DreamLedger: Execution-Settled Credit Files for World-Model Imagination in Robot Decision Loops

Xianyao Li; Ruitong Tian; Rui Min; Fang Xu; Jing Du

Source-linked AI summary

DreamLedger: Execution-Settled Credit Files for World-Model Imagination in Robot Decision Loops

Xianyao Li, Ruitong Tian, Rui Min, Fang Xu, Jing Du

arXiv:2608.23863v1Aug 24, 2026cs.RO

TL;DR

Robots often rely on world-model predictions whose reliability is represented by transient, model-internal signals rather than persistent deployment records. DreamLedger registers consumed predictions as execution-settled claims, gates reliance with context-indexed credit, and evaluates this layer across models, simulations, and a real manipulator. Credit gating reduced burned imagination by 62% (95% CI 43-81%) versus blind consumption while maintaining equal success and comparable collision rates, with additional evidence for cross-interface operation and audit replay.

Problem
World-model predictions are consumed without persistent records of where, under what conditions, and over what horizons they have been reliable, despite deployment risks from compounding error and distribution shift.
Method
DreamLedger registers each consumed prediction as a claim, settles attributable outcomes against arriving reality, accumulates condition × region × horizon credit, and gates reliance before imagination is consumed.
Results
62% (95% CI 43-81%) reduction in burned imagination versus blind consumption occurred with equal success and no detectable collision difference in the reported quadrotor comparison.
Takeaways & Limitations
The same trust layer operates across decoder-, latent-, and token-space interfaces and remains operational on real Franka execution frames with auditable reliance events.
Takeaways & Limitations
The credit file is intentionally deployment-bound and does not claim formal safety certification or zero-shot transfer of credit across deployment sites.

Abstract

from arXiv · show

Robots are beginning to act on world-model predictions, yet reliability is still expressed through instantaneous, model-internal signals. DreamLedger instead treats reliability as a persistent deployment object: an execution-settled credit file recording how often consumed predictions are borne out, indexed by operating condition, region, and prediction horizon, and consulted before each use. Each consumed prediction is registered as a claim; attributable outcomes are settled against arriving reality at zero labeling cost, an attribution stage excludes measurement-contaminated outcomes, and a settlement-supervised head complements sparse bins. The resulting credit gates consumption: low-credit predictions shorten the dependent horizon or trigger additional observation; every reliance event remains auditable via dependency tickets and replayable logs. We evaluate DreamLedger in three simulated domains (indoor flight, tabletop manipulation, 2D navigation), via mounts on unmodified DreamerV3, TD-MPC2, and V-JEPA 2-AC, and on a real Franka manipulator. Claim failure is dose-monotone in all 12 held-out condition-horizon cells. Credit-gated planning reduces burned imagination (consumed claims that later fail to redeem) by 62% (95% CI 43-81%) versus blind consumption, with equal success and comparable collision rates. At matched risk targets, persistent books cut verification probes from 1.00 to 0.36/episode in manipulation, at success 0.94 versus 0.98; settlement-grounded calibration retains moderate, seed-consistent operating points unlike raw instantaneous gates. The same trust layer operates across decoder-, latent-, and token-space interfaces, including V-JEPA 2-AC settled on real robot frames. On hardware, settlement remains operational under real sensing and contact noise, a deployment failure loop is re-priced online, and all 1,062 registered spends replay from the audit logs.

I. INTRODUCTION

DreamLedger extends forecast verification into robot decision loops by maintaining persistent, execution-settled records of world-model reliability. It registers consumed predictions as claims, filters measurement contamination, and gates reliance using context-indexed credit.

World-model predictions are consumed beyond the robot’s sensor horizon, but conventional reliability signals lack persistent records of conditions and horizons.
Each consumed prediction becomes a claim settled against arriving reality, accumulating credit indexed by operating condition, region, and prediction horizon.
Attribution excludes outcomes whose disagreement may reflect localization or sensing error, while a settlement-supervised introspection head supports thin or newly encountered cells.
The design treats reliability as execution-settled credit rather than requiring general high-dimensional uncertainty quantification or trusting model self-assessment alone.
The unchanged ledger core spans DreamerV3, TD-MPC2, and V-JEPA 2-AC across decoded-observation, latent-state, and token-space settlement interfaces.

II. RELATED WORK

DreamLedger combines ideas from runtime monitoring, uncertainty-aware imagination, competence estimation, accountability infrastructure, and forecast verification. Its distinction is a deployment-time, prediction-level record that governs reliance and audit.

Instantaneous gating and runtime monitoring: Existing runtime monitors and verifiers assess imagined plans or arriving observations, but do not maintain the persistent settlement record introduced here.
Uncertainty-aware imagination: Uncertainty-aware world models support training objectives or rollout scheduling, whereas DreamLedger governs deployment-time reliance and audit.
Certification and competence lines: Prior competence systems condition records on places, appearances, maps, components, or task competence, but the cited lines do not provide DreamLedger’s prediction-horizon settlement dimension.
Accountability infrastructure and forecast verification: Robotics accountability logs trace decisions, while meteorological verification supplies condition-dependent forecast records; DreamLedger connects these ideas to imagination spending and settlement.

III. PROBLEM STATEMENT AND SCOPE

The paper defines DreamLedger as a trust layer for predictive world models embedded in robot decision loops. It settles consumed predictions when observable, limits scope to deployment-bound empirical credit, and excludes formal certification and model repair.

DreamLedger consumes predictive outputs and optional read-only latent features without modifying the world model’s predictive pathway or training objective.
A spend is a planning decision whose execution depends on a prediction at a specified operating condition, region, and horizon, evaluated before consumption.
The evaluation covers aerial navigation and tabletop manipulation, including simulated and hardware settings with occluded or contact-dependent object states.
The credit file is deployment-bound and does not claim formal safety certification, general uncertainty quantification, model repair, or zero-shot cross-site credit transfer.
A. Settlement engine (execution as settlement): Consumed predictions settle against observable reality at zero additional labeling cost using frozen, platform-specific redemption predicates.
A. Settlement engine (execution as settlement): Attribution uses confidence gating, residual decomposition, and honest discard so measurement contamination is not booked as model failure.

B. Credit file

The credit file aggregates execution settlements into calibrated, context-specific reliability estimates and exposes them to the planner and auditors. Low-credit imagination is replaced by shorter dependence or additional observation.

Each condition class, region, and horizon bin records settlement count, redemption rate, and recency, with support-aware merging and Wilson 95% intervals.
A shallow calibrator combines bin history, introspection, self-report, and instantaneous consistency signals into the continuous redemption probability consumed by the gate.
A refused spend substitutes a shorter dependent horizon or an observation action, with threshold τ selected from warmup risk–coverage data and frozen before evaluation.
Dependency tickets, credit stamps, and imagination logs preserve each reliance event, its backing settlements, and the information needed for post-hoc reconstruction.

D. Model-side coupling: settlement-supervised introspection

DreamLedger adds a settlement-supervised introspection head to complement empirical credit books, especially where deployment histories are sparse. The evaluation spans quadrotor and 2D-navigation settings within the broader multi-domain study.

D. Model-side coupling: settlement-supervised introspection: The introspection head predicts claim redemption for each horizon bucket from latent state features and is supervised by settled deployment outcomes.Gradients are stopped at the world-model backbone, preserving the predictive pathway.
D. Model-side coupling: settlement-supervised introspection: The head complements sparse books in thin or newly encountered cells, while dense bins anchor estimates where direct settlement evidence is abundant.Both sources feed the calibrator, with their contributions isolated by ablation.
D. Model-side coupling: settlement-supervised introspection: Quadrotor evaluation uses Isaac Sim indoor corridors with depth perception, a recurrent latent world model, three data doses, and horizons from 0.5 to 5 s.The setup includes open, cluttered, and low-texture zones.
D. Model-side coupling: settlement-supervised introspection: Figure 3 reports dose-monotone claim failure in all 12 condition-horizon cells, with horizon compounding within each dose.Within each horizon group, failure bars ascend from strong to weak models.
D. Model-side coupling: settlement-supervised introspection: The study evaluates three robotic domains and organizes results around credit discrimination, reliance reduction, interface generality, and real-robot operability.The supplied setup passages identify quadrotor and 2D-navigation components of this evaluation.

A. Finding A: the ledger discriminates where imagination earns trust

DreamLedger distinguishes prediction reliability across condition–horizon cells and converts that record into deployment-time consumption decisions. Across held-out evaluation and gated planning, the ledger reduces reliance on claims that later fail while preserving reported task outcomes.

A. Finding A: the ledger discriminates where imagination earns trust: Claim-failure rates are dose-monotone in all 12 condition×horizon cells, with horizon compounding within each dose.On the held-out quadrotor distribution, failure is approximately 0.25, 0.30, and 0.41 for strong, medium, and weak models.
A. Finding A: the ledger discriminates where imagination earns trust: Executed-claim books become increasingly optimistic about unexecuted candidates as model weakness grows, with within-cell failure-rate gaps averaging +0.01/+0.05/+0.10 for strong/medium/weak models.For the weak model, the p90 gap is +0.18 and the worst-cell gap is +0.21.
A. Finding A: the ledger discriminates where imagination earns trust: Fusion is best in 6 of 10 comparable cells, while its average ECE gain is 0.032 for thin books and disappears for thick books.For thick books, ∆ECE = −0.003; the reported trend is descriptive over n=10 cells.
B. Finding B: credit gating reduces unredeemed imagination reliance: 62% fewer burned claims occur under credit gating on the weak quadrotor model, with equal reach at 0.683 and no detectable collision difference.The result uses frozen τ = 0.75 and reports a 95% CI of 43–81%.
B. Finding B: credit gating reduces unredeemed imagination reliance: Burn reductions across weak, medium, and strong model doses are 62%, 56%, and 44%, respectively, with no observed loss in reach or detectable collision differences.All reported hierarchical-bootstrap 95% confidence intervals exclude zero.
B. Finding B: credit gating reduces unredeemed imagination reliance: Risk–coverage selects τ = 0.75 from 540 settled warmup spends at a pre-stated fail≤20% target, then freezes that threshold for evaluation.The warmup set has overall claim failure of 27.4%.
B. Finding B: credit gating reduces unredeemed imagination reliance: Persistent books reduce manipulation verification probes from 1.00 to 0.36/episode, while success is 0.94 versus 0.98.The comparison comes from removing books from an otherwise identical calibrator.
B. Finding B: credit gating reduces unredeemed imagination reliance: Settlement-calibrated variants retain moderate, narrow per-seed thresholds, whereas raw instantaneous signals collapse toward extreme or highly variable operating points.Persistent history additionally provides cross-episode reuse, thin-cell anchoring, and auditable provenance.

C. Finding C: one trust layer across world-model interfaces

DreamLedger applies one execution-settled trust layer across decoder-, latent-, and token-space world-model interfaces. The resulting books recover host- and condition-specific reliability without requiring host-specific confidence semantics.

Cross-interface deployment: The same ledger mounts on DreamerV3, TD-MPC2, and V-JEPA 2-AC using approximately 200-line adapters.The hosts span recurrent, latent, and foundation-scale video-representation interfaces.
Host-specific reliability: TD-MPC2 redemption stratifies by movement speed at every horizon, with walker-walk k1 slow/mid/fast redemption of 0.966/0.898/0.776.On cheetah-run, the ordering reverses, showing task-specific rather than fixed reliability ordering.
Host-specific reliability: DreamerV3 redemption declines from 0.998 to 0.930 between k1 and k10 in the slow regime and is speed-stratified at k1.
Host-specific reliability: V-JEPA 2-AC books stratify by commanded action magnitude at every horizon, with k1 redemption of 0.91/0.93/0.78 for small/mid/large actions.Object-class labels additionally reveal high redemption for cylinders and sliders and strongest horizon decay for irregular objects.

D. Finding D: the credit file is operational on a real robot

The settlement–credit–audit pipeline runs on a real Franka manipulator under sensing and contact noise. It settles attributable claims, reprices a repeated deployment failure online, and supports replayable reliance records, while hardware gate comparisons remain descriptive.

Physical operation: 949 attributable settlements were produced across warmup, gated, and blind hardware phases, with measurement-contaminated outcomes reported as discards.At the frozen 9-cm claim granularity, per-class redemption was 0.97–1.00.
Online repricing: Fourteen repeated no-contact pushes caused every claim to fail, while consumed-cell credit fell online from 0.749 to 0.682.The frozen threshold τ = 0.50 did not intervene, whereas the decision-theoretic anchor τdt = 0.82 would reject the first spend.
Auditability: All 1,062 registered spend records replayed independently across seven deployment logs, including attributable settlements, discards, and pending claims.
Auditability: A high-credit episode consumed nine spends without additional observation, whereas an occluded-target episode acquired five observations before acting.
Evaluation boundary: Paired gated-versus-blind hardware trials are interpreted descriptively because sequential ordering and placement asymmetries prevent a causal comparison.Causal gate value is evaluated in simulation.

E. Supporting findings and boundaries

Supporting analyses show that partitioning, threshold choice, observation acquisition, and logging affect how DreamLedger prices and uses imagination. They also expose boundaries involving conservatism, noise, misuse, and thin-bin calibration.

Drift and conservatism: Across seven drift rounds, consumed-claim violation remains nearly unchanged under the conservative gate, including 0.218 versus 0.221 after replacing the strong model with the weak model.Degradation appears instead in task metrics and burned imagination because low-credit claims are withheld.
Externalization and audit: 45 denials in a thin-book occluded cell caused three observation actions before commitment, while independent replay verified 165/165 logs and settlement hashes.
Pricing and misuse: Under high contact noise, gated and blind variants converge toward the no-imagination reference, while single-step misuse raises on-policy violation from 0.30 offline to 0.58.
Granularity and partition: Finer real partitions improve AURC discrimination but worsen per-bin ECE, making thin-bin fusion and merge strategies necessary at fixed data.On the weak stream, AURC changes from 0.310 to 0.221 while ECE changes from 0.025 to 0.081.
Threshold sensitivity: Over τ ∈[0.70, 0.80], kept-spend failure remains 0.17–0.18 while coverage falls from 0.37 to 0.22, indicating a stable operating plateau.

VI. LIMITATIONS AND CONCLUSION

DreamLedger is a deployment-bound, empirical trust layer rather than a general uncertainty model or formal safety certificate. Within those limits, it supports auditable, execution-earned reliance across multiple world-model interfaces and a real manipulator.

Limitations: The credit file does not assume zero-shot transfer across sites and estimates reliability only for the consumed claim, not task semantics in general.
Limitations: Evaluation is limited by a compact third domain, simulation-only aerial results, pushing-only manipulation, and hardware trial asymmetries that preclude causal gate comparison.Grasping would require an additional typed settlement predicate.
Conclusion: DreamLedger’s contribution is the deployment object jointly supported by per-prediction settlement, persistent condition × region × horizon credit, spend-time consultation, and audit retention.
Conclusion: Within these bounds, the ledger discriminates earned imagination, reduces reliance on unredeemed predictions, spans decoder-, latent-, and token-space interfaces, and remains operational on a real manipulator.

APPENDIX

The appendix validates partition sensitivity through paired simulation and larger 2D-navigation replication, while documenting the real-hardware protocol and exact ledger accounting. Results show that meaningful granularity improves discrimination, with calibration trade-offs dependent on settlement volume.

Evaluation protocol: Rendering stochasticity makes quadrotor outcomes samples from per-world distributions, so behavioral comparisons use paired statistical contrasts with shared episode seeds.
Partition sensitivity at scale: 2D-navigation replication: ≈11,000 settlements per arm replicate monotonic discrimination gains from real granularity, while random partitions revert to the global level.The 2D-navigation replication reports strong-stream AURC improving from 0.202 to 0.129, whereas a random partition gives 0.201 versus 0.202.
Partition sensitivity at scale: 2D-navigation replication: Calibration remains between 0.007 and 0.03 across granularities at high settlement volume, indicating that the earlier granularity–calibration trade-off is a thin-book phenomenon.The Mondrian merge ladder and fusion head address the transition from sparse to denser books.
Real-track protocol details: 1,062 registered spends reconcile into 949 attributable settlements, 108 discards, and 5 pending claims, all reconstructed by replaying seven deployment logs.The hardware protocol freezes the interface and thresholds before evaluation, and attribution uses state-confidence gating, residual decomposition, and honest discard.