Silent Invariant

A survivable sea-based deterrent is not fully described by force totals or by an aggregate probability that some retaliatory capacity remains. If the governing operating rule is that no accountable ballistic-missile submarine may cross a declared compromise threshold, the force must be scored by its worst-positioned hull. This article formalizes that rule with the min-hull safety function h_min = min_i(c_i − σ_i), defines the corresponding admissible set, and studies a dual-regime controller that combines continuous quieting with additional recovery authority when a conservative look-ahead predicts boundary contact. The model is intentionally stylized; it does not represent a real patrol, sensor system, or adversary. Its narrower purpose is to show that aggregate survivability and patrol integrity are different mathematical problems. In a reproducible two-hull illustration, quieting alone leaves the min-hull admissible set, while a look-ahead dual controller preserves positive margin under the baseline disturbance. The certificate is finite: as disturbance intensity increases, the same controller eventually fails. The policy implication is disciplined certification, not invulnerability: define the safe set, declare the disturbance family, bound uncertainty, and verify that recovery authority directs the force back inward.