{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp11_mechanism_context_external20_20260804","research_id":"eoa_inverse_innovation_exp11_external_scrutiny_20260804","cell_id":"layer_decay_and_expiration_management__systems_cybernetics","opaque_id":"layer_decay_and_expiration_management__systems_cybernetics__A","search_lanes":{"direct_problem":{"queries":["industrial control system obsolete controller logic versions remain active configuration management superseded","supervisory control policy lifecycle stale model registry eligibility fallback replay","control system configuration drift stale logic version incident controller","PLC incorrect software version incident report controller configuration"],"source_ids":["S1","S2","S4","S8"],"no_result_note":null},"closest_prior_art":{"queries":["supervisory control policy lifecycle stale model registry eligibility fallback replay","MLOps model registry archive stage deprecated model lifecycle official documentation","supervisory control switching multiple controllers hysteresis dwell time obsolete controller historical paper","run-time assurance architecture backup controller switching validation official standard"],"source_ids":["S3","S4","S6","S7"],"no_result_note":null},"historical_terminology":{"queries":["supervisory control switching multiple controllers hysteresis dwell time obsolete controller historical paper","Dwell-time switching Cao Morse PDF","NIST software configuration management obsolete versions rollback audit records dependencies","NASA controller software configuration status accounting obsolete versions rollback validation"],"source_ids":["S5","S6"],"no_result_note":null},"products_practices_standards":{"queries":["IEC 62443 change management controller software backup obsolete versions control systems","NIST SP 800-82 configuration management backups rollback industrial control systems","controller configuration version control rollback PLC official product","vendor-agnostic PLC SCADA HMI backup version control recovery"],"source_ids":["S1","S2","S3","S4","S5"],"no_result_note":null},"non_english_regional":{"queries":["SPS Programm Versionsverwaltung alte Version freigegeben Archivierung Wiederherstellung Steuerung","旧 PLC プログラム バージョン 管理 バックアップ 復元 制御","automatisme industriel gestion versions programmes automate sauvegarde restauration obsolète","site:novotek.com/ch/fr gestion des versions automate"],"source_ids":["S8"],"no_result_note":null},"composition_subproblems":{"queries":["official guidance decommission software component dependency analysis rollback archive audit log","policy retirement controller model registry fallback controller","run-time assurance architecture backup controller switching validation official standard","model registry archive production alias rollback controller dependency preservation"],"source_ids":["S3","S4","S5","S7"],"no_result_note":null}},"sources":[{"source_id":"S1","title":"SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final","publisher":"National Institute of Standards and Technology","date_or_year":"2023","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["OT includes programmable systems that directly affect physical processes, including PLC, DCS, and SCADA systems.","OT security and configuration practices must account for distinctive reliability, performance, and safety requirements.","Industrial control-system owners and operators are a recognizable implementation population."]},{"source_id":"S2","title":"PLC_R_APPLICATION_ERROR: Detected Application Error Status Codes","url":"https://product-help.se.com/docs/Machine%20Expert/V2.0/en/m262sys/m262sys/D-SE-0003360.html","publisher":"Schneider Electric","date_or_year":"2022","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["A commercial controller reports application-version mismatch when its application differs from the engineering environment.","The controller also detects incorrect I/O and task configuration, unresolved external references, and applications intended for a different controller target.","Version and regime or target compatibility are therefore operational properties, not safely inferable from artifact age alone."]},{"source_id":"S3","title":"Model Registry Workflows","url":"https://www.mlflow.org/docs/latest/ml/model-registry/workflow/","publisher":"MLflow","date_or_year":"2026 documentation","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["A deployed-model registry provides versioned lifecycle states, production references, archival, and later deletion.","Aliases can determine which model version serves traffic and can be reassigned to a newer version.","Validation tags, access-controlled environments, lineage-preserving promotion, and staged testing are established model-governance mechanisms.","Fixed model stages were deprecated as too inflexible, indicating that richer lifecycle context is sometimes required."]},{"source_id":"S4","title":"Vendor-agnostic PLC, SCADA & HMI Backup, Version Control and Recovery","url":"https://octoplant.com/solutions/plc-scada-hmi-backup-version-control-recovery/","publisher":"Octoplant","date_or_year":"2026 documentation","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["An industrial product maintains centralized histories for PLC, SCADA, HMI, DCS, robot, and drive programs and configurations.","It compares live, current, prior, and server versions and records who changed what and when.","It supports restoration of current or historical versions and claims validated backups ready for recovery.","It detects deviations and preserves old states for recovery and audit rather than indiscriminately deleting them."]},{"source_id":"S5","title":"6.5 Configuration Management","url":"https://www.nasa.gov/reference/6-5-configuration-management/","publisher":"National Aeronautics and Space Administration","date_or_year":"2023 web edition","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["Configuration management is applied throughout a product lifecycle to distinguish versions and prevent incorrect, ineffective, or unsafe releases.","Configuration status accounting includes unique identities, complete current and historical records, deviations, waivers, discrepancy dispositions, and audit results.","NASA guidance calls for version comparison, lifecycle workflow, verification, authorization, and an authoritative released-information source.","Changes affecting safety, compatibility, operators, or maintainers require elevated evaluation and approval."]},{"source_id":"S6","title":"Dwell-time switching","url":"https://www.rug.nl/staff/m.cao/2010_switching.pdf","publisher":"Systems & Control Letters / University of Groningen","date_or_year":"2010","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Supervisory and adaptive control has long used monitors and switching logic to choose among a family of candidate controllers under model uncertainty.","Candidate-controller selection can be governed by estimated current process fit rather than artifact lifecycle status.","The paper supplies a close historical rival based on performance and dwell-time switching, but does not provide supersession, archival, replay, or dependency-aware retirement."]},{"source_id":"S7","title":"Run Time Assurance for Safety-Critical Systems: An Introduction to Safety Filtering Approaches for Complex Control Systems","url":"https://arxiv.org/abs/2110.03506","publisher":"arXiv; authors affiliated with Air Force Research Laboratory, Georgia Institute of Technology, and University of California","date_or_year":"2021","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Runtime-assurance architectures monitor a primary controller and substitute or modify its output when necessary.","A validated backup controller is a central architectural element, supporting the proposal's warning that retirement can remove an essential fallback.","Fallback preservation and controller-eligibility management are related but distinct: runtime assurance governs live safety filtering, not artifact lifecycle adjudication."]},{"source_id":"S8","title":"Gestion des versions et sauvegardes automatiques","url":"https://www.novotek.com/ch/fr/gestion-des-versions/","publisher":"Novotek Switzerland","date_or_year":"2026","source_type":"TRADE_PROFESSIONAL","language":"French","claims_supported":["The regional industrial-automation source describes uncertainty about the current PLC or system-configuration version as a frequent operational situation.","It reports that unnoticed adaptations and undocumented updates can materially affect operating systems.","The described practice centrally identifies and timestamps versions, automatically retains the preceding version, compares versions after faults, and supports restoration.","The practice is aimed at identifiable industrial operators, including regulated food, pharmaceutical, water, wastewater, and energy organizations."]}],"problem_evidence":{"status":"PARTLY_SUPPORTED","finding":"Public evidence supports the underlying configuration-integrity problem: controller application, target, and configuration mismatches are recognized product states, while industrial sources report frequent uncertainty over current PLC versions and unnoticed or undocumented changes. Standards and products consequently maintain authoritative inventories, histories, comparisons, and recoverable prior states. No retained source directly measures the proposal's narrower event-level condition—superseded or regime-mismatched artifacts remaining eligible or appearing authoritative within one supervisory selector—so its prevalence remains unestablished.","source_ids":["S1","S2","S4","S5","S8"],"uncertainty":"Vendor and trade sources establish capability and reported operational need rather than prevalence. The evidence does not distinguish stale eligibility from a wrong deployed version, undocumented drift, sensor faults, objective errors, or poor performance of the current controller."},"adopter_evidence":{"status":"SUPPORTED","finding":"An identifiable adopter and authorizer exist: the owner or operator responsible for a PLC, DCS, SCADA, or model-serving registry can conduct the audit, while configuration-control management and affected safety or compliance authorities can authorize dispositions. Product documentation explicitly targets industrial production organizations, and NASA guidance assigns baseline changes and major compatibility or safety impacts to formal management processes.","source_ids":["S1","S4","S5","S8"],"uncertainty":"Job titles and approval chains vary by plant and sector; the accountable owner must still be named for the nominated family."},"implementation_evidence":{"status":"PARTLY_SUPPORTED","finding":"Most components are independently implemented: industrial products inventory and compare controller artifacts, record histories, detect deviations, retain historical versions, and restore selected states; model registries gate deployment references through lifecycle states, aliases, validation tags, and permissions; configuration-management guidance supplies authorization and audit; supervisory-control research supplies candidate-selection monitoring; runtime assurance demonstrates preservation of backup-controller capability. No retained source implements the complete package of lifecycle adjudication, dependency and replay holds, shadow exclusion, and identical-opportunity replay for supervisory controller artifacts.","source_ids":["S2","S3","S4","S5","S6","S7","S8"],"uncertainty":"Cross-system integration, reproducibility of stale labels, dependency completeness, and fidelity of recorded-event replay remain empirical questions."},"prior_art":{"disposition":"ADJACENT_PRIOR_ART","closest_analogues":[{"name":"MLflow Model Registry lifecycle states and deployment aliases","source_ids":["S3"],"same_problem":true,"same_causal_lever":true,"overlap":"Versions are registered, validated, promoted, referenced for serving, archived, and optionally deleted; aliases directly control which version receives production use.","remaining_difference":"It does not establish controller-regime mismatch, sole validated fallback, incident-replay dependency, preservation holds, or a shadow-replay outcome test."},{"name":"Octoplant industrial controller versioning, comparison, backup, and recovery","source_ids":["S4","S8"],"same_problem":true,"same_causal_lever":false,"overlap":"It inventories PLC and supervisory-system versions, detects undocumented deviations, preserves historical artifacts, supports audit, and restores selected validated states.","remaining_difference":"It manages configuration integrity and recoverability but does not gate a selector's eligible candidate set according to supersession and regime fit."},{"name":"NASA lifecycle configuration management and status accounting","source_ids":["S5"],"same_problem":true,"same_causal_lever":true,"overlap":"It provides unique identity, current and historical status, discrepancies, waivers, lifecycle workflows, authorization, verification, audit, and an authoritative release source.","remaining_difference":"It is general configuration governance, not an event-level eligibility gate for multiple supervisory controllers or a quantified replay experiment."},{"name":"Multiple-model dwell-time supervisory switching","source_ids":["S6"],"same_problem":true,"same_causal_lever":false,"overlap":"A monitor selects among multiple candidate controllers according to estimated process fit under uncertainty, closely matching the nearest-rival selection architecture.","remaining_difference":"Candidate membership is taken as given; the method does not retire, quarantine, archive, or preserve candidates according to lifecycle and dependency evidence."},{"name":"Runtime assurance with a backup controller","source_ids":["S7"],"same_problem":false,"same_causal_lever":false,"overlap":"It makes explicit that a backup controller can be indispensable and that monitored conditions should govern transfer of control authority.","remaining_difference":"It filters live primary-controller behavior for safety rather than adjudicating accumulated artifact eligibility, dependencies, replay duties, or retirement."}],"contrastive_claim_remaining":"For one nominated non-safety-critical controller family, an owner-adjudicated lifecycle gate combining explicit supersession and regime-fit labels with sole-fallback, dependency, replay, and preservation exceptions will, on identical recorded selection opportunities, reduce stale-eligible opportunities by at least 50% relative to the frozen baseline while producing zero loss of sole validated fallback or replay capability and no unresolved reviewer disagreement. The combined claim remains distinct from performance-based switching, generic configuration management, ordinary version backup, model-registry aliases, and runtime safety filtering.","contrastive_claim_falsifier":"The claim is falsified for the pilot if the complete baseline has zero stale-eligibility, reviewers cannot reproducibly adjudicate stale or dependency status, shadow gating reduces the rate by less than 50%, any gated artifact removes sole validated fallback or replay capability, or any disagreement remains unresolved.","confidence":"MODERATE","search_limitations":"The bounded search used exactly eight opened direct sources and covered six adversarial lanes, including French, German, and Japanese terminology. It found no field study reporting stale-eligibility prevalence in a supervisory-controller registry and no source implementing the full proposed combination. Some full standards are paywalled, and product pages do not independently validate vendor performance claims. This is not a systematic literature, patent, market, or freedom-to-operate search."},"researchability_gates":{"externally_supported_problem":{"status":"PASS","rationale":"Independent official, first-party, and regional sources establish controller-version or target mismatch, undocumented configuration change, authoritative-version uncertainty, and the operational need for controlled historical states. This supports the scoped problem class even though the nominated family's event-level prevalence is unknown and must be tested.","source_ids":["S1","S2","S4","S5","S8"]},"identifiable_adopter_or_authorizer":{"status":"PASS","rationale":"The accountable owner or operator of the nominated PLC, DCS, SCADA, or model-serving controller family is identifiable, with configuration-management leadership and safety or compliance officers serving as authorizers where affected.","source_ids":["S1","S4","S5","S8"]},"distinct_testable_incremental_claim":{"status":"PASS","rationale":"Close practices cover lifecycle states, backups, configuration audits, controller switching, and backup-controller protection separately, but none of the retained sources combines owner-adjudicated stale eligibility with dependency and replay exceptions and an identical-opportunity shadow comparison. The remaining claim has explicit quantitative and dependency-loss falsifiers.","source_ids":["S3","S4","S5","S6","S7"]},"bounded_next_evidence_step":{"status":"PASS","rationale":"A 30-day frozen trace, complete enrollment of one non-safety-critical family, two-reviewer adjudication, and offline replay are bounded and reversible. Existing registries, histories, comparisons, lifecycle labels, monitors, and restoration mechanisms show that the constituent measurements are technically plausible.","source_ids":["S3","S4","S5","S6","S7"]},"no_unresolved_safety_or_authority_stop":{"status":"PASS","rationale":"The authorized step changes no live eligibility and performs no deletion. It preserves every artifact, halts on fallback or replay loss, and requires owner plus protected-artifact approval. External guidance confirms that OT safety and reliability require special treatment and that backup controllers and historical configurations must be protected.","source_ids":["S1","S4","S5","S7"]},"adequate_search_evidence":{"status":"PASS","rationale":"All six mandated lanes were searched adversarially. The eight retained and opened sources span seven publishers and include two official guidance sources, three first-party product sources, and two primary research papers. They cover direct problem evidence, historical terminology, standards, products, regional terminology, and component combinations.","source_ids":["S1","S2","S3","S4","S5","S6","S7","S8"]}},"strict_success":true,"screen_survival":true,"remaining_research_value":"MODERATE","recommended_next_step":"Run the authorized offline pilot on one explicitly named non-safety-critical family: freeze the complete 30-day trace and registry, enroll every version, have two independent reviewers label supersession, regime fit, dependencies, fallback and replay roles, and holds, then replay identical opportunities under observed and shadow eligibility. Proceed no further unless stale eligibility falls by at least 50%, dependency loss is zero, and reviewer agreement is complete; a zero baseline stale-eligibility rate ends the problem claim for that family.","world_novelty_boundary":"This bounded public-web review supports only an adjacent-prior-art disposition and a distinct pilot claim. It cannot establish world novelty, patentability, freedom to operate, market size, prevalence beyond the nominated audit, generalized safety, realized impact, or superiority over all alternatives."}