{"cases":[{"alternative_route_blocks":[],"case_id":"E14A022__DIRECT","case_type":"DIRECT_POSITIVE","domain":"Corporate finance and payment fraud","intended_route_id":"B1","omitted_condition_id":null,"remedy_leakage_audit":"The statement reports existing capabilities, vulnerabilities, and consequences without suggesting preparation, training, messaging, or any other intervention.","route_evidence":[{"condition_id":"b005_a08_b005_a08_c2","intended_status":"SATISFIED","scenario_evidence":"Staff know that supplier changes require independent confirmation, but the rule remains theoretical, is rarely rehearsed, and is easily displaced by urgency and authority cues."},{"condition_id":"HR1","intended_status":"SATISFIED","scenario_evidence":"More convincing synthetic impersonation attempts are expected, and a first successful encounter could produce an irreversible payment before ordinary review or correction."}],"scenario_text":"A regional construction company expects a rise in payment fraud after several subcontractors disclosed email breaches. Its accounts staff know, in principle, that changes to supplier banking details require independent confirmation. The rule appears in an annual compliance module, but most employees have never used it during a convincing live incident. Routine invoices are processed through long email threads, and urgent requests from senior managers often receive abbreviated review.\n\nAttackers have so far sent clumsy messages with incorrect signatures and unusual phrasing, which employees readily dismissed. Management now expects attempts using stolen correspondence, accurate project details, and synthetic voice calls resembling known executives. A request could arrive near the weekly payment cutoff, when one employee can release a six-figure transfer within minutes. Once funds move through intermediary accounts, later warnings from the real supplier or bank are unlikely to arrive soon enough to recover them. The company therefore faces a foreseeable first encounter whose realism and speed may overwhelm knowledge that staff possess but have never had to retrieve under pressure.","scenario_title":"Urgent Supplier Account Change","vocabulary_separation_audit":"Uses invoice processing, subcontractors, banking changes, executive impersonation, and payment cutoffs; it does not reuse the operational-control vocabulary of the transfer cases."},{"alternative_route_blocks":[],"case_id":"E14A022__TRANSFER","case_type":"TRANSFER_POSITIVE","domain":"Urban rail tunnel operations","intended_route_id":"B1","omitted_condition_id":null,"remedy_leakage_audit":"The statement describes current operating knowledge and an anticipated hazard but makes no recommendation about exercises, exposure, system changes, or response design.","route_evidence":[{"condition_id":"b005_a08_b005_a08_c2","intended_status":"SATISFIED","scenario_evidence":"Controllers understand general principles for recognizing corrupted telemetry, yet the relevant checks are buried, unrehearsed, and difficult to recall amid alarms."},{"condition_id":"HR1","intended_status":"SATISFIED","scenario_evidence":"A more coordinated future signal-corruption event is foreseeable, and its first full manifestation could prompt unsafe commands before engineers can identify and correct it."}],"scenario_text":"Controllers in a metropolitan rail tunnel understand that sensor readings can be misleading and that conflicting indicators should be checked against independent sources. That knowledge comes from certification coursework and a dense contingency manual. No controller on the current shift roster has handled a coordinated telemetry failure, and the relevant cross-checks are hard to locate when several alarms appear together.\n\nRecent faults have been isolated and slow: a single fan sensor drifted, or one track circuit briefly reported an occupied block. Engineers identified each problem before dispatchers changed traffic patterns. A planned software migration, however, creates a known window in which corrupted data could affect ventilation, train location, and smoke detection simultaneously. During peak service, a plausible sequence of alerts could force a controller to issue routing and fan commands within seconds. If the displays falsely suggest both a stalled train and spreading smoke, the first decisions may place additional trains or passengers in danger. Engineering staff might diagnose the false data minutes later, after the operational consequences can no longer be promptly reversed.","scenario_title":"Conflicting Tunnel Telemetry","vocabulary_separation_audit":"Uses tunnel ventilation, track circuits, dispatch, telemetry, and train routing, sharply separating it from the direct case's corporate-payment language."},{"alternative_route_blocks":[],"case_id":"E14A022__NEAR_MISS","case_type":"ONE_LITERAL_NEAR_MISS","domain":"Urban rail tunnel operations","intended_route_id":"B1","omitted_condition_id":"b005_a08_b005_a08_c2","remedy_leakage_audit":"The statement explicitly identifies the missing capability solely as diagnostic evidence; it does not propose creating that capability or recommend any remedial action.","route_evidence":[{"condition_id":"b005_a08_b005_a08_c2","intended_status":"CONTRADICTED","scenario_evidence":"The new contractor team explicitly lacks any method, instruction, training, or prior knowledge for distinguishing coordinated false readings from genuine emergencies."},{"condition_id":"HR1","intended_status":"SATISFIED","scenario_evidence":"The stronger coordinated telemetry event remains foreseeable, and initial commands could cause irreversible harm before outside engineers correct the interpretation."}],"scenario_text":"A newly contracted control team will supervise an older metropolitan rail tunnel during overnight maintenance. The team can operate trains and ventilation under ordinary conditions, but it has no method for recognizing coordinated false telemetry. Its manuals assume that displayed train positions, smoke alarms, and fan-status signals are accurate. The controllers have received no instruction about corrupted readings, know of no independent comparison source, and bring no prior experience that would help them distinguish fabricated indicators from a real emergency.\n\nPast equipment faults affected one device at a time and were resolved by off-site engineers. The upcoming integration of legacy sensors with a new control gateway creates a documented possibility that several believable readings could become wrong at once. If the screens simultaneously show a disabled train, smoke moving through the tunnel, and failed exhaust fans, controllers must issue routing and ventilation commands within seconds. Those commands could send a maintenance consist toward workers or draw smoke toward an occupied platform. Remote engineers may uncover the data error minutes later, but the first full event could already have produced consequences that a correction cannot quickly undo.","scenario_title":"Unfamiliar Legacy Control Gateway","vocabulary_separation_audit":"Retains the transfer case's rail-control complexity and terminology while varying the crew, maintenance context, gateway, and consequences; it remains distinct from the finance domain."}],"experiment_id":"eoa_inverse_innovation_exp14_applicability_retrieval40_20260813","sample_id":"E14A022","schema_version":1}