{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp03_full320_20260801","cell_id":"computability_boundary_mapping__medicine_healthcare","trajectory_id":"R","attempt_index":0,"archetype_slug":"computability_boundary_mapping","domain_slug":"medicine_healthcare","decision":"CANDIDATE","problem_id":"universal_cds_module_safety_preclearance","causal_lever_id":"enforceable_cds_scope_and_labeled_fallbacks","proposal":{"problem":"A health system wants a predeployment verifier that always terminates and correctly decides whether any arbitrary executable clinical decision-support module will terminate and never issue a prohibited recommendation for every possible longitudinal patient record. Finite simulations and review cannot establish that universal claim when modules admit unrestricted computation.","actors_substrate":["patients","clinicians","clinical decision-support governance committee","module developers","EHR and CDS runtime"],"observable_state":"Modules pass finite test suites or time out during analysis, yet are labeled universally safe; analyzer outputs collapse safe, unsafe, timeout, unknown, and out-of-scope states.","consequence":"A genuinely unsafe module may be cleared, or useful modules may be rejected after inconclusive analysis, while resources continue flowing to an unattainable total-exact verifier.","affected_objective":"Safe, timely, and auditable deployment of clinical decision support without overstating verification guarantees.","structural_mapping":[{"archetype_element":"Unrestricted class-wide exact terminating requirement","domain_realization":"Preclear every arbitrary CDS program over every admissible patient-record history.","claim_kind":"HYPOTHESIS"},{"archetype_element":"Expressive input and computation model","domain_realization":"Executable CDS modules can encode unbounded control flow unless their language and runtime are restricted.","claim_kind":"INFERENCE"},{"archetype_element":"Computability boundary","domain_realization":"Termination and nontrivial behavioral safety of unrestricted modules require a formal impossibility or constructive classification, not extrapolation from tests.","claim_kind":"INFERENCE"},{"archetype_element":"Weaker honest fallback","domain_realization":"Enforce a decidable module fragment; otherwise use sound abstraction, bounded checks, or UNKNOWN with human governance.","claim_kind":"HYPOTHESIS"},{"archetype_element":"Guarantee-preserving governance","domain_realization":"Every verdict carries its scope, assumptions, evidence, and recheck triggers into the release record.","claim_kind":"HYPOTHESIS"}],"component_map":[{"component":"Problem-Class Specification","status":"direct","domain_realization":"Arbitrary executable CDS modules and prohibited-output/termination properties."},{"component":"Instance Representation Contract","status":"adapted","domain_realization":"Versioned module, patient-record schema, terminology, and runtime encoding."},{"component":"Computation Model Contract","status":"direct","domain_realization":"Declared CDS language, memory, external calls, nondeterminism, and time model."},{"component":"Solvability Guarantee Profile","status":"direct","domain_realization":"Separate total-exact, sound-incomplete, bounded, and escalated guarantees."},{"component":"Quantifier and Scope Map","status":"direct","domain_realization":"Distinguish every module/every record from one module or bounded histories."},{"component":"Computability Status Lattice","status":"direct","domain_realization":"Classify fragments as decidable, recognizable, relative, unresolved, or undecidable."},{"component":"Constructive Procedure Witness","status":"adapted","domain_realization":"Provide a terminating verifier and proof for each supported fragment."},{"component":"Reduction Preservation Contract","status":"direct","domain_realization":"Show a computable source-to-CDS encoding preserving the queried behavior."},{"component":"Computability Impossibility Certificate","status":"direct","domain_realization":"Checked halting reduction for the unrestricted module language, if assumptions match."},{"component":"Assumption Register","status":"direct","domain_realization":"Record language expressiveness, environment bounds, and safety-property formalization."},{"component":"Decidable Subclass Map","status":"direct","domain_realization":"Enumerate enforceable finite-state or otherwise decidable CDS fragments."},{"component":"One-Sided Recognition Contract","status":"adapted","domain_realization":"Confirm witnessed violations without treating failure to find one as safety."},{"component":"Unknown and Nontermination Policy","status":"direct","domain_realization":"Keep UNKNOWN, timeout, out-of-scope, unsafe, and safe distinct."},{"component":"Fallback Solution Contract","status":"direct","domain_realization":"Route to fragment verification, sound abstraction, bounded testing, or review."},{"component":"Computability Guarantee Record","status":"direct","domain_realization":"Attach scope and exact guarantee to each release verdict."},{"component":"Recheck Trigger","status":"direct","domain_realization":"Reclassify after language, runtime, schema, property, or external-service changes."},{"component":"Termination Condition","status":"direct","domain_realization":"Bound fallback analysis and return UNKNOWN at exhaustion."},{"component":"Scope Boundary","status":"direct","domain_realization":"Mechanically reject or quarantine unsupported modules."},{"component":"Decision Record","status":"direct","domain_realization":"Version the chosen boundary, evidence, routing, and release decision."},{"component":"Uncertainty Residue","status":"direct","domain_realization":"List unproved obligations and abstraction-induced alarms."},{"component":"Independent Proof Review","status":"direct","domain_realization":"Independent review of reductions, verifier proofs, and formalization fidelity."},{"component":"Complexity Follow-On Gate","status":"direct","domain_realization":"Assess feasibility only after a fragment is shown decidable."}],"mechanism_dispositions":[{"slug":"abstract_interpretation_or_model_checking","disposition":"selected_load_bearing","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Soundly over-approximate module behavior; alarms remain inconclusive.","counterfactual_removal":"Unrestricted modules would lack a scalable safety-oriented fallback."},{"slug":"bounded_domain_exhaustive_search","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Exhaust records and traces only inside an explicit finite pilot bound.","counterfactual_removal":"The first test loses a complete bounded reference result."},{"slug":"computability_boundary_decision_record","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Version scope, guarantee, evidence, and triggers.","counterfactual_removal":"Guarantees could drift silently after system changes."},{"slug":"computational_complexity_analysis","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Gate deployment feasibility after decidability is established.","counterfactual_removal":"Correct but unusable verifiers could be mistaken for deployable ones."},{"slug":"constructive_algorithm_and_correctness_proof","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Required for total verification within the supported fragment.","counterfactual_removal":"The restricted fragment would lack a justified positive guarantee."},{"slug":"diagonalization_impossibility_proof","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Redundant because a matched halting reduction is easier to audit.","counterfactual_removal":"No change if the reduction certificate remains valid."},{"slug":"enumeration_and_dovetailing","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Operational nontermination is unsuitable for release gating; bounded UNKNOWN is used.","counterfactual_removal":"No change to the terminating workflow."},{"slug":"fallback_mode_router","disposition":"selected_load_bearing","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Dispatch by enforceable class and label each weaker guarantee.","counterfactual_removal":"Fallback outputs could be presented as universal clearance."},{"slug":"halting_problem_reduction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Use only if unrestricted CDS semantics support a property-preserving encoding.","counterfactual_removal":"The claim that universal exact preclearance is impossible would be unsupported."},{"slug":"language_fragment_restriction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Admit only mechanically recognizable constructs with a total verifier.","counterfactual_removal":"There is no enforceable region offering universal terminating answers."},{"slug":"many_one_reduction_proof","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Its obligations are incorporated in the specific halting reduction.","counterfactual_removal":"No change if those obligations remain explicit."},{"slug":"promise_problem_restriction","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Unenforced clinical don't-cares are unsafe; syntactic rejection is preferred.","counterfactual_removal":"No loss; the fragment boundary covers the safe restriction role."},{"slug":"proof_by_counterexample","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Use an in-scope module to refute any overbroad analyzer claim.","counterfactual_removal":"Pilot sensitivity to guarantee overreach is reduced."},{"slug":"proof_checking","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Independently check the reduction and fragment-verifier proof.","counterfactual_removal":"Release authority would depend excessively on proof authors."},{"slug":"reduction_direction_checklist","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Gate the impossibility certificate on source-to-target direction and assumptions.","counterfactual_removal":"A reversed or mismatched reduction could terminate valid work."},{"slug":"semi_decision_with_explicit_unknown","disposition":"selected_load_bearing","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Bound violation search and return UNKNOWN, never SAFE, when unconfirmed.","counterfactual_removal":"Timeouts could be laundered into safety verdicts."},{"slug":"theorem_prover_guided_search","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Proof discovery is optional; independently checkable proofs are the requirement.","counterfactual_removal":"No causal change to the proposed classification."},{"slug":"turing_reduction_analysis","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Relative oracle degrees do not answer the release-gating question.","counterfactual_removal":"No change to the target guarantee."}],"causal_chain":["Formalize the module class, patient-record encoding, prohibited behavior, quantifiers, and runtime.","Check whether a matched halting reduction blocks a total-exact verifier for the unrestricted class.","Enforce a decidable language fragment and prove its verifier total and correct.","Route other modules to sound abstraction or bounded witness search with explicit UNKNOWN.","Attach guarantee labels and unresolved obligations to governance review.","Recheck the boundary when language, runtime, data schema, or safety properties change."],"baseline":"Manual clinical/software review plus finite simulations, fuzzing, and timeouts, followed by a binary approve/reject decision.","nearest_rival":"Conventional hazard analysis, sandboxing, and testing without a formal class-wide computability classification or explicit UNKNOWN contract.","authority_safety":{"affected_parties":["patients whose care may be influenced","clinicians receiving recommendations","developers and reviewers"],"decision_authority":"The health system's accountable CDS governance and clinical-safety committee retains release authority; the analyzer cannot authorize care.","authorized_first_step":"Retrospectively classify a small, version-frozen set of nondeployed modules; compare bounded exhaustive results, fragment-verifier verdicts, and fallback labels without affecting care.","excluded_actions":["automatic clinical deployment","treating UNKNOWN as SAFE or NO-VIOLATION","generalizing bounded results beyond their bound","using patient outcomes to experiment without approved oversight"],"halt_rollback":"Stop the pilot on any false SAFE verdict, scope-enforcement bypass, mislabeled UNKNOWN, or proof-review failure; withdraw affected records and revert to existing review."}},"negative_tests":{"strongest_counterevidence":"The actual CDS language and record horizon may already be finite and effectively enumerable, making the target decidable; moreover, clinical appropriateness may resist faithful formalization, so the main limitation could be empirical uncertainty rather than computability.","analogy_break":"Program-semantic safety is not identical to clinical safety: a verifier can prove conformance to a formal prohibition while the prohibition itself is medically incomplete or wrong.","failure_condition":"The intervention fails if fragment membership cannot be enforced, the abstraction drops real behaviors, labels are ignored downstream, or useful coverage collapses into pervasive UNKNOWN.","problem_falsifier":"The problem is falsified if the deployed module language, environment, and admissible record histories are demonstrably bounded and a total correct verifier already covers every claimed safety property.","intervention_falsifier":"Compared with ordinary review, the bounded pilot shows no improvement in detecting overclaims or separating inconclusive cases, or it produces any false SAFE verdict under the declared model.","risks":["False reassurance from an unsound abstraction or wrong clinical formalization","Exclusion of clinically valuable modules by an overly narrow fragment","Alert-like overload from false alarms and UNKNOWN results","Governance delay for time-sensitive updates","Boundary records becoming stale after runtime or terminology changes"]},"null_rationale":null,"classification":{"candidate_kind":"MECHANISM_COMPOSITION","prior_art_status":"UNSEARCHED","evidence_maturity":"HYPOTHESIS"},"revision_change_log":{"revision_kind":"ORIGINAL","prior_problem_id":null,"prior_causal_lever_id":null,"problem_changed":false,"causal_lever_changed":false,"conceptual_changes":[],"operational_changes":[],"repairs_addressed":[]},"confidence":0.79,"generator_notes":"Closed-book structural transfer. The candidate concerns verification of executable CDS behavior, not algorithmic resolution of medical truth; empirical prevalence and effectiveness remain hypotheses."}