{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp03_full320_20260801","cell_id":"computability_boundary_mapping__aviation_aeronautics","trajectory_id":"R","attempt_index":0,"archetype_slug":"computability_boundary_mapping","domain_slug":"aviation_aeronautics","decision":"CANDIDATE","problem_id":"universal_flight_control_behavior_verification","causal_lever_id":"scope_relative_avionics_assurance_routing","proposal":{"problem":"HYPOTHESIS: An aviation assurance program requires one exact, always-terminating analyzer to decide whether arbitrary flight-control or autonomous-aircraft software can ever produce an unsafe behavior over every admissible input and unbounded execution, without specifying the program language, environment model, or treatment of unknown results.","actors_substrate":["flight-control and autonomy developers","design-approval and certification authorities","aircraft operators","software-verification teams","flight crews and passengers","flight-control software, hardware models, and environment traces"],"observable_state":"Timeouts, bounded test results, proof-search failures, and abstraction alarms are collapsed into pass/fail certification claims; the published guarantee exceeds the analyzed language or execution bound.","consequence":"Teams may spend effort pursuing an impossible unrestricted decider, reject useful bounded assurance, or clear unsafe behavior by treating unknown as safe.","affected_objective":"Obtain credible flight-software assurance while preserving safety, certification traceability, engineering capacity, and truthful guarantee labels.","structural_mapping":[{"archetype_element":"unrestricted total-exact automation demand","domain_realization":"A universal terminating safety decider for arbitrary controllers and unbounded flight/environment traces.","claim_kind":"HYPOTHESIS"},{"archetype_element":"model-relative computability boundary","domain_realization":"Solvability depends on controller language, finite hardware semantics, environment representation, trace horizon, and permitted external evidence.","claim_kind":"INFERENCE"},{"archetype_element":"decidable regions and governed fallback","domain_realization":"Enforceable controller fragments, finite-state abstractions, bounded traces, sound alarms, explicit UNKNOWN, and human escalation receive distinct guarantees.","claim_kind":"INFERENCE"},{"archetype_element":"reclassification on assumption change","domain_realization":"Changes to language expressiveness, hardware bounds, learned components, sensors, or environment assumptions reopen the assurance decision.","claim_kind":"INFERENCE"}],"component_map":[{"component":"Problem-Class Specification","status":"adapted","domain_realization":"Define controllers, properties, environments, and trace horizons covered."},{"component":"Instance Representation Contract","status":"adapted","domain_realization":"Version the software, hardware, property, and environment encodings."},{"component":"Computation Model Contract","status":"adapted","domain_realization":"State finite-machine, unbounded-program, oracle, interaction, and resource assumptions."},{"component":"Solvability Guarantee Profile","status":"direct","domain_realization":"Separate total-exact, sound-incomplete, bounded, approximate, and assisted claims."},{"component":"Quantifier and Scope Map","status":"direct","domain_realization":"Expose every controller, input, environment, behavior, and horizon quantifier."},{"component":"Computability Status Lattice","status":"direct","domain_realization":"Classify each assurance query as decidable, recognizable, relative, undecidable, or unresolved."},{"component":"Constructive Procedure Witness","status":"adapted","domain_realization":"For a decidable class, retain its algorithm plus correctness and termination arguments."},{"component":"Reduction Preservation Contract","status":"adapted","domain_realization":"Require a total computable encoding that preserves hazardous reachability."},{"component":"Computability Impossibility Certificate","status":"adapted","domain_realization":"Retain a checked reduction only if the unrestricted controller model supports it."},{"component":"Assumption Register","status":"direct","domain_realization":"Record language, memory, timing, environment, sensor, and oracle assumptions."},{"component":"Decidable Subclass Map","status":"adapted","domain_realization":"Map enforceable finite-state, bounded-horizon, or restricted-language regions."},{"component":"One-Sided Recognition Contract","status":"adapted","domain_realization":"Define which violations can be confirmed by witnesses without promising complete clearance."},{"component":"Unknown and Nontermination Policy","status":"direct","domain_realization":"Keep UNKNOWN, timeout, out-of-scope, false, and tool failure distinct."},{"component":"Fallback Solution Contract","status":"adapted","domain_realization":"Label exact, abstract, bounded, and escalated assurance outputs separately."},{"component":"Computability Guarantee Record","status":"adapted","domain_realization":"Link each released assurance claim to model, scope, evidence, and version."},{"component":"Recheck Trigger","status":"direct","domain_realization":"Reopen classification after model, language, hardware, or guarantee changes."},{"component":"Termination Condition","status":"direct","domain_realization":"Declare analysis time, depth, state, or proof-search bounds."},{"component":"Scope Boundary","status":"direct","domain_realization":"Mechanically reject or quarantine inputs outside the guaranteed class."},{"component":"Decision Record","status":"direct","domain_realization":"Record the selected assurance mode and rationale."},{"component":"Uncertainty Residue","status":"direct","domain_realization":"Preserve unproved obligations, abstraction alarms, and modeling gaps."},{"component":"Independent Proof Review","status":"adapted","domain_realization":"Have an independent reviewer check reductions, proofs, and formalization fidelity."},{"component":"Complexity Follow-On Gate","status":"direct","domain_realization":"After decidability, assess state explosion and operational feasibility."}],"mechanism_dispositions":[{"slug":"abstract_interpretation_or_model_checking","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Use a finite conservative aircraft/controller abstraction; safe verdicts require demonstrated over-approximation, while alarms may be spurious.","counterfactual_removal":"No scalable sound fallback remains for relevant unbounded concrete behavior."},{"slug":"bounded_domain_exhaustive_search","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Exhaustively check a declared finite state, input, or trace bound and prohibit extrapolation.","counterfactual_removal":"Bounded completeness evidence is lost, but the boundary classification remains."},{"slug":"computability_boundary_decision_record","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Version the shipped guarantee, assumptions, evidence links, and recheck triggers.","counterfactual_removal":"The boundary can drift silently across releases."},{"slug":"computational_complexity_analysis","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Apply only after a class is shown decidable to assess state-space feasibility.","counterfactual_removal":"Decidable but unusable methods may be selected."},{"slug":"constructive_algorithm_and_correctness_proof","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Require an explicit total correct analyzer for every region labeled decidable.","counterfactual_removal":"Positive decidability labels lack adequate witnesses."},{"slug":"diagonalization_impossibility_proof","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"A direct self-referential construction is unnecessary if a domain-specific reduction suffices.","counterfactual_removal":"No material change."},{"slug":"enumeration_and_dovetailing","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Unbounded recognizer execution is unsuitable for an operational assurance interface; bounded explicit-UNKNOWN is preferred.","counterfactual_removal":"No material change."},{"slug":"fallback_mode_router","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Route each query to exact, sound-abstract, bounded, or escalated handling and attach its actual guarantee.","counterfactual_removal":"Weaker evidence can again be laundered into universal clearance."},{"slug":"halting_problem_reduction","disposition":"selected_load_bearing","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Attempt a checked encoding where hazardous reachability occurs iff an arbitrary encoded computation halts; retain no impossibility verdict unless all obligations hold.","counterfactual_removal":"The claim that unrestricted exact verification is impossible remains unsupported."},{"slug":"language_fragment_restriction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Admit only mechanically recognizable controller/specification fragments with known total procedures.","counterfactual_removal":"There is no enforceable route from unrestricted claims to guaranteed answers."},{"slug":"many_one_reduction_proof","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Formalize totality, computability, and bidirectional answer preservation for the halting reduction.","counterfactual_removal":"The impossibility transfer becomes vulnerable to a defective mapping."},{"slug":"promise_problem_restriction","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Use only when the controller or environment promise is automatically checked or conservatively enforced.","counterfactual_removal":"Some useful guaranteed regions disappear; core fragment restriction survives."},{"slug":"proof_by_counterexample","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Use in-scope controllers to refute over-broad claims by existing analyzers, not to prove undecidability.","counterfactual_removal":"Empirical overclaims become harder to falsify quickly."},{"slug":"proof_checking","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Independently check constructive and impossibility certificates and their premises.","counterfactual_removal":"A proof gap could hard-gate the wrong certification policy."},{"slug":"reduction_direction_checklist","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Gate any hardness claim on source-to-target direction and explicit assumptions.","counterfactual_removal":"Direction errors become more likely, though full proof review remains."},{"slug":"semi_decision_with_explicit_unknown","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Bound sound violation search and return YES-with-witness or UNKNOWN, never fabricate NO.","counterfactual_removal":"Timeouts can again masquerade as clearance or refutation."},{"slug":"theorem_prover_guided_search","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Use for certificate discovery and checking; record timeout as an open obligation.","counterfactual_removal":"Automation decreases, but manual checked proofs remain possible."},{"slug":"turing_reduction_analysis","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Relative computability degrees add no necessary decision information for the proposed assurance routing.","counterfactual_removal":"No material change."}],"causal_chain":["Specify the controller class, encodings, computation model, safety property, and universal guarantee.","Seek a total constructive procedure and a valid impossibility reduction in parallel.","Partition enforceable decidable regions from unrestricted or unresolved regions.","Route each query to the strongest justified method with explicit UNKNOWN and scope labels.","Version evidence and assumptions so changes trigger reclassification.","This prevents unsupported universal clearance while retaining bounded or sound-incomplete assurance."],"baseline":"Ordinary assurance combines review, testing, simulation, and specialized analysis, with HYPOTHESIS-level risk that timeouts or bounded evidence are interpreted through a binary pass/fail interface.","nearest_rival":"Add more tests, compute, or model-checking capacity while retaining the unrestricted exact guarantee and a Boolean output.","authority_safety":{"affected_parties":["flight crews","passengers","people beneath flight paths","operators","developers","certification personnel"],"decision_authority":"The applicable certification or design-approval authority owns acceptance; the design approval holder owns the analysis and may not unilaterally weaken required safety findings.","authorized_first_step":"Conduct an offline, non-certifying pilot on synthetic controllers and a small authority-approved sample: formalize the claim, test a reduction, define one enforceable fragment, and compare exact, abstract, bounded, and UNKNOWN outputs. No aircraft or operational decision is affected.","excluded_actions":["automatic aircraft clearance","treating UNKNOWN or timeout as safe","changing certified flight software","live-flight experimentation","publishing undecidability before independent proof review"],"halt_rollback":"Halt if the formal model omits safety-relevant behavior, an abstraction is not conservative, scope membership is unenforceable, or output labels are lost downstream; withdraw pilot claims and revert to existing assurance decisions."}},"negative_tests":{"strongest_counterevidence":"Actual airborne computers, input alphabets, memory, and mission durations may be finitely bounded, making the concrete deployed system decidable in principle by exhaustive reachability; the alleged undecidability may arise only from an unnecessarily unbounded model.","analogy_break":"Program undecidability does not automatically transfer to physical aircraft: continuous dynamics, finite digital hardware, uncertain sensors, learned components, and human interaction require explicit encodings, while a finite closed model may be merely intractable.","failure_condition":"The approach fails if restrictions remove safety-relevant behaviors, abstractions omit real behaviors, promises are unenforced, or downstream users collapse UNKNOWN into safe.","problem_falsifier":"The problem is falsified if the actual requirement covers only a fixed finite controller, bounded environment and horizon, and already distinguishes timeout and UNKNOWN without asserting a class-wide universal guarantee.","intervention_falsifier":"The intervention is falsified if the proposed reduction cannot preserve hazardous reachability under the declared aviation model and the declared class instead has a checked total procedure, or if the bounded pilot cannot preserve output labels and semantic fidelity.","risks":["False confidence from an unsound abstraction","Certification gaps hidden by restrictive fragments","State explosion despite decidability","Incorrect reduction or formalized property","UNKNOWN overload encouraging operator workarounds","Governance records becoming stale"]},"null_rationale":null,"classification":{"candidate_kind":"DOMAIN_TRANSFER","prior_art_status":"UNSEARCHED","evidence_maturity":"HYPOTHESIS"},"revision_change_log":{"revision_kind":"ORIGINAL","prior_problem_id":null,"prior_causal_lever_id":null,"problem_changed":false,"causal_lever_changed":false,"conceptual_changes":[],"operational_changes":[],"repairs_addressed":[]},"confidence":0.84,"generator_notes":"The fit depends on a genuinely class-wide, exact, terminating assurance claim over an expressive or unbounded controller model. If the deployed task is only finite-state reachability, this becomes complexity assessment rather than a computability-boundary problem."}