{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp11_mechanism_context_external20_20260804","research_id":"eoa_inverse_innovation_exp11_external_scrutiny_20260804","cell_id":"computability_boundary_mapping__engineering_design","opaque_id":"computability_boundary_mapping__engineering_design__B","search_lanes":{"direct_problem":{"queries":["undecidability verification infinite state systems safety properties controller reachability halting problem","model checker result unknown timeout false safe verification tool specification","finite-state model checking decidable exhaustive verification safety controllers","formal methods certification DO-333 tool qualification verification limitations assumptions"],"source_ids":["SRC1","SRC2","SRC5","SRC6"],"no_result_note":null},"closest_prior_art":{"queries":["\"decidable fragment\" model checking \"unknown\" verification","\"language restriction\" \"UNKNOWN\" formal verification model checker","Conditional Model Checking condition unknown partial verification","verification witness validation unknown timeout official rules"],"source_ids":["SRC2","SRC3","SRC4","SRC5","SRC6","SRC7"],"no_result_note":null},"historical_terminology":{"queries":["\"What's Decidable About Hybrid Automata\"","software model checking safe unsafe fail conditional model checking","bounded model checking unwinding assertion verification coverage"],"source_ids":["SRC1","SRC2","SRC4","SRC5"],"no_result_note":null},"products_practices_standards":{"queries":["CBMC documentation unwinding assertions bounded proof","Microsoft Ivy decidability fragment official documentation","UPPAAL verification unknown maybe satisfied","FAA DO-333 formal methods software approval guidance"],"source_ids":["SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"],"no_result_note":null},"non_english_regional":{"queries":["Unentscheidbarkeit Verifikation Steuerungssysteme Erreichbarkeit Modellprüfung","vérification formelle indécidable automate contrôleur état fini résultat inconnu","Verifikationssystem Ablaufsteuerungen Petri-Netze Deutschland"],"source_ids":[],"no_result_note":"German and French searches surfaced translated terminology and older regional controller-verification literature, but no additional source was retained because it was less direct than the primary and official evidence in the eight-source set; the absence of a retained regional source is not treated as novelty evidence."},"composition_subproblems":{"queries":["decidable fragment explicit unknown bounded model checking proof certificate","formal verification sound abstraction assumptions tool qualification independent checker","finite-state admission grammar verifier routing exact bounded unknown","conditional model checking different tools conditions verification coverage"],"source_ids":["SRC2","SRC3","SRC4","SRC5","SRC6","SRC7"],"no_result_note":null}},"sources":[{"source_id":"SRC1","title":"What's Decidable About Hybrid Automata","url":"https://www2.eecs.berkeley.edu/Pubs/TechRpts/1998/3418.html","publisher":"EECS Department, University of California, Berkeley","date_or_year":"1998","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Hybrid automata model embedded control programs with digital and analog behavior.","Reachability verification has a boundary between decidable restricted classes and undecidable more-general classes.","The literature predates the proposal and directly studies restrictions that recover terminating reachability analysis."]},{"source_id":"SRC2","title":"Conditional Model Checking","url":"https://arxiv.org/abs/1109.6926","publisher":"University of Passau / IST Austria / Simon Fraser University","date_or_year":"2011 technical report; published 2012","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Software model checking is undecidable in general and ordinarily has safe, unsafe, or failure outcomes.","Timeout, memory exhaustion, and components giving up can be converted into an explicit condition describing verified coverage.","Unverified regions can be routed to another method or tool, closely anticipating honest partial-result routing and rechecking."]},{"source_id":"SRC3","title":"Decidability","url":"https://microsoft.github.io/ivy/decidability.html","publisher":"Microsoft Research Ivy project","date_or_year":"Undated; accessed 2026","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["Ivy defines a syntactic subset of first-order formulas as a decidable fragment.","Within the fragment, its underlying solver can determine satisfiability given sufficient resources; outside it, small formulas may diverge and reliable countermodels are not assured.","This is direct first-party precedent for restricting an accepted language to obtain predictable verification behavior."]},{"source_id":"SRC4","title":"CBMC: Background Concepts","url":"https://diffblue.github.io/cbmc/background-concepts.html","publisher":"CPROVER / Diffblue","date_or_year":"2026","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["CBMC implements bounded model checking and reports reachability only within a declared execution bound.","Bounded analysis can miss executions beyond the bound, so successful results must be interpreted with the bounds used.","Loop unwinding assertions expose whether the selected bound covers the modeled executions, providing precedent for mechanically checked coverage fences."]},{"source_id":"SRC5","title":"SV-COMP 2013: Definitions and Rules","url":"https://sv-comp.sosy-lab.org/2013/rules.php","publisher":"Competition on Software Verification / TACAS","date_or_year":"2013","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["Verification results are explicitly separated into TRUE, FALSE with an error-path witness, and UNKNOWN.","Timeout, out-of-memory, crashes, and inability to decide are interpreted as UNKNOWN rather than SAFE.","Wrong SAFE answers are penalized more heavily than UNKNOWN, operationalizing the safety importance of honest inconclusive outcomes."]},{"source_id":"SRC6","title":"Verifying Requirements","url":"https://docs.uppaal.org/gui-reference/verifier/verifying/","publisher":"UPPAAL","date_or_year":"Undated; accessed 2026","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["A deployed verifier for timed-system requirements distinguishes satisfied, not satisfied, and unknown results.","Approximate analyses may report that a property is only maybe satisfied when its truth cannot be determined.","This is controller-adjacent product precedent for exposing approximation and uncertainty instead of forcing a binary verdict."]},{"source_id":"SRC7","title":"Formal Assurance Certifiable Tooling Strategy Final Report","url":"https://ntrs.nasa.gov/api/citations/20170002595/downloads/20170002595.pdf","publisher":"NASA Langley Research Center","date_or_year":"2017","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["Formal-method tool qualification must address theoretical soundness, practical tool behavior, and risk mitigation.","The report considers input, output, execution, and proof-checking approaches, including independently developed tools checking common artifacts.","Certification use creates identifiable applicant, tool-qualification, safety-assurance, and approval roles rather than leaving verifier guarantees solely to tool developers."]},{"source_id":"SRC8","title":"Software & Airborne Electronic Hardware","url":"https://www.faa.gov/aircraft/air_cert/design_approvals/air_software/software_regs","publisher":"Federal Aviation Administration","date_or_year":"Updated 2024","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["FAA guidance identifies AC 20-115D for airborne software assurance and formal software-approval guidance.","The regulatory setting identifies certification applicants and FAA approval personnel as concrete authorizer classes for safety-assurance evidence.","Formal verification results do not themselves displace the applicable approval and certification authority."]}],"problem_evidence":{"status":"PARTLY_SUPPORTED","finding":"The general problem is real: controller-relevant hybrid reachability crosses decidability boundaries, software model checking can fail or exhaust resources, bounded analysis can be overread, and mature tools explicitly preserve UNKNOWN or conditional outcomes. Public evidence does not establish that a particular unnamed engineering organization currently promises the hypothesized universal verifier or collapses its timeouts into PASS or FAIL.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6"],"uncertainty":"The computability risk is well supported, but the prevalence and operational severity of the stated organizational behavior are not quantified, and a specific production input language might already be finite-state."},"adopter_evidence":{"status":"PARTLY_SUPPORTED","finding":"Role-level adopters and authorizers are identifiable: verification-tool owners, engineering safety authorities, certification applicants, and aviation approval personnel. NASA and FAA material confirms formal-method qualification and software-approval roles. No named organization, accountable individual, procurement owner, or controller program is supplied.","source_ids":["SRC7","SRC8"],"uncertainty":"A role-level authorizer is evident, but adoption willingness, budget, and authority for the hypothetical organization remain unverified."},"implementation_evidence":{"status":"PARTLY_SUPPORTED","finding":"Every load-bearing technical element has practical precedent: decidable model fragments, bounded model checking with checked bounds, explicit UNKNOWN or approximate outcomes, conditional coverage records, multi-tool continuation, and independent result or proof checking. The exact controller-oriented router, enforced admission grammar, versioned guarantee record, and recheck-trigger package was not found as one evaluated deployment.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7"],"uncertainty":"Component feasibility is strong, but integration cost, fragment usefulness, abstraction soundness, UNKNOWN volume, and effects on real certification decisions remain untested."},"prior_art":{"disposition":"ADJACENT_PRIOR_ART","closest_analogues":[{"name":"Decidability boundary for hybrid-automaton reachability","source_ids":["SRC1"],"same_problem":true,"same_causal_lever":true,"overlap":"Directly maps controller-like hybrid models into decidable and undecidable reachability classes and supplies algorithms for restricted classes.","remaining_difference":"It is a theoretical classification, not an organizational admission contract and guarantee-labelled routing workflow."},{"name":"Conditional Model Checking","source_ids":["SRC2"],"same_problem":false,"same_causal_lever":true,"overlap":"Replaces uninformative verifier failure with explicit verified conditions, supports resource bounds, routes uncovered regions to other methods, and supports re-verification.","remaining_difference":"It targets software state-space coverage and does not combine a controller-specific impossibility certificate, mechanically enforced finite-state grammar, safety authority approval, and shipped guarantee record."},{"name":"Ivy decidable-fragment enforcement","source_ids":["SRC3"],"same_problem":false,"same_causal_lever":true,"overlap":"Uses syntactic formula restrictions to obtain a decidable region and warns that solvers may diverge outside it.","remaining_difference":"It concerns verification-condition logic rather than end-to-end controller and property admission plus fallback routing."},{"name":"CBMC bounded verification with unwinding checks","source_ids":["SRC4"],"same_problem":false,"same_causal_lever":true,"overlap":"Provides bounded counterexample search, explicit execution fences, and mechanical checks that expose insufficient unwinding.","remaining_difference":"It does not itself establish the proposed unrestricted-controller reduction or route all out-of-fragment cases among exact, sound, bounded, and escalated modes."},{"name":"SV-COMP and UPPAAL result protocols","source_ids":["SRC5","SRC6"],"same_problem":false,"same_causal_lever":true,"overlap":"Operational tools and evaluation rules preserve UNKNOWN, timeout, witnesses, and approximation-qualified outcomes rather than forcing binary safety answers.","remaining_difference":"They are tool or benchmark protocols, not an accountable engineering-organization boundary decision for certification use."},{"name":"Formal-method tool qualification and approval practice","source_ids":["SRC7","SRC8"],"same_problem":true,"same_causal_lever":false,"overlap":"Requires attention to soundness, qualification, checking, risk mitigation, certification evidence, and approval authority.","remaining_difference":"It governs assurance evidence but does not itself prescribe the proposed decidability proof, admission grammar, or four-mode router."}],"contrastive_claim_remaining":"In a controller-design organization whose current workflow treats timeouts inconsistently, mechanically enforcing a controller-and-property fragment and routing every submission to exact, sound-approximate, bounded-witness, or explicit-UNKNOWN modes—with versioned guarantees and independent review—will reduce ambiguous or overstated verdicts without any false SAFE result on a predefined archived corpus. This is a contextual integration-and-governance claim, not a new computability or model-checking theorem.","contrastive_claim_falsifier":"The claim is falsified if a documented deployed workflow already implements the same end-to-end admission, routing, guarantee-record, and review package for the target context, or if the bounded pilot produces any false SAFE, permits admission-boundary bypass, overstates a bound, or fails to reduce ambiguous verdicts relative to baseline.","confidence":"HIGH","search_limitations":"The bounded search covered six adversarial lanes and eight opened sources but did not exhaust patents, proprietary certification workflows, non-indexed industrial procedures, paywalled standards, or every language and region. Component-level collisions are strong; absence of an identical public package cannot establish novelty."},"researchability_gates":{"externally_supported_problem":{"status":"PASS","rationale":"Primary research and deployed tools establish undecidability boundaries, failure or timeout outcomes, bounded-coverage risks, and the need for explicit uncertainty. The specific unnamed organization's conduct remains hypothetical, but the underlying research problem is externally supported.","source_ids":["SRC1","SRC2","SRC4","SRC5","SRC6"]},"identifiable_adopter_or_authorizer":{"status":"INDETERMINATE","rationale":"Safety-authority, certification-applicant, tool-owner, and FAA approval roles are identifiable, but no actual organization, accountable person, controller program, or committed adopter is named.","source_ids":["SRC7","SRC8"]},"distinct_testable_incremental_claim":{"status":"PASS","rationale":"Prior art leaves a narrow, falsifiable contextual claim about the integrated controller-specific admission and routing workflow reducing ambiguous or overstated verdicts with zero false SAFE outcomes; it does not leave a credible claim to inventing decidable fragments, UNKNOWN, bounded checking, or proof validation.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7"]},"bounded_next_evidence_step":{"status":"PASS","rationale":"The proposed comparison on 20 finite-state and 20 unrestricted archived non-production cases is finite, measurable, and can use exhaustive bounded ground truth, boundary-bypass tests, label audits, and independent review.","source_ids":["SRC4","SRC5","SRC7"]},"no_unresolved_safety_or_authority_stop":{"status":"PASS","rationale":"The first step is non-production and excludes automatic certification approval and treating UNKNOWN as SAFE. Existing guidance supports independent checking and preserves formal approval authority. The defined halt conditions address false SAFE and scope bypass.","source_ids":["SRC5","SRC7","SRC8"]},"adequate_search_evidence":{"status":"PASS","rationale":"All six required lanes were searched adversarially. The eight retained sources span primary research, first-party tools, official competition practice, NASA guidance, and FAA guidance from multiple independent publishers, with direct support for both the computability boundary and operational fallback mechanisms.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"]}},"strict_success":false,"screen_survival":true,"remaining_research_value":"MODERATE","recommended_next_step":"Identify one accountable engineering safety authority and run the authorized blinded 40-model archived pilot. Pre-register fragment grammar, expected ground truth, exact/sound/bounded/UNKNOWN labels, timeout handling, boundary-bypass tests, independent certificate review, and primary endpoints: false-SAFE count, overstated-label count, ambiguous-verdict rate, UNKNOWN rate, review time, and requirements displaced outside the fragment.","world_novelty_boundary":"This bounded public search supports only a contextual incremental workflow claim. It cannot establish world novelty, patentability, freedom to operate, market size, routine adoption across industry, or realized safety impact; proprietary workflows, patents, paywalled standards, and unindexed regional practices remain outside the evidence boundary."}