{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp03_full320_20260801","cell_id":"computability_boundary_mapping__systems_cybernetics","trajectory_id":"R","attempt_index":0,"archetype_slug":"computability_boundary_mapping","domain_slug":"systems_cybernetics","decision":"CANDIDATE","problem_id":"universal_viability_prediction_for_adaptive_feedback_systems","causal_lever_id":"model_relative_solvability_and_fallback_boundary","proposal":{"problem":"A systems-assurance program claims it can always decide, for any finitely described adaptive or self-modifying feedback system, whether the system will ever leave a specified viability envelope. Finite simulations, timeouts, or successful cases are treated as universal evidence, while the system language, quantifiers, and permitted external information remain implicit. This independently recognizable problem produces both unsafe certifications and open-ended investment in an exact terminating predictor that may not exist for the declared class.","actors_substrate":["systems modelers and cyberneticians","assurance and control engineers","operators relying on viability verdicts","people and environments exposed to controlled-system failures","adaptive-system descriptions, feedback policies, and viability predicates"],"observable_state":"The assurance interface emits SAFE or UNSAFE for unrestricted adaptive-system descriptions, converts timeout to SAFE or UNSAFE, lacks UNKNOWN and OUT_OF_SCOPE states, and cites simulation coverage rather than a class-wide termination/correctness argument.","consequence":"An unsound SAFE verdict can permit viability-envelope violations; persistent nontermination can block operations; and an unjustified impossibility claim can suppress useful analysis on restricted system classes.","affected_objective":"Provide trustworthy, terminating, scope-explicit viability assurance without representing bounded evidence or one-sided search as a universal prediction theorem.","structural_mapping":[{"archetype_element":"open-ended problem class","domain_realization":"Finitely encoded adaptive feedback systems with unrestricted state-update and self-modification rules constitute the claimed analysis class.","claim_kind":"HYPOTHESIS"},{"archetype_element":"total exact decision requirement","domain_realization":"For every admitted model, the analyzer must halt and correctly decide whether any future trajectory exits the viability envelope.","claim_kind":"INFERENCE"},{"archetype_element":"implicit computation model","domain_realization":"Simulation engines, sensors, operators, and external solvers may add information or interaction not represented in the assurance claim.","claim_kind":"INFERENCE"},{"archetype_element":"computability boundary","domain_realization":"Unrestricted trajectory-safety prediction is separated from enforceable finite-state, bounded-horizon, or syntactically restricted model classes.","claim_kind":"HYPOTHESIS"},{"archetype_element":"honest weaker fallback","domain_realization":"Queries route to exact restricted analysis, sound over-approximation, bounded search, one-sided recognition, or explicit escalation with labelled guarantees.","claim_kind":"HYPOTHESIS"},{"archetype_element":"reclassification trigger","domain_realization":"Changes to model expressiveness, viability predicates, sensors, oracle-like services, or horizon bounds reopen the assurance classification.","claim_kind":"INFERENCE"}],"component_map":[{"component":"Problem-Class Specification","status":"direct","domain_realization":"Define the admitted adaptive-system class and the trajectory-viability property."},{"component":"Instance Representation Contract","status":"direct","domain_realization":"Specify model syntax, state encoding, initial conditions, disturbances, and viability predicate."},{"component":"Computation Model Contract","status":"direct","domain_realization":"Declare machine resources, interaction, sensors, experts, randomness, and external solvers."},{"component":"Solvability Guarantee Profile","status":"direct","domain_realization":"Distinguish exact decision, sound incomplete warning, bounded assurance, and approximation."},{"component":"Quantifier and Scope Map","status":"direct","domain_realization":"Separate every model/every trajectory claims from one model, horizon, or disturbance set."},{"component":"Computability Status Lattice","status":"direct","domain_realization":"Classify each assurance query as decidable, recognizable, relative, undecidable, or unresolved."},{"component":"Constructive Procedure Witness","status":"direct","domain_realization":"Require an algorithm plus correctness and termination arguments for positive decidability claims."},{"component":"Reduction Preservation Contract","status":"direct","domain_realization":"Require a total computable translation preserving the relevant trajectory verdict."},{"component":"Computability Impossibility Certificate","status":"direct","domain_realization":"Retain a checked reduction or direct proof for any unrestricted impossibility verdict."},{"component":"Assumption Register","status":"direct","domain_realization":"Record encoding, expressiveness, environment, observability, and oracle assumptions."},{"component":"Decidable Subclass Map","status":"direct","domain_realization":"Map enforceable finite-state, bounded-horizon, and restricted-rule subclasses."},{"component":"One-Sided Recognition Contract","status":"direct","domain_realization":"State which violations or certificates can be confirmed without promising the opposite verdict."},{"component":"Unknown and Nontermination Policy","status":"direct","domain_realization":"Keep UNKNOWN, TIMEOUT, OUT_OF_SCOPE, SAFE, and UNSAFE distinct."},{"component":"Fallback Solution Contract","status":"direct","domain_realization":"Label the guarantee attached to each restricted or approximate mode."},{"component":"Computability Guarantee Record","status":"direct","domain_realization":"Version-link the shipped claim to its evidence and assumptions."},{"component":"Recheck Trigger","status":"direct","domain_realization":"Reassess when language, predicate, bound, environment, or external capability changes."},{"component":"Termination Condition","status":"direct","domain_realization":"Give exact-analysis termination proofs or explicit fallback resource bounds."},{"component":"Scope Boundary","status":"direct","domain_realization":"Mechanically reject, quarantine, or abstain on models outside the supported class."},{"component":"Decision Record","status":"direct","domain_realization":"Record the selected assurance modes and rejected universal claim."},{"component":"Uncertainty Residue","status":"direct","domain_realization":"List unproved obligations, abstraction imprecision, and unresolved classifications."},{"component":"Independent Proof Review","status":"direct","domain_realization":"Have an independent reviewer check formal statement, proof, and reduction direction."},{"component":"Complexity Follow-On Gate","status":"direct","domain_realization":"Send decidable subclasses to resource-scaling assessment before deployment."}],"mechanism_dispositions":[{"slug":"abstract_interpretation_or_model_checking","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Use a finite over-approximation for sound restricted safety claims; false alarms remain explicit.","counterfactual_removal":"The fallback loses its principal sound assurance mode for unbounded concrete dynamics."},{"slug":"bounded_domain_exhaustive_search","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Exhaustively check models and traces only inside declared size and horizon bounds.","counterfactual_removal":"The pilot loses a complete bounded reference against which verdict labels can be tested."},{"slug":"computability_boundary_decision_record","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Version the boundary, shipped guarantee, evidence, and recheck triggers.","counterfactual_removal":"Guarantees can drift after model-language changes without an auditable trigger."},{"slug":"computational_complexity_analysis","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Assess scaling only after a subclass has a total procedure.","counterfactual_removal":"Decidable but operationally infeasible modes could be deployed without a feasibility gate."},{"slug":"constructive_algorithm_and_correctness_proof","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Require a terminating correct analyzer for each positive decidability classification.","counterfactual_removal":"Positive classifications would rest on tests rather than a class-wide witness."},{"slug":"diagonalization_impossibility_proof","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"A direct self-referential proof is unnecessary if a valid reduction supplies the certificate.","counterfactual_removal":"No change; the selected reduction route remains available."},{"slug":"enumeration_and_dovetailing","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Fair unbounded search conflicts with the operational requirement that each request return.","counterfactual_removal":"No change because the bounded explicit-UNKNOWN protocol supplies the usable one-sided mode."},{"slug":"fallback_mode_router","disposition":"selected_load_bearing","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Dispatch by verified class to exact, abstract, bounded, or abstaining modes and label each result.","counterfactual_removal":"Weaker answers could again be presented through one misleading Boolean interface."},{"slug":"halting_problem_reduction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Attempt a computable embedding from halting into unrestricted viability-exit prediction.","counterfactual_removal":"There would be no selected route to justify retiring the universal exact predictor."},{"slug":"language_fragment_restriction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Enforce a syntactic model fragment admitting a terminating analyzer.","counterfactual_removal":"The proposal loses its enforceable path from unrestricted models to exact decidable assurance."},{"slug":"many_one_reduction_proof","disposition":"selected_supporting","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Supply the total, computable, answer-preserving map underlying the halting reduction.","counterfactual_removal":"The impossibility claim would lack explicit preservation obligations."},{"slug":"promise_problem_restriction","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"An unenforced semantic promise permits authoritative outputs on violated preconditions; use syntactic restriction instead.","counterfactual_removal":"No change; mechanically checkable fragment membership remains."},{"slug":"proof_by_counterexample","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Use one in-scope failing model to refute the existing universal analyzer claim, without inferring undecidability.","counterfactual_removal":"The pilot loses a cheap test of whether the current universal claim is already false."},{"slug":"proof_checking","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Independently verify the formal theorem, termination proof, and assumptions.","counterfactual_removal":"A flawed or mismatched proof could authorize an unsafe boundary."},{"slug":"reduction_direction_checklist","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Gate the reduction on source-to-target direction, totality, computability, and preservation.","counterfactual_removal":"A reversed or incomplete reduction could be mistaken for an impossibility certificate."},{"slug":"semi_decision_with_explicit_unknown","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Return witnessed UNSAFE when found and UNKNOWN at the declared bound, never SAFE from exhaustion.","counterfactual_removal":"Timeout could again be laundered into a false safety verdict."},{"slug":"theorem_prover_guided_search","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Proof discovery tooling is optional and its timeout adds no boundary evidence.","counterfactual_removal":"No change; supplied proofs can be checked independently."},{"slug":"turing_reduction_analysis","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Relative computability degrees are unnecessary for the binary project decision and obscure one-sided guarantees.","counterfactual_removal":"No change; the many-one reduction is stronger for the intended certificate."}],"causal_chain":["Make the adaptive-system class, encoding, quantifiers, computation model, and viability guarantee explicit.","Seek a constructive decider and a valid impossibility reduction under the same contracts.","Classify the unrestricted class and enforce decidable fragments rather than generalizing from simulations.","Route each admitted query to the strongest justified mode with explicit UNKNOWN and OUT_OF_SCOPE behavior.","Independently check evidence, record the boundary, and reclassify on assumption changes.","Reduce false safety certification and stop investment in unsupported universal automation."],"baseline":"Ordinary practice is simulation over selected scenarios with a timeout, followed by a Boolean safety judgment or an informal claim that universal assurance is impossible.","nearest_rival":"More simulation, randomized stress testing, and longer timeouts improve empirical coverage but neither establish class-wide termination nor justify treating an unobserved violation as impossible.","authority_safety":{"affected_parties":["operators and maintainers","people subject to automated control decisions","communities and environments exposed to failures","model authors and assurance reviewers"],"decision_authority":"The accountable system owner may authorize only the bounded evaluation; production assurance changes require the designated safety authority and independent proof reviewer.","authorized_first_step":"On a non-actuating sandbox corpus, formalize one viability predicate and model language, test one claimed decidable fragment by exhaustive bounded comparison, and verify that every timeout or out-of-fragment case returns UNKNOWN or OUT_OF_SCOPE.","excluded_actions":["Do not relax existing safety controls based on the pilot.","Do not connect the analyzer to live actuation.","Do not report bounded absence of counterexamples as universal safety.","Do not deploy an impossibility classification before independent proof review."],"halt_rollback":"Halt if any in-scope bounded case is mislabeled, any timeout becomes SAFE or UNSAFE without a witness, fragment membership is ambiguous, or proof review finds a gap. Revert to the existing safety process and withdraw the affected guarantee record."}},"negative_tests":{"strongest_counterevidence":"A uniform effective procedure with independently checked totality and correctness for the full declared adaptive-system class would defeat the proposed unrestricted-boundary diagnosis and move the work to complexity assessment.","analogy_break":"Real systems may include finite hardware, stochastic environments, continuous dynamics, sensor information, and human intervention; a computability result for a symbolic model transfers only if the representation and computational capabilities faithfully match the deployed claim.","failure_condition":"The mapping fails if the actual task concerns one fixed bounded model, if the admitted language is already finite and enforceable, or if the primary obstacle is resource cost rather than existence of a terminating correct procedure.","problem_falsifier":"Audit the stated requirement and interface: if no class-wide exact terminating verdict is claimed or operationally inferred, and UNKNOWN and scope restrictions are already preserved, the diagnosed problem is absent.","intervention_falsifier":"Within the bounded pilot, reject the intervention if formal routing and fragment enforcement do not reduce guarantee-mislabelling relative to the baseline, or if the selected exact mode disagrees with exhaustive reference results on any admitted case.","risks":["An abstraction may omit real behavior and create false safety confidence.","A decidable fragment may exclude operationally important models.","UNKNOWN may be coerced downstream into SAFE.","A correct computability result may be misapplied to a mismatched physical system.","The boundary record may become stale as model expressiveness changes."]},"null_rationale":null,"classification":{"candidate_kind":"DOMAIN_TRANSFER","prior_art_status":"UNSEARCHED","evidence_maturity":"HYPOTHESIS"},"revision_change_log":{"revision_kind":"ORIGINAL","prior_problem_id":null,"prior_causal_lever_id":null,"problem_changed":false,"causal_lever_changed":false,"conceptual_changes":[],"operational_changes":[],"repairs_addressed":[]},"confidence":0.88,"generator_notes":"Closed-book structural transfer. Empirical prevalence, reduction success, abstraction soundness, and pilot benefit remain hypotheses until the bounded test and independent proof review are completed."}