Evidence-Bound Investigation of Computational Behavior Across Time

A consequential computational runtime may leave many kinds of operational record: prompts, responses, messages, tool calls, traces, alerts, retries, handoffs, timestamps, workflow events, decisions, corrections, and externally observed outcomes.

Those records may be extensive or fragmentary. They may preserve chronology without dependency, actions without context, outputs without role provenance, or outcomes without the conditions that preceded them. They do not automatically explain how behavior developed.

Runtime Forensics is the evidence-bound reconstruction and investigation of Longitudinal Computational Behavior within a defined runtime case.

It examines what trajectory can be reconstructed from qualified operational records, how registered behavior changed across that trajectory, which findings are supported by the available evidence, which interpretations remain provisional, and where the investigation must stop.

Its central proposition is:

Runtime Forensics reconstructs the strongest account that qualified operational records can support while preserving the boundary among what was recorded, what was computed, what was interpreted, and what remains unknown.

The objective is not to recover hidden model state, recreate an inaccessible reasoning process, or turn temporal sequence into causal certainty. It is to make the observable development of a computational runtime inspectable, reproducible, challengeable, and accountable.

Its Place Within SubstrateX Research

Within SubstrateX research, Runtime Forensics is the investigative application of Longitudinal Computational Dynamics®.

It is not the primary empirical object. That object is Longitudinal Computational Behavior: the ordered development of observable computational activity across time.

It is not a second framework. Longitudinal Computational Dynamics supplies the concepts through which state, trajectory, stability, recurrence, transition, failure, and recovery are investigated.

It is not the engineering architecture of runtime reconstruction. Computational Behavior Architecture defines the objects through which events, roles, frames, dependencies, worldlines, regimes, markers, measurements, and findings are represented.

It is not the source of evidentiary authority. Runtime Evidence is the source-bound evidentiary output preserving what can be reconstructed and substantiated from the record, while Evidence-Governed Computation™ constrains every authoritative result to its evidence, method, status, and boundary.

Runtime Forensics brings these layers into a disciplined case investigation.

It asks:

• What records are available, and what part of the runtime do they cover?

• Which participants, models, agents, tools, workflows, and environments fall within the investigation boundary?

• What event, turn, dependency, and clock relationships can be established?

• What trajectory can be reconstructed from the eligible record?

• Which changes, regimes, boundaries, outcomes, and recovery states satisfy declared criteria?

• What was knowable prospectively, and what became visible only in retrospect?

• Which alternative explanations remain viable?

• Which claims are supported—and which are not?

Runtime Forensics therefore follows measurement and validation in the scientific sequence. It applies the science to a bounded evidentiary case without treating the reconstruction as self-validating.

Records Are Traces, Not Explanations

Operational records preserve traces of activity.

A source may establish that:

• a message was recorded;

• a tool was called;

• a result was returned;

• an alert was issued;

• a retry occurred;

• a role or instruction was supplied;

• a correction entered the workflow;

• an action failed; or

• an external outcome was documented.

These observations matter, but they do not by themselves establish how the complete runtime developed or why an outcome occurred.

A log may omit actions outside the instrumented system. A timestamp may be malformed or unsynchronized. A role label may reflect configuration rather than actual authority. A transcript may preserve content while omitting tool state. An alert may record that a threshold fired without validating the phenomenon the threshold was intended to detect.

Runtime Forensics begins by qualifying the record rather than assuming its completeness or truth.

Qualification may identify:

• source identity and origin;

• collection method;

• runtime and observation boundaries;

• participant and system coverage;

• temporal resolution and clock quality;

• missing intervals or fields;

• conflicting records;

• transformations applied before receipt;

• integrity information;

• access and disclosure conditions; and

• known limitations on reproduction or verification.

The flight-recorder analogy is useful only when kept precise. A recorder preserves operational traces. It does not interpret them, validate a dynamical construct, identify root cause, or establish responsibility. Those activities require reconstruction, measurement, comparison, and review.

Capture is therefore not reconstruction. Reconstruction is not explanation. Explanation is not causal proof.

The Forensic Object: A Bounded Runtime Case

A forensic investigation requires a declared case boundary.

The case may concern one model session, a tool-using agent, a multi-agent workflow, a human-machine decision process, an operational incident, or a comparison across several runs. Each choice defines a different system and a different evidentiary scope.

A bounded runtime case should identify:

• the system or process under investigation;

• the beginning and end of the observed interval;

• the participants and components included;

• the operational records admitted as evidence;

• the relevant objectives, constraints, and roles;

• any independently supplied outcome or incident markers;

• the methods and versions used in reconstruction;

• and the questions the available evidence is intended to address.

This boundary prevents evidence from one system, interval, or authority class from being silently used to strengthen claims about another.

It also distinguishes a case from a narrative. A case is not organized around a predetermined conclusion. It may support failure formation, abrupt failure, stable operation, absorbed perturbation, unresolved recovery, conflicting evidence, or no qualifying transition at all.

From Source Record to Forensic Reconstruction

A Runtime Forensics investigation proceeds through an evidence-preserving sequence:

Qualified source → Canonical runtime → Registered measurements → Worldline, regimes, and markers → Guided investigation → Findings and bounded interpretations → Runtime Evidence artifact

Each stage performs a distinct function.

Qualified source

The operational records admitted to the case are identified, scoped, and assessed for coverage, integrity, availability, and limitation.

Canonical runtime

Eligible observations are organized into a reproducible runtime structure. Source positions, actors, roles, events, coordinates, dependencies, missingness, and conflicts remain attached.

Registered measurements

Declared methods compute observables and derived signals from eligible evidence. Their dependencies, parameters, horizons, uncertainty, and validation status remain explicit.

Worldline, regimes, and markers

The evidence-bearing trajectory is projected through registered state dimensions. Sustained conditions and temporal markers are assigned only when their entry, persistence, exit, and authority requirements are satisfied.

Guided investigation

An investigator examines the trajectory through structured questions, source-linked views, alternative hypotheses, and bounded instrument projections.

Findings and bounded interpretations

Supported results are separated from human interpretation, unresolved questions, and prohibited conclusions.

Runtime Evidence artifact

The source-to-claim lineage, methods, findings, availability states, integrity information, and claim boundaries are preserved for replay, challenge, comparison, and later review.

Authority cannot increase merely because an object appears later in this sequence. A visualization cannot strengthen an uncertain source. An interpretation cannot turn a proxy into a direct observation. An export cannot convert a candidate marker into a confirmed transition.

Evidence Classes Must Remain Distinct

Runtime Forensics depends on a clear separation among evidence classes.

Source fact identifies what a qualified source directly records.

Canonical reconstruction identifies how eligible source observations were normalized, ordered, linked, or resolved.

Computed measurement identifies a value derived through a declared method.

Governed classification identifies a marker, regime, boundary, or support state assigned under explicit rules.

Investigative finding identifies a supported relationship assembled from observations, measurements, and classifications.

Interpretation expresses an investigator's reasoned account of what those findings may mean.

Bounded claim states the conclusion the complete evidence path is authorized to support.

These objects may be connected, but they are not interchangeable.

For example, a tool error recorded in a source is not the same as a pressure signal derived from an interval around it. A pressure signal is not the same as a candidate boundary. A candidate boundary is not a confirmed Basin Exit. A Basin Exit is not an observable failure. Temporal proximity between the tool error and the transition does not, by itself, establish that the tool error caused the transition.

Forensic discipline consists partly in preserving these differences when an apparently coherent story makes them easy to collapse.

The Canonical Runtime and the Worldline

The canonical runtime is the evidentiary structure beneath the investigation.

It aligns the recorded positions, events, roles, actors, coordinates, dependencies, measurements, markers, regimes, and source links required to reconstruct the case. It also preserves uncertainty, unavailable values, contradictory observations, and unresolved ordering.

The worldline is the evidence-bearing projection of behavioral development across that structure.

It can make visible:

• continuity and displacement;

• recurrence and re-entry;

• role and authority changes;

• perturbation and response;

• stable and transitional intervals;

• candidate and confirmed boundaries;

• observable outcomes;

• re-entry, relapse, and recovery; and

• regions in which the record is insufficient to classify the runtime.

The worldline is not a replay of hidden reasoning or a physical path inside the model. Its geometry is method-relative. Every position must remain resolvable to the canonical runtime, eligible source records, temporal coordinates, measurements, and methods from which it was constructed.

Runtime Cartography makes this structure navigable. Runtime Forensics uses that navigability to conduct an investigation.

Chronology, Dependency, and Symbolic Progression

Forensic reconstruction requires more than a single timeline.

The same case may contain:

• source time, supplied by the originating records;

• normalized clock time, established after declared qualification and normalization;

• turn order, representing conversational or workflow exchange;

• event order, representing canonical position in the reconstructed runtime;

• dependency order, representing supported precedence or requirement relationships;

• frame position, representing location on the canonical runtime spine; and

• symbolic time, representing registered structural progression under a declared Chronodynamic method.

These coordinates answer different questions.

An event may be thirty seconds before an outcome, six turns earlier, four dependency steps upstream, and twelve symbolic units before a qualifying boundary. None of those descriptions can silently substitute for another.

Dependency also requires restraint. Showing that a later action depended on an earlier tool result may establish an operational relationship. It does not necessarily establish that the earlier result caused a later behavioral transition.

Chronodynamics supplies the temporal discipline through which order, duration, persistence, lag, recurrence, warning, and recovery can be investigated without converting sequence into causation.

Investigating Formation, Transition, Outcome, and Recovery

Runtime Forensics can investigate failure formation, but it does not presume that every case contains a failure or that every failure developed gradually.

Where the evidence permits, an investigation may distinguish:

1. t_aw — weakening or awareness: the earliest supported point at which a qualifying reduction in a relevant stability condition becomes observable.

2. t_candidate — candidate boundary: a provisional point at which preliminary boundary conditions are satisfied.

3. t* — confirmed Basin Exit: the qualifying observable boundary crossing under a declared model and persistence rule.

4. t_f — observable failure: an independently supplied or qualified external outcome marker.

5. t_r — sustained recovery or re-entry: the point at which the applicable recovery requirements are satisfied.

The presence of one marker does not imply the others.

Weakening is not confirmation. A candidate boundary is not Basin Exit. Basin Exit is not automatically an external failure. An observed failure does not prove that an earlier marker predicted it. Re-entry does not establish sustained Recovery. The first event in the record is not automatically the beginning of formation.

The investigation must also preserve cases in which:

• no weakening is observed;

• a candidate is not confirmed;

• a perturbation is absorbed;

• Basin Exit occurs without a supplied failure marker;

• an observable failure occurs without a qualifying precursor;

• recovery begins but the observation ends before persistence can be established;

• or the record is insufficient to determine the runtime condition.

Runtime Forensics reconstructs these distinctions. Failure Formation and Recovery supplies the scientific hypotheses and criteria through which they are tested.

Retrospective Reconstruction and Prospective Forensics

Retrospective and prospective findings carry different authority.

A retrospective reconstruction may use the complete available record to identify where a trajectory appears to have changed, which earlier conditions are associated with a later outcome, and which alternative accounts remain plausible.

A prospective finding claims that a condition could have been detected using only the evidence available at that point in the runtime.

The second claim is stronger.

It requires prefix invariance: future events must not silently change measurements previously represented as available online. Full-run normalization, outcome-selected anchors, retrospective role resolution, future-aware smoothing, and thresholds tuned after the event can all introduce future-information leakage.

Predictive Runtime Forensics is therefore a narrow and separately validated research area within Runtime Forensics. It does not mean forecasting hidden model behavior or knowing that a future failure will occur. It concerns whether prospectively available measurements discriminate qualifying precursor conditions before an independently established outcome.

Formal lead time is admissible only when a prospective confirmed marker and an independent failure marker exist on compatible coordinates:

Δt = t_f − t*

If t_f is absent, the case may support a warning interval, candidate interval, confirmed transition, or post-exit observation period. It does not support formal lead time.

Prospective claims require held-out testing, threshold calibration, false-positive analysis, stable negative cases, and evaluation across independent outcomes. A retrospective precursor becomes a prospective warning only when it survives those conditions.

Evidence Replay

Runtime Forensics makes a completed case replayable as an ordered evidentiary sequence.

Replay may expose, at each position:

• the source observations then available;

• the canonical event and role structure;

• the registered measurements and their status;

• the developing worldline;

• regime and marker assignments;

• applicable uncertainty and missingness;

• later outcome evidence, when it becomes eligible; and

• subsequent evidence of recovery, relapse, or unresolved state.

Replay is not a reenactment of the original computation. It does not reproduce sampling conditions, hidden activations, private reasoning, or environmental state that was never recorded.

It is also not an animation whose persuasive continuity substitutes for evidentiary support.

Evidence replay exists so another investigator can return to the same position, inspect the same eligible record and method, and determine whether the represented finding is reproducible and the interpretation defensible.

Guided Investigation and Human Judgment

Complex runtime cases cannot be made scientifically responsible by giving an operator more charts.

Investigators need a structured path through the evidence while retaining the ability to question the reconstruction, compare alternatives, and withhold judgment.

Guided Investigation organizes that path through evidence-bound chapters and questions. An investigation may move through:

• source qualification and coverage;

• runtime and worldline formation;

• temporal organization;

• roles, tools, dependencies, and handoffs;

• stability, regimes, and boundary evidence;

• failure formation and observable outcomes;

• recovery, relapse, and unresolved states;

• measurement and claim lineage; and

• preservation readiness.

Each chapter can present relevant source spans, registered measurements, instrument projections, candidate interpretations, and claim limits.

Guidance does not automate scientific judgment. It does not force every runtime into a beginning–decline–failure–recovery narrative. It does not convert operator acceptance into source truth.

An investigator may record an interpretation, reject a candidate, identify conflicting evidence, request another comparison, or conclude that the available record is insufficient. Those contributions remain identified as reviewed human judgment rather than being rewritten as direct observation.

Presentation may adapt to the investigator's operational context. The underlying evidence, methods, marker authority, and claim boundary do not.

Role, Tool, and Interaction Forensics

Long-horizon computational behavior is often distributed across participants and systems.

A model may remain locally fluent while a human-machine workflow loses coordination. Two agents may preserve internally coherent but incompatible objectives. A tool may return a changed state while later actions continue from an earlier assumption. Authority may transfer without being recognized. A correction may be acknowledged but fail to alter subsequent behavior.

Runtime Forensics may therefore examine:

• role and authority continuity;

• objective alignment and divergence;

• tool-result integration;

• failed or delayed handoffs;

• cross-role displacement;

• phase lag among participants;

• dependency propagation;

• repeated correction and constraint re-entry; and

• whether coordination was restored.

These findings describe relationships within the observable record.

They do not establish intent, competence, negligence, legal responsibility, or blame. A role's presence near a transition does not make that role the cause of the transition. Attribution requires additional evidence and an appropriate standard of analysis.

Alternative Explanations and Causal Boundaries

A forensic reconstruction becomes stronger when it exposes alternative explanations rather than hiding them.

An observed trajectory change may be compatible with several accounts:

• a model-generated deviation;

• a changed instruction or role;

• an external tool result;

• missing context;

• source truncation;

• a workflow defect;

• an environmental event;

• stochastic variation;

• a preprocessing artifact; or

• a measurement method that is overly sensitive to surface change.

Runtime Forensics can organize evidence for and against these alternatives. It can identify temporal order, supported dependencies, correlated changes, and differences across matched or comparative cases.

It does not establish root cause merely because one explanation fits the reconstructed sequence.

Causal attribution requires additional support: controlled intervention, matched comparison, ablation, system knowledge, external evidence, quasi-experimental design, or another method appropriate to the claim. The correct forensic conclusion may be that several explanations remain viable.

Incomplete Evidence, Censoring, and Negative Findings

Operational records are often incomplete.

The runtime may have begun before collection. It may continue after the record ends. Some tools may be instrumented while others are not. Human decisions may occur outside the captured channel. An external outcome may be known without a precise timestamp. A recovery attempt may begin too near the end of observation to establish persistence.

Runtime Forensics must preserve these limits.

Left censoring occurs when relevant development may have begun before the available record.

Right censoring occurs when the record ends before an outcome, transition, or recovery condition can be resolved.

Missing evidence must remain missing. It must not be converted to zero, normality, or non-occurrence merely to complete a trajectory.

The investigation must also be able to conclude:

• not observed;

• not supplied;

• not computable;

• insufficient evidence;

• conflicting evidence;

• candidate but unconfirmed;

• no qualifying transition;

• no independent outcome marker;

• recovery unresolved; or

• stable under the applicable criteria.

A credible forensic system must be able to find no failure narrative when the evidence does not support one.

Evidence Integrity and Investigative Lineage

A forensic finding must remain traceable from claim to source.

That lineage should preserve:

• source identity and provenance;

• qualification and disclosure status;

• canonicalization history;

• source-to-frame relationships;

• temporal and dependency coordinates;

• measurement, schema, configuration, and software versions;

• marker and regime authority;

• operator annotations and review states;

• missingness, conflict, and uncertainty;

• export and preservation history; and

• explicit claim boundaries.

The authoritative investigation must remain bound to one Current Evidence Run. Instruments, guided views, annotations, summaries, and exports may examine or present that run, but they may not create competing versions of its evidence.

The Runtime Evidence Passport identifies the resulting evidence record and preserves its formation, integrity, availability, methods, and permitted scope of interpretation. It does not certify truth, validate every construct, or confer authority beyond the underlying sources and methods.

This continuity functions as a computational chain of custody. It makes alteration, substitution, omission, and methodological change inspectable across the life of the case.

Reproducibility and Forensic Validation

A forensic reconstruction should be computationally reproducible under a declared contract.

Given the same qualified sources, canonicalization rules, runtime boundary, ordering relations, methods, parameters, versions, and configurations, another implementation should be able to reproduce the governed reconstruction within stated tolerances.

This supports:

• deterministic replay;

• source-to-finding inspection;

• method comparison;

• version tracking;

• sensitivity analysis;

• challenge and review;

• and preservation across systems.

Reproducibility is necessary but not sufficient.

A deterministic reconstruction may still rest on an incomplete source, an invalid measure, an arbitrary threshold, or an unsupported interpretation. Scientific validity additionally requires comparison with alternatives, stable controls, negative cases, held-out evaluation, prospective testing where prediction is claimed, and independent replication.

Agreement among several instruments reading the same Current Evidence Run is not independent validation. It may show consistency across projections, but all projections remain dependent on the same sources and governing computation.

Runtime Forensics in SubstrateX Aperture™

SubstrateX Aperture™ makes Runtime Forensics operational within a Runtime Evidence Observatory.

Qualified logs, transcripts, traces, tool records, workflow events, and incident artifacts are transformed into a canonical runtime governed by one Current Evidence Run. The runtime spine preserves source identity, event order, role provenance, temporal coordinates, measurements, markers, regimes, availability states, and uncertainty.

Aperture's scientific instruments then provide bounded projections of the same reconstruction. They may examine worldline formation, Chronodynamic structure, displacement, pressure, recurrence, role and tool interaction, multivariate dynamics, boundary support, failure, and recovery. No instrument creates an independent history or acquires authority merely by producing a result.

Guided Investigation connects those projections to source-linked questions and evidence paths. An operator can move from the complete trajectory to a regime interval, marker, frame, event, source span, method, and claim boundary—and then return from the source to every finding that depends upon it.

Evidence replay makes the case temporally inspectable. The Runtime Evidence Passport preserves identity, formation, integrity, availability, and limits. Export and preservation carry that context forward so later reviewers can reconstruct the evidence path without relying on the original interface or accepting its interpretation in advance.

Aperture does not prove every scientific construct by implementing it. It creates an environment in which those constructs can be executed, inspected, challenged, compared, and refined against operational records.

Scientific Boundaries

Runtime Forensics does not claim that:

• every runtime leaves a complete or reliable record;

• a transcript reproduces the complete operational system;

• a worldline is a hidden path inside a model;

• observable behavior reveals private reasoning or complete internal state;

• temporal order or dependency establishes causation;

• a role's involvement establishes responsibility or blame;

• every weakening signal predicts failure;

• every Basin Exit produces an external incident;

• every retrospective precursor was prospectively detectable;

• replay reproduces the original computation;

• deterministic reconstruction establishes scientific truth;

• instrument agreement over one evidence object constitutes independent validation; or

• a Runtime Evidence Passport confers authority beyond the evidence it describes.

Without additional evidence, Runtime Forensics does not establish hidden mechanism, intent, consciousness, subjective experience, internal identity, root cause, organizational fault, legal liability, or universal predictive validity.

Its defensible claim is narrower:

Observable operational records can support a reproducible and evidence-bound reconstruction of computational behavior across time, provided that source coverage, transformations, measurements, uncertainty, interpretation, and claim limits remain explicit.

Why Runtime Forensics Matters

As computational systems operate across longer horizons, post-incident review cannot depend only on endpoint inspection, provider explanation, or infrastructure telemetry.

Models, agents, people, tools, memories, workflows, and environments can interact across hundreds or thousands of events. A consequential outcome may emerge from an accumulation of locally plausible actions. Conversely, a visible failure may arise abruptly from an external condition with little detectable behavioral formation.

Investigators need to determine:

• what evidence exists;

• what part of the runtime it covers;

• how the recorded trajectory developed;

• when qualifying changes became observable;

• which roles, tools, and dependencies were involved;

• whether a boundary or outcome was independently established;

• whether warning evidence was prospectively available;

• whether correction produced sustained recovery;

• which findings can be reproduced;

• which alternatives remain plausible; and

• where the evidentiary boundary requires the account to stop.

Runtime Forensics supplies the discipline for answering those questions without confusing a plausible story with an established reconstruction.

Its contribution is cultural as well as technical. It shifts investigation from:

What do we think happened?

to:

What does the qualified record support, how was that conclusion produced, and what remains unresolved?

That shift is foundational to runtime accountability.

Position Within SubstrateX Research and Infrastructure

The hierarchy is explicit:

• Intelligence in Motion™ is the organizing proposition.

• Longitudinal Computational Dynamics® is the scientific framework.

• Longitudinal Computational Behavior is the primary empirical object.

• Runtime Intelligence names the effective organization that forms and changes during operation.

• Inference-Phase Dynamics provides the first experimentally accessible domain.

• Chronodynamics establishes temporal coordinates, evidence horizons, marker relationships, and prospective admissibility.

• Stability, regime, identity, attractor, failure, and recovery analyses provide the dynamical constructs and hypotheses investigated in a case.

• Measurement Theory and Validation determines how those constructs become testable and which survive comparison and challenge.

• Computational Behavior Architecture represents the runtime through events, frames, roles, states, dependencies, worldlines, regimes, markers, measurements, and findings.

• Runtime Cartography makes those evidence-bearing structures navigable.

• Runtime Forensics applies the complete scientific and representational framework to bounded investigations of recorded computational behavior.

• Runtime Evidence binds the reconstruction and its findings to sources, methods, provenance, availability, integrity, and limits.

• Evidence-Governed Computation™ constrains what the investigation may measure, interpret, present, export, and claim.

• SubstrateX® is the primary organization through which the research, instruments, and Runtime Evidence Infrastructure are developed.

• SubstrateX Aperture™ is the flagship Runtime Evidence Observatory and operational demonstration of deterministic runtime reconstruction, behavioral telemetry, source-bound investigation, and preserved claim boundaries.

• Evidence Commons carries preservation-ready Runtime Evidence into comparison, exchange, and independent scrutiny.

Runtime Forensics is therefore the closing investigative discipline of the Science section. It is the point at which the scientific constructs developed across the section are assembled into an inspectable case—without allowing the case to exceed the evidence that supports it.

The Central Proposition

The forensic claim is narrow and testable:

Long-horizon computational behavior can be reconstructed and investigated from observable operational records when the case boundary, source coverage, temporal coordinates, transformations, measurements, marker authority, uncertainty, interpretation status, and conditions of failure are explicit.

Longitudinal Computational Dynamics supplies the scientific framework. Longitudinal Computational Behavior supplies the empirical object. Chronodynamics establishes temporal authority. Computational Behavior Architecture and Runtime Cartography make the trajectory representable and navigable. Measurement Theory and Validation determine which findings survive testing. Runtime Evidence preserves the source-to-claim lineage. Evidence-Governed Computation™ determines where the account must stop. SubstrateX Aperture™ demonstrates whether the complete architecture works as an examinable system.

Intelligence in Motion™ identifies the phenomenon. Runtime Forensics reconstructs its observable development. Evidence determines what the investigation can legitimately conclude.