = 1 and σ′ ⪰ σ imply τ(e, σ′) = 1 — once admissible, always admissible.

Monotonicity is often assumed because it supports fixed-point arguments. But that assumption excludes every criterion that consumes something.

Consider τ_balance, which rejects any action exceeding accumulated transfer limits over the context. As the record grows, the accumulated total grows, so a transfer once within the limit falls outside it — this criterion is not monotone. Budgets, quotas, rate limits and deadlines are all of this form; a convergence theorem requiring monotonicity excludes almost every deployed system.

Lemma 3 (admission facts are preserved). If e was admitted against σ↾n, the fact that τ(e, σ↾n) = 1 remains permanently verifiable from every later context containing that immutable prefix.

Proof. Admission of e was conditioned on τ(e, σ↾n) = 1, a fact about the prefix σ↾n. By append-only, σ↾n is a permanent prefix of every σ′ ⪰ σ. A fact about a fixed finite prefix is not altered by extension. ∎

Non-monotonicity is often mistaken for retroactive invalidation, and rejected on that ground. Nothing is invalidated: the record accumulates, the permission does not.

9.2. Monotone and Non-Monotone Criteria

Definition 6 (anti-monotone criterion). τ is anti-monotone in a resource r if r is non-decreasing along admissions and τ(e, σ) = 0 implies τ(e, σ′) = 0 for all σ′ ⪰ σ.

9.3. Context-Sensitive Non-Commutativity

Proposition 3 (Context-sensitive non-commutativity). If τ is not monotone, T need not be order-independent: there exist σ, e, f with σ⌢e⌢f ∈ T but σ⌢f⌢e ∉ T.

Proof. Let σ carry a flag b, initially 1. Let e be admissible whenever b = 1, without altering b; let f be always admissible, and set b := 0 upon admission. Both are individually admissible against σ (b = 1 there), so e, f ∈ Succ(σ). At σ⌢e, b is still 1 (e leaves it unchanged), so f — always admissible — remains admissible: σ⌢e⌢f ∈ T. At σ⌢f, b is now 0 (f’s own effect), so e — which requires b = 1 — is no longer admissible: σ⌢f⌢e ∉ T. ∎

This is precisely the case where the admission of f changes the context relevant to a later evaluation of e (Section 4.4 and Section 4.5): f does not depend on e — f is always admissible — but e’s continued admissibility depends on whether f has already been admitted, since f’s own effect on the shared flag is what later closes e off. This is unlike the case in Section 4.5, where several abstractions are all admitted directly against the same, already-fixed context, and their relative order carries no such dependency. Order dependence here is diagnosed by which of these two cases holds, not discovered after the fact in production.

9.4. Well-Founded Descent

Theorem 3 (fixed-point existence and well-founded convergence). Let τ = τ_mono ∧ τ_anti, where τ_anti is anti-monotone in a resource with finite budget B; let the eschatological hierarchy be well-founded downward with L levels, the budget resetting to B upon each descent to a new level; let every recursion step either consume at least one unit of the current level’s budget or descend one level, not both; and suppose τ_mono factors through the set of realizations already admitted — τ_mono(e, σ) depends only on {realizations occurring in σ}, not on their order — so that S ⊆ S′, as sets of realizations, implies whatever τ_mono admits given S it also admits given S′. Then: (a) if τ_anti is trivial, τ_mono induces a monotone operator Φ: $𝒫$(Ω) → $𝒫$(Ω), Φ(S) = S ∪ {ω ∈ Ω : ω is admitted by τ_mono given S}, on the complete lattice ($𝒫$(Ω), ⊆) — monotone by the factoring assumption above — so Tarski’s fixed-point theorem [13] applies to Φ, giving existence of a least fixed point and stabilization of the iteration at it; this is an existence and stabilization result, not itself a bound on how many steps stabilization takes. (b) if τ_mono is trivial and no level descent occurs (equivalently, L = 1), then μ(σ) = B − spent(σ) ∈ ℕ is well-founded and strictly decreases, so the recursion terminates in at most B steps. (c) in general the lexicographic measure (level, remaining budget) strictly decreases under the reset assumption above: each level contributes at most B budget-consuming steps, and a descent to the next level is a further, separate step not itself drawn from that budget, so across L levels the recursion terminates in at most L·B + (L−1) = L(B+1) − 1 steps.

The budget B and the level count L are hypotheses of this theorem, not conclusions of it. The measure must be supplied by whoever specifies the abstraction — a genuine finite resource, a genuine well-founded hierarchy — and nothing here derives their existence from weaker assumptions. Parts (b) and (c) show that a supplied well-founded measure is sufficient for finite termination, with no appeal to monotonicity anywhere in that argument. Part (a) is a separate result: Tarski guarantees existence of a least fixed point and stabilization of the associated transfinite iteration from ∅ — unions taken at limit stages — at a closure ordinal; no finite-step bound follows from that route, nor is one claimed.

Monotonicity was never what finite termination required — well-foundedness was. Tarski is one route to fixed-point existence; well-founded descent is a separate route to finite termination, and it is the one resource-constrained systems already travel.

What makes τ_balance non-monotone — consumption of a bounded resource — is precisely the well-founded measure that guarantees its termination. Anti-monotonicity is not the obstacle; it is the engine. The lexicographic measure is not ad hoc: level is depth on the eschatological axis (Section 8.6), budget is iteration within a level on the ontological axis.

9.5. Persistent Preemption and the Boundary

An active-capacity limit — a bound on how many admitted commitments may be outstanding at once — is genuinely oscillatory: its recorded value rises on admission and falls on completion. Such a criterion is neither monotone nor anti-monotone, and no measure comes for free — one must be supplied explicitly, by the governing abstraction that reads the record (Section 9.6). Where no such measure exists, non-convergence is real, but it is detected: exhaustion carries a coordinate and a level, so a system that cannot converge still records why.

Program termination, stated precisely, is the exhaustion of admission possibility (Section 1.4): no abstraction sharing the context can extend it further. Formally, write C ⇝_{Ω,τ} C′ when C′ is reached from C by one admissible application of Axiom 0 under the currently defined ontologies and criteria, and let ⇝*_{Ω,τ} be its reflexive-transitive closure. Then:

Terminal_{Ω,τ}(C) ⟺ ∄ C′ : C ≼ C′ ∧ C ≠ C′ ∧ C ⇝*_{Ω,τ} C′.

This happens in one of two ways. The first, and the rarer of the two, is that every abstraction’s criterion has by then been satisfied — nothing is left pending. The second, and the more common in practice, is that the context can no longer be extended while abstractions still wait: a functional requirement whose ontology never arrives, a non-functional constraint that is never met, or an ethical criterion τ_E that permanently excludes the only candidates that would have satisfied it (Section 10.3). These pending abstractions are not part of the execution record, and termination does not wait on them: they remain unresolved ontological possibilities, still nondeterministic, for which no context the system can generate will ever satisfy their criterion. Termination requires only that nothing further can be admitted, not that every abstraction eventually is — the definition of Terminal_{Ω,τ} just given makes that distinction exact: no abstraction remains pending (the first, rare case) is a stronger condition than no further C′ being generable at all, and only the second is what Terminal_{Ω,τ} asserts.

9.6. Governing Abstractions and Evolution

Axiom 0 has exactly two operational outcomes: admission, when a realization exists and τ holds over the accumulated context, and preemption otherwise. There is no rejection at this level — rejection would require knowing that the context will never satisfy τ, a claim about the future and outside the scope of a step. Deciding that waiting is futile is itself the work of an abstraction: a governing abstraction sits at a higher eschatological level than the execution it observes. It reads C, and, where preemption is persistent, admits an event that changes the ontology or the criterion. Its output is an admission, not a rejection — there is no rejection anywhere in the system, only admission at some level.

The loop. Persistent preemption is one observable condition to which a governing abstraction may respond: it reads the record, and, where preemption has not cleared, admits a change to an ontology or a criterion — (ω, τ) ↦ (ω′, τ′). This is itself an ordinary application of Axiom 0. Evolution is that admitted change, not the preemption that may have prompted it; a system that never admits such a change does not evolve, whether or not it happens to preempt.

Neither deterministic replay (Section 7.11) nor the control–execution duality (Section 7.8) is offered as a mechanism for evolution — evolution is what the two together permit. Replay makes a system able to establish what it did and under which criterion; the collapse of the control–execution duality makes it able to change that criterion by the same means it uses to act. A system that can determine why it did not proceed, and can admit a change to what is possible, evolves; a system lacking either cannot.

Evolution is not a capability added to execution. It is what remains available once nothing about execution is kept outside it.

Because control and execution are one act, not two (Corollary 5), evolutive branching requires no separate treatment: a governing abstraction’s admitted change to (ωτ, τ) is an ordinary admission, so its contribution to the perfect kernel falls under Theorem 2 exactly as any other source of branching does. Evolutivity is not a distinct mechanism that happens to produce a continuum; it is one recognizable instance of the same branching phenomenon Theorem 2 already characterizes in general — the collapse of control into execution is what makes that inclusion automatic, not what makes the continuum itself possible.

Nor does the governing abstraction’s capacity to act tend toward continuum in particular. Reading the same persistent preemption, it may respond by evolving — admitting a change to ontology or criterion that builds a new context in which execution continues. Such evolution may occur once, finitely many times, or persist indefinitely; evolutivity itself does not imply non-termination. Or it may instead admit nothing further, leaving the system to settle into the terminating regime through a different, non-evolutionary exercise of the same governing capacity. Continuum is one possible outcome connected to persistent evolution specifically, not a consequence forced by governing capacity in general; the broader capacity for control is equally compatible with halt, through simply not evolving. This division has a precedent in management cybernetics: Beer’s Viable System Model separates System 3, regulation within the organization’s present structure, from System 4, which monitors the environment and admits structural change when current operations can no longer cope [48]. System 3 is control that need not evolve anything; System 4 is the specifically evolutionary response this section defines.

Section 10.2 gives the worked instance of this loop: Regime III of quantum service integration is exactly a governing abstraction reading persistent preemption (accumulated measurements not yet unique) and admitting a control event that changes the ontology of the next step, under a criterion that stays fixed — evolutivity in its first concrete form, and the only realization in Section 10 that exercises the countable/continuum dichotomy of Section 8.5 directly rather than merely instantiating the five minimal conditions.

10. Implementation

The preceding sections have established the formal apparatus. This section shows how it is realized; the next shows that it is already at work.

10.1. Minimal Realization Conditions

Five minimal realization conditions, substrate-agnostic: an append-only context C, a candidate-event producer Aτ, an explicit admissibility criterion τ, an ontological specification ωτ, and preemption with re-evaluation on context growth.

Table 3. (minimal realization). 

Calculus construct	Minimal realization
Empty set ∅	Initial state of the persistent knowledge store
Aτ / Execute(Aτ, C)	Stateless service proposing a candidate event; admitted when (Cⁿ, ωτ) ∈ τ, preempted when (Cⁿ, ωτ) ∉ τ
Eschatology τ : E^{<ω} × Ω → {true, false}	API-level fulfillment condition
Ontology ωτ	Ontologically defined API or interface
Preemption	Service re-evaluates τ on each context write
Event e	Contextual record ⟨(id_esh, id_ont, id_inst), payload⟩ (6NF)
Context C	Persistent append-only knowledge store, growing from ∅
Projection π_A	Key-prefix lookup over the composite key; O(log card(C) + card(result)) with a suitable index
Layered architecture L	Set of stateless services sharing one knowledge store, each with τᵢ ⊏ τ_arch

Table 3. (minimal realization). 

Calculus construct	Minimal realization
Empty set ∅	Initial state of the persistent knowledge store
Aτ / Execute(Aτ, C)	Stateless service proposing a candidate event; admitted when (Cⁿ, ωτ) ∈ τ, preempted when (Cⁿ, ωτ) ∉ τ
Eschatology τ : E^{<ω} × Ω → {true, false}	API-level fulfillment condition
Ontology ωτ	Ontologically defined API or interface
Preemption	Service re-evaluates τ on each context write
Event e	Contextual record ⟨(id_esh, id_ont, id_inst), payload⟩ (6NF)
Context C	Persistent append-only knowledge store, growing from ∅
Projection π_A	Key-prefix lookup over the composite key; O(log card(C) + card(result)) with a suitable index
Layered architecture L	Set of stateless services sharing one knowledge store, each with τᵢ ⊏ τ_arch

The realization is a formal equivalence, not an analogy: any substrate satisfying these conditions realizes Axiom 0 as stated in Section 5.5. Interaction among abstractions sharing one append-only context requires no external orchestrator: the shared C is the only coordination medium, and the preemption–resume cycle is the operational realization of Section 7.6.

This is not a proposal for a new programming language, runtime, or architecture. Section 7.10 proves Axiom 0 infrastructure- and methodology-agnostic: any process whose execution can be represented as admitted events over an accumulating context can be realized this way, and nothing in the record, the criterion, or the ontology depends on a particular language. What it is, concretely, is a methodological discipline — writing the criterion explicitly and evaluating it over the accumulated record, rather than leaving it implicit or external. Most directly, it is realizable today in any stack that already supports stateless microservices and a key-value store, per Table 3 above: the discipline required of the engineer is architectural, not a new tool to adopt. Axiom 0 is, in this sense, closer to a recipe than a new kitchen: it specifies how ingredients already in wide use — an ontology, a criterion, a record — combine, not a new ingredient to acquire.

10.2. Quantum Services

A quantum service is usually integrated as a source of samples: the circuit runs, the outcome is taken, and the loop deciding when to stop runs in a classical controller outside the model. The criterion exists — variational loops refine parameters until a measured quantity converges, repeat-until-success circuits re-run until a condition holds, shot counts rise until a confidence threshold is met — but it resides outside what it governs. This is the separation of Section 1.1, in a third domain.

Under admission the criterion is τ, in three regimes strictly ordered by how much of the resolution the record contains. Regime I — external resolution: the service returns an already-resolved outcome and the substrate records it. Regime II — resolution over measurement history: each measurement is admitted as an event and a second abstraction evaluates admissibility over the accumulated measurements; measurement events are context-forming, not closure-forming. Regime III — active convergence control: a governing abstraction reads C, determines that the accumulated measurements do not yet determine a unique outcome, and admits a control event; the external process responds, further measurements are admitted, and τ is re-evaluated.

In Regime II the abstraction waits; in Regime III something acts on the reason for waiting. The difference is whether the record is only read or also used to intervene.

The admission condition. Let R*(n) be the candidates consistent with the accumulated context at step n. Then τ holds at n iff |R*(n)| = 1 — the condition of Section 6.6 in a particular case: uniqueness is what makes the selector definable.

Error tolerance. A semantic distance Δ and a tolerance ε ≥ 0 partition R*(n) into ε-clusters, and the condition becomes |Π_ε(R*(n))| = 1. ε is derived from the device error model before execution and is admitted with the abstraction, not tuned afterwards; at ε = 0 the strict condition is recovered.

Regime III is an evolutive system, in the pattern of Section 9.6: persistent preemption is read by a governing abstraction, which admits an event that changes the ontology of the next step under a criterion that stays fixed — evolutivity in its first form. A variational loop that converges and halts is in the terminating regime (Section 8.5); one that keeps re-specifying what it may attempt, generating genuine alternatives rather than merely continuing, is evolutive (the splitting regime).

The calculus does not reduce sampling or hardware noise, and makes no claim about the interpretation of measurement. It governs the loop that responds to noise. What becomes reproducible is the refinement, not the outcome (Section 7.11).

10.3. System Purpose, Requirements, and Ethics

Definition 7 (Unified System Purpose). τΣ : E^{<ω} × Ω → {true, false} is the conjunction of all admissibility conditions governing event admission into C: τΣ = τ_F ∧ τ_N ∧ τ_E, where τ_F is the functional requirement, τ_N the non-functional invariant, τ_E the ethical criterion. An event is admitted iff (Cⁿ, ωτ) ∈ τΣ.

τ_F validates the forward transition — that the candidate event is a valid structural increment toward the system’s governing completion condition — and conditions context generation. τ_N and τ_E restrict rather than generate context: they eliminate candidate events that violate performance, safety, compliance, or ethical constraints. τ_E acts as a topological eliminator: any candidate for which (Cⁿ, ωτ_E) ∉ τ_E is preempted before entering C. The violating event never enters the execution context, and no state or causal record of it is produced.

Formal equality of requirement types. τ_F, τ_N, and τ_E have identical formal status: each is a total Boolean function E^{<ω} × Ω → {true, false}, each is evaluated at the same admission boundary, each is governed by the same Axiom 0 rule. No additional postulate is required to incorporate non-functional or ethical criteria — they are components of τΣ by definition. A candidate violating τ_E is preempted by Axiom 0: it never enters C, and no causal record of its having been considered is produced. This is a structural consequence of the admission structure, not an engineering choice or a policy decision.

Specifying τ_E accordingly requires no special ethical methodology or framework: exactly as with τ_F and τ_N, what is required is a clear predicate — a statement of what is and is not admissible — evaluable in finite time over the accumulated context. Writing that predicate well is a domain problem for whoever specifies it, not a further requirement Axiom 0 imposes.

10.4. Exception Handling and Compensation

Preemption itself writes nothing: a failed evaluation produces no event and changes no context (Section 5.4), so a compensation abstraction cannot react to the failure directly — there is, by construction, no new fact for it to read. What triggers compensation is something else, already admitted. One route: a governing abstraction monitors the record and admits a compensation event once it reads a pattern consistent with the original candidate never having been satisfied — a timeout, a retry counter, an absent expected event. The other route: the failure condition is itself made explicit as an admitted signal, from a distinct abstraction whose own criterion is exactly “the original candidate’s context window has closed without admission.” Either way, the compensation abstraction reads this like any other event in C. Compensation is an ordinary abstraction with its own eschatological condition τ_comp, evaluated over C and admitted through Axiom 0 like any other: A_comp: τ_comp(C) = true ⇒ C′ = C ⁀ ⟨e_comp⟩ (same context). What compensation never does is fire directly off an unwritten false — there is nothing there for it, or anything else, to consult.

Exception handling is not a special mechanism outside the calculus — it is an ordinary abstraction with its own eschatological condition, evaluated over the accumulated record like any other. Compensation inherits the full context C and adds to it. The calculus is closed under exception: every execution path, including error paths, remains within the same deterministic context growing from ∅.

11. Validation of the Proposed Model

The calculus identified in this paper did not originate as a purely formal construction. It emerged from the analysis of engineering practice — from Tocher’s three-phase kernel [17], which had operationally realized the three-phase admission structure since 1963, and from ZTES [10], which arrived at the five-component OEE structure by a different route — combining prior formalisms rather than deriving it from rank, as this paper does — while formalizing that kernel’s correctness. The formal calculus is the semantic discipline that names what engineering had already discovered. The three subsections below establish that the five structural conditions stated in Section 10.1 and derivable from Axiom 0 alone are simultaneously realizable, through three evidentially distinct kinds of support that should not be conflated with one another: practical (Section 11.1), methodological and infrastructural (Section 11.2), and historical (Section 11.3).

This is a theoretical, formal contribution in the form customary in this literature: the results of Section 3, Section 4, Section 5, Section 6, Section 7, Section 8 and Section 9 stand on their own proofs, in the same way as the formalisms compared against them in Section 12. What follows is offered in addition, not in place of that standard: three complementary and evidentially distinct forms of validation not typically found alongside a contribution of this kind — correspondence with existing engineering practice (Section 11.1), convergence with an independent, prior formal result (Section 11.2), and precedent in a centuries-old institutional practice (Section 11.3).

11.1. Validation in Practice

The practical case is deliberately two-pronged. Longevity: Tocher’s kernel (1963) and the High Level Architecture (IEEE 1516, mandated across US DoD simulation from 1996) together give thirty to sixty years of continuous production use in some of the most demanding distributed systems built — an IEEE standard among them — and neither has, in that time, been given a formal account of why it works. Breadth: contemporary architectures with no direct lineage to either — event sourcing, CQRS, the Kappa architecture, and blockchain — independently converge on the same append-only substrate today, showing the gap this paper names is not a historical curiosity later formalisms resolved, but a live one recurring wherever the same problem is faced again. Together, the two answer the objection a formal contribution in this area should expect: not whether this has been tried, but why something so widely and successfully tried has never been proven correct.

Longevity: Tocher’s kernel and GPSS. GPSS [41], [17] constitutes a discrete-event realization of the execution calculus that predates its formalization, and the correspondence is precise rather than analogical: its re-scan on every commit is a working instance of the re-evaluation mechanism formalized in Section 7.6 — a candidate becomes admissible not because it changed, but because the Future Events List, the same role C plays throughout this paper, did. The Future Events List is C; events whose condition is not yet satisfied are held in the Current Events List, the operational realization of the preempted set rather than a separate structure. Tocher’s three-phase algorithm (scan, identify, execute) is the admission mechanism itself, evaluating over the Future and Current Events Lists whether a candidate is admissible now; each event type’s handler, invoked only once its condition is satisfied, is the operational realization of ωτ, the ontological mapping that fires on collapse, not before. Schriber’s account [41] records the architecture and Tocher’s own book [17] the algorithm — an early documented software-engineering realization of the same operational pattern, resolving admission without naming τ as such. The correspondence developed here is structural: Tocher’s mechanism repeatedly re-evaluates eligibility after the execution record changes, which is the operational feature the present calculus isolates and formalizes. A later survey by Schriber and coauthors documents closely related Current-Events-List/Future-Events-List mechanisms across AutoMod, SLX, ExtendSim, Simio, Arena (SIMAN), and ProModel [51] — AutoMod names its version the Current Event List (CEL) directly. The recurrence of the mechanism across these major commercial discrete-event simulation packages shows that the pattern is not isolated to GPSS. The present paper does not treat those implementations as formally verified instances of Axiom 0; they are evidence of a recurring operational structure. DEVS, a discrete-event formalism rather than a simulator, contains no three-phase admission mechanism of its own: δ_ext performs the work of an admission criterion (Section 12.1) without the scan–identify–execute structure that would make it explicit, and without it being named one.

Longevity: the High Level Architecture. The High Level Architecture (HLA), developed for U.S. Department of Defense distributed simulation in the 1990s, approved as the standard technical architecture for U.S. DoD simulations in 1996, and later standardized in the IEEE 1516 family [49], [56], is a second engineering-facing instance. It also demonstrates what is lost when the record is not preserved. HLA inherits part of the architecture just traced — a federate’s advancement is gated by an admissibility condition over accumulated messages — but does not inherit the undivided record that made Tocher’s original mechanism sufficient on its own. HLA’s time management services allow federates to locally employ either conservative or optimistic mechanisms [58]. The conservative discipline is Axiom 0 in another vocabulary: a federate does not advance until the Run-Time Infrastructure can guarantee that no message with a smaller time stamp will later arrive — an admissibility condition evaluated over what has accumulated, checked before the step is permitted. A federate using the optimistic discipline instead processes events aggressively and rolls back when an event arrives in its past — rollback is the annulment of an admission, precisely what an append-only record forbids. The conservative discipline is reproducible in exactly the sense of Section 7.11; the optimistic discipline, having discarded what it revokes, is not. The standard permits both, and therefore permits both a system that preserves its record and one that revokes it — different objects, not two configurations of one. The deeper cost is structural: partitioning a single ordered sequence across federates loses the shared epistemic axis, and consensus mechanisms are then required to recover an ordering that partitioning destroyed — the pattern of Section 2.3 in its most consequential instance, the criterion external to what it governs.

Breadth: contemporary architectures. Event-driven architectures [22] — Kafka [21], [59], event sourcing [19], CQRS [20], [23], and the Kappa architecture [24] — each independently converge on durable, ordered event- or log-oriented substrates, valued in practice for exactly the reproducibility Section 7.11 makes precise, and realizing C without formally naming it. What none formalizes is the eschatological criterion τ(C, ωτ): the decision to append is governed by application logic external to the architecture’s formal model, and introducing an explicit τ at the admission boundary requires no architectural change — only the formal naming of a selection criterion that already governs every event write. Microservice architectures that distribute data across isolated contexts violate Section 6.4 (Non-Regenerability) and sever the causal thread that inter-service admissibility evaluation needs.

A worked instance. [35] develops this concretely in agentic AI: an agent instructed to execute TransferFunds(amount=50000, recipient). A single admitted event takes the form e = ⟨(id_esh:1, id_ont:TRANSFER, id_inst:agent-03:txn-a7f2), {amount:5000, recipient:...}⟩, with admission governed by τ = τ_user_intent ∧ τ_authorization ∧ τ_regulatory ∧ τ_balance, each evaluated over the full accumulated Cⁿ, not a fixed projection of it. The payoff is concrete: if an adversary splits a $50,000 transfer into ten $5,000 sub-transfers, each below a fixed threshold, a verifier examining only the current payload admits every one — the fragmentation is invisible to it. Evaluated over the full Cⁿ, τ_user_intent sees all ten transfers sharing the same id_esh and evaluates false: the aggregate, not the individual step, is what the criterion checks. This is Section 3.5’s shared-key construction made concrete — the ten sub-transfers are ten binary relations sharing one context, and the sharing itself is what recovers what ten independently-verified fragments cannot see. [35] catalogues four documented incidents in this pattern — Knight Capital, Boeing 737 MAX, the Ethereum DAO exploit, Equifax — each instantiating a different dimension of the same structural gap; this example develops one of them concretely.

Blockchain. A distributed ledger is a further, rapidly expanding instance of the same pattern: an append-only, causally ordered record functions as C, and a consensus mechanism admits each candidate block against it — an ontological/eschatological pair in outline, unnamed as such. What is missing is a criterion evaluated constitutively over the full causal history at the point a smart contract executes, not only at block admission: [35] identifies this gap explicitly, proposing evolutive consensus — τ evaluated constitutively over C, extended to machine-to-machine smart-contract execution as an open problem — as the missing piece, and the smart-contract vulnerabilities behind incidents such as the DAO exploit noted above [26] are, on this reading, instances of exactly the anomaly Section 1.1 opens with. Blockchain’s expanding adoption argues for closing this gap without exception, not around it.

The absence of the three-phase kernel from broader software engineering practice, in sum, is not a failure of the mechanism but a failure of formalization: without an explicit τ, it could not transfer from simulation to layered architectures, to governance and ethics. The calculus is substrate-agnostic in exactly the sense this section has shown by example: every system represented under the execution conditions of Section 7.10 can be expressed in the form Σ = ({Rᵢ}, C) under Axiom 0 — simulation model, microservice, ML pipeline, embedded controller, ledger, or distributed protocol.

The systems surveyed in this section demonstrate reproducibility specifically, each independently and before the fact; none of them separately admits a governing act that revises its own criterion, so none is direct evidence for the collapse of control into execution. That result is grounded practically elsewhere: most directly in ZTES’s own, independently stated equivalence of governance and operational execution (Section 11.2), and further in the evolutive regime of quantum service integration (Section 10.2) and the guardrail-incompleteness result of [35].

11.2. Methodological and Infrastructural Validation

ZTES is the most complete prior realization of the present execution principle, and, unlike the practices in Section 11.1, is itself a formal, independently proved result rather than an unformalized engineering practice. Two of ZTES’s own three stated contributions are, in its own vocabulary, the two results this paper names in Section 1.1: deterministic reproducibility of execution (Corollary 6), and what ZTES calls the equivalence of governance and operational execution — the collapse of control into execution this paper states as Corollary 5, proved independently and specifically for this architecture. Reproducibility is proved as ZTES Theorem 1 (Deterministic Event Serialization): the three-phase kernel deterministically maps concurrent transition intents into a unique causally ordered sequence of committed events. The present calculus identifies the formal reason common to both results: ZTES correctly implements eschatological induction — no event enters C without satisfying τ. Tocher found the algorithm; ZTES proved both properties hold of it; the calculus identifies the principle of which all three are realizations. ZTES’s K (historical knowledge base), carrying eschatological and sequential coordinates, is the execution context C. The present calculus supplies what ZTES’s own formalism left an axiom rather than a consequence: the reason admissibility must take exactly this form.

11.3. Historical Validation

The medieval Obligationes protocol, practiced in European university disputation from the early thirteenth into the sixteenth century, exhibits the same three-part structure discussed throughout this section — a governed admission criterion, an accumulating record, a terminal condition — centuries before either the engineering or the mathematical instances above. Section 1.4 already introduces this correspondence as functional, not formal: the practice is offered as one of the earliest well-documented historical instances of the same functional pattern, not as a prior formalization of Axiom 0, whose relation to it is left to separate work. What Section 11.1 and Section 11.2 show for three to six decades of unformalized or independently-formalized practice, disputatio suggests for centuries longer, in a domain with no computational substrate at all — the same structural need recurring wherever admission must be governed, independent of what admits.

12. Related Work in Depth

12.1. Full Historical Comparison

The problems of execution did not arise at once, and none of the formalisms below failed at what it set out to do. Several solved a real part of the problem; they stopped in the same place, for the same reason (Table 4 below; Section 2.2 gives the condensed statement).

Tarski. Satisfaction is defined relative to a sequence: Sat(φ, s) is a two-valued predicate evaluated against an assignment sequence [11]. The sequence there is given and static rather than accumulated through execution. Tarski’s undefinability theorem shows that, for sufficiently expressive formalized languages, an adequate truth predicate cannot in general be defined within that same language. In OEE terms this provides a structural analogy with level separation, not a restatement of the ZF rank argument of Section 3. Tarski’s fixed-point theorem [13] guarantees fixed-point existence for monotone operators on a complete lattice; non-monotone operators may also have fixed points, but that theorem does not supply them. Tarski and Givant later showed that set theory can be developed in a variable-free equational formalism closely related to relation algebra, built from identity and membership relations [14].

Codd. Data independence, and the relation as the data model. The relation carries no criterion of admission, and arity is treated as primitive rather than as presentation (Section 3.5).

Mesarović. A system is a relation on sets and a subsystem is a projection of it — the notion this paper borrows (Section 7.9) — and process is a derived rather than a basic element. It is set in state space, where a transition replaces; the chronological sequence is recognized as a need but never defined as a read-only, append-only structure. Of prior formal frameworks, Mesarović’s Abstract Systems Theory comes closest to the present calculus: it defines systems through binary relations, introduces goal-seeking through purposive internal relations, and formalizes multilevel purpose hierarchies. Two constitutive elements are absent: the growing epistemic sequence C as a formal object, and a formal admissibility mechanism that names nondeterminism and resolves it at each step. Without these, AST is a rigorous ontology for what a system is — but not a formally specifiable execution model. The present calculus adds exactly two concepts to Mesarović’s ontology: C as a formal object, and (Cⁿ, ωτ) ∈ τ as the admission rule.

Zeigler (DEVS). DEVS supplies discrete-event semantics through explicit input, output, and state-transition functions. In OEE terms, δ_ext performs admission-like work when external input is incorporated into a transition, but DEVS does not separate that role into a constitutive criterion evaluated over an append-only execution context. The comparison is therefore functional, not an attribution of τ to DEVS.

Tocher. The three-phase kernel, in which conditions are re-tested each cycle — the operational signature of non-monotone admissibility, half a century before it was named (Section 9.2).

Milner [18], Hoare [39]. Process calculi make compositional concurrency and interaction first-class. Their choice operators formalize alternative continuations, but do not themselves carry the append-only accumulated record over which the present calculus evaluates an admission criterion. In OEE terms, they formalize alternatives and interaction without supplying the particular history-conditioned admission structure defined here.

Petri [37]; Dijkstra [38]; Lamport [40]. Petri nets make concurrency, enabling, and conflict explicit, but a bare net supplies no constitutive criterion for selecting among simultaneously enabled conflicting transitions; the resulting firing choice is nondeterministic unless an additional policy resolves it. Dijkstra’s guarded commands likewise make nondeterminism explicit: when several guards are executable, the formalism intentionally leaves which one is selected unspecified. Lamport supplies a causal ordering of distributed events without requiring a physical global clock. In OEE terms, these contributions respectively expose conflict, nondeterministic alternatives, and causal order; none by itself supplies the history-conditioned admission criterion defined here.

Event sourcing and CQRS. The record as the source of truth; nothing certifies what was permitted to enter it.

ZTES. Semantic closure demonstrated in one configuration (Section 11.2): append-only record, criterion inside the component, admission governed. Admissibility is posited there as an axiom and its origin left open; this paper supplies it.

Table 4. (full — what each contribution solved, and where it stopped). 

Contribution	What it solved	Where it stopped
Tarski, concept of truth [11]	A truth predicate for a language cannot live in that language	Never applied to execution
Tarski, calculus of relations [12]; Tarski & Givant [14]	Closure of composition on one carrier, which forces the square; variable-free equational formalization using identity and membership relations	No criterion, no record
Tarski, fixed-point theorem [13]	Existence of a fixed point for monotone operators, in ZF	The existence theorem requires monotonicity (Section 9.4)
Codd [15]	Data independence; the relation as the data model	The relation carries no criterion; arity taken as primitive (Section 3.5)
Mesarović, with Takahara [8], [9]	System as a relation; subsystem as a projection; process as derived, not basic	State space — the transition replaces; no append-only record
Tocher [17]	Three-phase kernel: conditions re-tested every cycle	No formal criterion; simulation-specific
Zeigler (DEVS) [16]	Discrete-event semantics: input, output, state transition	δ_ext performs admission-like work within the transition formalism; no separately named admission criterion over an append-only context
Milner (π, CCS) [18]; Hoare (CSP) [39]	Compositional concurrency; interaction and alternative continuation made first-class	No append-only accumulated context governing choice through an explicit admission criterion
Petri [37]; Dijkstra [38]; Lamport [40]	Concurrency and conflict; explicit nondeterminism; causal order without a physical global clock	No constitutive history-conditioned admission criterion: conflict remains nondeterministic without added policy; guarded-command selection is unspecified; causal order alone does not decide admission
Event sourcing [19]; CQRS [20]	The record as the source of truth	Nothing certifies what was permitted to enter it
ZTES [10]	Semantic closure in one configuration: append-only record, criterion inside the component	Admissibility posited as an axiom; its origin left open

Table 4. (full — what each contribution solved, and where it stopped). 

Contribution	What it solved	Where it stopped
Tarski, concept of truth [11]	A truth predicate for a language cannot live in that language	Never applied to execution
Tarski, calculus of relations [12]; Tarski & Givant [14]	Closure of composition on one carrier, which forces the square; variable-free equational formalization using identity and membership relations	No criterion, no record
Tarski, fixed-point theorem [13]	Existence of a fixed point for monotone operators, in ZF	The existence theorem requires monotonicity (Section 9.4)
Codd [15]	Data independence; the relation as the data model	The relation carries no criterion; arity taken as primitive (Section 3.5)
Mesarović, with Takahara [8], [9]	System as a relation; subsystem as a projection; process as derived, not basic	State space — the transition replaces; no append-only record
Tocher [17]	Three-phase kernel: conditions re-tested every cycle	No formal criterion; simulation-specific
Zeigler (DEVS) [16]	Discrete-event semantics: input, output, state transition	δ_ext performs admission-like work within the transition formalism; no separately named admission criterion over an append-only context
Milner (π, CCS) [18]; Hoare (CSP) [39]	Compositional concurrency; interaction and alternative continuation made first-class	No append-only accumulated context governing choice through an explicit admission criterion
Petri [37]; Dijkstra [38]; Lamport [40]	Concurrency and conflict; explicit nondeterminism; causal order without a physical global clock	No constitutive history-conditioned admission criterion: conflict remains nondeterministic without added policy; guarded-command selection is unspecified; causal order alone does not decide admission
Event sourcing [19]; CQRS [20]	The record as the source of truth	Nothing certifies what was permitted to enter it
ZTES [10]	Semantic closure in one configuration: append-only record, criterion inside the component	Admissibility posited as an axiom; its origin left open

The list is not a catalogue of deficiencies. Each entry solved a real problem and none failed at what it set out to do. What they share is where they stopped; Section 2.2 gives the condensed statement of the same ceiling.

The common ceiling, in full. The calculus begins from the abstraction, of which the set element, the binary relation, the process, the state, and the record alone are each projections (Section 6.3). The DEVS entry above already located this boundary in general terms. Concretely, an atomic model (X, Y, S, δ_int, δ_ext, λ, ta) has no eschatological criterion of its own: δ_ext simply maps the input axis, the output axis of another system, into its own states, with nothing in the tuple recording under what condition that mapping is admitted.

12.2. Five Formalizations, One Missing Synthesis

Five prior programmes each identified one structural component of the present calculus without their combination — and none had software execution as its primary intent. None of the five is cited as support for this paper’s own central claim, which is established independently by the ranked decomposition and its projection analysis (Section 3.4, Section 6.3, Section 6.4 and Section 6.5): a general non-functional binary relation, considered only as a set of pairs, does not by itself determine which among several available successors is admitted, under what criterion, or against which accumulated history, whatever that relation’s origin. Each formalism below is discussed because its own limitation illustrates that same gap from a different historical angle, not because this paper’s argument rests on any of them. Set out this way, the calculus’s contribution is not “a new formalism among these” but the specific combination none of the five attempted.

Tarski [12], [13], [14]. Tarski and Givant show that set theory and number theory can be developed in a variable-free equational formalism closely related to relation algebra, constructed from atomic identity and membership relations [14]. Tarski’s fixed-point theorem [13] shows that every monotone map on a complete lattice has a least fixed point. The analogy with admission is structural, not an identification: in the present calculus, an appropriately defined monotone operator may describe the growth of the admitted set (Theorem 3 gives one directly), and its fixed point is a stable set under that operator — it is not identified with an individual event, nor with the first successful evaluation of τ.

Leibniz [4], [5]. Read in OEE terms, the principle of sufficient reason provides an early philosophical precursor of an explicit admission condition. The correspondence is interpretive, not an attribution of τ or of the present execution structure to Leibniz.

Turing [34]. In the 1939 ordinal-logic paper, Turing introduces an oracle machine in which certain decisions are referred to an oracle that is not itself a machine. Read against the present calculus, the oracle marks an external decision boundary: the ordinary machine sequence does not itself contain what resolves that decision. The comparison is structural rather than historical attribution. Turing does not formulate Axiom 0, τ, or an OEE decomposition; his construction supplies a precise earlier example of a decision source placed outside the machine whose execution it affects.

Mesarović, with Takahara [8], [9]. The nearest prior formalism in structural terms (Section 12.1): purposive abstraction, ontological mapping, multilevel goal structure, events as admitted outcomes — all present, all rigorous. What is missing is not a gap but a scope decision: Mesarović’s theory is complete as a model of abstraction precisely because it deliberately excludes execution. ZTES [10] exists because someone had to build the execution machine Mesarović’s model made possible but did not attempt.

Cohen [36], [45]. Cohen’s forcing method supplied the complementary independence direction to Gödel’s constructibility result: [36] gives a model in which the Continuum Hypothesis fails, while the symmetric-model construction presented in [45] gives a model of ZF in which the Axiom of Choice fails. Gödel’s earlier constructibility result [46] established the complementary relative-consistency direction for AC and GCH. Taken together, these results locate AC as independent of ZF, assuming ZF itself is consistent. The structural comparison relevant here is narrower: a condition may be supplied at the level of a model without being recoverable from the lower-level objects it governs — in this paper’s terms, τ ⊥ C, established rather than assumed. The present calculus applies that separation to execution rather than to set-theoretic independence.

No one of the five is a partial version of this calculus — each is a complete answer to a different question that happens to share one structural piece with the present one. The synthesis is what none of them needed for their own purposes.

None of the five secures either result named in Section 1.1. Reproducibility requires a record kept and consulted at every step: Tarski’s fixed point, once reached, is a point in a lattice, not a record replayed; Leibniz’s condition sits inside the substance, with nothing external to it that a later step could consult; Cohen’s forcing is a fact about models, not a record any execution produces or revisits. The collapse of control into execution requires an execution for control to collapse into: Turing’s oracle marks a boundary at which an executing machine delegates a decision to a non-machine oracle; that external decision source is not incorporated as an admitted object in an accumulated execution record, and Mesarović’s abstraction, having deliberately excluded execution, has no record for a governing act to be admitted into either. Both results are properties of the specific composition Axiom 0 states, not incremental refinements available to any of the five by adding a missing piece.

12.3. Algebra and Execution

Algebra is discrete throughout, so a methodologically agnostic substrate executes algebraic specification without remainder; its models need not be discrete. The substantive gap is elsewhere. Equational algebra abstracts order: associativity states that grouping does not matter, commutativity that order does not matter, Church–Rosser that the reduction path does not matter. Execution is precisely where order does matter (Section 9.3).

Equational and process formalisms can represent ordering, alternative continuation, concurrency, and even structural reconfiguration in different ways. Those capabilities should not be confused with the execution structure studied here. The comparison relevant to OEE is narrower: none of the formalisms surveyed in this section combines an append-only accumulated context with a separately specified admission criterion that is evaluated over that context and can itself be revised through admission into the same record.

The Church–Rosser property of the λ-calculus [57], for example, concerns confluence of reduction and therefore a different question from the order-sensitive admission considered in Section 9.3. The π-calculus [18] makes interaction and structural mobility first-class — the closest prior model to a recursively generated abstraction (Section 4.3) — but does not thereby introduce the particular history-conditioned admission object defined here: the condition under which a channel or reconfiguration is admissible remains external to the calculus, exactly the gap Section 1.1 opens with. Likewise, Tarski and Givant’s relational results demonstrate the breadth of relational formalization; they do not by themselves supply an append-only execution record or an admission semantics over it.

The distinction is therefore not between mathematics and execution, but between relational or algebraic expressiveness and the additional structure required for the execution semantics defined in this paper.

12.4. Proof About Executions, Proof in Execution

Observation (per-step admissibility lifts to branches). By the definition of T in Section 8.1, every successor on every branch belongs to Succ of its preceding prefix, and therefore satisfies the corresponding admission criterion. If τ(e, σ) = 1 for every admitted e, then every p ∈ [T] satisfies τ at every step, and hence the family [T] satisfies it.

A proof over the family cannot say which execution occurred; a proof at each step, retained with the coordinates, can. This is the difference between soundness and soundness with attribution — and governance requires the second.

The implication runs one way: per-step admissibility yields the family property, but the family property does not yield the step. This is why the admissibility tree (Section 8) is the central object: it carries a per-step property up to a property of all executions.

13. Discussion

Axiom 0 is not new in the sense of being the first instance of governed admission: Section 1.4 and Section 11 catalogue instances from medieval disputation to six decades of simulation engineering, none of which named the criterion as such. To our knowledge, this is the first formal statement, within the literature surveyed in Section 12, of the specific combination defined here as Axiom 0: an append-only execution context, an independently specified ontology, and an explicit admission criterion assembled into one executable abstraction. The novelty claim concerns this combination and its derived results, not governed admission as a historical practice. Read together, the rest of this paper carries consequences no single section develops on its own. Six decades of simulation practice that produced correct results (Section 11.1) now have a formal account of why. A further application, from the same research program, derives a provable safety bound for agentic AI systems from the same decomposition ([35]) — one field where existing verification formalisms have not resolved the central problem, and a new decomposition is worth testing against it. The scope established in Section 7.10 is representation-based: it extends to any process whose execution can be represented as admitted events over an accumulating context, independent of the domain from which that process is drawn. And the rank apparatus of Section 3, carried one step further in Appendix B, locates the abstraction itself in the rank hierarchy and shows separately where the classical choice problem reappears after projection: it is a fact about what Axiom 0 constructs and invokes, not a preference stated twice.

Of the paper’s own two results (Section 7.8, Section 7.11), neither is unconditional, and stating the condition each depends on belongs here rather than left implicit. Reproducibility holds exactly as far as the record extends: an environmental abstraction’s own sample need not repeat (Section 7.11), and a substrate that fails to preserve C, as HLA’s optimistic discipline may (Section 11.1), forfeits it by construction, not by exception. The collapse of control into execution holds wherever a governing abstraction is itself admitted into the record it governs; a system that lets control act on the record from outside — the pattern Section 1.1 opens with — has not adopted a weaker version of this result but a different architecture, one the calculus describes from outside rather than from within.

13.1. A Possible Foundational Interpretation

What follows is offered as a suggestive analogy, not a derivation: no claim is made that the ZF axioms are proved, individually or collectively, from the calculus, nor that the generated fragment is formally bi-interpretable with any specific theory. The resemblance is worth noting because of how far it goes, not because it has been established.

Extensionality is near-definitional: a set is its record of admissions. Pairing resembles two steps of the sequence. Union resembles the merging of records, though concatenating two sequences is not, without further argument, an instance of the Union axiom’s guarantee for an arbitrary family of sets. Separation resembles what τ does locally: τ is one fixed criterion per abstraction, restricting admission to what it selects, not the full schema ranging over every formula. Regularity is suggested rather than derived: an append-only record of the kind this calculus generates cannot itself form a cycle, addresses pointing only backward — a fact about this structure, not a proof of Foundation for arbitrary sets. Selection over the generated, coordinated record is definable in ZF. Gödel’s constructible universe [46] provides a classical comparison in which a definable well-order supports choice, but no appeal to L or to a general form of the Axiom of Choice is required here.

Powerset and Replacement do not follow, and the obstruction is cardinality. A sequence indexed by ℕ yields a countable universe; $𝒫$(ω) is not countable. Powerset and Replacement are not derived by the present construction: no claim is made that the generated fragment provides the arbitrary subsets or transfinite image sets those schemas require. This is where the iterative conception of set also stops. Tarski’s 1924 theorem [28] — that |A×A| = |A| for every infinite A is equivalent to the Axiom of Choice — is not assumed: its universal quantifier is what gives it the strength of AC, and the calculus needs no such generality. Abian’s fixed-point theorem [31] is the same family in a different guise: a general fixed-point guarantee, equivalent to AC on the same terms Tarski’s cardinality theorem is. Theorem 3’s well-founded descent is this paper’s own avoidance of exactly that family, for the fixed-point case specifically — convergence follows from a measure supplied with the abstraction, not from an AC-strength existence guarantee. The carrier generated by the execution sequence, one element per step, is therefore countable and definably well-ordered, and for such a carrier the equality holds in plain ZF by explicit pairing [29]. The conclusion is reached without the hypothesis. Appendix B.4 and Appendix B.5 give the structural reason behind this local argument: Execute never touches the projected, coordinate-free representation in which such a choice family would arise, so the hypothesis is not merely satisfied trivially here — it is never called for.

The division is not a deficit but a signature: what describes construction is derived; what postulates a completed totality is not. Execution never holds a completed totality.

Two limits stated plainly. The generated carrier is rich enough to define the naturals and iterate a successor operation — the arithmetization Gödel’s theorem needs. If the generated fragment is formalized as a consistent, effectively axiomatized theory capable of representing a sufficient fragment of arithmetic, Gödel’s incompleteness theorem [27] applies to it as to any such theory; no exemption is claimed, and no formal bi-interpretability with Peano arithmetic is asserted, only that the same obstruction governs both, once that condition is met. And the results of Section 3 and Section 4 are proved in ZF, about the calculus — the calculus itself never holds [T], only finite prefixes.

13.2. Where Convergence Is Not Guaranteed

Theorem 3 does not cover the oscillatory case. Where no measure can be supplied, non-convergence is real — but detected: exhaustion carries a coordinate and a level.

13.3. Open

Perfect-subtree recognition. The existence of a nonempty perfect pruned subtree is a property a system either has or lacks, not a theorem, and it should not be proved in general: were it universal, every system would have a continuum of executions, including one that merely computes and halts. What remains open is a usable criterion for recognising it from the local admission rules.

Order of admission. Under monotone but non-confluent local admission, order may affect which reachable stable record is realized; under a non-monotone criterion, order may also affect whether a terminal record is reachable at all. Section 9.3’s non-commutativity result is the formal expression of this open problem.

Infinite-dimensional reduction. Whether the limit of an unbounded dimensional reduction admits a useful characterisation — as a limit, never as an object held at any step — is not settled here.

Each of these is a question the calculus makes it possible to ask precisely; none is answered by it.

14. Conclusions

Execution inherited its vocabulary from set theory, and inherited the abstraction with it: a set element with no origin, a relation with no history. For mathematics that is a virtue. For execution it is a loss, and the loss has a name — where the coordinates and admission criterion are discarded, the relational reduct may retain several possible successors without defining which is admitted; over an arbitrary family of nonempty fibers, the existence of a global selector is precisely the role played by the Axiom of Choice.

The calculus retains them. An event is admitted only as a composite key and a payload; the record is append-only; the criterion is evaluated over what has accumulated before every admission. From that rule, together with the explicit structural, effectiveness, finite-branching, and convergence assumptions stated in the relevant sections, the results below follow. Admission requires no choice selector: each ωτ is single-valued where defined and τ is Boolean, so Execute never selects among the members of an arbitrary family of nonempty sets (Section 1.2(iii), Section 6.5). Separately, the constitutive execution objects C, ωτ, and τ are rank-separated and, being independently specified rather than computed from one another’s content, mutually non-derivable (Section 3; Appendix A). Appendix B carries the rank analysis to the abstraction itself and shows where the classical choice problem reappears only after projection. The sequential dependency has the structural form associated with dependent choice, but no instance of Dependent Choice is assumed: where continuation exists, the next admitted event is defined, for the fixed invocation, by the recorded context and the specified procedures. Admission is decided from a finite prefix, and at each finite step only finitely many active invocation instances contribute candidates, each contributing at most one realization, so the admissible executions form a finitely branching tree whose body is closed, compact and Borel: the execution space is measurable. That measurability follows from finite branching, prefix-local admission, and the carrier’s explicit encoding (Section 8) — determinism’s role is to keep the construction choice-free, not to supply measurability by itself. And convergence turns out to require well-foundedness rather than monotonicity, as formalized by Theorem 3.

The two results named at the outset (Section 1.1), formalized as Corollaries 5 and 6, are what make this possible. Execution is reproducible: verification replay is deterministic from the recorded execution, because the preceding prefix fixes the admission context and applicable specifications, while the recorded event preserves the realization whose admission is being verified. And control and execution collapse into one act: control is not a layer over execution but the condition under which execution is admissible — structurally aligned with the Good Regulator principle rather than satisfying it by an added mechanism — so governance and execution cannot diverge. The capacity to evolve is what the two together permit. Three difficulties named there are addressed directly by this pairing, not as an afterthought: (1) the unaccountability of a system whose decisions cannot be traced to a recorded reason, (2) the fragmentation blindness of admission checked against less than the full history, and (3) the structural insufficiency of oversight built as a layer outside what it oversees. The saga transactions, idempotency keys, and circuit breakers also named there as six decades of compensation are not made obsolete by this — they remain reasonable engineering choices — but they stop being the only available response to an absence: the absence they compensated for now has a name, and a criterion stated once, in the abstraction, does the work that a pattern applied after the fact could only approximate. A companion application, from the same research program, illustrates this in a different domain: the same decomposition shows that external AI guardrails are incomplete by dimension, not by any parameter they could be given. The cardinality of that space separates two regimes by perfect splitting, with a further distinction on the countable side (Theorem 2; Section 8.5): terminating where T contains no nonempty perfect pruned subtree and no infinite branch remains; persistent where T contains no nonempty perfect pruned subtree but at least one branch continues forever; and continuum where T contains a nonempty perfect pruned subtree. Evolutive change is one possible source of such persistent splitting, not its definition.

Nondeterminism is not a defect of execution but its generative capacity. The anomaly is not nondeterminism itself, but nondeterminism left unresolved, unrecorded and unattributable. The calculus does not remove it — it keeps it as a source, resolves it before commitment, and records how it was resolved. 

The scope is execution of discrete systems: a finite admissibility resolution over a finite prefix, at every step. Each eschatological check that is reached is itself a halting computation, returning admission or eschatological preemption. Preemption may instead occur one stage earlier through ontological non-availability, before τ is evaluated. What remains potentially unresolved — whether a preempted abstraction is ever admitted at some later context — is a retrospective fact about the execution record, never one the calculus must decide in advance. Nothing undecidable is decided, and no claim is made about what may stand above execution.

A.1. The Three Objects and Their Types

Let X be a non-empty domain and R ⊆ X × X a binary relation. The three objects are defined as follows, each with a precise type in the cumulative hierarchy of ZF set theory.

Convention (rank-homogeneity). Assume, without loss of generality, that X is rank-homogeneous: every element of X has the same ZF rank, ρ_X, so that ρ(X) = ρ_X + 1. This is a standard coding convention, not a restriction on what X may contain — any domain can be re-indexed to satisfy it — and it is what turns the arithmetic below into exact equalities rather than merely upper bounds. Under this convention, the Kuratowski pair ⟨x, y⟩ = {{x}, {x, y}} of any x, y ∈ X has rank ρ(⟨x, y⟩) = max(ρ(x), ρ(y)) + 2 = ρ_X + 2 = ρ(X) + 1, exactly, by the standard rank computation for Kuratowski pairs.

Epistemic axis C. The execution context C is a finite subsequence of admitted events from R: ran(C) ⊆ X × X, growing from C⁰ = ∅. Each element e ∈ C is an ordered pair e = (x, y) with x, y ∈ X. Type: elements of C have rank ρ(e) = ρ(X) + 1 for each e ∈ C, where ρ denotes the rank function of ZF. The range of C is a subset of the ontological lattice E = (E, ≤): ran(C) ⊆ E at every step, E contains all candidate events, while C contains only those for which (e, ωτ) ∈ τ.

Ontological axis ωτ. The ontological content ωτ is a parameter that specifies the semantic content of the abstraction Aτ: what the relation means in a given domain. Formally, ωτ ∈ $𝒫$(X × X) — it is a subset of R, encoding which transitions are ontologically valid for the given abstraction. Type, for ωτ ≠ ∅: ρ(ωτ) = ρ(X) + 2 — the empty case is degenerate (ρ(∅) = 0) and excluded here, since an abstraction with no ontologically valid transitions never admits anything for Axiom 0 to evaluate. This is exactly the rank a classical binary relation occupies when taken as a whole — R ⊆ X × X itself is an element of $𝒫$(X × X) — so ωτ is not a new kind of object beside R; it is R read at the level where “the relation” means the entire set of admissible pairs, not any one pair in it. This static specification is what Section 5.2 calls ωτ as an object; the same notation denotes, dynamically, the partial deterministic realization function associated with that specification, yielding at most one realization for an invocation. In the internal case its output may depend on the accumulated context and remain unavailable until the required contextual facts are present. In the environmental case its candidate-generation stage may instead respond to an external occurrence without consulting the accumulated content of C. This operational distinction does not alter the static ontological type or rank established here.

Eschatological axis τ. The eschatological criterion τ is the selection predicate, given by an effective procedure or finite formula — write ⌜τ⌝ for this specification, to keep it distinct from what it defines — deciding, for σ a finite sequence from (X × X)^{<ω} and ω ∈ Ω, whether (σ, ω) is admitted: τ’s positive extension is Γ_τ⁺ = {(σ, ω) : τ(σ, ω) = true} ⊆ (X × X)^{<ω} × Ω. Given a realization ω, τ is total — the partiality of admission belongs entirely to ωτ, one stage earlier (Section 5.2, Section 5.3 and Section 5.4); pairs (σ, ω) ∉ Γ_τ⁺ are a genuine, computed negative, not a gap in τ’s domain.

Coding convention. Fix a tagged set-theoretic encoding of criterion specifications — a standard device pairing each code with a tag marking its type — such that every criterion code ⌜τ⌝ associated with a domain X occupies rank ρ(X) + 3, one level above the ontology ⌜ωτ⌝ it evaluates alongside. The exact offset is a fact about the encoding chosen, not a further hypothesis: what the argument below needs, and all it uses, is the strict separation ρ(e) < ρ(ωτ) < ρ(⌜τ⌝), which holds under any such tagged encoding.

Type: ρ(⌜τ⌝) = ρ(X) + 3, one level above ωτ, under the coding convention just fixed. This is a claim about ⌜τ⌝, the specification fixed once an abstraction is defined, not about Γ_τ⁺: the extension has a fixed rank too, but a different, much higher one, set once and for all by the rank of (X × X)^{<ω} × Ω itself — individual sequences grow in rank with their length, but the set containing all of them does not grow without bound; it simply sits at whatever fixed level that union settles at, depending on the sequence encoding chosen. Theorem 1 needs neither figure for Γ_τ⁺: its comparison is always against the rank of individual elements e ∈ C (Appendix A.2), which stays fixed at ρ(X) + 1 by rank-homogeneity regardless of how long C itself has grown. The ordering ∀e∈C: ρ(e) < ρ(ωτ) < ρ(⌜τ⌝) follows from the Kuratowski pair computation under the rank-homogeneity convention above and the coding convention just fixed: ⌜τ⌝ is formed one level above the specification it evaluates, and from that level it governs the admission of events drawn from the other two.

Why three ranks, and not an arbitrary count. These are not three independently postulated levels that happen to increase; the increase is forced by composition. The first constitutive specification, ωτ, occupies the ontological level and deterministically yields at most one realization for an invocation. In the internal case that realization is determined from the accumulated context; in the environmental case, the ontological candidate-generation stage need not consult the accumulated contents of C (Section 5.2). This distinction does not alter the ontological type or rank of the realization specification. The second relation, τ, evaluates the resulting realization together with C. Rank here tracks not the argument’s own rank — C, as a growing sequence, has no single fixed rank — but the level at which each relation is itself specified: ωτ, as the set of admissible pairs it draws from ($𝒫$(X × X), above), sits at ρ(X)+2, one level above the individual pairs (rank ρ(X)+1 by rank-homogeneity) it selects among; τ, as the rule deciding over ωτ’s own output alongside the context, sits one level above that, at ρ(X)+3. The three ranks are therefore the two steps of a single compositional chain in the specification — element → ωτ → τ — each step contributing exactly one level, not three separate facts to verify but one fact about composing two relations over a shared base of individually-ranked pairs.

Remark (why τ cannot be absorbed into ωτ’s own well-formedness). ωτ and τ each carry a trivial epistemic check at the level of their own definition — whether ωτ is a well-formed realization function of its declared type, whether τ is a well-formed function of its argument — and that check is satisfied by construction, true independent of any particular C. The interaction of ωτ and τ over a specific context is a different matter: it is not settled by either definition being well-formed, since two well-formed relations can interact successfully at one C and fail to at another. What settles it is a further, contextual epistemic fact — true or false depending on C, not on definition alone — and that fact is exactly what τ, evaluated at C, states. This is why τ cannot be folded into ωτ as a further clause of the same check: ωτ’s well-formedness is checked once, at the level of specification; τ’s holding is checked anew, at the level of execution, once per context. The admission condition is not an additional postulate layered onto two independent objects — it is the name for whichever contextual fact makes their interaction, at this C, succeed.

A.2. Theorem (Rank Separation) and Proof

Theorem 1 (restated; rank separation). Let ρ be the rank function of ZF. Elements of C are pairs, of rank ρ(X)+1; ωτ is a set of such pairs, of rank ρ(X)+2; τ, as specification ⌜τ⌝, is a rule whose first argument is a finite sequence of such pairs, of rank ρ(X)+3. Hence ρ(⌜τ⌝) > ρ(ωτ) > ρ(elements of C). (The rank stated is that of C’s elements, not of the sequence C as a whole encoded as an indexed object — a set of index–event pairs has higher rank than its members, exactly as any set does, and nothing below depends on the rank of that encoding.)

Proof. Rank does not decrease under the operations available within a level: pairing, union and separation applied to objects of rank ≤ α yield objects of rank ≤ α+1, and the criterion is formed one level above the specification it evaluates. The ordering follows from the Kuratowski pair computation under the rank-homogeneity convention (Appendix A.1). ∎

Proposition (orthogonality under independent specification). Assume, as part of the definition of Aτ, that ωτ and τ are independently specified parameters — fixed as part of the abstraction’s definition prior to any admission, not values computed from whatever C happens to contain (Section 5.1 and Section 5.2). Under this assumption, C, ωτ, and τ are constitutively orthogonal: none substitutes for another’s role. This is a separate claim from Theorem 1, not a restatement of it — rank alone does not establish it (see the Remark following C1–C3 below). Theorem 1 shows the three occupy different levels of construction; this proposition adds that, given the independent-specification assumption, none is, in addition, derivable from the others’ content.

A.3. Consequences

C1. τ cannot be derived from C. τ occupies a different level of construction than C’s elements (Theorem 1), and — by the orthogonality proposition — is in addition an independently specified parameter, not a value computed from C’s content. The eschatological criterion must therefore be supplied rather than inferred: τ takes C as its argument at every step, but a predicate over a domain is not reducible to an element of that domain, and nothing about C’s content determines it.

C2. ωτ cannot be derived from C, for the same two-part reason: a different level of construction (Theorem 1), and independent specification (the orthogonality proposition). Semantics is not a projection of C; it is a constitutive parameter of Aτ.

C3. τ and ωτ are independent. They occupy distinct levels (Theorem 1) and are independently specified (the orthogonality proposition): τ evaluates over ωτ as an argument but cannot be derived from it, and ωτ cannot be derived from τ. The two components of Aτ = (R, ωτ, τ) are therefore independently specifiable: purpose and content are separate dimensions of specification in every abstraction.

C4. Axiom 0 is not an external postulate over R: it names the full ranked structure whose coordinate-forgetting projection is a binary relation. Execute(Aτ, Cⁿ) = eₙ₊₁ is not an arbitrary assumption; it is the explicit statement of the full structure whose coordinate-forgetting projection is the binary relation generated by that abstraction, present in the full object and unnamed in the formalisms surveyed in Section 12. Thus every executable abstraction has a binary-relational reduct; no converse claim that every arbitrary binary relation admits such an executable lifting is required here. Stated as a single result: the epistemic, ontological, and eschatological axes are rank-separated (Theorem 1) and orthogonal in constitutive role (the Proposition above) — none can substitute for another’s part, C recording, ωτ specifying possibility, τ specifying the rule of admission — and Axiom 0 is their sole dynamic point of intersection, the one place where what is possible, what is required, and what has been recorded jointly determine whether an event is admitted.

Remark (separation and interaction). Separation by level does not imply isolation: τ and C interact at every step through Axiom 0. It means only that τ cannot be derived from C, and that C cannot determine τ. Interaction is the mechanism; the rank ordering is the structural guarantee that τ governs C without being reducible to it.

Remark (what rank alone does not show). Higher rank does not in general prevent derivability: {x} has rank one above x and is nothing more than the singleton of x, definable from x by Pairing. So Theorem 1’s rank comparisons, by themselves, do not rule out that some construction from C’s elements could happen to produce an object equal to ωτ or τ — which is exactly why the orthogonality proposition above is stated and argued separately, resting on independent specification rather than on rank.

A.4. Why the Square, and What Is Not Claimed

Remark (what is not claimed). The three are not pairwise disjoint as sets, and no such claim is required. Every event occurring in C is ontologically valid; the axes are distinguished by level, not by disjointness. What rank separation together with independent specification yields is non-derivability, which is what C1–C3 require.

A heterogeneous relation R ⊆ A × B does not compose with itself, so no sequence can be generated from it; the square is what makes composition, and therefore generation, possible. Δ = {(x,x)} is definable in ZF by Separation and is the unit of composition. The three axes are not obtained by a geometric transformation: X carries no addition, no metric and no bilinear form. They are obtained by type.

A deterministic (functional) subset of X × X — one in which each x is paired with at most one y — has cardinality at most |X|: the linear scale exemplified by Δ itself, never the full quadratic scale of X × X. C is exactly such a subset, being the graph of the deterministic function Execute (Section 7.1); this is why C’s growth never enters the cardinality regime that Tarski’s 1924 theorem (|A×A|=|A| for every infinite A, equivalent to AC) addresses in general. That theorem is a separate, illustrative parallel — it locates the same diagonal from outside — not a premise this construction needs: determinism of admission is what keeps C at linear scale, independently of it.

The “axes” are levels of construction, not directions in a space. Nothing depends on geometry, and nothing is assumed of X beyond its being a set.

A.5. Analogy with Homomorphic Quotients

The forgetful map U (Section 6.1) resembles, in its shape, a homomorphism in the sense of universal algebra: a homomorphism φ: A → B determines a congruence, ker(φ) = {(a,a’) : φ(a) = φ(a’)}, and the image of φ is isomorphic to the quotient A/ker(φ) — the First Homomorphism Theorem [53, Thm. 6.12]. This vocabulary is borrowed for its descriptive value, not asserted as a verified instance: no algebraic signature, operation set, or compatibility proof is given here for Aτ. Read loosely this way, ker(U) = {(e,e’) : payload(e) = payload(e’)} would be the corresponding congruence — identifying admitted events that share a payload regardless of coordinate — and R = U(Aτ) the corresponding image, with R not a separate object alongside Aτ but Aτ itself read through the equivalence its own coordinates induce. What this paper actually proves and uses is narrower and already established: Proposition 1.

B.1. The Ontological Axis Is the Binary Relation, Seen Whole

Appendix A.1 already places ωτ ∈ $𝒫$(X × X) at rank ρ(X)+2. This is exactly the rank a classical binary relation R ⊆ X × X occupies when R is taken as a whole set of pairs rather than any one pair in it — R itself is an element of $𝒫$(X × X). ωτ is not a further object beside R; it is R read at the level where “the relation” means the entire admissible set, restricted to what one abstraction’s ontology declares valid.

B.2. The Abstraction Outranks Its Highest Component

An abstraction is defined, prior to any admission, as A = (R, ωτ, τ). This is a bundling of three objects into one, and — by the same rule used throughout Appendix A, that a pairing or tupling operation raises rank by one level above its highest-ranked argument — A occupies a rank strictly above τ, its highest-ranked component: ρ(A) > ρ(X)+3. Call this level ρ(X)+4 under the bundling convention already fixed above.

This is a claim about A as a definition: the mathematical object that exists once an abstraction is specified, independent of and prior to any admission it will later perform. It is not a claim about anything written into C.

B.3. The Record of an Abstraction Is an Address, Not the Object

What enters C when an abstraction is registered is not A itself — that would break the rank of C, which Appendix A.1 fixes at ρ(X)+1 for every element. What enters C is e_esh and e_ont (Section 5.6): short records whose payloads describe τ and ωτ — for instance, the criterion procedure specified in Section 5.3 — without being τ or ωτ. A composite key (id_esh, id_ont, id_inst) built from these records stays at C’s own rank, because id_esh and id_ont are addresses pointing to other elements already inside C at that same rank — not embedded copies of the rank-3 and rank-4 objects they refer to. A pointer does not inherit the rank of what it points to, and this is why an abstraction can be defined at rank ρ(X)+4 while every trace of it in the record remains at rank ρ(X)+1, exactly like every other admitted event.

B.4. Where the Choice Problem Appears

The family relevant to the Axiom of Choice arises in the projected representation, not in the operational candidate set of a fixed abstraction. Let R = U(Aτ) ⊆ X × X be the binary-relational reduct, and for each x in its domain define the nonempty fiber Rₓ = {y ∈ X : (x, y) ∈ R}. After the criterion and execution coordinates have been forgotten, the reduct itself contains no object determining which member of Rₓ is to be taken. For an arbitrary family of such nonempty fibers, $𝒳$_R = {Rₓ : x ∈ D, Rₓ ≠ ∅}, a global selector choosing one member of each fiber has exactly the form to which the Axiom of Choice applies.

This is deliberately different from Cand(σ) in Section 8.1. There, each individual ωτᵢ contributes at most one realization at a fixed context, and Axiom 0 evaluates that realization by a Boolean criterion. No choice among the members of an arbitrary nonempty set occurs inside Execute.

B.5. Why Axiom 0 Does Not Invoke Such a Selector

Execute(Aτ, Cⁿ), unpacked, evaluates Cⁿ, the single value ωτ(Cⁿ) when defined, and the Boolean value τ(Cⁿ, ωτ(Cⁿ)). It neither constructs nor assumes a global selector over the fibers of the projected relation.

The sense in which the calculus operates without Choice is therefore operational rather than a consequence of a rank inequality: the choice problem appears only after the criterion and execution structure have been forgotten. In the full executable object, the realization procedure and admission criterion are already specified, so Axiom 0 requires no application of the Axiom of Choice.

The rank analysis of B.1–B.3 remains useful for locating the abstraction relative to its constitutive components, but no additional rank-distance theorem for a global choice function is required for this conclusion.

B.6. Reading Section 12.2 Against This Hierarchy

Each of the five formalizations surveyed in Section 12.2 reached the ontological axis and something existentially adjacent to it, without assembling the rank-4 object that would have turned adjacency into capacity. Tarski’s fixed-point theorem guarantees the existence of a least fixed point for a given monotone operator on a complete lattice. What it does not supply is the present execution structure in which an admission criterion, its ontology, and the accumulated record are assembled into one executable object. Mesarović’s purposive mapping supplies most of A’s components (ontology, goal-seeking structure) but, by explicit scope decision, never the execution primitive that would complete the bundle. DEVS’s δ_ext performs admission-like work inside a single transition function, never lifted to the status of a separate, named, rank-3 object in its own right. In each case, what was missing was not a fact about R or about existence — Tarski, Mesarović, and Zeigler all had those — but the assembly of R, ωτ, and τ into one object whose rank exceeds any of them individually. That assembly is Axiom 0.