What physical endpoint can the system reliably act upon now to satisfy the resolved resource intent?

Central question

1Introduction

Digital systems depend heavily on addressability. A computational resource may possess a logical identity independent of where or how it is stored or accessed; the URI architecture in RFC 3986 separates identification from access mechanism [1]. Related distinctions exist in physical systems: GS1 EPCIS represents objects independently from locations and records physical-state changes through events [2][3], and industrial digital-twin frameworks separate persistent asset identity from mutable location [4][5]. Resource identity and resource location are different system properties.

Intent-Addressable Physical Infrastructure (IAPI) extends this separation into an interaction model in which user-level resource intent is resolved into a physical response.

Intent → Fulfillment Target → Physical Endpoint → Physical Response

The stages are not interchangeable. A system may correctly determine what can satisfy an intent while failing to determine where the resource currently is. It may identify a region containing the resource while representing it too coarsely, or with too much localization uncertainty, for the required guidance. It may believe an inventory endpoint holds the requested class after the stock has been depleted. Its actuator registry may no longer match deployed hardware. And every computational stage may succeed while the physical response itself fails.

This paper therefore asks a narrower question than the general IAPI architecture: what properties must exist for a physical resource or inventory-bearing endpoint to be operationally addressable by an intent-driven cyber-physical system?

2Identity, Class, Address Space, and Response

Let R be the set of individually represented physical resource instances and K the space of semantic resource classes, related by a membership relation μ ⊆ R × K. An identity function id: R → U assigns each instance a logical identifier; within the operating interval, movement does not redefine identity. Let T be the time domain.

Let A_int denote machine-resolvable addresses inside the managed environment and a_ext a distinguished state meaning the resource is known to be outside it, so A = A_int ∪ {a_ext}. For every address a, V(a) is the physical region it represents. Two functions are kept strictly apart: the ground-truth address G*_t: R → A and the system representation Ĝ_t: R → A ∪ {⊥}, where ⊥ means the system cannot currently assert a sufficiently reliable address. G*_t(r) describes modeled physical truth; Ĝ_t(r) describes what the system currently claims. Supported response modes M (illumination, directional guidance, audible signal, display, access release, mechanical or robotic action) yield physical responses P; a valid address does not imply every mode is available there.

3Address Correctness and Spatial Adequacy

A represented address is correct when the resource's true region lies within the represented region: V(G*_t(r)) ⊆ V(Ĝ_t(r)). This is deliberately weaker than address equality. If the system represents a resource in the ICU supply room while it is physically in Bin 7 inside that room, the representation is correct but coarse. An address can be true without being useful.

A single scalar cannot represent every response-relevant spatial failure. A small region placed incorrectly and a large but correctly centred region fail in different ways. The model therefore keeps extent e(a), localization uncertainty u(a), and any mode-specific descriptor q(a, m) (shelf depth, visibility, orientation, occlusion) as separate components of a response-relevant spatial descriptor ζ(a, m).

Let ψ_R(r, m, ζ) be the probability that the desired response succeeds, conditional on the selected resource being eligible, the address being correct, the endpoint being operable at command issue, and the response being attempted with descriptor ζ. For allowable residual response risk δ, the acceptable response region is Z*_req(r, m) = {ζ : ψ_R(r, m, ζ) ≥ 1 − δ}. The system operates on an estimated or validated version of that set, and its response-adequacy gate Γ̂_R(r, t, m) holds when the descriptor of the represented address falls inside it.

4Hierarchical Address Spaces

Many environments naturally produce hierarchical addresses a = (a_1, a_2, …, a_n) in which successive components increase physical specificity: (hospital, ICU, supply room, rack 3, shelf 2, bin 7); (plant, line, cell, station, fixture, position); (facility, zone, aisle, bay, level, slot). The hierarchy is prefix-closed, and the physical regions exhibit inverse containment: V(a^(n)) ⊆ V(a^(n−1)) ⊆ … ⊆ V(a^(1)). Extent is monotone under containment, V(a) ⊆ V(b) ⇒ e(a) ≤ e(b), but no such monotonicity is imposed on localization uncertainty: a more specific nominal address can still be poorly registered.

IAPI therefore does not require a universal global coordinate system. It requires an address representation whose physical meaning is sufficiently precise and sufficiently well registered for the target response.

5The Resource-State Binding and Temporal Validity

The association between an instance and its physical state is not timeless. The binding B_t(r) = (Ĝ_t(r), Â_R,t(r), a_last, τ_r, v_r, q_r(t)) carries the current represented address and availability, the most recently verified address a_last, its verification time τ_r, a state or mapping version, and an optional evidence-conditioned confidence. Retaining a_last separates current uncertainty from historical knowledge: Ĝ_t(r) = ⊥ with a_last = a means the current address is unresolved but the resource was last verified at a at time τ_r.

Define state age Δ_R(r, t) = t − τ_r and the first state-invalidity time T_R as the smallest age at which the verified state assertion is no longer valid. If availability is defined entirely by continued presence at the verified endpoint, this is a first-departure model. The survival function S_R(Δ) = P(T_R > Δ) gives the probability the verified state still holds at age Δ; a hazard function describes instantaneous invalidation risk conditional on survival so far.

S_R(Δ_R(r, t)) ≥ 1 − ε_R,m

Age-only state-validity gate; the maximum permissible age θ_R is the largest Δ satisfying it

Two cautions follow. A resource can leave the valid state and later return, so survival is a lower bound on current correctness whenever re-entry is possible. And the age-only survival estimate and the evidence-conditioned confidence q_r(t) serve different purposes: survival depends on elapsed age and an empirical persistence model, while q_r(t) may incorporate richer evidence that moves belief up or down, so no universal ordering exists between them.

Four states result. A verified internal state has Ĝ_t(r) ∈ A_int and satisfies the validity criteria. A known external state has Ĝ_t(r) = a_ext. A last-known state has Ĝ_t(r) = ⊥ while (a_last, τ_r) retains the most recent verified address and time. An unknown state asserts no actionable address. A stale precise address can be more dangerous than an explicit unknown because it creates false certainty; uncertainty should remain observable rather than collapse into an apparently exact answer.

Cyber-physical divergence has a simple form. If resource r leaves region V(a_i) at time t_p and the representation is not updated until t_d, the system asserts Ĝ_t(r) = a_i throughout [t_p, t_d) while the truth lies elsewhere; the reactive synchronization lag is L_s = t_d − t_p. A conservative architecture may instead transition Ĝ_t(r) → ⊥ as soon as movement is detected. The engineering objective is bounded divergence between physical and represented state.

6Modeled Addressability

Define Addr̂_R(r, t, m) as the system's modeled judgment that instance r is sufficiently addressable at time t for response mode m. It is the conjunction of five conditions: the address is known (Ĝ_t(r) ∈ A_int), the resource is represented as available, the state-validity gate Φ̂_R passes, the response-adequacy gate Γ̂_R passes, and the endpoint is reachable for mode m under the system's modeled physical-response relation Ĥ: A_int × M ⇀ P.

Addr̂_R(r, t, m) = Known_R ∧ Available_R ∧ Φ̂_R ∧ Γ̂_R ∧ Reach(Ĝ_t(r), m)

An admission decision, not a statement of physical truth

7Two Fulfillment Pathways

Let I denote intent space and C bounded contextual state. For individually represented resources, a resolution function F_R: I × C × T → Seq(R) returns a ranked sequence of candidates. The realized eligibility set R_elig(i, c) contains the instances that satisfy the semantic, authorization, and policy requirements of the request; physical availability is deliberately excluded and handled downstream. A partial selection function σ_R picks one instance and remains undefined when no candidate can be selected with sufficient confidence. Execution proceeds only if Addr̂_R(r, t, m) is true.

For fungible resources, the request need not resolve to a serialized unit at all. True and represented inventory are N*_t, N̂_t: A_int × K → ℕ_0. Endpoints satisfying the semantic, authorization, and policy requirements form A_elig(i, c), and the endpoints that also physically hold the interpreted class k_c form A_ok(i, c, t) = {a ∈ A_elig : N*_t(a, k_c) > 0}. A resolution function F_N ranks eligible endpoints and a partial selector σ_N chooses one.

Instance pathway: Intent → Class → Instance → Address → Response. Inventory pathway: Intent → Class → Inventory-Bearing Address → Response.

8Inventory-State Validity and Endpoint Addressability

Suppose endpoint a is verified at time τ_N to contain n_last > 0 units of class k. Inventory age is Δ_N = t − τ_N, and the first-stockout time T_N is the smallest age at which the true count reaches zero. The stock-validity survival function is conditioned on the verified count: S_N,n(Δ) = P(T_N > Δ | N*(a, k) = n at τ_N). Conditioning on n matters: an endpoint verified with fifty units and one verified with a single unit need not share a stockout hazard at equal age. The age-only gate requires S_N,n_last(Δ_N) ≥ 1 − ε_N.

The first-stockout formulation is conservative because a depleted endpoint may be replenished, even though the uninterrupted assertion established at verification has expired. A richer system may maintain an evidence-conditioned confidence from removal events, replenishment records, weighing, sensing, or scanning.

Modeled addressability for an inventory-bearing endpoint mirrors the instance case. Addr̂_N(a, k, t, m) holds when represented inventory is positive (N̂_t(a, k) > 0), the freshness gate Φ̂_N passes, the response-adequacy gate Γ̂_N built from ψ_N(k, m, ζ) passes, and the endpoint is reachable for mode m.

9Realized Failure Classes

Let X ∈ {R, N} denote the pathway. Five realized events, evaluated after the fact against physical reality, define where an attempted interaction can fail.

10End-to-End Reliability, Coverage, and Loss

Let Attempt_X be the event that the system admits a request and initiates a physical response. Success is E_Success = E_I ∩ E_B ∩ E_R ∩ E_Γ ∩ E_H, and conditional on attempt the chain rule gives, with no independence assumption:

P(E_Success | Attempt) = P(E_I | Attempt) × P(E_B | E_I, Attempt) × P(E_R | E_I, E_B, Attempt) × P(E_Γ | E_I, E_B, E_R, Attempt) × P(E_H | E_I, E_B, E_R, E_Γ, Attempt)

• Coverage and abstention. Let D_req be the evaluation distribution of legitimate target-domain requests and attempt coverage C_attempt = P(Attempt) over it. Evaluation should report success conditional on attempt together with coverage and, where relevant, clarification, refusal, and unresolved-state rates, preferably as a success-versus-coverage curve rather than a single point. This is related to classical reject-option and selective-prediction formulations [10][11].
• Severity-aware loss. Binary success is insufficient for safety-relevant infrastructure because failure classes carry radically different consequences. For response mode m and request-risk class h, define a nonnegative loss L_m,h(Y) over outcome classes with L(success) = 0, and the admission-conditioned expected loss R_m,h = E[L_m,h(Y) | Attempt]. A deployment can then impose both a binary reliability requirement and R_m,h ≤ λ_m,h, so that a wrong drug concentration carries substantially greater loss than guidance to an adjacent harmless bin even though both count as binary failures.
• Role of freshness. Freshness is not an additional realized success event. It is an admission mechanism intended to control P(¬E_B) and must not be counted twice.

11Admission-Conditioned Risk Bound

The definitions give the formalism a direct design consequence. What follows is engineering risk accounting, not a novel probability identity. Consider pathway X, mode m, and an admitted interaction under calibration stratum Z = z, where Z is defined only by variables observable at or before admission: request class, response mode, state age, evidence class, endpoint class, hazard class, modeled confidence. Realized eligibility and physical correctness are evaluation outcomes, never admission-time stratum variables. Assume:

1. Eligibility-matched state calibration. For every admitted stratum, the state-validity model is calibrated on the eligible evaluation subpopulation for that stratum, so the state gate controls P(E_B | E_I, Z = z, Attempt). Validation may use post hoc ground-truth labels for E_I; the deployed gate need not observe realized eligibility at run time.
2. Response calibration. The response-success model is calibrated for the pathway, mode, and spatial descriptor, conditional on E_I, E_B, E_R, and E_Γ, within the admitted stratum.
3. Finite-sample uncertainty is controlled. Each gate uses a pre-specified conservative lower confidence bound or an explicitly distribution-free calibration method; conformal and risk-controlling prediction provide one relevant family [16][17].
4. Simultaneous confidence matches the scope of the claim. For one interaction using one state gate and one response gate, choose β_B + β_H ≤ β_tot; one-sided lower bounds at 1 − β_B and 1 − β_H then give confidence at least 1 − β_tot for the pair by the union bound. Claims across J state calibrations and L response calibrations must cover the whole family, Σ β_B,j + Σ β_H,l ≤ β_tot, or use a valid simultaneous procedure.

If the state gate guarantees P(E_B | E_I, Z = z, Attempt) ≥ 1 − ε_z and the response gate guarantees P(E_H | E_I, E_B, E_R, E_Γ, Z = z, Attempt) ≥ 1 − δ_z, and α_I(z), α_R(z), α_Γ(z) denote the remaining conditional probabilities of eligibility, endpoint operability, and realized spatial adequacy in that stratum, the chain rule yields, pointwise in the admitted stratum:

P(E_Success | Z = z, Attempt) ≥ α_I(z) · (1 − ε_z) · α_R(z) · α_Γ(z) · (1 − δ_z)

For a heterogeneous population, average the stratum-conditioned products over Z given Attempt

A single conservative scalar may instead use uniform guarantees and worst-case bounds over all admitted strata. The key point is that incompatible calibration regimes are not silently collapsed into a product of marginal averages, and no conditional-independence assumption between E_B and E_I is required.

ε and δ are explicit engineering risk controls: ε bounds admitted stale-state risk, δ bounds residual response risk once eligibility, physical-state correctness, operability, and spatial adequacy are established. The remaining factors expose fulfillment-selection risk, realized operability, and model-to-world spatial adequacy. The stratum-conditioned form matters operationally: a system can have excellent average component performance while containing admitted strata with materially weaker full-loop guarantees, so reliability claims should preserve the calibration regime on which each guarantee was established.

12Relationship to Existing Research

The mathematical ingredients have substantial precedent; the contribution is their composition around intent-driven physical resource resolution. RFC 3986 separates identity from access mechanism [1]. EPCIS represents objects and locations through event state [2][3], and Asset Administration Shell models separate persistent asset identity from mutable properties such as location [4][5]. NIST cyber-physical-systems work places logical state, physical state, humans, timing, trustworthiness, and actuation in one frame [6][7], and Intent-Based Networking separates declarative intent from the mechanisms that realize it [8]. Age of Information relates update age to the usefulness of represented state [9]; first-invalidity and first-stockout survival target the probability that an assertion remains valid, and so complement AoI metrics. DeHoratius and Raman documented substantial inventory record inaccuracy in retail [15]; the count-conditioned stockout model asks the narrower question of how confidence in continued positive inventory should decay with time, workflow, and evidence.

Chow's reject option and selective classification formalize the risk-versus-coverage tradeoff [10][11], and conformal prediction and risk-controlling prediction sets supply finite-sample calibration [16][17]; IAPI's gates are not themselves a conformal method, but such calibration is a natural way to set disciplined thresholds. Belief-space planning treats physical-state uncertainty as part of the decision state [12]; this framework proposes no general POMDP planner but identifies the uncertainty-bearing state and admission conditions resolution needs. Named-content networking framed the problem as mapping the what users care about to the network's where [13], and Information-Centric Networking formalizes resolution from persistent names to current locators [14]. IAPI applies the same abstraction to physical resources, where resolution ends not in data forwarding but in a physical endpoint and a guidance or actuation response.

13Engineering Implications

• Identity should survive movement. Movement changes state without redefining logical identity.
• Classes should remain separate from instances. Intent often names a class that several instances can satisfy.
• Fungible inventory should not require artificial serialization. Class-level intent can resolve directly to an inventory-bearing endpoint.
• Ground truth and represented state should remain distinct. G* from Ĝ, A* from Â, N* from N̂.
• Correctness, extent, and positional uncertainty should remain distinct. Whether the target lies in the region, how large the region is, and how well it is registered are three questions.
• Response adequacy should be calibrated empirically. The ψ functions derive acceptable descriptors from observed response success, not assumption.
• Last-known state should survive loss of current certainty. It remains available for reconciliation, audit, and recovery.
• Freshness is risk control. Age changes confidence that prior state remains valid; it is not itself correctness.
• Modeled addressability is not realized addressability. Evaluation must test whether the admission model matched physical reality.
• Reliability must be paired with coverage and severity. High success among attempts can conceal excessive abstention, and a binary failure rate can conceal large differences in harm.

Illustrative worked example

Consider a request resolved to a high-turnover syringe bin; the numbers are illustrative. Require stockout risk ε = 0.05, residual response risk δ = 0.02, and total statistical confidence 1 − β_tot = 0.95 across the state and response gates, allocated as β_B = β_H = 0.025 so that one-sided 97.5% lower bounds give at least 95% confidence for the pair by the union bound.

The bin was verified with 20 acceptable syringes 30 minutes ago. In an eligibility-matched, high-turnover calibration stratum, the estimated probability of continued positive inventory is 0.975 and its 97.5% lower bound is 0.956. Because 0.956 ≥ 0.95, the freshness gate passes. The bin has extent e = 0.18 m, registration uncertainty u = 0.012 m, and an unobstructed line-of-sight illumination descriptor; the calibrated response-success estimate is 0.992 with lower bound 0.982. Because 0.982 ≥ 0.98, the response-adequacy gate passes.

P(E_Success | Z = z, Attempt) ≥ 0.956 × 0.982 × α_I(z) α_R(z) α_Γ(z) = 0.9384 · α_I(z) α_R(z) α_Γ(z)

At the nominal risk limits alone the contribution is 0.95 × 0.98 = 0.931. If, purely for sensitivity, each remaining factor were 0.99, the floor becomes 0.9384 × 0.99³ ≈ 0.910. High component-level confidence does not by itself establish high end-to-end physical reliability; eligibility, endpoint operability, spatial adequacy, and the calibration stratum still matter. The physical trial determines the realized outcome: evaluation records actual eligibility, inventory, operability, spatial adequacy, and execution, reports refusal through coverage, and scores failures through the mode- and hazard-specific loss function.

14Research and Evaluation Questions

1. Address representation and resolution. What minimum interoperable representation supports hierarchical, mobile, temporary, shared, and state-dependent endpoints, and how should class-level intent resolve to instances or inventory endpoints?
2. State persistence and reconciliation. How should first-invalidity and first-stockout distributions be estimated, and how should represented state be reconciled when people or machines move, consume, replenish, or reconfigure resources without complete machine-readable events?
3. Calibration under uncertainty. Which lower-bound, conformal, or risk-controlling procedures suit finite data, repeated gates, distribution shift, and drift?
4. Risk-dependent admission and abstention. How should ε, δ, and loss budgets be selected across hazard classes and response modes, and when should infrastructure act, clarify, offer alternatives, abstain, or hand back to a human?
5. Endpoint operability and distributed consistency. How should systems verify actuator-map fidelity at command time and keep multiple edge controllers consistent over a dynamic physical topology?
6. Coverage-aware end-to-end assurance. Which success- and loss-versus-coverage measures best characterize safe physical systems, and when can the decomposition be validated, tightened, or extended to correlated failure modes?

15Conclusion

Intent-driven physical systems require a reliable bridge between semantic resource need and physical action. That bridge is physical resource addressability. A semantic class is not itself a physical address. An instance is not operationally addressable merely because it has an identifier. An inventory endpoint is not trustworthy merely because a database claims stock is present. A location representation can be correct while still too coarse, too uncertain, or geometrically unsuitable for the intended response. And a system can believe an endpoint is actionable while its representation no longer matches reality.

A rigorous architecture must therefore distinguish semantic resource intent, eligible fulfillment target, system-represented physical state, realized physical state, response-relevant spatial adequacy, and executable physical response. The two pathways differ in the state they must maintain: individual resources need trustworthy resource-state bindings, fungible resources trustworthy class-to-inventory-endpoint state. Both need explicit uncertainty, correspondence between modeled and actual operability, calibrated response adequacy, an admission policy that does not confuse abstention with success, and risk controls that weigh consequence as well as probability.

This gives the word addressable in Intent-Addressable Physical Infrastructure a more precise technical meaning. The objective is not merely to know where physical resources are. It is to create a trustworthy computational relationship through which human or authorized workflow intent can resolve into an acceptable physical fulfillment target and then into an endpoint on which infrastructure can act.

Intent determines the need. Resource resolution determines what can satisfy it. Physical addressability determines where computation can reliably touch the world.