{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp06_four_proposal_generalization60_20260803","cell_id":"predictive_residual_processing__human_computer_interaction","arm":"COMPLETE_PROPOSAL_PORTFOLIO","candidate_id":"prp-hci-residual-bulk-action-preview","proposal_index":3,"version":0,"title":"Residual Dry-Run Preview for Bulk Interface Actions","problem":"Before committing a bulk action in an administrative table, spreadsheet, or content-management interface, a user may need to verify changes across many heterogeneous records. A count-only confirmation hides record-level effects, while a complete before-and-after listing consumes visual attention with changes that exactly follow the declared operation. Unexpected coercions, skipped records, dependency changes, permission effects, or out-of-scope records can consequently be buried among routine diffs. This proposal addresses execution heterogeneity after the user has declared an operation; it does not assume that agreement between the operation and its execution proves the user's underlying intent was correct.","actors":["User authorizing the bulk operation","Bulk-action interface and local preview client","Server-side dry-run executor","Data or application owner","Safety, permissions, or compliance reviewer","Product team responsible for the operation contract"],"observable_state":"For each preview, logs can show the selected scope, declared operation contract, predictor version, expected field-level effects, independently computed dry-run effects, structured residuals, risk weights, displayed rows, raw audit sample, full-preview requests, model compatibility, and final user decision. The problematic state is observable when material nonconforming effects are surrounded by routine diffs, or when a summary reports nominal counts without exposing which records changed differently from the declared pattern.","consequence":"A user may approve a bulk operation without noticing exceptional effects, producing unintended data, access, workflow, or dependency changes that require recovery or separate review. Conversely, an overaggressive exception model can hide expected rows whose full context would have revealed that the selected scope or operation itself was wrong.","affected_objective":"Enable accurate, contestable pre-commit verification of heterogeneous bulk effects within a bounded human-attention budget, while preserving full visibility of selection scope, protected changes, representative expected cases, and the complete dry run on demand.","intervention":"Require every supported bulk action to expose a versioned intent contract specifying selected objects, fields, units, expected transformation, exclusions, and permissible side effects. Before commitment, a predictor uses that contract and the pre-action snapshot to generate an expected before-and-after effect for every selected record. A separately executed dry run computes the operation's actual prospective effects without committing them. A structured comparator subtracts expected effects from dry-run effects and preserves affected record, field, direction, dependency, and reason. The interface always shows the complete selection and operation summary, protected changes, uncertainty, and a random sample of full expected rows; it then allocates the remaining preview surface primarily to precision-and-consequence-weighted residuals such as skipped records, coercions, cascading changes, unexpected nulls, permission changes, or scope discrepancies. Expected rows can be reconstructed from the contract and snapshot, expanded individually, or revealed through a persistent 'show complete preview' control. Predictor and executor versions are checked before residual mode is allowed. Full snapshots, independent raw samples, residual-distribution monitoring, and a raw-preview fallback expose shared-model errors and drift. The user alone authorizes commitment. Reviewed residuals may revise preview rules and risk weights in a later version but cannot modify the pending operation or automatically approve it.","structural_mapping":[{"archetype_element":"Prediction target and scope","domain_realization":"The target is the record- and field-level prospective effect of one declared bulk operation on an immutable pre-action snapshot, bounded by selection, schema, application version, and dry-run validity window."},{"archetype_element":"Generative model state","domain_realization":"A versioned predictor combines the explicit operation contract, record snapshot, schema semantics, and declared side-effect rules to generate expected before-and-after states with uncertainty."},{"archetype_element":"Expected and actual behavior","domain_realization":"Expected effects are stored before a separate dry-run executor produces actual prospective effects; neither representation commits the operation."},{"archetype_element":"Prediction comparator","domain_realization":"A structured diff identifies unexpected records, values, types, omissions, additions, dependency effects, and scope changes while preserving direction and provenance."},{"archetype_element":"Precision-weighted residual channel","domain_realization":"The preview gives scarce visual attention to reliable and consequential mismatches, while protected categories bypass ranking and predicted effects remain reconstructible."},{"archetype_element":"Reconstruction","domain_realization":"The complete prospective state can be regenerated from the immutable snapshot, operation contract, expected-effect model, and structured corrections, or requested directly from the dry-run result."},{"archetype_element":"Synchronization and freshness","domain_realization":"Predictor, executor, schema, and snapshot identifiers must match; any intervening data change expires the preview and requires a new snapshot and dry run."},{"archetype_element":"Residual-driven learning","domain_realization":"Human-classified mismatches can revise side-effect expectations, model scope, consequence weights, or operation documentation only in a subsequently reviewed version."},{"archetype_element":"Independent raw audit","domain_realization":"Random full before-and-after rows and risk-stratified protected rows are drawn directly from dry-run output rather than selected by the predictor."},{"archetype_element":"Fallback and safety bypass","domain_realization":"Unsupported operations, high uncertainty, excessive residual mass, version mismatch, stale snapshots, failed reconstruction, or protected effects force a complete preview or prohibit commitment."}],"mechanism_mapping":[{"mechanism_slug":"efference_copy_cancellation","role":"A copy of the outgoing bulk command drives a forward model of its expected record-level consequences; comparison with the dry run leaves execution effects the command contract did not explain.","counterfactual_removal":"Without the command copy and forward model, the interface can show diffs but cannot distinguish declared consequences from unexplained prospective effects."},{"mechanism_slug":"delta_or_differential_encoding","role":"Expected record transformations remain implicit in the shared contract and snapshot, while the primary preview transmits structured corrections and compact counts.","counterfactual_removal":"Without differential representation, every routine before-and-after pair must occupy the primary preview or be discarded by a nonreconstructible summary."},{"mechanism_slug":"precision_weighted_error_gate","role":"Residuals are ranked by dry-run reliability, affected field, consequence class, uncertainty, recurrence, and preview cost; protected changes remain outside the gate.","counterfactual_removal":"Without weighting, numerous low-consequence formatting differences can displace a small permission, identity, or dependency mismatch."},{"mechanism_slug":"confidence_threshold_table","role":"A versioned table maps operation class, uncertainty, residual type, and consequence tier to compact display, expanded display, mandatory full preview, or blocked commitment.","counterfactual_removal":"Without an explicit threshold policy, preview compression and escalation would depend on opaque tuning or ad hoc interface choices."},{"mechanism_slug":"model_version_checksum_handshake","role":"The preview client and dry-run service verify compatible operation-contract, predictor, executor, schema, and snapshot identities before interpreting residuals.","counterfactual_removal":"Without the handshake, a residual can be reconstructed against an obsolete schema or operation definition and appear valid while describing the wrong prospective state."},{"mechanism_slug":"periodic_full_state_resynchronization","role":"Complete snapshot anchors and refreshed dry runs prevent accumulated or concurrent data changes from contaminating the preview baseline.","counterfactual_removal":"Without full-state reanchoring, a preview can remain internally coherent but stale relative to the records that will actually be changed."},{"mechanism_slug":"shadow_raw_channel_sampling","role":"Random complete before-and-after rows and protected strata are displayed from independent dry-run output to reveal uniform or systematic losses that residual selection would suppress.","counterfactual_removal":"Without raw samples, the preview cannot expose cases where predictor and gate share the same blind spot or where expected rows reveal a mistaken operation."},{"mechanism_slug":"residual_comparison_test","role":"Residual structure is compared across operation types, record segments, a simpler rule model, and raw dry-run samples to distinguish incidental variation from misspecified effect prediction.","counterfactual_removal":"Without comparison, structured misses may be dismissed as harmless exceptions or a noisy predictor may trigger indiscriminate expansion."},{"mechanism_slug":"model_drift_monitoring","role":"Changes in residual distributions, schemas, executors, record populations, and reconstruction fidelity determine when an effect model is stale or outside scope.","counterfactual_removal":"Without drift monitoring, evolving side effects can gradually become misrepresented by a preview model licensed under earlier behavior."},{"mechanism_slug":"raw_signal_fallback_switch","role":"High uncertainty, stale state, mismatched versions, unsupported effects, excess residual mass, reconstruction failure, or user request switches to the complete dry-run preview or blocks commitment if completeness is unavailable.","counterfactual_removal":"Without a tested fallback, the user could be required to decide from a compressed preview precisely when its predictive assumptions have failed."},{"mechanism_slug":"prediction_error_review","role":"Owners classify material mismatches as executor defects, contract defects, model defects, data-quality cases, or legitimate side effects before changing the preview model.","counterfactual_removal":"Without review, repeated harmful side effects could be learned as expected and progressively disappear from the residual surface."}],"causal_chain":["The user defines a bulk selection and operation, while the interface exposes the complete scope and a versioned effect contract.","The predictor generates expected record-level effects from the command, immutable snapshot, schema, and declared side effects before execution.","A separate noncommitting dry run calculates the actual prospective effects against the same snapshot.","The comparator produces provenance-tagged residuals for prospective effects not reconstructed by the expected model.","Protected categories bypass compression, and a consequence-aware gate allocates the primary preview to remaining material residuals.","The interface combines residual episodes with the full operation summary, random expected-row samples, uncertainty, and controls for expanding any row or the complete preview.","Checksums and freshness rules ensure that expected effects and residuals refer to the same contract, executor, schema, and data snapshot.","The user inspects the evidence and independently chooses to commit, revise, cancel, or request fuller review; silence never authorizes commitment.","Raw samples and complete-preview audits test what the model suppressed, while drift or reconstruction failure forces decompression.","Reviewed mismatches revise later predictor, contract, or threshold versions without modifying the pending action automatically."],"baseline":"The baseline is the same noncommitting dry run presented either as a complete sequential before-and-after list or as aggregate counts plus manually defined warnings. The comparison preserves the same selected records, operation, snapshot, protected-change rules, commit control, and recovery plan, and includes predictor, synchronization, audit, and review costs.","nearest_rivals":["Complete row-by-row diff previews, which preserve prospective effects but do not represent predictable rows through a model-relative residual channel.","Count-only confirmation dialogs, which compress the preview without reconstructible record-level corrections, raw samples, or an error budget.","Static warning rules, which expose predefined risky fields but cannot identify arbitrary divergence between declared and executed effects.","Change summaries grouped by field or operation, which reduce repetition but do not maintain a versioned predictor, residual learning loop, synchronization protocol, or automatic decompression.","Post-commit audit logs, which support investigation after an operation but do not allocate attention to unexplained effects before authorization."],"remaining_contrastive_claim":"The proposal is specifically a pre-commit predictive representation loop: a declared operation generates expected record-level effects, an independent dry run supplies actual prospective effects, their structured residual becomes the principal exception evidence, and versioning, reconstruction, raw sampling, reviewed updating, and full-preview fallback constrain suppression. It does not claim to detect a uniformly mistaken intention when execution exactly matches the declared operation; complete scope display and raw expected-row sampling remain necessary for that separate risk.","authority_safety":{"decision_authority":"The user who holds permission to perform the bulk operation retains sole authority to commit, cancel, or request the complete preview. Data owners define operation eligibility and recovery requirements. Security, permissions, and compliance reviewers approve protected categories and blocking thresholds. A designated model owner may publish predictor revisions only after review; the preview system cannot grant itself commitment authority.","authorized_first_step":"Run the residual preview in shadow mode on scripted or recoverable dry runs for one reversible metadata-edit operation. Preserve and display the complete conventional preview to evaluators while separately recording which rows the residual interface would foreground, summarize, sample, or force into fallback.","excluded_actions":["No automatic commitment, preselected approval, or removal of the explicit commit step.","No residual-only preview for deletion, financial transfer, credential, ownership, legal-hold, identity, permission, or irreversible operations during the first evaluation.","No concealment of the complete selection scope, operation parameters, uncertainty, or random full-row sample.","No use of the predictor and dry-run executor as the same unchecked implementation of operation semantics.","No automatic learning from committed operations or treatment of repeated side effects as acceptable.","No reuse of raw record values beyond the authorized preview, audit, and retention scope.","No commitment from a stale snapshot or after a failed model-version check.","No tuning solely to reduce preview length or residual count."],"halt_rollback":"Disable residual mode and return to the complete conventional preview if any protected effect is summarized, reconstruction differs from dry-run truth beyond the declared tolerance, the predictor and executor lack independent checks, checksums mismatch, the snapshot becomes stale, residual mass exceeds capacity, a random sample exposes a systematic miss, or the user requests full detail. No operation may proceed when a complete current dry run cannot be produced. Because the first step is shadow-only, rollback removes no committed data; later testing must retain the operation's existing recovery mechanism."},"negative_tests":{"strongest_counterevidence":"The strongest counterevidence would be that users detect mistaken selections or operation parameters primarily by inspecting ordinary expected rows, so emphasizing residuals reduces correct pre-commit rejection even when reconstruction is technically accurate. The approach would also be undermined if predictor and dry-run semantics cannot be made independent enough to reveal shared errors, or if prospective effects are too heterogeneous for residual representation to reduce review cost after audits and fallback are included.","problem_falsifier":"The inferred problem is falsified for the scoped operation if observed conventional-preview sessions show that users can inspect all relevant prospective effects within the available decision time and that material exceptional effects are not obscured by routine diffs or aggregate summaries.","intervention_falsifier":"The intervention is falsified for the tested scope if blinded evaluators using the residual preview miss more injected material effects or mistaken scopes than with the complete preview, if any protected effect is compressed, if held-out reconstruction exceeds tolerance, if raw audits repeatedly reveal structured suppressed errors, or if modeling and fallback costs erase the usable attention savings.","risks":["A uniformly wrong selection or operation can match the predictor and produce little residual signal.","The predictor and executor may share code or assumptions, causing correlated blind spots and false reassurance.","Random expected-row samples may miss a rare but important mistake outside known protected classes.","Residual salience can expose sensitive outlier records more prominently than a full listing.","Users may anchor on highlighted exceptions and neglect the complete scope and operation summary.","A large residual queue can recreate the original preview overload while adding model complexity.","Repeated side effects may be normalized into the model even though they remain undesirable.","Stale snapshots or concurrent edits can make a correct preview differ from the eventual committed effect.","Consequence weights may systematically underrepresent minority record types or unfamiliar dependencies.","A persistent 'show all' control may be technically available but practically overlooked unless its use is visible and tested."]},"next_evidence_step":"Pre-register a shadow comparison for one reversible metadata-edit operation using scripted heterogeneous records and an immutable snapshot. Define exact field-level reconstruction tolerance, protected effects, residual budget, snapshot lifetime, raw-sample rule, review-time accounting, fallback triggers, and rejection criteria before generating results. Include ordinary expected rows plus injected skipped records, type coercion, unexpected null propagation, dependency changes, out-of-scope selection, stale snapshot, checksum mismatch, uniform wrong operation, and one protected permission effect. Have evaluators inspect both complete and residual previews in counterbalanced order while all commits remain disabled. Measure detection and correct classification of injected effects, detection of the uniformly wrong scope, full-preview requests, reconstruction disagreement, and total model-plus-review effort. Manually audit every protected case and a random sample of suppressed rows. The result may authorize only a supervised test on the same reversible operation.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Earlier proposal 1 predicts accessibility-tree consequences after an individual screen-reader command and reallocates a user's live auditory attention toward unexpected interface feedback. This proposal instead operates before a bulk data operation, predicts prospective record-level effects, compares them with a noncommitting dry run, and supports a commit-or-cancel decision through a visual residual preview; it neither mediates screen-reader speech nor manages post-command orientation. Earlier proposal 2 compresses consented interaction histories after use so UX researchers can find departures from an expected task path. This proposal does not model user navigation, select research sessions, or produce retrospective breakdown evidence; it models the effects of a declared data transformation and presents prospective execution discrepancies directly to the authorized operator. It is independently adoptable as a bulk-operation verification layer without either the assistive speech mediator or the session-research pipeline.","revision_record":{"parent_version":null,"progress_targets_addressed":[],"conceptual_changes":["Initial formulation of bulk-action verification as a predictive residual comparison between declared effects and independent dry-run effects."],"operational_changes":["Defined immutable snapshots, operation contracts, structured prospective residuals, protected full-display classes, raw expected-row sampling, synchronization, user-controlled commitment, and complete-preview fallback."],"evidence_changes":["Specified a bounded shadow comparison with injected execution, scope, synchronization, and shared-model failures; no external or prior-art evidence was used."],"claim_changes":["Bounded the opportunity to execution heterogeneity and explicitly excluded any claim that a zero-residual preview verifies the user's underlying intent, novelty, prevalence, demand, or effect size."]}}