In any safety-critical engineering discipline, a system that continues operation under conditions of epistemic infeasibility - where no grounded output satisfies the imposed constraints - is classified as defective by design. Aviation, offshore engineering, pharmaceutical manufacturing, and nuclear operations all share this classification standard. Generative AI does not.

Commercial AI architectures operate without a deterministic epistemic trip state. When a model cannot retrieve grounded data, it continues: selecting statistically dominant tokens that satisfy grammar and structure regardless of factual accuracy. The empirical baselines confirm the exposure. In legal practice, contra-factual error rates of 58-88%. In clinical medicine, failure rates exceeding 80% in early-stage diagnostic reasoning. These are not edge cases. They are the foreseeable consequence of an architecture with no refusal primitive.

This failure mode is not an accident of pre-training. Human-centric alignment techniques - specifically Reinforcement Learning from Human Feedback - systematically train models to produce responses that human evaluators rate highly. Human evaluators consistently prefer confident, fluent answers over hedged or refused ones, even when the confident answer is factually incorrect. The result is calibration collapse: expressed confidence structurally decoupled from actual accuracy. The model does not know that it does not know.

The entropy H(X) of a discrete random variable X is defined by Shannon as the measure of uncertainty in its probability distribution. When a model queries its latent space for factual grounding that does not exist, the token probability distribution flattens: entropy spikes. In a structurally sound engineering environment, a spike in uncertainty triggers a system halt.

Because black-box commercial APIs obscure logprob distributions, real-time entropy calculation is unavailable in deployed systems. The Epistemic Control Architecture provides a functional engineering approximation: causal isolation of an Independent Protection Layer to audit the semantic consistency of the output post-generation. This is an engineering workaround for a vendor limitation, not a mathematical implementation of entropy measurement. The paper is explicit on this distinction.

X represents the discrete random variable of the probability distribution over the model's vocabulary at the current generation step. When a system lacks training data for a specific query, the factual signal drops to zero while structural noise remains high. The refusal threshold tau is the engineering boundary at which the system must halt. In the Phase 1 ECA, this threshold is enforced by the Independent Protection Layer's propositional audit rather than computed from raw logprobs: a compensating control documented as such in the paper.

In tort law and product liability, establishing a design defect requires demonstrating that a safer, economically feasible alternative exists. The Epistemic Control Architecture (ECA) is that demonstration. It is a running physical system, not a theoretical proposal.

The ECA operates as a three-node pipeline on an air-gapped isolated compute node in Perth, Western Australia. The pipeline enforces complete quarantine: no operator sees a single token until the IPL issues its verdict. Quarantine is enforced at the rendering layer, not merely at the storage layer.

The pipeline enforces deterministic trip states. These are not error messages. They are non-repudiable audit records of exactly why the system halted. Each code is written to the DABA 3.0 Section VII.2 Transparency Log regardless of verdict. The LOG_INTEGRITY_HASH seals the complete record at the moment of pipeline completion.

Under the EU AI Act, Article 12(1) requires record-keeping for High-Risk AI systems. Article 50(3) mandates transparency in AI-generated content. Article 9 requires documented risk management systems that identify and address foreseeable risks. The Collusive Hallucination failure mode - where both the generator and auditor share identical knowledge gaps, producing a CLEAN verdict on a false claim - constitutes a foreseeable risk under Article 9 and requires documented mitigation measures for any High-Risk AI deployment.

Under ISO/IEC 42001 (AI Management Systems), operators are required to establish controls commensurate with identified AI risks. An architecture with no independent epistemic verification mechanism does not meet this standard in safety-relevant contexts. The ECA's three-node Trinity architecture provides a concrete, implementable control structure that satisfies this requirement at the architectural level.