Charlot Lab · Energy First Architecture · certify-before-commit (internal)
Every world-model robot today predicts, then acts: it imagines rollouts, scores them, and commits the best-looking one. That is an expected-value score, not a guarantee. Here the agent imagines rollouts of a contact task, scores each by one scalar energy, and then runs a formal certificate — a contraction / Lyapunov-decrease check on the committed action — that abstains or re-plans instead of committing. Beside it, a faithful reconstruction of sample-and-score commits a plausible-looking rollout the certificate rejects — and it drifts off the world. The point is not "we beat Cosmos": it is that a score over an imagined window is not a certificate of the commitment.
What you are seeing. The dynamics are a hybrid contact system (free flight, then a spring-damper wall that switches on at x=1), with a constant inward bias — a nano stand-in for touching a surface against a preload. One scalar energy E(s) does double duty: the agent picks actions by descending it, and the gate certifies a commitment by coasting its last action and checking the same E stays bounded (a sampled contraction/Lyapunov condition). An outcome scorer — the realistic model of a vision-judge or sample-and-score world-model policy — can crown a rollout whose final frame looks perfect but whose committed action, coasted forward, drifts off the world. The certificate rejects exactly those: in a live 200-episode scan, every certified commit was actually stable (100% sound) and 87% of rejections were genuine drifts (the rest conservative — the safe direction). Crucially, both an outcome judge and a path-integral reward optimize the imagined 25-step window and get fooled at nearly the same rate — neither certifies what happens when you commit and the window ends. The certificate does. Honest ledger: the interactive gate above is the fast intuition; the formal guarantee is an exact proof — a common quadratic Lyapunov function V(e)=eᵀPe whose strict decrease is verified by the eigenvalues of AᵢᵀPAᵢ−P in both contact modes, giving a certified region of attraction {V≤0.175} over the whole continuum (not sampled points). Full proof and math in the Energy Is the Certificate living paper. This is the mechanism, at nano/1-DOF scale — not a fixed "price" (in sibling toys the certified controller was as good or better), and drift is structurally bounded, not "impossible."
Differentiates against, and builds on: Certified World Models (2606.13092) · Glen Chou differentiable reachability (RSS'26) · EBT-Policy (2510.27545) · Cosmos Policy (sample-and-score) · SafeDreamer. The claim is the different-object point — a statistical score is not a formal certificate — at ~2-state nano scope, honestly smaller than the external 40–72D certified-world-model / reachability work. Probe: efa_unification_probe_P1 (seed 20260722), re-run verified.