{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp12_substrate_denial72_20260805","research_id":"eoa_inverse_innovation_exp12_light_screen_20260805","cell_id":"inversion_of_control__computer_science","search_lanes":{"direct_problem_and_intervention":{"queries":["stateful worker requests restart after checkpoint maintenance lease workflow","worker initiated rolling restart safe checkpoint application maintenance","site:learn.microsoft.com Azure Scheduled Events approve start event application ready reboot redeploy NotBefore","site:docs.aws.amazon.com ECS task scale-in protection endpoint task protect itself deployment"],"source_ids":["SRC1","SRC2"],"no_result_note":null},"synonyms_and_historical_terms":{"queries":["application controlled restart checkpoint external side effects graceful shutdown maintenance","workflow worker safe point restart checkpoint rolling upgrade","safe point application initiated maintenance reboot intent lease checkpoint","site:nightlies.apache.org/flink upgrade savepoint stop with savepoint drain documentation"],"source_ids":["SRC1","SRC3","SRC4"],"no_result_note":null},"products_practices_and_standards":{"queries":["site:kubernetes.io pod disruption budget rolling update readiness graceful shutdown stateful application","site:kubernetes.io container lifecycle preStop termination signal grace period readiness","site:docs.aws.amazon.com ECS task scale-in protection endpoint task protect itself deployment","site:learn.microsoft.com Azure Scheduled Events approve start event application ready reboot redeploy NotBefore"],"source_ids":["SRC1","SRC2","SRC3"],"no_result_note":null},"component_combination":{"queries":["worker initiated rolling restart safe checkpoint application maintenance","application controlled restart checkpoint external side effects graceful shutdown maintenance","site:nightlies.apache.org/flink upgrade savepoint stop with savepoint drain documentation","safe point application initiated maintenance reboot intent lease checkpoint"],"source_ids":["SRC1","SRC2","SRC4"],"no_result_note":"No retained source documented the entire proposed combination of workflow-step checkpoint attestation, unresolved-effect veto, signed one-use maintenance request, capacity revalidation, and a short-lived replacement lease."}},"sources":[{"source_id":"SRC1","title":"Scheduled Events for Windows VMs in Azure","publisher":"Microsoft","url":"https://learn.microsoft.com/en-us/azure/virtual-machines/windows/scheduled-events","source_type":"FIRST_PARTY_PRODUCT","claims_supported":["Azure publishes advance maintenance events such as reboot and redeploy so an application can prepare before impact.","After preparation, the application can approve the particular event by POSTing its EventId; Azure starts after approval or when NotBefore is reached.","The platform retains deadline and execution authority, and exceptional hardware failures may bypass the preparation period."]},{"source_id":"SRC2","title":"Protect your Amazon ECS tasks from being terminated by scale-in events","publisher":"Amazon Web Services","url":"https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-scale-in-protection.html","source_type":"FIRST_PARTY_PRODUCT","claims_supported":["Queue and job-processing containers that can determine their own critical-work state may set or clear task protection through a local ECS agent endpoint.","Protection applies to deployment and autoscaling termination; clearing it after work completes makes the task eligible for later termination.","AWS identifies expensive reprocessing as a motivation and documents expirations, IAM permissions, deployment blocking, and capacity-related rollout constraints."]},{"source_id":"SRC3","title":"Disruptions","publisher":"Kubernetes","url":"https://kubernetes.io/docs/concepts/workloads/pods/disruptions/","source_type":"OFFICIAL_GUIDANCE","claims_supported":["Pod disruption budgets constrain concurrent voluntary disruptions and eviction can be retried until success or timeout.","Evicted pods receive graceful termination, but workload controllers are not constrained by PDBs during their own rolling upgrades.","Kubernetes explicitly distinguishes cluster-manager and application-owner roles and notes that shutdown duration, capacity, replica needs, and controller type affect disruption behavior."]},{"source_id":"SRC4","title":"Savepoints","publisher":"Apache Flink","url":"https://nightlies.apache.org/flink/flink-docs-stable/docs/ops/state/savepoints/","source_type":"OFFICIAL_GUIDANCE","claims_supported":["A Flink savepoint is a consistent execution-state image usable to stop, resume, or update a stateful job.","Flink supports an atomic stop-with-savepoint operation and restoration from the resulting durable state.","The documentation warns that intermediate savepoints do not commit side effects and that incorrect snapshot or transactional-sink handling can compromise correctness."]}],"problem_evidence":{"status":"SUPPORTED","finding":"The control mismatch is visible. AWS documents job-processing tasks that must protect themselves during deployments because termination can cause expensive reprocessing; Flink documents the need for consistent state and careful side-effect handling when stopping stateful jobs; Kubernetes shows that generic disruption controls do not govern every rolling update; and Azure already lets an application delay and then approve a pending maintenance event after local preparation.","source_ids":["SRC1","SRC2","SRC3","SRC4"]},"closest_prior_art":[{"name":"Azure Scheduled Events application approval","source_ids":["SRC1"],"overlap":"The platform publishes a specific pending reboot or redeploy event with a latest-start boundary; the affected application prepares using locally known state and then sends an EventId-scoped approval that permits the platform to execute the event. The platform proceeds at the deadline even without approval.","remaining_difference":"The retained documentation does not require a workflow durable-checkpoint event, an application callback that verifies unresolved external effects, a signed attestation, or explicit replica-capacity and fleet-concurrency revalidation before granting a replacement lease."},{"name":"Amazon ECS task scale-in protection","source_ids":["SRC2"],"overlap":"A queue or job-processing task can use a local agent endpoint to make itself ineligible for deployment termination while critical work is active and can clear protection when locally observed work completes; IAM, expiry, deployment, and capacity constraints remain platform-controlled.","remaining_difference":"This changes eligibility rather than approving a particular preauthorized maintenance intent, can be repeatedly extended, and does not document checkpoint evidence, one-use leases, unresolved-effect attestations, or an immutable maintenance deadline."},{"name":"Apache Flink stop-with-savepoint","source_ids":["SRC4"],"overlap":"A stateful application can be stopped atomically at a consistent durable savepoint and later resumed under an updated runtime, directly addressing interruption, replay, and state compatibility.","remaining_difference":"The documented operation is externally triggered and job-wide; it does not give an individual worker the right to request a preapproved infrastructure replacement when its own checkpoint predicate becomes true."},{"name":"Kubernetes disruption budgets and graceful eviction","source_ids":["SRC3"],"overlap":"The platform enforces replica availability, retries denied evictions, and grants graceful termination time while accounting for capacity and controller behavior.","remaining_difference":"The controller still initiates disruption, and PDBs do not constrain workload-controller rolling upgrades or attest application-specific checkpoint and side-effect safety."}],"prior_art_disposition":"SUBSTANTIAL_COLLISION","contrastive_claim_remaining":"The broad inversion claim does not remain: Azure Scheduled Events already delegates activation of a pending, deadline-bounded maintenance event to the affected application, and ECS tasks already self-declare deployment-termination eligibility. A narrower falsifiable claim remains: for stateful workflow workers, automatically requesting a one-use replacement lease immediately after a durable checkpoint and an unresolved-effect callback, with platform capacity revalidation, identifies safer replacement instants than Azure-style event approval, ECS-style self-unprotection, or a controller using the same freshly exported predicate, without reducing deadline compliance.","contrastive_claim_falsifier":"Under identical maintenance windows, checkpoint definitions, replica limits, and workloads, the narrower claim is falsified if Azure-style prepare-and-approve handling, ECS-style protection clearing, or centralized scheduling from a fresh safety signal matches the proposed lease requests on critical-section intersections, false-safe decisions, replay, duplicate effects, deadline compliance, and capacity violations.","gates":{"adequate_source_search":{"status":"PASS","rationale":"The bounded search covered direct phrasing, safe-point and graceful-shutdown terminology, official platform products and practices, and combinations involving checkpoints, side effects, rolling maintenance, protection, approval, and deadlines. Exactly four opened official or first-party sources from four publishers were retained.","source_ids":["SRC1","SRC2","SRC3","SRC4"]},"supported_problem":{"status":"PASS","rationale":"Official product documentation independently shows expensive reprocessing from deployment termination, application-controlled termination eligibility, maintenance preparation and approval, state-consistent stop/resume, and gaps between disruption budgets and rolling updates.","source_ids":["SRC1","SRC2","SRC3","SRC4"]},"distinct_testable_claim":{"status":"PASS","rationale":"Although the broad control inversion substantially collides with existing products, the narrower checkpoint-attested, unresolved-effect-aware, one-use lease mechanism can be compared against Azure-style approval, ECS protection, and centralized fresh-signal scheduling using observable safety and deadline outcomes.","source_ids":["SRC1","SRC2","SRC4"]},"bounded_next_test":{"status":"PASS","rationale":"A staging-only shadow study of at most 40 no-op intents is bounded, reversible, and capable of comparing baseline, existing-practice rivals, and proposed activation times. Manual reconciliation against durable checkpoint and external-effect logs supplies an explicit false-safe stop condition before any restart test.","source_ids":["SRC1","SRC2","SRC4"]},"no_obvious_safety_or_authority_stop":{"status":"PASS","rationale":"The first step performs no restart or production mutation. Platform authority over artifact, deadline, capacity, and execution is preserved, consistent with documented platform patterns; authentication, immutable deadlines, concurrency checks, auditability, and rollback conditions address the obvious deferral, false-attestation, and surge risks sufficiently for shadow testing.","source_ids":["SRC1","SRC2","SRC3"]}},"screen_survival":false,"world_novelty_boundary":"This bounded four-source public-web screen found substantial collision in the proposal's central inversion but did not locate the entire checkpoint-attestation and one-use-lease combination. That phrase or combination miss does not establish world novelty, patentability, market size, expert acceptance, implementation feasibility, or realized value."}