Open source · MIT Windows 10/11 · Windows Server One RTX GPU · runs offline Built on FUSOR-1 REV 0 · proposal — pre-build

AORTA · The signal-floor seam

BELLMAN

The bedside watch. Thirty hours of donor management happen in a room where something is always beeping. Every alarm fired correctly. Almost none of them were for you. BELLMAN is a resident mind on your own machine that holds the whole signal floor in one attention state — every monitor, pump, vent and lab, continuously — and answers the one question no threshold can: of everything sounding right now, which one is yours? It silences nothing. It ranks, it says one word — look — and it writes down every single time it decided not to.

GitHub · watch for the repo ↗ Its sibling: ROUNDS → ← AORTA

FREE FOREVER. NO ACCOUNT, NO CLOUD, NO TELEMETRY, NO PHONE-HOME. YOU CLONE IT, YOU COMPILE IT, IT RUNS ON YOUR SILICON WITH YOUR WEIGHTS — AND NOTHING IT SEES EVER LEAVES THE BUILDING.

§ 01

The room where the bell means nothing.

The monitor has alarmed one hundred and forty times since midnight. Leads-off twice when he was turned. SpO₂ dropping through 88 four times on suction, recovering each time before anyone reached the door. A pump occlusion that cleared itself. The vent's high-pressure alarm on a cough. Every one of those alarms was correct — the threshold was crossed, the device did its job.

Hour 31 · 04:52 · synthetic donor record

At 04:52 the same chime sounds again — same tone, same volume as the hundred and forty before it. This one is different. The MAP has been drifting down for nineteen minutes while the levophed rate has been climbing to hold it. The last gas showed a widening base deficit. Urine output stopped an hour ago.

No single number has crossed a line that wasn't crossed at midnight and cleared.

BELLMAN, at the boundary: look — bed 4. Four lanes moving together for 19 min: MAP ↓, levophed ↑ to hold it, base deficit widening (03:58 gas), UOP zero since 03:50. No threshold has been crossed. This outranks everything else currently sounding on the floor.

The alarm that matters sounds exactly like the alarm that doesn't.

That is not a bug in any device. It is the design: a threshold has no way to know that this crossing, unlike the last hundred and forty, is the fourth term in a sentence.

What the industry already knows · verify before publication

Clinical alarm safety has been a named patient-safety priority for over a decade, alarm hazards recur in annual health-technology hazard rankings, and the literature's recurring finding is that the overwhelming majority of alarms on a monitored floor require no intervention — the fatigue is the documented harm, not the alarms themselves. Primary sources must be fetched and cited by name before this page ships. This estate does not print a statistic it has not read at the source.

The honest incumbents, named

threshold tuning

Moves the fatigue around the floor. Never removes it — and every loosened limit is a risk decision nobody wrote down.

alarm middleware

Routes the same undifferentiated flood to a phone. Faster delivery of an unranked stream is a louder flood.

delay timers & smart pauses

Buy quiet by adding latency to the one alarm that mattered. Honest, blunt, and a trade nobody enjoys signing.

staffing the watch

The only thing that reliably works, and the thing no unit can afford at 04:00.

Every one of those answers is a rule written in advance. BELLMAN exists for the alarm whose significance lives in the conjunction — in four unremarkable streams that only mean something together, in this order, at this hour, on this patient.

§ 02

A watch, not a filter. A resident, not a service.

BELLMAN is not something you ask. It has no chat box, no prompt, no send key, and you will mostly forget it is there. It is a resident: a small open-weight model that lives on one machine in your unit, holds every signal lane and the case record in one continuous attention state, and judges — silently, at every boundary — one question:

The one question

Of everything happening on this floor right now, does any of it deserve a human — which human, and now or in ten minutes?

Almost always the answer is hold, and you never hear from it. When the answer is look, one line appears on the glass — naming the streams it fused, the record lines it stands on, and the lead time it thinks you have. That is the entire product.

Watches

Every monitored lane as it lands: vitals and derived trends, pump and vent events, device alarms with their own timestamps, labs as they result, the case record, and the room's own history since admission.

Catches

The alarm that matters inside the flood — and the deterioration that never crosses a line at all, because it lives in four streams at once.

Never touches

Nothing. It silences no device, pauses no alarm, writes to no chart, orders nothing, notifies no one on its own. It cannot cause an error. It can only ask a human to look.

Why it must live on your machine

To rank alarms it must see the continuous stream — waveform-derived trends, device events, the record beside them, all of it, all night. That stream is PHI at its most granular, and it cannot leave the building, which means the mind that watches it cannot live in someone else's datacenter.

Residency

In this industry, residency isn't a preference. It is the only compliant shape a watch can have. BELLMAN runs entirely on one workstation GPU behind your firewall: unplug the network cable and it works identically.

§ 03

How a machine earns the right to say look.

Everything you have used before evaluates one signal against one line, at the instant it crosses. BELLMAN is built on FUSOR-1, a substrate for minds that don't take turns — and that changes what is physically available:

THE SIGNAL FLOOR ONE RESIDENT MIND THE GLASS ───────────────── ───────────────── ───────── monitor lanes ──┐ pump / vent events ──┤ every lane fused in one attention state ┌── look ranked · cited · with lead time labs as they result──┼──► judged at every boundary and world delta ───┤ the case record ──┤ ranked: does this outrank the rest? └── hold you never hear it — and it is the room's history ──┘ written down anyway NO POLL · NO TIMER · NO THRESHOLD TABLE · NO CLOUD

It is always caught up.

Every value, event, and result appends to one persistent attention state the moment it exists. Nothing is re-read; there is no refresh interval and no "checking now." Being current is not something BELLMAN does — it is what BELLMAN is.

It ranks, which is the part no threshold can do.

A threshold answers did this cross a line. BELLMAN answers does this outrank everything else currently true in this room — the same judgment a senior nurse makes when four things are beeping and she walks toward one of them.

Measured · the reference bench

On byte-identical event text, with no priority, severity, or urgency field anywhere in the schema, the safety seat separated a hand on a door handle from a hand on an overhead bin by ~0.5 nats, and a passenger from a crew member by ~0.25 — two independent signals, added, with no interaction term. Ranking without a rule table, on a dated tape. The same organ, one room over.

Silence is the product.

BELLMAN is trained default-silent against a contracted interruption budget — a handful per shift, or it isn't doing its job.

Measured · the vise

On a full recorded workday, the untuned disposition fired 921 times an hour at zero bias, and no fixed threshold separated signal from noise — deaf at any livable setting, unlivable at zero. A tuned disposition brought it to 6.7% of decision points while keeping the catches. That measurement is the empirical statement that thresholds cannot be tuned into a solution, and it is why this product is a judgment and not a limit.

§ 04

The catches no threshold can hold.

The conjunction

Four streams, none alarming, that together are a sentence: MAP drifting, pressor climbing to hold it, base deficit widening, urine output stopped. No line crossed. No rule exists, because the condition can't be written as one.

The alarm that means something this time

The one hundred forty-first desaturation is the first that doesn't recover on its own — identical to the hundred and forty before it in every field, different only in what preceded it.

The silence that should have been a sound

A lane that stopped. Nothing alarms when a value stops arriving; every alarm system on earth fires on presence. A resident notices absence, because absence changes what it expects next.

The contradiction across devices

The pump says it delivered; the pressure says nothing changed. Two systems, both green, telling different stories — and nothing compares them, because nothing holds both.

The trajectory, not the value

The number is in range and heading somewhere. A threshold is a fence; deterioration is a direction.

The cross-room collision

Two rooms, one coordinator, both stable — and one of them is about to need two hands at the same moment the other does. This is where BELLMAN hands the floor to ROUNDS: the signal floor escalates, the case board arbitrates.

§ 05

The ledger of silence.

A system that ranks alarms is, functionally, a system that tells you not to look at things. Every attempt at that has died in risk management for the same reason: nobody can prove what it decided not to tell you. An absence leaves no artifact. "It didn't alert" and "it never considered it" are indistinguishable after the fact, and no clinical leader can sign for the difference.

BELLMAN's every judgment — every look, and every single hold — is an event on an append-only, hash-chained tape: the streams it fused, the margin, the lead time, the record lines it stood on, and the alternatives it outranked. The tape is local, immutable, and replayable, and two cold replays of one shift are byte-identical.

The question a review has never been able to ask

"At 03:14, what did it see, what did it consider, what did it hold — and by how much?"

The answer is a line in a file, not a shrug.

The property that makes the product possible

"It stayed quiet" becomes a decision on the record rather than an absence. That single property is what converts alarm ranking from an idea nobody will sign for into a system a unit can adopt, audit — and if necessary, indict.

The regulatory shape this implies · verify with counsel before publication

BELLMAN is advisory: it does not silence, delay, route, or act, and every recommendation ships with the specific evidence a clinician can independently review in seconds. That transparency is not decoration — under the clinical-decision-support carve-outs it is the property that distinguishes a reviewable aid from a regulated device. Regulatory posture must be confirmed with counsel and the primary guidance cited by name. This estate does not assert a legal status it has not read.

§ 06

What BELLMAN never does.

By construction — not by policy

Never silences an alarm. Every device continues to sound exactly as it does today. BELLMAN adds a channel; it removes nothing. A layer that could suppress would be a device, and a device is a different company.
Never makes the clinical determination. It surfaces the change and names its evidence. The coordinator decides.
Never writes, orders, files, pages, or sends. Advisory-only, structurally — it can prevent an error; it cannot cause one.
Never leaves the building. Zero egress by default. No account, no telemetry, no phone-home.
Never learns from you without saying so. Every label, tuning event, and weight version is on the ledger with its vintage; the deterministic core must pass its battery with all learned components zeroed, or the flywheel halts.

§ 07

The plate.

Substrate numbers are measured on the reference bench — one consumer GPU, Dallas — with dated files behind them. Product numbers are budgets until a pilot produces them, and say so.

Quantity	Rating	Status
Judgment probe, per boundary	~44 ms	measured
Verdict after a world event	+30 ms	measured
Boundary detection — end of a thought	0.97 vs 0.02	measured
Deterministic replay of a shift	byte-identical	measured
Ranking with no priority field in schema	~+0.5 / ~+0.25 nats	measured
Disposition at zero bias, untuned	921 fires/hr	measured
Disposition after tune	6.7%	measured
Interruptions per shift	contracted	budget
Lead time on a conjunction catch	minutes	budget
Missed graded events vs threshold arm	—	bet · the pilot

§ 08

Where it goes.

The organ transposes without changing. A signal floor is a signal floor: an ICU that isn't a donor bed, a security operations center whose analysts tune out the same flood, a network operations center, an industrial line. The lanes change; the judgment, the ranking, the contracted silence, and the ledger do not. BELLMAN ships for the room this estate knows best, and the same weights run the others.

ROUNDS

Holds the case board when the signal floor escalates. BELLMAN watches the patient; ROUNDS watches the board about the patients.

VIGIL

Catches the stale sentence at the seam where the shift changes.

STEWARD

Rides the single case from referral to recovery, field by field.

HOTWASH

Reads the simulation where all of it gets rehearsed, before anyone tries it at 4 a.m.

The falsifier, printed

BELLMAN's claim is that ranked judgment beats threshold alarming on a graded shift: fewer interruptions, no missed graded event, and every hold defensible on the tape. It loses if a threshold configuration, tuned by the unit's own staff on the same shift, matches it on both jaws — in which case the honest product is a better threshold editor, and this page says so and ships that instead.

Silence is a decision, and here it is written down.