{"schema_version":1,"research_id":"eoa_inverse_innovation_exp06_external_evaluation_20260803","source_assessment_id":"predictive_residual_processing__human_computer_interaction:P4:v0","cell_id":"predictive_residual_processing__human_computer_interaction","search_queries":["site:figma.com/blog multiplayer technology optimistic updates server authoritative client prediction latency","direct manipulation latency user performance primary study dragging interface latency Jota 2013","differential synchronization Fraser 2009 paper","official documentation optimistic UI server authoritative collaborative editor state synchronization","Jota Ng Albert Dietz Wigdor How fast is fast enough touch latency DOI 2013 pdf","primary research latency direct manipulation dragging performance user interface delay study","W3C WCAG status messages visual provisional state asynchronous updates official","React official useOptimistic documentation optimistic UI rollback","Local-First Software You Own Your Data in spite of the Cloud ACM paper Ink Switch","site:bls.gov/ooh computer information technology software developers median pay 2024","WCAG 2.2 W3C Recommendation status messages 4.1.3 official","site:fluidframework.com docs optimistic client state collaboration latency"],"sources":[{"source_id":"S1","title":"How Fast Is Fast Enough? A Study of the Effects of Latency in Direct-Touch Pointing Tasks","publisher":"ACM CHI","url":"https://www.tactuallabs.com/papers/howFastIsFastEnoughCHI13.pdf","source_class":"PRIMARY_RESEARCH","publication_date":"2013-04-27","accessed_at":"2026-08-03","claims_supported":["A controlled study of 45 participants and 12,960 dragging trials tested 1, 10, 25, and 50 ms latency.","Increasing latency significantly reduced pointing throughput and affected movement time and error-related performance.","Direct-manipulation latency can affect performance even at delays far below ordinary wide-area network round trips."]},{"source_id":"S2","title":"How Figma’s Multiplayer Technology Works","publisher":"Figma","url":"https://www.figma.com/blog/how-figmas-multiplayer-technology-works/","source_class":"COMMERCIAL_FIRST_PARTY","publication_date":"2019-10-16","accessed_at":"2026-08-03","claims_supported":["Figma applies local property changes immediately instead of waiting for server acknowledgement because it wants the editor to feel responsive.","Figma displays its best prediction of the eventually consistent value while an update remains unacknowledged.","Its server is ultimately authoritative and may reject locally applied changes, creating temporary conflicts or visible disappearance.","The production system already combines optimistic local manipulation, centralized ordering, conflict handling, and incremental property synchronization."]},{"source_id":"S3","title":"Making Multiplayer More Reliable","publisher":"Figma","url":"https://www.figma.com/blog/making-multiplayer-more-reliable/","source_class":"COMMERCIAL_FIRST_PARTY","publication_date":"2022-10-20","accessed_at":"2026-08-03","claims_supported":["Figma identifies its multiplayer service as authoritative for validation, ordering, and conflict resolution.","Figma uses sequence-numbered changes and full checkpoints, and reports more than 2.2 billion received changes per day.","Before rollout, Figma replayed journal entries and required byte-for-byte identity with later checkpoints on a sampled dark-launch path, obtaining about 400,000 consecutive validations.","Figma explicitly describes improving latency, reliability, and user trust as ongoing operational needs."]},{"source_id":"S4","title":"Differential Synchronization","publisher":"Google Research / ACM DocEng","url":"https://research.google/pubs/differential-synchronization/","source_class":"PRIMARY_RESEARCH","publication_date":"2009-09-16","accessed_at":"2026-08-03","claims_supported":["Differential Synchronization is an established client-server method for synchronizing state through deltas.","The method was designed to reduce bandwidth, avoid blocking input, tolerate occasional errors, and converge replicated copies.","It is close prior art for sending differences instead of complete document state."]},{"source_id":"S5","title":"useOptimistic","publisher":"React","url":"https://react.dev/reference/react/useOptimistic","source_class":"OFFICIAL_PRODUCT_DOCUMENTATION","publication_date":"n.d.","accessed_at":"2026-08-03","claims_supported":["React officially supports immediate optimistic rendering while an asynchronous action is pending.","The documentation distinguishes pending optimistic state from the actual returned state and demonstrates rollback/error recovery.","The reducer form recomputes optimistic state when shared base state changes, including changes caused by another user."]},{"source_id":"S6","title":"Local-First Software: You Own Your Data, in Spite of the Cloud","publisher":"Ink & Switch / ACM Onward!","url":"https://www.inkandswitch.com/essay/local-first/","source_class":"PRIMARY_RESEARCH","publication_date":"2019-04","accessed_at":"2026-08-03","claims_supported":["The paper identifies server round trips as a source of perceptible cloud-application delay.","It describes optimistic UI as a known latency-hiding pattern whose apparent completion can still be reversed by network or server failure.","It develops and evaluates collaborative synchronization approaches that keep interaction local while background synchronization resolves shared state."]},{"source_id":"S7","title":"Web Content Accessibility Guidelines (WCAG) 2.2","publisher":"World Wide Web Consortium","url":"https://www.w3.org/TR/WCAG22/","source_class":"STANDARD","publication_date":"2024-12-12","accessed_at":"2026-08-03","claims_supported":["WCAG 2.2 is a W3C Recommendation for web accessibility.","Status messages must be programmatically determinable so assistive technologies can present them without moving focus.","User-interface states and changes must be exposed to assistive technologies; interaction-triggered motion should also be disableable when nonessential.","A visual-only provisional marker is therefore insufficient for an accessible implementation."]},{"source_id":"S8","title":"Software Developers, Quality Assurance Analysts, and Testers","publisher":"U.S. Bureau of Labor Statistics","url":"https://www.bls.gov/ooh/computer-and-information-technology/software-developers.htm?src_trk=em66208e30428cf5.482550521236198752","source_class":"GOVERNMENT_OR_REGULATOR","publication_date":"2025-08","accessed_at":"2026-08-03","claims_supported":["The May 2024 median annual wage was $133,080 for software developers and $102,610 for software quality-assurance analysts and testers.","These wage anchors support broad labor-equivalent estimates, although they exclude benefits, management, infrastructure, and 2024-to-2026 escalation."]}],"problem_evidence":{"support":"STRONG","rationale":"The problem is visible in both controlled HCI evidence and a directly analogous production editor. S1 experimentally shows that added latency degrades dragging performance. S2 says Figma applies edits immediately specifically to preserve responsiveness and documents flicker and server-rejection edge cases. S6 independently identifies remote-server round trips and optimistic-update failure as cloud-application UX problems. S3 shows that authoritative synchronization, latency, and correctness are material at production scale. The prevalence and severity of this problem under the candidate's exact constrained-network regime remain unquantified.","source_ids":["S1","S2","S3","S6"]},"stakeholder_evidence":{"support":"MODERATE","rationale":"Figma is an identifiable potential adopter and authorizer: its multiplayer organization already owns an authoritative collaborative editor, explicitly prioritizes responsiveness, reliability, latency reduction, and user trust, and has used shadow replay validation before rollout. React's first-party optimistic-state support shows broad developer demand for immediate pending feedback. No source expresses demand for the candidate's exact command-conditioned residual, checksum, digest, and raw-audit bundle or commits to evaluating it.","source_ids":["S2","S3","S5"]},"prior_art":{"proximity":"SUBSTANTIAL_COLLISION","closest_analogues":[{"name":"Figma server-authoritative optimistic multiplayer editing","similarity":"Immediate local property application, prediction of eventual values, centralized authoritative ordering and rejection, incremental property updates, sequence-numbered changes, checkpoints, replay, and sampled byte-identical validation closely overlap the proposed workflow.","remaining_difference":"The opened descriptions do not establish a per-command shared predictor in which the server encodes its authoritative geometry result specifically as a residual against the client's command-conditioned prediction, the client verifies every reconstructed digest, provisional geometry is persistently and accessibly marked, and random full affected-state replies continuously audit that same residual channel.","source_ids":["S2","S3"]},{"name":"Differential Synchronization","similarity":"Maintains client-server copies and propagates deltas to reduce bandwidth while permitting asynchronous input and convergence after errors.","remaining_difference":"It is general state-diff synchronization, not a geometry-command predictor with provisional-versus-confirmed semantics, authoritative protected-operation bypasses, per-command reconstruction digests, or human-factors correction-jump criteria.","source_ids":["S4"]},{"name":"React useOptimistic","similarity":"Renders an immediate optimistic state, exposes a pending state, reconciles to the actual asynchronous result, and supports rollback and concurrent base-state changes.","remaining_difference":"It supplies UI state machinery rather than a synchronized predictive codec, server-side structured residual, model/version handshake, raw-state audit, or exact authoritative reconstruction guarantee.","source_ids":["S5"]},{"name":"Local-first and CRDT collaborative editing","similarity":"Avoids interaction-blocking server round trips by updating locally and synchronizing collaborative changes in the background.","remaining_difference":"Local-first architectures generally elevate the local replica rather than preserving the candidate's single authoritative server, command-relative residual response, explicit provisional state, and protected full-state bypass.","source_ids":["S6"]}],"distinctive_claim_remaining":"For a fixed set of reversible geometry commands under constrained network conditions, a visibly and programmatically marked command-conditioned prediction plus a server-generated, version-gated structured residual and client digest verification will reduce net authoritative-response bytes and manipulation disruption relative to complete-state waiting, while remaining non-inferior to both complete-state and ordinary optimistic-update comparators on retries, reversals, correction jumps, and accessibility, with zero digest errors and zero provisional confirmation of protected events. Random full responses must independently confirm that no authoritative differences were omitted. This is a testable integration claim, not an established novelty claim.","confidence":"HIGH"},"implementation_evidence":{"support":"MODERATE","rationale":"The main technical elements are individually credible: Figma demonstrates immediate local edits with an authoritative server, sequencing, checkpoints, replay, and sampled byte-identical validation; Differential Synchronization demonstrates bandwidth-saving deltas; React demonstrates pending optimistic state and rollback. The candidate is implementable for bounded deterministic geometry operations if client and server share canonical arithmetic, ordering, constraint versions, and digest rules. Workflow authority is feasible because the server remains authoritative and product owners control enabled operations. WCAG requires the provisional/confirmed distinction and changes to be programmatically exposed, not merely visual. No opened source validates the combined protocol under packet loss, hidden constraints, accessibility use, privacy-sensitive raw audits, or adversarial concurrency; those remain empirical and governance gaps.","source_ids":["S2","S3","S4","S5","S7"]},"scores":{"meaningful_impact":{"score":4,"rationale":"Latency measurably impairs direct manipulation, while production collaborative editors treat responsiveness, synchronization correctness, and reliability as core user needs. The addressable prevalence and realized effect size for the proposed scope are unknown.","source_ids":["S1","S2","S3","S6"]},"stakeholder_pull":{"score":3,"rationale":"A credible adopter class and a concrete first-party example exist, but expressed need is for responsive, reliable collaboration generally rather than this specific residual protocol.","source_ids":["S2","S3","S5"]},"incremental_advantage":{"score":3,"rationale":"Command-relative residuals, exact digest verification, protected bypasses, and independent full-response audits could improve naive optimistic editing, but net bandwidth and interaction benefits have not been measured against mature incremental synchronization.","source_ids":["S2","S3","S4"]},"distinctiveness_plausibility":{"score":2,"rationale":"The candidate substantially overlaps established optimistic UI, Figma's multiplayer architecture, differential synchronization, sequence replay, checkpoints, and shadow identity validation. Distinctiveness survives only in the exact governed integration and acceptance criteria.","source_ids":["S2","S3","S4","S5","S6"]},"technical_implementability":{"score":4,"rationale":"All central primitives have demonstrated analogues, and deterministic reversible geometry is a tractable initial boundary. Exact canonicalization across clients, concurrency, hidden constraints, and loss handling add nontrivial engineering risk.","source_ids":["S2","S3","S4"]},"adoption_authority_feasibility":{"score":4,"rationale":"An editor vendor controls the client, authoritative server, protocol, operation allowlist, rollout, accessibility review, and fallback. No outside regulator must authorize a non-production sandbox, although workspace data and participant consent remain organizational responsibilities.","source_ids":["S2","S3","S7"]},"evidence_readiness":{"score":3,"rationale":"A simulator can retain full authoritative truth, inject failures, compare exact digests, and measure bytes and interaction errors. Representative proprietary scenes and live participant evidence are still needed.","source_ids":["S1","S3"]},"safety_net_benefit":{"score":4,"rationale":"Server authority, sequence gates, full snapshots, sampled full-state replay, explicit pending status, rollback, and accessible status exposure are credible protections compared with unmarked optimistic rendering.","source_ids":["S2","S3","S5","S7"]},"scalability":{"score":3,"rationale":"Figma demonstrates authoritative incremental synchronization at billions of changes per day, and delta methods are bandwidth-efficient. Per-command prediction, digesting, audit traffic, model-version governance, and fallback frequency could erase savings and are unmeasured.","source_ids":["S3","S4"]}},"score_confidence":"MODERATE","costs":{"first_evidence":{"band_2026_usd":"50K_TO_250K","scope":"Build a non-production client/server simulator for three reversible commands, implement full-state and residual comparators, add fault injection and retained authoritative truth, preregister metrics, and run a small supervised HCI/accessibility study.","confidence":"MODERATE","assumptions":["Approximately 2 to 4 engineer-months plus part-time HCI, accessibility, and QA effort.","Existing editor geometry and constraint code can be reused or faithfully stubbed.","Includes loaded labor, participant costs, and test infrastructure but no production integration.","BLS 2024 wage medians are escalated and multiplied for benefits and overhead to obtain 2026 resource-equivalent costs."],"source_ids":["S1","S8"]},"initial_deployment_startup":{"band_2026_usd":"250K_TO_1M","scope":"Integrate one predictor version for drag, resize, and alignment into one editor client and authoritative server; add canonical serialization, sequence/checksum gates, digest verification, provisional-state accessibility, telemetry, snapshots, and shadow full responses in a staging or dark-launch environment.","confidence":"MODERATE","assumptions":["Roughly 2 to 5 loaded FTE-years across client, server, QA, reliability, design, accessibility, privacy, and product functions.","The existing synchronization stack exposes authoritative affected-object state and ordering tokens.","Excludes a broad production rollout and support for destructive or rights-affecting operations."],"source_ids":["S2","S3","S7","S8"]},"operational_launch":{"band_2026_usd":"1M_TO_5M","scope":"Production hardening and phased launch for the bounded operation set, including multi-client concurrency testing, regional network testing, observability, incident playbooks, security/privacy review, accessible alternatives, shadow validation, rollback, and on-call readiness.","confidence":"LOW","assumptions":["Approximately 6 to 15 loaded FTE-years plus infrastructure, independent testing, and rollout support.","A mature collaborative editor and authoritative service already exist; greenfield construction would exceed this scope.","Raw audit traffic is sampled and subject to existing workspace access, retention, and security controls.","Cost varies substantially with the number of clients, platforms, constraint engines, and regions."],"source_ids":["S3","S7","S8"]},"annual_recurring":{"band_2026_usd":"250K_TO_1M","scope":"Maintain predictor compatibility, canonicalization tests, telemetry, audit sampling, accessibility regression tests, incident response, constraint-version reviews, and periodic revalidation for the supported commands.","confidence":"LOW","assumptions":["Approximately 2 to 5 loaded FTE equivalents plus incremental storage, bandwidth, and observability.","The operation allowlist remains narrow and predictor updates are release-governed rather than continuously learned.","Major new platforms, command classes, or regulatory obligations would be separately funded."],"source_ids":["S3","S7","S8"]}},"verified_pipeline_gates":{"externally_supported_problem":{"status":"YES","reason":"Controlled primary research shows latency degrades dragging performance, while first-party production evidence identifies immediate local rendering, conflict flicker, server rejection, latency, and synchronization reliability as real editor concerns.","source_ids":["S1","S2","S3","S6"]},"externally_credible_adopter_or_authorizer":{"status":"YES","reason":"A collaborative-editor product organization such as Figma's multiplayer, reliability, product, and accessibility owners is identifiable and already controls an analogous authoritative client-server workflow. This establishes credibility, not partnership or commitment.","source_ids":["S2","S3","S7"]},"distinct_testable_incremental_claim":{"status":"YES","reason":"The candidate can be compared with complete authoritative updates and ordinary optimistic updates on net bytes, completion, retries, reversals, correction jumps, digest identity, protected-event confirmation, accessibility, fallback rate, and maintenance cost.","source_ids":["S1","S2","S3","S4","S5"]},"bounded_next_evidence_step":{"status":"YES","reason":"A sandbox simulator and within-subject study can be limited to three reversible operations, fixed network regimes, scripted concurrency and rejection cases, retained full authoritative truth, and explicit stop criteria.","source_ids":["S1","S3"]},"no_unresolved_safety_or_authority_stop":{"status":"YES","reason":"For the next sandbox step, authoritative state never leaves the server, production persistence is disabled, protected actions use full responses, every command retains full truth, users can request refresh, and the pending/confirmed distinction is accessibility-tested. Production safety remains unverified but is not a stop for the bounded experiment.","source_ids":["S2","S3","S5","S7"]},"credible_cost_scope_and_range":{"status":"YES","reason":"The four bands are tied to explicit staffing, integration, rollout, and maintenance scopes and anchored to official developer and QA wage data. Infrastructure and proprietary integration uncertainty are disclosed.","source_ids":["S8"]}},"next_evidence_step":"Pre-register and run a non-production comparison using one canonical scene engine, drag/resize/alignment only, 24 participants including keyboard and assistive-technology users, and identical scripted scenes under 20, 80, and 150 ms round-trip delay plus injected loss, reordering, stale baselines, snap changes, hidden constraints, concurrent movement, permission revocation, and server rejection. Compare (A) complete authoritative affected-object responses with no provisional geometry, (B) ordinary optimistic local rendering followed by normal server updates, and (C) the candidate's marked prediction plus structured residual, checksum, digest, snapshots, and random full-response audit. Retain a full authoritative response for every trial. Pre-register success as at least 25% lower median net response bytes than A after all metadata/audit traffic; at least 10% lower median completion time than A in the 80/150 ms regimes; no more than a 2-percentage-point increase versus the better comparator in retries or reversals; 100% reconstructed digest identity; zero protected events displayed as confirmed; at least 95% correct participant identification of provisional versus confirmed state in each input/accessibility mode; and fallback on no more than 20% of ordinary supported commands. Falsify the scoped claim if full-state latency is not a binding problem, either benefit threshold fails, any digest/protected-event failure occurs, correction jumps or mode switching exceed the non-inferiority limits, the provisional distinction is inaccessible, or total protocol/model/audit cost eliminates the byte saving.","blocking_evidence":["No target-editor telemetry quantifies how often complete authoritative responses miss the manipulation-feedback window or how much response content is predictable.","No comparative trial shows that marked prediction plus correction reduces retries, reversals, overshoot, or completion time without harmful correction jumps.","No failure-injection result establishes exact reconstruction, safe sequence-gap behavior, protected-event bypass, and recovery under concurrency, loss, reordering, and hidden constraints.","No accessibility study establishes that provisional and confirmed geometry are distinguishable across visual, keyboard, low-vision, motion-sensitive, and screen-reader workflows.","No production trace establishes net bandwidth savings after checksums, acknowledgements, digests, snapshots, shadow full responses, fallback traffic, and model-maintenance cost.","No adopter has committed engineering access, proprietary scene traces, or authority for a production pilot."],"research_disposition":"PARTNERED_RESEARCH_PROGRAM","world_novelty_boundary":"The eight-source search establishes substantial adjacent and overlapping practice, not world novelty. It did not conduct a patent search, standards-essential-claim analysis, source-code comparison, exhaustive literature review, or jurisdiction-specific legal review. Patentability, freedom to operate, world novelty, market size, realized impact, and the prevalence of the target network regime remain unmeasured. The surviving claim is only the contrastive and falsifiable performance/safety claim for the exact governed integration.","arm":"COMPLETE_PROPOSAL_PORTFOLIO","candidate_version":0,"controller_recommendation":{"action":"STOP_EMPIRICAL_RESEARCH_NEEDED","repairable":false,"material_progress_observed":true,"progress_targets":["Secure a collaborative-editor partner or an equivalent open sandbox exposing authoritative geometry, constraint, ordering, and full-response truth.","Pre-register the three-comparator protocol, network regimes, accessibility strata, benefit thresholds, non-inferiority margins, and immediate safety stop conditions.","Demonstrate zero digest mismatch and zero protected-event false confirmation under scripted loss, reordering, staleness, rejection, hidden constraints, and concurrency.","Measure net bytes, completion time, retries, reversals, correction displacement, fallback rate, provisional-state comprehension, accessibility, and maintenance effort against both comparators.","Obtain a partner-authorized dark launch with random full-response audit before any user-visible production pilot."],"reason":"Web evidence verifies the problem, adopter class, implementable primitives, extensive prior-art overlap, and a bounded test. The remaining incremental claim depends on proprietary editor traces, failure injection, participant interaction, accessibility evaluation, and live comparative measurements; bounded web research cannot resolve it. Under the controller rule, that requires an empirical-research stop."},"proposal_index":4}