The controller's inheritance
A network controller inherits three kinds of evidence and owns none of their origins. Track circuits report occupation and, by absence, broken rail. Rolling-stock telemetry — axle box temperature, wheel-impact load, brake pipe pressure — arrives from trains that were built, inspected and certified somewhere else entirely. Weather stations report rail temperature, and rail temperature is the variable that turns a hairline defect into a buckle on a 32°C afternoon. None of these streams was generated for the controller's benefit. Each was bred in its own lineage — signalling engineering, rolling-stock maintenance, meteorology — and none of them anticipated the others. The controller's job is to hold a synthesis that none of the source systems intended to produce.
This is the condition the Large Language Model, Large World Model, Large Universe Model progression names precisely. A model trained once on historical fault logs is a closed lineage: whatever pattern it can recognise was present, distributed across past incidents, at the moment training stopped. A model that also takes the current occupation of the block section is doing something more: it is acquiring from outside its training corpus, but only for the duration of that scene. The Large Universe Model position is that rail safety cannot be reduced to either of those. It requires every stream — track circuit, telemetry, weather, maintenance record — held open simultaneously, each observation tagged with where it came from and how stale it has become, any of it able to overturn a belief the system formed an hour ago from a different stream.
The characteristic failure of the domain makes the case without needing biology at all. A wheel-impact load reading climbs across three consecutive passes. A section of rail has been due for ultrasonic testing for six days because the possession window was cancelled for a signalling fault elsewhere. Rail temperature crosses the stress-free threshold at 14:20. None of these three facts, alone, triggers a speed restriction. Together, read against each other, they describe a defect propagating toward failure. The restriction gets applied at 15:05, after a track circuit drops out and the section is declared failed outright — after propagation, not at onset. The evidence for early action existed in three different systems, none of which was built to talk to the others, and the controller was the only place they could have met.
Two positions on what the controller should be given
Position one: the controller's authority should rest on continuous, cross-stream synthesis, because the failure mode above is not an edge case — it is what happens whenever four independently-bred systems are expected to converge only in a human head under time pressure. Under this view, the fix is architectural: keep every stream live, let a belief about a section's condition be revised the moment any stream disagrees with it, and record which stream produced which belief so that a bad sensor can be discounted without discarding the whole picture. This is, structurally, horizontal gene transfer applied to infrastructure: capability — in this case, the capability to see a defect early — is acquired from a source outside the recipient's own lineage of maintenance history, and it must be acquired continuously, because the moment of onset cannot be scheduled.
Position two: this is exactly backwards, and rail operations has forty years of institutional memory saying so. Signalling systems are interlocked and closed by design because closed, provable systems fail predictably and open, synthesising ones fail unpredictably. Every additional stream a controller must weigh in real time is an additional way for the controller to be wrong, and the controller is a human with a fixed attentional budget, not a database. The proper response to the 15:05 incident is not more intake but better-scheduled inspection: shorten the possession cycle so ultrasonic testing happens before six days elapse, and let temperature thresholds trigger their own automatic restriction without waiting on a person to correlate three unrelated numbers. Fix the schedule. Do not ask the controller to become a fusion engine for streams that were never designed to be fused.
Both positions are held by serious people in the industry, and both are defensible on the record. Position one is right that the fault which produced the 15:05 failure was, in the fullest sense, an intake failure: the information needed to act early existed and was not synthesised. Position two is right that adding streams to a human controller's board without redesigning the controller's authority and workload simply moves the failure mode from "missed correlation" to "overloaded operator," and there is direct evidence for this: signal passed at danger incidents cluster around periods of high information load, not low.
If the controller's board carries every stream at once, the controller becomes the single point of failure for the whole railway's sensing apparatus, and no amount of provenance tagging changes the fact that a tired person is still doing the fusion.
That objection is not answered by more architecture. It is answered, if at all, by moving the fusion below the level of individual attention — automated correlation that surfaces a synthesised belief ("section 4, rising defect probability, three streams agree") rather than raw streams, with the controller retaining authority to accept, query or override it. That is a narrower claim than either position above, and it is where this page is heading.
The biology underneath, briefly
Lynn Margulis proposed in 1967 that mitochondria descend from free-living bacteria engulfed by an ancestral cell — a capability, aerobic respiration, that arrived from outside the recipient's genome entirely. Sequencing eventually vindicated her. Around the same period, researchers investigating Shigella dysentery outbreaks in Japan found antibiotic resistance moving between Shigella and E. coli without any descent relationship at all — a conjugative plasmid, the R factor, carrying resistance genes across a species boundary in the time it takes two bacteria to touch. Both findings broke the assumption that a lineage's capability is bounded by its own ancestry. Inheritance, for bacteria and for the eukaryotic cell, is a network, not only a tree.
The unflattering part of that story matters here as much as the triumphant part. Most horizontally transferred genetic material in bacteria is neutral or actively harmful, and the majority of it is purged within a few million years. Symbiosis and gene transfer are not evidence that more intake is always better; they are evidence that a lineage able to acquire capability from outside itself needs machinery to accept, trace and discard what it acquires. Bacteria carry restriction-modification systems and CRISPR arrays for exactly this reason — to reject foreign DNA that isn't worth the risk. Unfiltered transfer is not symbiosis. It's infection.
Answering the two objections that bite hardest here
The first objection: most cross-stream correlations will be noise, and a controller drowning in flagged correlations is worse off than one working from a stable, closed set of rules. This is correct, and the rail evidence backs it — most temperature-based stress warnings do not precede a buckle, most rising wheel-impact readings do not precede a broken rail. The answer is not fewer streams but cheaper retraction. A synthesised belief that carries its provenance — this flag came from WILD site 14 and a temperature model, not from a human judgement — can be downgraded the moment WILD site 14 is found to be miscalibrated, without the controller having to re-derive trust in every other flag raised that shift. Provenance is what makes a high false-positive rate survivable rather than paralysing.
The second objection: vertical improvement — better maintenance scheduling, better interlocking, better training — accounts for nearly all of the railway's safety gains historically, and cross-stream synthesis is a marginal addition to a system that mostly works by disciplined repetition. This is also correct as a claim about frequency, and it concedes the structural point rather than defeating it. The 15:05 failure was rare precisely because most defects are caught by scheduled inspection. But the rare cases are the ones the schedule cannot anticipate — onset does not wait for the possession window — and a system optimised only for the anticipable is exactly the one that misses the transition. Scheduling and synthesis are not competitors for the same budget; one handles the median case, the other the tail the median case cannot see.
Where this narrows
Neither position wins outright. Continuous, provenanced synthesis across track circuit, telemetry and weather is the only architecture that catches onset rather than propagation — that much survives. But it cannot be delivered as raw intake to a controller's attention without redesigning where the fusion happens and what authority it carries; that much the second position establishes and the first must concede. The terminal claim on intake is narrower than "give the controller everything": it is that a defect's evidence, wherever it arises, must be held as a revisable, sourced belief rather than a stream the controller reconstructs from memory under pressure — and that belief, not the raw stream, is what should reach the human who still decides whether to slow the railway down.