{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp12_substrate_denial72_20260805","cell_id":"incentive_compatible_rule_design__computer_science","arm":"CONSTRAINED_MAX","candidate_id":"incentive_compatible_rule_design__computer_science__CONSTRAINED_MAX","decision":"PROPOSAL","abstention_reason":null,"proposal":{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp12_substrate_denial72_20260805","cell_id":"incentive_compatible_rule_design__computer_science","arm":"CONSTRAINED_MAX","candidate_id":"incentive_compatible_rule_design__computer_science__CONSTRAINED_MAX","proposal_index":1,"version":0,"title":"Passive charge-account branches for noisy-neighbor power isolation in accelerator backplanes","problem":"In a modular FPGA or accelerator testbed, independently controlled cards share a low-voltage DC backplane. Each card and workload owner knows its forthcoming burst demand and can choose clocking or launch timing to maximize completed work. With a direct common feed, a card can take burst energy from shared capacitance while every slot experiences the resulting rail disturbance; declared power budgets and telemetry do not physically constrain that waveform. The candidate targets this cross-slot power externality rather than general malicious-hardware control.","actors":["Independently controlled FPGA or accelerator cards","Workload owners choosing compute timing and intensity","The shared DC source, wiring impedance, and backplane","Neighboring cards whose computations require stable supply voltage","Per-slot charge-account modules","The laboratory hardware owner and electrical-safety reviewer"],"observable_state":"Simultaneous raw measurements of source-rail voltage and current, each branch's source current and terminal voltage, each local capacitor voltage, component temperature, and neighboring-load undervoltage state. The key physical state is the time integral of load current above the branch refill current, represented directly by loss of local capacitor charge.","consequence":"Under the direct-feed baseline, an over-budget current pulse can discharge common capacitance and depress the shared rail, interrupting neighboring computation or corrupting volatile state. The bursting card obtains the immediate energy while conservative cards bear part of the electrical consequence.","affected_objective":"Electrical failure containment and continuity of independent computations on a shared modular backplane while retaining a bounded envelope for legitimate burst loads.","intervention":"Insert a nonprogrammable charge-account module between the source bus and every slot. Each module contains a source-side fuse, a hardwired analog current limiter set to the slot's sustainable refill current, a reverse-blocking diode, a slot-local capacitor, and a branch-local thermal fail-safe. The sum of refill limits is kept within the source's continuous envelope. When load current exceeds refill current, only that slot's stored charge supplies the difference, so its charge falls by the integral of I_load minus I_refill and its own voltage headroom is consumed. Sustained excess therefore reduces that slot's delivered power or activates its local fail-safe without exposing the common rail to the full transient. No telemetry output, microcontroller, firmware command, or participant report controls the protection.","structural_mapping":[{"archetype_element":"Structural problem: strategic divergence","domain_realization":"A throughput-seeking card benefits from aggressive bursts on a direct common rail, while voltage disturbance and reset risk are partly externalized to neighboring cards."},{"archetype_element":"Participant Role Map","domain_realization":"Cards and workload owners choose load waveforms; the source and backplane supply shared energy; neighboring cards bear rail disturbances; each charge-account branch couples a card's choice to its own electrical state."},{"archetype_element":"Desired Outcome Specification","domain_realization":"A slot may consume its sustainable share and a bounded private burst reserve, but its excess demand should first deplete or interrupt that same slot rather than disturb peers."},{"archetype_element":"Action and Choice Set","domain_realization":"A card can pace work, issue bursts of different amplitude or duration, synchronize bursts, remain continuously over budget, add downstream capacitance, or stop drawing power."},{"archetype_element":"Incentive Payoff Map","domain_realization":"The relevant payoff is physical completed-work capacity: staying within the refill and burst envelope preserves local voltage, while accumulated excess consumes local voltage headroom and creates a local recovery interval."},{"archetype_element":"Information Structure Map","domain_realization":"The card knows its intended workload and transient demand; the backplane owner need not know or trust either. The branch responds to actual current rather than a declared workload class or reported power figure."},{"archetype_element":"Truthfulness Condition","domain_realization":"No statement is elicited. Actual charge withdrawal is the revelation: even an added downstream capacitor must replenish through the limited branch, so reported demand cannot substitute for physical use."},{"archetype_element":"Verification Rule","domain_realization":"Kirchhoff current balance and capacitor charge conservation embody verification continuously. Excess current necessarily appears as local charge depletion, series-stage dissipation, or local voltage loss."},{"archetype_element":"Penalty or Reward Rule","domain_realization":"The consequence is energetic rather than administrative: compliant draw retains voltage and immediate service; excess draw spends finite local energy and then causes local sag, heating, or disconnection."},{"archetype_element":"Participation Constraint","domain_realization":"Capacitance and refill current must admit the predeclared legitimate pulse envelope; otherwise valid burst-oriented cards would lose useful operation and the design would fail."},{"archetype_element":"Fairness Constraint","domain_realization":"Branches use the same physical budget for electrically equivalent slots. Any class-specific capacity is established from connector and workload-envelope requirements, not operator identity, reputation, or telemetry."},{"archetype_element":"Strategic Response Test","domain_realization":"Adversarial load traces vary amplitude, pulse width, duty cycle, synchronization, downstream capacitance, and sustained overload to test whether any waveform transfers its local debit to another slot."},{"archetype_element":"Failure and Gaming Monitor","domain_realization":"Evidence instrumentation checks for shared-rail droop, synchronized recharge peaks, reverse injection, thermal drift, and alternative power paths. These observations diagnose failure but do not actuate the intervention."}],"mechanism_mapping":[{"mechanism_slug":"deposit_bond_or_stake","role":"The finite slot-local charge is a physical stake that only its slot can spend. Bursting consumes that slot's voltage headroom, and restoration requires replenishment through its limited feed.","counterfactual_removal":"Replacing local reverse-isolated reservoirs with common capacitance removes the slot-specific conserved state; burst energy and its depletion are again shared across slots."},{"mechanism_slug":"self_selection_menu","role":"The branch presents two physical service regimes: indefinitely sustainable power at the refill rate and finite burst power drawn from local stored charge. A load self-selects through its actual waveform, without classification or permission.","counterfactual_removal":"A direct stiff feed collapses the two regimes into unmetered shared draw, while a single instantaneous trip threshold removes the bounded burst option and its participation benefit."},{"mechanism_slug":"anti_gaming_scoring_rule","role":"Capacitor voltage is a physical, stateful score of accumulated excess charge. Dividing a demand into closely spaced subpulses cannot erase the debit; only operating below the refill rate restores charge.","counterfactual_removal":"Without the stateful local integrator, a threshold can either reject every excursion or become sensitive to pulse timing. The intertemporal coupling between cumulative excess use and the same slot's consequence disappears."}],"causal_chain":["Independently controlled cards choose current waveforms using workload information unavailable to the backplane owner.","On the direct common rail, a burst draws from shared source impedance and capacitance, so part of its voltage cost reaches neighboring slots.","The proposed branch limits how quickly each slot can draw fresh charge from the source and blocks reverse withdrawal from other slots' reservoirs.","If a slot draws below its refill rate, its local reservoir remains charged and its terminal voltage remains available for computation.","If it draws above that rate, the current difference is supplied from its own capacitor and cumulative excess demand lowers only its stored charge first.","For a card seeking sustained completed work and losing work under undervoltage, pacing demand within the refill and burst envelope avoids its own recovery interval and becomes the locally preferable response.","If a card does not adapt or instead seeks disruption, the hardwired source-current limit and local depletion still contain its sustained demand without requiring cooperation.","Because branch refill ceilings sum to no more than the source's continuous envelope, reservoir recovery is not intended to recreate the same shared overload at a slower timescale.","The resulting outcome is conditional physical isolation: each slot bears the first electrical consequence of its own excess demand while peers retain their separately supplied envelopes."],"baseline":"A matched direct-feed fixture using the same source, wiring, nominal loads, total capacitance, and ordinary safety fuses, but with capacitance shared at the source and no per-slot refill limit or reverse-isolated reservoir. Any telemetry is observational and issues no control command.","nearest_rivals":["A larger source and common bulk capacitor, which absorb more transient energy but leave all stored energy mutually accessible","A fixed per-slot fuse or single-threshold current limiter, which can contain faults but may reject admissible bursts or ignore cumulative pulse energy","An independent converter for every slot with an ordinary current-limit transfer curve, which may reproduce all material behavior of the candidate and therefore could subsume it","A telemetry-driven firmware power scheduler, which can coordinate loads but depends on measurement, computation, control authority, and compliant hardware","A static ballast element without a local reservoir, which localizes current but continuously dissipates energy and provides no separate burst participation envelope"],"remaining_contrastive_claim":"The bounded claim is that, with source capability, sustainable per-slot power, wiring, and total added capacitance matched, reverse-isolated local charge accounts should make the integral of a slot's excess current appear first as that slot's voltage loss and recharge delay. Common buffering externalizes that state, while a simple fixed limiter lacks the same combination of cumulative debit and bounded burst participation. The candidate has no remaining distinction if an ordinary per-slot converter or limiter produces the same transfer behavior under matched constraints.","authority_safety":{"decision_authority":"The laboratory hardware owner and a qualified electrical-safety reviewer may jointly authorize only an isolated, extra-low-voltage dummy-load experiment. This proposal grants no authority over production infrastructure or workload owners.","authorized_first_step":"Construct a two-branch, nonproduction fixture using a current-limited source, fused dummy loads, bounded stored energy, rated bleeders, and a touch-safe enclosure; collect raw electrical traces without connecting accelerator cards.","excluded_actions":["Connection to production backplanes or live user workloads","Use of mains voltage or capacitor energy outside the laboratory's approved limits","Bypassing source fuses, bleeders, thermal protection, or component ratings","Using observed voltage sag to punish, rank, or infer intent about a workload owner","Automatic intervention based on telemetry, analytics, or software classification","Treating successful bench isolation as evidence of general hardware compatibility"],"halt_rollback":"Immediately de-energize the fixture and discharge each reservoir through its rated bleeder if there is unexpected heating, swelling, oscillation, reverse current, component breakdown, or shared-rail excursion beyond predeclared fixture limits. Remove the experimental modules only after verified discharge and return the fixture to its de-energized direct-feed configuration."},"negative_tests":{"strongest_counterevidence":"The strongest counterevidence would be a matched per-slot converter or limiter that provides the same local cumulative-debit and legitimate-burst envelope with fewer failure modes, or traces showing that constant-power load instability or synchronized recharge still depresses the shared rail before the offending slot loses local headroom.","problem_falsifier":"The problem is falsified for the target fixture if the direct-feed baseline, under the full bounded load-waveform matrix and connector-rated fault surrogate, produces no reproducible cross-slot rail disturbance or neighboring undervoltage state.","intervention_falsifier":"The intervention is falsified if no component setting simultaneously serves the legitimate burst envelope and localizes sustained excess, if neighboring voltage changes before local reservoir depletion, if excess-energy accounting does not track capacitor charge within component and measurement uncertainty, or if the candidate offers no causal contrast to a fixed per-slot limiter.","risks":["Capacitor inrush, stored-energy release, dielectric failure, or fire","Limiter, diode, fuse, or PTC failure that creates an unintended low-impedance path","Thermal loss from current limiting and repeated recharge","Oscillation or collapse caused by a constant-power load's negative incremental impedance","Local undervoltage corrupting the offending card rather than inducing orderly pacing","Legitimate burst-heavy workloads being excluded by an incorrectly sized participation envelope","Synchronized recharge across depleted branches recreating a shared supply excursion","An alternate power or ground path bypassing isolation and transferring energy between slots"]},"next_evidence_step":"Run one bounded two-load comparison across four matched topologies: direct common feed, matched common capacitance, fixed per-branch current limiting, and the proposed reverse-isolated local charge accounts. Keep source, wiring, total capacitance, sustainable branch rating, and quiet-neighbor load fixed. Apply a finite predeclared matrix of switched-resistor pulse amplitudes, widths, duty cycles, synchronized pulses, and a current-limited fault surrogate to the other branch. Record only raw voltage, current, charge-recovery, and temperature traces. Advance no further unless the candidate shows the predicted causal ordering—offending branch charge loss before neighbor disturbance—while serving the predeclared legitimate burst envelope and remaining within safety limits.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Not compared with prior proposals because runtime isolation prohibits access to them. Relative only to the supplied inputs, this candidate instantiates strategic payoff alignment as conserved electrical charge and spatially local energy depletion rather than software, reporting, policy, or administrative reward.","revision_record":{"parent_version":null,"progress_targets_addressed":["Construct an initial candidate whose primary effect is physical and energetic","Preserve private information, strategic choice, payoff coupling, verification, participation, and adversarial-response structure","Make the forbidden-wrapper counterfactual explicit","Bound authority, evidence collection, claims, and rollback"],"conceptual_changes":["Initial version maps a shared-compute power externality to a slot-specific conserved-charge account.","It separates throughput-seeking best-response alignment from hard containment of a nonresponsive or disruptive load."],"operational_changes":["Initial version limits evidence collection to a two-branch extra-low-voltage dummy-load fixture.","It adds matched conceptual rivals and a predeclared waveform stress test."],"evidence_changes":["No empirical or prior-art evidence was consulted.","All performance statements remain falsifiable hypotheses for the bounded bench comparison."],"claim_changes":["No novelty, prevalence, demand, or effect-size claim is made.","The remaining claim is limited to a matched causal contrast in where cumulative excess energy is expressed."]},"substrate_contract":{"primary_allowed_process":"PHYSICAL_MATERIAL","counterfactual_independence":"Once installed, disconnect every telemetry and control wire and remove schedulers, logs, quotas, rewards, sanctions, identity checks, and reporting. Replace each card with switches and fixed resistive loads producing the same current waveforms. The hardwired limiter, diode, capacitor, fuse, and PTC still cap source current, prevent reverse reservoir sharing, convert excess current into local charge depletion, and localize sustained overload through electrical and thermal processes. A noncooperative load may sacrifice its own operation, but the essential cross-slot containment does not require it to understand or obey a rule.","forbidden_channel_audit":"No code, algorithm, model, database, dashboard, report, incentive payment, permission decision, audit adjudication, or procedural enforcement closes the causal chain. Oscilloscope measurements are evidence-only and never command the branch. Component selection and laboratory authorization are setup and safety wrappers. The physical payoff language refers to terminal energy, voltage headroom, and recovery time—not an institutional reward. If localization requires firmware throttling, telemetry-triggered action, software-enforced identity, or sanctions against an operator, the proposal fails the substrate contract."}}}