TRW: TRACE-RealWorld—An Auditable Consistency Contract for World Models as Materialized Views

World models enable agents to plan against predicted physical state, but that state drifts over time. Re-observation is costly and delayed, and repair can fail. Existing approaches to maintaining consistency between predicted and actual state lack a formal contract that specifies when a prediction is fresh enough to authorize a physical commitment. TRW addresses this gap by introducing a commitment-level consistency contract. The core idea is to treat predicted state as a materialized view and a physical commitment as a read whose authorization can expire. This framing allows the system to reason about freshness, verification cost, and repair in a unified way. The authors motivate the work with search-and-rescue scenarios where stale predictions can lead to ineffective or dangerous actions. TRW is presented as the first commitment-level consistency contract for world models, and the paper provides both theoretical guarantees and an empirical evaluation in a realistic simulator.

TRW defines typed, calibrated claims that specify consequence-conditioned freshness and priced verification. A claim includes a prediction, a freshness requirement that depends on the consequence of acting on it, and a cost for verifying the prediction against the real world. Adaptive refresh generalizes dual-Kalman synchronization to consult the world when evidence could change a decision. This means the system only pays the cost of re-observation when the expected benefit—avoiding a bad decision—exceeds the cost. Dependency-scoped SagaLLM compensation repairs reversible commitments that are invalidated after authorization. When a commitment is found to be based on stale state, the system can undo or adjust it, but only within the scope of its dependencies. The authors prove that synchronization and compensation are insufficient alone, but their composition yields a conditional consistency guarantee under an event-aligned risk oracle and recovery-liveness assumptions. Otherwise, the argument yields an auditable decomposition of violations into named debts. The system is implemented in Flood-SAR, a search-and-rescue simulator over real geography. Six preregistered questions are tested at frozen operating points on held-out seeds. The formal model can be expressed as follows: let $S_t$ be the predicted state at time $t$, $C$ a commitment, and $\varphi$ a freshness predicate. The contract requires that if $C$ is authorized based on $S_t$, then either $\varphi (S_t)$ holds or a verification action $V$ is taken such that the updated state $S_{t^{\prime }}$ satisfies $\varphi$. The consistency guarantee is conditional on the risk oracle correctly estimating the probability that a decision changes due to stale state. A Mermaid diagram of the architecture is shown below.