{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp12_substrate_denial72_20260805","cell_id":"inversion_of_control__accounting_auditing","arm":"CONSTRAINED_MAX","candidate_id":"inversion_of_control__accounting_auditing__CONSTRAINED_MAX","decision":"PROPOSAL","abstention_reason":null,"proposal":{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp12_substrate_denial72_20260805","cell_id":"inversion_of_control__accounting_auditing","arm":"CONSTRAINED_MAX","candidate_id":"inversion_of_control__accounting_auditing__CONSTRAINED_MAX","proposal_index":1,"version":0,"title":"Flow-Called Mechanical Witness for Bulk-Inventory Cutoff","problem":"An auditor testing a closed, hard-piped bulk-liquid storage tank must determine whether inlet and outlet transfers physically occurred on the reported side of a financial-period cutoff. The usual beginning-and-ending tank gauges are auditor- or custodian-initiated snapshots. They can establish net change but may not reveal the timing or direction of intervening, potentially offsetting transfers; ledger timestamps and transfer tickets are claims about those events rather than an independent physical witness of them.","actors":["Bulk-liquid storage tank whose period-end inventory is asserted","Inlet and outlet liquid streams carrying the actual transfer timing and volume","Tank operator and asset custodian","Internal or external auditor","Qualified process-safety and measurement engineer","Sealed flow-powered mechanical witness spools"],"observable_state":"Under the baseline, opening and closing tank readings may be observable while the physical sequence between them is not. Under the intervention, each permitted inlet and outlet has a sealed foil trace containing time-positioned embossments, one per calibrated volume quantum, alongside a non-resettable mechanical totalizer. Separate inlet and outlet tracks expose the timing, direction, and measured amount of intervening flow without consulting the ledger.","consequence":"Without an independent event-timed physical trace, an auditor may be unable to discriminate a correctly recorded sequence from an omitted, duplicated, or wrong-period transfer that produces the same net endpoint change. This weakens evidence for inventory and transaction cutoff, completeness, and accuracy assertions.","affected_objective":"Independent physical evidence for the cutoff, completeness, occurrence, and measured quantity of bulk-liquid inventory transfers.","intervention":"Fit every permitted liquid inlet and outlet of the scoped tank with a sealed all-mechanical witness spool. Liquid passage turns a calibrated positive-displacement rotor. After each fixed displacement quantum, the rotor charges and releases an over-center spring that embosses one mark onto tamper-evident foil. A prewound mechanical clock advances the foil continuously, so mark position represents elapsed time while mark count represents volume; inlet and outlet spools use distinct tracks. The same rotor advances a non-resettable mechanical totalizer. The recorder requires no electrical sensor, software, network, ledger input, or operator command at transfer time: the audited material event itself invokes measurement and creates the local durable trace.","structural_mapping":[{"archetype_element":"Usual controller push","domain_realization":"The auditor or tank custodian chooses when to dip the tank, read a meter, or prepare transfer evidence, leaving the interval between chosen observations dependent on their scheduling."},{"archetype_element":"Context holder","domain_realization":"The liquid crossing the tank boundary physically contains the decisive contextual signal: exactly when movement occurs, in which line, and by how much displacement."},{"archetype_element":"Inverted control boundary","domain_realization":"At each hard-piped inlet and outlet, initiation of the audit measurement moves from the auditor or operator to the physical transfer event."},{"archetype_element":"Activation rule","domain_realization":"Each calibrated rotor displacement mechanically releases one embossment; no flow produces no volume mark."},{"archetype_element":"Interface contract","domain_realization":"A fixed physical mapping connects one line direction, one displacement quantum, one embossment, and one mechanical-clock position, without accepting ledger data or discretionary annotations."},{"archetype_element":"Delegation rule","domain_realization":"The material event gains only the ability to initiate measurement. It cannot set accounting treatment, valuation, audit conclusions, or process-safety limits."},{"archetype_element":"Feedback signal","domain_realization":"Agreement or disagreement among known collected volume, embossment count, and the non-resettable totalizer provides a directly testable physical consistency signal."},{"archetype_element":"Guardrail","domain_realization":"Pressure-rated wetted parts, direction-specific gearing, captive foil, a frangible enclosure seal, visible end-of-tape indication, and installation on all scoped transfer ports bound the physical activation path."},{"archetype_element":"Override or fallback path","domain_realization":"Certified tank gauging and custody-transfer measurement remain available; the prototype is removable and is not the sole basis for a financial or safety decision."},{"archetype_element":"Audit trail","domain_realization":"The captive embossed foil and non-resettable totalizer preserve a local physical witness of what activated the instrument and when, even if no downstream system receives data."}],"mechanism_mapping":[{"mechanism_slug":"event_listener_or_webhook","role":"Implemented as a wholly physical event listener: material displacement at the boundary directly drives the rotor and calls the bounded embossing action at the moment of flow.","counterfactual_removal":"If the flow-to-rotor linkage is removed and embossing instead waits for an auditor or operator to activate it, the transfer event no longer controls measurement, the inversion disappears, and unsampled intervals return."}],"causal_chain":["Auditor-scheduled snapshots place measurement initiation with a party that does not physically experience every intervening transfer.","Actual liquid movement reaches the boundary with more precise event timing than a later scheduled observation.","The moving liquid supplies mechanical work to the positive-displacement rotor.","Each calibrated displacement quantum mechanically invokes the embossing head while the clock locates the mark in time.","The sealed foil and totalizer retain a ledger-independent physical time-volume trace without software or reporting.","The retained trace permits a later audit comparison to distinguish transfer sequences that identical beginning-and-ending net readings cannot distinguish."],"baseline":"Manual or auditor-scheduled tank dips immediately before and after cutoff, reconciled to transfer tickets, ledger timestamps, and optionally a cumulative mechanical meter read only at selected times.","nearest_rivals":["A sealed non-resettable mechanical totalizer read before and after cutoff measures cumulative flow without software, but a cumulative number alone does not locate increments in time unless someone brackets them with readings.","A continuous mechanical tank-level chart supplies a physical time series of net contents, but simultaneous or offsetting inlet and outlet flows can be indistinguishable in the net level trace.","A certified electronic custody-transfer meter with a secure logger can capture richer event data, but its operative evidence path depends on electronic sensing and stored data.","An all-mechanical spring-chart flow recorder may be functionally equivalent. If it already provides a sealed, direction-specific, volume-versus-time trace at every relevant boundary, this candidate has no remaining functional contrast from that rival.","Independent observation or surprise tank gauging can strengthen evidence at selected moments but retains observer-initiated sampling and does not continuously bind measurement to every transfer event."],"remaining_contrastive_claim":"The bounded claim is not novelty or general superiority. Relative to snapshot gauging and a cumulative-only totalizer, a transfer-activated sealed mechanical time-volume trace should make the cutoff side and direction of each metered volume quantum observable without an operator initiating a reading, computation, or data path. No contrast is claimed against an existing all-mechanical recorder that already satisfies the same boundary, activation, and trace conditions; demonstrated equivalence would collapse the candidate into that rival.","authority_safety":{"decision_authority":"The facility asset owner and process-safety authority must jointly approve any pipework or live installation, with a qualified measurement engineer approving calibration. An auditor may specify the evidentiary question but cannot authorize process modification or declare prototype output sufficient audit evidence.","authorized_first_step":"Construct one low-pressure benchtop prototype on a recirculating water loop, outside any accounting system or live inventory process, and test it against a calibrated collection vessel, reference balance, and independent clock.","excluded_actions":["No installation on a live tank, pressurized production line, food stream, corrosive material, or flammable liquid during the first step","No alteration of an official ledger, financial statement, certified custody meter, or retained audit record","No representation of prototype traces as sufficient audit evidence","No blocking or bypassing of required pressure relief, containment, or certified measurement equipment","No unsupervised pressure testing or use beyond the rated materials and pressure envelope"],"halt_rollback":"Stop immediately upon leakage, unexpected pressure rise or loss, rotor or clock stoppage, damaged seal, unreadable trace, or error outside the preregistered calibration tolerance. Depressurize and drain the water loop, remove the spool, restore the original test-loop section, and quarantine the cassette and observations for diagnosis."},"negative_tests":{"strongest_counterevidence":"In randomized sequences containing offsetting inlet and outlet movements around a simulated cutoff, blinded reconstruction from the proposed trace performs no better than reconstruction from opening and closing gauges plus a cumulative-only totalizer, or a conventional all-mechanical recorder produces the same evidence with the same independence.","problem_falsifier":"The problem is falsified for the scoped tank if every possible liquid-transfer boundary already creates an independently verifiable physical time-volume trace at the required resolution, or if no intervening transfer sequence can produce identical endpoint readings while differing in cutoff treatment.","intervention_falsifier":"The intervention is falsified if known-volume, known-time water transfers fail to produce the corresponding irreversible marks within preregistered tolerances; if no-flow periods create marks; if direction is ambiguous; or if the cassette, counter, or drive can be suppressed, advanced, or replaced through ordinary access without visible physical evidence.","risks":["Added pressure drop, leakage, rupture, or flow obstruction","Wetted-material incompatibility, contamination, or fouling","Volume error from wear, bubbles, temperature, viscosity, slip, or reverse flow","Mechanical-clock drift or exhausted clock and foil capacity","Uninstrumented hatches, bypasses, or alternate lines creating false completeness","Seal replacement, enclosure access, or shaft decoupling creating unresolved tamper paths","Device seizure disrupting operations or silently missing transfers","False assurance from treating a flow trace as evidence of ownership, authorization, valuation, or product identity","Loss of auditor independence if the custodian alone controls installation, calibration, or cassette custody"]},"next_evidence_step":"On the water loop, run twelve randomized, documented transfer sequences containing inlet-only, outlet-only, simultaneous or offsetting movements, pauses, and events on both sides of a simulated cutoff. Before testing, set volume-error, timing-resolution, missed-mark, false-mark, clock-drift, pressure-loss, and seal-integrity criteria from the prototype's intended measurement resolution. Conceal the reference sequence from the person decoding the sealed foil. Compare reconstruction from the candidate with reconstruction from opening and closing level readings and a cumulative-only mechanical totalizer, then attempt cassette removal and drive disengagement using normal external access. This is a bounded feasibility and falsification test, not an audit validation or effect-size study.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Runtime isolation precludes comparison with other proposals, so no cross-candidate diversity claim is made. Internally, this candidate is characterized by a flow-powered, non-electronic, local physical measurement path rather than software, governance, incentives, or reporting.","revision_record":{"parent_version":null,"progress_targets_addressed":["Initial construction of one causally mapped accounting-and-auditing candidate","Explicit preservation of inversion through transfer-event initiation","Explicit compliance with the constrained physical and measurement substrate"],"conceptual_changes":["Initial version; no parent concept was revised."],"operational_changes":["Initial version specifies a removable water-loop prototype and bounded comparison against snapshot and cumulative-meter baselines."],"evidence_changes":["No empirical or prior-art evidence is asserted; falsification observations are specified prospectively."],"claim_changes":["Claims are limited to a testable contrast in event-timed physical observability; novelty, prevalence, demand, superiority, and effect size are not claimed."]},"substrate_contract":{"primary_allowed_process":"MEASUREMENT_INSTRUMENTATION","counterfactual_independence":"Remove all software, algorithms, databases, dashboards, communications, incentives, permissions, reviews, workflows, and procedural enforcement. During a transfer, liquid displacement still turns the rotor, mechanically releases an embossment, advances the non-resettable totalizer, and leaves a time-positioned mark on the clock-driven foil. The essential effect—material-event-triggered creation of a durable physical time-volume witness—therefore survives. Calibration, safe installation, and later human interpretation support use of the trace but do not create it.","forbidden_channel_audit":"No forbidden channel lies in the causal path from transfer to trace. The unit does not emit a sensor signal for downstream analytics and has no software control loop; it locally converts fluid displacement and mechanical elapsed time into irreversible physical marks. Ledger comparison, reporting, chain-of-custody procedure, and audit judgment are downstream wrappers. Removing them prevents use of the witness in a formal conclusion but does not prevent or alter the operative physical measurement."}}}