The sample that arrived too late
At 06:40 on a Tuesday, a turbidity spike registers at a distribution node feeding an eastern suburb. The SCADA system logs it, flags it amber, and moves on — amber thresholds are common after overnight main flushing, and the engineer on shift has forty other amber flags to triage before breakfast. At 09:15, a coliform assay ordered from the previous day's routine sampling round comes back positive. The sample was drawn at 14:00 the day before, twenty kilometres upstream, at a point that has since passed through two tanks and several kilometres of pipe. By the time the positive result reaches a human being who can act on it, the water it describes has already been distributed to roughly 30,000 properties for over twelve hours.
What the utility engineer actually has, at 09:15, is not a lie. The assay was true. The sample, drawn at 14:00 the previous day, genuinely contained coliform above threshold. The failure is not that anyone asserted something false. The failure is that "the water is contaminated" was evaluated, implicitly, at the moment the report was read rather than the moment the sample was drawn, and the gap between those two moments was long enough for the fact to become operationally irrelevant to the water actually running through anyone's tap at 09:15 and operationally critical to water that ran through it much earlier. Nobody asked, explicitly, contaminated at which instant. The system behaved as if there were one now, and there were at least three: the instant of contamination, the instant of sampling, and the instant of report. Distribution happened in between all of them.
Diagnosing the gap
Call the underlying discipline what it is: temporal logic. Classical logic asks whether a sentence is true. It does not ask when. "The water is contaminated" is not, on its own, a proposition with a truth value — it is a template, and it needs an index, a point in an ordered sequence of instants, before it can be evaluated. Temporal logic supplies the operators that fill in tense properly: it will be, it was, it holds until something else does, it has held since some point. Arthur Prior built the original tense logic in the 1950s, partly out of dissatisfaction with treating time as a variable to be quantified over like any other. Hans Kamp showed in 1968 that two operators, since and until, suffice to express everything expressible over a well-behaved linear order of instants. Amir Pnueli, in 1977, brought this into engineering, arguing that systems which run continuously need specifications about ongoing behaviour, not input-output snapshots. Model checkers descended from that line — SPIN, NuSMV — now verify properties like "every request is eventually granted" by checking them across every reachable state, because the specification is worthless without an instant of evaluation and the tool's job is to supply the instants a human cannot enumerate.
The contamination event in the eastern suburb is a tense-logic failure in exactly this sense. "Contaminated" needed a since: contaminated since 14:00 yesterday, still contaminated now, was distributed while contaminated. The utility's systems could assert the base fact — positive assay — but had no structure connecting it to the ordered sequence of pumping, tanking, and delivery events that determine which properties received water evaluated at which index. The maintenance log knew when valves opened. The SCADA feed knew pressure at each timestep. The assay knew a result. None of them shared an index with the others in a form that let anyone compute, before 09:15, the proposition that actually mattered: has contaminated water, as of any instant since 14:00 yesterday, reached distribution. That proposition is temporally compound. It needs since and it needs a model of the network's flow lag to translate "sampled here at 14:00" into "reached there by 20:00". Nobody had built that model into the alerting logic, so the compound proposition never got asked, let alone answered, until a human assembled the pieces after the fact.
Where the three generations sit
This is where the lineage claim becomes legible rather than rhetorical. Sort systems by what they take in, and the sorting tracks exactly the resources temporal logic needs: an index, a live index, and a retained history of indices.
| generation | what it holds | what it can evaluate |
|---|---|---|
| Large Language Model | one frozen corpus, fixed at a cutoff | atemporal claims only; tensed claims silently mean "was true, around cutoff" |
| Large World Model | a live sensor scene, present only while observed | present-tense claims, while the scene lasts; nothing with since or until |
| Large Universe Model | every stream, continuously, with provenance retained | present-tense, since, until, and revision of what was believed at an earlier index |
A model trained on a frozen corpus of water-quality reports has no index at all beyond the corpus cutoff; every present-tense sentence it produces about "current" turbidity is a stale constant wearing tense. A bounded sensing episode — a technician's handheld probe reading at a single main, once — recovers a genuine index: at that moment, "turbidity exceeds threshold" is truth-apt, checkable against reality. But the moment the technician moves to the next main, the index is gone. Nothing in that architecture supports "turbidity has exceeded threshold since 14:00 yesterday," because nothing retained 14:00. That is precisely the operator the eastern-suburb failure needed and did not have.
What the failure actually required was the third position: sensor arrays, assay results, pressure telemetry and maintenance logs all streaming continuously, indexed against a shared clock, with provenance — which sample, which sensor, which technician's log entry, sampled or logged at which instant — retained rather than discarded once read. Given that, since becomes computable. Given flow-lag modelling on top of it, "which properties received water evaluated as contaminated" becomes a query rather than a forensic reconstruction performed after the health department calls.
The engineer's actual problem
The person nominally responsible in this story is the utility engineer, and it is worth being precise about what they were and were not responsible for. They did not fail to read an assay correctly. They failed to have, at 06:40, a system in which an amber turbidity flag and a pending assay result were linked by index to the same volume of water moving through the same pipe segment. That linkage is not a matter of hiring more attentive staff. It is a matter of what the infrastructure takes in and for how long it keeps what it took in, correlated by time and by provenance, so that since and until can be asked of it automatically rather than reconstructed by a human doing detective work against a deadline that has already passed.
Two objections worth taking seriously
Just put the sample timestamp and the retrieval query in the same report. The index can be supplied as a parameter — attach the date, attach the relevant readings, and any system correctly evaluates the tensed claim. There is no deep architectural distinction here, only a formatting one.
This is correct as far as it goes, and it is roughly how most utilities cope today: timestamped reports, cross-referenced by hand or by a simple join. But a timestamp supplies the index; it does not supply the valuation at that index for every proposition that later turns out to matter. If nobody thought to retrieve pressure telemetry for the two intervening tanks, the join is silently incomplete, and the compound proposition about distribution reach cannot be computed even though the raw date is sitting right there in the report header. Retrieval closes the gap for whatever was thought to retrieve; it leaves it open everywhere the analyst did not anticipate needing. That is not a refutation of the intake requirement. It relocates the requirement to the coverage of what gets retrieved, and coverage is exactly an intake property, not a formatting one.
Continuous monitoring is overkill. Sampling theory says a bandwidth-bounded signal is fully recoverable from periodic samples. Turbidity, pressure and residual chlorine do not change instantaneously; an hourly or four-hourly polling regime, properly designed, loses nothing that matters, and it is far cheaper than treating every stream as needing constant attention.
Conceded, and it is why utilities already poll rather than continuously stream most of these signals — polling residual chlorine every fifteen minutes at a tank is entirely adequate given how slowly it moves. The point at issue is not sampling rate; it is whether there is a stopping point, a moment after which the stream can be discarded because it is no longer needed. A fifteen-minute poll that runs indefinitely, with every reading retained and indexed against the flow model, satisfies the temporal semantics the contamination case needed. A fifteen-minute poll that was only run during a commissioning trial in 2019 does not, no matter how densely it sampled at the time. The argument was never for infinite rate. It was against a terminal cutoff, and a maintenance log that stops being consulted once a pipe is judged "settled" is a terminal cutoff by another name.
Why this is the top rung
Temporal logic does not ask for a fourth kind of resource beyond a linear order of instants, a present, and access to the segment already traversed. Municipal water systems make that abstract requirement concrete: an advancing clock, a live present state at every node, and a retained, provenance-tagged record of every sample, reading and maintenance action back to whenever the network needs to reason about since. Nothing past that is asked for by the semantics, which is the sense in which the Large Universe Model position is terminal on this particular axis — not the end of engineering better water systems, only the end of what intake, as such, has left to supply.