The Connection

Late afternoon. A clinician opens the last patient on their list before sign-out. The AI has been running with them all day, and now it has drafted a one-paragraph summary for the incoming team. The clinician scans it, edits two words, changes "stable" to "stable on pressors," and clicks send.

That two-word edit was the first moment in eight hours when the fact that this patient was on pressors finally made it across to the AI. Other channels had been carrying that fact for hours. The eMAR had recorded the norepinephrine the moment the bag was hung. The infusion pump knew its current rate. The nursing flowsheet had hourly entries. The order entry system had logged the vasopressor sign-off. The AI was listening on none of them. It was reading the chart and the summary it had drafted itself.

The Coda named verification as the property the other five depend on. Reading the back half of the series again, the right reframe is in two parts. First, the AI is not trying to match the clinician's working model; it is trying to keep its model coupled to reality. The clinician is a privileged channel into that reality, with the highest bandwidth and the only decision authority, but is not the verification target. Second, once the target is reality, the mechanism is simpler than the Coda's three routes.

The mechanism. Verification is observable signal meeting explicit state. The AI holds a structured representation of the patient: a mixture distribution over hypothesis-components, each carrying its own evidence dependencies, predicted trajectory, and action threshold. A signal arrives from some channel. The mechanism compares the signal to what the mixture says and produces one of four outcomes. The signal confirms what a component predicted, and the mixture stands. The signal is new information that shifts relative weights, and the mechanism updates silently. The signal contradicts what the leader predicted, and the mechanism flags the divergence and adjudicates, by asking the highest-authority channel, halting a pending action, or holding for more signal. Or the signal is a high-stakes action commit, and the mechanism gates the action against the mixture before allowing it through.

That is the architecture. Everything else is a question of which channels are wired, which signals are watched, and which moments earn an interrupt.

Two verification problems hide inside this picture. Signal-fact verification (does the record match what was sensed, said, or done) is largely automatable; sources cross-check themselves without spending clinician attention. Inference-layer verification (do the system's inferences over those signals match the clinician's inferences and eventual reality) is the harder problem, and the one the rest of this essay maps.

The channels. Reality reaches the AI through four classes, and they are not ontologically equivalent. Three are signal types: facts that arrive observable, time-stamped, and attestable. The fourth is a derived inference, computed from successive signals plus eventual delayed ground truth. The signal types differ in source, modality, latency, and authority.

Human attestation. Direct input from the clinician, the patient, or the family. Edits, confirmations, structured notes, collateral history, declared goals of care. The clinician's signals are the highest bandwidth and carry decision authority. The patient and family carry context the chart often does not have. Same observation surface (notes, structured fields, UI inputs), different authority and reliability profiles.

Action and actuation. The acts being performed on the patient. Orders, sign-offs, escalations, administrations, procedures, device settings, infusion states, vent parameters. The AI observes these directly when wired into the action stream (order-entry telemetry, eMAR feeds, device integration) and indirectly when not (a result arriving is evidence the order was placed, a downstream chart entry is evidence the procedure was performed).

Measurement. Quantitative state read from the patient. Labs, imaging reports, monitor streams, structured exam findings. The compression is mechanical and the AI reads the value at the moment it lands.

Outcome and trajectory. A derived sequence rather than an external channel: successive measurement signals computed into a trajectory, compared against what each hypothesis-component in the mixture predicted, with eventual ground-truth signals arriving much later. The verification is high-fidelity and lagged by hours to days. A trajectory that does not match the prediction of the leading component is the strongest single signal the AI ever gets, and the latest to arrive.

Outside the channel classes sit two layers that shape them but do not verify state. Priors, the standing knowledge the AI brings (epidemiological base rates, population trajectories, current evidence) shape every signal but are not signals themselves; their failure mode is drift, and the Coda named that under Property 6. Constraints, the operational envelope the AI's recommendations have to respect (resources, protocols, formulary, what is available in this place tonight) shape which actions can even be taken; they do not verify the patient's state.

The Coda's three routes recast. The Coda sketched three architectural routes for verification: explicit read-back, behavioral inference, a separate user-model module. The first two were modalities within the human attestation channel. The third, the user-model module, was a prior over how a specific clinician decompresses what the AI sends them, useful for interpretation but not a verification channel of its own.

The route the Coda missed. Production clinical decision support has, for years, half-implemented one specific instance of this architecture: action-precondition checks. Active anticoagulation before a procedure. Pregnancy before a teratogen. Allergy before an order signs. Code status before an escalation. Laterality before a procedure. The signal is the pending action. The state is the AI's representation of the patient. The mechanism gates the action until the two converge or until the clinician overrides. The architecture was not novel; the naming was.

The same architecture generalizes across channels. A critical lab result that contradicts the AI's working frame is a signal-meets-state moment with no clinician in the loop. A pulse oximetry reading that disagrees with a recent arterial blood gas is a signal-meets-state moment the AI resolves on its own with priors. A vasopressor titration recorded in the eMAR while the AI's working model says "stable" is a signal-meets-state moment, and the AI updates without interrupting anyone. A predicted trajectory that does not happen is the same mechanism on a longer timescale.

Most production CDS implements this only at the clinician-action moment. The wider architecture watches all four channel classes and chooses, per moment, whether to update silently, ask the clinician, halt an action, or hold.

What this rules out. Two specific moves stop looking right.

One. AI confidence is the wrong selectivity variable. The intuition was that if the AI is sure, a return signal is wasted attention. The cases where verification matters most are exactly the cases of high-confidence wrongness: a confidently asserted code status that was changed an hour ago, a confidently asserted "no anticoagulation" from a model that does not have the home med list. Verification triggers on what would hurt if wrong and how irreversible the harm is, not on whether the model feels sure.

Two. "Confirm without edit" looks like a return signal but is not one. The click that says "I saw this and I agree" is silence in a click-fatigued environment. Treating it as evidence of shared reality launders rote acknowledgment into belief. The signal worth more than the click is the edit, or some equivalent that requires the clinician to do something specific.

The structural prerequisite. For any of this to work, the AI's state has to be inspectable at the moment a signal arrives. Not as a hidden vector inside a transformer. Not as a paragraph of natural language that requires the receiver to find the relevant slot. As a structured object the system can hold up against the incoming signal: a mixture over hypothesis-components with their evidence dependencies and predicted trajectories. A manifold representation is one way. A typed problem list with per-component priors is another. A structured care plan with explicit thresholds is another. The archetype is open; what matters is that the mixture is articulable at the moment of contact, so the new signal can confirm a component, shift weights, or refute the leader.

Systems that do not externalize their internal state in some form cannot do this, no matter how sophisticated their forward compression becomes.

The end-of-day edit, revisited. Back to the opening. In the new frame, the two-word edit was a signal arriving on the slowest, highest-cost channel the AI had access to, when the same fact had been crossing on faster, cheaper channels all day. The eMAR had recorded the norepinephrine. The pump telemetry knew the rate. The order entry log had the sign-off. The AI was listening on none of them. The system was capable, the data was present, and the architecture was deaf to the channels that mattered.

Most of the design problem is wiring the right listeners. A handoff is one moment. An order signing is another. An administration is another. A new measurement is another. An outcome arriving is another. Each is a moment where a signal could meet the AI's state if the channel were observable.

Close. The field's current bet is on smarter forward compression. Bigger context windows. Sharper retrieval. Better summarization. Those build the outbound channel. The work is real, and the work is not finished, but verification does not live there.

If the system cannot observe medication administrations, order commits, measurements, and human corrections at the moment each arrives, no amount of forward compression is verification. Property 3 is the surface where observable signal meets explicit state. Anywhere the architecture is silent at that meeting, the system is open-loop. The next clinical AI worth trusting will be the one wired to listen, not the one with the best summary.

---

Six Essays on Compression · Preface · I · II · III · IV · V · VI · Coda · Postscript