{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp03_full320_20260801","cell_id":"computability_boundary_mapping__earth_sciences","trajectory_id":"R","attempt_index":0,"archetype_slug":"computability_boundary_mapping","domain_slug":"earth_sciences","decision":"CANDIDATE","problem_id":"universal_hazard_reachability_in_extensible_earth_models","causal_lever_id":"model_relative_hazard_decidability_boundary","proposal":{"problem":"An extensible Earth-system modeling platform is expected to decide, for every admissible executable model and initial condition, whether a specified geological, hydrological, oceanic, or atmospheric hazard threshold will ever be crossed. Because admissible process rules, time horizons, and guarantees are left implicit, nontermination or resource exhaustion can be reported as absence of hazard, while restricted successes are advertised as universal conclusions.","actors_substrate":["Earth scientists authoring executable process models","Hazard analysts interpreting reachability results","Model-platform engineers maintaining analyzers and plugin interfaces","Public agencies and communities relying on hazard classifications","Executable Earth-system model language, initial-condition encoding, and hazard predicates"],"observable_state":"The analyzer returns Boolean hazard/no-hazard outputs for open-ended models; some runs time out, yet timeout, false, numerical failure, and unresolved status are not consistently distinguished.","consequence":"A genuine reachable hazard may be cleared after incomplete analysis, or an impossible universal analyzer may absorb continued engineering effort.","affected_objective":"Scientifically faithful and operationally safe screening of hazard reachability in executable Earth-system models.","structural_mapping":[{"archetype_element":"Open-ended problem class","domain_realization":"All models expressible through the platform's process language or plugins, paired with encoded initial conditions and hazard predicates.","claim_kind":"HYPOTHESIS"},{"archetype_element":"Universal exact terminating guarantee","domain_realization":"For every admitted model, answer correctly and halt on whether the hazard is ever reached.","claim_kind":"INFERENCE"},{"archetype_element":"Potential universal computation","domain_realization":"User-defined rules, unbounded state, iteration, and conditional evolution may jointly encode arbitrary computation; this must be demonstrated for the actual language.","claim_kind":"HYPOTHESIS"},{"archetype_element":"Impossibility evidence","domain_realization":"A computable, property-preserving translation from a known undecidable source into hazard-reachability instances would rule out the unrestricted decider.","claim_kind":"INFERENCE"},{"archetype_element":"Decidable region","domain_realization":"Mechanically enforced finite-state, bounded-horizon, or otherwise proven-total model fragments.","claim_kind":"INFERENCE"},{"archetype_element":"Honest weaker operation","domain_realization":"Exact bounded checking, sound abstraction, or witness-producing one-sided search returns labeled YES, SAFE-under-abstraction, or UNKNOWN rather than fabricated NO.","claim_kind":"INFERENCE"},{"archetype_element":"Semantic-fidelity constraint","domain_realization":"Restrictions and abstractions must preserve the Earth process and hazard meaning for which users claim assurance.","claim_kind":"INFERENCE"}],"component_map":[{"component":"Problem-Class Specification","status":"direct","domain_realization":"Declare the admitted model, initial-condition, forcing, horizon, and hazard-predicate class."},{"component":"Instance Representation Contract","status":"direct","domain_realization":"Version the model syntax, numeric semantics, state encoding, and hazard predicate."},{"component":"Computation Model Contract","status":"direct","domain_realization":"State precision, execution semantics, nondeterminism, external data, and plugin capabilities."},{"component":"Solvability Guarantee Profile","status":"direct","domain_realization":"Separate total exact decisions from sound, bounded, or one-sided results."},{"component":"Quantifier and Scope Map","status":"direct","domain_realization":"Distinguish every admitted model from named models and finite scenario sets."},{"component":"Computability Status Lattice","status":"adapted","domain_realization":"Classify model fragments as decidable, recognizable, relative, undecidable, or unresolved."},{"component":"Constructive Procedure Witness","status":"direct","domain_realization":"Provide algorithm plus termination and correctness arguments for any decidable fragment."},{"component":"Reduction Preservation Contract","status":"direct","domain_realization":"Require a total computable encoding preserving hazard reachability in both directions."},{"component":"Computability Impossibility Certificate","status":"direct","domain_realization":"Retain the checked reduction and exact theorem scope."},{"component":"Assumption Register","status":"direct","domain_realization":"Record expressiveness, numeric, horizon, forcing, and oracle assumptions."},{"component":"Decidable Subclass Map","status":"direct","domain_realization":"List enforceable finite-state, bounded-horizon, and restricted-rule fragments."},{"component":"One-Sided Recognition Contract","status":"adapted","domain_realization":"A simulated trajectory or certificate may confirm reachability without deciding non-reachability."},{"component":"Unknown and Nontermination Policy","status":"direct","domain_realization":"Keep UNKNOWN, timeout, numerical failure, out-of-scope, and NO distinct."},{"component":"Fallback Solution Contract","status":"direct","domain_realization":"Label the scope and direction of every weaker result."},{"component":"Computability Guarantee Record","status":"direct","domain_realization":"Version-link model semantics, proof, analyzer, and public claim."},{"component":"Recheck Trigger","status":"direct","domain_realization":"Reassess after language, plugin, numeric, external-data, or hazard-predicate changes."},{"component":"Termination Condition","status":"direct","domain_realization":"Set finite state, horizon, depth, step, or time bounds for operational modes."},{"component":"Scope Boundary","status":"direct","domain_realization":"Mechanically reject or quarantine models outside guaranteed fragments."},{"component":"Decision Record","status":"direct","domain_realization":"Record which guarantee ships and why."},{"component":"Uncertainty Residue","status":"direct","domain_realization":"Publish unproved obligations and abstraction-induced alarms."},{"component":"Independent Proof Review","status":"direct","domain_realization":"Have an independent reviewer check formalization, reduction, and constructive proofs."},{"component":"Complexity Follow-On Gate","status":"direct","domain_realization":"After decidability, assess state explosion and operational cost."}],"mechanism_dispositions":[{"slug":"abstract_interpretation_or_model_checking","disposition":"selected_supporting","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Over-approximate reachable Earth-model states in a finite abstraction and preserve one-directional safety claims.","counterfactual_removal":"Fallbacks would lose a sound abstraction option but bounded checking would remain."},{"slug":"bounded_domain_exhaustive_search","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Exhaust finite horizons and discretized state spaces with claims confined to the bound.","counterfactual_removal":"The first operational exact fallback would lack a terminating completeness basis."},{"slug":"computability_boundary_decision_record","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Version the chosen boundary, guarantee, assumptions, and recheck triggers.","counterfactual_removal":"The mathematical boundary could stand, but guarantee drift would be harder to detect."},{"slug":"computational_complexity_analysis","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Evaluate feasibility only after a fragment is shown decidable.","counterfactual_removal":"Decidable but unusable modes could pass into deployment."},{"slug":"constructive_algorithm_and_correctness_proof","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Establish totality and correctness for restricted model fragments.","counterfactual_removal":"Placement of fragments on the decidable side would lack a constructive witness."},{"slug":"diagonalization_impossibility_proof","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"A direct self-reference proof is unnecessary if the actual model language admits a clearer reduction.","counterfactual_removal":"No material change; reduction evidence supplies the negative boundary."},{"slug":"enumeration_and_dovetailing","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Unbounded operation is unsuitable for the first deployed interface; bounded semi-decision is safer.","counterfactual_removal":"No change to the bounded fallback."},{"slug":"fallback_mode_router","disposition":"selected_load_bearing","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Route each model to exact-fragment, bounded, sound-abstract, or UNKNOWN handling with guarantee labels.","counterfactual_removal":"Valid analyses could be presented under the wrong guarantee."},{"slug":"halting_problem_reduction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Test whether actual model constructs permit a computable encoding whose hazard event reveals halting.","counterfactual_removal":"The unrestricted impossibility claim would remain unsupported."},{"slug":"language_fragment_restriction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Define a mechanically enforceable restricted Earth-model grammar with a total analyzer.","counterfactual_removal":"There would be no enforceable exact-answer region."},{"slug":"many_one_reduction_proof","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Use its totality, computability, and biconditional obligations to validate the halting encoding.","counterfactual_removal":"Reduction review would lose its precise preservation contract."},{"slug":"promise_problem_restriction","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Unenforced scientific-data promises could yield authoritative wrong answers; prefer syntactic enforcement.","counterfactual_removal":"No change because the chosen scope boundary is enforceable."},{"slug":"proof_by_counterexample","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Use one admitted failing model to refute any overbroad analyzer-totality claim.","counterfactual_removal":"Positive proof obligations remain, but cheap claim refutation is lost."},{"slug":"proof_checking","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Independently check the exact formal statement, reduction, and fragment proof.","counterfactual_removal":"A subtle proof or formalization gap could authorize unsafe claims."},{"slug":"reduction_direction_checklist","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Gate the source-to-target direction and declared assumptions.","counterfactual_removal":"A reversed reduction could be mistaken for impossibility evidence."},{"slug":"semi_decision_with_explicit_unknown","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Return witnessed YES or bounded UNKNOWN, never timeout-as-NO.","counterfactual_removal":"Resource exhaustion could again be laundered into non-reachability."},{"slug":"theorem_prover_guided_search","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Optional proof discovery adds no required guarantee beyond independent checking.","counterfactual_removal":"Hand-constructed checkable proofs remain sufficient."},{"slug":"turing_reduction_analysis","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Relative oracle degrees are not needed to decide the proposed flat deployment boundary.","counterfactual_removal":"No material change to classification or fallback."}],"causal_chain":["Formalize the executable Earth-model class, semantics, quantifiers, and hazard property.","Seek both a total constructive analyzer for restricted fragments and a valid source-to-target impossibility reduction for the unrestricted class.","Mechanically enforce the proven decidable fragment and classify all other inputs without overextending the theorem.","Route admitted queries to exact, bounded, or sound one-sided analysis.","Preserve UNKNOWN and failure states, preventing incomplete computation from becoming a false no-hazard verdict.","Version the evidence and reclassify whenever model expressiveness or semantics change."],"baseline":"Continue running the universal analyzer, impose operational timeouts, and translate unresolved runs into Boolean outputs or analyst judgment without a model-relative guarantee.","nearest_rival":"Treat the task solely as numerical optimization and scaling: add compute, improve solvers, and benchmark heuristics without first determining whether a total exact analyzer exists for the declared class.","authority_safety":{"affected_parties":["Model authors","Hazard analysts","Public decision-makers","Communities exposed to modeled hazards"],"decision_authority":"The model-platform owner may classify and label analyzer guarantees; domain hazard authorities retain responsibility for operational hazard decisions.","authorized_first_step":"On a frozen sandbox copy of one representative model language, specify semantics and attempt both a checked halting-style encoding and a constructive decision procedure for a finite-state, bounded-horizon fragment; test only synthetic models and publish no hazard clearance.","excluded_actions":["Using UNKNOWN or timeout as evidence of no hazard","Changing public hazard classifications during the test","Claiming undecidability from failed proof search","Generalizing bounded results beyond their declared bounds","Silently excluding real models from the advertised scope"],"halt_rollback":"Halt if the encoding does not preserve the hazard property, fragment membership cannot be enforced, or abstraction soundness is unproved. Retain the existing advisory workflow, mark computability status unresolved, and withdraw only experimental guarantee labels."}},"negative_tests":{"strongest_counterevidence":"The deployed language may already have finite state, bounded horizons, and no unrestricted plugins. If so, exhaustive reachability is decidable in principle and the observed failures are complexity or numerical-engineering problems, not a computability boundary.","analogy_break":"The physical Earth is not thereby claimed to be a program, and uncertainty in observations is not undecidability. The reduction applies only to the executable model language when its constructs can encode arbitrary computation and the translation preserves the specified hazard event.","failure_condition":"The proposal fails if the actual admitted class cannot encode the reduction source, if its semantics are too ambiguous for a stable decision problem, or if restrictions remove scientifically essential behavior so the solved fragment no longer represents the stated hazard task.","problem_falsifier":"A complete audit shows every admitted production model belongs to an effectively enumerable finite class with a fixed finite horizon and total transition semantics; no universal claim extends beyond it.","intervention_falsifier":"Independent review finds no valid impossibility reduction for the unrestricted language and no proved-total, semantically faithful analyzer for the proposed restricted fragment, or the routed interface still causes users to interpret UNKNOWN as no hazard.","risks":["A correct theorem may formalize the wrong Earth process or hazard predicate.","A coarse abstraction may create unusable false alarms; an unsound one may miss real hazards.","State-space explosion may make a decidable fragment operationally useless.","Users may bypass restrictive fragments to recover needed expressiveness.","Official boundary records may preserve stale or erroneous assumptions."]},"null_rationale":null,"classification":{"candidate_kind":"MECHANISM_COMPOSITION","prior_art_status":"UNSEARCHED","evidence_maturity":"HYPOTHESIS"},"revision_change_log":{"revision_kind":"ORIGINAL","prior_problem_id":null,"prior_causal_lever_id":null,"problem_changed":false,"causal_lever_changed":false,"conceptual_changes":[],"operational_changes":[],"repairs_addressed":[]},"confidence":0.82,"generator_notes":"Closed-book structural transfer. The candidate is conditional on the actual Earth-model language being expressive enough for a valid reduction; no empirical claim of undecidability is made."}