Figure A3 — MTBF Qualification Tiers

Hardware-tracked Mean Time Between Failures determines whether abstractions may propagate beyond their provisioning c-list. Three tiers gate downloadability: Isolated (local only), User-regulated (individual distribution), and Namespace-regulated (full namespace access). The hardware enforces these gates — software cannot override MTBF qualification.

MTBF QUALIFICATION PROGRESSION TIER 1: ISOLATED Local only MTBF < threshold_user Scope: • Runs only in provisioning c-list • Cannot be distributed • Cannot be downloaded Use case: New or untested abstractions Development / debugging 🔒 LOCKED to local namespace MTBF improves TIER 2: USER-REGULATED Individual distribution threshold_user ≤ MTBF < threshold_ns Scope: • Can be shared with individuals • Downloaded by named users • Still scoped to user level Use case: Proven abstractions shared between trusted parties 🔓 User-level distribution MTBF improves TIER 3: NS-REGULATED Full namespace access MTBF ≥ threshold_ns Scope: • Full namespace distribution • Downloadable by any CTMM • Proven reliability record Use case: Production-grade abstractions System libraries, services 🔓 Full namespace access HARDWARE ENFORCEMENT ✔ MTBF counters are maintained by hardware, not software — unforgeable ✔ Tier transitions are automatic when MTBF crosses threshold ✔ FAULT resets MTBF counter — a single failure can demote an abstraction ✗ Software cannot override MTBF qualification. No backdoor. No admin bypass. MTBF COUNTER FORMAT Fault counter: increments on every FAULT attributed to this abstraction Invocation counter: increments on every successful CALL to this abstraction MTBF = invocation_count / fault_count (higher = more reliable) Both counters are hardware registers. Reset only on abstraction destruction. No software read/write path.