Nabla Shadow Lease: Incremental Evaluation of Standing Queries
Abstract
An agent does not want to ask the same question repeatedly. It wants to register the question once and be told when the answer changes. WunderOS gives this a single primitive, the shadow lease: register any query the substrate can answer, receive a handle, receive the result as a stream of changes. The lease is not a restricted subscription language bolted onto the query engine. Anything a one-shot query expresses, a standing query expresses, because standing is an orthogonal modifier and the engine underneath is the same. The contribution is not a new query engine and not a new incremental-maintenance runtime. Both already exist in the substrate.
The contribution is the lease as one abstraction over them, and the property that makes the abstraction worth having: a standing query’s cost on each write tracks the size of the change, not the size of the view. A query whose answer is a million rows, watched while one row changes, does the work of one row. The mechanism is an incremental circuit in the manner of DBSP, compiled from the query plan, evaluated over signed multisets so that a retraction is a write of negative weight and propagates like any other.
The circuit is clean-room, and the reference engine that defines correct behavior is kept outside the build as a conformance oracle, never linked and never shipped. The result is a standing-query layer that is deterministic by the same replayable clock as the rest of the substrate, audit-safe under approximate operators by a calibrated correctness bound, and uniform in expressiveness across every tenant tier.
1. The problem
Agentic memory is read far more often than it is written, and most of the reading is the same reading. A shadow agent watching for a compliance condition, a saga executor waiting on a trigger, a planner waiting on a precondition: each holds a question open and cares only about the moment its answer crosses from false to true. The naive way to serve a held question is to re-run it, on a timer or on every write. Re-running scales with the size of the answer. A query that folds over a large relation pays for the whole relation every time it runs, whether or not anything it depends on has changed. Across many standing questions and a busy write stream, that cost is the dominant cost, and it is almost all waste, since the answer between two writes is the same answer.
WunderOS already had one narrow form of the held question. The substrate kept a fixed-shape probe, a single directional match on subject, predicate, and object, fired from the write path when a matching fact landed. It detected a crossing in under fifty nanoseconds and it served the common case well. It was also exactly one shape. A held question with a join, a recursion, a temporal bound, or a similarity match had no home. It fell back to re-running, or to machinery built by hand for the one occasion.
The question before us is whether the held form of an arbitrary query can be served at the cost of the change rather than the cost of the answer, under one abstraction, without a second query engine and without weakening the determinism the substrate already promises. It can, and the rest of this note is that construction.
2. The lease is the abstraction
A shadow lease is a registered standing query. It has three operations and no more. One registers a query and receives a lease. One reads a lease and receives the current folded view, the answer as it stands. One revokes a lease and it is gone. Registration emits the full current answer as the first change, the answer computed from nothing, and then streams subsequent changes. Reading is a snapshot; the stream is the motion.
The query a lease wraps is a full query in the substrate’s own language, the same language a synchronous caller uses. Recursive rules, joins across the five-place pentad, temporal operators, similarity literals: a lease admits all of them, because standing adds nothing to and removes nothing from what the query can say. This is the load-bearing decision. A subscription system that defines its own smaller language forces every held question to be rephrased and forces the two languages to be kept in step forever. The lease refuses that. It reuses the existing planner and the existing per-clause evaluation, and the narrow fixed-shape probe of section 1 becomes the degenerate case of the general abstraction, folded in unchanged, still firing in under fifty nanoseconds when the held question happens to be that shape.
The lease registry is itself part of the substrate. Who is listening for what is an ordinary fact, queryable like any other, which is the substrate recursion of PLRN-005 applied to the act of listening. A standing query over the registry is a standing query over the standing queries, and nothing special is needed to express it.
3. The change is the unit, in and out
The wire primitive of a lease is the change, not the snapshot. A write commits at a substrate epoch, a monotone counter that is the substrate’s logical clock. The change is queued and the circuits catch up off the write’s critical path, so the write pays only to enqueue. Every change and every read carries the epoch it reflects, so a consumer can align the stream it has received with a snapshot it takes: the changes through epoch E and a read at epoch E describe the same state. The epoch is the deterministic clock of PLRN-002, which is what lets a standing query be replayed exactly rather than merely re-observed.
The internal representation of a change is the same as its representation on the wire. A relation and a change to it are both signed multisets: a map from a tuple to an integer weight, positive for an assertion, negative for a retraction. This is the representation that makes retraction ordinary. The append-only retraction of PLRN-007, a fact retired by a later fact rather than deleted in place, arrives at the circuit as a change of weight minus one and propagates by the same arithmetic as an assertion of weight plus one. There is no separate deletion path. A correction is two changes, a retraction of the wrong tuple and an assertion of the right one, and it travels the stream like any other change.
4. Cost proportional to the change
The query compiles to a circuit, a tree of incremental operators over signed multisets, in the manner of DBSP (DBSP, Budiu et al., 2022, arxiv:2203.16684). The algebra is the point, not any particular engine. Each operator has an incremental form that consumes a change and produces a change.
The linear operators carry no state. Selection, projection, and the union of rule bodies apply directly to the change, because each distributes over multiset addition: the change to the output is the operator applied to the change to the input. The work is proportional to the change by construction.
The join is the operator where the property is won or lost. A join of two relations, each changing, has an output change with three parts: the left change against the standing right side, the standing left side against the right change, and the two changes against each other. Each standing side is held as a trace indexed by the join key, so every part of the output change is computed by probing the trace by key, never by scanning the relation. This is what keeps the work proportional to the change and not to the view. A join whose result is large costs, on a small change, the price of the keys the change touches.
Distinctness is the subtle operator. A derived fact can have several derivations, and the change stream must not retract a fact that still has support. The incremental distinct keeps the accumulated multiplicity of each tuple and emits a change only on a crossing: an assertion when a tuple’s support rises from zero to positive, a retraction when it falls to zero, and nothing when support changes without crossing zero. Retract one of two edges that both witness a node as a source, and the lease emits nothing, because the node is still a source. Retract the last, and it emits the single retraction. A naive implementation that pushed the change through projection would get this wrong, and the difference is exactly the correctness of retraction under multiple derivation.
Recursion closes the construction. A recursive relation is the distinct of the union of its rules, with its own occurrence in the rule body fed back as a delayed input, which is the nested-stream construction of DBSP. On each write an inner semi-naive loop re-evaluates the recursive body through the same incremental join and distinct, seeing on the first round only the real change and on each later round only the frontier the previous round produced. The key-indexed traces persist across epochs, so the loop touches only the recursion layers the change reaches. The work is proportional to the change for the whole circuit, recursion included, and not only for its non-recursive part. The loop terminates because a re-derived fact that is already present produces an empty frontier, and it is correct under retraction because the accumulated state is a pure function of the facts: retract an input and the traces return to exactly the state before it was asserted.
5. Clean-room, with an oracle outside the build
The circuit is written in Gleam, in the substrate. No incremental-maintenance library is vendored, linked, or shipped. The algebra of DBSP is used as a way of reasoning about the circuit, which is a different thing from depending on a particular implementation of it.
Correct behavior is nonetheless defined by a reference, and the reference is the mature engine that the algebra comes from, run offline. It generates frozen fixtures, each a standing query and an input stream of changes paired with the output stream of changes the reference produced, and the clean-room circuit is checked change-for-change against them. A conformance oracle is not a dependency. It is never in the build, never in the package manifest, never on the deployed path; it exists only to say what the answer should have been. This is the established pattern of the substrate, the clean-room kernel checked against the canonical implementation of the thing it computes, applied here a third time. The same comparator also checks a second, obviously-correct reference evaluator written in the substrate, a plain fixpoint with multiset difference, so the circuit is checked against two independent statements of the same semantics.
6. Approximate operators and a bound on missing
Not every operator is a multiset homomorphism. Similarity match over the vector memory of PLRN-001, and optimal-transport distance over structured memory, are approximate by nature and do not compose into the exact circuit the way a join does. A standing query that depends on them inherits their error, and the error that matters is the false negative, the match the fast path silently drops, because a missed match is a lease that never fires and a failure no one observes. A false positive, by contrast, arrives as a change the consumer can inspect and discard.
The lease bounds the false negative with a calibrated correctness layer, in the manner of conformal risk control (ConRAD, Horchidan et al., 2026, arxiv:2605.03806). Each result carries a tag, fast and probabilistic or escalated and certified. A per-result gate, calibrated online against a sliding window of recent outcomes, decides which results may ride the fast path and which must escalate to the exact matcher, and it sets the threshold so that the realized rate of misses converges on the lease’s stated target. A consumer chooses its own point on the curve between latency and certainty. A compliance-critical lease chooses a recall target of one, the gate escalates every result, the stream carries nothing but certified changes, and the deterministic exact path is recovered as the limiting case of the same mechanism rather than as a second mechanism beside it. An escalated correction reconciles into the stream as an ordinary change, so the stream is eventually correct rather than instantly correct for the approximate operators, and a consumer that needs instant correctness sets the target that forbids the fast path.
7. One expressiveness, two axes of scale
Tiering is a question about execution, never about what a tenant may ask. Every tenant registers any query. Two axes vary underneath.
The first axis is the shape of the query. A held question that is the narrow fixed-shape crossing of section 1 runs on the fast path and detects its crossing in under fifty nanoseconds, at every tier. A held question with a join, a recursion, or a similarity match runs on the circuit.
The second axis is the scale of the tenant. The circuit runs in process for ordinary tenants and on a dedicated incremental-dataflow process for tenants at enterprise scale, with the output projected back so that a fast-path crossing component keeps its sub-nanosecond wakeup. What tiers is where the work runs and which path serves a given shape. Expressiveness does not tier. A small tenant’s recursive standing query is served in full; it runs on the in-process circuit rather than the fast path, and that is the whole of the difference.
8. What this does not give
The exact-relational core is built and runs: the lease abstraction, the signed-multiset change stream, the incremental circuit with join, distinct, and recursion, the conformance oracle and the fixtures, and the calibrated layer wired into the fixed-shape lease. The claims about that core are claims about running code checked against an oracle, not aspirations.
The approximate operators are not all built. Similarity match as a standing source rests on the vector primitive of PLRN-001, which is specified and partly in place, and optimal-transport similarity rests on the structured-memory certification path, which is still in design. Until those land, the approximate arm of section 6 is an architecture with a calibration machine proven on a synthetic oracle, not a measured production result. The recursion-through-an-approximate-operator case, where a similarity match sits inside a recursive rule, is designed and not implemented, and it activates only when the query language admits similarity inside recursion, which it does not yet.
The cost property is a property of the circuit, not a headline number. That the work tracks the change is established by construction and pinned by a separate benchmark on a workload where the view is far larger than the change, because it is invisible to a correctness check that compares small fixtures change for change. The benchmark is the place that claim is kept honest, and the hypothesis is registered before the measurement, not after.
9. Related work
The incremental algebra is DBSP, which gives a circuit semantics for incremental view maintenance over signed multisets with a clean treatment of recursion through nested streams (DBSP, Budiu et al., 2022, arxiv:2203.16684). The generalization of the weight from a count to an element of a ring, which lets the same circuit carry provenance alongside multiplicity, is the factorized-maintenance line (F-IVM, Kara et al., 2023, arxiv:2303.08583). The calibrated bound on the approximate operators is conformal risk control applied to neural databases (ConRAD, Horchidan et al., 2026, arxiv:2605.03806), with the online adaptive form drawn from adaptive conformal inference (Gibbs and Candès, 2021, arxiv:2106.00170). The treatment of recursion through an approximated operator, deferred here, follows the fixpoints-of-approximated-functions line (Charalambidis et al., 2025, arxiv:2501.08950), which is the same approximation-fixpoint family the substrate’s negation already uses.
The standing query as a held lease, priced by the change and uniform with the synchronous query, sits on the determinism composition of PLRN-002, the append-only retraction of PLRN-007, the vector memory of PLRN-001, and the substrate recursion of PLRN-005. What it adds to that substrate is one abstraction over the incremental machinery the substrate already had, and the calibrated correctness layer that the rest of the field does not yet carry.
A note on method
Written in conversation with Claude Opus 4.8 (Anthropic) as structured interlocutor and prose editor. The research backstop was assembled with Paper Lantern. The ideas, claims, framing, and architectural commitments are mine.
Kendall Clark · k@pentad.ai
Great Falls, Virginia
June 2026