What the frame problem actually asks
Formal logic has a stubborn old puzzle sitting underneath most reasoning about action. Describe a robot lifting a cup off a table and you must, if you want a complete description, also say that the table stayed put, the room stayed lit, the door stayed shut, the coffee in the next room did not spontaneously refill. List every fact an action does not touch and you generate an explosion of persistence axioms, one for every fact against every action. Leave them out and logic will not do the work for you: nothing in a formal system forbids the unmentioned from having changed. Silence is not evidence of stillness.
John McCarthy set up the machinery for this in 1963, in situation calculus, a way of writing actions and their effects as logical formulae. He and Patrick Hayes named the difficulty in 1969: describing what changes is tractable; describing what does not is not. The problem is not computational load. It is that non-change cannot generally be derived from an incomplete description of the world. You can compute forever and still not know, from the record alone, whether the door is shut.
Ray Reiter offered a compact fix in 1991 — successor state axioms, which collapse the persistence-axiom explosion into one axiom per fluent. It works, given a closure assumption: that you have listed every action capable of affecting every fact. That assumption holds in blocks-world toy problems. It holds almost nowhere else, which is the seam this page eventually pulls on.
Why intake, not intelligence, is the axis
The frame problem is a statement about evidence, not reasoning power. A reasoner working from a closed record has exactly two options when asked whether something unmentioned has changed: assume persistence, or attempt to enumerate non-change. The first is wrong in precisely the cases that matter, because the cases that matter are the ones where something moved quietly. The second does not scale, for the reason above — logic cannot certify an absence of change from a description that stops mentioning a thing.
There is a third option logic does not have: look. Determining whether the table moved is intractable by inference and trivial by observation. That asymmetry is the whole argument for building systems around what they are permitted to see, rather than around how cleverly they reason from what they were once told.
This is the axis that runs from Large Language Model to Large World Model to Large Universe Model. A Large Language Model holds a corpus frozen at a training cutoff and must project the present forward from it — the maximal frame problem, since everything after the cutoff is an unmentioned fact of unknown persistence, and the model has no channel that would tell it otherwise. A Large World Model watches a scene while the scene is in view, and inside that sensor cone the frame problem dissolves: the table is still there because it is visible, not because it was assumed to persist. But the problem returns the instant attention moves elsewhere. A Large Universe Model is the position that keeps every relevant stream open and attaches provenance and a timestamp to every belief, so that persistence is continuously re-witnessed rather than assumed, and anything not recently observed is marked stale rather than silently held true.
Past that point there is no further category of evidence to add. You cannot observe more than everything, continuously. What is left to argue about is coverage, latency, cost and trust in the sensors — quantities, not a fourth kind of intake. That is the sense in which this ladder has a top rung.
The SOC as a closed-record reasoner
Security operations is a good place to test that claim, because a security operations centre is, structurally, exactly the kind of reasoner the frame problem describes, and it knows it.
An analyst runs a threat hunt. The hunt queries EDR telemetry, identity events, configuration state and threat intelligence feeds as they stand at the moment of the query, builds a picture of what is present and what is compromised, and closes the ticket. Between that hunt and the next scheduled one — a week later, a month later, in many under-resourced teams a quarter later — the environment does not hold still. New identities get provisioned. A misconfigured role grants excess privilege. A dormant credential gets used from a new geography. None of that is in the record the hunt closed against, because the hunt's record stopped when the hunt stopped.
The analyst, and the tooling built for the analyst, faces the identical choice the frame problem poses to any closed-record reasoner. Assume the environment found clean last time is still clean, or attempt to enumerate everything that could have changed since. The first is the working default of scheduled hunting and it is wrong in exactly the cases that matter: an intrusion that established itself the day after the last hunt closed can dwell, unremarked, for the entire interval until the next one opens. The second does not scale to an estate with tens of thousands of endpoints, rotating identities and daily configuration drift; no analyst enumerates non-change across that surface by hand.
This is the sharpest domain-specific form of the general failure. Dwell time is not a vague industry statistic when you look at where it comes from. It is the gap between a hunt's closing assumption and the next hunt's opening query — a frame problem with a calendar attached.
What continuous streams actually buy
A security operations centre with EDR telemetry, identity events and configuration change streaming live, rather than pulled at hunt time, is trading inference for observation in exactly the place the frame problem says the trade is worth making. It does not need to derive that the privileged role is still unused since last week; it can see whether it fired. It does not need to assume the endpoint's process tree is unchanged since the last scan; it has the live tree. Persistence becomes a re-witnessed fact with a timestamp, not a carried-over conclusion from the last closed ticket.
You've just relocated the frame problem, not solved it. Your EDR agent doesn't cover the unmanaged laptop, the shadow SaaS tenant, the contractor's personal device on the guest network. Outside that instrumented set you're back to assuming persistence, and you've dressed the assumption up as continuous monitoring.
That objection is correct, and it is not a rebuttal so much as a description of what the improvement actually is. No estate achieves full sensor coverage; there is always an unmanaged boundary. What changes with live, provenance-tagged streams is that the boundary becomes visible and priced rather than silently inherited. A belief about an unmanaged laptop can be flagged as unwitnessed rather than quietly treated as clean. That is the difference between a coverage gap you can put a number on — this segment has no EDR, last configuration snapshot here is nine days old — and an undecidable logical question about whether the unmentioned thing moved. Converting an assumption into a tracked staleness metric is the entire gain on offer, and in an operations context, where budgets and audits run on numbers, it is a substantial one.
The second objection lands closer to the analyst's actual job. Hunting is not pure observation. Deciding whether to isolate a host, revoke a credential or roll back a configuration change is a decision about a future state that has not happened yet, and no telemetry feed reports on a future.
That is true, and continuous intake does not touch it directly. What it changes is the feedback loop around the guess. A model of what a given containment action typically disturbs — service availability, downstream authentication dependencies, logging continuity — is built from observed outcomes of past actions rather than authored by hand, and every prediction about the next action is checked against what the same streams report in the minutes after. The frame problem inside planning is not dissolved. It becomes an estimation problem with a fast, instrumented correction cycle, which is a meaningfully easier problem than a hand-enumerated one, but a different kind of hard than the observation problem the streams do solve.
What this rules in and out
None of this licenses a claim that streaming telemetry replaces judgement, or that a fully instrumented SOC has no dwell time. Reiter's closure assumption — list every action affecting every fluent and the frame problem collapses to one axiom per fact — works in security operations exactly as well as it works anywhere outside a blocks-world: given a complete action theory, meaning every way a system's state can change is enumerated in advance, the representational problem is tame. Real estates violate that constantly. New attack techniques, new integrations, new shadow infrastructure are new ways for state to change that no one enumerated. Formal closure buys correctness relative to a model of the estate. Live streams with provenance buy correctness relative to the estate itself. In security operations, where the adversary's entire advantage is finding the gap between those two, that is not a marginal distinction.