{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp03_full320_20260801","cell_id":"computability_boundary_mapping__robotics_automation","trajectory_id":"R","attempt_index":0,"archetype_slug":"computability_boundary_mapping","domain_slug":"robotics_automation","decision":"CANDIDATE","problem_id":"universal_robot_controller_collision_verification","causal_lever_id":"model_relative_safety_verification_boundary","proposal":{"problem":"A robotics program requires one verifier to always terminate and correctly decide whether any arbitrary controller program can ever cause a collision across unbounded executions and admissible sensor/environment traces, while its controller language, environment model, quantifiers, and treatment of timeout remain implicit.","actors_substrate":["robotics verification engineers","controller developers","safety owners","robot operators and nearby people","arbitrary controller programs","robot and environment models","sensor and execution traces"],"observable_state":"Timeouts or successful finite campaigns are converted into SAFE/UNSAFE labels, and restricted-model results are presented as guarantees for arbitrary controllers and unbounded deployments.","consequence":"A potentially impossible universal-verification requirement consumes engineering effort or produces deceptive safety clearances; alternatively, an overbroad impossibility claim blocks useful verification of enforceable fragments.","affected_objective":"Obtain trustworthy, terminating collision-safety decisions where justified while preventing unverified controllers from receiving stronger guarantees than the evidence supports.","structural_mapping":[{"archetype_element":"Implicit open-ended problem class","domain_realization":"The claimed input class contains arbitrary controller programs, unbounded runs, and environment traces.","claim_kind":"INFERENCE"},{"archetype_element":"Universal exact terminating guarantee","domain_realization":"The verifier is expected to answer SAFE or UNSAFE correctly and terminate for every admitted controller-model pair.","claim_kind":"HYPOTHESIS"},{"archetype_element":"Model-relative boundary proof","domain_realization":"Controller syntax, plant/environment semantics, sensing assumptions, and computational capabilities are fixed before constructive or impossibility evidence is accepted.","claim_kind":"CORPUS"},{"archetype_element":"Restricted honest fallback","domain_realization":"Enforceable finite-state fragments receive exact checking; broader inputs receive sound abstraction, bounded evidence, or UNKNOWN with explicit scope labels.","claim_kind":"INFERENCE"}],"component_map":[{"component":"Problem-Class Specification","status":"adapted","domain_realization":"Controller-model pairs and collision reachability over declared trace classes."},{"component":"Instance Representation Contract","status":"adapted","domain_realization":"Versioned controller syntax, robot geometry, dynamics, sensors, environment, and initial states."},{"component":"Computation Model Contract","status":"adapted","domain_realization":"Effective offline verifier with declared arithmetic, nondeterminism, and external services."},{"component":"Solvability Guarantee Profile","status":"direct","domain_realization":"Exact total, sound-incomplete, bounded, or unresolved status per class."},{"component":"Quantifier and Scope Map","status":"adapted","domain_realization":"Separates every controller/state/trace claims from bounded instances."},{"component":"Computability Status Lattice","status":"direct","domain_realization":"Classifies fragments as decidable, recognizable, relative, undecidable, or unresolved."},{"component":"Constructive Procedure Witness","status":"adapted","domain_realization":"Algorithm plus correctness and termination proof for any exact fragment."},{"component":"Reduction Preservation Contract","status":"adapted","domain_realization":"Computable source-to-controller encoding preserving the reachability answer."},{"component":"Computability Impossibility Certificate","status":"adapted","domain_realization":"Checked reduction or direct proof for the unrestricted formal class."},{"component":"Assumption Register","status":"direct","domain_realization":"Records language, dynamics, precision, trace, and oracle assumptions."},{"component":"Decidable Subclass Map","status":"adapted","domain_realization":"Enforceable finite-state, bounded-horizon, or restricted-language regions."},{"component":"One-Sided Recognition Contract","status":"adapted","domain_realization":"Collision witnesses may establish UNSAFE without establishing SAFE."},{"component":"Unknown and Nontermination Policy","status":"direct","domain_realization":"UNKNOWN, timeout, out-of-scope, SAFE, and UNSAFE remain distinct."},{"component":"Fallback Solution Contract","status":"adapted","domain_realization":"Each fallback publishes only its model-relative guarantee."},{"component":"Computability Guarantee Record","status":"direct","domain_realization":"Version-links formal class, evidence, verdict, and shipped label."},{"component":"Recheck Trigger","status":"adapted","domain_realization":"Language, dynamics, environment, sensor, or oracle changes reopen classification."},{"component":"Termination Condition","status":"adapted","domain_realization":"Finite model or explicit time/depth/state budget."},{"component":"Scope Boundary","status":"adapted","domain_realization":"Mechanically checked admission to guaranteed fragments."},{"component":"Decision Record","status":"direct","domain_realization":"Records accepted boundary, rationale, owners, and expiry triggers."},{"component":"Uncertainty Residue","status":"direct","domain_realization":"Open proof obligations and abstraction gaps remain visible."},{"component":"Independent Proof Review","status":"direct","domain_realization":"A reviewer checks theorem fit, reductions, and constructive proofs."},{"component":"Complexity Follow-On Gate","status":"adapted","domain_realization":"Decidable fragments proceed to runtime and state-space feasibility analysis."}],"mechanism_dispositions":[{"slug":"abstract_interpretation_or_model_checking","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Sound finite abstraction supplies scoped safety verdicts with possible false alarms.","counterfactual_removal":"Broad inputs would lack a sound automated fallback."},{"slug":"bounded_domain_exhaustive_search","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Exhaustively checks the bounded pilot model.","counterfactual_removal":"Pilot completeness within its fence would be lost."},{"slug":"computability_boundary_decision_record","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Versions boundary, guarantee, and recheck triggers.","counterfactual_removal":"Guarantees could drift silently."},{"slug":"computational_complexity_analysis","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Gates decidable fragments for practical feasibility.","counterfactual_removal":"Decidability could be mistaken for deployability."},{"slug":"constructive_algorithm_and_correctness_proof","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Required evidence for an exact terminating fragment.","counterfactual_removal":"Exact decidability claims would lack a witness."},{"slug":"diagonalization_impossibility_proof","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"A robotics-specific direct self-reference construction is not supplied.","counterfactual_removal":"No planned chain changes."},{"slug":"enumeration_and_dovetailing","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Unbounded running is unsuitable for this operational interface.","counterfactual_removal":"Bounded UNKNOWN protocol remains."},{"slug":"fallback_mode_router","disposition":"selected_load_bearing","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Routes by enforced class to exact, abstract, bounded, or escalation modes.","counterfactual_removal":"Weaker evidence could be mislabeled as universal."},{"slug":"halting_problem_reduction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Tests unrestricted collision reachability via a property-preserving controller encoding.","counterfactual_removal":"The proposed impossibility boundary would be unsupported."},{"slug":"language_fragment_restriction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Mechanically enforceable controller syntax creates decidable regions.","counterfactual_removal":"No admission-controlled exact region remains."},{"slug":"many_one_reduction_proof","disposition":"selected_supporting","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Formalizes total computable answer-preserving reduction obligations.","counterfactual_removal":"Reduction validity becomes ambiguous."},{"slug":"promise_problem_restriction","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Unchecked promises allow authoritative answers on violating inputs; syntactic admission is safer.","counterfactual_removal":"Fragment restriction remains sufficient."},{"slug":"proof_by_counterexample","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Refutes overbroad tool guarantees using an admitted failing instance.","counterfactual_removal":"Claim stress-testing becomes weaker."},{"slug":"proof_checking","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Independently checks boundary proofs and exposed premises.","counterfactual_removal":"A proof gap could authorize a false boundary."},{"slug":"reduction_direction_checklist","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Gates source-to-target direction and assumptions.","counterfactual_removal":"Reversed reductions may pass review."},{"slug":"semi_decision_with_explicit_unknown","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Returns witness-backed UNSAFE or bounded UNKNOWN, never timeout-as-SAFE.","counterfactual_removal":"Operational termination would invite fabricated negatives."},{"slug":"theorem_prover_guided_search","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Optional proof discovery adds no necessary guarantee beyond independent certificate checking.","counterfactual_removal":"Core classification is unchanged."},{"slug":"turing_reduction_analysis","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Relative degrees and adaptive oracles are unnecessary for the binary boundary claim.","counterfactual_removal":"Many-one evidence still supports the claim."}],"causal_chain":["Formalize the controller, environment, input class, computation model, and universal guarantee.","Seek a total correct procedure and a checked source-to-target impossibility reduction in parallel.","Classify only matched formal classes; enforce membership in decidable fragments.","Route admitted instances to exact checking and broader ones to sound abstraction or bounded witness search.","Preserve UNKNOWN and scope labels so missing evidence cannot become a safety clearance.","Reclassify when the language, model, or external capability changes."],"baseline":"Continue testing and timing out the existing verifier, treating no found collision as SAFE or treating repeated failure as proof of undecidability.","nearest_rival":"Adopt a fast simulation or reachability heuristic with thresholds, without first determining which class-wide guarantees are possible.","authority_safety":{"affected_parties":["robot operators","nearby workers and bystanders","controller developers","safety reviewers","system owners"],"decision_authority":"The designated robotics safety owner may approve the formal boundary and offline pilot only after independent proof review; deployment clearance remains with the existing safety authority.","authorized_first_step":"On synthetic non-actuating models, define one finite-state controller fragment and 20 bounded scenarios, check admission mechanically, compare exact exhaustive results with abstract and UNKNOWN outputs, and audit every label.","excluded_actions":["deploying or actuating a robot from pilot results","treating UNKNOWN or timeout as SAFE","generalizing beyond the encoded fragment or bound","weakening existing safety interlocks","allowing an unchecked promise or external expert to extend the guarantee"],"halt_rollback":"Halt if admission is unsound, a known bounded collision is labeled SAFE, evidence labels are lost, or proof review finds a gap; withdraw the guarantee record and revert all cases to unverified/manual safety review."}},"negative_tests":{"strongest_counterevidence":"The actual production controller language and environment may already be finite and effectively enumerable, with an existing total reachability algorithm; then the issue is complexity, not computability.","analogy_break":"Physical robots have bounded hardware and finite recorded missions, whereas the impossibility result requires an unrestricted formal language or unbounded execution model; the theorem cannot be transferred to a merely large finite deployment without the encoding proof.","failure_condition":"The intervention fails if fragment membership cannot be enforced, the abstraction drops feasible behaviors, routing strips guarantee labels, or the reduction does not preserve collision reachability.","problem_falsifier":"The diagnosed problem is falsified if requirements and interfaces already restrict inputs to an enforceable finite class, provide a proved total correct decider, and never claim beyond that class.","intervention_falsifier":"In the bounded pilot, falsify the intervention if exact enumeration finds any collision that the sound abstraction labels SAFE, if any out-of-fragment case receives an exact label, or if independent review rejects the constructive proof or reduction.","risks":["An unsound robot/environment abstraction could create false safety confidence.","A restrictive fragment may exclude common controllers and encourage bypasses.","State-space explosion may make decidable checks operationally useless.","Formal semantics may omit physical failure modes, sensor faults, or human interaction.","Institutional labels may outlive the assumptions supporting them."]},"null_rationale":null,"classification":{"candidate_kind":"DOMAIN_TRANSFER","prior_art_status":"UNSEARCHED","evidence_maturity":"HYPOTHESIS"},"revision_change_log":{"revision_kind":"ORIGINAL","prior_problem_id":null,"prior_causal_lever_id":null,"problem_changed":false,"causal_lever_changed":false,"conceptual_changes":[],"operational_changes":[],"repairs_addressed":[]},"confidence":0.86,"generator_notes":"Closed-book domain transfer. The target problem and empirical prevalence are hypotheses; no prior-art search or robotics-specific impossibility proof was performed."}