{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp03_full320_20260801","cell_id":"computability_boundary_mapping__disaster_management","trajectory_id":"R","attempt_index":0,"archetype_slug":"computability_boundary_mapping","domain_slug":"disaster_management","decision":"CANDIDATE","problem_id":"universal_disaster_response_policy_assurance","causal_lever_id":"restrict_policy_language_and_preserve_unknown","proposal":{"problem":"A disaster-management authority seeks an automated, exact, always-terminating verdict on whether any submitted response policy will satisfy specified safety and completion properties across every admissible incident evolution. If policies can express unbounded loops, adaptive resource requests, or interacting processes, repeated timeouts cannot establish impossibility, while an unrestricted Boolean assurance claim may be uncomputable. HYPOTHESIS: forcing inconclusive analyses into safe/unsafe verdicts can either certify hazardous plans or reject usable ones.","actors_substrate":["emergency-management authority","incident commanders and planners","policy authors and software vendors","responders","residents, evacuees, and people needing assistance","formal policy language, incident-transition model, and assurance service"],"observable_state":"The assurance service times out or returns inconsistent results on some policies, yet downstream systems receive an unqualified safe/unsafe result; documentation does not distinguish unrestricted, bounded, abstracted, and out-of-scope inputs.","consequence":"Resources may continue flowing to an impossible universal analyzer, or a timeout, abstraction artifact, or bounded result may be mistaken for proof that a response policy is safe in all represented incidents.","affected_objective":"Provide trustworthy, timely disaster-response policy assurance without concealing the limits of the model, input class, or analysis guarantee.","structural_mapping":[{"archetype_element":"unrestricted program or process class","domain_realization":"response policies with loops, concurrency, adaptive actions, and unbounded incident traces","claim_kind":"HYPOTHESIS"},{"archetype_element":"universal exact terminating decision requirement","domain_realization":"a safe/unsafe verdict for every accepted policy and every represented incident evolution","claim_kind":"HYPOTHESIS"},{"archetype_element":"model-relative impossibility boundary","domain_realization":"a proved boundary for the declared policy syntax, transition semantics, property, and computation model","claim_kind":"INFERENCE"},{"archetype_element":"decidable fragment","domain_realization":"mechanically enforced finite-state or otherwise restricted response-policy language","claim_kind":"INFERENCE"},{"archetype_element":"honest weaker fallback","domain_realization":"sound abstraction, bounded exploration, or one-sided witness search returning explicit UNKNOWN","claim_kind":"INFERENCE"},{"archetype_element":"guarantee-labelled routing","domain_realization":"each policy is routed to exact, bounded, abstract, or human-review handling with its guarantee attached","claim_kind":"INFERENCE"}],"component_map":[{"component":"Problem-Class Specification","status":"direct","domain_realization":"Define the policy/property pairs covered by the assurance claim."},{"component":"Instance Representation Contract","status":"direct","domain_realization":"Version the policy syntax, incident-state encoding, environment assumptions, and bounds."},{"component":"Computation Model Contract","status":"direct","domain_realization":"Declare machine resources and any human, forecast, sensor, or external-service capability."},{"component":"Solvability Guarantee Profile","status":"direct","domain_realization":"Separate exact decision, sound one-sided assurance, bounded completeness, and approximation."},{"component":"Quantifier and Scope Map","status":"direct","domain_realization":"State whether claims cover every policy, scenario, trace, and horizon."},{"component":"Computability Status Lattice","status":"adapted","domain_realization":"Classify policy/property regions as decidable, recognizable, relative, unresolved, or undecidable."},{"component":"Constructive Procedure Witness","status":"direct","domain_realization":"For a decidable fragment, retain the analyzer plus correctness and termination arguments."},{"component":"Reduction Preservation Contract","status":"direct","domain_realization":"Require a total computable source-to-policy translation preserving the decision answer."},{"component":"Computability Impossibility Certificate","status":"direct","domain_realization":"Retain a checked reduction if unrestricted assurance is proved undecidable."},{"component":"Assumption Register","status":"direct","domain_realization":"Record semantic, hazard-model, finiteness, oracle, and property assumptions."},{"component":"Decidable Subclass Map","status":"direct","domain_realization":"Identify enforceable finite-state, bounded-horizon, or restricted-rule fragments."},{"component":"One-Sided Recognition Contract","status":"adapted","domain_realization":"Specify which policy violations or certificates can be confirmed without guaranteeing the opposite."},{"component":"Unknown and Nontermination Policy","status":"direct","domain_realization":"Keep UNKNOWN, timeout, out-of-scope, unsafe, and tool failure distinct."},{"component":"Fallback Solution Contract","status":"direct","domain_realization":"Attach exact guarantees to abstraction, bounded search, and escalation modes."},{"component":"Computability Guarantee Record","status":"direct","domain_realization":"Version-link shipped claims to evidence and assumptions."},{"component":"Recheck Trigger","status":"direct","domain_realization":"Reclassify after changes to policy expressiveness, semantics, properties, or external capabilities."},{"component":"Termination Condition","status":"direct","domain_realization":"Set explicit state, trace-depth, step, or time limits where bounded modes are used."},{"component":"Scope Boundary","status":"direct","domain_realization":"Mechanically reject or quarantine policies outside the guaranteed fragment."},{"component":"Decision Record","status":"direct","domain_realization":"Record the adopted boundary, fallback, rationale, and approval."},{"component":"Uncertainty Residue","status":"direct","domain_realization":"List unproved obligations and model-to-reality gaps."},{"component":"Independent Proof Review","status":"direct","domain_realization":"Have an independent reviewer check reductions and constructive proofs."},{"component":"Complexity Follow-On Gate","status":"direct","domain_realization":"After decidability, assess whether incident-time execution is feasible."}],"mechanism_dispositions":[{"slug":"abstract_interpretation_or_model_checking","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Use a finite conservative incident-policy abstraction and label one-directional guarantees.","counterfactual_removal":"Without it, the fallback loses scalable sound assurance for policies outside exact fragments."},{"slug":"bounded_domain_exhaustive_search","disposition":"selected_load_bearing","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Exhaustively check a finite pilot corpus and declared trace bound without generalizing beyond it.","counterfactual_removal":"The first test would lack a terminating, reproducible bounded reference result."},{"slug":"computability_boundary_decision_record","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Version the boundary, evidence, shipped wording, and recheck triggers.","counterfactual_removal":"The mathematical boundary remains, but guarantee drift becomes harder to detect."},{"slug":"computational_complexity_analysis","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Gate decidable modes against disaster-response latency and resource limits.","counterfactual_removal":"A correct analyzer could still be operationally unusable."},{"slug":"constructive_algorithm_and_correctness_proof","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Establish totality and correctness for each claimed decidable fragment.","counterfactual_removal":"Positive decidability claims would lack a usable witness."},{"slug":"diagonalization_impossibility_proof","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Reject unless the policy formalism admits a clean direct self-reference construction; use a reduction first.","counterfactual_removal":"No change to the proposed reduction-based boundary test."},{"slug":"enumeration_and_dovetailing","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Unbounded running is unsuitable for incident-facing operation; use bounded semi-decision with UNKNOWN.","counterfactual_removal":"No material change because fair unbounded search is not shipped."},{"slug":"fallback_mode_router","disposition":"selected_load_bearing","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Route policies to exact, abstract, bounded, or escalation modes and preserve guarantee labels.","counterfactual_removal":"Weaker results could be consumed as universal safety verdicts."},{"slug":"halting_problem_reduction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Attempt a model-matched reduction from halting to unrestricted policy assurance.","counterfactual_removal":"The proposal would lack its principal route to proving an impossibility boundary."},{"slug":"language_fragment_restriction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Define a mechanically enforceable response-policy fragment admitting a total analyzer.","counterfactual_removal":"There would be no guaranteed exact serviceable region after an unrestricted impossibility result."},{"slug":"many_one_reduction_proof","disposition":"selected_supporting","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Use it as the formal contract for the halting-to-assurance mapping.","counterfactual_removal":"The reduction could remain rhetorical rather than property-preserving."},{"slug":"promise_problem_restriction","disposition":"considered_rejected","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Reject unchecked don't-care behavior; emergency inputs require enforced rejection or conservative quarantine.","counterfactual_removal":"Excluding it prevents authoritative outputs on violated promises."},{"slug":"proof_by_counterexample","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Use in-scope policies to refute overbroad analyzer claims, not to prove undecidability.","counterfactual_removal":"Universal overclaims become slower to disprove empirically."},{"slug":"proof_checking","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Independently verify constructive and impossibility certificates against the stated theorem.","counterfactual_removal":"A proof gap could authorize an unsafe or needlessly narrow boundary."},{"slug":"reduction_direction_checklist","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Gate the reduction on source-to-target direction, totality, computability, and assumptions.","counterfactual_removal":"A reversed or incomplete reduction becomes more likely to pass review."},{"slug":"semi_decision_with_explicit_unknown","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Bound sound witness search and return YES-with-certificate or UNKNOWN, never fabricate NO.","counterfactual_removal":"Timeouts could again be converted into false negative verdicts."},{"slug":"theorem_prover_guided_search","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Optional proof discovery adds no essential guarantee beyond independent certificate checking in the bounded test.","counterfactual_removal":"Proofs may take longer to discover, but the causal chain and safety gate remain."},{"slug":"turing_reduction_analysis","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Relative oracle degrees do not answer the immediate shipped exact-versus-fallback decision.","counterfactual_removal":"No material change to the operational boundary."}],"causal_chain":["Make the policy language, incident model, property, quantifiers, and computational capabilities explicit.","Seek both a constructive total analyzer and a valid impossibility reduction for the declared class.","Classify the unrestricted class and mechanically enforce any decidable fragment.","Route each accepted input to the strongest justified mode while preserving UNKNOWN and scope labels.","Independently check evidence and reclassify when assumptions or language change.","Reduce false universal assurances and futile implementation effort while retaining useful bounded analysis."],"baseline":"Continue extending the analyzer, impose timeouts, and coerce timeout or inconclusive results into safe/unsafe outputs without a class-wide termination proof.","nearest_rival":"Treat the task solely as computational-complexity and capacity engineering, assuming a total decision procedure exists and optimizing its runtime.","authority_safety":{"affected_parties":["responders","incident commanders","evacuees and residents","people with mobility, medical, language, or access needs","jurisdictions and mutual-aid partners"],"decision_authority":"The emergency-management authority retains approval authority; technical reviewers may classify guarantees but may not certify operational policy safety from the formal result alone.","authorized_first_step":"Run an offline pilot on one versioned policy language, one formal safety property, a finite synthetic policy set, and a fixed trace bound; compare exact bounded results with abstraction and UNKNOWN rates before any operational use.","excluded_actions":["automatic activation or rejection of live response plans","claiming real-world safety from model safety alone","treating timeout or UNKNOWN as safe or unsafe","generalizing bounded findings beyond the declared bound","accepting out-of-fragment policies under an exact-guarantee label"],"halt_rollback":"Halt if the abstraction misses a bounded counterexample, guarantee labels are lost downstream, fragment membership is unenforceable, or reviewers cannot validate the claimed theorem. Revert to advisory-only output and human review; retain prior records and withdraw the affected guarantee."}},"negative_tests":{"strongest_counterevidence":"The authority may use a finite, effectively enumerable policy language and bounded incident horizon with an existing total checker; then the central issue is tractability or model validity, not computability.","analogy_break":"A physical disaster is not a program. An undecidability result applies only to the encoded policy-transition model and cannot establish that real incidents are intrinsically undecidable or that formally verified plans are safe in reality.","failure_condition":"The mapping fails if the operative requirement concerns one bounded scenario, if policy semantics cannot be defined faithfully enough to form a stable decision problem, or if no universal exact terminating guarantee is claimed.","problem_falsifier":"Show that all accepted policies and incident traces are mechanically bounded and effectively enumerable, and that the requirement is only for that bounded class with no unrestricted public claim.","intervention_falsifier":"In the offline pilot, the boundary workflow fails if it cannot prevent mislabelled outputs, if its exact fragment excludes the operationally important policy forms, or if its fallbacks provide no useful certified result at acceptable latency.","risks":["A correct formal proof may certify the wrong incident model.","A restrictive fragment may omit adaptations needed during cascading disasters.","False alarms from coarse abstraction may cause alert fatigue.","UNKNOWN may be suppressed by downstream interfaces or organizational pressure.","The impossibility claim may overreach because of a flawed reduction or mismatched encoding.","Formal assurance may displace field expertise and affected-community knowledge."]},"null_rationale":null,"classification":{"candidate_kind":"DOMAIN_TRANSFER","prior_art_status":"UNSEARCHED","evidence_maturity":"HYPOTHESIS"},"revision_change_log":{"revision_kind":"ORIGINAL","prior_problem_id":null,"prior_causal_lever_id":null,"problem_changed":false,"causal_lever_changed":false,"conceptual_changes":[],"operational_changes":[],"repairs_addressed":[]},"confidence":0.78,"generator_notes":"Closed-book structural transfer. The candidate depends on the unverified hypothesis that the response-policy language and assurance requirement are sufficiently expressive and universal; the proposed first test is therefore classification and falsification, not deployment."}