{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp11_mechanism_context_external20_20260804","research_id":"eoa_inverse_innovation_exp11_external_scrutiny_20260804","cell_id":"computability_boundary_mapping__economics_finance","opaque_id":"computability_boundary_mapping__economics_finance__B","search_lanes":{"direct_problem":{"queries":["smart contract verification undecidable Turing complete contract safety halting problem","collateral invariant smart contract formal verification lending protocol solvency analyzer"],"source_ids":["SRC1","SRC5","SRC6","SRC8"],"no_result_note":null},"closest_prior_art":{"queries":["Securify compliance violation warning unknown smart contracts paper","Marlowe static analysis contract warnings timeout financial contracts finite state","Solvent liquidity verification smart contracts tool decidability"],"source_ids":["SRC3","SRC4","SRC5","SRC6"],"no_result_note":null},"historical_terminology":{"queries":["program verification undecidable Rice theorem reachability safety property historical","partial correctness total correctness smart contracts verification"],"source_ids":["SRC1","SRC8"],"no_result_note":null},"products_practices_standards":{"queries":["smart contract analyzer timeout unknown sound static analysis product","ITU formal verification framework smart contract model checking","Marlowe static analysis financial contracts finite state","CME clearing collateral policy risk committee"],"source_ids":["SRC2","SRC3","SRC4","SRC6","SRC7"],"no_result_note":null},"non_english_regional":{"queries":["formale Verifikation Smart Contracts Unentscheidbarkeit Halteproblem Sicherheit deutsch","vérification formelle contrats intelligents indécidabilité solvabilité collatéral"],"source_ids":["SRC8"],"no_result_note":"The German official Ethereum documentation directly covered decidability and verification limits. The French query produced no sufficiently stronger independent primary or official source for retention within the eight-source limit."},"composition_subproblems":{"queries":["financial smart contract collateral solvency formal verification model checking","unknown safe unsafe smart contract analyzer formal verification","contract admission formal verification smart contract exchange listing","clearinghouse programmable contracts admission risk committee collateral rules"],"source_ids":["SRC3","SRC4","SRC5","SRC6","SRC7"],"no_result_note":null}},"sources":[{"source_id":"SRC1","title":"Ethereum Whitepaper","url":"https://ethereum.org/whitepaper/","publisher":"Ethereum.org","date_or_year":"2014 (original whitepaper; living web edition)","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["The EVM is Turing-complete and can encode infinite loops.","The general halting problem prevents deciding in advance whether every program terminates.","Ethereum bounds individual executions with gas rather than solving termination universally.","Contract calls and variable target addresses complicate ahead-of-time execution bounds."]},{"source_id":"SRC2","title":"Recommendation ITU-T F.751.12: Formal verification framework for smart contract on distributed ledger technology","url":"https://www.itu.int/epublications/zh/publication/itu-t-f-751-12-2023-09-formal-verification-framework-for-smart-contract-on-distributed-ledger-technology","publisher":"International Telecommunication Union","date_or_year":"2023","source_type":"OFFICIAL_STANDARD","language":"English/Chinese interface","claims_supported":["An official standard already specifies a smart-contract formal-verification framework.","The framework integrates parsers, model builders, model checkers, smart contracts, and decentralized applications."]},{"source_id":"SRC3","title":"Securify: Practical Security Analysis of Smart Contracts","url":"https://files.sri.inf.ethz.ch/website/papers/ccs18-securify.pdf","publisher":"ETH Zurich / ACM CCS","date_or_year":"2018","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Securify uses sound over-approximating compliance and violation patterns.","It distinguishes proved compliance, proved violation, and an unresolved warning when neither sufficient pattern matches.","The tool supports contract-specific properties and was applied to more than 18,000 submitted contracts.","This is close prior art for one-sided conclusions with an explicit non-Boolean residual category."]},{"source_id":"SRC4","title":"Marlowe: Implementing and Analysing Financial Contracts on Blockchain","url":"https://www.iog.io/api/research/pdf/93VVH49W","publisher":"IOHK and University of Kent","date_or_year":"2020","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Marlowe is a restricted domain-specific language for financial contracts.","Its contracts can be exhaustively analyzed before deployment and failures can yield explicit examples.","The semantics has machine-checked money-preservation, positive-balance, timeout, and trace-bound properties.","Every contract has a finite transaction bound, enabling bounded symbolic exploration and guaranteed closing/refunds after a computable timeout."]},{"source_id":"SRC5","title":"Solvent: Liquidity Verification of Smart Contracts","url":"https://vadimmalvone.github.io/papers/IFM24.pdf","publisher":"Universities of Cagliari, Modena and Reggio Emilia, Genoa, and Télécom Paris / IFM","date_or_year":"2024","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Liquidity is also called solvency or enabledness and concerns guaranteed asset transfers from reachable states.","Solvent verifies user-defined liquidity properties using a restricted Solidity fragment, bounded model checking, predicate abstraction, and SMT solvers.","It can return replayable counterexamples and prove properties either generally or up to a transaction bound.","The supported fragment excludes unbounded loops and contract-to-contract calls, and the authors explicitly document resulting assumptions and scope limitations."]},{"source_id":"SRC6","title":"Formal Verification of Suilend","url":"https://www.certora.com/blog/fv-suilend","publisher":"Certora","date_or_year":"2026","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["A commercial verifier was used on an actual lending protocol to prove system-level solvency, account-health, and liquidation invariants over reachable states and call sequences.","The verification found rounding and collateral-check defects.","This establishes a concrete adopter class and direct prior art for formal solvency analysis, though not for computability-boundary routing."]},{"source_id":"SRC7","title":"101 Overview: Collateral","url":"https://www.cmegroup.com/articles/brochures-and-handbooks/101-overview-collateral.html","publisher":"CME Group","date_or_year":"2026","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["CME Clearing has an operational collateral-admission policy and performs initial acceptability analysis.","The Credit and Liquidity Committee, Clearing House Risk Committee, and Clearing House Oversight Committee are identifiable authorizers.","Eligibility, valuation, haircuts, concentration limits, operational considerations, ongoing review, and stressed conditions are already governed controls."]},{"source_id":"SRC8","title":"Formale Verifikation von Smart Contracts","url":"https://ethereum.org/de/developers/docs/smart-contracts/formal-verification/","publisher":"Ethereum.org","date_or_year":"2026 living documentation","source_type":"OFFICIAL_GUIDANCE","language":"German","claims_supported":["Formal verification is recommended for high-value smart contracts and can prove invariants across executions.","Finite-state model checking and infinite-state theorem proving have different scopes.","Automated provers cannot always determine whether a logical problem is decidable, and human assistance may be required.","Specification errors, state/path explosion, solver cost, nontermination, and false confidence remain practical hazards."]}],"problem_evidence":{"status":"PARTLY_SUPPORTED","finding":"The conditional technical problem exists: unrestricted smart-contract computation creates general termination and semantic-verification limits, while real financial contracts require solvency or liquidity properties across reachable states. However, no retained source shows an exchange or clearinghouse presently demanding an exact, total verdict for every arbitrary program-defined contract, or shows timeouts routinely being coerced into approval or rejection. Ethereum also bounds each execution with gas, so an unrestricted off-chain semantic class must not be inferred merely from on-chain execution.","source_ids":["SRC1","SRC4","SRC5","SRC6","SRC8"],"uncertainty":"The decisive production facts—admitted language, data bounds, oracle model, horizon, analyzer interface, and treatment of inconclusive results—were not publicly documented for a specific market operator."},"adopter_evidence":{"status":"SUPPORTED","finding":"Concrete adopters and authorizers are identifiable. Protocol developers and auditors already use formal solvency verification, while CME Clearing names committees that own collateral eligibility and risk policy. These actors could authorize a sandboxed admission-analysis pilot, although the evidence does not show that CME currently admits arbitrary programmable contracts.","source_ids":["SRC6","SRC7"],"uncertainty":"A specific operator willing to sponsor the proposed pilot is not established; CME demonstrates an analogous governance locus rather than adoption of the proposed analyzer."},"implementation_evidence":{"status":"PARTLY_SUPPORTED","finding":"Nearly all load-bearing mechanisms have public implementations or precedents: bounded execution, restricted financial DSLs, exhaustive finite analysis, sound over-approximation, compliance/violation/warning outputs, bounded model checking, predicate abstraction, counterexample traces, solvency invariants, and formal-verification standards. The retained evidence does not establish the complete institutional package of checked undecidability reduction, mechanically enforced eligibility promises, guarantee-versioned routing, independent proof review, and pre-listing decision records.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6"],"uncertainty":"Integration cost, proof validity for the exact collateral-breach encoding, oracle semantics, usable coverage, and operator workflow effects remain unmeasured."},"prior_art":{"disposition":"ADJACENT_PRIOR_ART","closest_analogues":[{"name":"Securify ternary smart-contract security analysis","source_ids":["SRC3"],"same_problem":false,"same_causal_lever":true,"overlap":"Uses sound over-approximation and distinguishes proved compliance, proved violation, and unresolved warning instead of forcing a Boolean answer.","remaining_difference":"It targets security patterns generally, not an operator's collateral-breach admission property, computability reduction, fragment router, or governance record."},{"name":"Marlowe restricted financial-contract language and exhaustive pre-deployment analysis","source_ids":["SRC4"],"same_problem":true,"same_causal_lever":true,"overlap":"Restricts financial contracts to a finite analyzable language, proves money and timeout properties, bounds traces, exhaustively checks contracts before deployment, and returns failure examples.","remaining_difference":"It avoids the unrestricted class by language design and does not route arbitrary admitted contracts among exact, one-sided, bounded, and UNKNOWN modes."},{"name":"Solvent liquidity/solvency verification","source_ids":["SRC5"],"same_problem":true,"same_causal_lever":true,"overlap":"Checks solvency-like asset-transfer properties with an explicit language fragment, bounded model checking, abstraction, proofs, assumptions, and counterexample traces.","remaining_difference":"It is a research verifier rather than a pre-listing institutional router; it does not provide the proposed class-wide impossibility certificate, guarantee-version record, or admission-policy evaluation."},{"name":"Certora verification of Suilend solvency","source_ids":["SRC6"],"same_problem":true,"same_causal_lever":false,"overlap":"Demonstrates real protocol-level solvency invariants checked over reachable states and sequences, with financially meaningful defects found.","remaining_difference":"It verifies a specified protocol rather than mapping a universal computability boundary or routing unsupported contracts to explicit UNKNOWN."}],"contrastive_claim_remaining":"For a named market operator and production-representative contract mix, mechanically enforcing an eligibility-and-guarantee router that returns exact, sound one-sided, bounded, or UNKNOWN results will reduce unsupported categorical admission decisions relative to the legacy workflow while meeting predefined coverage, latency, and review thresholds. This is an operational integration claim, not a new computability or verification technique.","contrastive_claim_falsifier":"The claim is falsified if the production representation audit proves every admissible contract is already in one finite decidable class; the legacy workflow already preserves equivalent guarantee distinctions; routed labels do not reduce predefined categorical errors; certificates fail independent checking; promises cannot be enforced; or UNKNOWN/rejection rates exceed the preset usability threshold.","confidence":"MODERATE","search_limitations":"The bounded search retained exactly eight opened sources and covered theory, research tools, a standard, first-party practice, historical terminology, German terminology, and component combinations. The ITU page exposed limited text through its dynamic publication interface. No nonpublic operator procedures, analyzer logs, procurement records, patents, or exhaustive product and literature corpora were examined. Sources cannot establish routine coercion of timeout to a Boolean verdict or whether a particular production language is computationally unrestricted."},"researchability_gates":{"externally_supported_problem":{"status":"PASS","rationale":"Public theory, tools, and financial-contract studies support the conditional boundary problem and the practical importance of solvency/liquidity verification. The hypothesized operator-interface failure remains to be measured rather than assumed.","source_ids":["SRC1","SRC3","SRC4","SRC5","SRC6","SRC8"]},"identifiable_adopter_or_authorizer":{"status":"PASS","rationale":"Protocol teams and formal-verification auditors are identifiable adopters, and CME names specific committees responsible for collateral acceptance and risk oversight.","source_ids":["SRC6","SRC7"]},"distinct_testable_incremental_claim":{"status":"PASS","rationale":"Despite close technical prior art, a distinct falsifiable claim remains about an institutionally enforced guarantee router reducing unsupported categorical admission decisions at acceptable coverage and latency.","source_ids":["SRC3","SRC4","SRC5","SRC6","SRC7"]},"bounded_next_evidence_step":{"status":"PASS","rationale":"A sandboxed representation audit and fixed synthetic corpus can compare legacy decisions with routed exact, one-sided, bounded, and UNKNOWN outputs; proof checking, trace replay, categorical-error rates, latency, and coverage are finite measurable endpoints.","source_ids":["SRC3","SRC4","SRC5","SRC6"]},"no_unresolved_safety_or_authority_stop":{"status":"PASS","rationale":"The proposed first step is non-live and reversible, and a clearing risk-policy authority is identifiable. Safety can be bounded by prohibiting live admission changes, UNKNOWN-to-safe coercion, and production-fund access, while halting on a failed safe certificate or scope-enforcement failure.","source_ids":["SRC5","SRC6","SRC7","SRC8"]},"adequate_search_evidence":{"status":"PASS","rationale":"All six required lanes were searched adversarially. The eight retained and opened sources span seven publisher groupings and include an official standard, primary research, official/first-party platform documentation, an actual solvency-verification case, and clearinghouse governance evidence.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"]}},"strict_success":true,"screen_survival":true,"remaining_research_value":"MODERATE","recommended_next_step":"Obtain one operator's actual admitted-language specification and anonymized analyzer decision taxonomy, then run the authorized 30-contract sandbox pilot. Pre-register: zero out-of-scope exact labels, zero unchecked safe certificates, categorical-error reduction versus legacy review, maximum latency, minimum decisive-coverage rate, maximum UNKNOWN rate, and independent replay/checking of every certificate or counterexample. First audit whether all production-admissible contracts are already finite-state or bounded; stop treating computability as the issue if that audit succeeds.","world_novelty_boundary":"This bounded public-web search supports only a contrastive claim against the retained sources. It cannot establish world novelty, patentability, freedom to operate, exhaustive absence of prior art, market size, adoption, or realized impact."}