“Just use a stable RNN.”
It stays bounded and still forgets. Head-to-head on a shared multi-task stream at the same size, a properly stable net sheds old skills while this one holds them. The rival is properly constrained, not a strawman, and it still forgets. Stability alone doesn’t guarantee retention.
“So it’s a reservoir or echo state network?”
No. A reservoir also stays bounded and holds memory in fixed dynamics, but it freezes its recurrent weights and trains only a linear readout, so its representation can’t adapt in the field. Synapse Runtime learns the full parameter set online, bounded, which the reservoir approach never attempts.
“Bounded must mean contractive, and a contractive map forgets.”
Many provably stable recurrent systems are stable because they contract to a fixed point, which erases state. Not here: the state is confined to an interval but not pulled to a point, so it’s free to hold many positions, and that freedom is where memory lives. Boundedness and memory horizon are separate axes. Checkable: hold the bound, vary the horizon.
“The capacity limit is just normalization’s zero-sum under another name.”
They differ in what the limit is tied to. Normalization makes forgetting the mechanism of stability: the fixed budget both prevents blow-up and forces old down as new goes up. Here stability is structural and independent of how full the network is. The limit is neuron count, which is expected, not a tax the architecture extracts or a price of staying live. Adding neurons raises capacity with the bound unchanged, which normalization can’t do because its bound is the budget.
“Why not wrap it in run-time assurance?”
That wraps a learner that can blow up instead of fixing why it blows up, and the wrapper is too heavy for a battery-powered device anyway.
“Isn’t this classical adaptive control?”
Good inside a fixed control law. But the case the law wasn’t written for is the rule, not the exception; every deployment meets one eventually. Instead of trying to foresee every scenario, this adapts to whatever actually happens.
“So it’s federated learning.”
Federated learning learns from the field into a central model and ships it back. This learns in the field; each unit adapts to its own machine, bounded, with no connectivity.
The comparison is sharpest on the ground federated was invented to hold. It exists to keep raw data on the device for privacy, but it still transmits model updates to a server on a schedule. Those updates are themselves data: reconstructing training examples from shared gradients is a published attack, not a hypothetical. So federated shrinks the transmitted surface without removing it, and it still needs the server, the aggregation infrastructure, and the connectivity. Here nothing is transmitted, because there is nowhere to transmit to.
“It must need a critic, a replay buffer, or batch updates.”
The update needs no critic, no batch, and no replay to stay bounded. It runs synchronously at tick rate on a single CPU thread, with no background training process to offload. The size and latency figures are measured, not projected.
“So a model rewrites itself in the field, unattended.”
Learning and authority are separate concerns. It learns live and label-free from what happens next on the device, and stays bounded by construction, so it can’t run away. Learning is opt-in, and you can gate authority on top: a new policy takes control only once it’s earned it on the device. It is neither frozen nor live-and-risky; it is live and gated.
“Isn’t frozen the safe default?”
Frozen is predictable, which is not the same as correct. It preserves whatever was true the day it shipped, errors included, and it can’t notice the asset stopped matching it. On a fleet of deliberately miswired units, the frozen fleet-average controller performed worse than shipping no controller at all, while every unit that learned locally recovered. The problem there wasn’t the model download. It was the freeze.