f_Capture_Hard — Hard Lock Capture Variant

§0 — Preamble#

This file is the structural inverse of f_Capture_Soft. Where Soft extends provisional binding below the standard floor, Hard refuses commitment below a floor that sits above the nominal binding distance. The elevated requirement ensures that only high-confidence, high-energy bindings enter the orbit registry.

Relationship to base capture:

f_Capture.md         → standard path    (d_bind ≥ d_bind_min → CAPTURE_LOCKED → orbit eval)
f_Capture_Soft.md    → sub-threshold    (soft_threshold ≤ d_bind < d_warn; grace period)
f_Capture_Hard.md    → supra-threshold  (d_bind ≥ d_hard, β ≥ β_min_hard → ORBIT_STABLE)

Hard capture bypasses the standard CAPTURE_LOCKED intermediate state. On success, the orbit registry entry is written directly at ORBIT_STABLE.

§1 — Module Identity#

§2 — Operator Definitions#

2.1 Hard-Lock Threshold Distance#

d_hard = α_hard × d_bind_nominal

Threshold ordering relationship:

d_collapse < d_warn < d_bind_nominal < d_hard

Hard lock demands a binding stronger than nominal — the pair must already be over-bound relative to their equilibrium distance before the lock is written.

2.2 Hard Binding Coefficient Floor#

β_hard ≥ β_min_hard     (default β_min_hard = 2.0)

The standard capture floor is β ≥ 1.0. Hard lock requires β ≥ 2.0, ensuring the coupling is at least doubly reinforced before the commitment becomes irrevocable.

2.3 Lock Cost#

lock_cost = M_E × β_hard × d_hard × k_lock

lock_cost is debited from M_E at execution time. Unlike f_Capture_Soft, there is no amortized cost schedule — the full cost is paid at the moment of lock, reflecting the commitment's irrevocability.

§3 — Primitive Declarations#

§4 — Formal Operator Specifications#

4.1 Hard Eligibility Check#

PRIM:031 evaluates the conjunctive condition set {HLC-1, HLC-2, HLC-3, HLC-4}. All four must hold simultaneously. A single failure returns HARD_REJECTED immediately.

HLC-1 (Binding distance floor):

d_bind ≥ d_hard     ⟺     d_bind ≥ α_hard × d_bind_nominal

HLC-2 (Binding coefficient floor):

β ≥ β_min_hard

HLC-3 (Field presence):

ρ(Φ) > 0.0

The attractor field must be live. A null field renders hard lock meaningless; FM-001 is active on this condition.

HLC-4 (Approach state guard):

state ∈ {APPROACH_LIVE}

Hard lock is only legal from a live approach. Any other state (CAPTURE_LOCKED, ORBIT_STABLE, RELEASED, COLLAPSED, HARD_REJECTED) causes immediate return of HARD_REJECTED.

No-retry policy:

if no_retry_flag = TRUE → return HARD_REJECTED   (skip all HLC evaluation)

Once a hard rejection has been issued for a given (E, A) pair in the current encounter, no_retry_flag is latched to TRUE. All subsequent calls to PRIM:031 for that pair return HARD_REJECTED without re-evaluation. The flag is encounter-scoped: it resets only when the approach fully terminates and a new approach begins.

4.2 Orbit Registry Entry#

On HARD_ELIGIBLE, PRIM:032 writes the orbit registry entry directly at ORBIT_STABLE, bypassing the CAPTURE_LOCKED intermediate:

orbit_entry = {
  E:            element node ID,
  A:            attractor node ID,
  d_bind:       d_bind at lock time,
  β:            β at lock time,
  ρ(Φ):         ρ(Φ) at lock time,
  orbit_class:  classify_orbit(d_bind, e, T_orb),   ← PRIM:007
  stab_class:   STABLE,
  lock_type:    HARD,
  lock_cost:    M_E × β × d_bind × k_lock,
  state:        ORBIT_STABLE
}

The lock_type: HARD field differentiates hard-locked entries from standard captures in the orbit registry. This distinction is available to downstream operators (f_Release, f_Decay, f_Amplify) for conditional logic.

4.3 State Transition Diagram#

APPROACH_LIVE
     │
     ▼
[PRIM:031: evaluate_hard_eligibility]
     │
     ├── All HLC pass ──→ HARD_ELIGIBLE
     │                         │
     │                         ▼
     │                  [PRIM:032: execute_hard_lock]
     │                         │
     │                         ├── frame capacity OK ──→ ORBIT_STABLE  (terminal success)
     │                         │
     │                         └── FM-003 triggered  ──→ FRAME_SATURATED (retriable)
     │
     └── Any HLC fails ──→ HARD_REJECTED  (terminal failure; no retry)

No intermediate state is ever entered. The transition from APPROACH_LIVE to ORBIT_STABLE is atomic from the perspective of the orbit registry.

§5 — Primitive Specifications#

PRIM:031 — evaluate_hard_eligibility (Pure)#

PRIM:031 evaluate_hard_eligibility(
  d_bind:        float,   // current binding distance
  β:             float,   // current binding coefficient
  ρ_phi:         float,   // current field density ∈ [0, 1]
  state:         enum,    // current approach state
  no_retry_flag: bool     // encounter-scoped hard-reject latch (write-once)
) → EligibilityResult

EligibilityResult ::= HARD_ELIGIBLE | HARD_REJECTED

Algorithm:
  if no_retry_flag:
    return HARD_REJECTED                        // no-retry policy — skip all checks

  if state ≠ APPROACH_LIVE:
    no_retry_flag := TRUE                       // latch (only permitted mutation)
    return HARD_REJECTED                        // HLC-4 violated

  if ρ_phi ≤ 0.0:
    no_retry_flag := TRUE
    return HARD_REJECTED                        // HLC-3 violated; FM-001 active

  if β < β_min_hard:
    no_retry_flag := TRUE
    return HARD_REJECTED                        // HLC-2 violated

  if d_bind < d_hard:                          // d_hard = α_hard × d_bind_nominal
    no_retry_flag := TRUE
    return HARD_REJECTED                        // HLC-1 violated

  return HARD_ELIGIBLE

Purity note: The only permitted mutation is the write-once no_retry_flag latch. It does not mutate the binding registry, orbit registry, or any node state. All other outputs are read-only.

FM guards active in PRIM:031:

• FM-001: ρ(Φ) ≤ 0.0 → HLC-3 fails immediately
• FM-003: frame capacity is not checked here — it is a graph-level resource checked in PRIM:032, not a pair-level eligibility condition

PRIM:032 — execute_hard_lock (Impure)#

PRIM:032 execute_hard_lock(
  E:       node,    // element node
  A:       node,    // attractor node
  d_bind:  float,   // binding distance (HLC-1 verified by PRIM:031)
  β:       float,   // binding coefficient (HLC-2 verified by PRIM:031)
  ρ_phi:   float,   // field density (HLC-3 verified by PRIM:031)
  k_lock:  float    // lock cost coefficient
) → LockResult

LockResult ::= ORBIT_STABLE | FRAME_SATURATED

Precondition: PRIM:031 returned HARD_ELIGIBLE for (E, A) in this call chain.

Algorithm:
  // 1. Frame capacity check (FM-003 guard)
  if GravityGraph.frame_capacity_reached():
    emit FM-003 (HARD variant)
    return FRAME_SATURATED                     // no_retry_flag unchanged

  // 2. Compute and debit lock cost
  lock_cost := M_E × β × d_bind × k_lock
  E.energy  -= lock_cost
  if E.energy < 0:
    E.energy := 0                             // floor at zero; INV-007 compliance

  // 3. Classify orbit via PRIM:007 (f_Orbit)
  orb_class := classify_orbit(d_bind, e, T_orb)

  // 4. Write orbit registry entry
  orbit_entry := {
    E:           E.id,
    A:           A.id,
    d_bind:      d_bind,
    β:           β,
    ρ(Φ):        ρ_phi,
    orbit_class: orb_class,
    stab_class:  STABLE,
    lock_type:   HARD,
    lock_cost:   lock_cost,
    state:       ORBIT_STABLE
  }
  GravityGraph.orbit_registry.write(orbit_entry)

  // 5. Transition node states
  E.state := ORBIT_STABLE
  A.state := ORBIT_STABLE

  // 6. Emit GravityGraph event
  emit GravityGraph.event(
    HARD_LOCK_CONFIRMED,
    { E, A, d_bind, β, lock_cost }
  )

  return ORBIT_STABLE

Side effects:

• Debits lock_cost from E.energy
• Writes new entry to GravityGraph.orbit_registry
• Mutates E.state and A.state to ORBIT_STABLE
• Emits HARD_LOCK_CONFIRMED event to GravityGraph

Caller contract: PRIM:032 must only be called after PRIM:031 returns HARD_ELIGIBLE in the same synchronous call chain. Out-of-order invocation is a protocol violation and yields undefined behavior.

§6 — Failure Mode Guards#

FM-001 — Field Collapse (active in HLC-3)#

If ρ(Φ) ≤ 0.0 at the time PRIM:031 is called, HLC-3 fails and HARD_REJECTED is returned. The attractor field has collapsed; hard lock is impossible without a live field. The caller should invoke f_Emit or restore field presence via f_Amplify before initiating a new approach.

FM-003 — Frame Saturation (active in PRIM:032)#

If GravityGraph.frame_capacity_reached() returns TRUE inside PRIM:032, the lock is aborted and FRAME_SATURATED is returned. Unlike HARD_REJECTED, FRAME_SATURATED does not set no_retry_flag — the pair may retry once frame capacity is restored. The FM-003 guard is deferred to PRIM:032 (not PRIM:031) because frame capacity is a graph-level resource, not a pair-level eligibility condition.

FM-004 — Resonance Drift (monitoring only)#

Hard-locked orbits with orbit_class = RESONANT are flagged for enhanced decay monitoring. FM-004 governs resonance drift in f_Decay; the elevated d_bind at lock time provides greater margin before d_warn is crossed. No action taken in this file; FM-004 guard is noted for the decay integration contract.

FM-005 — Decay Spiral (awareness only)#

Hard lock does not preclude decay after the orbit is established. f_Decay runs independently. The elevated d_hard floor provides margin, but FM-005 remains possible if decay accelerates post-lock. No guard implemented here; noted for downstream awareness.

§7 — Invariant Compliance#

§8 — Stability & Condition Manifest#

8.1 Hard Lock Conditions (HLC)#

All four conditions are conjunctive (INV-005). Every HLC must be satisfied simultaneously for PRIM:031 to return HARD_ELIGIBLE.

8.2 No-Retry Policy Specification#

no_retry_flag := FALSE                         // initialized at encounter start

on any HLC failure:
  no_retry_flag := TRUE                        // latched; never reset mid-encounter

on FRAME_SATURATED from PRIM:032:
  no_retry_flag unchanged                      // FM-003 path is retriable

on encounter_end / full reset:
  no_retry_flag := FALSE                       // encounter-scoped reset only

Rationale: The no-retry policy enforces that hard lock is a one-shot commitment attempt. If the pair cannot meet the elevated threshold on the first try, the encounter is considered mismatched for this pathway. The caller must either route through standard f_Capture, wait for conditions to improve in a new encounter, or use f_Amplify and f_Emit to raise β and ρ(Φ) before a fresh approach begins.

8.3 State Flags#

8.4 Comparison — Hard vs. Soft vs. Standard#

§9 — Registry Footprint#

9.1 OPERATORS.md Registration#

The following symbols must be appended to OPERATORS.md under the Wave 4 — Capture Variants heading:

### f_Capture_Hard Operators

| Symbol      | Definition                          | Constraint              | Source file       |
|-------------|-------------------------------------|-------------------------|-------------------|
| d_hard      | α_hard × d_bind_nominal             | > d_bind_nominal        | f_Capture_Hard.md |
| α_hard      | Hard lock multiplier                | > 1.0; default 1.5      | f_Capture_Hard.md |
| β_hard      | Binding coefficient at lock time    | ≥ β_min_hard            | f_Capture_Hard.md |
| β_min_hard  | Minimum β for hard eligibility      | > 1.0; default 2.0      | f_Capture_Hard.md |
| lock_cost   | M_E × β_hard × d_hard × k_lock     | ≥ 0                     | f_Capture_Hard.md |
| k_lock      | Lock cost coefficient               | > 0; domain-calibrated  | f_Capture_Hard.md |

9.2 PRIMITIVES Registry Update#

PRIM:031  evaluate_hard_eligibility  Pure    f_Capture_Hard.md
PRIM:032  execute_hard_lock          Impure  f_Capture_Hard.md

9.3 State Flags Registry Update#

HARD_ELIGIBLE    f_Capture_Hard.md  Transient — cleared after PRIM:032 executes
ORBIT_STABLE     f_Capture_Hard.md  Terminal success (extended: lock_type = HARD)
HARD_REJECTED    f_Capture_Hard.md  Terminal failure; encounter-scoped; no retry
FRAME_SATURATED  f_Capture_Hard.md  Retriable abort; FM-003 path only

§10 — Worked Examples#

Example 1 — Clean Hard Lock (All HLC Pass)#

Context: A high-energy pair where prior f_Amplify calls have elevated β and f_Emit has raised ρ(Φ). The binding distance comfortably exceeds d_hard.

Given:

d_bind_nominal = 10.0
α_hard         = 1.5
d_hard         = 15.0

d_bind         = 18.0    ← HLC-1: 18.0 ≥ 15.0   ✓
β              = 3.2     ← HLC-2: 3.2  ≥ 2.0    ✓
ρ(Φ)           = 0.75    ← HLC-3: 0.75 > 0.0    ✓
state          = APPROACH_LIVE                    ← HLC-4: ✓
no_retry_flag  = FALSE

M_E            = 5.0
k_lock         = 0.1

PRIM:031 → HARD_ELIGIBLE

PRIM:032 execution:

FM-003 check: frame not saturated → continue

lock_cost = M_E × β × d_bind × k_lock
          = 5.0 × 3.2 × 18.0 × 0.1
          = 28.8

E.energy -= 28.8

orb_class = classify_orbit(18.0, e, T_orb)    ← PRIM:007

orbit_entry.state     = ORBIT_STABLE
orbit_entry.lock_type = HARD
orbit_entry.lock_cost = 28.8

Result: ORBIT_STABLE. GravityGraph event HARD_LOCK_CONFIRMED emitted. Lock is irrevocable. Downstream operators see lock_type = HARD in orbit registry.

Example 2 — HLC-1 Failure: Binding Distance Insufficient#

Context: An attractor pair where β has been amplified above the hard floor via f_Amplify, but the physical binding distance has not yet grown to d_hard. The attempt is routed prematurely to hard capture.

Given:

d_bind_nominal = 10.0
α_hard         = 1.5
d_hard         = 15.0

d_bind         = 12.5    ← HLC-1: 12.5 < 15.0   ✗
β              = 2.4     (HLC-2 would pass)
ρ(Φ)           = 0.82    (HLC-3 would pass)
state          = APPROACH_LIVE               (HLC-4 would pass)
no_retry_flag  = FALSE

PRIM:031 evaluation:

HLC-1: d_bind(12.5) < d_hard(15.0)  →  FAIL
no_retry_flag := TRUE   (latched immediately)
return HARD_REJECTED

Result: HARD_REJECTED. PRIM:032 is never invoked. No energy debited. No orbit registry entry written. The encounter is closed for hard capture.

Post-rejection routing options:

Key distinction: The no-retry flag applies to the hard capture pathway only. It does not block the same pair from using standard f_Capture.md in the same encounter. Hard reject ≠ total encounter reject.

Example 3 — HLC-2 Failure: β Below β_min_hard#

Context: The binding distance is well above d_hard, but β has not been sufficiently amplified. A strong field cannot compensate for an under-coupled binding coefficient in the hard capture pathway.

Given:

d_bind_nominal = 10.0
α_hard         = 1.5
d_hard         = 15.0
β_min_hard     = 2.0

d_bind         = 19.0    ← HLC-1: 19.0 ≥ 15.0   ✓
β              = 1.7     ← HLC-2: 1.7  < 2.0    ✗
ρ(Φ)           = 0.91    (HLC-3 would pass)
state          = APPROACH_LIVE               (HLC-4 would pass)
no_retry_flag  = FALSE

PRIM:031 evaluation:

HLC-1: 19.0 ≥ 15.0      → PASS
HLC-2: 1.7  < 2.0       → FAIL
no_retry_flag := TRUE
return HARD_REJECTED

Result: HARD_REJECTED. HLC conditions are evaluated in order (1→2→3→4); the first failure latches the flag and exits. HLC-3 and HLC-4 are never reached.

Recovery analysis:

To succeed on a future encounter, β must reach β_min_hard = 2.0. The shortfall is:

Δβ_needed = β_min_hard − β_current = 2.0 − 1.7 = 0.3

If f_Amplify is used (PRIM:021) with F_amp:

β_new = β × F_amp ≥ 2.0
F_amp ≥ 2.0 / 1.7 ≈ 1.18

A single f_Amplify call with F_amp ≥ 1.18 resolves the shortfall. After amplification, a new encounter must begin (no_retry_flag prevents retry in the current encounter).

Diagnostic note: HLC-2 failures are typically engineering failures, not field failures — the binding distance is sufficient but the coupling is under-maintained. check_runaway_risk (PRIM:022) should be called before any amplification to ensure β_new does not breach β_max.

Example 4 — Near-Threshold Lock with lock_cost Analysis#

Context: A pair exactly at the hard lock eligibility boundary. All HLC pass with minimal margin. This example focuses on the lock_cost computation and its implications for the element's energy budget.

Given:

d_bind_nominal = 10.0
α_hard         = 1.5
d_hard         = 15.0
β_min_hard     = 2.0

d_bind         = 15.1    ← HLC-1: margin = 0.1   (barely passes)
β              = 2.05    ← HLC-2: margin = 0.05  (barely passes)
ρ(Φ)           = 0.41    ← HLC-3: passes (> 0)
state          = APPROACH_LIVE               (HLC-4 passes)
no_retry_flag  = FALSE

M_E            = 8.0
k_lock         = 0.12
E.energy_pre   = 22.0    (available energy before lock)

PRIM:031 evaluation:

HLC-1: 15.1 ≥ 15.0   → PASS (margin: 0.1)
HLC-2: 2.05 ≥ 2.0    → PASS (margin: 0.05)
HLC-3: 0.41 > 0.0    → PASS
HLC-4: APPROACH_LIVE → PASS
return HARD_ELIGIBLE

PRIM:032 execution:

lock_cost = M_E × β × d_bind × k_lock
          = 8.0 × 2.05 × 15.1 × 0.12
          = 8.0 × 2.05 × 1.812
          = 8.0 × 3.7146
          = 29.717

E.energy_post = E.energy_pre − lock_cost
              = 22.0 − 29.717
              = −7.717  →  clamped to 0.0  (INV-007)

Result: ORBIT_STABLE. Lock succeeds. However, E.energy is exhausted — the lock cost exceeds E's available energy budget.

Energy exhaustion implications:

lock_cost sensitivity analysis (α_hard = 1.5, β_min_hard = 2.0):

Design implication: lock_cost scales with all three binding parameters (M_E, β, d_bind) and the system constant k_lock. Near-threshold hard locks carry disproportionate energy burden relative to their marginal eligibility. Operators should prefer well-above- threshold approaches unless energy budget is abundant.

§11 — Document Metadata#

§11.1 — INV Compliance Summary#

§11.2 — Primitive Registry (This File)#

Running PRIM total after this file: PRIM:032

§11.3 — Operator Registry (This File)#

§11.4 — State Flags Registry (This File)#

§11.5 — Failure Mode Summary#

§11.6 — Changelog Entry#

## [f_Capture_Hard v1.0.0] — 2026-08-13 — SES-20260813-HARD-001
Wave 4, File 4 of 6. Hard lock capture variant.

### Added
- Hard lock threshold model: d_bind ≥ d_hard = α_hard × d_bind_nominal
- Operators frozen: d_hard, α_hard, β_hard, β_min_hard, lock_cost, k_lock
- Conditions: HLC-1 (binding floor) · HLC-2 (β floor) · HLC-3 (field
  present) · HLC-4 (approach live) — all conjunctive
- No-retry policy: no_retry_flag write-once latch; encounter-scoped reset
- Atomic state skip: APPROACH_LIVE → ORBIT_STABLE (no CAPTURE_LOCKED
  intermediate)
- lock_cost debit: M_E × β × d_bind × k_lock; E.energy floored at 0
- PRIM:031 evaluate_hard_eligibility (Pure)
- PRIM:032 execute_hard_lock (Impure)
- State flags: HARD_ELIGIBLE, ORBIT_STABLE, HARD_REJECTED, FRAME_SATURATED
- FM guards: FM-001 (HLC-3), FM-003 (PRIM:032 frame check)
- Four worked examples: clean lock, HLC-1 fail, HLC-2 fail, near-threshold
  energy analysis
- Comparison table: Hard vs. Soft vs. Standard capture

§11.7 — Wave 4 Status Tracker#

§11.8 — Suggested Commit Message#

docs(FFF_Gravity): add canonical f_Capture_Hard — hard lock variant,
binary threshold, no-retry policy, PRIM:031-032 [Wave4 / SES-HARD-001]

- Hard lock zone: d_bind ≥ α_hard × d_bind_nominal (default α_hard = 1.5)
- β floor: β ≥ β_min_hard (default 2.0) — stricter than standard 1.0
- PRIM:031 evaluate_hard_eligibility (Pure) — HLC-1–4 conjunctive gate
- PRIM:032 execute_hard_lock (Impure) — atomic skip to ORBIT_STABLE
- No-retry policy: encounter-scoped no_retry_flag write-once latch
- lock_cost = M_E × β × d_bind × k_lock debited from E.energy at lock
- FM-001 guard (HLC-3), FM-003 guard (PRIM:032 frame check)
- 4 examples: clean lock; HLC-1 fail; HLC-2 fail; near-threshold analysis

End of f_Capture_Hard.md — [FFF:GRAVITY:CAPTURE:HARD] v1.0.0 — Wave 4 File 4 of 6