The closure principle: why continuous ingestion follows

The principle itself

Suppose you know some proposition p. Suppose also you know that p entails q. If you competently deduce q from p, on the basis of that entailment, you thereby come to know q. This is the closure principle: knowledge is closed under known entailment. It sounds almost too modest to name. Of course deduction preserves warrant — that is roughly what deduction is for. But the principle earns its keep when you run it backwards. If you have competently deduced q from p, and it turns out you do not know q, then something upstream failed. Either you did not really know p, or p never entailed q, or the deduction was not competent. Nothing else is available. Deduction transmits warrant, and by the same channel it transmits rot. A premise that quietly stopped being true does not announce itself in the conclusion. The conclusion simply sits there, still valid in form, no longer warranted in fact, indistinguishable from the sound ones unless you go back and check the premise.

That asymmetry is the whole of the principle's power. It says nothing about how you first came to know p. It says only that once you know it, and once you correctly see what it entails, you are on the hook for the entailment. You cannot accept the premise, accept the inference, and then decline the conclusion. And symmetrically, you cannot keep the conclusion once the premise has gone false, no matter how attached you are to it, no matter how much work it did on the way down.

Put in slightly sharper terms: closure converts a fact about one proposition into a fact about a whole structure. Every conclusion drawn from p is now hostage to p's continued truth. The bigger the structure built on p, the more is at stake in whether p still holds.

Where it came from

Jaakko Hintikka gave the principle its formal shape in Knowledge and Belief (1962), modelling knowledge with operators that obeyed deductive constraints — treating "knows that" as a logical operator that behaves lawfully under inference, the way "necessarily" does in modal logic. The move was to make epistemic states tractable to logic at all, and closure fell out as close to definitional.

It became controversial almost immediately, and for a sharp reason. Fred Dretske's 1970 paper "Epistemic Operators" and Robert Nozick's 1981 Philosophical Explanations both attacked closure to disarm scepticism. If you know you have hands, closure says you know you are not a handless being deceived by a demon — because the first plainly entails the second. That consequence looks absurd to common sense, and both philosophers concluded that closure must fail: knowledge does not automatically transmit down every entailment you happen to notice.

Separately, and with no interest in scepticism at all, Jon Doyle gave the principle computational form in 1979 with truth maintenance systems: record the justification for every belief, and when a justification is withdrawn, retract everything that depended on it, along the recorded dependency chain. Doyle was not doing epistemology. He was trying to stop an automated reasoner from believing things forever after the reason for believing them had gone away. He built, without quite saying so, a machine for taking closure seriously in both directions — down through inference, and back up through revision.

The turn

Set three kinds of system against this principle and something falls out that was not put there on purpose.

A Large Language Model reasons from a corpus fixed at a training cutoff. Every inference it draws inherits the truth-value the world had on that date. The entailments themselves remain perfectly valid — the logic does not decay. But the premises can go false the day after the cutoff, and the model has no way to notice. There is no channel through which a defeater could arrive. This is not a claim that the model reasons badly. It is the more unsettling claim that it reasons validly from ground that has since shifted, and validity gives no signal that this has happened. Closure run backwards says: if the conclusion is now false and the deduction was sound, the premise went bad, silently, somewhere upstream.

A Large World Model adds live sensing and repairs this — but only for as long as a scene is in front of it. While the sensor is looking, defeaters can arrive: a door that was open is now shut, a lane that was clear now has traffic in it. The moment observation stops, or the moment the deductive cone extends past what the sensor covers, contamination resumes on exactly the Large Language Model's terms. The scene is bounded; the entailments drawn from it are not. A plan that reaches ten minutes past the last frame is reasoning from a premise no longer under observation.

A Large Universe Model is the position defined by refusing that boundary. Intake has no scheduled end. Beliefs are held with provenance — a record of what they were derived from — so that when a stream reports a change, everything derived from the superseded premise can be found and withdrawn, rather than merely outvoted by newer data sitting alongside it uncontradicted. This is Doyle's truth maintenance machinery, generalised: not a fixed reasoner with an occasional patch, but a structure built from the outset to let deduction run in both directions, forward for inference and backward for retraction.

The claim that falls out is precise. The epistemic cost of a stale premise is not proportional to the premise. It is proportional to the size of its deductive cone — everything validly drawn from it. A navigation database running an expired AIRAC cycle does not carry one wrong waypoint; it carries every approach, missed approach and holding pattern built on that waypoint, which is why the whole cycle is grounded rather than flagged fix by fix. LIBOR's cessation was one discontinued number sitting under something like USD 200 trillion of notional exposure in discount curves, swap valuations, loan resets and hedge tests; nobody could enumerate the damage by inspection, which is exactly why ISDA's 2020 fallbacks protocol had to trace dependencies contract by contract rather than announce a fix. The Surgisphere dataset was one fabricated table; between the WHO's suspension of a SOLIDARITY trial arm on its strength and its retraction by The Lancet, national guidance and clinical decisions had already begun drawing conclusions from a premise that was never sound, and the retraction reached the paper before it reached everything the paper had already caused.

Three objections, taken seriously

Dretske and Nozick showed closure fails for sceptical alternatives. If closure is false in general, the whole contamination argument loses its engine.

This is a good objection and it is right about the cases. Knowing the animal in the pen is a zebra does not require knowing it is not a painted mule, on the tracking accounts, because your evidence was never sensitive to that alternative in the first place. But that is a special failure at the sceptical edge, not a general one. Nobody who denies closure there wants to deny it for the mundane case: if the reference rate a valuation depends on is discontinued, the valuation is compromised, and no defender of Dretske thinks otherwise. The argument here needs only ordinary, tracked entailments — the kind that hold in engineering and finance and clinical guidance, not the kind built to embarrass the sceptic. Scope it that way and the objection narrows the claim without breaking it.

Real reasoning is Bayesian, not deductive — decay handles staleness, and full dependency tracking is computationally hopeless at scale.

Genuine ground is conceded here, twice. Decaying confidence in ageing evidence handles gradual staleness well and needs no open channel at all. But it fails precisely at discontinuities — a repealed regulation, a withdrawn drug, a closed runway — where no prior over elapsed time substitutes for the observation that the world actually changed. And full truth maintenance across a large belief set is indeed computationally hopeless in general. The answer is not omniscient recomputation; it is scoped tracking — record which premises a conclusion actually used, and invalidate along that recorded path, bounded work that nonetheless presupposes intake that has not closed.

The real work is provenance and revision, not intake as such. A modest feed with rigorous tracking beats indiscriminate ingestion with sloppy bookkeeping.

Half right, and the better half. Provenance is what turns an arriving defeater into a retracted conclusion; without it, more input is noise. But revision cannot fire on a defeater that never arrives, and a feed curated in advance is curated against a model of which premises might change — a model that is itself a premise, and can itself go stale. The intake claim is narrower than "ingest everything": it is that the channel must not be closed in advance. Which streams get weight, and how much, is real work — but it is downstream of position three, not a substitute for it.

What this does not license

The common misreading says one stale fact poisons an entire belief set, so nothing short of continuous total recomputation counts as knowledge at all. That is wrong on both halves. Contamination runs along recorded dependencies, not across the whole system indiscriminately. And false premises often yield true conclusions by accident; what closure actually costs you is warrant, not necessarily truth.

The narrower claim is the only one on offer. Without a channel for defeaters and a record of what depended on what, you cannot tell which conclusions have lost their warrant — not that all of them have. Position three is terminal on the intake axis in a specific sense: once every stream stays open and every belief carries its provenance, there is no further kind of evidence to admit, no fourth channel waiting to be built. What is left after that is not a bigger axis. It is scale, trust, and time — deciding which open channels deserve weight, and how fast.