The DCT Map

Put the enterprise into state, control, disturbance and operator form. Nothing may be optimized, certified or steered until this move is complete, because every later object is defined on the objects fixed here.

The move ends when four objects exist and their regularity has been checked: a state space with sufficiency, an admissible policy class closed under the operations the problem needs, a disturbance specification that is a set or a law rather than a forecast, and a law of motion satisfying Carathéodory-type conditions. Failure is common and is usually a failure of sufficiency — a dashboard of indicators presented as a state.

• Fix X and test sufficiency: does the future depend on history only through x(t)?
• Fix 𝒰_ad honestly, including irreversibility, lumpiness and state-dependent availability.
• Specify w as a set or a law — never as a point forecast.
• Check well-posedness before proceeding; an ill-posed representation makes everything downstream vacuous.

A well-posed controlled system, ready to be resolved into architectures.

Resolve the state into five architectures — state, transformation, capital, performance, risk — and study their internal structure and their cross-couplings. Analysis here is structural, not statistical: what depends on what, what can move before what, and what is priced by what.

Each architecture contributes a different kind of object to the eventual programme: state architecture contributes the precedence graph and the admissible set, transformation architecture the operator algebra and reachability, capital architecture the resource constraints, performance architecture the objective terms, risk architecture the constraints and ambiguity sets. The five are then unified rather than solved separately — the point of the move is to expose the off-diagonal coupling that siloed analysis hides.

• Five architectures, one state — the decomposition is of description, not of the enterprise.
• Structure first: precedence, admissibility, operator algebra, then measurement and exposure.
• The off-diagonal blocks of M are the whole reason integration is worth its cost.
• Output of this move is UETA: one law of motion consistent across all five layers.

The unified architecture U_E, with its coupling register made explicit.

Establish feasibility, viability, stability and cross-layer consistency, and record each as a witness that a third party can verify without re-running the model. Certification precedes optimization, because optimizing over the wrong set produces plans that are optimal and doomed.

The chain is ordered so that a failure localizes to one assumption. Kernel membership first: outside Viab(Ω) no admissible policy avoids eventual breach, so no optimization is meaningful. Spectral condition second: if the coupling loop amplifies, every multiplier and every total-effect argument is invalid. Lyapunov certificate third, for the specific trajectory chosen. Sensitivity last, because it states which unpinnable estimate the recommendation is resting on.

• Certificates are witnesses: expensive to find, cheap to check, verifiable by a sceptic.
• Order matters — kernel, then spectrum, then Lyapunov, then sensitivity to θ and to M.
• Non-normal coupling needs transient bounds as well as asymptotic ones.
• The output is an auditable chain, not a score.

A certified admissible set over which optimization is meaningful.

Pose and solve the General Enterprise Optimization Problem: maximize the value functional over admissible policies subject to the unified dynamics, path and terminal constraints, and risk limits. Volume I poses it; Volume II supplies six families of solution methods.

Two solution routes and one discipline. Pontryagin gives necessary conditions and the costate as shadow price of state; dynamic programming gives the value function and sufficiency through a verification theorem, at the cost of the curse of dimensionality. The discipline is that attainment, constraint qualification and time-consistency are settled before either route is run, and that whichever route is used, the answer is reported as a policy with an error bound rather than as a number.

• The decision object is a policy, not a choice: the problem lives in function space.
• Necessary conditions from Pontryagin; sufficiency from HJB plus verification.
• Multipliers and costates are the managerially useful output — internal prices of constraints and capital.
• Report the approximation error; an approximate policy with a bound beats an exact-looking number.

Optimal policies π*, value function V, multipliers λ and costates p.

Turn optimal policies into closed-loop managerial action: sequencing that respects the operator algebra, allocation that follows the multipliers, and an intelligence layer that approximates what cannot be solved exactly — inside an autonomy envelope that says where judgement is still required.

Execution is where the mathematics either binds or is quietly discarded. The two commonest failures are re-sequencing a roadmap for organizational convenience — which, because operators do not commute, produces a different terminal state than the one that was certified — and reallocating against multipliers that were computed under constraints that have since changed. Both are detectable, and both are reasons to re-solve rather than to improvise.

• Sequencing follows from non-commutativity; re-ordering the roadmap invalidates the certificate.
• Allocation follows the costates: fund until marginal values equalize, net of binding wedges.
• The intelligence layer approximates; the constraint layer certifies. Do not swap their jobs.
• The autonomy envelope states where the twin acts and where a human decides.

Roadmaps, allocations and mandates traceable to the solved programme.

Synchronize the digital twin with the live enterprise and watch the trajectory against the certified plan: state estimation under partial observation, tracking of the certificate conditions, and detection of model drift before it becomes a surprise.

Monitoring in this framework is not dashboarding: the quantities watched are the ones whose violation would invalidate a certificate. Distance to the boundary of the viability kernel, the current spectral radius of the coupling, the realized value against the modelled value, and the innovation sequence of the filter — an innovation sequence that stops looking like white noise is the earliest evidence that the model, not the enterprise, has moved.

• Estimate the state, report the posterior spread, and never present the point estimate alone.
• Watch certificate conditions, not indicators: distance to the kernel boundary, ρ(A), value gap.
• A non-white innovation sequence is the earliest warning that the model has drifted.
• A stale twin is worse than none: it carries the authority of quantification without the warrant.

A live estimate of the state and of the certificates' standing.

Re-solve as the state, environment and constraints move. Adaptation in DCT is a scheduled, principled re-optimization with fresh certificates, not an improvised deviation from a plan — and the framework specifies both the trigger and the procedure.

The move closes the loop back to Represent, and the loop is where the framework's claim to being dynamic is actually cashed. Two properties keep it from becoming thrashing: triggers are stated in advance as certificate violations rather than as discomfort, and each re-solution carries its own certificate chain, so the organization can see which assumption changed and what it cost. Where the criterion involves risk measures or non-exponential discounting, re-optimization must also check time-consistency, or successive re-solutions will reverse each other.

• Triggers are stated in advance as certificate violations, not as discomfort with results.
• Each re-solution carries a fresh certificate chain, so the changed assumption is visible.
• Time-inconsistent criteria make successive re-solutions reverse each other — check before re-solving.
• The loop returns to Represent: the state moved, so the representation is re-examined first.

A revised programme, with a new certificate chain and a recorded reason for the change.

Why and how do enterprises transform? DCT refuses the narrative answer and demands a mathematical one: a transformation is a trajectory t ↦ x(t) in a state space, generated by admissible controls against a realized environment, and graded by a functional defined on the whole trajectory rather than on its endpoint.

Posing transformation as a trajectory converts a management question into a well-posedness question, and well-posedness is a testable property. Four demands follow immediately and in order: existence of a trajectory for each admissible control (the Cauchy problem for the enterprise dynamics), uniqueness given (x₀, u, w) under Carathéodory-type measurability and local Lipschitz conditions, continuous dependence on data via a Grönwall estimate, and attainment of the supremum of J over 𝒰_ad, which is the Filippov–Cesari existence programme.

The methodological claim of Chapter 1 is not that narrative accounts of transformation are false but that they are unfalsifiable: with no state there is nothing to move, with no dynamics no counterfactual, with no objective no notion of error. DCT accepts a heavier burden of proof in exchange for refutability.

• A transformation is a controlled trajectory, not an episode with a beginning and a moral.
• Well-posedness — existence, uniqueness, stability, attainment — is the entry fee, not a technicality.
• Every object downstream on this map answers one clause of this question.
• The question fixes the burden of proof: represent, move, constrain, optimize, certify.

• Bellman (1957), Dynamic Programming
• Pontryagin et al. (1962), The Mathematical Theory of Optimal Processes
• Cesari (1983), Optimization — Theory and Applications

The enterprise exchanges resources and information with an environment it does not control, and revises its own policy in response. Openness forces an exogenous term w(·) into the dynamics; adaptation forces the control to be a measurable function of information rather than a schedule fixed at t = 0.

The distinction between open-loop u(·) ∈ L^∞([0,T]; U) and closed-loop π : [0,T] × X → U is not cosmetic. Under deterministic dynamics the two attain the same optimal value; under a non-degenerate disturbance they do not, and the gap is exactly the value of information. Adaptation is therefore a modelling commitment with a price attached: the admissible class becomes a set of policies, the optimization becomes a problem in function space, and dynamic programming becomes the natural solution apparatus.

Open adaptive systems also inherit a thermodynamic caution. A system that dissipates and imports is never at equilibrium in the Walrasian sense; steady states are at best stationary distributions or invariant sets, which is why viability and invariance, not equilibrium, are the right stability notions in Chapter 14.

• Openness enters the model as w(t) ∈ W, not as a caveat in the text.
• Adaptation makes the decision object a policy π, so the optimization lives in function space.
• Open-loop and closed-loop values coincide only in the degenerate deterministic case; the difference is the value of information.
• Equilibrium is the wrong idealization here — invariance and viability replace it.

• von Bertalanffy (1968), General System Theory
• Ashby (1956), An Introduction to Cybernetics
• Bertsekas & Shreve (1978), Stochastic Optimal Control: The Discrete-Time Case

Conventional strategy frameworks are static, fragmented and unoptimizable. They classify positions instead of generating motion, and they compress a high-dimensional enterprise into a handful of scalars — a projection that destroys precisely the coupling that makes transformation hard.

Four structural absences, each fatal on its own. No state: there is no x ∈ X whose motion could be studied, so all comparisons are cross-sectional. No dynamics: without F there is no counterfactual trajectory, hence no attribution of outcome to action. Scalar compression: a 2 × 2 grid is a map ℝⁿ → {1,2,3,4}, and any such map has level sets of codimension zero — enterprises in genuinely different positions are declared identical. No optimization formulation: with no objective functional and no admissible set, 'better' is undefined and recommendations cannot be ranked, only advocated.

The diagnosis matters for what comes next. Each absence is repaired by a specific object on this map, and the repair order is forced: state before dynamics, dynamics before control, control before optimality.

• Absent state: nothing whose motion could be studied, so every claim is cross-sectional.
• Absent dynamics: no counterfactual trajectory, therefore no attribution of outcome to action.
• Scalar compression: a 2 × 2 grid is a map ℝⁿ → {1,2,3,4} — distinct enterprises collapse to one cell.
• Absent optimization: no objective and no admissible set means 'better' is not defined.
• Each absence is repaired by a named object downstream, and the repair order is forced.

• Porter (1980), Competitive Strategy
• Teece, Pisano & Shuen (1997), 'Dynamic Capabilities and Strategic Management'
• Rumelt (1991), 'How Much Does Industry Matter?'

What is required is a representation that is simultaneously dynamic, controllable and optimizable. The four requirements are not a wish list but a minimal closure: drop any one and the framework degenerates back into description.

Read the quadruple as a control system in the sense of Sontag: X a state space with enough structure to support limits and distances, 𝒰_ad a set of admissible policies closed under the operations the problem needs, F a transition law with the regularity that makes trajectories exist and depend continuously on data, and J a functional with enough convexity or concavity structure that optimizers exist and first-order conditions are necessary.

The minimality claim is checkable by deletion. Delete J and the object is a simulation model — it can answer 'what if' but never 'what best'. Delete F and it is a scoring model. Delete 𝒰_ad and it is a forecasting model. Delete X and nothing remains. This is why Volume I develops all four in sequence before Volume II ever poses a solution method.

• State: where the enterprise is, in enough dimensions that the coupling survives.
• Dynamics: how it moves when acted upon, with regularity strong enough for well-posedness.
• Control: what management may choose, and the constraint set that makes 'may' precise.
• Optimization: which admissible choice is best, under a criterion stated before the analysis, not after.
• Minimality by deletion: drop J and you have a simulator; drop F and you have a scorecard.

• Sontag (1998), Mathematical Control Theory
• Luenberger (1979), Introduction to Dynamic Systems
• Stokey & Lucas (1989), Recursive Methods in Economic Dynamics

Sets, mappings, vectors, matrices, metrics and norms: the minimum vocabulary in which the four requirements can be written without ambiguity. Chapter 3 is not a refresher — it fixes which structures X is assumed to carry, and every later theorem cites one of them.

Each layer of structure purchases a specific capability and nothing more. Set and mapping give composition and feasibility. A metric gives distance-to-target and lets 'converging on the target state' mean something. A norm gives magnitude, so control effort and deviation from plan are comparable. An inner product gives projection and orthogonality, which is what makes least squares, Kalman filtering and variance decomposition available later.

Being explicit about which structure is in force prevents the commonest silent error in applied enterprise modelling: mixing ordinal, cardinal and categorical dimensions inside one vector and then computing a Euclidean distance over the mixture. If a dimension carries only an order, the norm is not defined on it, and Chapter 3 says so.

• Sets and mappings buy composition and feasibility; nothing else.
• Metric buys distance-to-target; norm buys magnitude of change and control effort.
• Inner product buys projection and orthogonality — the basis for estimation and variance decomposition.
• Mixing ordinal and cardinal dimensions in one vector and then taking a Euclidean norm is not permitted.

• Rudin (1976), Principles of Mathematical Analysis
• Aliprantis & Border (2006), Infinite Dimensional Analysis
• Horn & Johnson (2013), Matrix Analysis

Abstraction, decomposition, aggregation, validation and verification — the discipline that keeps an enterprise model both tractable and answerable to evidence. These are the practices that later harden into the certificate chain of Chapter 14.

Aggregation is the dangerous step and the one with a precise criterion. An aggregation map π : X → X̂ is consistent if the aggregated dynamics commute with it, π(F(x,u)) = F̂(π(x), u) — lumpability in the Markov setting, exact aggregation in the Leontief setting. When commutation fails, the aggregate model is not a coarse version of the truth, it is a different dynamical system, and its optimal policy need not be near-optimal for the disaggregated problem.

Verification and validation answer different questions and need different evidence: verification asks whether the model solves the equations it claims to solve (numerical convergence, invariant checking, dimensional consistency), validation asks whether those equations describe this enterprise (out-of-sample tracking, identifiability of θ, structural break tests).

• Abstraction and decomposition are the only real controls on dimension.
• Aggregation is admissible only when it commutes with the dynamics — lumpability, not convenience.
• Verification: does the model solve its own equations? Validation: are they this enterprise's equations?
• These practices become the audit and readiness chain once the architectures are coupled.

• Zeigler, Praehofer & Kim (2000), Theory of Modeling and Simulation
• Kemeny & Snell (1976), Finite Markov Chains (lumpability)
• Simon & Ando (1961), 'Aggregation of Variables in Dynamic Systems'

An n-dimensional evolving state vector in a state space X. Everything else in DCT acts on, measures, constrains or steers this object, and the choice of n is a modelling decision with consequences for identifiability, not a matter of taste.

The defining property is sufficiency: x(t) must summarize the past well enough that the future depends on history only through it. Formally, for all s > t the conditional law of x(s) given ℱ_t depends on ℱ_t only via x(t) and the control on [t,s]. A representation that fails sufficiency is not a state — it is a set of indicators, and dynamic programming does not apply to it.

Structure on X is inherited from the mathematical stack and each piece is load-bearing: completeness for limits of approximating sequences, separability for measurable selection of policies, local compactness of admissible sets for existence of maximizers, and a norm for the Grönwall and Lyapunov estimates. Where constraints curve the feasible set, X is treated as a manifold rather than ℝⁿ.

• Sufficiency is the test: the future must depend on history only through x(t).
• n is set by decomposition and identifiability, not by data availability.
• X carries metric, norm and sometimes inner-product structure — each used by a named later result.
• x(0) = x₀ is the initial condition of every transformation programme, and sensitivity to it is measurable.
• Indicator dashboards fail sufficiency, which is exactly why they cannot be optimized.

• Kalman (1960), 'A New Approach to Linear Filtering and Prediction Problems'
• Sontag (1998), Mathematical Control Theory, ch. 2
• Aliprantis & Border (2006), Infinite Dimensional Analysis

Managerial policies and actions drawn from the admissible control space U. Choosing u(·) well is the entire content of the optimization problem; specifying U honestly is what stops that problem from being a fantasy.

Two structural facts about 𝒰_ad drive almost everything in Volume II. First, state-dependence: U(x) is a correspondence, not a fixed set, because capital, governance and contractual position determine what is available. Existence of an optimal measurable policy then rests on measurable-selection theory — Kuratowski–Ryll-Nardzewski or Michael selection — rather than on ordinary compactness arguments.

Second, convexity: when U is non-convex the set of reachable states may be non-convex and maximizers may fail to exist, which is why relaxed (chattering) controls and the Filippov convexification of the velocity set appear in existence proofs. In enterprise terms this is the difference between 'invest 40% in digital' and 'run the digital programme 40% of the time' — the relaxed control that makes the mathematics work is not always an admissible managerial act, and the modeller must say which one is meant.

• U(x) is a correspondence: what is available depends on where the enterprise stands.
• Existence of an optimal measurable policy rests on measurable selection, not on compactness alone.
• Non-convex U can destroy existence; relaxed controls repair the mathematics but not always the management.
• Lumpy, irreversible and timing decisions belong here as integrality and switching constraints, not as afterthoughts.

• Bertsekas & Shreve (1978), Stochastic Optimal Control
• Aubin & Frankowska (1990), Set-Valued Analysis
• Warga (1972), Optimal Control of Differential and Functional Equations

Exogenous shocks, regime shifts and model ambiguity. The enterprise does not choose w(·); it must remain viable across the plausible range of it, which is why W is specified as a set and a law rather than a point forecast.

Three treatments of the same symbol, and the choice among them is a substantive commitment rather than a technical preference. Stochastic: w has a known law and the criterion is an expectation, so rare events are averaged away. Robust: w is adversarial within a set, the criterion is a worst case, and the resulting problem is a minimax dynamic game with a saddle-point requirement. Distributionally robust: the law itself is uncertain within an ambiguity set — a Wasserstein ball or a φ-divergence neighbourhood — which interpolates between the two and admits tractable convex reformulations.

Knight's distinction between risk and uncertainty is therefore not rhetorical in DCT: it selects which optimization problem is posed in Volume II, and the three choices generally have different optimal policies even on identical data.

• Stochastic, robust and distributionally robust are three different problems, not three attitudes.
• Worst-case formulations become dynamic games and need a saddle-point condition to be meaningful.
• Wasserstein and φ-divergence ambiguity sets give convex, tractable distributionally robust reformulations.
• The choice among the three is a modelling commitment that changes the optimal policy, not just its value.

• Knight (1921), Risk, Uncertainty and Profit
• Ben-Tal, El Ghaoui & Nemirovski (2009), Robust Optimization
• Mohajerin Esfahani & Kuhn (2018), 'Data-driven DRO using the Wasserstein metric'
• Hansen & Sargent (2008), Robustness

A mapping that carries one enterprise state to another under a chosen action and a realized environment. Its algebra — composition, feasibility, irreversibility, commutation failure — is what makes transformation programmes, rather than individual moves, analyzable.

Treat the admissible operators as a monoid under composition: closed, associative, with identity 'do nothing', but in general neither commutative nor invertible. Non-commutativity is the mathematical content of sequencing — T₂ ∘ T₁ ≠ T₁ ∘ T₂ means the order of a restructuring and a platform migration changes the terminal state, and the commutator measures by how much. Non-invertibility is the content of irreversibility: sunk reorganizations, lost capability, severed relationships.

Regularity of T is what the stack supplies. Continuity gives stability of programmes under small perturbation; a contraction property gives convergence of iterated application and a unique fixed point by Banach; monotonicity in a suitable order cone gives comparative statics without differentiability. Where T is only upper semicontinuous and set-valued, differential inclusions replace differential equations and Filippov's theory takes over.

• Admissible operators form a monoid: composition, identity, but neither commutativity nor inverses.
• Non-commutativity is sequencing; the commutator quantifies what reordering costs.
• Non-invertibility is irreversibility — the formal reason option value attaches to transformation timing.
• Contraction gives a unique fixed point and convergence of repeated application (Banach).
• Set-valued or discontinuous T moves the analysis to differential inclusions.

• Banach (1922), fixed-point theorem
• Filippov (1988), Differential Equations with Discontinuous Righthand Sides
• Topkis (1998), Supermodularity and Complementarity

The operator written as a law of motion, in discrete or continuous time, parameterized by θ. This is the constraint that every optimization in Volume II is solved subject to, and the object whose regularity decides whether that optimization is well posed at all.

Existence and uniqueness are not formalities here. Carathéodory conditions — measurability in t, continuity in (x,u), local Lipschitz in x with an integrable bound — give a unique absolutely continuous solution, and Grönwall's inequality converts the Lipschitz constant into an explicit bound ‖x₁(t) − x₂(t)‖ ≤ e^Lt‖x₁(0) − x₂(0)‖ on divergence of nearby trajectories. That bound is the honest statement of forecast horizon for a transformation plan.

θ is where econometrics enters and where most applied failures live. Identifiability asks whether distinct θ generate distinguishable trajectory laws; without it, calibration fits and policy advice does not transfer. Continuous dependence on θ is what licenses sensitivity analysis of the optimal policy, and its derivative is the object the Architectural Jacobian generalizes to the coupled system.

• Discrete time for decision cycles, continuous time for analysis, control and comparative statics.
• Carathéodory conditions plus Grönwall give uniqueness and an explicit divergence bound — a forecast horizon.
• θ carries estimation, calibration and identification; unidentified θ makes policy advice untransferable.
• Continuous dependence on (x₀, θ) is the licence for every sensitivity result downstream.

• Hartman (2002), Ordinary Differential Equations
• Khalil (2002), Nonlinear Systems
• Hansen & Sargent (2013), Recursive Models of Dynamic Linear Economies

The dynamics placed on a filtered probability space: transition kernels, the Markov property, Brownian and jump drivers, and Monte Carlo evaluation. The filtration is what makes 'the information available at time t' a precise object rather than a figure of speech.

Adaptedness is the whole discipline. A control that is not ℱ_t-adapted uses information the enterprise does not have, and every implementable plan must satisfy this measurability constraint — it is the formal statement of 'no hindsight'. Itô's formula then converts the dynamics into the generator 𝒜 acting on test functions, and the generator is what appears in the Hamilton–Jacobi–Bellman equation of Volume II.

Jump components are not decoration. Diffusion models drift and noise in ordinary operations; compound Poisson and more generally Lévy drivers model the discontinuous transformation events — acquisitions, regulatory shocks, defaults — whose presence makes the value function's smoothness fail and pushes the analysis to viscosity solutions and quasi-variational inequalities. Where the state is only partially observed, the Kushner–Stratonovich or Zakai equation for the conditional law replaces the state equation, and the control problem is posed on the space of measures.

• Adaptedness to ℱ_t is the no-hindsight constraint every implementable policy must satisfy.
• Itô's formula produces the generator 𝒜; the generator is what enters the HJB equation.
• Diffusion for ordinary noise, Lévy and compound-Poisson jumps for discontinuous transformation events.
• Jumps and constraints break classical smoothness — viscosity solutions become necessary, not optional.
• Partial observation replaces the state equation with a filtering equation on the space of measures.

• Karatzas & Shreve (1991), Brownian Motion and Stochastic Calculus
• Øksendal & Sulem (2019), Applied Stochastic Control of Jump Diffusions
• Bain & Crisan (2009), Fundamentals of Stochastic Filtering

The state space given structure: dimensions grouped into a hierarchy, dependencies and admissibility constraints made explicit, and an Enterprise Topology — a graph-theoretic dependency structure over the state, deliberately distinct from the point-set topology carried in the mathematical stack.

The Enterprise Topology is a directed graph of precedence over state coordinates, and its structure is diagnostic. Acyclicity permits a topological order and hence a staged transformation programme; a strongly connected component is a block of dimensions that must move together, and no sequencing can decouple them. The condensation of 𝒢 into its strongly connected components is therefore the formal object behind 'what can be phased and what cannot'.

Two cautions the chapter is explicit about. First, this graph is not a topology in the point-set sense; the deliberate name collision is resolved by keeping the two objects in separate chapters, with the stack supplying convergence and the architecture supplying precedence. Second, the decomposition X = ⊕_k X_k is a direct sum of coordinate blocks, not an orthogonal decomposition of the dynamics — the blocks interact, and that interaction is what the coupling register later records.

• A structured state space, not a flat vector: hierarchy, blocks, and explicit admissibility set Ω_S.
• Precedence graph 𝒢: which dimensions can move only after others have moved.
• Acyclic 𝒢 ⟹ a topological order ⟹ a legitimately phased programme.
• Strongly connected components are blocks that must move together — the formal limit of phasing.
• Distinct from point-set topology: precedence here, convergence in the stack.

• Harary (1969), Graph Theory
• Simon (1962), 'The Architecture of Complexity'
• Baldwin & Clark (2000), Design Rules

The operator family organized into programmes: admissible compositions, transformation pathways, reachability of target states, and the stability of the motion those pathways generate.

A transformation pathway is a word in the operator alphabet, and the architecture is the grammar that says which words are admissible. Reachability then asks whether a target x* lies in ℛ(x₀), and controllability asks whether ℛ(x₀) covers the feasible set. For linear dynamics these reduce to a rank condition on the Kalman controllability matrix; for nonlinear dynamics to the Lie-algebra rank condition of Chow–Rashevskii, and the honest finding is usually that the reachable set is strictly smaller than the feasible set.

Stability of the pathway is a separate question from reaching the target. A programme can reach x* and fail to hold it, which is why the architecture carries Lyapunov and invariance arguments alongside reachability. The distinction between 'we can get there' and 'we can stay there' is precisely the distinction between reachability and viability, and it is what Chapter 14 turns into a certificate.

• Pathways are words in the operator alphabet; the architecture is the grammar of admissible words.
• Reachability: is the target in ℛ(x₀)? Controllability: does ℛ(x₀) cover the feasible set?
• Rank conditions (Kalman, Chow–Rashevskii) decide reachability; the reachable set is usually strictly smaller than hoped.
• Reaching a target and holding it are different theorems — the second needs invariance, not reachability.

• Kalman (1963), 'Mathematical Description of Linear Dynamical Systems'
• Sontag (1998), Mathematical Control Theory
• Isidori (1995), Nonlinear Control Systems

What transformation consumes: financial, human, technological, innovation, governance, relational and strategic capital — each carried as a dimension of the state, none permitted to be a scalar proxy for the others.

Capital enters twice and the two roles must not be conflated. As a state, each capital accumulates and depreciates with its own law and its own δ_k; human and relational capital in particular depreciate on attention, not on time. As a constraint, the requirement c(x) ≥ r_α determines which operators are admissible, which is how a resource limit becomes a restriction on the reachable set rather than a penalty in the objective.

Whether the seven capitals substitute or complement is an empirical question with sharp formal consequences. If the production structure is complementary — Leontief-like in the limit — then the binding capital dominates the programme and shadow prices are extremely uneven; if substitution is easy, allocation becomes a smooth convex problem and multipliers are comparable across capitals. The seven-dimensional treatment exists so that this question can be asked at all, rather than assumed away by a single 'investment' variable.

• Seven capitals carried as state dimensions: financial, human, technological, innovation, governance, relational, strategic.
• Capital acts twice: as accumulating state with its own depreciation, and as an admissibility constraint on operators.
• Resource limits restrict the reachable set; they are not penalties bolted onto the objective.
• Substitution versus complementarity decides whether shadow prices across capitals are comparable or wildly uneven.
• Allocation across capitals becomes a control, and its multiplier is the internal price of that capital.

• Leontief (1986), Input–Output Economics
• Arrow, Chenery, Minhas & Solow (1961), 'Capital–Labor Substitution'
• Dixit & Pindyck (1994), Investment under Uncertainty

How the enterprise is measured: financial, operational, innovation, governance and ESG performance. This is the layer that supplies the objective functional its terms, so every modelling sin committed here is inherited by the optimum.

Measurement is a map h from state to observable outcome, and three of its properties matter. Observability: can x be recovered from the history of y? If not, the performance layer cannot support the closed-loop policies the framework assumes, and a filter must be introduced. Aggregation weights: writing L = ⟨λ, y⟩ imposes a scalarization, and by the standard results in multi-criteria optimization a fixed λ recovers only the convex part of the Pareto frontier — which is why Volume II treats multi-objective methods separately rather than tuning weights.

Incentive response: because y is both the criterion and the reported number, Goodhart's law is a dynamical statement in this framework — measurement changes h, and a performance architecture that ignores the feedback from measurement to behaviour is misspecified in a way no amount of estimation repairs.

• Five performance dimensions mapped by h : X × U → ℝ^m.
• Observability decides whether closed-loop policies are implementable or need a filter first.
• Fixed weights λ recover only the convex hull of the Pareto frontier — a real limitation, not a nuance.
• Goodhart's law is a misspecification of h, not a moral observation.
• Supplies both the running term L and the terminal term Φ in GEOP.

• Kaplan & Norton (1996), The Balanced Scorecard
• Miettinen (1999), Nonlinear Multiobjective Optimization
• Holmström & Milgrom (1991), 'Multitask Principal–Agent Analyses'

Exposure and endurance: financial, operational, strategic, cyber, governance and environmental risk, together with resilience, robustness, stress treatment and ambiguity. This architecture supplies the constraints and ambiguity sets that Volume II optimizes against.

Risk, resilience and robustness are three distinct mathematical objects and the framework refuses to blur them. Risk is a functional ρ on random outcomes; if it is to support optimization without producing incentives to split positions, it must be coherent in the sense of Artzner, Delbaen, Eber and Heath — which excludes value-at-risk and admits conditional value-at-risk, the latter with the Rockafellar–Uryasev convex representation that makes it usable inside a programme. Dynamic consistency adds a further requirement, time-consistency of the conditional risk mappings, which rules out naive iteration of static measures.

Resilience is a hitting time: how long until the trajectory re-enters a neighbourhood of the target after a shock. Robustness is a worst-case value over a perturbation set. A programme can be highly resilient and not robust (it recovers, but from a much worse place each time) or robust and brittle (it never moves far, but cannot recover when it does). Certifying both, separately, is what the risk architecture contributes to the readiness chain.

• Risk measures used in optimization must be coherent — VaR is not; CVaR is, and is convex-representable.
• Dynamic problems additionally need time-consistent risk mappings, not iterated static ones.
• Resilience is a hitting time; robustness is a worst case over a perturbation set. Different objects, different certificates.
• Six risk dimensions; cyber and environmental carry fat tails that make expectation-based criteria misleading.
• Supplies the ambiguity sets 𝒫 and the path constraints that bind in Volume II.

• Artzner, Delbaen, Eber & Heath (1999), 'Coherent Measures of Risk'
• Rockafellar & Uryasev (2000), 'Optimization of Conditional Value-at-Risk'
• Shapiro, Dentcheva & Ruszczyński (2021), Lectures on Stochastic Programming

One enterprise under five descriptions. The coupling register M records how each architecture moves the others, and the unified dynamics replace five separate models with a single law of motion that is consistent across layers — the object Volume I analyzes and Volume II optimizes.

The unification is a statement about consistency, not about size. Five separately estimated architecture models will in general disagree: the capital model's implied hiring path will not be the one the performance model prices, and the risk model's stress path will not be the one the transformation model can execute. Imposing one state, one law of motion and one admissible set removes that inconsistency by construction, and the coupling register is where the cross-layer terms are made visible and auditable instead of being hidden in separate calibrations.

Formally the interest is in the off-diagonal blocks. A block-diagonal M means the architectures are independent and the enterprise decomposes into five separate control problems, which is the case in which conventional siloed practice is defensible. Any non-trivial off-diagonal structure makes the optimal policy for the whole differ from the concatenation of the five separately optimal policies, and the size of that difference is the quantitative case for integration.

• One enterprise, five descriptions — not five models with five calibrations.
• Coupling register M: who moves whom, by how much, and with what lag.
• Block-diagonal M is exactly the case where siloed management is optimal; off-diagonal terms measure the cost of silos.
• Cross-layer consistency is imposed by construction, then verified by certificate.
• Differentiating this system is what produces the Architectural Jacobian.

• Simon (1962), 'The Architecture of Complexity'
• Mesarović, Macko & Takahara (1970), Theory of Hierarchical, Multilevel Systems
• Lasdon (1970), Optimization Theory for Large Systems

The set of states the enterprise is permitted to occupy once architecture constraints, resource limits, governance rules and policy commitments are all imposed simultaneously. Feasibility is a property of a state, and it is weaker than anything worth calling sustainable.

The geometry of Ω governs everything computational downstream. Closedness plus boundedness gives compactness and hence existence of maximizers of continuous criteria (Weierstrass); convexity gives sufficiency of first-order conditions and uniqueness of projections; a non-empty interior gives Slater's condition and therefore strong duality with finite multipliers. Where Ω is defined by many active inequalities with empty interior, multipliers can fail to exist and the problem must be regularized before any solver is trusted.

In enterprise terms the interesting pathology is non-convexity from integrality and from logical constraints ('either the platform migration or the acquisition, not both in the same year'), which turns Ω into a disjunctive set. Its convex hull is what solvers actually work with, and the gap between the two is where most apparent optimality in practice quietly lives.

• Compactness gives existence of maximizers; convexity gives sufficiency of first-order conditions.
• Non-empty interior (Slater) is what guarantees finite multipliers and strong duality.
• Integrality and either/or commitments make Ω disjunctive and non-convex; the relaxation gap matters.
• Feasible today ≠ sustainable: that distinction is the viability kernel's job.

• Rockafellar (1970), Convex Analysis
• Boyd & Vandenberghe (2004), Convex Optimization
• Nemhauser & Wolsey (1988), Integer and Combinatorial Optimization

The subset of the feasible region from which the enterprise can remain feasible indefinitely under some admissible control. Being feasible today is not the same as being sustainable: outside the kernel, every admissible policy eventually violates a constraint, however well managed.

Aubin's viability theorem is the result that makes the kernel computable in principle: for a Marchaud set-valued dynamic and a closed constraint set, Ω is viable if and only if at every boundary point the velocity set meets the Clarke tangent cone T_Ω(x). The kernel itself is the largest closed viable subset of Ω, obtained as the limit of a decreasing sequence of set-valued approximations — a fixed point in the space of closed sets, not a solution of an equation.

The managerial reading is uncomfortable and is the point. A state can satisfy every covenant, ratio and policy limit today and still lie outside Viab(Ω), meaning that no sequence of admissible decisions avoids eventual breach: the breach is already determined, only its date is open. Optimization over Ω rather than over Viab(Ω) therefore produces policies that look optimal and are guaranteed to fail, which is why the certificate chain requires kernel membership before any GEOP solution is accepted.

• Outside Viab(Ω) every admissible policy eventually breaches — the failure is determined, only the date is open.
• Viability theorem: tangency of the velocity set to the Clarke tangent cone at every boundary point.
• The kernel is the largest closed viable subset: a fixed point in the space of sets, computed by set-valued iteration.
• Capture basins and the invariance kernel are the companion objects for 'can reach' and 'cannot leave'.
• Optimization is meaningful only over the kernel; over Ω it certifies plans that are guaranteed to fail.

• Aubin (1991), Viability Theory
• Aubin, Bayen & Saint-Pierre (2011), Viability Theory: New Directions
• Clarke (1983), Optimization and Nonsmooth Analysis

Differentiate the unified dynamics and the coupling register becomes a matrix. Its spectral radius is the stability indicator: whether a disturbance in one architecture damps as it travels the coupling loop, or returns amplified.

Linearize the unified system at a reference trajectory and the local behaviour is governed by the spectrum of A = ∂f/∂x. In discrete time, ρ(A) < 1 gives local asymptotic stability and a convergent Neumann series; in continuous time the condition is that every eigenvalue has negative real part. The relevant subtlety for enterprise work is non-normality: a matrix can satisfy ρ(A) < 1 and still produce large transient amplification, measured by the numerical abscissa or by pseudospectra. A programme can therefore be asymptotically stable and still blow through a covenant on the way.

Two further properties earn their place in the diagnosis. Block structure: the dominant eigenvector says which architecture drives the loop, and its participation factors say which couplings to cut first. Sign structure: if the linearization is Metzler or the system monotone, then Perron–Frobenius applies, the dominant eigenvalue is real and simple, and comparative statics are unambiguous — a rare and useful situation.

• ρ(A) < 1 in discrete time: cross-layer feedback damps around the loop.
• ρ(A) ≥ 1: the architectures amplify each other and the programme is dynamically unstable.
• Non-normal A can be asymptotically stable and still amplify transiently — check pseudospectra, not only eigenvalues.
• The dominant eigenvector identifies the driving architecture; participation factors rank which coupling to cut.
• Monotone or Metzler structure brings Perron–Frobenius and unambiguous comparative statics.

• Horn & Johnson (2013), Matrix Analysis
• Trefethen & Embree (2005), Spectra and Pseudospectra
• Berman & Plemmons (1994), Nonnegative Matrices in the Mathematical Sciences

The total long-run impact of an intervention once it has propagated around every coupling, rather than the first-round effect a single architecture would report. The series converges precisely when the spectral radius condition holds, which is what ties this multiplier to the stability diagnosis.

(I − A)⁻¹ = Σ_k≥0 A^k whenever ρ(A) < 1, and each term has a reading: A⁰B is the direct effect of the intervention, AB the effect after one pass through the couplings, and so on. The multiplier is thus a Leontief inverse for the enterprise rather than for an economy, and the same warning applies: the entries are total requirements, valid only while the linearization and the coupling coefficients hold.

Divergence is informative rather than merely inconvenient. If ρ(A) ≥ 1 the series has no sum, and the correct conclusion is not that the multiplier is large but that no finite total effect exists at the linearized level — the programme must be restructured to damp the loop before any allocation argument based on total effects can be made at all.

• Total, not first-round, effect of a decision: Σ A^kB, term by term interpretable.
• Exists as a convergent Neumann series exactly when ρ(A) < 1 — the same condition as stability.
• A Leontief inverse for the enterprise; entries are total requirements under a fixed linearization.
• Divergence means no finite total effect exists, not that the effect is merely large.
• Turns coupling into an allocation argument: rank interventions by total, not local, response.

• Leontief (1986), Input–Output Economics
• Berman & Plemmons (1994), Nonnegative Matrices
• Horn & Johnson (2013), Matrix Analysis, §5.6

Lyapunov and stability arguments, propagation sensitivity, kernel membership and cross-layer consistency checks, assembled into an auditable chain that states whether a transformation programme is fit to run — and says in whose terms it would fail.

A certificate is a witness: an object whose existence can be checked independently of the argument that produced it. A Lyapunov function is the canonical example — finding V may require ingenuity or a sum-of-squares programme, but verifying V̇ ≤ 0 is mechanical, and that asymmetry is what makes the claim auditable by a third party who does not trust the modeller.

The chain is ordered so that failure localizes. Kernel membership first, because optimizing outside Viab(Ω) is meaningless; then spectral stability, because an unstable loop invalidates every multiplier; then the Lyapunov certificate for the chosen trajectory; then sensitivity of the optimal value to θ and to the coupling coefficients, which is the quantitative statement of how much the recommendation depends on estimates nobody can pin down. A board that reads the chain in this order learns not just whether the plan passes but which assumption it is standing on.

• A certificate is a witness — hard to find, cheap to verify, and verifiable by someone who distrusts the modeller.
• Lyapunov certificates can be searched for by sum-of-squares programming when F is polynomial.
• The chain is ordered so failure localizes: kernel, then spectrum, then Lyapunov, then sensitivity to θ.
• Sensitivity of the optimal value states how much the recommendation rests on unpinnable estimates.
• This is the artefact a board or regulator can inspect without re-running the model.

• Khalil (2002), Nonlinear Systems
• Parrilo (2003), 'Semidefinite programming relaxations for semialgebraic problems'
• Boyd, El Ghaoui, Feron & Balakrishnan (1994), Linear Matrix Inequalities in System and Control Theory

The hinge of the framework: choose the transformation policy that maximizes long-run enterprise value subject to the unified dynamics, path and terminal constraints, risk limits and architectural consistency. Volume I poses it; Volume II solves it, method by method.

Two routes to a solution, and the framework uses both because each answers a different question. The variational route forms the Hamiltonian ℋ = L + ⟨p, F⟩ and applies the Pontryagin maximum principle: an optimal u*(t) maximizes ℋ pointwise, the costate satisfies ṗ = −∂ℋ/∂x with p(T) = ∇Φ(x(T)), and p(t) is the shadow price of the state — the marginal value of an extra unit of any capital, in the objective's units. Necessary conditions only, and with path constraints they acquire measure-valued multipliers.

The dynamic-programming route posits the value function V(t, x) = sup 𝔼[Φ + ∫L] and derives the HJB equation ∂_tV + sup_u∈U{ L + 𝒜^uV } = 0 with V(T, ·) = Φ. Sufficient where a solution exists, but the value function is generally non-smooth at constraint boundaries and after jumps, so solutions are taken in the viscosity sense (Crandall–Lions) and the verification theorem is what converts a candidate into an optimum. Both routes suffer the curse of dimensionality in a five-architecture state, which is precisely why Volume II is a catalogue of methods rather than a single algorithm.

Three well-posedness questions must be settled before either route is used: attainment of the supremum (Filippov–Cesari conditions on convexity of the velocity set and growth of L), time-consistency of the criterion when risk measures or non-exponential discounting are present — absent it the 'optimal' policy is one no future decision-maker will follow — and constraint qualification, without which multipliers need not exist.

• Decision object: the policy π or trajectory u(·) — not a single choice at a single date.
• Pontryagin route gives necessary conditions and the costate p(t), the shadow price of state.
• HJB route gives sufficiency via a verification theorem, in the viscosity sense where V is not smooth.
• Path constraints bring measure-valued multipliers; jumps bring quasi-variational inequalities.
• Time-inconsistency from risk measures or hyperbolic discounting must be resolved, not ignored.
• Solution objects carried forward: policies π, value function V, multipliers λ, costates p.

• Pontryagin et al. (1962), The Mathematical Theory of Optimal Processes
• Fleming & Soner (2006), Controlled Markov Processes and Viscosity Solutions
• Yong & Zhou (1999), Stochastic Controls: Hamiltonian Systems and HJB Equations
• Clarke (1983), Optimization and Nonsmooth Analysis

Convex and nonlinear programming, KKT conditions, duality and sensitivity: the case where time and uncertainty are deliberately switched off so that the structure of the constraint geometry can be seen and priced.

The static case is where the multiplier earns its interpretation. Under a constraint qualification — Slater for convex problems, LICQ or MFCQ otherwise — KKT conditions are necessary, and λ_i is the derivative of the optimal value with respect to relaxing constraint i: the internal price of a governance limit, a covenant or a capital ceiling. Strong duality closes the gap between the primal programme and its dual price system, and the dual is often the object management should be reading.

Conic reformulation is what makes this practical at enterprise scale: second-order cone and semidefinite representations cover risk-return constraints, chance constraints under ellipsoidal uncertainty, and robust counterparts, all with polynomial-time interior-point methods and reliable certificates of optimality.

• Multipliers are prices: λ_i = ∂(optimal value)/∂(constraint level).
• Constraint qualification is what makes KKT necessary — check Slater or MFCQ before trusting a solver.
• Duality turns the programme into a price system, often the more useful managerial object.
• SOCP and SDP reformulations cover risk-return and robust constraints with certified optimality.

• Boyd & Vandenberghe (2004), Convex Optimization
• Bertsekas (1999), Nonlinear Programming
• Ben-Tal & Nemirovski (2001), Lectures on Modern Convex Optimization

Dynamic optimization and optimal control: the Pontryagin maximum principle, dynamic programming and the Bellman equation, and the Hamilton–Jacobi–Bellman framework in continuous time — with the approximation machinery that makes them computable in five coupled architectures.

Blackwell's conditions make the Bellman operator a contraction on a space of bounded functions, so value iteration converges geometrically at rate β and the fixed point is unique; policy iteration converges in finitely many steps for finite action sets and is a Newton method on the Bellman residual. These are the results that license numerical dynamic programming at all.

Dimension is the binding constraint, not theory. With a five-architecture state the tensor grid is hopeless, so the practical apparatus is approximate dynamic programming: basis-function or neural approximation of V, least-squares Monte Carlo for conditional expectations, and duality-based bounds that bracket the true value so that an approximate policy can be reported with an error estimate rather than a claim.

• Contraction (Blackwell) gives uniqueness and geometric convergence of value iteration.
• Policy iteration is Newton's method on the Bellman residual — few, expensive steps.
• Continuous time: HJB with viscosity solutions; verification converts a candidate into an optimum.
• Five coupled architectures force approximate dynamic programming plus duality bounds on the error.

• Bertsekas (2012), Dynamic Programming and Optimal Control
• Powell (2011), Approximate Dynamic Programming
• Kushner & Dupuis (2001), Numerical Methods for Stochastic Control Problems

Stochastic, robust and distributionally robust optimization over Wasserstein ambiguity sets, with neuro-fuzzy treatment where the uncertainty is linguistic rather than distributional. Three formalisms for the same symbol w, each with its own notion of a good decision.

Two-stage and multistage stochastic programmes are convex in the recourse structure but grow with the scenario tree, and their honest evaluation requires the sample-average approximation theory that bounds the optimality gap in N. Robust counterparts replace the tree with a set and, for ellipsoidal or polyhedral sets and affine dependence, give tractable conic reformulations of the same size as the nominal problem.

Distributionally robust optimization over a Wasserstein ball of radius ε is the formulation with the best statistical warrant: the radius can be calibrated to a finite-sample confidence level, the worst-case expectation admits a strong dual as a finite convex programme, and the resulting policies are provably regularized versions of the sample-average ones. It is the natural home for tail risk that is real but rare — cyber, regulatory, climate — where an empirical distribution is not to be believed and a point forecast is worse.

• Sample-average approximation comes with an optimality-gap bound in N — report it.
• Robust counterparts for ellipsoidal or polyhedral sets stay the same size as the nominal problem.
• Wasserstein DRO: radius ε calibrates to a confidence level; the dual is a finite convex programme.
• DRO policies are regularized sample-average policies — the connection is exact, not metaphorical.
• Fuzzy and neuro-fuzzy treatment where the uncertainty is linguistic, not distributional.

• Shapiro, Dentcheva & Ruszczyński (2021), Lectures on Stochastic Programming
• Ben-Tal, El Ghaoui & Nemirovski (2009), Robust Optimization
• Mohajerin Esfahani & Kuhn (2018), 'Data-driven DRO using the Wasserstein metric'

Multi-objective optimization, Pareto frontiers, and decomposition and coordination across architectures and business units — the methods that handle the fact that five architectures do not share one criterion and one solver cannot see the whole state.

Scalarization by fixed weights is the default and it is lossy: weighted sums recover only the convex portion of the Pareto set, so genuinely attractive non-convex compromises are invisible to it. ε-constraint and reference-point methods recover the rest; the Chebyshev and achievement-scalarizing forms are the ones with a completeness guarantee. Choosing a point on the frontier is a governance act, and the framework's position is that it should be made explicitly, after the frontier is computed, not implicitly through weights chosen beforehand.

Decomposition is the structural counterpart. Dantzig–Wolfe and Benders split the programme by architecture or business unit and coordinate through prices or cuts; the subgradient-based dual coordination converges slowly but its iterates are interpretable — each λ is a transfer price that the units respond to. Non-convexity leaves a duality gap, and that gap is the formal reason a decentralized organization cannot always be coordinated by prices alone.

• Weighted sums see only the convex part of the frontier; ε-constraint and Chebyshev methods see all of it.
• Compute the frontier first, choose on it second — weights chosen beforehand hide the governance decision.
• Dantzig–Wolfe and Benders coordinate architecture-level subproblems by prices or cuts.
• Dual coordination prices are transfer prices: interpretable, and directly implementable as internal policy.
• A duality gap is the formal reason prices alone cannot always coordinate a decentralized enterprise.

• Miettinen (1999), Nonlinear Multiobjective Optimization
• Conejo et al. (2006), Decomposition Techniques in Mathematical Programming
• Lasdon (1970), Optimization Theory for Large Systems

Machine learning, Markov decision processes, reinforcement learning, explainable AI and hybrid AI–optimization schemes: the layer that supplies function approximation and policy learning where the model is too large to solve exactly or too poorly specified to be trusted.

The MDP is the same object as the Bellman recursion above, restated so that P may be unknown and sampled rather than specified. What changes is the epistemic status of the answer: with a known model, dynamic programming returns a policy with an error bound; with a learned model or model-free learning, the guarantees are asymptotic or high-probability and depend on exploration, function-approximation error and the mismatch between training and deployment distributions. Policy-gradient and actor–critic methods converge to stationary points, not global optima, and off-policy evaluation is where most silent failure occurs.

For enterprise use, the framework's position is hybrid rather than substitutional. Learning is used where it is strong — approximating V or Q in high dimension, learning F's residual structure, screening scenarios — while the constraint and viability structure stays in the optimizer, where it can be certified. Safe and constrained RL with shielding keeps the learned policy inside Viab(Ω), and explainability is a governance requirement here, since a policy no one can interrogate cannot be certified and therefore cannot be adopted.

• An MDP is the Bellman recursion with P unknown and sampled — the mathematics is the same, the guarantees are not.
• Policy gradient and actor–critic reach stationary points, not global optima; off-policy evaluation is the weak joint.
• Hybrid by design: learning approximates value and residual dynamics, the optimizer keeps the constraints.
• Constrained and shielded RL keeps learned policies inside the viability kernel.
• Explainability is a certification requirement: an uninterrogable policy cannot be adopted.

• Puterman (1994), Markov Decision Processes
• Sutton & Barto (2018), Reinforcement Learning
• Bertsekas (2019), Reinforcement Learning and Optimal Control

The enterprise digital twin: state synchronization with the live enterprise, scenario simulation, model-predictive control for closed-loop adaptation, and an explicit autonomy envelope that says which decisions the twin may take unaided.

Receding-horizon control is where DCT becomes operational: the finite-horizon GEOP is re-solved as the state is re-estimated, and only the first action of each solution is used. Its stability is not automatic — the standard guarantee requires a terminal cost and terminal constraint set that are control-invariant, which is exactly the viability kernel material of Chapter 14 reappearing as a numerical device. Without that terminal ingredient, a well-tuned MPC controller can be recursively infeasible, which in enterprise terms is a plan that is optimal each quarter and cumulatively fatal.

Synchronization is a filtering problem: a Kalman filter where the linear-Gaussian structure holds, an unscented or particle filter where it does not. The twin's credibility rests on reporting the posterior spread, not the point estimate, and on tracking model drift — a twin that has silently stopped matching the enterprise is more dangerous than no twin, because it carries the authority of quantification. The autonomy envelope is the formal answer: state-dependent bounds within which the twin may act, outside which a human decision is required.

• MPC re-solves the finite-horizon problem and applies only the first action — closed loop by construction.
• Recursive feasibility needs a control-invariant terminal set: the viability kernel returning as a numerical device.
• Synchronization is filtering — report the posterior spread, not just the point estimate.
• Model drift detection is mandatory; an unnoticed stale twin carries unearned authority.
• The autonomy envelope is state-dependent: inside it the twin acts, outside it a human decides.

• Rawlings, Mayne & Diehl (2017), Model Predictive Control
• Mayne et al. (2000), 'Constrained model predictive control: stability and optimality'
• Särkkä (2013), Bayesian Filtering and Smoothing

Transformation roadmaps, sequencing decisions and policy design that follow from a solved GEOP rather than from workshop consensus — with the sequencing justified by operator non-commutativity and the phasing limited by the precedence graph.

A roadmap in this framework is the projection of an optimal policy onto the calendar, and it inherits two formal properties worth stating to a board. Sequencing is not a preference: because the operators do not commute, reordering two initiatives changes the terminal state, and the roadmap's order is a computed consequence of that algebra. Phasing is bounded: the strongly connected components of the precedence graph cannot be split across phases, so a roadmap that phases them anyway is not a slower plan but a different and infeasible one.

Timing carries option value. Where a transformation operator is irreversible and the environment is uncertain, the optimal policy generally waits longer than a net-present-value rule suggests, and the size of that delay is computable from the same value function that produced the roadmap.

• Order is computed, not negotiated: non-commuting operators make sequencing a consequence of the algebra.
• Phases cannot split a strongly connected block of the precedence graph.
• Irreversibility plus uncertainty produces an optimal delay, quantifiable from the value function.
• Every milestone traces to a constraint, a multiplier or a viability condition — not to a workshop.

• Dixit & Pindyck (1994), Investment under Uncertainty
• Topkis (1998), Supermodularity and Complementarity

Allocation across the seven capitals, scenario analysis, and strategy stated with its risk adjustment attached rather than appended. The multipliers from the solved programme are the internal prices that make allocation decidable.

Allocation is read off the dual. The costate p_k(t) is the marginal value of capital k at time t in the objective's own units, so the allocation rule 'fund until marginal values equalize' is not an analogy here but the first-order condition itself, subject to the correction that binding constraints drive wedges between capitals that no budgeting process can arbitrage away.

Risk adjustment enters through the criterion, not afterwards. A programme optimized under expectation and then stress-tested is not the same object as a programme optimized under a coherent risk measure, and the two generally differ in allocation, not merely in reported risk. Stating which was done is part of the deliverable.

• Costates are internal prices of capital; equalizing marginal values is the first-order condition.
• Binding constraints drive permanent wedges between capitals — budgeting cannot arbitrage them away.
• Optimizing under a coherent risk measure and stress-testing an expectation-optimal plan are different objects.
• Scenario results are reported as conditional policies, not as a single adjusted number.

• Rockafellar & Uryasev (2000), 'Optimization of Conditional Value-at-Risk'
• Merton (1990), Continuous-Time Finance

Running the twin against the live enterprise, with the AXIOM computational laboratory as the teaching and experimentation surface: the same model objects, exposed for students to perturb, re-solve and break.

The laboratory closes the loop from theory to evidence. A student changes a coupling coefficient and watches the spectral radius cross one; raises a covenant and watches the viability kernel shrink; switches the criterion from expectation to CVaR and watches the allocation move. These are the experiments that make the framework's claims falsifiable in a classroom rather than merely stated.

• The same objects as the manuscript — state, operators, coupling register, GEOP — exposed for experiment.
• Parameters that change conclusions are the ones worth teaching: ρ(A), ε, δ, the coupling coefficients.
• Reproducibility is part of the pedagogy: pinned environment, seeded runs, saved scenario definitions.

Managerial decisions that carry their certificates with them, worked end to end through the Meridiam Industrial Group integrated case — the same decision taken twice, once with the certificate chain and once without, so the difference is visible.

A certified decision is a triple: the policy, the certificate chain that establishes it is admissible and stable, and the sensitivity statement that says which estimates it depends on. The case study exists to show that the third element is usually the one that changes the decision, and that a recommendation without it is an opinion with better notation.

• A certified decision is policy plus certificate chain plus sensitivity statement — all three, or none.
• The integrated case runs one decision with and without the chain to make the difference concrete.
• What a board can audit: kernel membership, spectral condition, Lyapunov witness, value sensitivity.

Sets, relations, mappings and correspondences: the vocabulary in which a state space, an admissible control set and a transformation operator can be defined at all. Nothing in DCT is stated before this layer, and two of its results are load-bearing rather than decorative.

Two set-theoretic facts do real work later. The axiom of choice, in its measurable form, is what lets a pointwise argmax be assembled into a policy: the Kuratowski–Ryll-Nardzewski selection theorem gives a measurable selector for a measurable closed-valued correspondence, and without it 'choose the best action in each state' need not define a measurable, hence implementable, policy. Zorn's lemma underlies the maximal-element arguments used for existence of undominated programmes.

Correspondences, not functions, are the right primitive for admissibility: U(x) is set-valued, and its regularity is stated as upper or lower hemicontinuity of the graph rather than continuity. Berge's maximum theorem then delivers what economics and control both need — continuity of the value function and upper hemicontinuity of the argmax correspondence — under compact-valued continuous U and continuous objective. Nearly every comparative-statics claim downstream is a corollary of Berge.

• Correspondences, not functions, are the primitive for state-dependent admissibility.
• Kuratowski–Ryll-Nardzewski: measurable selection is what makes a pointwise argmax an implementable policy.
• Berge's maximum theorem: continuity of the value function, upper hemicontinuity of the argmax.
• Cardinality and product structure fix what 'dimension' means before any norm is introduced.

• Aliprantis & Border (2006), Infinite Dimensional Analysis, ch. 17–18
• Berge (1963), Topological Spaces
• Kuratowski & Ryll-Nardzewski (1965), 'A general theorem on selectors'

Neighbourhoods, open sets, continuity and convergence: what it means for a transformation operator to be continuous, for a trajectory to converge, and for a feasible set to be closed. The layer where stability first becomes expressible.

Compactness is the property that matters most and it is genuinely topological: by Weierstrass, a continuous real functional on a compact set attains its supremum, which is the existence half of every optimization statement in the framework. In infinite dimensions — policy spaces, measure spaces — norm compactness fails and one works instead with the weak or weak-* topology, where Banach–Alaoglu restores compactness of the closed unit ball and direct methods in the calculus of variations become available.

Lower semicontinuity, not continuity, is the right hypothesis for minimization: the direct method requires only that the functional be sequentially lower semicontinuous along minimizing sequences in a topology in which sublevel sets are compact. This is exactly why relaxation and convexification appear in existence proofs for optimal control — the velocity set is convexified so that weak limits of minimizing sequences remain admissible.

• Weierstrass on compact sets is the existence half of every optimization claim in DCT.
• In infinite dimensions use weak-* topology and Banach–Alaoglu; norm compactness is unavailable.
• Lower semicontinuity, not continuity, is the correct hypothesis for the direct method.
• Closedness of Ω is a topological statement and is what makes the viability kernel well defined.

• Munkres (2000), Topology
• Aliprantis & Border (2006), Infinite Dimensional Analysis
• Dacorogna (2008), Direct Methods in the Calculus of Variations

Separation axioms. In a Hausdorff space limits are unique, so an enterprise trajectory cannot converge to two different states, and the phrase 'the steady state' refers to one object rather than to whichever the argument happens to need.

T₂ is cheap for the spaces DCT actually uses — every metric space is Hausdorff — but stating it is not pedantry, because two constructions leave the metric world. Quotient spaces from aggregation need not be Hausdorff: if the aggregation map does not separate distinct enterprise configurations, the quotient carries non-unique limits and 'the aggregate steady state' is ill defined. Spaces of sets under the Hausdorff distance, used for viability kernels, are Hausdorff only after restricting to closed sets, which is why the kernel is defined as the largest closed viable subset.

Beyond T₂, normality (T₄) is what gives Urysohn's lemma and hence the existence of the smooth bump functions and partitions of unity used to construct Lyapunov certificates and to patch local controllers into a global policy.

• Unique limits: the precondition for 'the steady state' to name one object.
• Aggregation quotients can fail Hausdorff — a formal warning about lossy aggregation.
• Hausdorff distance on closed sets is why the viability kernel is defined as the largest closed viable subset.
• Normality gives Urysohn and partitions of unity — the tools for patching local certificates into global ones.

• Munkres (2000), Topology
• Rockafellar & Wets (1998), Variational Analysis, ch. 4

Distance between enterprise states: how far x(t) is from a target x*, whether it is getting closer, and at what rate. The layer at which convergence acquires a speed and fixed-point arguments become available.

Banach's fixed-point theorem on a complete metric space is the workhorse: it gives existence and uniqueness of the fixed point, a constructive iteration, and the a-priori error bound d(x_n, x*) ≤ kⁿd(x₀, x₁)/(1−k). Value iteration in dynamic programming is precisely this theorem with k = β, which is why discounting is not a modelling convenience but the source of the convergence guarantee.

The choice of metric is a modelling act with consequences. Weighted and Bielecki-type metrics change which maps are contractions without changing the topology, and this is how unbounded or long-horizon problems are brought inside the contraction framework. On sets rather than points, the Hausdorff metric makes set-valued iterations converge — the basis for viability-kernel algorithms — and on probability measures the Wasserstein metric plays the same role, which is where distributionally robust optimization gets its geometry.

• Banach fixed point: existence, uniqueness, a constructive scheme and an explicit error bound.
• Value iteration is Banach with k = β; discounting is where the convergence rate comes from.
• Weighted metrics turn non-contractions into contractions without changing the topology.
• Hausdorff metric for set-valued iteration; Wasserstein metric for ambiguity sets over distributions.

• Banach (1922)
• Stokey & Lucas (1989), Recursive Methods in Economic Dynamics, ch. 3
• Villani (2009), Optimal Transport: Old and New

Norms give magnitude: the size of a state change, the effort in a control, the deviation from plan. Once magnitudes exist, so do growth bounds, Lipschitz constants and every quantitative stability estimate in the framework.

The operator norm and the spectral radius are different numbers and the difference is exactly the transient-amplification phenomenon that matters in coupled architectures. Gelfand's formula ρ(A) = lim ‖Aⁿ‖^1/n says they agree asymptotically; for non-normal A they can differ substantially at finite n, so a system with ρ(A) < 1 can amplify a shock by orders of magnitude before decaying. Reporting only the spectral radius of the Architectural Jacobian is therefore an incomplete stability statement.

In finite dimensions all norms are equivalent, so the choice affects constants and not conclusions; in the infinite-dimensional policy spaces of Volume II it affects which sequences converge, and the choice becomes substantive. Dual norms are what give multipliers their magnitudes, which is why sensitivity bounds are always stated with respect to a specified pair.

• Operator norm bounds the spectral radius; equality only in the limit (Gelfand).
• Non-normal coupling: ρ(A) < 1 with large transient amplification — report both numbers.
• Finite dimensions: all norms equivalent. Policy spaces: the choice decides what converges.
• Dual norms set the magnitude of multipliers, hence the units of every sensitivity bound.

• Horn & Johnson (2013), Matrix Analysis
• Trefethen & Embree (2005), Spectra and Pseudospectra

Completeness makes limits of approximating sequences exist; the inner product makes projection, orthogonality and least squares available. Together they are the setting in which every approximation scheme in Volume II is justified.

Completeness is what converts 'the iterates are getting closer to each other' into 'the iterates converge to something in the space' — Cauchy implies convergent. Every numerical scheme in the framework, from value iteration to Galerkin approximation of the HJB equation, relies on this, and the Neumann series that defines the enterprise multiplier converges in operator norm for the same reason.

Hilbert structure adds orthogonality and therefore the projection theorem: a closed convex set admits a unique nearest point, projections are non-expansive, and conditional expectation is exactly the orthogonal projection of L² onto the sub-σ-algebra generated by available information. That identification is the reason least-squares Monte Carlo works: the conditional continuation value is a projection, and regression estimates it. The Riesz representation theorem then identifies multipliers with elements of the space itself, which is what gives shadow prices their concrete form.

• Cauchy ⟹ convergent: the licence for every approximation scheme used later.
• Neumann series converges in operator norm when ‖A‖ < 1 — the enterprise multiplier lives here.
• Conditional expectation is orthogonal projection in L²; least-squares Monte Carlo follows directly.
• Riesz representation gives multipliers a concrete form, hence interpretable shadow prices.
• Projection onto a closed convex set is unique and non-expansive — the basis of proximal methods.

• Luenberger (1969), Optimization by Vector Space Methods
• Conway (1990), A Course in Functional Analysis
• Longstaff & Schwartz (2001), 'Valuing American options by simulation'

Local coordinates on a curved state space, for the case where constraints make X something other than a flat vector space: simplices of shares, positive-definite covariance blocks, ratio and rotation constraints.

Where the admissible set is a smooth manifold, optimization should respect the geometry rather than penalize deviations from it: gradients become Riemannian gradients, straight-line steps become retractions or geodesics, and convergence theory carries over with curvature-dependent constants. Allocation vectors on a simplex, correlation and covariance blocks in the cone of positive-definite matrices, and rotation-like governance structures are the concrete DCT cases.

The tangent-space condition ẋ ∈ T_xX is also the smooth ancestor of the viability tangency condition: viability theory replaces the tangent space of a manifold with the Clarke tangent cone of a merely closed set, which is what lets the same geometric idea survive kinks, corners and inequality constraints.

• Simplices, positive-definite blocks and ratio constraints make X curved, not flat.
• Riemannian gradients and retractions respect the constraint geometry instead of penalizing it.
• The tangent-space condition is the smooth ancestor of the viability tangency condition.
• Clarke tangent cones extend the same geometry to closed sets with kinks and corners.

• Lee (2013), Introduction to Smooth Manifolds
• Absil, Mahony & Sepulchre (2008), Optimization Algorithms on Matrix Manifolds
• Rockafellar & Wets (1998), Variational Analysis

Measure-theoretic probability and filtrations: the only precise way to say what the enterprise knows and when. Everything about information, adaptedness and conditioning in DCT is a statement about σ-algebras.

The filtration is the formal content of 'information available at t', and requiring a control to be ℱ_t-adapted is the formal content of 'no hindsight'. Conditional expectation is defined by the Radon–Nikodym theorem, and the tower property 𝔼[𝔼[·|ℱ_s]|ℱ_t] = 𝔼[·|ℱ_t] for t ≤ s is exactly what makes the Bellman recursion legitimate — dynamic programming is the tower property applied to a value functional.

Two further results are used without ceremony and should not be. The Doob–Dynkin lemma identifies ℱ_t-measurable random variables with measurable functions of the observed history, which is what licenses writing a policy as π(t, x). Girsanov's theorem allows a change of measure and is the machinery behind risk-neutral valuation and behind the entropic penalties used in robust control — where the ambiguity radius is a relative-entropy budget, the worst-case measure is an exponential tilt.

• Adaptedness to ℱ_t is the no-hindsight constraint; every implementable policy satisfies it.
• The tower property is what makes the Bellman recursion legitimate — dynamic programming is iterated conditioning.
• Doob–Dynkin licenses writing a policy as a measurable function of the observed state.
• Girsanov change of measure underlies both risk-neutral valuation and entropic robust control.
• Almost-sure statements: 'never breaches' means ℙ-a.s., and the null sets have to be named.

• Williams (1991), Probability with Martingales
• Folland (1999), Real Analysis
• Hansen & Sargent (2008), Robustness

Brownian motion, Poisson and jump processes, Lévy drivers and Markov chains: the concrete disturbance models the enterprise dynamics are driven by, each with a generator that determines the form of the optimality equation.

The generator is the bridge from process to equation: whichever driver is chosen, 𝒜^u is what appears in the HJB equation, so the modelling choice of driver is the choice of which PDE or integro-differential equation must be solved. A pure diffusion gives a second-order parabolic equation; adding jumps gives a non-local integro-differential operator whose solutions are generally only viscosity solutions and whose numerical treatment differs in kind.

The Markov property is what makes the state sufficient and hence makes dynamic programming applicable; where it fails — path dependence through backlogs, reputation, or contracts with memory — the honest repairs are state augmentation or working with path-dependent equations. Semimartingale structure is the minimal requirement for Itô calculus, and heavy-tailed drivers with infinite variance break the moment conditions that expectation-based criteria silently assume.

• The driver determines the generator, and the generator determines the optimality equation.
• Jumps give a non-local operator and viscosity solutions — a different numerical problem, not a harder one.
• The Markov property is what makes the state sufficient; path dependence is repaired by augmentation.
• Heavy tails break the moment conditions that expectation criteria assume without saying so.

• Karatzas & Shreve (1991), Brownian Motion and Stochastic Calculus
• Protter (2005), Stochastic Integration and Differential Equations
• Cont & Tankov (2004), Financial Modelling with Jump Processes

Objectives, constraints, multipliers and policies: the apparatus that turns the unified dynamics into a solvable problem. This is the rung of the stack on which GEOP itself stands.

Multipliers are derivatives of the optimal value, and that identification is the single most useful fact in the apparatus: λ prices a constraint, the costate p(t) prices the state, and Danskin's theorem and the Milgrom–Segal envelope results say when those derivatives exist and how to compute them without re-solving. Where the value function is non-differentiable, subdifferentials replace gradients and the statements survive in Clarke's generalized form.

The maximum principle and dynamic programming are two faces of one object: under sufficient regularity p(t) = ∇_xV(t, x(t)) along the optimal path, so the costate is the gradient of the value function. Necessary conditions from the first route and sufficiency from the second are used together — a candidate is constructed from the maximum principle and then certified by a verification theorem.

• Multipliers are value derivatives: λ prices a constraint, p(t) prices the state.
• Danskin and the envelope theorem give those derivatives without re-solving the problem.
• Costate = gradient of the value function along the optimal path; the two routes are one object.
• Construct with the maximum principle, certify with a verification theorem.
• Non-smoothness is handled by subdifferentials, not by assuming it away.

• Clarke (1983), Optimization and Nonsmooth Analysis
• Seierstad & Sydsæter (1987), Optimal Control Theory with Economic Applications
• Milgrom & Segal (2002), 'Envelope theorems for arbitrary choice sets'