Four Kinds of Knowing: A Synthesis of the H-DKPS Tetralogy on Confining Clinical AI Decision Authority

The question. When a probabilistic component proposes and a deterministic component decides, what must be true of a clinical system for it to be safe and useful to the patient in front of the clinician? Four papers took that question from four directions. This synthesis reads them as one argument. The architecture. A probabilistic shell brings in evidence and proposes; a deterministic kernel is the only path to an output and holds every candidate to a fixed safety envelope; a human-centric core lets the patient's own account raise the priority of a concern but never widen the boundary. Authority is placed by position, not by the reliability of the component that proposes. The argument. Each part begins where the previous one runs out. Part I (知止, knowing where to stop) confined decision authority and found, by a red team the formal lines could not anticipate, that conforming to an invariant set does not establish the property it was meant to entail. Part II (知行, knowing when to act) showed that every invariant of that kind is satisfied by doing nothing, measured the region in which doing nothing is the only safe output — 80 of 384 reachable states — and stated four invariants of the opposite polarity. Part III (知變, knowing that things change) showed that a formalism stated one encounter at a time cannot see repetition, and gave the state a memory, invariants over trajectories, and a bounded form of the physician's override. Part IV (知己, knowing oneself) held the boundary under 94,036 adversarial trials and then found, by validation rather than verification, that 96.4 per cent of the inputs that would have altered a decision were the clinician's own legitimate writing, which the system had silently failed to recognise. The skeleton. The order is not a matter of presentation. The four knowings are four kinds of property: safety, which a monitor can enforce; liveness, which it cannot, and which must therefore be stated in bounded form; properties of a trace rather than a state; and validation, which no verification against a specification can reach. Specification-completeness audits applied in October 2026 to the families of Parts II and III returned no defect a further invariant could close; their largest groups pointed, from two directions, at the person who receives the system's output. What runs through all four. Authority is placed by position; every bound is reported together with where the risk went next; and every silence is a finding. No part of the series reports a clinical outcome.A synthesis of the four parts of the H-DKPS Tetralogy, read as one argument. It reports no new experiment. It states the architecture in one page, gives the formal skeleton that orders the four parts (safety, bounded liveness, properties of traces, validation), summarises what each part established and handed on, sets out what runs through all four (silent failures; risk relocated by every bound; three specification audits converging on the human recipient of the system's output), places the architecture in its lineage (reference monitor, simplex, shielding, LLM-Modulo), and states what the series does not establish. Appendix R collects every invariant of the series with its kind and status. Not peer reviewed. Version v2 corrects the numbering of the numbered lists in the PDF: in v1 each list after the first continued the numbering of the one before (the reference list began at 5). Text, citations and data are unchanged.