Scope-Boundary Stress Test¶

Boundary stress test — instantiates Incompatible Requirement Set Resolution

Pushes each commitment to the edges of where it is meant to apply, to reveal whether the incompatibility is genuine or an artifact of over-broad scope that a sharper boundary would dissolve.

Many "impossible" requirement sets are not impossible at all — they only look that way because two commitments are each stated more broadly than anyone actually intends, so their scopes overlap where they were never meant to. Scope-Boundary Stress Test attacks exactly this. It takes each commitment and pushes it to the edges of its intended domain — which data, which users, which jurisdiction, which time window, which operating mode — asking at each boundary whether the conflict still bites. Its defining move is to treat the commitments' scope and meaning as the variable, not their values: where a sensitivity sweep asks "does the conflict survive if the numbers change," this asks "does the conflict survive once we say precisely what each promise covers." Often it dissolves — the incompatibility was an equivocation, and a crisp boundary makes both commitments jointly satisfiable in their proper scopes.

Example¶

A fintech's data platform carries two commitments that read as a flat contradiction: honor a user's right to erasure on request, and retain complete transaction records for the audit trail. Stated baldly — "delete everything the user asks us to" versus "keep every record" — they cannot both hold, and the team has been treating it as a genuine incompatibility requiring one to be sacrificed.

The stress test pushes each to its scope boundary. Erasure is examined at its edges: does the right, as written, actually extend to records a law requires the firm to keep? Under the GDPR's right to erasure, it does not — Article 17 carves out an explicit exception where retention is needed to comply with a legal obligation.^[1] Retention is pushed the other way: does the audit obligation truly cover marketing preferences and profile fields, or only the financial transaction records? It covers only the latter. Once both boundaries are drawn, the overlap where they collide shrinks to nothing: erase profile and marketing data on request; retain the legally-mandated transaction records and tell the user why. The "incompatibility" was two over-broad scopes; naming the boundaries precisely made the set jointly satisfiable, with no commitment truly sacrificed.

How it works¶

The method interrogates the edges of each commitment rather than its interior:

Restate each commitment with an explicit scope. Force the vague "we always X" into "we X for this population, this data, this condition" — the act of writing the boundary is where hidden breadth surfaces.
Push to the boundary cases. Probe the edge regions — the record that is both erasable and legally retained, the user in two jurisdictions, the mode nobody specified — and ask whether both commitments are really meant to reach that far.
Test whether the conflict is boundary-only. If the incompatibility lives entirely in an overlap that neither commitment genuinely intends to cover, sharpening the scopes removes it; if it persists even under the tightest defensible scopes, the conflict is real and must be resolved by relaxation or choice.
Publish the sharpened set. Emit the commitments with their newly-explicit boundaries, and the reduced set of commitments actually in force in each region.

Tuning parameters¶

Scope granularity — how finely boundaries are drawn — per-jurisdiction, per-data-field, per-user-state. Finer scoping dissolves more spurious conflicts but multiplies cases and can become unmaintainable hair-splitting.
Edge aggressiveness — how extreme the boundary cases probed are. Aggressive edges expose latent conflicts early; timid ones leave nasty corner cases for production to find.
Defensibility bar — how much narrowing counts as legitimate versus gerrymandering. A scope narrowed only to escape a conflict, with no principled justification, is a hidden relaxation in disguise.
Semantic vs. structural framing — whether boundaries are drawn by meaning (what the promise means) or by system structure (modules, tables, regions), which changes where the cut naturally falls.
Freeze point — whether the sharpened scopes are locked as authoritative or left provisional pending review, trading stability against the risk of premature commitment.

When it helps, and when it misleads¶

Its strength is that it recovers feasibility for free when the conflict was never real — no commitment weakened, just its reach made honest — and it hardens the surviving requirements by replacing vague universals with boundaries that survive the corner cases.^[1] It is often the cheapest resolution available, and the one that leaves the fewest losses to publish.

Its danger is that the same move that dissolves a false conflict can disguise a real one: quietly narrowing a commitment's scope until the collision disappears is a relaxation wearing the costume of a clarification, and the promise the world thought it had is silently smaller. It can also fragment a clean requirement into an unmaintainable thicket of special cases. The classic misuse is to gerrymander the boundary around whichever outcome was already wanted. The discipline is to require an independent justification for every narrowing — the scope must be defensible on its own terms, not merely because it escapes the conflict — and to route any narrowing that a stakeholder would experience as a lost guarantee back through relaxation and an explicit decision, not to bury it as a definition.

How it implements the components¶

Scope-Boundary Stress Test realizes the scope-and-meaning machinery of the archetype — the parts that pin down what each commitment actually covers:

commitment_semantics_and_scope — its core work: converting each vague promise into an explicit statement of the population, data, and conditions it applies to, tested at the edges.
commitment_set — by resolving which commitments genuinely reach a given region, it refines which commitments are actually in force where, sharpening the set the rest of the resolution reasons over.

It varies the scope and meaning of commitments, not the uncertain input values a verdict rides on — that is Scenario Sensitivity Sweep; nor does it run the feasibility model or extract the conflicting core, which are Constraint-Satisfaction Solver Pass and Minimal Unsatisfiable Core Extraction.

Instantiates: Incompatible Requirement Set Resolution — it distinguishes genuine incompatibilities from scope artifacts and hands on a sharpened commitment set.
Sibling mechanisms: Scenario Sensitivity Sweep · Compatibility Matrix · Requirements Traceability Matrix · Proof Checking · Constraint-Satisfaction Solver Pass · Constraint Relaxation Experiment · Pareto Frontier Analysis · Stakeholder Frontier Review · Impossibility-Theorem Instantiation Review · Minimal Unsatisfiable Core Extraction · SAT/SMT Satisfiability Check · Weighted MaxSAT or Soft-Constraint Optimization · Decision Record with Residue

Notes¶

A dissolved conflict and a hidden relaxation look identical in the final artifact — both end with narrower scopes and a feasible set. The difference is entirely in the justification: a genuine scope fix has a reason that would stand even if there were no conflict, while a disguised relaxation only exists to make the conflict go away. Recording that justification is what keeps this mechanism from becoming a quiet way to break promises.

References¶

[1] Lex specialis derogat legi generali — the interpretive principle that a specific provision governs over a general one where they overlap. It is the legal instance of this mechanism's general move: an apparent conflict between a broad commitment and a narrow one resolves once the broad one is read as not reaching into the narrow one's domain. The GDPR's Article 17 erasure exception for legal-retention obligations is one such carve-out; the mechanism generalizes the move beyond law to any over-broad commitment. ↩