TRW: TRACE-RealWorld---An Auditable Consistency Contract for World Models as Materialized Views
Edward Y. Chang
cs.AI, cs.DB
2026-07-24
TRW treats predicted world state as a materialized view, binding typed freshness claims, adaptive refresh, and saga compensation into an auditable contract; in a search-and-rescue simulation, adaptive refresh cuts stale execution by 0.15 pp but rescues 3.2 fewer people than a fixed 600-second interval.
World models are internal digital replicas of the environment on which agents plan and reason. They drift from physical reality the moment the agent stops observing. Re-observation is priced (drone sorties, sensor queries, human reports), delayed, and fallible. Existing world-model research concentrates almost entirely on predictive quality. The data-management questions underneath — when to observe, through which channel, what to do when a commitment goes stale — are largely unaddressed.
TRW (TRACE-RealWorld) reframes this as a database view-maintenance problem: predicted state is a materialized view over the physical world, an observation is a partial refresh, a planned action is a read whose authorization can expire, and deciding when to observe is a view-maintenance policy.
Three mechanisms compose the consistency contract:
Typed claims: each world-state assertion carries calibrated uncertainty, a validity interval, a declared observable with a refresh tolerance, and supporting evidence. A refresh fires when the declared discrepancy exceeds its threshold.
Adaptive refresh: four trigger families handle the decision of when to observe: predicted uncertainty crossing a bound, observed innovation exceeding declared tolerance, support or out-of-distribution alerts, and normative requirements for high-consequence actions. Channel selection maximizes value-of-information minus observation cost, generalizing dual-Kalman stream management to commitment precision.
Dependency-scoped saga compensation: when a commitment is invalidated after authorization, repair traverses only the dependency-scoped affected set, not the full plan.
Three theorems establish: refresh alone cannot drive stale-execution probability to zero at bounded cost (a nonzero floor survives any policy); compensation alone cannot undo already-executed irreversible commitments; their composition bounds expected violations under explicit, named assumptions.
Experiments run on Flood-SAR, a simulated search-and-rescue workbench over real Antioch delta geography with simulated missions and outcomes.
The headline finding is a trade-off, not dominance:
| Metric | Adaptive (εc=4) | Fixed 600s | Difference |
| Stale execution | 0.063% | 0.215% | −0.151 pp |
| Observation cost | 3.769 | 2.738 | +1.032 |
| Coverage | 97.18% | 99.12% | −1.93 pp |
| Rescued people | 197.95 | 201.15 | −3.20 |
Adaptive refresh reduces stale execution but costs more and rescues fewer people. The deficit appears driven by false holds: unnecessary decision pauses that impede task progress.
In the RQ6 composition experiment, localized saga repair versus global recovery: repair work fell by 9.56 units per mission, restoration latency by 80.7 seconds, while residual violations were identical. Post-hoc recovery cannot change stale authorization; this held exactly across all 160 paired comparisons.
Calibration: a frozen 16-level isotonic map reduces raw predictor ECE from 0.327 to 0.0048 across 62,977 held-out route claims.
Theorem 1's predictor-independence corollary is the sharpest theoretical result: conditional on the same observation filtration, no richer encoder removes the stale-execution floor. Closing that gap is a channel-contract obligation, not a modeling problem. This separates "build a better predictor" from "reduce commitment risk" into two independent design axes.
For practitioners building agentic systems over physical environments, the framework points to a concrete architectural choice: world-state assertions should carry explicit refresh conditions, and commitments should carry dependency graphs so that invalidation cost is trackable and bounded.
All experiments run in simulation; the geography is real but missions and outcomes are not. Calibration is certified only for horizon-1 route claims. Longer prediction horizons, other action classes, and real deployment remain uncertified.
Adaptive refresh did not beat fixed intervals on rescue outcomes. The trigger design over-holds in this scenario; further tuning may change the balance but is untested. Among 97 invoked localized compensations, 10 were incomplete by mission end, representing the theorem's empirical slack rather than a discharged proof.