{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp05_complete_proposal_portfolio20_20260803","cell_id":"computability_boundary_mapping__human_computer_interaction","arm":"COMPLETE_PROPOSAL_PORTFOLIO","candidate_id":"cbm_hci_adaptation_explanation_boundary_004","proposal_index":4,"version":0,"title":"Scope-Labeled Explanations for Adaptive Interface Changes","problem":"An adaptive interface changes navigation, defaults, prompts, or control visibility using executable personalization rules. Its explanation service is required to answer, correctly and with guaranteed termination, both “What happened during this interaction?” and “Can feature F ever influence this interface outcome?” for every rule program and valid context. These are different questions. A completed execution can support bounded provenance about the rules and values observed on that trace, but a global influence claim quantifies over all contexts and executions. For an unrestricted adaptation language, a program can simulate an arbitrary computation and make its output depend on F exactly when that computation halts. A total exact global-influence analyzer would therefore cross a computability boundary that trace logging, sampled tests, timeouts, or fluent reason text cannot remove.","actors":["People whose interfaces are personalized or adapted","Interaction designers defining which changes require explanation or contestability","Personalization engineers implementing adaptation rules","Accessibility reviewers assessing the effects of changing control placement and visibility","Data-governance reviewers examining use of profile and context features","Support staff investigating disputed interface changes","Product owners responsible for the explanation contract"],"observable_state":"After an interface changes, the user sees a reason such as “based on your preferences,” while internal evidence may consist only of a feature read, a reason-code string, a sampled test, or an engineer's inspection. The system does not distinguish recorded execution provenance from a local counterfactual or a class-wide claim that a feature can or cannot affect any outcome. Failure to observe influence before a timeout may be displayed as “feature not used,” and dependencies on external models or services may be omitted.","consequence":"Users and reviewers can receive an explanation stronger than the available evidence, making an interface change difficult to understand or contest. Engineers may incorrectly conclude that a feature is irrelevant, fail to investigate a valid counterexample, or redesign the wrong part of the interaction. Accessibility and governance decisions may rely on a global non-influence statement that was derived only from one trace or bounded testing.","affected_objective":"Provide truthful and inspectable explanations of adaptive interface behavior while keeping actual-trace provenance, bounded counterfactual evidence, exact finite-domain influence results, unrestricted witnessed influence, and unresolved global questions distinct.","intervention":"Adopt an Adaptive Explanation Boundary with three separately routed query contracts. ACTUAL_TRACE asks which recorded rule evaluations, input values, and external responses participated in one completed output; it returns RECORDED_TRACE_PROVENANCE and explicitly makes no global causal claim. BOUNDED_COUNTERFACTUAL fixes a finite context and execution envelope, checks every encoded comparison inside it, and reports results only for that bound. GLOBAL_INFLUENCE asks whether two valid contexts differing in a declared feature can produce different declared interface outcomes. Exact positive and negative global answers are available only for an enforceable finite, total adaptation-rule fragment. For unrestricted executable rules, fairly enumerate context pairs and interleave their computations; return WITNESSED_INFLUENCE with a replayable pair when found and UNKNOWN_GLOBAL_INFLUENCE when the resource bound expires. Return OUT_OF_MODEL_DEPENDENCY when an undeclared model, service, sensor, or human judgment affects the output, and keep OUT_OF_SCOPE_QUERY and TOOL_FAILURE separate. Present a short status and scope at the interface with an expandable evidence record. Version the rule fragment, feature model, output predicate, proof evidence, and recheck triggers.","structural_mapping":[{"archetype_element":"Problem-Class Specification","domain_realization":"The global class consists of executable adaptation programs, valid context encodings, a named feature, and a declared interface-output predicate; the question is whether some pair of contexts differing only in that feature yields different terminating outputs."},{"archetype_element":"Instance Representation Contract","domain_realization":"Each instance specifies the rule program and version, context variables and domains, feature-isolation relation, initial adaptive state, external inputs, termination observations, and the interface outcome being compared."},{"archetype_element":"Computation Model Contract","domain_realization":"The contract distinguishes recorded terminating executions, finite total rule systems, unrestricted programs with potentially nonterminating computations, bounded experiments, and behavior relative to external services or people."},{"archetype_element":"Quantifier and Scope Map","domain_realization":"One-trace participation, finite-envelope counterfactuals, existence of a global influence witness, and universal non-influence are represented as different claims rather than variants of one explanation."},{"archetype_element":"Computability Impossibility Certificate","domain_realization":"A checked reduction constructs an adaptation program that makes an interface outcome depend on the chosen feature exactly if an embedded arbitrary computation halts."},{"archetype_element":"Decidable Subclass Map","domain_realization":"A mechanically enforceable rule fragment has finite context domains, bounded internal state, total terminating evaluations, declared external inputs, and no executable escape hatch; global influence is decidable there by enumeration."},{"archetype_element":"One-Sided Recognition Contract","domain_realization":"For unrestricted rules, two terminating executions that differ only in the feature and produce different outcomes are a positive influence witness; failure to find such a pair is not evidence of non-influence."},{"archetype_element":"Unknown and Nontermination Policy","domain_realization":"Bound exhaustion becomes UNKNOWN_GLOBAL_INFLUENCE, an undeclared external dependency becomes OUT_OF_MODEL_DEPENDENCY, and analyzer failure becomes TOOL_FAILURE; none is rendered as feature non-use."},{"archetype_element":"Fallback Solution Contract","domain_realization":"Trace provenance and bounded counterfactual testing remain available where global classification is unresolved, but their interface labels prevent them from inheriting an exact global guarantee."},{"archetype_element":"Computability Guarantee Record","domain_realization":"A supersedable record links every explanation label to its rule version, context model, query scope, method, resource bound, evidence, external dependencies, and recheck triggers."}],"mechanism_mapping":[{"mechanism_slug":"halting_problem_reduction","role":"Test the unrestricted boundary by mapping a computation instance to an adaptation program whose declared output depends on feature F exactly when the embedded computation halts.","counterfactual_removal":"Without the reduction, failed analysis could be mistaken for impossibility, or an informal halting analogy could be applied to the wrong feature, output predicate, or execution model."},{"mechanism_slug":"proof_checking","role":"Independently verify the reduction, feature-isolation definition, termination observations, answer preservation, and exact theorem claimed.","counterfactual_removal":"Without independent checking, a proof about feature reads, one trace, or a different output semantics could be presented as a global influence result."},{"mechanism_slug":"language_fragment_restriction","role":"Define a syntactically enforceable finite and total adaptation-rule fragment for which exact global influence and non-influence answers are permitted.","counterfactual_removal":"Without the fragment, the proposal would expose the unrestricted boundary without providing an exact explanation mode designers can intentionally target."},{"mechanism_slug":"constructive_algorithm_and_correctness_proof","role":"Enumerate all valid finite context comparisons in the restricted fragment, run the total rules, compare declared outcomes, and prove termination and correctness.","counterfactual_removal":"Without a constructive decider, the fragment's exact explanation guarantee would rest on assertion rather than an executable procedure and proof obligations."},{"mechanism_slug":"bounded_domain_exhaustive_search","role":"Check every context pair and execution inside a declared finite envelope, producing a certificate whose scope includes the exact feature domain, state bound, and rule version.","counterfactual_removal":"Without precise bounded enumeration, sampled counterfactual tests could be described as exhaustive and their results generalized beyond the tested envelope."},{"mechanism_slug":"enumeration_and_dovetailing","role":"Fairly interleave unrestricted context-pair executions so that a nonterminating candidate cannot prevent discovery of a later finite influence witness.","counterfactual_removal":"Without dovetailing, search could become permanently trapped on one context and miss a readily demonstrable influence elsewhere."},{"mechanism_slug":"proof_by_counterexample","role":"Use one well-formed context pair differing only in F and producing different declared outcomes to refute a universal non-influence claim.","counterfactual_removal":"Without counterexample discipline, a valid witness might be dismissed as merely anecdotal, while absence of a found witness might be treated as proof."},{"mechanism_slug":"semi_decision_with_explicit_unknown","role":"Return WITNESSED_INFLUENCE when unrestricted search finds a replayable pair and UNKNOWN_GLOBAL_INFLUENCE at the declared bound, never exact non-influence.","counterfactual_removal":"Without an explicit unknown protocol, timeout or search exhaustion would tend to become a false statement that the feature cannot matter."},{"mechanism_slug":"fallback_mode_router","role":"Classify requests as trace, bounded counterfactual, finite-fragment global, unrestricted global, or externally relative and attach the strongest justified explanation label.","counterfactual_removal":"Without routing, evidence with different quantifiers could collapse into a single persuasive but ambiguous “because” statement."},{"mechanism_slug":"computability_boundary_decision_record","role":"Record the boundary, rule fragment, feature and output semantics, shipped labels, proof links, open uncertainty, and changes that trigger reclassification.","counterfactual_removal":"Without the record, new scripting capabilities, feature derivations, or external models could silently invalidate earlier explanation guarantees."}],"causal_chain":["An executable adaptation rule changes an interface outcome using user, device, task, or environmental context.","The explanation surface compresses trace participation, counterfactual dependence, and global feature influence into a single reason statement.","A feature read or a passing sample does not establish that changing the feature was necessary on the trace or that the feature can or cannot matter over all valid contexts.","When the global query ranges over arbitrary executable rules, a rule can delay feature-dependent output until an embedded arbitrary computation halts.","A checked reduction therefore blocks a total exact global-influence analyzer for the unrestricted model without blocking weaker or restricted explanations.","An enforceable finite total rule fragment makes every relevant context comparison enumerable and supports exact influence and non-influence certificates.","Unrestricted rules retain a one-sided search: a divergent terminating context pair proves influence, while non-finding remains unknown.","Recorded trace provenance and bounded counterfactual checks provide narrower evidence without acquiring the global claim.","Explicit labels and expandable evidence make the scope visible to users, designers, and reviewers at the point where the explanation is interpreted.","A versioned boundary record forces reclassification when rule expressiveness, feature semantics, external dependencies, or interface outcomes change."],"baseline":"The adaptive component emits developer-authored reason codes or natural-language explanations derived from values read during execution. Engineers supplement them with sampled counterfactual tests, logs, and manual code inspection. The explanation interface does not state whether its reason is trace-local, bounded, global, externally dependent, or unresolved, and a timeout or lack of observed variation may be interpreted as non-influence.","nearest_rivals":["Developer-authored reason strings: inexpensive and understandable, but they can become stale or state a rationale that is not supported by the executed rule path.","Execution logging or dynamic program slicing: can identify operations and values participating in one run, but it does not decide whether a feature can affect any other valid context.","Feature-importance or correlation summaries: may describe behavior over a selected dataset or model but do not provide an exact semantic influence verdict for arbitrary executable interface rules.","Sampled counterfactual testing: can find useful witnesses but cannot prove global non-influence outside its finite sample.","Manual engineer explanation: can combine contextual knowledge and inspect code, but it is an external capability with latency, disagreement, refusal, and accountability limits rather than a uniform total analyzer.","Disabling all adaptive explanations for executable rules: avoids overclaiming but discards trace provenance, bounded evidence, witnessed influence, and exact answers for the enforceable finite fragment."],"remaining_contrastive_claim":"The proposal's contrastive claim is limited to quantifier-preserving explanation: actual-trace provenance is never presented as a global causal result, exact non-influence is confined to an enforceable finite total fragment, and unrestricted analysis produces witnesses or explicit unknowns. It does not claim that computational influence is the same as a user's normative question of why a design choice was made, or that a technically correct explanation will be understandable or satisfactory.","authority_safety":{"decision_authority":"The product owner retains deployment authority, constrained by an interaction-design owner who approves the user-facing query semantics, a data or accessibility reviewer who approves material feature and outcome definitions, and an independent reviewer who approves formal boundary evidence. Users may contest an explanation but are not assigned responsibility for validating the analyzer. The explanation service cannot alter profiles, interfaces, eligibility, or permissions during the first evidence step.","authorized_first_step":"Run an offline shadow audit on one nonproduction adaptive interface component and a fixed synthetic rule suite. Freeze the feature domains, output predicate, rule semantics, query taxonomy, finite-fragment grammar, resource bounds, external-dependency representation, and status alphabet before generating explanations.","excluded_actions":["Changing a user's profile, interface, permissions, or service outcome in response to the pilot","Claiming global non-influence from a feature's absence on one trace, a sample, a timeout, or a bounded non-finding","Presenting RECORDED_TRACE_PROVENANCE as proof that a feature was necessary or sufficient","Issuing an exact global result for a rule outside the enforced finite total fragment","Hiding an external model, service, sensor, or human judgment that contributes to the outcome","Treating a computational influence result as a complete normative justification for the adaptation","Collapsing UNKNOWN_GLOBAL_INFLUENCE, OUT_OF_MODEL_DEPENDENCY, OUT_OF_SCOPE_QUERY, or TOOL_FAILURE into feature non-use","Using pilot explanations to make adverse or irreversible decisions about users"],"halt_rollback":"Halt the audit if recorded provenance disagrees with the frozen execution trace, finite-fragment membership can be bypassed, the exact analyzer misclassifies a seeded case, a witnessed pair cannot be replayed, an external dependency is omitted, sensitive trace material is exposed beyond the audit group, or any incomplete state is rendered as non-influence. Withdraw the affected labels, remove the shadow explanation output, preserve only authorized audit artifacts, and restore the unchanged baseline until the model or interface contract is corrected."},"negative_tests":{"strongest_counterevidence":"A mechanically checked constructive procedure that always terminates and correctly decides the declared global influence property for every program in the same unrestricted executable adaptation model would refute the proposed boundary. Evidence that all intended rules and context domains are already mechanically confined to a finite total fragment would instead show that the unrestricted classification is unnecessary and that the remaining issue is complexity or explanation design.","problem_falsifier":"The inferred problem is falsified if the service claims only to report literal execution provenance for completed traces, clearly labels that scope, makes no global or counterfactual feature claim, and already distinguishes missing logs, external dependencies, and tool failures. That situation would require provenance quality or communication work rather than computability-boundary mapping.","intervention_falsifier":"The intervention fails if the query types cannot be distinguished operationally, finite-fragment membership is unenforceable, the constructive analyzer is incorrect or nonterminating on a well-formed finite rule, a replayable influence witness is rejected, trace evidence is generalized to unobserved contexts, or any unknown or externally relative result is displayed as exact non-influence.","risks":["The formal influence predicate may not answer the user's intended normative question about why the adaptation policy exists.","Trace and context evidence may contain sensitive profile or environmental information.","Derived or aliased features may violate the assumption that two contexts differ only in the named feature.","Nondeterministic services or changing environments may make a witness difficult to replay.","The finite total fragment may exclude adaptation behavior designers consider necessary.","Exact enumeration may be decidable but too costly for an interactive explanation surface.","Unrestricted search may overproduce unknown results or find technically valid but operationally implausible witnesses.","Users may interpret concise labels without opening the scope and evidence details.","An incorrect external-dependency declaration may make a locally correct analysis semantically incomplete."]},"next_evidence_step":"Construct a fixed offline fixture suite for one adaptive component containing completed traces with known rule participation; finite-fragment rules where a feature is globally relevant or irrelevant; visually different outputs with the same declared outcome; unrestricted programs whose feature dependence appears only after delayed computation; a nonterminating context scheduled before a finite witness; bounded searches with no witness; derived-feature aliasing; undeclared external-service responses; missing logs; and simulated tool failures. Freeze all semantics and expected labels before execution. Require an independent check of the reduction and finite algorithm plus an interaction review of whether the labels communicate their quantifiers. Continue only if trace provenance matches the frozen traces, every exact finite result is correct, every witness replays, the nonterminating context does not starve a later witness, bounded non-finding remains UNKNOWN_GLOBAL_INFLUENCE, and external, out-of-scope, and failure statuses remain distinct. This step tests classification and representation fidelity only and estimates neither prevalence nor effect size.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Proposal 1 addressed release-time verification of whether an extensible interface could reach a forbidden protected-action state. Its intervention was a safety monitor, enforceable declarative fragment, sound abstraction, and release-assurance routing. Proposal 4 instead addresses the truth conditions of explanations for adaptive interface changes, separating completed-trace provenance from global feature influence; it can be adopted as an explanation and contestability contract without certifying protected-action safety. Proposal 2 addressed runtime help about whether a user could reach a desired workspace goal, using plan witnesses, a finite closed-world promise for exact unreachability, and declared collaborator dependencies. Proposal 4 neither finds task plans nor classifies user-goal feasibility; its evidence object is a feature-isolating context pair or execution record. Proposal 3 addressed whether an accessible replacement preserves the task semantics of a legacy interface and whether Wizard-of-Oz success supports a universal migration claim. Although both proposals expose provenance, Proposal 3 tracks human substitution during prototype-to-build evaluation and compares two complete systems, whereas Proposal 4 analyzes the scope of causal claims about one adaptive system's outputs. The four proposals therefore have different formal predicates, evidence artifacts, decision moments, authorities, consequences, and independent adoption paths.","revision_record":{"parent_version":null,"progress_targets_addressed":["Created a fourth independently adoptable opportunity for the same archetype-domain cell","Selected adaptive-interface explanation scope rather than safety verification, task reachability, or migration equivalence","Specified actors, observable states, causal boundary, operational statuses, authority, safeguards, rivals, falsifiers, risks, and bounded evidence","Explicitly contrasted the candidate with all three earlier sealed proposals"],"conceptual_changes":["Initial version; realized computability boundary mapping as a separation between actual-trace provenance, bounded counterfactual evidence, and global feature influence.","Defined global influence as an explicit context-pair property rather than treating feature reads or reason strings as causal explanations."],"operational_changes":["Initial version; defined the query router, finite total rule fragment, exact and one-sided modes, external-dependency status, user-facing scope disclosure, decision authority, and rollback conditions."],"evidence_changes":["Initial version; defined an offline fixture audit covering trace fidelity, exact finite classification, delayed and nonterminating computations, witness replay, feature aliasing, external dependencies, and label comprehension."],"claim_changes":["Initial version; limited the claim to quantifier-preserving adaptive explanations and made no claim of novelty, prevalence, demand, or effect size."]}}