Knowing the Physical: Provenance and No-Imputation Invariants at the Cyber-Physical Edge of Clinical Decision Support

Abstract

Part II of Volume II (the outward extensions) of the H-DKPS series on physician-governed clinical AI (知衡八法). The redacted code package is included as a separate file. Clinical problem. A wearable drops one of its channels for an afternoon. The dashboard still shows a full six-axis profile, because the missing axis was filled with a neutral default — a value that, on that system's scale, reads as "about normal". A heart-rate trace contains one physiologically impossible spike; the denoiser replaces it by holding the previous value, and the trace looks clean. The ultraviolet index used by a vitamin-D rule came from a demonstration key, not a live feed. A laboratory value behind today's dose was drawn eight months ago. In each case the system shows a number. In none does the number say what it is. Engineering problem. Clinical decision support increasingly consumes data that originate in the physical world — sensors, wearables, environmental feeds, laboratory instruments — and arrive through a chain of hardware, firmware, networks and software. Each stage of that chain can fail, and the conventional engineering response is to repair: interpolate the gap, hold the last value, substitute a default, fall back to a demonstration source. Each repair produces a plausible value. A plausible value that was never measured is, from the kernel's point of view, indistinguishable from one that was — and Volume I's kernel, however strictly it bounds what it may decide, decides on what it is given. Approach. We state four invariants for the edge between the physical world and the kernel, INV-W1–W4, together with an environmental provenance gate and a time-fidelity correction: (W1) data that have not passed an admission gate never enter the prescription core; (W2) a missing or rejected value is marked as missing and never replaced, and any quantity derived from it is itself undefined; (W3) every value carries its source and its time, environmental values from a non-live source are not applied to prescription rules, and values carried forward from earlier days are labelled with their date; (W4) a failure to read is recorded as a failure, in its own field, never as a value. A further corollary governs time itself at the edge: a scheduled task whose wait is silently stretched by the host's low-power state must be woken, not trusted. Evidence. This is an architecture study; all evidence comes from the deployed code exercised on synthetic data. The environmental gate makes a prescription computed with non-live environmental items byte-identical to one computed with none, while the same values marked live trigger the four environment-dependent rules. Across the physiological pipeline, four mutations that each restore one form of repair — zero-order hold over a spike, carry-forward in exponential smoothing, a neutral default for a missing wearable channel, a scene default for a missing axis — are each caught by the guard. A failure-to-read field for heart-rate-variability assessment is read by no algorithm. And two development incidents are reported as findings: a gate that changed the meaning of a daily-calibration fixture, and a scheduler that a host's low-power state silenced for a night because, on current Windows, a timed wait does not count time spent in low-power states. Contribution. At the cyber-physical edge, the dangerous output is not the wrong number but the plausible one that was never measured. Absence is information; provenance is part of the value; and time is a physical quantity the host can distort. Each can be made a checkable invariant. Not peer reviewed.