Antidote: A Governed Framework for Inspectable Person-and-Moment Generative Audio Journeys

Research gap

The relevant literature does not leave an empty technical category for Antidote to fill. Longitudinal person-specific modeling, current-to-target selection, generated affective trajectories, smooth real-time feedback, interpretable musical controls, and semantic intervention planning all have documented precedent (Janssen, Broek, and Westerink 2012; Daly et al. 2016; Ehrlich et al. 2019; Agres, Dash, and Chua 2023; Zhang et al. 2026). Furthermore, a recent preliminary brain–computer music study reported nonsignificant target-emotion and time effects while person and trial variation dominated its observed variance (Monroy-D’Croz, Ramirez-Melendez, and Cespedes-Guevara 2026). Technical loop closure therefore cannot be assumed to establish reliable affective change.

Instead, our bounded review identifies an operational gap: it did not find one evaluated system that preserves, as a complete governed chain, (1) the context a person permitted for a particular purpose, (2) user-extensible semantic intent and exclusions, (3) an accepted time-indexed journey plan, (4) the generated artifact and measured acoustic realization, (5) actual exposure, (6) perceived expression, felt response, immediate usefulness or harm, and later aftereffect as separate observations, and (7) any proposed within-person update with its provenance and explicit human approval. “Did not find” is a bounded-review result, not proof that no such system exists. The proposed combination may constitute a useful research-system contribution; its global novelty, technical feasibility, learnability, and benefit remain unresolved.

This framing shifts the central question away from whether a system can infer an emotion and generate music. It asks whether a research instrument can make the entire person-and-moment audio hypothesis inspectable enough to specify, challenge, reproduce, and evaluate without promoting one record type into another.

Staged research questions

The manuscript separates a design question from two later feasibility questions:

RQ1—design.

How can a local research instrument represent, generate, and evaluate a person-and-moment audio journey while keeping consented context, semantic intent, planned controls, realized acoustics, exposure, response, and longitudinal updates inspectable and non-interchangeable?

RQ2—technical feasibility.

Can the implemented instrument preserve its declared authority, provenance, control-adherence, continuity, interruption, and recovery contracts across a complete local session?

RQ3—within-person feasibility.

Across repeated sessions, do provenance-linked person-and-moment records support useful advisory relationships among semantic intent, acoustic realization, and self-reported response without increasing burden, surprise, mismatch, or harm?

The design/protocol manuscript is structured to address RQ1 by formalizing the research instrument and its evaluation boundary. RQ2 requires an end-to-end implemented session and auditable technical checks. RQ3 additionally requires a frozen protocol, resolved ethics and privacy gates, qualifying repeated-session observations, and uncertainty-aware analysis. Neither later question is answered by the originating experience, the literature review, a repository fixture, or the proposed architecture.

Bounded contributions

Within those limits, the complete design/protocol manuscript is scoped to five contributions at explicitly different evidence states:

1. it bounds the problem against prior closed-loop, current-to-target, controllable, physiologically adaptive, and longitudinal music systems rather than presenting those ingredients as new;

2. it formalizes an end-to-end inspectability contract that keeps consented context, semantic intent, planning, acoustic realization, exposure, response layers, provenance, and advisory updating distinct;

3. it proposes a two-rate adaptive-audio architecture that separates uncertain, person-correctable deliberation from deterministic generate-ahead rendering, without claiming a validated controller or seamless listening experience;

4. it requires a local-first authority model in which context use, plan acceptance, generation, playback, retention, export, and personal-model updates remain interruptible and human-correctable, while distinguishing the partially implemented mock path from proposed runtime behavior; and

5. it specifies prospectively an evidence-disciplined feasibility boundary that retains null, negative, missing, interrupted, and adverse observations and never substitutes intended control, acoustic adherence, perceived expression, felt response, usefulness or harm, or aftereffect for one another.

The remainder of the manuscript locates these contributions in prior work, formalizes the system and its mathematical objects, specifies the prospective feasibility method and results boundary, discusses only evidence-proportional interpretations, states limitations and ethical constraints, and records availability and reproducibility conditions before concluding with the gates required to revisit RQ2 and RQ3.

Musical emotion, meaning, and response constructs

Musical response is not a direct readout of an acoustic feature. Juslin and Västfjäll describe multiple candidate induction mechanisms—including brain-stem reflexes, evaluative conditioning, emotional contagion, imagery, episodic memory, and musical expectancy in addition to appraisal—whose timing, volitional influence, cultural dependence, and relation to musical structure differ (Juslin and Västfjäll 2008). The framework is theoretical, but it makes a single acoustic-to-emotion rule an inadequate research model. It also motivates retaining a person’s context and interpretation rather than treating a classifier output as the mechanism that operated.

Measurement work reinforces that distinction. Across four studies, Zentner et al. derived and replicated the nine-factor Geneva Emotional Music Scale and reported differences by genre and by whether emotion was perceived in the music or felt by the listener (Zentner, Grandjean, and Scherer 2008). This supports a music-specific response vocabulary while also showing why no group-derived taxonomy should replace personally meaningful language. AffectMachine- Classical offers a complementary technical boundary: its 26-participant study evaluated whether generated excerpts communicated intended affect, not whether listeners felt that affect or benefited from it (Agres, Dash, and Chua 2023). Expression alignment, felt response, usefulness, and harm are therefore separate outcome questions.

An exclusively positive account of musical intensity would be incomplete. Silverman et al.’s theoretical model treats music-induced harm as potentially affective, behavioral, cognitive, identity-related, interpersonal, physical, or spiritual, arising through interactions among context, deliverer, music, and recipient (Silverman, Gooding, and Yinger 2020). The model does not estimate risk or validate Antidote’s safeguards. It does require the research record to retain mismatch, unwelcome intensity, and harm for the person’s interpretation rather than recoding them as failed optimization or successful catharsis.

Current-to-target and longitudinal personalization

Person- and moment-conditioned music predates Antidote. The personalized affective music player combined current and desired affect, physiological observations, and person-specific associations to select existing music over multiple weeks (Janssen, Broek, and Westerink 2012). Its three-participant field evaluation is too small to establish robust generalization, but it is direct precedent for current-to-goal selection and longitudinal personal modeling.

The LUCID trial extended this design neighborhood to an explicit calm target, the iso principle, preference information, and reinforcement-learning-based sequencing of pre-existing tracks and nature sounds (Mallik and Russo 2022). The open-label single-session study randomized 163 participants across music-plus-beats, music, beats, and pink-noise conditions; some differences appeared in the moderate trait-anxiety subgroup and were less differentiated in the high-anxiety subgroup. Commercial involvement, subgroup dependence, and the inseparability of several design components prevent the study from validating a universal journey or mechanism. BEAMERS likewise documents strong person-dependent variation in response to the same song while using EEG in a personalized recommendation setting (Li et al. 2022); as a preprint, it is a comparator rather than an independent basis for an outcome claim.

Together, these systems reject novelty claims based on personalization, current-to-target sequencing, physiology, or longitudinal learning alone. They also leave a methodological reason to model the unit of inquiry as a person–moment–journey record rather than a fixed “best music” profile.

Closed-loop and psychophysiological music systems

Physiological feedback has been connected to music at several levels of complexity. iHeartLift used heart-rate-related feedback to manipulate music tempo, demonstrating a narrow real-time loop rather than a semantic generator (Ho and Chen 2011). Daly et al.’s affective brain–computer music interface combined EEG and other physiology, a desired affective trajectory, algorithmic generation, and a person-specific model across sessions (Daly et al. 2016). Eight participants completed its longitudinal protocol; attrition, constrained generation, and signal limitations qualify the result. Ehrlich et al. reported continuous generated musical feedback with smooth parameter control and user calibration, using an 11-listener perceptual study and a five-participant BCI pilot (Ehrlich et al. 2019). The preliminary outcomes were heterogeneous and did not establish reliable regulation.

MindMelody is the closest recent semantic comparator. It connects real-time EEG processing to global and local affect trajectories, a retrieval-augmented semantic intervention plan, controllable MusicGen-based generation, and physiological and subjective feedback (Zhang et al. 2026). Its reviewed v2 preprint reports technical evaluations and a randomized within-subject non-clinical pilot, but the pilot participant count was not found in the visible methods. The system is strong prior art for an affect estimate to semantic plan to generated music to response loop; its pilot is not Antidote evidence and does not settle clinical efficacy.

Conflicting findings must remain in the same comparison. A 22-participant preliminary minimalist brain–computer musical interface reported nonsignificant target-emotion and time effects, with participant and trial variation dominating the observed variance (Monroy-D’Croz, Ramirez-Melendez, and Cespedes-Guevara 2026). At field level, a systematic review found heterogeneous music-neurofeedback methods and no consensus success measure (Sayal et al. 2025). A separate scoping review of commercial music-based digital therapeutics found product presence but insufficient direct evidence for real-world effectiveness or superiority over generic music (Venkatesan et al. 2026). Technical loop closure, product availability, and beneficial response are therefore three different evidence classes.

Controllable generation and real-time architecture

Interpretable generation controls also have established precedent. AffectMachine-Classical maps continuous valence and arousal controls to a rule-based and probabilistic generator that can change musical parameters bar by bar (Agres, Dash, and Chua 2023); MindMelody exposes semantic plan fields including tempo, texture density, section dynamics, and a target affect trajectory (Zhang et al. 2026). Mustango adds explicit chord, beat, tempo, and key conditioning to text-to-music generation and evaluates condition adherence (Melechovsky et al. 2024). JASCO demonstrates global text conditioning combined with local time-varying symbolic and audio conditions (Tal et al. 2024). These systems support a translation from human-readable intent into inspectable generator controls. They do not make prompt mixtures perceptually linear, guarantee requested conditions in the realized artifact, or establish felt-response control.

Antidote’s timing and adaptation proposal therefore transfers engineering ideas rather than outcome evidence. Adaptive game-music research supplies precedents for transition-aware musical structure (Hutchings and McCormack 2020); just-in-time adaptive intervention design separates decision points, tailoring variables, and intervention options (Nahum-Shani et al. 2018); model-predictive control supplies receding-horizon re-estimation (García, Prett, and Morari 1989); and partially observable planning supplies belief-state reasoning under uncertainty (Kaelbling, Littman, and Cassandra 1998). Interactive machine learning further motivates visible correction and override instead of treating an estimate as authority (Amershi et al. 2014). These transfers inform a two-rate, generate-ahead architecture. They do not model a person as a controllable plant, validate an affect transition model, define a therapeutic reward, or establish a stable real-time generator.

Auditory beats: behavioral findings versus entrainment

Auditory-beat outcomes and brainwave entrainment require separate claims. The LUCID factorial comparison permits reporting subgroup-dependent behavioral differences among music, beat, combined, and noise conditions (Mallik and Russo 2022); it does not isolate a universal beat-frequency mechanism. In contrast, Ingendoh et al.’s systematic review asked specifically whether binaural-beat stimulation entrains EEG activity. Among 14 included studies, five supported the entrainment hypothesis, eight contradicted it, and one was mixed, with substantial heterogeneity in stimulation, design, EEG measures, and analysis (Ingendoh, Posny, and Heine 2023). Binaural beats can thus be treated as testable psychoacoustic controls, but the reviewed evidence does not justify a rule that a frequency produces a known neural or therapeutic state.

Music as setting and phenomenological variable

Psychedelic research provides adjacent evidence that music can shape an experience without being reducible to a treatment ingredient. In interviews with 19 patients receiving psilocybin with psychological support for treatment-resistant depression, Kaelen et al. identified welcome influences such as emotion, imagery, guidance, openness, calm, and safety, alongside unwelcome emotion, resistance, and misguidance (Kaelen et al. 2018). Music-experience ratings were associated with acute experience and later symptom change, but the small exploratory study had no no-music comparison and cannot isolate music, playlist, preparation, support, drug, or expectancy effects.

Rowe et al.’s scoping review included 19 papers from 10 studies and 330 total participants (Rowe et al. 2026). It found preliminary relationships with intensified emotion, meaning and imagery processes, and neural-dynamics measures, while emphasizing small samples, methodological inconsistency, and poorly standardized music conditions. The eligible evidence concerned LSD, psilocybin, and ayahuasca rather than establishing a ketamine–music comparison. This literature supports treating music as an active, temporally structured, sometimes unwelcome setting variable. It does not validate generated therapeutic music, an optimized soundtrack, or Antidote as a psychedelic or ketamine intervention.

Capability-level comparison

Table 2 projects the governed comparator matrix into capability families. A reported mark means only that the reviewed artifact described the capability; it is not an evidence grade or a positive outcome. Partial and unreported cells remain explicit, and the Antidote row is labeled as a proposed reference profile rather than an evaluated system.

R = reported; P = partial; NR = not reported in the reviewed artifact; NA = not applicable; Prop. = proposed, not evaluated. A token identifies reported capability only, not evidence strength, implementation quality, safety, or benefit.

Table description: MindMelody, Daly aBCMI, Ehrlich BCI, AffectMachine, the personalized affective music player, BEAMERS, LUCID, iHeartLift, and the Minimalist BCMI are projected from the governed comparator JSON. Columns cover semantic representation, journey representation, audio strategy, within-session adaptation, longitudinal learning, and provenance. Reported audio strategy may be generation, sonification, selection, sequencing, or playback as defined in the source cell. The final Antidote row says proposed in every capability family and is not evidence of implementation, novelty, safety, or benefit.

Bounded contribution

Antidote therefore does not claim those components individually as new. It formalizes a governed combination that preserves consented context, user-extensible semantic intent, time-indexed planning, measured acoustic realization, actual exposure, perceived and felt response, usefulness or harm, aftereffect, provenance, and human-approved within-person updating as distinct records. The bounded review did not identify that complete chain in one evaluated system; this is a contribution rationale, not a global novelty claim or proof of learnability or benefit.

The gap handed to System Design is consequently narrower than “adaptive music.” Prior work establishes the ingredients and several close loops; the remaining task is to define how one research instrument preserves authority and evidence status at each transformation, including failures and disagreements. The following section formalizes that record chain without treating design coherence as evidence of feasibility or benefit.

Person–moment conditional model

Let $i$ index an individual and $t$ a decision point within or between sessions. Antidote does not represent the person as a fixed feature vector. Instead, it defines the information available for one bounded moment as the heterogeneous record $$z_{i,t} = \left( o^{\mathrm{usr}}_{i,t}, o^{\mathrm{opt}}_{i,t}, c^{\mathrm{work}}_{i,t}, g_{i,t}, k^{\mathrm{usr}}_{i,t}, \mathcal{H}_{i,<t} \right).$$ ANT-EQ-001—Definitional; implementation: represented in the executable mock slice.

Here $o^{\mathrm{usr}}$ contains explicit check-in observations, $o^{\mathrm{opt}}$ contains any separately consented optional observations, $c^{\mathrm{work}}$ is the reviewed context projection, $g$ is the desired journey, $k^{\mathrm{usr}}$ contains direct semantic-control settings, and $\mathcal{H}$ denotes eligible prior evidence. Equation [eq:moment-record] is a tuple, not a sum: its members need not share units and none is silently converted into “the person’s state.” Missing optional observations remain missing. The same individual may therefore produce different moment records at two times, and the same audio may be associated with different responses without either response being treated as anomalous.

The desired journey $g_{i,t}$ is a direction and time-indexed proposal—for example, staying with, softening, exploring, releasing, focusing, or closing— rather than a promised terminal state. The current schemas permit compact valence, arousal, intensity, and confidence fields, but preserve free-text description because a low-dimensional affect coordinate cannot exhaust the person’s meaning. Likewise, prior history is eligible evidence only when its retention and learning permissions remain active and the person accepts its relevance to the present moment.

Inspectable record chain

The context boundary separates retained source records from replaceable interpretations. Following the repository’s personal-model contract, the context state is defined as $$S^{\mathrm{ctx}}_{i,t} = \left(L_{i,t}, P_{i,t}, V_{i,t}\right),$$ ANT-EQ-002—Definitional; implementation: append-only events and derived projections exist for the executable mock slice.

where $L$ is the consented source-event record, $P$ contains derived projections, and $V$ contains their versions and provenance. This partition is compatible with local-first and event-derived views, but neither local storage nor an append-only history proves privacy, truth, or correct interpretation (Kleppmann et al. 2019; Lin et al. 2026). A current consent grant $A_{i,t}$ then constrains the view used for a declared purpose: $$c^{\mathrm{work}}_{i,t} = \pi\!\left(S^{\mathrm{ctx}}_{i,t}; A_{i,t}\right).$$ ANT-EQ-003—Proposed operationalization; implementation: manual session-scoped projection is enforced in the executable mock slice.

The projection operator $\pi$ may select, minimize, summarize, or omit records, but it must preserve source-event identifiers, derivation version, purpose, review state, expiry, and any person-authored edit or exclusion. Revoked, expired, excluded, or out-of-purpose fields do not enter the working view. The source events remain distinguishable from the projection so a new derivation can be audited without rewriting what was originally authorized. Consent to inspect, project, generate, retain, learn, export, and publish remains separate; manual semantic entry remains usable without historical context.

The record chain continues from the accepted working projection to an immutable moment record, a versioned journey-plan revision, an approved generation specification, a generation attempt, a content-hashed artifact and feature report, an actual exposure, and separated response observations. No skipped link is inferred from a later one: generating an artifact does not establish playback, and playback does not establish a response.

Figure description: A private context store sits outside the generation boundary. A consent grant selects purpose, fields, retention, and expiration, producing a reviewable working projection. Only that minimized projection can inform planning and the immutable generation specification. Excluded, revoked, or expired fields terminate at a blocked path rather than reaching the worker.

Semantic intent, mixins, and adapter compilation

Semantic intent is the model-independent statement of what the person wants a journey to explore. It combines a desired transition with words, metaphors, memories, inclusions, exclusions, priorities, and bounded acoustic preferences. A semantic mixin $m_j$ is a typed and versioned control object with a human-readable purpose, neutral position, bounds, conflicts, and adapter mapping. It is not a hidden prompt fragment and does not claim a linear mapping to acoustics or felt emotion.

For mixin $j$, the effective normalized control is determined by an explicit authority order: $$k^{\mathrm{eff}}_{j,t} = \begin{cases} k^{\mathrm{usr}}_{j,t}, & \text{when the person sets a current value},\\ k^{\mathrm{acc}}_{j,t}, & \text{when the person accepts a suggestion},\\ k^{0}_{j}, & \text{otherwise}, \end{cases} \qquad k^{\mathrm{eff}}_{j,t}\in[0,1].$$ ANT-EQ-004—Proposed operationalization; implementation: the generalized mixin control surface is not implemented.

An inferred value has no branch in Equation [eq:effective-knob]: it gains authority only through explicit acceptance. A current person-authored value therefore outranks an accepted suggestion, which outranks the neutral default. An active exclusion or safety constraint may reject a value or block a transition, but it may not silently substitute a different intent. Stop, revocation, and exclusion act immediately and are never smoothed.

For ordinary non-safety controls, a visible rate parameter may reduce jitter: $$\alpha_{j,t} = (1-\rho_j)\alpha_{j,t-1}+\rho_j k^{\mathrm{eff}}_{j,t}, \qquad 0<\rho_j\leq 1.$$ ANT-EQ-005—Proposed operationalization; implementation: control smoothing is not implemented or perceptually validated.

Both $k$ and $\alpha$ are dimensionless. The rate $\rho_j$, neutral zone, and maximum rate of change are mixin-specific, visible policy rather than model invention. Smoothing can reduce control jitter; it cannot prove a smooth musical transition or a helpful experience.

The resulting semantic condition for journey stage $n$ is $$q_{i,n} = \operatorname{Resolve}\!\left( q^{\mathrm{base}}_{i,n} \mathbin{\oplus} \bigoplus_{j=1}^{J}\alpha_{j,n}m_j; \Xi_{i,t},\prec_{i,t} \right),$$ ANT-EQ-006—Definitional; implementation: the typed generalized composition remains formalized only.

where $\oplus$ denotes typed composition, $\Xi$ contains active exclusions and constraints, and $\prec$ records the visible precedence order used to resolve conflicts. The operator cannot be interpreted as numerical addition or raw text concatenation. Human-scale controls may be grounded in established conditioning dimensions such as tempo, key, chord, and beat, while remaining separate from the model’s native prompt representation (Melechovsky et al. 2024; Tal et al. 2024).

The accepted journey plan $J_{i,t}$ remains model independent. A replaceable adapter $a$ compiles one stage against the adapter capability set $\mathcal{K}_a$: $$\begin{aligned} \gamma^{(a)}_{i,n} &= \operatorname{Compile}_{a} \!\left(J_{i,t},q_{i,n},\mathcal{K}_a\right),\\ \varphi^{(a)}_{i,n} &= \operatorname{Prompt}_{a}\!\left(\gamma^{(a)}_{i,n}\right). \end{aligned}$$ ANT-EQ-007—Proposed operationalization; implementation: only the immutable mock generation boundary is executable.

The conditioning state $\gamma$ records model-native controls, conflicts, downgrades, exclusions, uncertainty, and provenance. The prompt projection $\varphi$ is merely one adapter-specific projection of $\gamma$; it is not the journey plan or the canonical semantic record. An unsupported control must produce a visible downgrade or failure before generation. The person may accept the revised specification, change the plan, choose another compatible adapter, or stop. This separation permits model comparison without rewriting Antidote’s domain language and recognizes that requested conditions are not guaranteed to be realized by current generators (Melechovsky et al. 2024; Tal et al. 2024).

Figure description: Several semantic mixin cards expose a human-readable purpose, current value, neutral position, bounds, exclusions, priority, and adapter mapping. The cards combine into a versioned conditioning state that the person may inspect, correct, accept, or reject before generation. No arrow claims that a mixin directly causes an emotion.

Two-rate architecture and authority

The proposed architecture uses two clocks because model deliberation and audio rendering have different timing and authority requirements. A slower deliberative loop operates at meaningful decision points. It may inspect authorized observations, maintain alternative state hypotheses, combine person-authored intent, propose a short journey horizon, and request future generation. Every material change remains visible and correctable. A faster deterministic audio loop schedules already verified material, applies bounded gain and transition curves, tracks playback, and responds immediately to stop or underrun conditions. It does not infer psychology or rewrite semantic intent. Control-rate and render-rate separation has normative and neighboring-system precedents, but does not establish Antidote’s conformance or response quality (World Wide Web Consortium 2024; Hutchings and McCormack 2020; Ehrlich et al. 2019).

Authority crosses these loops asymmetrically. The person chooses context, desired journey, mixins, plan acceptance, generation, playback, retention, export, and whether evidence may inform a later proposal. The Rust domain core enforces those transitions and owns the canonical session record. A model worker receives only an approved generation specification and cannot read the database, change the personal model, initiate playback, or publish an interpretation. The renderer may halt or fall back when a deadline or safety condition fails, but cannot silently choose a new emotional goal.

At the source revision identified in this manuscript’s build provenance, an executable synthetic slice already composes a React/Tauri interface, Rust session authority, session-scoped context review, deterministic Level-1 journey planning, SQLite events, a supervised mock worker, verified synthetic WAV production, deliberate playback state, response capture, and safety halts. This is repository evidence, not human-outcome evidence. The generalized Semantic Intent Mixer, probabilistic state estimation, receding-horizon controller, generate-ahead queue, continuity engine, real music model, measured control adherence, privacy-reviewed export, optional sensors, and autonomous adaptation are not implemented. The governed final-figure specification requires both groups to be labeled so the proposed system cannot borrow credibility from the mock path.

“Closed loop” therefore names a governed possibility for later evidence to inform a new proposal. In v0, planning is rule guided, responses are recorded, and a personal-model change requires a separate evidence-linked proposal and human acceptance. The worker and controller have no autonomous learning authority.

Figure description: The numbered path begins with consented context, a correctable state belief, semantic intent, a journey plan, and explicit human approval. Approval produces one immutable generation specification that crosses into a capability-scoped model adapter. Variable-latency generation and verification prepare future audio before the proposed deterministic renderer consumes small audio blocks and segment boundaries for a deliberate playback path. Exposure remains a separate record of what was actually heard, and a response remains a separate observation that can return only as a dashed future proposal requiring human review; no automatic learning path exists. Solid cards identify the executable synthetic slice, dashed cards identify proposed capabilities, and split cards distinguish current mock or schema support from target behavior. The listening/exposure and response cards are split because playback state and response schemas exist while no qualifying human exposure or response is observed. Separate cancel, approved-fallback, and immediate-stop paths bypass semantic deliberation. The provenance spine requires source, version, hash, and authority lineage while explicitly making no claim of truth, privacy, safety, benefit, hard-real-time generation, or human outcome.

State belief, receding horizon, and generate-ahead buffer

Real-time evaluation begins with observations rather than a verdict about what the person needs. Let $o_{i,1:t}$ contain only provenance-linked explicit reports, control changes, playback actions, and optional signals authorized for the current purpose. A candidate state estimator may retain alternatives as a belief distribution $$b_{i,t}(x) = \Pr\!\left( X_{i,t}=x \mid o_{i,1:t},u_{i,1:t-1} \right).$$ ANT-EQ-008—Estimated model; implementation: no state estimator or sensor path exists in v0.

Equation [eq:belief-state] transfers belief-state notation from planning under partial observation; Antidote does not claim to implement a POMDP or to observe a hidden true emotion (Kaelbling, Littman, and Cassandra 1998). The state space, observation model, calibration, and confidence representation remain study questions. Person correction changes the system record and outranks the model view. Conflicting, missing, stale, or out-of-distribution observations should widen uncertainty or suspend a proposal rather than create false precision. Reviews of passive monitoring and electrodermal affect models reinforce this validation burden: missingness, feature variation, small samples, limited generalizability, and weaker valence inference constrain any future sensor use (De Angel et al. 2022; D’Amelio et al. 2025).

At a decision point, a conceptual receding-horizon planner may compare a sequence $U=(u_t,\ldots,u_{t+H_p})$ of semantic and musical control proposals: $$\begin{aligned} \mathcal{U}^{\mathrm{adm}}_{i,t} &= \mathcal{U}\!\left(A_{i,t},\Xi_{i,t},\mathcal{K}_a\right),\\ U^{*}_{i,t:t+H_p} &\in \operatorname*{arg\,min}_{U\in\mathcal{U}^{\mathrm{adm}}_{i,t}} \sum_{\tau=t}^{t+H_p} \left[ \bar{L}_{g}(\hat{x}_{i,\tau\mid t},g_{i,\tau},u_{i,\tau}) +\lambda_{\Delta}\bar{D}_{\Delta}(u_{i,\tau},u_{i,\tau-1}) +\lambda_{R}\bar{R}(u_{i,\tau}) +\lambda_{B}\bar{C}_{\mathrm{burden}}(u_{i,\tau}) \right]. \end{aligned}$$ ANT-EQ-009—Conceptual; implementation: v0 uses a deterministic rule-guided planner rather than this optimizer.

The admissible set is constrained by active consent $A$, exclusions and safety rules $\Xi$, and adapter capabilities $\mathcal{K}_a$. The four barred terms are normalized, dimensionless design costs: represented journey mismatch, control change, uncertainty or risk, and interaction burden. Their weights are therefore dimensionless policy choices, not learned clinical utilities. $\hat{x}_{i,\tau\mid t}$ is a planning estimate, not a predicted lived state. Only the first proposed action is shown; nothing is committed until the person approves it, after which the system observes and may replan. This is an MPC-inspired transfer under JITAI-like decision points, not a stability, optimality, intervention, or affect-dynamics claim (García, Prett, and Morari 1989; Nahum-Shani et al. 2018).

Generation must also finish before its audio is needed. If $B_{i,t}$ is the verified playable buffer in seconds, the proposed readiness condition is $$B_{i,t} \geq \ell_{\mathrm{observe}}+\ell_{\mathrm{plan}}+\ell_{\mathrm{generate}} +\ell_{\mathrm{verify}}+\ell_{\mathrm{schedule}}+M_{i,t}.$$ ANT-EQ-010—Proposed operationalization; implementation: generation latency and a generate-ahead buffer are not yet benchmarked.

Every term in Equation [eq:buffer-deadline] is measured in seconds; $M_{i,t}$ is an uncertainty margin derived from the declared hardware, adapter, and latency distribution. If the condition fails, the renderer uses a previously approved continuation, loop, ambient bed, or graceful ending. It does not insert unverified bytes or block the audio callback. Emerging streaming-generation work makes changing-input, chunk-wise generation a plausible future adapter, but does not establish local performance or production readiness (Wang, Bao, and Han 2026).

Figure description: A time axis shows the current playback cursor, verified buffered audio, generation in progress, and a future planning horizon. Above it, an uncertain state belief is corrected by the person before the next plan is accepted. Deadline and safety margins are marked independently from claims about subjective response or model quality.

Semantic, musical, and waveform continuity

A continuously changing prompt does not by itself produce a continuous listening experience. Antidote therefore separates three questions: whether neighboring semantic conditions change within their declared bounds, whether the realized audio is musically and acoustically compatible at a boundary, and whether the renderer joins verified samples without a signal discontinuity.

For adjacent stages $n$ and $n+1$, semantic-plan distance is $$D^{\mathrm{sem}}_n = d_{\mathcal{Q}}\!\left(q^{\mathrm{tail}}_{i,n}, q^{\mathrm{head}}_{i,n+1}\right),$$ ANT-EQ-011—Proposed operationalization; implementation: no validated semantic-distance function is selected.

where $d_{\mathcal{Q}}$ is a versioned, dimensionless distance over compatible typed controls and stage roles. It must expose which mixins contributed to the distance and cannot assume that interpolation in embedding or prompt space is perceptually linear.

Measured acoustic-boundary distance is independent: $$D^{\mathrm{ac}}_n = \sum_{r\in\mathcal{F}} w_r\, d_r\!\left( f_r(a^{\mathrm{tail}}_n), f_r(a^{\mathrm{head}}_{n+1}) \right), \qquad \sum_{r\in\mathcal{F}}w_r=1.$$ ANT-EQ-012—Proposed operationalization; implementation: the mock analyzer does not validate musical boundary continuity.

The feature family $\mathcal{F}$ may include normalized distances for tempo and beat phase, key or chord compatibility, loudness, spectral balance and timbre, density, and phrase-boundary alignment. The $w_r$ are nonnegative, dimensionless, and versioned; the feature-specific $d_r$ functions normalize otherwise incompatible units before aggregation. Thresholds for $D^{\mathrm{sem}}$ and $D^{\mathrm{ac}}$ require perceptual and technical evaluation and may differ by person or listening context. Loudness standards can anchor measurement practice without supplying a universal transition or hearing-safety threshold (European Broadcasting Union 2023).

Within an accepted overlap window $s\in[0,1]$, one waveform-level candidate is the equal-power crossfade $$y(s) = \cos\!\left(\frac{\pi s}{2}\right)a_n(s) + \sin\!\left(\frac{\pi s}{2}\right)a_{n+1}(s).$$ ANT-EQ-013—Proposed operationalization; implementation: no adaptive continuity renderer exists in v0.

Both input signals and $y$ share the same sample-amplitude units. The equation can reduce a gain discontinuity; it cannot repair incompatible meter, phase, harmony, phrase, timbre, meaning, or emotional pacing. Resequencing, reorchestration, continuation generation, stem mixing, and a graceful ending are separate strategies. A transition is eligible for playback only after its artifact integrity, buffer margin, semantic condition, acoustic measurements, and relevant safety constraints pass their own checks. Failure of any one check invokes an approved fallback rather than being hidden by a crossfade.

Figure description: The upper lane shows two versioned conditioning states and a bounded semantic transition. The lower lane shows adjacent audio segments, overlap or crossfade regions, waveform and feature measurements, and acceptance or fallback decisions. Separate indicators make clear that semantic similarity does not guarantee smooth audio and smooth audio does not prove intended meaning.

Exposure, response, and advisory updating

The generated segment $a_n$ is not the exposure $e_{i,t}$. Exposure records which content hash was actually played, when playback began, duration heard, completion, interruption, stop reason, and safety events. Response is then a heterogeneous record linked to that exposure: $$\mathsf{Y}_{i,t} = \left( y^{\mathrm{perc}}_{i,t}, y^{\mathrm{felt}}_{i,t}, y^{\mathrm{int}}_{i,t}, w^{\mathrm{int}}_{i,t}, y^{\mathrm{help}}_{i,t}, y^{\mathrm{harm}}_{i,t}, y^{\mathrm{res}}_{i,t}, y^{\mathrm{mis}}_{i,t}, y^{\mathrm{after}}_{i,t} \right).$$ ANT-EQ-014—Definitional; implementation: the mock slice captures a bounded subset and keeps exposure separate.

The components describe perceived musical expression, felt state, intensity, whether that intensity was wanted, immediate helpfulness, possible harm, resonance, mismatch, and a later aftereffect. They may contain text, bounded scores, categorical values, or missingness, so Equation [eq:response-record] is a record declaration rather than a numeric vector. Intense crying, for example, cannot be classified as success or harm from intensity alone; the person’s appraisal, stop behavior, and later account remain separate evidence.

A future within-person response model could estimate $$p_{\theta_i}\!\left( \mathsf{Y}_{i,t} \mid e_{i,t},z_{i,t} \right),$$ ANT-EQ-015—Future empirical model; implementation: no response predictor is fitted or used for generation.

where $\theta_i$ parameterizes a person-specific and versioned hypothesis. Conditioning on exposure prevents an unplayed artifact from becoming response evidence. The model would need to represent uncertainty, changed meanings, missing responses, contradictory sessions, and alternative explanations; it could not infer clinical benefit from acoustic adherence or immediate affect.

If a future protocol justified Bayesian updating, a candidate posterior form would be $$p\!\left(\theta_i\mid\mathcal{D}_{i,1:t}\right) \propto p\!\left( \mathsf{Y}_{i,t} \mid e_{i,t},z_{i,t},\theta_i \right) p\!\left(\theta_i\mid\mathcal{D}_{i,<t}\right).$$ ANT-EQ-016—Future empirical model; implementation: v0 records evidence-linked proposals and prohibits autonomous updating.

Equation [eq:personal-update] is deliberately generic: it does not specify a valid likelihood, prior, forgetting rule, causal effect, or sufficient sample size. In the current authority model, eligible observations may support a descriptive proposal, but a new personal-model snapshot is created only after the person reviews the evidence and accepts the update. Rejection preserves both the prior snapshot and the rejected proposal. The design follows an interactive-machine-learning rationale while retaining the possibility that feedback requests can be burdensome or reduce trust (Amershi et al. 2014; Honeycutt, Nourani, and Ragan 2020).

Figure description: Six cards cover all 16 registered equations. They separate moment and authorized context; semantic mixing and model-specific adaptation; uncertain state belief and a negotiated planning horizon; buffer and independent semantic, acoustic, and waveform continuity; exposure-linked response; and a future within-person update. Each card states its epistemic class and implementation status. Dashed arrows show record dependencies rather than established causality, and the final warning rejects any reading of the equations as validated affect laws, optimal policies, or authorization for autonomous learning.

Provenance and failure boundaries

Every derived record links to the activity, agent, version, and source records that produced it. For generation this includes the accepted plan hash, adapter and model identity, code revision, effective parameters, seed when supported, device class, elapsed time, warnings, downgrade decisions, output hashes, and feature-analyzer versions. For exposure and response it includes the artifact hash, playback interval, interruption state, observation window, instrument version, missingness, corrections, and permission for later use. W3C PROV supplies an interoperable vocabulary for entities, activities, agents, and derivations, while Workflow Run RO-Crate demonstrates a packaging pattern for computational lineage (Moreau and Missier 2013; Leo et al. 2024). Antidote proposes to use those concepts; a provenance record remains an assertion to audit, not proof that its interpretation is true.

The system fails closed at the boundary whose precondition is missing. Invalid, expired, or ambiguous consent prevents projection. Conflicting mixins or an unsupported capability prevent compilation until the conflict or downgrade is reviewed. A worker crash, malformed response, timeout, partial output, path violation, size violation, or hash mismatch cannot become a playable verified artifact. A missed generation deadline invokes an approved fallback. A stop, reported harm, or safety event halts automatic continuation and is never scored as engagement. A failed or rejected model update preserves the prior snapshot. An export remains blocked when classification, minimization, redaction, consent, privacy review, or destination approval is incomplete.

Append-only events make those transitions reconstructable, while separately classified payloads permit future retention and deletion policies to act on sensitive content. The present repository implements integrity and replay for the synthetic path; encryption, key recovery, backup, secure deletion, projection invalidation, real-model sandboxing, and privacy-reviewed research export remain unresolved. Local execution and content hashes reduce some dependencies and improve traceability, but they do not establish security, ownership, meaningful consent, safety, or benefit.

Figure description: Versioned session events, model identity, control records, exposure, response, and artifact hashes feed an export candidate. Four gates check purpose and consent scope, excluded or sensitive fields, privacy review, and explicit human approval. Any failed or unresolved gate stops export and records the reason; a successful path emits a manifest and checksums without asserting truth or safety.

Planned measurement layers

The protocol preserves intended semantic controls, model and adapter identity, generation settings, output identity and checksum, measured acoustic features, actual exposure, baseline and target states, separated subjective responses, timestamps, protocol version, and mutations between trials. These layers are non-interchangeable. A requested control is not a realized acoustic property; a measured acoustic property is not perceived expression; perceived expression is not felt state; and emotional intensity, completion, or engagement is not evidence of usefulness, harm, or clinical benefit. Behavioral or physiological measures are optional extensions and cannot become the sole definition of a person’s experienced state.

Evidence classification

Research records use five non-interchangeable classes: source for what external evidence establishes, hypothesis for what the project proposes, observation for what occurred, interpretation for a bounded explanation of an observation, and claim for a statement supported in the manuscript. The working claim ledger is maintained outside publication artifacts under research/notes/. Synthetic fixture output and repository tests remain technical observations; they are not participant data.

Research questions and feasibility stages

The protocol maps the three research questions to four evidence stages. D0 addresses RQ1 through design traceability: each transformation and authority boundary must resolve to a versioned record, equation, contract, or explicit unavailable state. T0 addresses the implemented portion of RQ2 with synthetic, deterministic conformance and recovery tests. T1 would extend RQ2 to a frozen real-model, adapter, analyzer, hardware, and mutation manifest, but is currently blocked-no-real-model. H1 would address the record-feasibility prerequisite to RQ3 through a prospective repeated-session within-person series, but is blocked-no-collection-authority. Passing D0 or T0 neither implies that T1 will pass nor authorizes H1. H1 can test only whether separated records can be collected, corrected, retained, and provenance-linked with auditable completeness, voluntary-response usability, burden, and safety-event accounting. That is a prerequisite for RQ3, not a test of useful advisory relationships. Likewise, technical controllability cannot establish that an exposure is subjectively fitting, useful, safe, or therapeutically effective.

Units, conditions, and session structure

The technical unit is one immutable generation specification and its terminal result; the human-response unit is one assigned session attempt, with an exposure counted only when a verified artifact is actually played. The proposed H1 series contains six blocks and three conditions per block, for 18 planned completed exposures and an absolute ceiling of 24 scheduled attempts. Each artifact targets eight minutes. Exposures are separated by at least 48 hours, limited to three in any seven days, and followed by an aftereffect window targeting 24 hours (acceptable range 18–30 hours).

Condition G is a generic instrumental ambient generation that receives neither current state, desired transition, nor personal context. Condition S receives only selected current-state and desired-transition categories and a frozen meet–hold–transition–integrate template; it receives no free-text history, personal descriptors, or prior-session mappings. Condition P receives the explicitly approved working projection, person-authored semantic mixins, inclusions, exclusions, and an editable journey plan. Across conditions, a qualifying execution would hold constant the immutable model revision, adapter and analyzer versions, hardware profile, duration, output format, playback setup where feasible, response-instrument version, and file target of $-23$ LUFS integrated loudness with a $-1$ dBTP true-peak ceiling. File-level normalization neither determines sound-pressure level at the ear nor establishes hearing safety; playback begins at the lowest device level and remains under the person’s control. Auditory beats, within-exposure adaptation, and personal- model updating are excluded from this protocol.

These are visibly different condition-and-interface bundles. They jointly vary context fields, desired-transition use, personal semantic content, plan visibility, editing, and—for P—negotiated approval. Randomization permits only within-person contrasts among those bundles. It cannot isolate personalization, a semantic field, plan editing, approval, or a psychological or neurological causal pathway.

Each prospective session follows eight governed steps: authority and readiness; baseline and desired transition; condition reveal and plan review; generation and verification; a separate, explicit playback action; immediate response within five minutes; later aftereffect report; and closure or pause. A generated but unplayed artifact never enters an exposure or human-response denominator. The current desktop MVP is not this H1 instrument, and records produced through its schema-generation v1 runtime payloads are not H1-eligible. H1 remains blocked until, at minimum, the timed session workflow, separate version 2 consent enforcement, version 2 response and correction contract, assignment and seed enforcement, participant-facing instrument, safety workflow, and minimum-data private research export have been implemented and independently reviewed.

Figure description: The timeline begins with protocol version and consent confirmation, then baseline and desired trajectory, plan review, generation and artifact verification, explicit playback approval, exposure with stop controls, immediate separated response measures, a declared aftereffect interval, and later review. Safety events may interrupt the sequence at every exposure-related stage.

Technical verification

T0 verifies the mock system’s authority, schema, replay, interruption, recovery, hashing, and provenance invariants with complete denominators. T1, if activated after implementation review, freezes a real-model qualification manifest before any qualifying run. Its planned matrix contains three baseline runs, 24 one-factor mutation runs, six adjacent-segment continuity runs, and six injected failure-and-recovery runs: 39 attempts if all declared controls are supported. The fixed seeds are 101, 307, and 911.

The one-factor pairs vary tempo (70 versus 100 BPM), normalized density (0.25 versus 0.65), timbral instruction, or semantic intent while holding seed, model, adapter, hardware, duration, output format, base plan, and all other controls constant. Tempo and density require versioned measured outputs. Timbral comparison requires a named analyzer and uncertainty. Semantic mutation is verified only as an adapter-conditioning trace unless an independently specified measure exists; it is not relabeled as acoustic adherence. Unsupported controls remain unsupported rather than being silently substituted.

The technical measures are authority-state conformance, required provenance completeness, component latency and verified buffer margin, requested-versus- measured control adherence, semantic and acoustic boundary distances, and terminal generation state. They correspond to the consent projection, adapter, generate-ahead, continuity, and response-record equations (ANT-EQ-003, ANT-EQ-007, and ANT-EQ-010–ANT-EQ-014). Hard gates require all invalid or unapproved transitions to fail closed; every playable artifact to match its declared hash, format, and bounded path; cancellation, timeout, stop, and safety halt to reach recorded terminal states; and no missed deadline, partial output, or unsupported control to be reported as success. Hardware- and adapter-specific latency, buffer, analyzer, and perceptual thresholds must be frozen in the later T1 manifest; this paper invents no universal threshold. For each registered component latency and verified buffer-margin variable, reporting fixes $n$, minimum, maximum, the ordinary arithmetic median, and $q_{0.50}$, $q_{0.90}$, and $q_{0.95}$. Quantiles use fixed linear interpolation: $h=(n-1)p+1$, $j=\lfloor h\rfloor$, $g=h-j$, and $Q(p)=(1-g)x_{(j)}+g x_{(j+1)}$, with the upper index capped at $n$. Values are calculated from unrounded seconds separately for each component and terminal state. These summaries remain descriptive rather than universal thresholds.

Within-person feasibility measures

The proposed H1 instrument uses brief, near-event self-report because ecological momentary assessment can reduce recall distance while introducing its own burden, reactivity, adherence, and missingness concerns (Shiffman, Stone, and Hufford 2008). Baseline captures a person-authored description plus valence, arousal, and intensity; desired transition remains a separate nominal category with a person-authored description. Those descriptions are required by the current moment-context contract. The compact valence and arousal interaction borrows from the Affective Slider (Betella and Verschure 2016), but Antidote’s wording, intensity, response timing, and additional items constitute a new protocol and are not validated by that source.

After exposure, the instrument records perceived musical expression separately from felt state. It then records whether the intensity was wanted, as well as helpfulness, resonance, mismatch, harm, surprise, interaction burden, and total session burden. Helpfulness and harm are asked again in the later aftereffect window together with a yes/no/unsure ongoing-effect item and optional person-authored meaning, without overwriting the immediate record. Response descriptions are optional in the version 2 response contract; every prompted-but-absent response field instead receives its own field path and exactly one of not_prompted, declined, missed_window, technical_failure, interrupted, or not_applicable. A correction is a new record carrying the superseded response identifier and correction reason.

Every subjective scale is frozen. Valence runs from $-1$ “very unpleasant” through 0 “neither pleasant nor unpleasant, or evenly mixed” to $1$ “very pleasant”; arousal runs from $-1$ “very low activation” through 0 “neither low nor high” to $1$ “very high activation”; intensity runs from 0 “not at all intense” to 1 “extremely intense.” Wanted intensity and ongoing effect each use the nominal responses yes, no, and unsure. Helpfulness runs from “not at all helpful for my chosen purpose” to “as helpful as I could reasonably ask for that purpose”; resonance from “did not fit or resonate at all” to “fit or resonated completely”; mismatch from “no perceived mismatch” to “extreme perceived mismatch”; harm from “no unwanted negative effect noticed” to “extreme unwanted negative effect”; and surprise from “entirely expected” to “entirely unexpected.” Interaction burden and whole-session burden are separate items, each running from “not burdensome” to “too burdensome to repeat.” No clinical outcome is collected, and no emotional direction is prespecified as inherently better. In particular, catharsis, crying, arousal, or movement toward a target cannot substitute for the person’s appraisal of whether the experience was wanted, helpful, mismatched, or harmful.

Physiology is disabled in version 1.1.0. A future supplemental module would require separate consent; device, calibration, clock, unit, signal-quality, artifact, dropout, and missingness records; a frozen analysis; and independent privacy and safety review. It could not overwrite self-report, diagnose emotion or need, prove entrainment, or steer generation under this protocol.

Prospective projection of ANT-PROT-FEAS-001 v1.1.0. Collection authority is false. Scale shorthand preserves the frozen anchors; prompted but absent fields retain explicit missingness rather than a substituted value.

Table description: Each row names one non-interchangeable measurement layer. Columns identify the planned instrument, collection timing, provenance fields, missing-data treatment, and the strongest permitted interpretation. Clinical outcome is shown as outside the initial feasibility protocol rather than inferred from the other rows.

Assignment, carryover, and missingness

The six possible orders of G, S, and P are each used once. Their block order is randomized with a cryptographically generated seed committed in a separate activation record before session 1. This is a bijection of six distinct orders to six chronological blocks, so the allowable schedule space is exactly $6!=720$. It is not six independent draws. The machine-readable protocol maps a 32-byte seed uniformly to a zero-based lexicographic schedule index using SHA-256 rejection sampling and records the counter, index, schedule, and commitment. H1 additionally fixes block seeds 101, 307, 911, 1217, 1601, and 2027 in chronological order and uses the same block seed for G, S, and P. A model or adapter that cannot honor that commitment leaves H1 blocked. The committed seed is never substituted; any pre-exposure retry retains it, and no retry is allowed after hearing or rating its output. Eligibility and baseline are confirmed before condition reveal. Participant blinding is impossible because the three interfaces disclose different context and plan operations; researcher blinding is also impossible in a self-study, and both facts must be reported. A failed assigned session remains in the attempt ledger. A replacement is allowed only before any exposure starts, retains the same block, slot, condition, and committed block seed, and never erases the failure. Once playback starts, the slot is consumed regardless of completion or response and cannot be rerun based on what was heard or reported.

At least 48 hours and completion or expiry of the later-response window separate exposures. Ongoing aftereffect, mismatch, distress, hearing discomfort, or uncertainty postpones the next attempt by at least another 24 hours and triggers a repeated readiness review. This spacing may reduce but cannot prove removal of carryover. Flagged sessions remain in primary accounting and are examined in a prespecified sensitivity analysis.

Analyses distinguish all assigned attempts, verified artifacts, started exposures, completed exposures, immediate windows, and later windows. No outcome is imputed in the primary analysis. Each prompted but absent field carries its own canonical missingness reason. Condition contrasts use only blocks containing both required observations and disclose every omitted block. Lower- and upper-endpoint values are used only for the prespecified interaction-burden progression sensitivity, never as substituted observations.

Analysis and sensitivity plan

Technical reporting includes complete state denominators, invariant outcomes, the frozen latency summaries, paired control differences by factor and seed, and every semantic and acoustic boundary component. Human-response feasibility reporting includes assigned through withdrawn counts by condition; audit completeness; usable voluntary values by field and canonical missingness reason; separate interaction- and whole-session-burden distributions; all mismatch, harm, hearing-discomfort, distress, and safety events; and the ability to link semantic, acoustic, exposure, response, and correction records through provenance. A declined response can be audit-complete but is not counted as a usable response.

Secondary within-person estimands are blockwise P-minus-S, P-minus-G, and S-minus-G contrasts for immediate helpfulness, resonance, mismatch, harm, and interaction burden and whole-session burden separately; differences between perceived-expression and felt-state valence and arousal; and condition-specific baseline-to-immediate valence and arousal changes. Protected analysis output retains every session point; the public envelope exposes only privacy-reviewed aggregate denominators, medians, ranges, and eligible blockwise contrasts. Exploratory variable-pair searches and multivariable response regressions are not run: with at most 18 exposures, neither a search nor simultaneous condition, block, order, and baseline coefficients are defensibly supported. A later protocol would have to name its variables, model, and sample-size rationale prospectively.

For a named immediate outcome and pairwise contrast, an exact randomization distribution is available only when all three chronological position values are present in all six blocks. It holds those values fixed, enumerates lexicographically all 720 bijections of the six condition orders to the six blocks, assigns labels under each schedule, and uses the mean of the six within-block A-minus-B differences as the statistic. The two-sided tail includes every unrounded statistic with absolute value at least the observed absolute value, including ties, and reports the count divided by 720. All 720 statistics are retained in the protected analysis output. A public aggregate reports the observed statistic, tail count, denominator, exact proportion, and privacy- reviewed distribution summaries; the full vector is not released without a separate field-level disclosure review and current export scope. No reduced, asymptotic, one-sided, plus-one, or multiplicity-adjusted substitute is used. This is an exploratory reference for the single person and schedule under a sharp no-bundle-effect null, not population inference or component-level causal attribution.

Sensitivity analyses compare started exposures with those reaching 80 percent of audio (384 of 480 seconds), include and exclude named carryover flags, report blocks 1–3 and 4–6 separately without treating the split as a trend test, leave out each block in turn, and stratify by administration status only if it actually changes. For missing interaction-burden values only, the progression decision is repeated once with 0 and once with 1. Audit completeness, completion, usable-response proportions, provenance, and unresolved safety are factual and cannot be rescued by bounds. Helpfulness and resonance otherwise use 1/0 as descriptive best/worst endpoints; mismatch, harm, and both burden fields use 0/1; valence, arousal, intensity, and surprise receive endpoint ranges without calling either direction better; and nominal fields are never numerically imputed. All prespecified null, zero, opposite-direction, negative, missing, interrupted, burdensome, harmful, and adverse observations remain visible. No endpoint will be selected or renamed after observation.

The progression rule is operational rather than therapeutic. A later bounded study may be considered only if the hard technical gates pass; at least 15 of 18 exposures and at least four per condition complete; every assigned attempt and scheduled window is audit-complete; and every immediate core field has at least 80 percent of the started-exposure count, rounded upward to the next whole value, overall and at least three per condition, while every later core field has at least 70 percent of that count, again rounded upward, overall and at least two per condition. Every eligible response must preserve the full protocol-to-correction provenance chain. Observed median interaction burden and both its endpoint-bound decisions must be no greater than 0.5; no safety event may remain unresolved; and the participant and an independent reviewer must separately find another bounded study acceptable. Otherwise the decision is stop or revise. Even a “proceed” decision establishes neither advisory usefulness, efficacy, generalizability, privacy, nor safety.

Equation ANT-EQ-014 defines the separated response record used here. ANT-EQ-015 and ANT-EQ-016 remain unavailable future empirical models: this protocol fits no response predictor, specifies no likelihood, and authorizes no personal-model update.

Protocol freeze, safety, and deviations

The canonical protocol, its SHA-256 lock, and an initially empty append-only deviation log are stored under experiments/protocols/. Before the first qualifying record, a material change requires a new semantic protocol version, content lock, analysis plan, and review. After collection begins under separate authority, the frozen file is never rewritten: amendments and deviations append the rationale, affected records, evidence impact, author, reviewer, and disposition. Conditions, assignment, timing, measures, estimands, exclusions, model or analyzer identity, consent, privacy, retention, safety, physiology, and missingness rules are material changes.

The person may postpone, pause, skip, stop, withdraw, or decline any response without penalty or automatic substitution. A stop request or consent revocation, hearing pain or unexpected loudness, unwanted escalating distress or disorientation, technical or provenance failure, or any loss of freely chosen participation stops playback and prevents automatic continuation. The interface must offer silence and a clear exit, retain only the minimum consented event, and defer optional questions until the person chooses. Urgent concerns belong with appropriate human or emergency support, not Antidote. Unresolved adverse responses, serious events, stop-control failure, or repeated high harm pause the protocol for independent review; these rules do not prove clinical safety.

For those pause rules, “high harm” means a non-missing immediate or later harm rating of at least 0.75, or an explicit request by the person to treat an event as high harm. “Repeated” means high harm associated with two distinct started exposures; immediate and later reports from one exposure count once. A “serious event” is operationally an event for which urgent or emergency human assessment is sought; reported hospitalization, persistent hearing change, or persistent functional impairment; incapacity preventing a self-directed exit; continued playback after a stop request; or unauthorized access, retention, or export of consent-scoped sensitive data. This is not a diagnosis or clinical severity judgment. An event is unresolved while it lacks a documented disposition, a reported unwanted effect remains ongoing or unsure, or required independent review is incomplete. Serious events and stop-control, privacy, or consent failures cannot close automatically.

Separate consent scopes govern inspection, projection, generation, playback, retention, analysis, export, and learning (future personal-model use). Raw journal, therapy-chat, health, or other private free text cannot enter the public repository or a default research export. Storage encryption and recovery, retention expiry and deletion, projection invalidation, backups, participant materials, the applicable ethics determination, assignment commitment, version 2 consent enforcement, protocol timing, version 2 response and correction handling, minimum-data private research export, instrument implementation, analysis code, and pilot stop/go review all remain unresolved activation gates. Consequently, this protocol is reproducible as a design artifact but is not permission to recruit, expose, collect, or report a human result.

Technical verification reporting

The D0 protocol record is available for inspection. Its identity and content lock are repository artifacts, while the reporting contract declares the intended slot, schema, equation, and activation-gate mappings. This is evidence that versioned design records and explicit mappings exist; it is not an execution result, an independent audit of implementation, or evidence of feasibility, privacy, safety, or benefit.

The repository also contains an executable synthetic session path and its component tests, as bounded by ANT-OBS-002. Those artifacts remain development and conformance evidence. The ANT-Q03 exit gate in issue #18 has not produced the reserved ANT-REC-T0-001 result package, so no T0 rate, count, latency, or success claim is promoted here. Closing an issue or observing a green workflow would not be sufficient by itself. Promotion requires the reviewed source revision, execution environment, exact commands, planned denominators, every terminal state, injected failure and recovery, artifact hashes, exclusions, and an explicit claim-ledger decision. Any accepted T0 statement must retain the labels synthetic and technical and cannot imply a human exposure or response.

No interface capture is included in the current manuscript because the qualifying ANT-REC-T0-001 package does not exist. The governed visual slot is retained as retired provenance so a later revision can reactivate it only with a reproducible reviewed build, capture metadata, an explicit synthetic-or-approved-data label, and redaction review. Interface presence could demonstrate that a control is displayed; it could not demonstrate that the underlying authority is complete or that an experience is helpful.

Control adherence and continuity

T1 remains blocked-no-real-model. No T1 qualification manifest has frozen a specific model, adapter, analyzer, hardware profile, technical threshold set, or run plan, and ANT-REC-T1-001 does not exist. Consequently, the governed table below contains source and analysis identities plus current evidence states, but no attempt accounting, authority or artifact-integrity invariant results, requested controls, measured features, adherence values, latencies, buffer margins, boundary distances, failure rates, or uncertainty estimates.

Exact planned paths and protocol pointers are governed by ANT-REPORT-RESULTS-001. No qualifying values are registered; absent is not zero.

Table description: The generated empty-state table maps each future technical result to a source package, protocol version, and analysis identifier. The mock exit-gate row awaits issue 18, while all real-model rows are blocked because no model qualification has run. The table reports no rates, latencies, adherence estimates, boundary distances, or subjective outcomes.

If T1 is later activated, its matrix reaches 39 attempts only when every declared control is supported; otherwise reporting will name each unsupported or missing attempt and the resulting denominator. Authority and artifact-integrity invariants will each be reported as pass, fail, or unavailable rather than being inferred from an aggregate success state. Requested-versus-measured differences will be paired by factor and seed; generation latency and verified buffer margin will name the hardware context; semantic and waveform boundary components will remain separate; and partial output, timeout, cancellation, failure, and recovery will stay in their denominators. Unsupported semantic controls will be reported as unsupported rather than assigned an invented acoustic measure. A technically accurate tempo, sufficient buffer, or small waveform boundary does not establish perceived continuity, affective fit, safety, or therapeutic value.

No benchmark graphic is included until the T1 source package and analysis outputs pass promotion review. Its governed visual slot is retained as retired provenance. A future reactivation must show denominators, uncertainty, missing runs, failures, model and hardware revisions, and source-package and analysis identities rather than only favorable traces.

Exposure and response completeness

H1 remains blocked-no-collection-authority; none of its activation gates is satisfied and no assigned attempt, generated study artifact, exposure, or response record is registered. The table shell names the future flow, immediate-response, later-response, cross-package provenance, and progression analyses. Its blocked cells are not denominators and must not be read as zero events.

Exact planned paths and protocol pointers are governed by ANT-REPORT-RESULTS-001. No qualifying values are registered; absent is not zero.

Table description: The generated empty-state table maps assigned-attempt and exposure flow, immediate response completeness, and later aftereffect completeness to their planned source packages, protocol version, and analysis identifiers. Every row is blocked because H1 collection lacks authority. The blocked state is not a zero denominator or evidence that no response occurred.

After separately authorized collection, reporting would begin with every assigned attempt and retain the transitions to attempted generation, verified artifact, started playback, completed exposure, immediate window, and later window. Conditions G, S, and P would be shown separately and together. Generated but unplayed audio would remain outside the exposure denominator; an interrupted session would remain in the attempt ledger; a replacement would not erase the original assignment; and withdrawal would not be converted into technical failure. Each response field would be classified as present or with exactly one canonical reason: not_prompted, declined, missed_window, technical_failure, interrupted, or not_applicable. The wanted-intensity and ongoing-effect responses of unsure are present answers, not missingness.

The progression report would show every criterion as pass, fail, or indeterminate and would keep audit completeness separate from usable voluntary response completeness. An explicit decline can complete the audit trail but cannot be counted as a response value. The public H1 audit envelope would also have to reconcile the flow, response, and safety envelopes before any H1 slot could be promoted. A stop, revise, or proceed disposition concerns only a later bounded protocol and cannot establish advisory usefulness, improved targeting, efficacy, privacy, generalizability, or safety.

Subjective response and aftereffect

No perceived-expression, felt-state, helpfulness, resonance, mismatch, harm, surprise, burden, or aftereffect observation is reported. The reporting contract reserves six distinct H1 analysis views: perceived musical expression versus felt state; baseline-to-immediate felt-state change; immediate appraisal by condition; exact randomization uncertainty; prespecified sensitivities; and immediate versus later aftereffect. The first preserves both reports without declaring either one correct. The second uses only paired present baseline and immediate valence or arousal values. The third retains every session point and prespecified within-block P-minus-S, P-minus-G, and S-minus-G contrast in the protected analysis output, while the public envelope exposes privacy-reviewed aggregate summaries only. These compare bundled conditions and cannot isolate the effect of personalization, context access, or plan editing. The sixth retains the immediate and later records as separate window-specific protected accounts rather than using later meaning to rewrite the immediate response.

Future public summaries must display exact aggregate denominators, prespecified medians, ranges, and blockwise summaries; session-level values remain in protected analysis output. The exact randomization distribution is eligible only if all six blocks satisfy its frozen analysis conditions. It enumerates the 720 assignments of the six unique condition sequences to the six chronological blocks; it is exploratory within-person uncertainty, not a population estimate or confirmatory test. No clinical outcome is collected, and movement toward a desired state cannot substitute for the person’s appraisal of whether an experience was wanted, helpful, mismatched, burdensome, or harmful.

Any populated report must also retain the prespecified sensitivity views: started exposures versus those with at least 80 percent of audio heard, with versus without carryover flags, blocks one through three versus four through six, all six leave-one-block-out summaries, administration status only if both statuses occur, and the declared lower- and upper-bound burden decisions. These are reporting views rather than opportunities to select a preferred estimate after observing the data. A bound that changes the decision makes that criterion indeterminate and the final disposition revise; it is not resolved in the preferred direction. None has been computed.

Null, negative, missing, and adverse observations

The empty-state table gives null or opposite-direction response, mismatch or unwanted intensity, burden, harm or adverse response, missingness, and interruption the same structural visibility as a future favorable observation. It contains no event counts because H1 has not begun.

Exact planned paths and protocol pointers are governed by ANT-REPORT-RESULTS-001. No qualifying values are registered; absent is not zero.

Table description: The generated empty-state table assigns source and analysis identities to null or opposite-direction response, mismatch or unwanted intensity, burden, harm or adverse response, missing or declined data, and stop or interruption. Every row is blocked because H1 has not begun. The table contains no fabricated zeroes and does not treat intense emotion as success.

In a qualifying report, zero movement would remain distinct from a missing measurement; opposite-direction movement would remain distinct from harm; mismatch would remain distinct from unwanted intensity; unsure would remain distinct from missing wanted intensity or ongoing effect; and declined would remain distinct from missed_window or technical_failure. Stops, interruptions, hearing discomfort, distress, consent or privacy failures, technical safety failures, and participant-described adverse responses would be listed with their denominators and review dispositions. None could be silently removed because it weakens a narrative. Conversely, the absence of an observed adverse event in a bounded series could not establish clinical safety.

Optional physiological observations

Physiology is disabled under protocol version 1.1.0. No physiological source record, analysis, panel, or result row is authorized, and no vital sign or sensor estimate may steer generation within this protocol. A future module would require a protocol amendment, separate consent, device and clock records, signal-quality and artifact handling, a frozen analysis, and independent privacy and safety review. Even then, physiology would remain supplemental: it could not diagnose emotion or need, overwrite self-report, demonstrate entrainment, or establish benefit.

Promotion and replacement rule

The current Results state is a governed empty-state specification: its three tables are deterministic version 1.1 projections bound to the final protocol lock, while the two evidence-contingent visual slots are retired and absent from the manuscript. To replace an empty state, a future change must add the reserved source package, validate its protocol and analysis identity, preserve complete denominators and non-positive records, register any deviations, and record a claim-ledger promotion decision. The reporting contract and generated projection must then be versioned together. A source package may remain available in the repository while its manuscript claim is rejected or downgraded.

Every H1 repository source is a privacy-reviewed aggregate envelope with a .public.json suffix. The flow, response, safety, and audit envelopes must share one evidence-set identity and opaque, nonce-bound integrity commitment. Public envelopes may contain aggregate accounting, prespecified summaries, uncertainty, public-safe artifacts, and review dispositions; they may not contain participant, session, consent-grant, or source-event identifiers, raw or free-text responses, row-level observations, private paths, per-record hashes, stable cross-package pseudonyms, or participant-event timestamps. The private evidence index and commitment nonce remain outside Git. Their commitment supports reconciliation only; it does not prove anonymity, consent, authenticity, truth, completeness, efficacy, or safety.

This gate is deliberately asymmetric: qualifying evidence may populate only the slot it supports, while failure at any provenance, authority, analysis, or claim boundary leaves the slot unavailable. Technical verification cannot unlock human-response claims, H1 feasibility cannot establish efficacy, and no result at these stages can establish a neurological mechanism.

Contribution at the design evidence level

Antidote’s contribution at this stage is the specification of a research object and its governance, not evidence that an adaptive audio system changes a listener’s state. Current-to-target selection, person-specific modeling, generated affective trajectories, continuous musical feedback, interpretable controls, and semantic planning each have prior precedent (Janssen, Broek, and Westerink 2012; Daly et al. 2016; Ehrlich et al. 2019; Agres, Dash, and Chua 2023; Zhang et al. 2026). The narrower contribution is to formalize how consented context, semantic intent, a time-indexed plan, adapter-specific conditioning, acoustic realization, actual exposure, separated response constructs, provenance, and a possible later update can remain individually inspectable. Our bounded review did not identify that complete governed chain in one evaluated system. This supports a candidate research-system contribution, not a global first-system claim.

Two separations carry most of the design rationale. The first is epistemic: the record that requests a property is not the measurement of its realization, and neither record determines what a person perceived, felt, found helpful, or found harmful. The second concerns timing and authority: in the proposed two-rate architecture, uncertain semantic deliberation may prepare verified future material, while a deterministic renderer would own audio deadlines and the immediate stop path. These separations make disagreements locatable in principle. A plan may be accepted while an adapter visibly downgrades one control; an artifact may satisfy its file checks while missing a requested acoustic property; or playback may be technically continuous while the person reports mismatch. Preserving those possibilities is more defensible than calling a prompt, affect label, or aggregate score “interpretable.” It does not guarantee that the records are understandable, correct, complete, or safe.

Three proposed components turn this separation into falsifiable design claims. The Semantic Intent Mixer can be tested for preservation of typed controls, exclusions, authority precedence, conflict resolution, and visible adapter downgrades; its control values do not imply linear changes in acoustics or felt response. The predictive horizon is a receding horizon over candidate controls, not a forecast of the person’s lived state: it can be tested by whether only the first approved action is committed and whether verified future material meets a frozen generation deadline. Continuity must be tested separately as semantic-plan distance, measured acoustic-boundary distance, and waveform scheduling; success at one layer cannot establish the others or a person’s perception of continuity. None of the three is implemented or validated end to end.

Five evidentiary distinctions must therefore remain non-interchangeable. Demonstrated implementation means that a named capability executes at a reviewed source revision; at that revision, the only executable session evidence is the rule-guided synthetic slice described in Section 3.4. Technical feasibility must remain stage-specific: qualifying T0 records can establish only the synthetic authority, schema, replay, interruption, recovery, hash, and provenance invariants; T1 would additionally require real-model adherence, continuity, latency and buffer-margin, and failure-and-recovery evidence under a frozen model, adapter, analyzer, hardware, mutation, and seed manifest. Experiential feasibility would require authorized H1 records showing that the procedure and its separated response measures can be completed with acceptable burden; it would not establish efficacy. Efficacy would require a materially different design capable of supporting a causal outcome claim, while a mechanism claim would require evidence identifying how an effect arose rather than merely observing change. Neither efficacy nor mechanism is tested here.

These arguments establish only the design-level boundary described by RQ1. Formal equations and a coherent record model cannot by themselves answer RQ2 or RQ3. The contribution would need revision if the record chain proves too burdensome to use, if its provenance cannot expose where material mismatches arise, if model adapters cannot preserve the approved semantic distinctions, or if simpler records support equally accountable evaluation. Inspectability is consequently a falsifiable design commitment, not an empirical success already achieved.

Moment-specific and negotiated personalization

The person–moment unit resists treating personalization as retrieval of a fixed profile or discovery of an objectively correct sound. A person may want to stay with, explore, soften, or close an experience at one time and make a different choice later. Antidote therefore represents prior evidence as eligible context rather than destiny, a desired journey as a proposal rather than a promised endpoint, and semantic language as person-extensible rather than as a universal affect vocabulary. “Moment-specific” describes this conditioning boundary; it does not imply that the system knows what the person needs.

“Negotiated” identifies an authority process rather than an optimization result. Within the proposed framework, person-authored intent, an inspectable plan, adapter downgrades, and any evidence-linked update proposal remain distinct, reviewable records; edits create new revisions, and approvals or rejections are recorded where the applicable contract permits them. Model uncertainty is not converted into authority by being presented as personalization. This process may make the system’s assumptions easier to contest, but additional interaction may itself create burden, demand characteristics, or reduced trust. An accepted plan is thus evidence of a recorded choice under the declared interface, not evidence that the plan represents a stable preference, was freely understood, or will be helpful.

The response model must be equally conditional. Musical responses may involve memory, expectancy, imagery, appraisal, cultural associations, and other pathways that are not recoverable from one acoustic feature or affect label (Juslin and Västfjäll 2008). Perceived expression and felt emotion can differ (Zentner, Grandjean, and Scherer 2008), while intensity may be welcome, unwanted, mixed, or harmful in ways that require the person’s interpretation (Silverman, Gooding, and Yinger 2020). The same realized artifact may therefore receive different accounts in different moments without one being treated as noise merely because it conflicts with an earlier record.

The frozen H1 design can eventually examine whether those distinctions can be collected with acceptable completeness and burden, but its P condition is a bundle: it changes contextual input, personal semantic content, plan visibility, editing, and approval together. A P-versus-S or P-versus-G contrast cannot identify which component mattered, and a favorable response cannot validate an objective need estimate. Even repeated provenance-linked records would support only a bounded within-person account unless a later protocol prospectively tests whether a named advisory relationship predicts new observations. Until then, moment-conditioned personalization remains a structured hypothesis and a human-authority requirement, not an observed advantage.

Alternative explanations and architectures

Any later favorable response would admit explanations other than successful moment-specific adaptation. Generic ambient audio might suffice; a current-state category with a fixed journey template might capture most of the difference; or preference, familiarity, novelty, expectancy, attention, editing effort, and interface-mediated agency might shape the report. Output quality, loudness, setting, time of day, baseline variation, order, or carryover could also confound the intended semantic manipulation. Repeated use may teach instrument use or reporting rather than reveal a stable audio–response relationship. The G, S, and P conditions preserve an initial comparison among interface bundles, but cannot isolate components or mechanisms.

Contradictory evidence makes those alternatives substantive rather than ceremonial. Prior systems demonstrate technically closed loops and person-specific or affective control, yet their evaluations are small, heterogeneous, or directed at different constructs. A recent preprint of a preliminary brain–computer musical-interface evaluation reported nonsignificant target-emotion and time effects, with person and trial variation dominating its observed variance (Monroy-D’Croz, Ramirez-Melendez, and Cespedes-Guevara 2026). A systematic review likewise found heterogeneous music-neurofeedback methods and no consensus success measure (Sayal et al. 2025); a scoping review of commercial music-based digital therapeutics found insufficient direct evidence for real-world effectiveness or superiority over generic music (Venkatesan et al. 2026). These sources do not show that an individual effect is impossible. They do show why loop closure, market presence, and a beneficial response cannot substitute for one another.

The proposed architecture is also only one arrangement of the technical problem, and four simpler baselines deserve direct comparison. A population affect-label pipeline could map a small shared state vocabulary to fixed audio rules without personal context. A static recommender could select or sequence existing recordings, as prior current-to-target systems do (Janssen, Broek, and Westerink 2012; Mallik and Russo 2022). Direct physiological conditioning could drive continuous controls without a negotiated semantic layer, following earlier brain–computer music systems (Daly et al. 2016; Ehrlich et al. 2019). A one-shot generator could render the complete journey offline for human review, avoiding a future-audio buffer and mid-session model deadline altogether. Interpretable rule-based and probabilistic generation (Agres, Dash, and Chua 2023) and human-authored segments with a fixed transition engine provide further alternatives. These arrangements may reduce latency, unsupported controls, interaction burden, or transition uncertainty at the cost of a smaller or less inspectable generation space. Antidote’s two-rate proposal should be preferred only if explicit deadlines, verification, and fallbacks measurably improve the declared technical properties without obscuring person authority.

Several outcomes would count against the proposed arrangement: adapters that frequently downgrade accepted intent, a buffer margin that cannot be maintained on the frozen hardware, fallbacks that dominate listening, semantic or acoustic boundary measures that do not correspond to reviewable failures, or an authority path that does not halt reliably. Even technical success would leave the response question open. Small boundary distances, accurate tempo, or an uninterrupted file cannot establish perceived continuity, fit, usefulness, safety, or benefit. Alternative architectures should therefore be compared under the same provenance, exposure, missingness, burden, and non-positive reporting rules rather than by selecting whichever system produces the most persuasive demonstration.

Bounded future research program

The next evidence should be acquired within the stages and gates already frozen by the protocol rather than by expanding the interpretation of the present record. At D0, the immediate question is whether every RQ1 construct and governed transformation or authority boundary resolves to a versioned record, equation, contract, or explicit unavailable state; satisfying that traceability check would not constitute an independent implementation audit. At T0, a qualifying synthetic package would have to preserve complete denominators and demonstrate the declared authority, schema, replay, interruption, recovery, hash, and provenance invariants. Only an explicit claim-ledger promotion could turn that package into a synthetic technical result, and no T0 result could describe a human exposure or response.

T1 is the next test of the proposed generation path. Before execution it would freeze the model, adapter, hardware profile, analyzer set, mutation manifest, seed policy, output-rights review, hardware- and adapter-specific thresholds, and run plan. Its 39-attempt matrix, when every declared control is supported, would test one-factor adherence, adjacent-segment continuity, latency and buffer margins, and injected failure and recovery. A technically feasible claim would require the reserved source package, complete terminal-state accounting, reproducible analysis, and review against those frozen thresholds. Any resulting claim would remain bounded to that manifest. Unsupported controls would remain explicitly unsupported and reduce the applicable attempt denominator; missed deadlines against frozen thresholds, integrity failures, or unreliable stopping would require the corresponding technical claim to be downgraded or rejected, or the design to be revised. Passing T1 would remain specific to the tested model and hardware and would not establish perceived continuity or a beneficial response.

Optional real-time sensing and genuinely continuous generation are separate later studies, not capabilities assumed by H1. Every sensor stream would need its own consent, calibration, missingness, uncertainty, synchronization, and person-correction contract; its estimate could tailor a proposal but could not define the person’s state. A streaming generator would likewise need a new qualified adapter and deadline study demonstrating that variable-latency model work remains outside the audio callback and that stop does not depend on model completion. Failure at either gate should default to manual input and, only after its own implementation and qualification, generate-ahead playback; it must not silently strengthen inference or timing claims.

H1 remains blocked-no-collection-authority: all eight activation gates—real-model/T1 qualification, privacy, consent, independent review, assignment, instrument, analysis, and pilot stop/go—remain unsatisfied. If separately authorized, its six-block G/S/P series targets 18 completed exposures within an absolute ceiling of 24 scheduled attempts and can test whether the governed records are collectable, correctable, provenance-linked, and usable with the prespecified completeness, burden, and safety-event accounting. It can describe exploratory within-person bundle contrasts while preserving missing, null, opposite-direction, interrupted, burdensome, harmful, and adverse observations. It cannot isolate personalization components, estimate a population effect, establish safety, or answer whether advisory learning is useful. Its progression rule decides only whether another bounded study may be acceptable; “proceed” is not an outcome claim.

Testing RQ3 would consequently require a new, prospectively frozen protocol after H1, not reuse of the H1 observations both to discover and confirm a preferred relationship. Such a protocol would need to name the eligible semantic, acoustic, exposure, and response variables; specify the response model, uncertainty, forgetting and contradiction rules; separate model development from evaluation on later observations; and retain human review of every proposed update. A useful advisory claim would require prospective evidence that a frozen proposal rule adds information for that person’s new records relative to declared non-adaptive alternatives, while retaining burden, mismatch, harm, and missingness. Failure to improve prospective prediction, or improvement purchased through unacceptable burden or risk, would count against the claim.

Only after those within-person gates should multi-participant work be considered. A later study would require a separate ethics determination, participant and setting rationale, sample-size justification, device and model qualification, accessible procedures, prespecified comparison conditions, and an analysis that distinguishes person variation from moment, order, and trial variation. It would also need to test rather than assume that the semantic vocabulary, control mappings, and response measures transfer across people and contexts. No stage described here is a treatment or neurological-mechanism evaluation. A claim may be promoted only when its named source package and review gate support that promotion; otherwise the relevant slot remains unavailable or the candidate remains unchanged, is downgraded, or is rejected. The unresolved validity, emotional and hearing safety, privacy, rights, accessibility, and independent-review gates in Section 7 constrain every future direction described here; publication of the design cannot satisfy them.

Construct and measurement validity

The moment representation is a bounded account produced through a particular interface; it is not the person’s true psychological or physiological state. Self-report can preserve experience that an external classifier cannot observe, but wording, timing, scale anchors, recall, current arousal, and the wish to make the session coherent may all shape a response. Compact affect scales provide a measurement precedent (Betella and Verschure 2016), yet that precedent does not validate Antidote’s desired-transition, mismatch, usefulness, harm, burden, or aftereffect items. Likewise, optional physiology or behavior would be an uncertain observation rather than an objective need: passive-monitoring research reports substantial heterogeneity and missing-data concerns, and electrodermal activity does not uniquely identify felt valence (De Angel et al. 2022; D’Amelio et al. 2025).

Semantic intent, requested acoustic controls, measured realization, perceived expression, felt response, immediate usefulness or harm, and later aftereffect are kept in separate records. This reduces category errors; it does not prove that any record validly or reliably measures its named construct. Perceived and felt musical emotion may diverge (Zentner, Grandjean, and Scherer 2008), and an analyzer’s tempo, key, loudness, or embedding estimate cannot decide what the audio meant to the listener. Person correction and field-level missingness are consequently necessary controls, but their usability, responsiveness, test–retest behavior, and sensitivity to meaningful within-person change remain unvalidated.

The originating cathartic experience is one retrospective, researcher-authored observation without a protocol, comparator, standardized measure, or independent interpretation. It motivates the person-and-moment question but is not a Result, an effect estimate, or evidence that emotional intensity was helpful. The framework’s deliberate separation of intensity, welcome or unwanted response, harm, and later meaning must survive instrument review before any qualifying human observation can support even a feasibility claim.

Internal and statistical validity

The prospective H1 series is an unblinded self-study in which researcher, developer, participant, analyst, and author roles overlap. That overlap creates expectancy, demand, selective-attention, analytic-flexibility, and role-conflict risks that provenance cannot remove. The generic, state-aware, and negotiated personal conditions are also visibly different bundles: personal context, semantic content, plan visibility, editing, and approval change together. Neither a pairwise contrast nor exact randomization can isolate which component produced a difference, and no contrast identifies a psychological or neurological mechanism.

Baseline fluctuation, time of day, setting, prior activity, familiarity, regression toward a person’s usual state, repeated instrument use, novelty, order, carryover, and learning may all covary with condition. The frozen balanced schedule and within-block seed policy constrain some researcher degrees of freedom, while near-event assessment can reduce retrospective delay (Shiffman, Stone, and Hufford 2008). They do not create blinding, washout, exchangeability, or a stable underlying affect process. A stopped or missing response may also be informative rather than random, particularly when discontinuation follows distress, burden, technical failure, or mismatch.

The target of 18 completed exposures under an absolute ceiling of 24 attempts is appropriate only to the declared record-feasibility questions. The series cannot estimate a population effect or support a clinical, safety, superiority, or causal claim. SPENT and CENT provide useful protocol and complete-reporting precedents for N-of-1 work (Porcino et al. 2020; Vohra et al. 2015); checklist alignment does not repair weak measurement, multiplicity, bundled conditions, carryover, or investigator conflict. Preserving every assignment, failure, exposure, null or opposite-direction observation, adverse response, denominator, missingness reason, and prespecified analysis is a transparency control. It is not a guarantee of conclusion validity.

External and ecological validity

Any later H1 observation would describe one person under one frozen protocol, model, adapter, device path, listening environment, semantic vocabulary, and period of life. It would not establish transfer across people, moments, languages, cultures, musical histories, sensory tolerances, hearing profiles, devices, generators, or clinical contexts. Even within one person, a mapping may change after familiarity, major events, medication or substance changes, sleep disruption, illness, or a shift in what the same semantic term means. Versioning can locate such change; it cannot make the relationship stationary.

The proposed local, self-guided setting is not interchangeable with a music therapy relationship, laboratory procedure, guided psychedelic setting, or ordinary music listening. The presence of headphones, an eye mask, a check-in, or a structured journey may itself alter attention and expectancy. Reviews of music-based digital therapeutics and music-neurofeedback systems report heterogeneous methods and limited grounds for real-world generalization (Venkatesan et al. 2026; Sayal et al. 2025). Those limitations neither prove that Antidote cannot work nor support transporting a favorable demonstration. A later multi-participant protocol would need a new sampling rationale, accessible procedure, device and setting qualification, and explicit tests of which constructs and controls transfer.

System, model, and continuity failures

Every transformation in the proposed chain can fail while producing a plausible-looking artifact. A context extractor may omit the relevant detail or privilege the wrong one; a state estimate may become confidently wrong; a semantic mixin may conflict with an exclusion; an adapter may ignore or downgrade a control; an analyzer may mischaracterize the output; and a generative model may reproduce, imitate, or introduce unwanted material. Human correction constrains authority but does not ensure that a person can identify every omission, understand every control, or review effectively while distressed.

The two-rate architecture is also prospective. The checked-in application can supervise a deterministic mock worker, verify a synthetic WAV, start deliberate playback, stop, recover, and record a response. It does not yet implement or qualify a real music model, uncertain state estimator, receding-horizon controller, verified future-audio buffer, or deterministic continuity renderer. Real generation can miss deadlines; supported controls may differ by adapter; crossfades can hide a waveform discontinuity while leaving harmony, rhythm, timbre, meaning, or pacing incoherent. Normative scheduling and loudness references help define tests (World Wide Web Consortium 2024; European Broadcasting Union 2023); they do not establish seamlessness, perceived continuity, or an appropriate experience.

Model, code, analyzer, driver, and hardware drift may invalidate a prior result even when a prompt appears unchanged. Immutable specifications, capability negotiation, hashes, event replay, versioned analyzers, cancellation, fallbacks, and complete failure accounting can make some divergence detectable. Provenance records what the governed system says occurred; W3C PROV and workflow-run packaging do not prove semantic correctness, authenticity, consent, ownership, privacy, or benefit (Moreau and Missier 2013; Leo et al. 2024). T1 must therefore qualify control adherence, latency, buffer margin, continuity, integrity, interruption, and recovery on the exact real-model and hardware manifest before that path can inform H1. Fallbacks that dominate playback, unverifiable outputs, missed deadlines, or unreliable stopping count against feasibility rather than as invisible implementation details.

Status key. Mixed = only named synthetic behavior is implemented; Specified = required but unverified; Unresolved = no adequate control or evidence is registered; Blocked = the activity cannot proceed before the stated gate. Every row retains residual uncertainty.

Table description: Seven rows cover construct and inference validity; internal and statistical validity; external and ecological validity; model, timing, and continuity failures; emotional and hearing safety; consent, privacy, and export; and rights, bias, accessibility, misuse, and independent review. Each row names the affected evidence layer, current control, residual risk, status word, owner, and blocking gate. Only some synthetic prototype behaviors are implemented. The table authorizes no collection and does not present provenance, local execution, consent records, or a planned safeguard as proof of truth, privacy, rights, accessibility, safety, or benefit.

Emotional safety and participant authority

Music can be unwanted or harmful as well as meaningful. A theoretical model of music-induced harm identifies affective, behavioral, cognitive, identity, interpersonal, physical, and spiritual dimensions and treats harm as an interaction among context, music, recipient, and delivery (Silverman, Gooding, and Yinger 2020). Antidote must therefore never optimize tears, intensity, duration, completion, engagement, or physiological change as a proxy for benefit. Crying, calm, activation, numbness, discomfort, catharsis, and distress require the person’s interpretation in that moment and again, when appropriate, at the declared later interval.

The design preserves explicit playback, skip, stop, correction, grounding, and withdrawal authority and gives mismatch, unwanted intensity, harm, hearing discomfort, serious or unresolved events, and later aftereffect their own records. A stop must halt playback independently of model completion; a safety halt must block automatic continuation and personal-model updating. These are necessary requirements, not evidence that distress is prevented or resolved. The prototype provides no clinical monitoring, emergency response, or reliable way to distinguish tolerable challenge from escalating harm.

Before any human exposure, an independently reviewed safety plan must define eligibility and exclusions, pre-session information, low-burden stopping, grounding and follow-up, adverse-event classification, escalation contacts, unresolved-event review, and discontinuation rules. High-risk crisis use, unsupervised treatment claims, and guidance for medication or psychoactive-drug sessions remain outside v0 authority. Refusal, stopping, non-response, or an unfavorable account must not reduce access, be reframed as noncompliance, or be used as a negative reward signal.

Consent, privacy, and data governance

Consent is action- and purpose-specific. Permission to inspect one source does not authorize summarization, generation, playback, retention, learning, synchronization, research analysis, export, or publication. The current synthetic desktop path requires explicit confirmation for a manually entered, session-scoped context projection and keeps the worker outside unrestricted history. Historical journal or therapy-chat integration, revocation UI, retention enforcement, and privacy-ready payload handling are not implemented. An inspectable grant or projection also does not demonstrate comprehension, voluntariness, or freedom from demand—a particular concern when researcher and participant are the same person.

Local-first design can reduce required server transfer and keep an authoritative record available on the person’s device (Kleppmann et al. 2019); it is not perfect security. The current store is not ready for private participant data. At-rest encryption, key creation and recovery, operating-system account separation, backup policy, retention enforcement, auditable deletion, tombstones, derived-projection invalidation, crash-log review, and a production worker sandbox remain unresolved. Device compromise, malware, cloud-synced folders, backups, screen capture, exports, and another local user can still expose sensitive context or response data.

Public provenance presents a second tension: detailed lineage aids audit but can increase linkability and re-identification risk. The reporting contract permits only privacy-reviewed aggregate public envelopes and keeps row-level human records, free text, private paths, stable identifiers, record hashes, and the private evidence index outside the repository. Even a reconciled aggregate commitment does not establish anonymity, consent, authenticity, truth, or completeness. A person must be able to decline retention and export separately; the exact deletion effect on events, payloads, projections, analyses, backups, and already shared artifacts must be specified before collection. No public release may proceed solely because a schema validates or a hash matches.

Licensing, bias, accessibility, and hearing safety

No real generator has been selected or qualified for the study. Before a model or audio artifact can enter T1, H1, a release, or the magazine, review must cover the exact code and weight licenses, redistribution and commercial restrictions, training-data documentation and consent, required attribution, model-card limitations, remote-code execution, recognizable reproduction or imitation, third-party samples, output rights, and the intended distribution context. Generative-audio research has historically discussed positive implications far more often than negative ones and identifies copyright, agency, bias, privacy, misuse, labor, access, and resource concerns as material review categories (Barnett 2023). That review does not prove that a particular model or output violates rights; conversely, an open weight license cannot clear its training data or every generated artifact.

Training corpora, control vocabularies, affect labels, and musical evaluation may privilege well-represented genres, languages, cultures, instruments, and listener assumptions. A person-extensible semantic layer may reduce pressure to adopt one vocabulary, but adapter mappings and model outputs can still flatten or appropriate meaning. The prototype has automated keyboard and semantic checks; it has not established usability with screen readers, reduced-motion or low-vision settings, hearing differences, motor constraints, cognitive load, trauma-related sensitivities, or users outside the developer context. More knobs may increase agency for one person and burden or suggestion effects for another. Accessibility and cultural review must precede recruitment rather than be inferred from a nominally local interface.

File-level integrated loudness and true-peak constraints can bound some digital-output errors but do not determine sound pressure at the ear. The WHO–ITU safe-listening standard treats exposure as level over duration and recommends dosimetry, accessible information, and volume-limiting options (World Health Organization and International Telecommunication Union 2019). Antidote currently has no calibrated device path, at-ear measurement, cumulative-dose accounting, or proof that its lowest volume is appropriate. Human exposure therefore requires device-aware qualification, conservative defaults, continuously available volume and stop control, warnings that do not rely on sound alone, and a response path for tinnitus, pain, dizziness, or hearing discomfort. None of those controls alone establish hearing safety.

Independent review and collection gate

The project has not recorded an institutional review board, research ethics committee, or other independent determination, and this manuscript does not decide whether a future self-study is exempt or outside a particular regime. That determination depends on the final protocol, institution, jurisdiction, recruitment, data, claims, and intended use. Self-use, local execution, public source code, or the absence of payment does not by itself resolve research ethics. WHO health-AI guidance provides a relevant normative foundation for autonomy, well-being, transparency, accountability, inclusiveness, and responsiveness (World Health Organization 2021); alignment with those principles is not an approval or safety certification.

Before H1 can change state, independent review must document the applicable ethics determination and approve or otherwise disposition the exact protocol, role conflict, consent process, eligibility and exclusion rules, emotional and hearing-safety plan, adverse-event and crisis escalation, compensation if any, privacy and data-management plan, retention and deletion behavior, public-export boundary, accessibility procedure, device qualification, model and output rights audit, analysis plan, and stopping rules. The separate real-model/T1, privacy, consent, independent-review, assignment, instrument, analysis, and pilot stop/go gates must each be satisfied by named evidence; no gate is inherited from the paper or another project. Any material amendment requires a new version and renewed review before collection continues.

Until those records exist, formal collection, recruitment, therapeutic use, autonomous personalization, sensor inference, and public release of private or row-level response data remain prohibited. A later approval would be limited to its exact scope and would not prove benefit, privacy, accessibility, or safety.

Public artifacts and reproducibility boundary

The canonical review surface is antidote.egohygiene.io. It exposes the accessible web paper, the PDF, and a download index. The download index links the independently compilable, arXiv-oriented source archive; the publication manifest; the site catalog; build and site-suite provenance; and the complete SHA-256 inventory. The source archive is a packaging target, not an arXiv submission. No DOI, arXiv identifier, archival release, or peer-reviewed status is asserted for this preprint.

For each deployed revision, publication.json binds the web, PDF, provenance, and source-archive artifacts to their Git revision and SHA-256 digests; site.json records the stable routes and their availability states; and SHA256SUMS covers the staged publication tree. These records can detect byte drift and trace an artifact to its declared build. They do not establish source correctness, scientific validity, authorship, consent, privacy, ownership, safety, or clinical efficacy.

The project-owned Make and Task entry points invoke the same build scripts. make check-all and task check-all build and validate the neutral and Ego Hygiene projections. The reproducibility target performs two clean builds and byte-compares the PDF, accessible HTML, provenance JSON, and arXiv-oriented source archive. Continuous integration repeats the publication checks on Ubuntu 24.04; the Beacon research-paper source and Holon site-suite inputs are pinned to immutable commits, while language package graphs use committed lockfiles. The operating-system packages installed by the publication workflow are not frozen as a complete container image, and cross-platform or perpetual byte identity is therefore not claimed. The documented developer baseline records Rust 1.97.1, Node 24.19.x, pnpm 11.19.x, Python 3.12.13, uv 0.11.33, and Tauri 2 for the synthetic application workspace; these pins do not constitute end-user platform or real-model support.

Excluded and access-controlled material

No private journal, therapy-chat, health, credential, or other personal content is included. No formal participant record has been collected under protocol ANT-PROT-FEAS-001, whose H1 stage remains blocked-no-collection-authority. Any later qualifying H1 material would require separately reviewed consent, security, retention, de-identification, and release decisions. The public reporting contract permits only reviewed aggregate envelopes and audit metadata; it does not promise row-level records, raw text, direct identifiers, or protected provenance payloads.

The repository does not distribute third-party article full text, training datasets, proprietary media, model weights, real-model packages, or generated audio. Source records provide citations, links, and project-authored assessments without transferring the rights of the underlying works. Future model code, weights, datasets, and audio outputs must retain their own verified licenses and output-rights records before use or release.

Licensing follows the artifact boundary rather than the repository location. Repository software, automation, and non-manuscript documentation are provided under the root MIT license. The reviewable manuscript source and manuscript figures remain copyright Alan Szmyt, all rights reserved, under paper/LICENSE.md; public access does not grant a reuse license. Linked or quoted third-party works retain their original rights. The root MIT license does not relicense the manuscript, source literature, model assets, training data, or future generated audio. A later archival release or venue submission may select a different manuscript license through an explicit reviewed change.