{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp11_mechanism_context_external20_20260804","research_id":"eoa_inverse_innovation_exp11_external_scrutiny_20260804","cell_id":"layer_decay_and_expiration_management__systems_cybernetics","opaque_id":"layer_decay_and_expiration_management__systems_cybernetics__A","search_lanes":{"direct_problem":{"queries":["\"stale controller\" eligibility supervisory control policy superseded fallback","obsolete control logic remains active industrial control system","supervisory controller stale obsolete policy remains active fallback version registry"],"source_ids":["SRC1","SRC2","SRC3","SRC7"],"no_result_note":null},"closest_prior_art":{"queries":["controller policy registry version retire fallback dependency replay model governance","model registry expiration date model version retire archive rollback official documentation","multiple model adaptive control supervisory switching controller bank stability fallback"],"source_ids":["SRC4","SRC5","SRC6","SRC8"],"no_result_note":null},"historical_terminology":{"queries":["legacy control logic dead code obsolete interlock PLC configuration management","configuration item status accounting superseded software operational baseline archival","software retirement archival obsolete versions cessation operational use"],"source_ids":["SRC1","SRC4","SRC8"],"no_result_note":null},"products_practices_standards":{"queries":["IEC 62443-2-1 management of change backup restore asset owner","MLflow model registry archive version aliases rollback","Azure Machine Learning archive restore model version registry"],"source_ids":["SRC1","SRC2","SRC5","SRC6"],"no_result_note":null},"non_english_regional":{"queries":["systèmes industriels gestion configuration sauvegarde automate versions logiciel obsolescence","industrielle Steuerung Konfigurationsmanagement Sicherung Versionen veraltet SPS","sistemas control industrial gestión configuración copias seguridad versiones obsoletas PLC"],"source_ids":["SRC3"],"no_result_note":"French official guidance directly addressed active-versus-reference controller-program versions, configuration management, backups, and restoration. German and Spanish searches found adjacent PLC security and configuration guidance, but no additional source was retained within the fixed eight-source limit because none documented the complete proposed eligibility-and-preservation experiment."},"composition_subproblems":{"queries":["controller artifact registry supersession marker dependency check replay fallback quarantine rollback audit","model governance expiry revalidation regime drift archive restore champion challenger","PLC change management version control dependency impact analysis rollback validated backup"],"source_ids":["SRC1","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"],"no_result_note":null}},"sources":[{"source_id":"SRC1","title":"Guide to Operational Technology (OT) Security (NIST SP 800-82 Rev. 3)","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf","publisher":"National Institute of Standards and Technology","date_or_year":"2023","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["OT configuration management should initialize, change, monitor, and audit hardware and software configurations throughout the lifecycle.","Centralized change tracking, testing, and approval can detect or prevent deployment of unapproved or untested versions.","PLC logic and configuration backups should be inventoried, integrity-checked, geographically protected, and restoration-tested.","Configuration-management tools can affect active files and OT operation, supporting a non-live first test."]},{"source_id":"SRC2","title":"IEC 62443-2-1:2024 — Security for industrial automation and control systems, Part 2-1","url":"https://webstore.iec.ch/en/publication/62883","publisher":"International Electrotechnical Commission","date_or_year":"2024","source_type":"OFFICIAL_STANDARD","language":"English/French","claims_supported":["The standard assigns IACS security-program policies and procedures to the asset owner, explicitly including the operator.","It recognizes IACS lifetimes exceeding twenty years, unsupported legacy hardware and software, and unavailable backup software.","It permits compensating measures where legacy systems lack native technical capabilities, supporting an identifiable authorizer and cautious implementation boundary."]},{"source_id":"SRC3","title":"La cybersécurité des systèmes industriels — Mesures détaillées","url":"https://messervices.cyber.gouv.fr/guides/la-cybersecurite-des-systemes-industriels-mesures-detaillees","publisher":"Agence nationale de la sécurité des systèmes d'information (ANSSI)","date_or_year":"2025 revision of 2014 guidance","source_type":"OFFICIAL_GUIDANCE","language":"French","claims_supported":["Industrial systems act directly on physical processes and can endanger people, property, or the environment.","Configuration management should compare the version executing in equipment with an identified reference backup and analyze differences between successive versions before commissioning.","The guidance covers SCADA applications and PLC programs and recommends backup policies capable of reconstructing an installation after an incident.","It reports that restoration procedures are often insufficiently tested and that online PLC or SCADA modifications may lack authentication or logging."]},{"source_id":"SRC4","title":"SWE-196 — Software Retirement Archival","url":"https://swehb.nasa.gov/spaces/SWEHBVD/pages/102695531/SWE-196%2B-%2BSoftware%2BRetirement%2BArchival","publisher":"National Aeronautics and Space Administration","date_or_year":"NPR 7150.2D-era requirement; handbook current in 2026","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["NASA requires identification of records and software tools to archive, archive locations, and access procedures for software retirement or disposal.","The guidance treats obsolescence and incompatibility with current mission requirements as retirement triggers.","It calls for preservation of versions, dependencies, configuration records, histories, test artifacts, deployment logs, access controls, disposal records, inventories, independent assurance, and verification that retired software is no longer active.","Preservation serves future reexecution, analysis, accountability, legal duties, reuse, and continuity, establishing close component-level lifecycle prior art."]},{"source_id":"SRC5","title":"MLflow Model Registry","url":"https://www.mlflow.org/docs/2.4.2/model-registry.html","publisher":"MLflow Project, a Series of LF Projects","date_or_year":"2023 documentation for MLflow 2.4.2","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["The registry manages model lineage, identity, versions, lifecycle stages, descriptions, tags, and mutable aliases.","Versions can transition among staging, production, archived, and no-stage states; production workloads can resolve a Champion alias to a selected version.","A production version can be archived while its artifact remains registered, and irreversible deletion is separately warned against.","These capabilities closely match version chronology, eligibility-like status, archival, and reversible selection, but not dependency-preserving stale adjudication."]},{"source_id":"SRC6","title":"Register and work with models in Azure Machine Learning","url":"https://learn.microsoft.com/en-us/azure/machine-learning/how-to-manage-models?view=azureml-api-2","publisher":"Microsoft","date_or_year":"Updated 2026-01-27","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["Azure Machine Learning stores registered models as named, versioned assets and provides lifecycle-management operations.","Specific model versions or complete model containers can be archived.","Archiving hides a model from ordinary list queries while still permitting workflows to reference and use it; archived versions can be restored through the associated CLI.","This is close prior art for hot-versus-archived visibility and reversible restoration, but archival alone is not a controller-safety eligibility gate."]},{"source_id":"SRC7","title":"Hidden Technical Debt in Machine Learning Systems","url":"https://papers.nips.cc/paper/2015/hash/86df7dcfd896fcaf2674f757a2463eba-Abstract.html","publisher":"Advances in Neural Information Processing Systems","date_or_year":"2015","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Real ML systems incur maintenance risks from entanglement, undeclared consumers, data dependencies, configuration issues, and changes in the external world.","These mechanisms support the plausibility of regime mismatch and the danger of removing apparently obsolete artifacts without dependency evidence.","The paper does not measure stale controller eligibility or evaluate the proposed gate."]},{"source_id":"SRC8","title":"Multiple model adaptive control with safe switching","url":"https://liberzon.csl.illinois.edu/research/safemultiplefinal.pdf","publisher":"International Journal of Adaptive Control and Signal Processing / John Wiley & Sons","date_or_year":"2001","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Multiple-model adaptive control uses a supervisor to switch among a finite bank of controllers as evidence about the plant accumulates.","The paper evaluates controller candidates with monitoring or performance measures and seeks a controller appropriate to the current plant.","It shows that controller changes can be dangerous even when the preceding loop appears stable and develops safety conditions for switching.","This is strong prior art for performance-based supervisory selection and safety-gated switching, but not for registry-level retirement, archival, replay preservation, or stale-eligibility auditing."]}],"problem_evidence":{"status":"PARTLY_SUPPORTED","finding":"The sources establish the underlying mechanisms: wrong or unapproved OT versions can be active; controller programs require reference-version comparison, audit, backup, and tested restoration; models can become mismatched as the external world changes; and hidden dependencies make removal hazardous. They do not establish that superseded or regime-mismatched artifacts remain selection-eligible in the nominated controller family, nor do they measure the proposal's stale-eligibility rate. The local problem therefore remains a credible, explicitly falsifiable hypothesis rather than a demonstrated prevalence claim.","source_ids":["SRC1","SRC2","SRC3","SRC7","SRC8"],"uncertainty":"Public standards emphasize governance and hazards rather than operational prevalence. Proprietary controller registries, dependency graphs, selector traces, and incident records are rarely public, and terminology differs across OT configuration management, software retirement, MLOps, and adaptive control."},"adopter_evidence":{"status":"SUPPORTED","finding":"IEC explicitly identifies the IACS asset owner, including the operator, as responsible for security-program policies and procedures. NIST likewise assigns configuration decisions to OT owners and responsible personnel. NASA guidance shows analogous project-manager, technical, assurance, CIO, and records-management roles. An accountable control-system owner is therefore an identifiable adopter and authorizer, with safety, compliance, and incident-review personnel as required co-approvers for protected artifacts.","source_ids":["SRC1","SRC2","SRC3","SRC4"],"uncertainty":"A named organization and accountable individual cannot be identified until one controller family is nominated."},"implementation_evidence":{"status":"SUPPORTED","finding":"Most prerequisites are established and technically available: versioned registries, status or archive states, reference comparisons, inventories, histories, backup and restoration testing, access control, retirement records, and supervisory controller-bank evaluation. Freezing one registry and trace, adjudicating dependencies, and replaying identical recorded opportunities under a shadow rule is a bounded extension that does not require live plant changes.","source_ids":["SRC1","SRC3","SRC4","SRC5","SRC6","SRC8"],"uncertainty":"Feasibility depends on complete registry enrollment, sufficiently faithful and deterministic replay, reconstructable selector inputs, preserved rare-regime evidence, and reproducible reviewer judgments. Archived models remaining referenceable in some products also show that archive status cannot be assumed to enforce non-eligibility."},"prior_art":{"disposition":"ADJACENT_PRIOR_ART","closest_analogues":[{"name":"OT configuration management, reference-version comparison, backup, and recovery","source_ids":["SRC1","SRC2","SRC3"],"same_problem":true,"same_causal_lever":false,"overlap":"Controls and audits active configurations, compares active controller programs with reference versions, requires approval, and preserves tested recovery capability under an accountable asset owner.","remaining_difference":"The guidance does not define superseded or regime-mismatched selection eligibility, preservation-aware gating, or a matched-opportunity shadow estimate of stale eligibility."},{"name":"General software retirement with archival and verified cessation","source_ids":["SRC4"],"same_problem":true,"same_causal_lever":true,"overlap":"Uses explicit retirement status, inventories, preservation duties, dependency and history retention, role-based approval, assurance review, disposal records, and verification that retired software is no longer active.","remaining_difference":"It applies to software retirement broadly and does not gate individual supervisory-controller candidates by current regime or test the gate on recorded selection opportunities."},{"name":"MLflow and Azure model-registry lifecycle controls","source_ids":["SRC5","SRC6"],"same_problem":true,"same_causal_lever":true,"overlap":"Provides identities, versions, lineage, production or champion selection, archive states, reversible lifecycle transitions, and separation between archiving and irreversible deletion.","remaining_difference":"The products do not require independent supersession and regime-fit adjudication, sole-fallback and incident-replay dependency blockers, preservation holds, or the proposed prespecified shadow-replay outcome test. Azure also permits continued reference to archived artifacts, so archival alone does not guarantee ineligibility."},{"name":"Multiple-model adaptive control with safe switching","source_ids":["SRC8"],"same_problem":false,"same_causal_lever":false,"overlap":"A supervisor evaluates and switches among controller candidates while imposing conditions intended to prevent an unsafe plant-controller combination.","remaining_difference":"It is a runtime identification and stability-selection method, not a lifecycle process for superseding, quarantining, archiving, preserving, or auditing accumulated controller artifacts."},{"name":"ML-system technical-debt and dependency mechanisms","source_ids":["SRC7"],"same_problem":true,"same_causal_lever":false,"overlap":"Explains changing-world mismatch, configuration debt, undeclared consumers, and dependencies that make stale artifacts and unsafe removal plausible.","remaining_difference":"It diagnoses system-maintenance mechanisms rather than implementing or testing controller-eligibility retirement."}],"contrastive_claim_remaining":"For one completely enrolled non-safety-critical controller family, independent supersession and regime-fit adjudication combined with a sole-fallback-and-replay dependency blocker will reduce the trace-defined stale-eligibility rate by at least 50% on identical recorded selection opportunities, with zero dependency loss and no unresolved reviewer disagreement. The incremental claim is the combined preservation-aware eligibility gate and matched-opportunity test, not the novelty of registries, versioning, controller banks, archival, retirement, backup, or restoration.","contrastive_claim_falsifier":"The complete frozen baseline has zero stale-eligible opportunities; reviewers cannot reproducibly classify stale status or dependencies; shadow gating produces less than a 50% relative reduction; any exclusion removes the sole validated fallback or required replay evidence; or replay cannot reconstruct the original selection opportunities faithfully enough for comparison.","confidence":"MODERATE","search_limitations":"The bounded search used six adversarial lanes and exactly eight retained direct sources. It cannot reveal proprietary controller registries or internal operating procedures and cannot establish world novelty, patentability, freedom to operate, routine prevalence, market size, or realized impact. Public IEC material exposed only the official abstract and product documentation can change over time."},"researchability_gates":{"externally_supported_problem":{"status":"PASS","rationale":"Independent official and primary sources establish active-version mismatch, lifecycle, changing-regime, hidden-dependency, unsafe-removal, and unsafe-switching mechanisms. The proposal appropriately treats prevalence in the nominated family as a falsifiable audit question with baseline zero as a decisive local falsifier.","source_ids":["SRC1","SRC3","SRC7","SRC8"]},"identifiable_adopter_or_authorizer":{"status":"PASS","rationale":"The IACS or OT asset owner, explicitly including the operator, is an identifiable authorizer; protected artifacts additionally implicate safety, compliance, assurance, and records-management roles.","source_ids":["SRC1","SRC2","SRC3","SRC4"]},"distinct_testable_incremental_claim":{"status":"PASS","rationale":"Although lifecycle management and safe controller selection are established separately, the dependency-preserving stale-eligibility gate tested on identical opportunities with numerical reduction and zero-loss criteria remains distinct and falsifiable.","source_ids":["SRC3","SRC4","SRC5","SRC6","SRC8"]},"bounded_next_evidence_step":{"status":"PASS","rationale":"One non-safety-critical family, its complete registry, a frozen 30-day trace, dual-review adjudication, and offline shadow replay define a finite next step with explicit denominators, thresholds, and stop conditions.","source_ids":["SRC1","SRC3","SRC4","SRC5","SRC6"]},"no_unresolved_safety_or_authority_stop":{"status":"PASS","rationale":"No live eligibility change or deletion is authorized. Sole-fallback loss, replay-evidence loss, preservation conflicts, unresolved dependencies, and reviewer disagreement all halt the simulation. This is consistent with OT caution, tested restoration, formal retirement authority, and safe-switching research.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC8"]},"adequate_search_evidence":{"status":"PASS","rationale":"All six required lanes were searched, including direct phrases and synonyms, historical configuration and retirement terminology, current standards and products, French/German/Spanish regional terminology, and combinations of registry, dependency, fallback, replay, archival, restoration, and regime-fit subproblems. The eight retained sources span eight publication contexts and include four official sources, two first-party products, and two primary research papers.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"]}},"strict_success":true,"screen_survival":true,"remaining_research_value":"MODERATE","recommended_next_step":"Obtain written authorization for one non-safety-critical controller family; freeze every registry version and the prespecified 30-day trace; preregister the artifact ontology, stale and dependency rubric, reviewer-agreement procedure, replay-fidelity checks, metrics, and exclusion blockers; then conduct independent adjudication and identical-event shadow replay. Report a zero baseline as problem falsification and make no live eligibility change without a separate safety and change-control authorization.","world_novelty_boundary":"The search supports only a bounded contrast: no retained source documented the exact combination of lifecycle adjudication, sole-fallback and replay preservation, and matched-event shadow eligibility testing, while nearly all constituent practices have established precedents. This is not evidence of world novelty, patentability, freedom to operate, market size, or impact."}