# Interrogation mind-map: JPL_AUTONOMY_EDL_04

Nodes: 120 | questions: 48 | grounded claims: 40 | gaps: 32

## Questions

- **[identification]** State the operational definition of the counterfactual: for a high-autonomy mission that survived a fault, what is the explicitly specified next-best LOWER-autonomy implementation it is compared against, and from which primary records (TechPort anchor plus design documentation for an actually-flown lower-autonomy analogue) is that substitute's recovery behavior costed, rather than inferred from spacecraft that merely score lower on the ordinal autonomy index? (raised by fogel)
- **[empirics]** Before the data are touched, what are the upper and lower bounds on the autonomy hazard ratio that the assembled NTRS/GAO/JPL episode population can actually support given its realized number of mission-ending losses, and at what event count does the estimable bound become so wide it cannot discriminate H1 from H0, reducing the contribution to an unlicensed slogan? (raised by fogel)
- **[mechanism]** What is the measured shadow price of recovery time in the data: does survival depend on autonomy through the time-to-resolve channel (faster onboard isolation beating the light-time-plus-ground-cycle clock), and can you show from fault-entry-to-resolution timestamps in the JPL/NTRS records that the autonomy effect runs through reaction time saved rather than through unobserved program quality correlated with both autonomy and survival? (raised by fogel)
- **[economics]** The dissertation repeatedly calls the autonomy hazard ratio 'the direct analogue of the social saving,' but a social saving is the COST of performing the same task by the next-best means with output held fixed, not a survival probability. For the assembled fault episodes, can the missing cost leg be constructed: for each recovered high-autonomy episode, the documented ground-loop recovery cost (operator-hours, DSN/tracking-pass time consumed, days of mission downtime) the next-best lower-autonomy design would have incurred to recover the SAME fault to the SAME end state? Do the NTRS/GAO/JPL records actually carry recovery-cost fields, or is the central Fogelian 'social saving' claim unbacked, reducing the contribution to a bare survival association? (raised by fogel)
- **[empirics]** The dependent variable is binary terminal survival with time entering only as the survival clock, yet the railway social-savings literature found that time SAVED, not outcome avoided, drove most measured benefit. Can the autonomy benefit be partitioned into a survival channel (fewer losses) and a time-to-resolve channel (faster return to nominal among survivors), and the distribution of fault-entry-to-recovery durations reported by autonomy level? If autonomy's measurable effect lives mostly in recovery TIME among survivors rather than in the rare loss tail, the loss-hazard estimand is measuring the wrong margin, and the corpus timestamps can settle which margin carries the signal. (raised by fogel)
- **[rival]** Every mission-ending loss is treated as one homogeneous terminal event and priced against a partial, single-vehicle counterfactual. Fogel's market-access critique is that a partial counterfactual systematically misstates value by omitting general-equilibrium channels. Can the assembled episodes be coded for whether the loss externality is localized (single-vehicle, deep-space, no downstream consequence) versus reallocation-bearing (a lost relay, constellation node, or shared-asset failure that degraded OTHER missions, or a debris-generating event)? If documented losses differ in off-vehicle consequence, a uniform loss-hazard treats a contained deep-space loss and a systemically-coupled loss as identical and mis-aggregates the social saving; does the corpus support that stratification? (raised by fogel)
- **[mechanism]** Will you test the proportional-hazards assumption in h0(t)*exp(beta*autonomy) as a substantive structural claim, by partitioning scaled Schoenfeld residuals by autonomy level and showing whether autonomy-stratified baseline survival curves are parallel-up-to-a-multiplier rather than crossing or diverging, since a recovering spacecraft is a stock-and-flow system whose high- and low-autonomy episodes should trace different baseline trajectories? (raised by forrester)
- **[measurement]** Can the four named sources (NTRS, GAO, JPL anomaly records, TechPort) reconstruct the within-episode state path, the sequence and timing of autonomous actions and state responses during a fault, for enough episodes to fit even a coarse stock-and-flow recovery model as a rival to the Cox reduction? If the records only support entry-time, end-state, and duration, concede on the record that the data cannot distinguish the hazard-ratio story from a structural-recovery story. (raised by forrester)
- **[identification]** Will you specify and estimate at least one model in which autonomy and the ground-loop (one-way-light-time) delay enter as interacting feedback, e.g., an autonomy-by-light-time interaction with the autonomy effect allowed to grow as the delay lengthens, and show whether the protective effect is endogenous to the loop structure rather than a fixed multiplier? If the hazard ratio is stable across light-time regimes, the deep-space rationale for autonomy is unsupported by the model; if it is not stable, a single proportional-hazards coefficient is the wrong summary. (raised by forrester)
- **[identification]** Autonomy is treated as exogenous treatment with program quality as a scalar confounder absorbed by conditioning on complexity and cost. The rival: a risk-averse program is a balancing loop that simultaneously raises autonomy investment AND tightens abort thresholds, margin, and fault-test rigor, so autonomy and post-fault survival are two co-outputs of one latent risk-posture regime. Specify the stock-and-flow / simultaneous-equation structure needed to separate the lever from the regime (latent regime stock = program risk aversion; two measured outflows = autonomy level and abort/margin/test stringency), and show whether NTRS, GAO, JPL anomaly records, and TechPort record a requirements-stringency or margin-policy variable at mission level at all. Concede if the Cox specification cannot represent a co-produced-regime rival. (raised by forrester)
- **[empirics]** The regime rival yields a concrete falsifier from the candidate's own population: a LOW-autonomy program with the same conservative posture (wide margins, aggressive aborts, heavy fault-injection) should survive as well as a HIGH-autonomy program, because survival tracks the regime not the autonomy arm. Can you partition coded episodes by an independently-coded stringency proxy and test, within a fixed autonomy level, whether survival still varies with stringency, and whether stringency-matched high- vs low-autonomy episodes have indistinguishable hazard? State whether a stringency proxy is independently codable per episode from NTRS/GAO/JPL/TechPort, or whether stringency and autonomy are so collinear in the sources that the regime rival is unfalsifiable with these data. (raised by forrester)
- **[rival]** Even granting HR<1 survives conditioning, where on the causal structure does the estimate license a manager to ACT? Sec 6.1 invites buying down one autonomy level against the estimated hazard reduction. But if autonomy is a symptom of a co-determined regime, the hazard ratio is a coefficient on one output of that regime and is not a transferable lever: adding autonomy software without the conservative margin/abort/test posture should yield little benefit, while adopting the posture without the autonomy arm yields most of it. Can the design distinguish the transferable-lever from the regime-symptom interpretation of the same hazard ratio, and if the four sources cannot identify which holds, will you state in the contribution that the estimate is a within-regime association of unknown transferability rather than an architecture-trade input? (raised by forrester)
- **[measurement]** Before any hazard ratio, show the catalog hygiene: of the candidate fault episodes assembled, how many survive an independent second-reader re-coding of the fault-entry event itself, and what is the reported inter-coder kappa on (a) the fault-entry timestamp and (b) the recovery-versus-mission-ending-loss end-state classification? A catalog whose entries cannot be reproduced by a second coder cannot ground a survival model. (raised by mcdowell)
- **[empirics]** The dependent variable is mission-ending loss conditional on fault entry, yet silently-handled or never-escalated episodes are absent from the sources and the tracking floor is set by reporting venues, not by what occurred on orbit. Quantify that floor: across missions where the true number of safe-mode entries can be independently reconstructed (releasable telemetry / ops logs), what fraction of actual fault episodes appear in NTRS, GAO, and JPL releasable records, and how does the recovery-versus-loss distribution of captured episodes differ from the reconstructed full set? (raised by mcdowell)
- **[identification]** Classified/small missions are systematically missing and flagship deep-space missions over-represented, and these are exactly the high-autonomy, large-distance cases that drive the treatment. Bound that selection bias: what is the autonomy-level and distance-regime composition of the missions whose anomaly records were never releasable, and what does a worst-case Manski-style nonparametric bound or tipping-point sensitivity on the unreleasable stratum do to the SIGN of the autonomy hazard ratio? (raised by mcdowell)
- **[measurement]** On the subset of missions covered by two or more of the four registers (NTRS, GAO, JPL anomaly records, TechPort), what fraction of fault episodes appear in all overlapping sources versus only one, and what is the inter-source agreement on the three quantities that define the survival object: fault-entry timestamp, end-state classification (recovery vs mission-ending loss), and autonomy level? (raised by mcdowell)
- **[identification]** Show fault episodes coded per spacecraft-year as a time series by launch epoch and demonstrate the autonomy variable is not confounded with the catalog's own improving completeness over time, since safe-mode logging granularity, ISA reporting, and TechPort all postdate the earliest missions and later missions are both higher-autonomy and better-recorded. (raised by mcdowell)
- **[measurement]** Name the independent register of record against which the reader-coded autonomy score can be externally validated for a held-out subset of missions, reconciled against an as-flown fault-protection capability description authored before and independent of the anomaly record, and report the agreement rate. (raised by mcdowell)
- **[measurement]** Your treatment scale is a single ordinal ordered by how much of the detection-isolation-recovery chain runs without a ground command cycle, entered in Cox as one monotone coefficient read per level. But the out-of-the-loop result (Kaber & Endsley 2004) predicts harm that is non-monotone in delegation: at intermediate autonomy the ground team has ceded enough of detection-isolation to lose practiced recovery skill and situation awareness yet must still take over when onboard logic mis-diagnoses. A monotone hazard coefficient averages over that middle. Will you test the inverted-U directly with ordered dummies or a quadratic, and do you have enough mid-scale episodes per mission-class stratum to identify a middle-level hazard bump? (raised by parasuraman)
- **[mechanism]** Your autonomy score collapses onboard detection, isolation, and recovery into one ordered level on the premise that they advance together along the chain. The Parasuraman-Sheridan-Wickens stage model holds that automating information analysis (isolation) versus action implementation (recovery) has opposite human-performance signatures: auto-isolate-but-wait-for-ground keeps a human in the decision loop, whereas auto-recover removes them. Can you code your TechPort-and-NTRS-anchored score as three separate stage indicators rather than one composite, and is the documentation rich enough to populate them, so the model can show whether any survival benefit comes from automated diagnosis, automated recovery action, or only their bundle? (raised by parasuraman)
- **[measurement]** Your dependent variable is time from fault entry to recovery-or-loss, and you read a lower hazard as autonomy protecting the mission. But under the out-of-the-loop mechanism an intermediate-autonomy spacecraft that mis-diagnoses can recover faster to a wrong configuration or a deeper fault state, so faster transit out of the initial safe mode is not the same as better survival. Does your event coding distinguish a confirmed clean recovery to nominal from an autonomous reconfiguration that masked or compounded the fault, and can the JPL anomaly and ISA records you cite resolve cases where onboard recovery action was itself implicated in the eventual loss, so a commission-error episode is not miscounted as a censored recovery? (raised by parasuraman)
- **[rival]** Is the low-autonomy comparison arm (the human ground loop) itself an automated-monitoring-plus-operator system with non-constant reliability, so that the estimated autonomy benefit is the mirror image of a degrading human backstop (complacency/disuse) rather than capability in the high-autonomy arm? Can a ground-loop responsiveness measure (anomaly-telemetry-to-first-correct-operator-action time, plus recent-recurrent-safing desensitization) be constructed from NTRS/JPL incident records? (raised by parasuraman)
- **[measurement]** Does a single monotone autonomy coefficient (H1) conflate the reduction in omission errors with the increase in commission errors that higher decision-and-action-implementation autonomy introduces, and can the flown fault-management monitor's false-alarm/miss posture (detection threshold, nuisance-trip and misdiagnosis history) be coded per high-autonomy episode and entered as a covariate so the data can separate the two? (raised by parasuraman)
- **[identification]** Can an operations-tempo or concurrent-load index at fault entry (workload, vigilance, fatigue, shift-handover state) be recovered from NTRS/GAO/JPL records and shown not to confound the autonomy term, given that high-autonomy missions and high-tempo operational moments are plausibly correlated and the protective effect could be a less-loaded ground team rather than a more-capable spacecraft, beyond the static complexity/distance/age controls? (raised by parasuraman)
- **[identification]** Conditioning on fault-episode entry is selection on a treatment-caused node: autonomy -> recorded-entry <- unobserved severity, with recorded-entry also a child of autonomy (silently-handled episodes under-recorded, Sec. 3.5). Draw the DAG and name an observed adjustment set that d-separates autonomy from loss given conditioning on entry; if none closes the collider path, say so rather than report a hazard ratio. (raised by pearl)
- **[identification]** Distance and complexity are named as confounders to adjust away (Sec. 4.2), but they are also the regimes autonomy is DESIGNED to exploit (EDL, long light-time, Sec. 1.4/6.1), so they may be mediators of autonomy's protective effect. Give the graphical test that separates a back-door path (autonomy<-distance->loss) from a mediated path (autonomy->distance-regime-exploited->loss) for each control, and confirm the adjustment set blocks only the former. (raised by pearl)
- **[empirics]** The single time-invariant beta_1 encodes that autonomy's effect on the loss hazard is constant in time-since-entry, but the Talebian frame (Sec. 5.3/6.2) predicts tail-concentration: benefit largest in the shortest-reaction-time episodes, i.e. early on the post-entry clock, a time-varying treatment effect, hence a PH violation for the TREATMENT variable. Which conditional-independence / Schoenfeld-residual tests run specifically on beta_1 will confirm time-homogeneity, and what early-vs-late hazard divergence falsifies the single coefficient and forces a time-stratified estimand? (raised by pearl)
- **[identification]** Add a node R = the program's risk-tolerance / requirements-stringency regime (NASA payload risk classification Class A-D, design-margin and fault-tolerance requirements, abort-and-disposal policy). R is a common cause pointing BOTH into the treatment (R -> autonomy investment) and into survival through a channel that never touches autonomy (R -> hardware margin / redundancy depth / safe-mode-vs-disposal policy -> mission-ending loss). Show this R -> loss path stays OPEN inside a perfectly held-fixed autonomy stratum, so it is not closed by the Sec. 4.2 conditioning on complexity, distance, and age. Then: is R the SAME node as the already-signed 'overall program quality', or distinct? It is distinct only if at least one R -> loss path bypasses every variable program-quality is a proxy for. Name that path. (raised by pearl)
- **[measurement]** Give the back-door adjustment set that d-separates autonomy from mission-ending loss in the presence of R, then test it against the data inventory: which observed variable, codable from EXACTLY the four named sources (NTRS, GAO, JPL anomaly records, TechPort), is a faithful proxy for R = risk-classification / margin-requirements regime, as opposed to a proxy for complexity or cost class? If risk class and margin-policy requirements are not separately recorded in any of the four sources, R is unmeasured and co-causes the treatment, so declare the autonomy hazard ratio NON-IDENTIFIED on regime-confounding grounds, a result separate from the selection-on-fault-entry non-identification. State which it is. (raised by pearl)
- **[identification]** Conditional on R unmeasured: Sec. 4.2 already rejected every instrument for autonomy (era, budget) for violating exclusion. Restate that rejection against R: does any variable move autonomy investment yet stay excludable from R (d-separated from loss given autonomy, not a child/parent of R) anywhere in NTRS/GAO/TechPort, e.g. a TRL-maturation timing shock that shifts what autonomy was flyable without shifting the mission's risk class? Or can the front-door criterion rescue identification: is there a fully mediating onboard mechanism (detection -> isolation -> recovery within the fault episode, from JPL state logs) that is itself unconfounded by R, so P(loss|do(autonomy)) is recovered through the mediator even with R open? Answer which, if either, the four sources can instantiate. (raised by pearl)
- **[identification]** Specify the manipulation defining Y_i(1)/Y_i(0) at the fault-episode level. If the only honest manipulation is 'this program built one autonomy level higher,' the unit is the program not the episode, and conditioning on fault entry conditions on a post-treatment variable. Can you exhibit two episodes matched on every coded covariate differing only in the autonomy score, or does every autonomy contrast also move complexity, era, and program richness in lockstep? (raised by rubin)
- **[empirics]** Estimate the propensity (ordinal autonomy on complexity, distance, age) and report covariate overlap/common support across autonomy levels, plus the R-squared of autonomy on the controls. If overlap is empty or the controls explain most autonomy variation, the within-stratum Cox contrast is extrapolation past support, not adjustment. Which is it in your data? (raised by rubin)
- **[measurement]** Run the blinding experiment: have a coder blinded to each episode's end state score autonomy from documents stripped of post-fault narrative, and compare to the outcome-aware score. What is the measured agreement between outcome-blind and outcome-aware autonomy codings, and does the disagreement correlate with end state? (raised by rubin)
- **[measurement]** SUTVA no-hidden-versions: enumerate the distinct fault-management architectures placed at each ordinal autonomy level, with per-level count and within-level architectural variance, to establish the levels are well-defined treatments (versions) and not bags of materially different interventions whose post-fault potential outcomes differ. (raised by rubin)
- **[identification]** SUTVA no-interference: recurrent episodes on one spacecraft mean a first safe-mode entry can change flight software, the operators' model, or the autonomy configuration, so earlier episodes alter the treatment realization and potential outcomes of later ones. Using the assembled timelines, quantify how often between-episode fault-management changes (patch, reconfiguration, operational learning) occurred for multi-episode missions, and restate the estimand to respect that episode-level potential outcomes are not independent of earlier episodes' treatment. A clustered/frailty variance estimator does not repair an interference-violated estimand. (raised by rubin)
- **[empirics]** Outcome-side design-blinding: who adjudicated each episode's end state (confirmed recovery vs mission-ending loss) and its fault-entry-to-resolution timing/censoring, and was that adjudication blind to the autonomy score? Report the coding protocol's separation: distinct coders, sealed treatment labels during outcome coding, and inter-rater agreement on end-state and on event-time specifically, not on the autonomy score. (raised by rubin)
- **[empirics]** Show, from a feasibility computation on the actual assembled NTRS/GAO/JPL episode counts, the minimum number of tail events the hardest-episode stratum will hold, and demonstrate the tail-benefit conclusion cannot be flipped by adding, removing, or recoding a single tail event. (raised by taleb)
- **[measurement]** Can you partition coded episodes by terminal-event externality (localizable single-vehicle loss vs systemic debris-generating/congested-shell loss), and show whether NTRS anomaly narratives and GAO assessments record enough detail to make that partition, or whether the data are structurally blind to the systemic tail the Talebian section claims to care about? (raised by taleb)
- **[governance]** From the structure of your own sources, can you show whether the missions whose documentation produced the autonomy scores were authored by parties exposed to the downside of the loss, or by the same engineering organizations whose autonomy investment is being evaluated, and does that authorship asymmetry make your favorable upper-bound estimate precisely the cheap assurance the skin-in-the-game filter is designed to discard? (raised by taleb)
- **[mechanism]** Replace the monotone hazard ratio exp(beta_1) with a SECOND-order response: construct a stressor-dose axis (severity, one-way-light-time, reaction-time-available, fault-cascade depth) and estimate via an autonomy-by-dose interaction or spline whether the marginal protective effect of one autonomy level RISES (convex = antifragile, benefit accelerates in the worst episodes) or FALLS (concave = fair-weather control that decays at the tail), and show the event count can resolve that curvature, not just the average. (raised by taleb)
- **[measurement]** The Sec 3.5 concession that faults 'silently handled and never escalated' are under-recorded is treated as truncating only the low-severity end, but the silently-handled episode IS the autonomous save, the realization where high autonomy resolved a fault before any written anomaly record. Treating absence-of-record as absence-of-episode undersamples precisely the (high autonomy, fast clean recovery) cell H1 needs. Measure it directly: on missions with telemetry-reconstructable safe-mode entries (independent of whether a narrative report was filed), estimate the fraction of true autonomous fault-handling events that generated NO codable record, broken out by autonomy level, and test whether recording probability itself correlates with autonomy. (raised by taleb)
- **[rival]** The design treats autonomy as a protective intervention added on top of the vehicle and codes terminal events only as recovery-vs-loss. Via negativa forces the opposite question: what fragility does autonomy ITSELF introduce? An onboard action that misdiagnoses, reconfigures into a worse state, or masks a developing fault until unrecoverable is an iatrogenic loss CAUSED by autonomy, yet lands in the same 'mission-ending loss' bucket. Partition loss episodes into (a) loss despite autonomy's correct-but-insufficient action, (b) loss where ground intervention was foreclosed/delayed BY the autonomous response, (c) loss where an autonomous action is the documented proximate aggravating cause, and report whether the autonomy-loss cell concentrates in (b)/(c). Without it the estimator cannot tell protective autonomy from one that merely transfers the failure mode from slow-and-recoverable to fast-and-absorbing. (raised by taleb)
- **[measurement]** Name the matched pairs: produce from NTRS+JPL records a set of high- and low-autonomy fault episodes genuinely comparable on complexity, distance regime, and age; count how many such matched pairs exist in the assembled population; show whether that number can carry a pooled hazard ratio or collapses to a handful of incomparable cases. (raised by yin)
- **[rival]** For the hardest rival, program quality, point to specific fault episodes where a high-autonomy and a low-autonomy spacecraft of demonstrably comparable program quality faced comparable faults, and show the survival difference tracked autonomy not quality, rather than asserting from the coefficient's sign that residual bias is bounded. (raised by yin)
- **[identification]** State the generalization claim exactly: does the hazard ratio estimate a parameter for the universe of robotic missions (statistical) or test a theoretical proposition about autonomy in a narrow stratum (analytic), and show from the coverage table how many spacecraft and distinct mission classes contribute events. (raised by yin)
- **[rival]** State the program-quality/requirements-stringency regime as a POSITIVE rival theory (survival produced by conservative go/no-go and abort criteria, margin policy, test depth, review-gate count/severity; autonomy a co-selected MARKER not the lever). Write the ONE observable prediction this rival makes that H1 does NOT: within a single autonomy level survival still tracks independently-coded stringency, and high-autonomy mission-ending losses cluster in the weakest-stringency programs. If the prediction is not mutually exclusive from H1's you have renamed the rival, not addressed it. (raised by yin)
- **[identification]** From NTRS + GAO + JPL anomaly records + TechPort, name specific fault-episode PAIRS where a high-autonomy and a low-autonomy spacecraft of comparable complexity, distance regime, and age faced a comparable fault, and the two programs differ in documented requirements-stringency, and show whether survival tracks autonomy or stringency. If you cannot assemble even a handful of named stringency-discriminating pairs, the population coefficient cannot distinguish lever from marker and the rival is unmeasured, not ruled out. (raised by yin)
- **[measurement]** State whether NTRS, GAO, JPL anomaly records, and TechPort can code a requirements-stringency-regime ordinal SEPARATELY from the autonomy score (built from review-gate count, abort-criteria conservatism, margin policy, test depth, independent of the detect-isolate-recover coding). If separable, add it to the Cox model and report whether beta_1 survives. If NOT separable - if stringency and autonomy are documented by the same offices in the same documents so a second reader cannot disentangle them - concede autonomy is constitutively confounded with the regime that selected it, the unit of value-attribution is the regime not the onboard system, and the dissertation cannot answer the program-manager autonomy-investment question it claims to. (raised by yin)

## Grounded claims

- **[identification]** The candidate CONCEDES Fogel's distinction rather than meeting it. The design does NOT construct or cost a specific next-best lower-autonomy substitute spacecraft from primary records; its operational counterfactual is a within-stratum Cox comparison of 'comparable fault episodes that differ in autonomy level,' which the dissertation itself calls 'the operationalized analogue of Fogel's explicit no-railroad world' but explicitly downgrades to 'a conditional association defended as causal, not a randomized causal effect' and 'a weaker counterfactual than a randomized experiment.' The treatment variable is an admittedly 'ordinal and coarse' TechPort-scored autonomy index read 'per autonomy level, not per unit'; recovery behavior of the comparison is therefore inferred from lower-scoring episodes, exactly the reweighting Fogel flags, not costed from a named flown analogue. So the costed substitute Fogel demands is absent by the candidate's own admission.
    - JPL_AUTONOMY_EDL_04 dissertation (Ch2-Ch5, identification strategy), dissertation.md | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
    - Hall of Shoulders fogel brain dossier (review lens, falsifiable questions) | file:///D:/Claude_Code/brain/collegium/hall_of_shoulders/brains/fogel/ | grade C
    - Fogel, Railroads and American Economic Growth: Essays in Econometric History (1964) | https://doi.org/10.2307/2552284 | grade B
- **[empirics]** The candidate concedes the design is 'feasibility-limited rather than precision-rich,' that effective sample size is governed by the event count (terminal losses), not the episode count, that 'the most likely realized condition is one in which the event count is near or below the four-covariate floor,' and pre-registers an event-count floor gate plus Firth-penalized and reduced two-covariate (autonomy+distance) fallbacks. It specifies a power computation of the minimum detectable hazard ratio given realized event count. But it DELIBERATELY reports no numeric upper/lower HR bound and no numeric feasibility floor, because the realized terminal-event count is unknown at the design stage ('the chapter specifies the computation rather than its result'). So the bounded estimate Fogel demands does not exist in the retrieved material.
    - JPL_AUTONOMY_EDL_04 dissertation (Ch5-Ch6 power/feasibility, Firth penalization, reduced model), dissertation.md | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
    - Andersen & Gill, Cox's Regression Model for Counting Processes: A Large Sample Study, Annals of Statistics (1982) | https://doi.org/10.1214/aos/1176345976 | grade A
- **[mechanism]** The candidate NAMES the time-saved channel as its causal story ('higher onboard autonomy lets the detection-isolation-recovery chain execute without waiting for a ground command cycle, which produces faster, light-time-independent resolution') and records fault-entry UTC timestamps and dwell time, but performs NO shadow-price-of-time, mediation, or time-channel test: 'time-to-resolve,' 'shadow price,' 'mediator,' and 'mechanism channel' are absent from the dissertation. Distance enters only as a coarse ordinal three-band regime (near-Earth / cislunar / interplanetary), not a clock that times resolution against light-time. The design collapses the mechanism into a single hazard ratio and explicitly concedes program quality is the most plausible confounder and is only 'partially absorbed,' handled by SIGNING the residual bias, not by separating the reaction-time channel from program quality. So the measured time-mechanism Fogel demands does not exist; the autonomy effect cannot, in this design, be shown to run through reaction time saved rather than program quality.
    - JPL_AUTONOMY_EDL_04 dissertation (mechanism narrative, distance-regime coding, program-quality confounder treatment), dissertation.md | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
    - Hall of Shoulders fogel brain dossier; Leunig, Social Savings, Journal of Economic Surveys (2010) | https://doi.org/10.1111/j.1467-6419.2010.00636.x | grade A
- **[economics]** AUDIT VERDICT: the corpus carries NO recovery-cost fields, so the 'social saving' label is a rhetorical analogy, not a measured quantity. The candidate's assembled material is a 134-record reference bibliography (fields: key/title/authors/year/venue/doi/url/abstract/grade/theme/source) plus a 758-row RAG store (fields: chunk_id/kind/title/text/source/ref/grade); neither carries an episode-level operator-hour, DSN/tracking-pass, dollar, or mission-downtime field. The canonical estimating equation has exactly four covariates h_i(t)=h_0(t)*exp(b1*autonomy + b2*complexity + b3*distance + b4*age); none is a recovery cost. The dissertation itself only ASSERTS the equivalence ('The hazard ratio on the autonomy variable ... is the direct analogue of the social saving') without a costed counterfactual recovery. Fogel's own standard (the railroad social saving = cost of the freight task by canals/wagons at observed rates, output held fixed) is precisely the costed substitute that is absent. The cost leg therefore CANNOT be constructed from the named records, and the contribution, as the corpus stands, reduces to a survival association, exactly Fogel's charge.
    - JPL_AUTONOMY_EDL_04 corpus.jsonl field census + jpl_autonomy_edl_04.db schema (docs table) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/corpus.jsonl | grade C
    - JPL_AUTONOMY_EDL_04 dissertation.md (Sec 2.2 lines 332, 340; Sec 4 variable inventory lines 256-272) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
    - Fogel, Railroads and American Economic Growth: Essays in Econometric History (1964) | https://doi.org/10.2307/2552284 | grade B
    - Leunig, Social Savings, Journal of Economic Surveys (2010) | https://doi.org/10.1111/j.1467-6419.2010.00636.x | grade A
- **[empirics]** AUDIT VERDICT: the raw material for the partition EXISTS but the partition is never performed, so Fogel's margin objection stands on the design's own terms. The dissertation defines time-to-event as 'the duration measured from fault entry to either confirmed recovery to nominal operations, which is treated as censoring, or mission-ending loss, which is treated as the event' (line 256). Recovery is thus modeled only as CENSORING, never as an outcome to be timed: the entire estimand is the loss hazard, and the fault-entry-to-recovery durations among survivors are discarded as censoring times rather than analyzed as a time-to-resolve distribution. No duration distribution by autonomy level, no survival-vs-time-saved decomposition, and no competing-risks treatment of recovery-as-event appears. Because the railway literature (Leunig's 'Time is Money' re-assessment) shows time saved is where most of the social saving lives, modeling only the rare loss margin while censoring away the recovery-time margin risks measuring the smaller component. The timestamps the survival object already requires (fault-entry UTC; recovery time) make the partition constructible in principle; the design simply does not run it.
    - JPL_AUTONOMY_EDL_04 dissertation.md (Sec 4 definitions, lines 256-258, 272) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
    - Leunig, Time is Money: A Re-Assessment of the Passenger Social Savings from Victorian British Railways, Journal of Economic History (2006) | https://doi.org/10.1017/S0022050706000283 | grade A
    - Leunig, Social Savings, Journal of Economic Surveys (2010) | https://doi.org/10.1111/j.1467-6419.2010.00636.x | grade A
- **[rival]** AUDIT VERDICT: the loss event is defined homogeneously and the corpus carries NO off-vehicle externality field, so the stratification Fogel demands cannot be coded from the assembled records. The dependent-variable event is 'Permanent loss of the spacecraft or of its primary mission objective, traceable to the fault episode' (line 258), a single undifferentiated terminal state. The episode/reference records carry no relay, constellation-node, shared-asset, downstream-mission-degradation, or debris-generation field (corpus fields are bibliographic; the docs RAG table is chunk-level text). The model's only event is this uniform loss, with no cause-specific or competing-risks split by off-vehicle consequence. The methodological half of Fogel's point is independently supported: heterogeneous terminal events with differing downstream consequence require cause-specific / competing-risks stratification, which is absent here, so a localized deep-space loss and a systemically-coupled relay/constellation/debris loss are scored as identical events. The general-equilibrium reallocation channel, where Fogel's large numbers live, is omitted, and the corpus as assembled cannot supply the stratifier needed to recover it.
    - JPL_AUTONOMY_EDL_04 dissertation.md (Sec 4 line 258) + corpus.jsonl/db field census | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
    - Hall of Shoulders fogel brain dossier (review lens) + Fogel, Railroads and American Economic Growth (1964) | https://doi.org/10.2307/2552284 | grade B
    - Andersen et al., Statistical Models Based on Counting Processes / competing-risks cause-specific hazard regression literature (Crossref: cause-specific transition hazard) | https://doi.org/10.1201/b18695-10 | grade B
- **[mechanism]** The objection is methodologically correct and there is an established, named test that operationalizes exactly what is demanded. The proportional-hazards assumption is testable through the scaled Schoenfeld residuals: a regression of the scaled residuals on a function of time (Grambsch and Therneau, Biometrika 1994) yields a global and per-covariate test of non-proportionality, and a non-zero slope of the residual against time is direct evidence that the baseline hazard shape is not merely being scaled by exp(beta) but is changing differently across covariate levels. The candidate should therefore (a) stratify the Cox fit by autonomy level so each stratum gets its own non-parametric baseline survival curve, (b) plot those baseline curves and inspect for crossing/divergence rather than parallel-up-to-multiplier behavior, and (c) report the Grambsch-Therneau test of the autonomy coefficient against time. This is the correct response because the substantive structural claim (stocks change only through flows, and behavior over time is the integral of inflow minus outflow, so an intervention at minute two alters the inflow-outflow balance governing the stock at minute thirty) means the two regimes are different dynamic systems whose baseline accumulation paths need not be proportional. When proportionality fails, a single hazard ratio is a time-average over a non-constant effect and is the wrong summary.
    - Grambsch & Therneau, 'Proportional hazards tests and diagnostics based on weighted residuals', Biometrika 81(3):515-526 | https://doi.org/10.1093/biomet/81.3.515 | grade A
    - Forrester dossier (Hall of Shoulders / hos-forrester brain): stocks-flows-accumulation concept, 'Stocks change only through flows; behavior over time is the integral of inflow minus outflow'; aggregation discipline ('the stock integrates all of them; re-run your conclusion against the aggregate') | D:/Claude_Code/brain/collegium/hall_of_shoulders/brains/forrester/ (search_brain.py --brain forrester) | grade C
    - Forrester, 'Industrial Dynamics / Dynamic models of economic systems and industrial organizations', System Dynamics Review (reprint commentary), system behavior governed by stocks and the flows that fill/drain them, coupled through information feedback and delays | https://doi.org/10.1002/sdr.284 | grade A
- **[identification]** The test the panelist proposes is well-posed and standard estimation machinery exists to run it, and the logical disjunction the panelist states is the correct decision rule. (1) The ground-intervention delay is, in Forrester's terms, a delayed information-feedback loop: material and information delays between a flow and its effect on a stock generate overshoot and instability, and a balancing loop with a long delay cannot be treated as an exogenous additive condition without losing the very behavior that motivates autonomy. (2) The interaction can be estimated directly: add an autonomy x light-time product term to the Cox linear predictor (optionally as a time-varying covariate), and the protective effect is loop-dependent if and only if that interaction coefficient is non-zero. (3) Whether the autonomy effect is itself non-proportional across light-time regimes is testable with the same scaled-Schoenfeld-residual / time-varying-coefficient diagnostics: when a covariate's effect varies with time or with a regime variable, the constant-hazard-ratio summary from a single Cox coefficient is known to mislead and a time-varying-effect or stratified specification is required (e.g. Bellera et al., BMC Medical Research Methodology 2010, on variables with time-varying effects in the Cox model). Therefore the candidate's own deep-space rationale commits them to estimating the interaction: a stable hazard ratio across light-time regimes would falsify the autonomy-is-more-valuable-at-distance premise, and an unstable one falsifies the single-coefficient summary. The GROUNDED EXPERT cannot, from retrieval, assert which way the candidate's data actually break, only that the interaction model is the correct instrument to settle it.
    - Forrester dossier (hos-forrester brain): 'Material and information delays between a flow and its effect on a stock generate oscillation, overshoot, and instability; humans cannot mentally simulate high-order delay'; balancing-loop / policy-resistance concept | D:/Claude_Code/brain/collegium/hall_of_shoulders/brains/forrester/ (search_brain.py --brain forrester) | grade C
    - Forrester, 'Counterintuitive Behavior of Social Systems' (1971), delayed feedback and the failure of single-lever interventions | https://doi.org/10.1007/bf00148991 | grade A
    - Bellera et al., 'Variables with time-varying effects and the Cox model: some statistical concepts illustrated with a prognostic factor study in breast cancer', BMC Medical Research Methodology 10:20 (2010), when covariate effects vary, the constant hazard ratio misleads; time-varying-effect specification required | https://doi.org/10.1186/1471-2288-10-20 | grade A
    - Grambsch & Therneau, 'Proportional hazards tests and diagnostics based on weighted residuals', Biometrika 81(3):515-526 (1994), scaled Schoenfeld residual test for non-proportionality, applicable to the autonomy x light-time effect across regimes | https://doi.org/10.1093/biomet/81.3.515 | grade A
- **[identification]** The rival is structurally legitimate and the Cox single-equation reduction cannot represent it. In system-dynamics terms a risk-averse program is a balancing (goal-seeking) loop in which a latent regime stock (program risk aversion) drives two correlated outflows: autonomy investment and abort/margin/test stringency. When two observables are co-outputs of one feedback structure, a coefficient on one of them is not a structural effect; intervening on a visible parameter rather than the loop structure is the canonical low-leverage error. To separate the autonomy lever from the regime that produced both arms you must estimate a simultaneous structure: model the latent regime stock with two outflow equations (autonomy; stringency) and an instrument or exclusion restriction that shifts autonomy without shifting the regime. The econometric counterpart is explicit: recovering a causal hazard ratio under treatment endogeneity requires instrumental-variable / structural identification of the Cox model, not the partial-likelihood coefficient, because the proportional-hazards coefficient on an endogenous, self-selected treatment is not the causal hazard ratio. A single-equation Cox model that conditions only on complexity and cost class is therefore structurally blind to a co-produced-regime rival and the candidate should concede this on the record.
    - Forrester, Industrial Dynamics (1961); Counterintuitive Behavior of Social Systems (1971) [forrester dossier, hall_of_shoulders] | https://doi.org/10.1007/bf00148991 | grade A
    - Martinussen & Vansteelandt, 'Instrumental Variable Estimation of the Causal Hazard Ratio,' Biometrics (2022) | https://doi.org/10.1111/biom.13792 | grade A
    - Meadows, 'Leverage Points: Places to Intervene in a System' (1999), articulating a Forrester principle [forrester dossier] | https://doi.org/10.4324/9781849773386-15 | grade A
- **[empirics]** The proposed test is well-posed and is the correct identification test: stratify episodes by an independently coded stringency proxy, hold autonomy level fixed, and test (a) whether hazard varies with stringency within an autonomy stratum and (b) whether stringency-matched high- and low-autonomy episodes have indistinguishable hazard. Indistinguishable hazard after stringency-matching falsifies the autonomy-as-lever reading in favor of regime-as-cause. This is the stock-and-flow falsification logic (separate the two outflows and check whether the slow regime constraint, not the fast autonomy parameter, binds the outcome) and is exactly what the simultaneous-equation / IV framing for an endogenous treatment requires before a hazard coefficient can be read causally.
    - Forrester, Industrial Dynamics (1961); review-lens on separating co-determined flows [forrester dossier, hall_of_shoulders] | https://doi.org/10.1002/sdr.284 | grade A
    - Martinussen & Vansteelandt, 'Instrumental Variable Estimation of the Causal Hazard Ratio,' Biometrics (2022) | https://doi.org/10.1111/biom.13792 | grade A
- **[rival]** A protective hazard ratio that is a symptom of a co-determined risk-posture regime is not a lever a manager can pull in isolation, and the design as specified cannot separate the transferable-lever from the regime-symptom interpretation. This is the leverage-point and policy-resistance result: the obvious visible parameter (buy one autonomy level) is typically low-leverage, and acting on it while leaving the loop structure (the conservative margin/abort/test regime) unchanged can produce little or none of the apparent benefit, because the benefit was generated by the regime, not the parameter. Distinguishing lever from symptom requires identifying variation in autonomy that is independent of the regime stock (an instrument or a stringency-matched comparison) which the single-equation Cox design does not supply. Absent that identification the estimate must be reported as a within-regime association of unknown transferability, not as an architecture-trade input that licenses buying down an autonomy level; the contribution should be downgraded accordingly and the conceded.
    - Forrester, 'Counterintuitive Behavior of Social Systems' (1971) | https://doi.org/10.1007/bf00148991 | grade A
    - Meadows, 'Leverage Points: Places to Intervene in a System' (1999) [forrester dossier] | https://doi.org/10.4324/9781849773386-15 | grade A
    - Martinussen & Vansteelandt, 'Instrumental Variable Estimation of the Causal Hazard Ratio,' Biometrics (2022) | https://doi.org/10.1111/biom.13792 | grade A
- **[measurement]** GROUNDED STANDARD, not an answer to the candidate's specific number: McDowell's discipline makes a precise, reproducible event definition and reconciliation of competing counts the first-order hygiene requirement before any downstream estimate. Just as orbital cataloging fixes stable definitions of 'object,' a fault catalog must fix a reproducible definition of the fault-entry event before a survival model can rest on it. Retrieval contains the requirement (F6 definitional rigor / reconciliation, F1 catalog-as-ground-truth) but NO spacecraft-fault inter-coder kappa for fault-entry timestamp or end-state classification exists in the queried corpora or in the OpenAlex sweep. The kappa is a property of the candidate's own catalog and must be produced by the candidate; it cannot be supplied from the literature.
    - mcdowell dossier (Hall of Shoulders brain hos-mcdowell), frameworks F1/F6 | D:/Claude_Code/brain/collegium/hall_of_shoulders/brains/mcdowell/ | grade A
    - Murtaza et al., LEO satellite security and reliability survey (cited in mcdowell dossier as the census-precondition source) | https://doi.org/10.1109/access.2020.2979505 | grade A
- **[measurement]** McDowell's discipline makes this demand well-founded and gradable: before any coefficient, competing counts from heterogeneous registers must be reconciled, and a candidate proposing an estimate must reconcile catalog completeness across sources (frameworks F6 'reconciliation as the discipline's hygiene' and F1 'the catalog as ground truth'). But no retrieved source supplies the candidate-specific concordance fraction or the per-quantity inter-source agreement rates for the NTRS/GAO/JPL/TechPort overlap set; those are facts about the candidate's own assembled artifact and were not located in any corpus this turn. The methodological standard is grounded; the empirical answer is not, so the question is refused on its empirical content.
    - Hall of Shoulders mcdowell dossier (frameworks F1, F6), built from vault sweep with DOI-bearing anchors | D:/Claude_Code/brain/collegium/hall_of_shoulders/brains/mcdowell/ | grade A
    - OpenAlex works search 'spacecraft anomaly database reconciliation multiple sources fault classification' (top result Aerospace 2026 Jilin-1 KF single-satellite case study, off-target) | https://doi.org/10.3390/aerospace13020116 | grade B
- **[identification]** McDowell's 'trend, not snapshot' framework (F4) and his tracking-floor / catalog-completeness reasoning establish that a hazard ratio estimated over a non-stationary recording regime can be measuring the archive rather than the spacecraft, exactly when detection probability rises with the same era that raises autonomy. This validates question 2 as a first-order identification threat, but supplies only the standard, not the candidate's epoch-by-epoch recording-rate series, which remains a gap.
    - Hall of Shoulders mcdowell dossier (framework F4 'trend accounting'; falsifiable reviewer questions list, item 5 'Trend, not snapshot') | D:/Claude_Code/brain/collegium/hall_of_shoulders/brains/mcdowell/ | grade A
- **[measurement]** The critique lands on the candidate's own stated specification, not a strawman: the dissertation fixes the autonomy treatment as an ordinal score whose 'hazard ratio is read per level rather than per unit,' a single monotone coefficient, while explicitly granting non-monotone (spline/polynomial/categorical) flexibility ONLY to the age covariate ('age must enter the model and its functional form must be allowed to be non-monotone'). The human-automation literature predicts the harm is concentrated at intermediate delegation, where the operator is out-of-the-loop yet still the backstop: ceding continuous control imposes a performance cost so that an operator suddenly required to intervene is slow and error-prone (Parasuraman, Sheridan & Wickens 2000), and intermediate levels of automation were studied precisely for their non-uniform effect on situation awareness and workload in a dynamic control task (Kaber & Endsley 2004). A monotone-in-level coefficient is structurally incapable of registering a hazard bump localized to the mid-scale; the candidate already applies the non-monotone repair (ordered category indicators / flexible form) to age and can apply the identical repair to the autonomy treatment, conditional on the mid-scale episode count per mission-class stratum being large enough to identify it. The candidate's own event-count-feasibility check (dissertation sec 6.2) is the right place to certify that identification.
    - JPL_AUTONOMY_EDL_04 dissertation.md (sec 3.5a and Ch4 age-covariate discussion), COLLEGIUM candidate corpus | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
    - Parasuraman, Sheridan & Wickens (2000), 'A model for types and levels of human interaction with automation', IEEE Trans. SMC-A | https://doi.org/10.1109/3468.844354 | grade A
    - Kaber & Endsley (2004), 'The effects of level of automation and adaptive automation on human performance, situation awareness and workload in a dynamic control task', Theoretical Issues in Ergonomics Science | https://doi.org/10.1080/1463922021000054335 | grade B
- **[mechanism]** The decomposition the question demands is licensed by the framework the candidate already cites and by the candidate's own data substrate. The stage model partitions automation into four stages of human information processing, of which information analysis and action implementation carry different human-performance consequences, so a system that auto-isolates but waits for ground recovery leaves a human in the decision/action-selection loop while one that auto-recovers does not (Parasuraman, Sheridan & Wickens 2000). The candidate's dissertation already names detection, isolation, and recovery as 'three logically distinct tasks' and states that a coder reading NTRS and design documentation can place an implementation on the detection-isolation-recovery scale 'because the architectures are documented at that granularity'; this same granularity is what would populate three separate stage indicators instead of one collapsed ordinal. Coding them separately would let the hazard model attribute any survival benefit to automated diagnosis, to automated recovery action, or only to their bundle, which a single composite cannot distinguish (the dissertation itself concedes the composite risks 'autonomy standing in for the entire bundle of attributes'). The candidate's stated rebuttal, that the scale would fail only if the three functions were 'so entangled in real designs that they could not be assessed separately', is precisely the empirical claim a three-indicator coding would test rather than assume.
    - Parasuraman, Sheridan & Wickens (2000), 'A model for types and levels of human interaction with automation', IEEE Trans. SMC-A 30(3):286-297 | https://doi.org/10.1109/3468.844354 | grade A
    - JPL_AUTONOMY_EDL_04 dissertation.md (Ch3 fault-management taxonomy; sec 3.5a; composite-bundle caveat), COLLEGIUM candidate corpus | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
    - Parasuraman & Riley (1997), 'Humans and automation: use, misuse, disuse, abuse', Human Factors 39(2):230-253 | https://doi.org/10.1518/001872097778543886 | grade A
- **[measurement]** The candidate's event coding as written cannot make the distinction the question requires, and the gap is exactly the commission/omission asymmetry at the center of the calibrated-reliance literature. The dissertation defines the event as 'confirmed recovery or mission-ending loss' and its censoring treatment addresses ONLY right-censoring of still-operating missions; no construct in the methods separates a clean recovery to nominal from an autonomous reconfiguration that recovered fast to a wrong configuration or compounded the fault. Automation failures split into errors of omission (the automation did not flag, the human therefore missed) and errors of commission (following an automated action against contrary evidence); these are dosage-dependent and only partially mitigated by training (Parasuraman & Manzey 2010). A commission-error recovery, fast transit out of safe mode into a worse state, registers in the candidate's coding as a short time-to-recovery (apparently protective) or as a censored survivor, exactly the miscounting the question names, and would bias the hazard ratio toward a spurious autonomy benefit. The repair is a third event category that flags onboard-recovery-action-implicated losses, which requires the JPL anomaly and GAO/ISA lessons-learned narratives to attribute causation to the recovery action itself; whether those post-hoc narratives resolve causation at that grain is an open identification question, but the calibrated-reliance frame makes clear that 'faster out of safe mode' is not 'better survival' and the current two-state coding conflates them.
    - JPL_AUTONOMY_EDL_04 dissertation.md (event-definition and censoring discussion, Ch5/Ch6), COLLEGIUM candidate corpus | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
    - Parasuraman & Manzey (2010), 'Complacency and bias in human use of automation: an attentional integration', Human Factors 52(3):381-410 | https://doi.org/10.1177/0018720810376055 | grade A
    - Parasuraman & Riley (1997), 'Humans and automation: use, misuse, disuse, abuse', Human Factors 39(2):230-253 | https://doi.org/10.1518/001872097778543886 | grade A
- **[rival]** The mechanism the panelist invokes is real and documented: high automation reliability predictably degrades operator monitoring of the very function being automated, so a highly reliable onboard safe-mode monitor would cause responding operators to reallocate attention and become slower/worse at catching the rare mishandled case; and reliance miscalibrates two ways (misuse=over-reliance, disuse=under-reliance after nuisance trips). This validates the panelist's worry that the comparator ground loop has its own eroding reliability. HOWEVER, no retrieved source documents that the specific ground-loop responsiveness measure (telemetry-to-correct-action latency, recent-safing desensitization) can be constructed from NTRS/JPL incident-surprise-anomaly records; NTRS API and OpenAlex returned zero on-topic records, and the AMOS/ACTA/Space-Economy corpora returned nothing. The framework is grounded; the claimed empirical construction is not.
    - Parasuraman, Molloy & Singh (1993), Performance Consequences of Automation-Induced 'Complacency', Int. J. Aviation Psychology | https://doi.org/10.1207/s15327108ijap0301_1 | grade A
    - Parasuraman & Riley (1997), Humans and Automation: Use, Misuse, Disuse, Abuse, Human Factors | https://doi.org/10.1518/001872097778543886 | grade A
- **[measurement]** The omission/commission asymmetry the panelist invokes is documented: higher-stage (decision and action-implementation) automation reduces errors of omission but introduces new errors of commission, where an operator (or autonomous system) executes a wrong automated recovery against a misdiagnosed fault; quantifying both error types and stating the false-alarm/miss posture of any automated alert is the standard demand. This validates the critique that a single monotone coefficient assumes away the commission-error term. HOWEVER, no retrieved source establishes that the false-alarm/miss posture of each flown JPL fault-management monitor (threshold, nuisance-trip and misdiagnosis history) is documented or codeable per episode; that empirical covariate construction is not supported by any retrieved record.
    - Parasuraman & Manzey (2010), Complacency and Bias in Human Use of Automation: An Attentional Integration, Human Factors (as cited in the parasuraman grounded dossier) | https://doi.org/10.1518/001872097778543886 | grade A
    - Parasuraman & Riley (1997), Humans and Automation: Use, Misuse, Disuse, Abuse, Human Factors | https://doi.org/10.1518/001872097778543886 | grade A
- **[identification]** The panelist's premise is grounded: operator/team cognitive state (workload, vigilance, fatigue, shift handover) is a dynamic, time-varying variable, not a constant ideal human, and a safe-mode entry during a concurrent critical operation, encounter window, or overloaded console is resolved by a different effective backstop than one during quiet cruise; neuroergonomics was built precisely to measure these dynamic states rather than assume a flat workload curve. This validates treating operations tempo at fault entry as a distinct candidate confounder of the ground-loop-dependent outcome. HOWEVER, no retrieved source establishes that an operations-tempo or concurrent-load index at fault entry can be recovered from NTRS/GAO/JPL records; NTRS and OpenAlex queries returned zero on-topic records, so the recoverability and the de-confounding test are not supported.
    - Parasuraman (2003), Neuroergonomics: Research and practice, Theoretical Issues in Ergonomics Science | https://doi.org/10.1080/14639220210199753 | grade A
- **[identification]** Conditioning on fault-entry is collider/selection conditioning, not innocent confounder control. Because recorded-entry is a common effect of autonomy and of unobserved fault severity (and autonomy additionally causes whether a condition is recorded at all, per Sec. 3.5), selecting the analysis sample on entry opens a non-causal autonomy<->severity->loss path INSIDE the risk set (endogenous selection / collider bias). No observed adjustment set d-separates autonomy from loss here, because the opened path runs through UNOBSERVED severity: the back-door criterion requires blocking nodes you can condition on, and an unobserved collider-descendant path cannot be closed by conditioning on observed covariates. The correct output is to declare the effect non-identified under selection-on-entry and refuse the hazard ratio, unless entry can be made conditionally independent of unobserved severity (e.g., severity proxies that render entry ignorable) or the estimand is redefined as a selection-model / principal-stratum quantity. This is the back-door criterion applied honestly: the adjustment set either satisfies it or it does not, and here it does not.
    - Pearl, Causality: Models, Reasoning and Inference (2nd ed., 2009), d-separation, back-door/front-door criteria, collider/spurious-association detection | https://doi.org/10.1017/cbo9780511803161 | grade A
    - Elwert & Winship, Endogenous Selection Bias: The Problem of Conditioning on a Collider Variable, Annu. Rev. Sociol. (2014) | https://doi.org/10.1146/annurev-soc-071913-043455 | grade A
    - Munafo et al., Collider scope: when selection bias can substantially influence observed associations, Int. J. Epidemiol. (2017) | https://doi.org/10.1093/ije/dyx206 | grade A
- **[identification]** The discriminating test is the direction of the arrows incident on each control, established from the data-generating timeline, not from the regression. A variable is a back-door confounder only if it is a common CAUSE of autonomy and loss (arrows point OUT of it into both: distance->autonomy and distance->loss, with distance temporally/structurally prior to the autonomy-investment decision). It is a mediator (or a moderator on a causal path) if autonomy points INTO it or into the mechanism it indexes (autonomy->[onboard action exploited under distance/complexity]->loss). Operational tests: (i) temporal/ structural precedence, a true confounder is fixed before treatment assignment; distance-regime-EXPLOITATION is realized only after autonomy acts, so it is post-treatment and adjusting on it is over-control; (ii) the d-separation / conditional-independence implication, if distance is a pure confounder, then autonomy _||_ distance is FALSE but distance carries no autonomy-caused variation, whereas if part of distance's association with loss is mediated, conditioning on it removes a piece of the total effect and attenuates the estimate toward the null (overadjustment bias). Per Schisterman et al., adjusting for an intermediate (or a proxy of one) on the causal path is overadjustment that biases the effect, distinct from unnecessary adjustment which only costs precision. So the candidate must split each control: the static back-door component (mission distance class as a design pre-condition) is adjustable; the realized exploitation-under-distance component is a mediator and must be left UNadjusted, or the protective effect it carries is differenced out and the hazard ratio is biased toward 1. The adjustment set is valid only if every retained control is shown, from the graph, to have no autonomy-caused incoming arrow.
    - Schisterman, Cole & Platt, On the Relative Nature of Overadjustment and Unnecessary Adjustment, Epidemiology (2009) | https://doi.org/10.1097/ede.0b013e3181a82f12 | grade A
    - Pearl, Causality: Models, Reasoning and Inference (2nd ed., 2009), back-door criterion, mediators vs confounders, d-separation | https://doi.org/10.1017/cbo9780511803161 | grade A
    - Tennant et al., Drawing Credible Directed Acyclic Graphs for Causal Inference / adjustment-set selection | https://doi.org/10.31234/osf.io/u4yta_v4 | grade B
- **[empirics]** The PH assumption for the treatment is directly testable: under proportional hazards the scaled Schoenfeld residuals for beta_1 have zero slope against (transformed) time, so the test is a regression of the autonomy-variable's scaled Schoenfeld residuals on a function of survival time (Grambsch-Therneau weighted-residual test, cox.zph), run on the autonomy coefficient itself rather than on the nuisance controls. A statistically non-zero slope is the conditional-independence violation: residual _NOT_||_ time means the autonomy log-hazard-ratio is not constant in time-since-entry. The Talebian tail-concentration prediction makes a directional, falsifiable forecast: an early-time protective log-HR (beta_1(t) more negative, hazard ratio further below 1 soon after entry) decaying toward null at late times, i.e., a negative residual-vs-time slope and divergence of the early-vs-late stratified hazard ratios. If the data show that divergence, the single-coefficient model is falsified and the candidate must move to a time-varying-coefficient Cox model (beta_1(t) via a treatment x time interaction or a step function on the post-entry clock) or a time-stratified estimand; absence of slope (cox.zph p above threshold, flat residuals, overlapping early/late HRs) is the only result that licenses reporting one beta_1. Reporting a single hazard ratio without this residual test on the treatment coefficient leaves the structural PH commitment untested.
    - Grambsch & Therneau, Proportional hazards tests and diagnostics based on weighted residuals, Biometrika 81(3) (1994), scaled Schoenfeld residual test of PH | https://doi.org/10.1093/biomet/81.3.515 | grade A
    - Zhang et al., Time-varying covariates and coefficients in Cox regression models, Ann. Transl. Med. (2018), testing and modeling time-varying treatment effects / PH violation remedies | https://doi.org/10.21037/atm.2018.02.12 | grade B
- **[identification]** R is a SEPARATE non-identification object from the round-1 selection-on-fault-entry collider (pearl_r1_c1) and is NOT collapsible into the candidate's signed 'overall program quality' node. DAG: R -> autonomy_investment; R -> margin/redundancy/disposal-policy -> mission_ending_loss; autonomy -> loss (target); complexity/distance/age are the only Sec. 4.2 controls. The back-door path autonomy <- R -> margin -> loss is open in every fixed-autonomy stratum because none of {complexity, distance, age} sits on it, so conditioning on the Sec. 4.2 set does not block it. Distinctness from program-quality is exhibited by ONE bypass path the candidate's own text forces: the candidate defines program quality as a bundle of 'test rigor, redundancy, staffing depth, operations-team experience' and claims it raises survival THROUGH redundancy/test rigor. R also acts through redundancy, so that path is shared. The distinct, non-shared path is R -> abort-and-disposal policy (controlled disposal / safe-mode-vs-dispose decision rule) -> mission-ending loss: a stringent-regime program can be REQUIRED to command end-of-mission disposal or a non-recoverable safe configuration that program-quality (rigor/staffing/redundancy) does not proxy, because policy-mandated loss is orthogonal to how well-built or well-staffed the program is. Name on graph: R -> disposal/abort-policy -> loss. That single path makes R a distinct node, and because it terminates in loss without passing through autonomy or through any program-quality proxy, even a clean within-stratum autonomy contrast leaves it un-blocked. Identifiability verdict on this path follows Pearl's back-door criterion (a path open under the chosen conditioning set defeats identification of P(loss|do(autonomy))).
    - Pearl, Causality: Models, Reasoning and Inference (2nd ed., 2009) | https://doi.org/10.1017/cbo9780511803161 | grade A
    - Risk Classification and Risk-based Safety and Mission Assurance (2014) | https://openalex.org/W2139925863 | grade C
    - JPL_AUTONOMY_EDL_04 dissertation.md (Sec. 4.2 confounding discussion) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
- **[measurement]** The d-separating set would have to be {complexity, distance, age} PLUS a faithful proxy for R itself (or for both downstream channels margin-depth AND disposal-policy). Inventory test against the dissertation's own data dictionary: the four sources are coded for subsystem count, instrument count, program COST CLASS (-> complexity index), Earth-spacecraft range regime (-> distance), spacecraft age, and TechPort technology-readiness used to score fault-management maturity (-> autonomy). NONE of these is the risk-classification regime: cost class is a budget/size proxy, and TechPort TRL is a maturity proxy for the treatment, not the assurance-requirements regime. The dissertation contains no 'risk class', 'Class A/D', or margin-policy variable (zero occurrences), and explicitly states only complexity, distance, and age are controlled. Therefore R is UNMEASURED in all four sources and co-causes the treatment. Verdict: the autonomy hazard ratio is NON-IDENTIFIED on regime-confounding grounds. This is a SECOND and DISTINCT non-identification from the round-1 selection-on-fault-entry (collider) result: the entry result is selection bias from conditioning on a treatment-caused recorded-entry node; this one is omitted-common-cause confounding via R -> margin/disposal -> loss. Both stand; neither is reducible to the other. The candidate's sign-of-bias rescue (program-quality bias is one-signed, so the conditional hazard ratio is an upper bound) does NOT cover R, because R's disposal-policy channel is not sign-pinned to program quality and can move survival independently of autonomy in either direction.
    - Pearl, Causality: Models, Reasoning and Inference (2nd ed., 2009) | https://doi.org/10.1017/cbo9780511803161 | grade A
    - JPL_AUTONOMY_EDL_04 dissertation.md (variable definitions and Sec. 4.2 controls) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
    - Drawing Credible Directed Acyclic Graphs for Causal Inference (2025) | https://doi.org/10.31234/osf.io/u4yta_v4 | grade B
- **[identification]** Neither formal rescue is instantiable from the four named sources, so non-identification under regime confounding stands. (a) Instrument excludable from R: a candidate would be a TRL/technology-infusion timing shock that changed which autonomy was flyable in a build epoch. But the dissertation already rejects era and budget instruments precisely because they affect survival through other channels (era/budget co-move with test rigor, redundancy, staffing), and any infusion-timing shock large enough to move autonomy investment is itself plausibly correlated with the program's assurance regime R (high-assurance Class-A programs adopt flight-proven autonomy on different timelines than Class-D), so it is a child or correlate of R and fails the exclusion-from-R requirement. The four sources record no infusion shock that is demonstrably orthogonal to risk class. (b) Front-door rescue via the onboard detection->isolation->recovery mediator: front-door requires (i) the mediator fully mediates autonomy's effect, (ii) no unblocked back-door from autonomy to the mediator, and (iii) no back-door from the mediator to loss except through autonomy. Condition (iii) fails under open R, because R -> margin/redundancy -> whether an isolation/recovery action can succeed -> loss is a back-door from the mediator to loss that does NOT pass through autonomy (a thin-margin Class-D vehicle's recovery action fails where a high-margin Class-A vehicle's identical action succeeds). Moreover the mediator path is only reconstructable from JPL state logs, which the dissertation flags as releasable for a subset of JPL-operated missions, not the full NTRS/GAO/TechPort population, so the mediator is not even measured corpus-wide. Verdict: no instrument excludable from R and no R-unconfounded front-door mediator exists in the four sources; the autonomy hazard ratio remains non-identified on regime-confounding grounds, and the correct deliverable is the explicit non-identification declaration plus a sensitivity bound (E-value / Rosenbaum-style), not a point hazard ratio.
    - Pearl, A general identification condition for causal effects (2002) | https://doi.org/10.5555/777092.777180 | grade A
    - JPL_AUTONOMY_EDL_04 dissertation.md (Sec. 4.2 instrument rejection) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
    - Risk Classification and Risk-based Safety and Mission Assurance (2014) | https://openalex.org/W2139925863 | grade C
- **[identification]** On the candidate's own terms the contrast is conceptually program-level, not episode-level. The autonomy score is 'an ordered score for each MISSION's fault-management implementation' (Ch4 definition) fixed by pre-flight design, so the only well-defined manipulation is 'this program built one autonomy level higher,' making the treated unit the program. The candidate also already concedes the lockstep confound: Proposition 2 states deep-space missions 'face long light times and therefore both invest more in autonomy and operate in a harsher recovery environment; flagship missions are more complex and better funded,' so 'the unconditioned autonomy-survival association conflates autonomy with distance, complexity, and program richness,' with 'confidence that conditioning removes all confounding: low, by construction.' This is exactly Rubin/Holland's 'no causation without manipulation' and SUTVA 'no hidden versions of treatment': a design property bundled with the whole program is not an episode-level treatment.
    - JPL_AUTONOMY_EDL_04 dissertation.md (Ch4 'Fault-management autonomy level' definition; Ch3 Proposition 2) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
    - Holland, Statistics and Causal Inference, JASA (1986) | https://doi.org/10.1080/01621459.1986.10478354 | grade A
    - Imbens & Rubin, Causal Inference for Statistics, Social, and Biomedical Sciences (2015) | https://doi.org/10.1017/cbo9781139025751 | grade A
- **[empirics]** The candidate text already asserts the structural non-overlap Rubin's positivity check would expose: 'Coverage is strongest for flagship and competed deep-space and Earth-science missions' and deep-space/flagship missions are simultaneously the high-autonomy, high-complexity, high-distance region. Per Rosenbaum & Rubin, adjustment for the propensity score removes bias due to observed covariates ONLY where overlap holds; where the highest-autonomy episodes occupy a complexity-distance region with no lower-autonomy donors, the conditional contrast is an extrapolation, not an adjustment. The dissertation supplies the qualitative direction (high autonomy co-located with deep-space flagships) but not the propensity overlap map or the autonomy-on-controls R-squared, which require executed data.
    - Rosenbaum & Rubin, The central role of the propensity score in observational studies for causal effects, Biometrika (1983) | https://doi.org/10.1093/biomet/70.1.41 | grade A
    - JPL_AUTONOMY_EDL_04 dissertation.md (Ch1 scope paragraph; Ch3 Proposition 2) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
- **[measurement]** Partial answer with binding limit. The dissertation defines a three-level ordinal autonomy score (Level 1 ground-loop-dependent recovery; Level 2 onboard detection with limited autonomous response; Level 3 onboard detection-isolation-recovery), built from pre-flight TechPort TRL anchors and design documentation (Appendix B; sec 4.3.2-4.3.3). But it explicitly concedes that 'genuine within-level autonomy variation is unmodeled' and treats this only as attenuation toward the null (sec 4.6.2, 'Coarse ordinal autonomy score'), and the FDIR literature it draws on contains materially different architectures (e.g., two-layer fault-detection-with-isolation plus two-layered recovery, Kalman-filter/neural-network fusion, observer-based schemes) that the three-bin score collapses. The candidate therefore CANNOT meet the demand: no within-level table of architectural composition, per-level counts, or within-level variance exists in the assembled work, so the no-hidden-versions limb of SUTVA is asserted by coarsening rather than demonstrated. Per Rubin's SUTVA, potential outcomes are well-defined only under 'no hidden versions of treatment'; an ordinal score that bins heterogeneous architectures makes the per-level hazard ratio an average over hidden versions, not the single contrast H1 names. The 'attenuation-only' defense addresses precision, not estimand definition.
    - Imbens & Rubin, Causal Inference for Statistics, Social, and Biomedical Sciences (RCM; SUTVA = no interference + no hidden versions) | https://doi.org/10.1017/cbo9781139025751 | grade A
    - Chen, Bettens, Xie, Wang & Wu, 'Kalman filter and neural network fusion for fault detection and recovery in satellite attitude estimation,' Acta Astronautica (2024) | https://doi.org/10.1016/j.actaastro.2024.01.038 | grade A
    - JPL_AUTONOMY_EDL_04 dissertation, Appendix B and sec 4.3.2-4.3.3, 4.6.2 | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
- **[empirics]** Grounded methodological standard for Q3 (the half that is settleable). Rubin's 'design trumps analysis' holds that objective causal inference requires the design, including the determination of outcomes and the analysis plan, to be completed while blind to the outcome data, mirroring how a randomized trial is designed before data collection. The dissertation already satisfies this on the treatment side (pre-flight autonomy scoring with second-reader weighted-kappa reliability) but leaves the outcome/censoring side outside the blinding and reliability apparatus, so the standard is half-met: the treatment is sealed, the outcome adjudication is not demonstrably sealed and carries no reported end-state or event-time inter-rater agreement.
    - Rubin, 'For objective causal inference, design trumps analysis,' Annals of Applied Statistics (2008) | https://doi.org/10.1214/08-aoas187 | grade A
    - JPL_AUTONOMY_EDL_04 dissertation, Appendix B and sec 4.3.3, 4.6.3 | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
- **[empirics]** The candidate cannot supply a realized minimum tail-event count because the dissertation is explicitly at the design stage: Chapter 4 states 'No episode has yet been coded against the assembled population' and that coverage figures (low hundreds of episodes, several dozen spacecraft, single-digit mission-ending losses) are 'design-stage targets, not realized counts.' What the candidate CAN ground is that the pre-specified tail subgroup is, by the design's own admission, structurally thinner than the pooled sample: Ch6.4 commits that 'the tail subgroup will be even thinner in events than the pooled sample, so its interval will be wider and its conclusion weaker,' reportable 'as suggestive rather than decisive.' The design also already concedes the single-event-reversal failure mode Taleb demands: Ch6.2 pre-registers a dfbeta leave-one-out diagnostic precisely because 'the deletion or retention of one terminal episode can flip a conclusion,' giving the worked contingency of 'a single mission-ending loss on the one high-autonomy spacecraft' pushing the coefficient above one. The honest grounded answer is therefore a concession: the leave-one-out stability test Taleb asks for is named in the plan but, with single-digit losses partitioned into a tail stratum that may hold only two or three events, the design cannot demonstrate sign-stability in advance and commits only to exposing the fragility, not bounding it. This is a point forecast with a stated weak interval, not an exposure bound, which is exactly Taleb's charge.
    - JPL_AUTONOMY_EDL_04 Ch4 Data and Measurement (4.0, 4.6.1) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/chapters/ch4_data_and_measurement.md | grade C
    - JPL_AUTONOMY_EDL_04 Ch6 Analysis Plan (6.2 influence/leverage, 6.4 tail subgroup) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/chapters/ch6_analysis_plan.md | grade C
    - Taleb, Read, Douady, Norman, Bar-Yam, The Precautionary Principle (arXiv:1410.5787, 2014) | https://doi.org/10.48550/arxiv.1410.5787 | grade A
    - Cirillo & Taleb, Tail risk of contagious diseases, Nature Physics (2020) | https://doi.org/10.1038/s41567-020-0921-x | grade A
- **[measurement]** The dataset as specified is structurally blind to the localizable-vs-systemic partition Taleb demands. The dependent variable in Ch4.3.1 is a single absorbing outcome, 'permanent loss of the spacecraft or of its primary mission objective traceable to the fault episode,' coded as a binary event indicator (1=loss, 0=censored). The coding protocol records terminal TYPE only as recovery-vs-loss, never as benign-vs-debris-generating; no construct, source column, or scale in the Ch4.3.5 measurement table captures whether a terminal loss produced trackable debris or occurred in a congested shell. The dissertation itself flags this exposure as discussion-level, not measurement-level: Ch4.6.2 cites Lewis on orbital-environment dynamics only as 'the reminder that the consequences of a loss are not always localized to the lost vehicle,' i.e., it ASSERTS the systemic tail in prose but never operationalizes it in the survival object. So the candidate's honest grounded answer is concession: the precautionary framing Taleb invokes (confined to the joint case of fat tails AND systemic non-localizable ruin, per Taleb 2014) is not realized in the measurement; pooling debris-generating losses with single-vehicle losses dilutes exactly the exposure the frame says matters, and the assembled NTRS/GAO sources are not coded at a resolution that would let the partition be recovered post hoc. Whether NTRS anomaly narratives or GAO assessments CONTAIN enough latent detail to support a retrofit partition is not demonstrable from retrieval, because no episode has been coded and the protocol never asks the question.
    - JPL_AUTONOMY_EDL_04 Ch4 Data and Measurement (4.3.1, 4.3.5 measurement table) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/chapters/ch4_data_and_measurement.md | grade C
    - JPL_AUTONOMY_EDL_04 Ch4 Data and Measurement (4.6.2, rare-events limitation) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/chapters/ch4_data_and_measurement.md | grade C
    - Taleb et al., The Precautionary Principle (arXiv:1410.5787, 2014) | https://doi.org/10.48550/arxiv.1410.5787 | grade A
    - Lewis, Understanding long-term orbital debris population dynamics, Journal of Space Safety Engineering (2020) | https://doi.org/10.1016/j.jsse.2020.06.006 | grade A
- **[governance]** The candidate can partially detect the authorship asymmetry in-corpus, and the design already concedes its direction. The autonomy treatment is scored from NTRS reports and program design documentation authored by the implementing engineering programs themselves (Ch4.3.3 pass two reads 'NTRS and program design documentation'; the anchor is NASA TechPort, a NASA technology-management product). The dissertation explicitly recognizes the self-report problem and partially counters it for the OUTCOME variable only: Ch4.1.2 and Ch4.6.3 route mission-ending-loss corroboration through GAO 'because GAO is an external oversight body rather than the implementing program, a loss documented in a GAO assessment is less subject to the implementing program's framing than a self-report.' But the TREATMENT (the autonomy score) has no equivalent independent author: TechPort TRL is exogenous to the survival hypothesis but is still a NASA/JPL self-classification, and the detection-isolation-recovery placement is read from the implementing program's own pre-flight prose. So the authorship asymmetry Taleb names is real and detectable: the favorable hazard ratio is conditioned on a treatment variable scored largely from the documentation of the same organizations whose autonomy investment is being evaluated. The design's own confounding admission compounds this: Ch4/Ch6 concede program quality biases the estimate toward OVERSTATING protection, making the conditional estimate an upper bound. Handing a confounded, self-authored upper bound to program managers who bear the autonomy cost but can defer the tail consequence is precisely the cheap-assurance pattern Taleb's skin-in-the-game filter is built to discard. The candidate cannot ground a claim that the scorers bore the downside of loss; the corpus shows the opposite structural posture (implementing-org authorship for the treatment, external GAO authorship only for the outcome).
    - JPL_AUTONOMY_EDL_04 Ch4 Data and Measurement (4.1.4 TechPort, 4.3.3 three-pass construction) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/chapters/ch4_data_and_measurement.md | grade C
    - JPL_AUTONOMY_EDL_04 Ch4 Data and Measurement (4.1.2 GAO independence, 4.6.3 validation); Ch6 Analysis Plan (confounding/upper-bound framing) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/chapters/ch4_data_and_measurement.md | grade C
    - Hall of Shoulders taleb dossier, citing Taleb, Skin in the Game (2018) and Martinetti et al. Safety-I/II antifragility analysis | https://doi.org/10.1080/10803548.2018.1444724 | grade A
- **[mechanism]** The diagnostic Taleb demands is correctly stated and is the operative standard: antifragility is a SECOND-order (convex) response to the DOSE of a stressor, formally distinct from robustness (stays the same) and resilience (recovers). A single monotone Cox coefficient is a first-order mean-shift quantity and by construction cannot locate the system on the fragile-robust-antifragile continuum; convexity (benefit accelerating at higher dose) versus concavity (decay at the tail) is exactly the distinction a single slope erases. The candidate's hardest-episode subgroup split is a coarse two-bin proxy, not a curvature estimate. GROUNDED on framework. NOT GROUNDED: no retrieved source supplies the candidate's actual autonomy-by-dose interaction/spline coefficient, its sign, or a power calculation showing the assembled event count resolves curvature; that result is absent and must be produced by the candidate, not asserted here.
    - Taleb panelist dossier (hall_of_shoulders/taleb), citing Antifragile (Taleb 2012) and the precautionary-principle convexity/concavity analysis: 'second-order (convex/concave) response of your system to the DOSE of the stressor, where does it sit on the fragile-robust-antifragile continuum' | local:D:/Claude_Code/brain/collegium/hall_of_shoulders/brains/taleb | grade A
    - Taleb, Antifragile: Things That Gain from Disorder (2012), review record | https://doi.org/10.1080/14697688.2013.829244 | grade B
    - Taleb et al., The Precautionary Principle (with Application to the Genetic Modification of Organisms), formal fragility/convexity framework | https://doi.org/10.48550/arxiv.1410.5787 | grade A
- **[measurement]** The mechanism Taleb names is a real and named failure mode, not rhetorical: the historical/anomaly record systematically undersamples the events that matter, and treating ABSENCE of a written catastrophe/anomaly as EVIDENCE of safety is the classic 'silent evidence' / fragility-hiding error. When the undersampled cell is correlated with the treatment (autonomous saves are the episodes least likely to be written up), the resulting bias is differential censoring, not random truncation, it contaminates the autonomy-survival association at the source, exactly as the question asserts. The proposed fix (reconstruct safe-mode entries from telemetry on a calibration subset, independent of narrative filing, and measure record-generation probability by autonomy level) is the methodologically correct way to convert the verbal caveat into a quantified selection bias. GROUNDED on framework and on the appropriateness of the test design. NOT GROUNDED: no retrieved source supplies the candidate's actual measured record-generation probability by autonomy level, nor evidence that such a telemetry-reconstructable calibration subset has been assembled or analyzed; that quantity is absent.
    - Taleb panelist dossier (hall_of_shoulders/taleb): 'the historical record systematically undersamples extreme events ... treating the absence of catastrophe as evidence of safety is the classic fragility-hiding error', invoking silent-evidence/survivorship reasoning | local:D:/Claude_Code/brain/collegium/hall_of_shoulders/brains/taleb | grade A
    - Taleb et al., The Precautionary Principle, 'absence of evidence and the incompleteness of scientific knowledge carries profound implications' under fat tails | https://doi.org/10.48550/arxiv.1410.5787 | grade A
- **[rival]** The iatrogenic / via-negativa rival is a first-class part of Taleb's program and applies directly here: every intervention that ADDS something (here, onboard automation) must be justified against the via-negativa alternative and audited for the fragility it introduces and TRANSFERS, not only the harm it prevents. A binary recovery/loss outcome with one monotone coefficient is structurally blind to autonomy-caused loss, and a negative beta_1 would count an iatrogenic loss as evidence against autonomy only by accident, it cannot distinguish lowering loss hazard from RESHAPING the failure distribution toward fast, irreversible (absorbing-barrier) terminal events, which is precisely the outcome Taleb's ruin/absorbing-barrier criterion says must be isolated. The proposed proximate-cause partition (a/b/c) coded from JPL anomaly narratives and ISA-type records is the correct instrument to make that distinction settleable. GROUNDED on framework and on the validity of the partition as the right test. NOT GROUNDED: no retrieved source supplies the candidate's actual partition counts or evidence that the autonomy-loss cell does or does not concentrate in (b)/(c); that empirical result is absent and cannot be asserted.
    - Taleb panelist dossier (hall_of_shoulders/taleb): 'Via negativa and the transfer of fragility ... your recommendation ADDS something (more automation, more intervention). What fragility does it remove, and to whom does it transfer fragility' and the ruin/absorbing-barrier review lens ('an absorbing barrier, an outcome from which there is no recovery') | local:D:/Claude_Code/brain/collegium/hall_of_shoulders/brains/taleb | grade A
    - Martinetti et al., Safety I–II, resilience and antifragility engineering: a debate (formalizes whether added safety/automation builds or erodes antifragility) | https://doi.org/10.1080/10803548.2018.1444724 | grade B
    - Spinelli & others, Resiliency in Space Autonomy: a Review (2023), surveys onboard autonomy fault-handling, relevant to whether autonomous recovery can reconfigure into worse states | https://doi.org/10.1007/s43154-023-00097-w | grade B
- **[measurement]** The candidate cannot produce a matched-pair count, because no assembled fault-episode population exists in its materials. The on-disk corpus is 134 literature references (corpus.jsonl) plus dissertation text (624 chunks); the candidate DB has no episode-level, per-spacecraft, or class field. The dissertation states it is presented at the design stage and not yet executed on the full dataset, and its data-architecture passage describes the spacecraft-and-event linkage key only as a planned assembly across four sources, never a realized matched set. By Yin's unit-of-analysis discipline the case boundary must be defensible before data persuade, and treating a convenient handful of cases as a sample is the named error; here the population that would settle the question does not yet exist, so the fault-episode unit cannot be shown to support pooling. The matched-pair count itself is therefore a gap.
    - Yin dossier + Case Study Research: Design and Methods (Yin 2014), via hos-yin brain | https://openalex.org/W2168545530 | grade A
    - JPL_AUTONOMY_EDL_04 dissertation.md (design-stage admission; spacecraft-and-event linkage key passage) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
    - JPL_AUTONOMY_EDL_04 corpus.jsonl + jpl_autonomy_edl_04.db (134 reference records, 0 episode/spacecraft/class fields) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/corpus.jsonl | grade C
- **[identification]** On Yin's terms the defensible claim is analytic generalization, not statistical: the dissertation concedes it undersamples the catastrophic tail and generalizes only to flagship NASA/JPL spacecraft, which is generalization to a theoretical class of replications, not estimation of a population parameter. Yin's framework states that case findings generalize to theoretical propositions, not to populations, and that the error to avoid is over-claiming statistical generalization from a convenient handful; disconfirmation under the most-favorable conditions travels by analytic generalization. The candidate should therefore commit to claiming the hazard ratio tests the autonomy proposition within a narrow flagship stratum. However, the supporting count, how many spacecraft and how many distinct mission classes actually contribute events, cannot be supplied: no coverage table and no realized event distribution exist in the materials, so the analytic-generalization commitment can be stated but not yet backed with the contributing-class counts the question demands.
    - Yin dossier + Case Study Research: Design and Methods (Yin 2014), via hos-yin brain (analytic vs statistical generalization; handful-as-sample error) | https://openalex.org/W2168545530 | grade A
    - Case Study Evaluations: A Decade of Progress? (Yin), via hos-yin brain | https://doi.org/10.1007/0-306-47559-6_11 | grade A
    - JPL_AUTONOMY_EDL_04 dissertation.md (Sec 6.4: undersamples catastrophic tail; generalizes to flagship NASA/JPL only) | file:///D:/Claude_Code/brain/collegium/candidates/dissertations/JPL_AUTONOMY_EDL_04/dissertation.md | grade C
- **[rival]** The rival is statable as a positive theory with a mutually-exclusive predicted pattern, and this is the correct way to discharge it. Yin's pattern-matching logic compares an empirically observed pattern against a pattern predicted IN ADVANCE from theory; rival-explanation pattern matching has competing theories predict DIFFERENT patterns, and the rival is addressed only if it was explicitly named and tested with evidence rather than asserted as a nuisance term. The discriminating prediction is codable in principle because test depth is treated in the literature as a program-quality decision variable distinct from onboard capability ('Testing in NASA human-rated spacecraft programs: how much is just enough?'), which establishes stringency (test depth) as an axis a program sets independently of autonomy. The regime rival therefore predicts: (a) holding autonomy level fixed, survival rises with an independently-coded stringency ordinal (review-gate count, abort-criteria conservatism, margin policy, test depth); and (b) high-autonomy mission-ending losses concentrate in low-stringency programs. H1 (autonomy is the lever) predicts the OPPOSITE on (a): within an autonomy stratum, stringency should add nothing once autonomy is held constant. The two predictions are mutually exclusive on the within-stratum stringency coefficient, so the rival is a falsifiable competitor, not a relabeled caveat. The candidate's design, which carries program quality only as a one-line sign-of-bias caveat, has not yet committed to or tested this within-stratum prediction.
    - Yin thinker dossier (Hall of Shoulders, brain=yin) - pattern-matching / rival-explanation discipline entries | D:/Claude_Code/brain/collegium/hall_of_shoulders/brains/yin/ | grade C
    - Beach, 'It's all about mechanisms - what process-tracing case studies should be tracing' | https://doi.org/10.1080/13563467.2015.1134466 | grade A
    - Testing in NASA human-rated spacecraft programs: how much is just enough? (NASA/MIT, 2003) | http://hdl.handle.net/1721.1/91783 | grade B
- **[measurement]** The codability question is the binding one and is only partially answerable from sources. Test depth ('how much is just enough') is documented as a program decision variable, which shows at least ONE stringency component is in principle codable from program documentation as something a program sets, supporting the claim that a stringency ordinal is constructible in concept. But whether a SECOND reader can separate a stringency ordinal from the autonomy ordinal WITHIN the four named corpora is an empirical inter-coder-separability fact that no retrieved source this turn establishes; it must be demonstrated by an actual blind double-coding on a pilot sample, which the design has not reported. Methodologically, if autonomy is in fact selected-into by the same stringency regime that the program offices document in the same artifacts, the treatment is confounded by selection in exactly the sense the non-randomised-intervention bias literature formalizes (confounding by indication / baseline confounding domain), where the treated and untreated differ systematically on a prognostic factor that governs both treatment assignment and outcome (ROBINS-I, baseline-confounding domain). In that case a Cox coefficient on autonomy estimates the regime's effect, not the onboard system's, and the value-attribution unit is wrong - which is precisely the Yin rival-explanation failure mode (the posited mechanism vs. case-specific confounds that govern both X and Y). The honest on-record answer is therefore conditional: stringency is constructible as a concept, separability from autonomy in the four corpora is UNDEMONSTRATED and must be settled by a blind double-coding pilot; if separability fails, the confound is constitutive and the candidate must concede the unit-of-analysis objection.
    - Testing in NASA human-rated spacecraft programs: how much is just enough? (NASA/MIT, 2003) | http://hdl.handle.net/1721.1/91783 | grade B
    - ROBINS-I: a tool for assessing risk of bias in non-randomised studies of interventions (Sterne et al., 2016) | https://doi.org/10.1136/bmj.i4919 | grade A
    - Yin thinker dossier (Hall of Shoulders, brain=yin) - rival-explanation / confound entries | D:/Claude_Code/brain/collegium/hall_of_shoulders/brains/yin/ | grade C

## Gaps

- **[identification]** No named, primary-data-costed lower-autonomy substitute exists for any treated episode. The design supplies covariate conditioning on a coarse ordinal index, not a constructed-and-costed recovery counterfactual for a specific flown lower-autonomy analogue; the Fogelian operational definition (named substitute + TechPort/design-doc costing of its recovery behavior) is unmet. (raised by fogel)
- **[empirics]** No bounded autonomy hazard-ratio estimate and no numeric feasibility floor are produced. The Fogelian deliverable (a stated upper/lower HR the population can support and the terminal-event count at which H1 cannot be discriminated from H0) is specified as a computation but left unexecuted because the realized loss count is unknown at design stage; the population's capacity to falsify indispensability is therefore unestablished. (raised by fogel)
- **[mechanism]** No measured shadow price of recovery time and no mediation/time-channel analysis exist. The design cannot show, from fault-entry-to-resolution timestamps, that the autonomy effect runs through reaction-time-saved versus unobserved program quality; the time mechanism is asserted and conditioned-away into one hazard ratio, not estimated as a channel. (raised by fogel)
- **[economics]** No recovery-cost leg can be constructed: the NTRS/GAO/JPL episode records as assembled carry no operator-hour, DSN/tracking-pass, dollar, or mission-downtime field, and the model has no cost covariate. The Fogelian 'social saving' the dissertation claims to estimate is therefore unbacked by the corpus; the hazard ratio measures only a conditional loss association, not the costed counterfactual recovery of the next-best lower-autonomy substitute on the same fault. (raised by fogel)
- **[empirics]** The autonomy benefit is never partitioned into a survival channel and a time-to-resolve channel, and no distribution of fault-entry-to-recovery durations by autonomy level is reported: recovery is modeled only as censoring, so the time-saved-among-survivors margin (where the railway literature locates most social saving) is discarded by construction. The corpus's required fault-entry/recovery timestamps could in principle support the decomposition, but the design estimates only the loss-hazard margin, leaving open that autonomy's measurable effect lives in recovery TIME and that the loss-hazard estimand measures the wrong margin. (raised by fogel)
- **[rival]** The corpus does not support stratifying losses by off-vehicle consequence: the terminal event is defined as a single homogeneous spacecraft/mission loss and no relay, constellation-node, shared-asset, downstream-degradation, or debris-generation field exists in the assembled records. The uniform loss-hazard therefore treats a contained deep-space loss and a systemically-coupled loss as identical, omitting the general-equilibrium reallocation/externality channel; the reported autonomy social saving is mis-aggregated and the partial-vs-general-equilibrium correction Fogel requires cannot be executed on these records. (raised by fogel)
- **[measurement]** No retrieved source this turn characterizes the intra-episode resolution of NTRS, GAO, JPL anomaly records, or TechPort, i.e., whether those corpora record the time-ordered sequence of autonomous fault-management actions and the corresponding spacecraft state responses at sub-episode granularity, or only entry-time, terminal outcome, and total duration. The AMOS, ACTA, and Space Economy corpora returned zero hits on spacecraft fault-recovery survival data or anomaly-record granularity, and no NTRS/GAO/TechPort data-dictionary or schema evidence was retrieved. Without that evidence the GROUNDED EXPERT cannot assert that the data either can or cannot support a within-episode stock-and-flow recovery model, and therefore cannot adjudicate whether the Cox choice is phenomenon-driven or data-availability-driven. Per the no-confabulation contract (3.3) this question is refused; resolving it requires the candidate to produce the actual record schema / a sample of episode-level event logs for the named sources. (raised by forrester)
- **[identification]** Whether NTRS, GAO, JPL anomaly records, and TechPort independently record a mission-level requirements-stringency / margin-policy / abort-threshold / fault-injection-rigor variable cannot be confirmed from retrieval this turn. AMOS, ACTA, and Space-Economy corpora returned zero hits on this, and an NTRS API query on fault-protection/design-margin/requirements/mission-survival returned zero results. No retrieved source establishes that a stringency variable is codable per mission from those four sources. Absent that source, the data-blindness charge stands unrebutted: the design cannot be shown to measure the regime variable needed to break the simultaneity, so on the record the Cox specification is conceded to be structurally blind to the co-produced-regime rival. (raised by forrester)
- **[empirics]** Whether a margin/abort/test-stringency proxy is independently codable per episode from NTRS/GAO/JPL/TechPort, or is so collinear with autonomy in those sources that the regime rival is unfalsifiable, cannot be resolved from retrieval this turn. No retrieved source documents the per-episode field structure of those four sources for a stringency variable, and direct corpus and NTRS queries returned nothing. The operative status of the falsification test therefore cannot be asserted: if stringency is not separately codable the test is infeasible and the regime rival is unfalsifiable with these data, which the candidate must state rather than claim a feasible partition. (raised by forrester)
- **[measurement]** No reported inter-coder kappa for the fault-entry timestamp or for the recovery-versus-mission-ending-loss end-state classification, and no second-reader re-coding survival count, exists in the queried corpora (AMOS, ACTA, Space Economy, mcdowell brain) or in the OpenAlex gap-fill (372/40 adjacent hits, none reporting a spacecraft-fault coding-reliability kappa). The reproducibility statistic is a property of the candidate's own constructed catalog; it must be generated by an actual second-reader exercise, not retrieved. REFUSED rather than fabricate a kappa. (raised by mcdowell)
- **[empirics]** No empirical estimate of the fraction of actual fault episodes captured by NTRS / GAO / JPL releasable records against an independently reconstructed ground truth, and no observed-versus-reconstructed recovery/loss distribution, exists in retrieval. OpenAlex 'satellite on-orbit failure reporting completeness survivorship bias' returned 40 results, none a spacecraft fault-reporting completeness study. The completeness fraction must be measured by the candidate against releasable telemetry; it cannot be asserted from the literature. REFUSED rather than fabricate a completeness fraction. (raised by mcdowell)
- **[identification]** No Manski-style nonparametric bound, tipping-point sensitivity, or autonomy-by-distance composition of the unreleasable (classified/small-mission) stratum exists in retrieval that would settle whether the SIGN of the autonomy hazard ratio is identified. The mcdowell brain supplies the standard (reconcile observed sample against unobserved population; conditioning on observed confounders cannot rescue an estimate when the missing stratum is correlated with both treatment and outcome) but supplies no bound for THIS estimand. The bound is the candidate's to compute. REFUSED rather than fabricate a bound or a sign-stability claim. (raised by mcdowell)
- **[measurement]** REFUSED (no-confabulation, contract 3.3): No retrieved source supplies the cross-source reconciliation for this candidate's dataset, the fraction of fault episodes appearing in all overlapping registers versus only one, or the inter-source agreement on fault-entry timestamp, end-state classification, and autonomy level. This is an artifact-internal quantity the candidate must compute and report; the panel cannot supply it and the literature does not contain it. The demand stands (McDowell F6/F1) but the answer is owed by the candidate. (raised by mcdowell)
- **[identification]** REFUSED (no-confabulation, contract 3.3): No retrieved source provides the recording-rate time series (fault episodes per spacecraft-year by launch epoch) for this dataset, nor a test that the autonomy variable is deconfounded from the catalog's improving completeness over time. McDowell's 'trend, not snapshot' framework (F4) makes the objection legitimate and gradable, but the time-varying observability of the dependent variable in THIS catalog is a property the candidate must demonstrate; it is absent from every corpus queried this turn (AMOS, ACTA, Space Economy, OpenAlex, NTRS). (raised by mcdowell)
- **[measurement]** REFUSED (no-confabulation, contract 3.3): No retrieved source names an independent fault-protection capability register of record against which the reader-coded autonomy score can be externally validated, nor reports an agreement rate for a held-out subset. McDowell's F1 (name the catalog of record; reconcile against an independently tracked census) makes the external-anchor demand sound, but the existence, identity, and agreement rate of such an as-flown register for JPL missions was not located in AMOS, ACTA, Space Economy, OpenAlex, Crossref, or NTRS this turn. Without it the treatment and outcome remain drawn from one entangled archive; the candidate must supply the external anchor. (raised by mcdowell)
- **[rival]** No retrieved source supports that a ground-loop responsiveness measure (time from anomaly telemetry to first correct operator action, and a recent-recurrent-safing desensitization flag) can be recovered from NTRS/JPL incident-surprise-anomaly records, nor that doing so would show the estimated autonomy benefit is complacency in the low-autonomy arm rather than capability in the high-autonomy arm. NTRS citation API (two queries) and OpenAlex gap-fill returned zero on-topic incident records; AMOS, ACTA, and Space-Economy corpora returned nothing on spacecraft autonomy/fault-management ground response. The construction is unverifiable from retrieval and is therefore not asserted. (raised by parasuraman)
- **[measurement]** No retrieved source supports that the flown fault-management monitor's detection threshold, nuisance-trip history, and misdiagnosis history are documented per high-autonomy episode such that the false-alarm/miss posture could be coded as a model covariate; nor that doing so would reveal commission errors rising with autonomy and partially cancelling the omission-error benefit. The space-domain corpora and NTRS/OpenAlex returned no per-monitor false-alarm/miss records. The covariate is theoretically warranted but its empirical availability is unverified, so its feasibility is not asserted. (raised by parasuraman)
- **[identification]** No retrieved source supports that an operations-tempo or concurrent-load index at fault entry can be recovered from NTRS/GAO/JPL records, nor that the autonomy coefficient survives its inclusion. The confounder is theoretically distinct from the static program-quality rival and is well-motivated by neuroergonomics, but its empirical construction from the named record sources is undocumented in retrieval (NTRS API zero hits; OpenAlex zero on-topic; AMOS/ACTA/Space-Economy zero). Feasibility is therefore not asserted; the identification threat stands as a gap the candidate must close with data not shown to exist. (raised by parasuraman)
- **[identification]** The matched-pair EXISTENCE check cannot be settled: the dissertation is explicit that 'No episode has yet been coded against the assembled population; the worked examples are drawn from published mission post-mortems... and the coverage numbers are intended targets, not realized counts.' With zero coded episodes there is no constructed dataset from which to exhibit even one covariate-matched pair differing only in autonomy. The candidate cannot demonstrate the existence (or non-existence) of a matched pair as a settled empirical fact; the conceptual diagnosis (treatment is program-level; conditioning on fault entry conditions on a post-treatment variable) stands, but the empirical existence question is unanswerable until the dataset is executed. (raised by rubin)
- **[empirics]** The overlap map and the R-squared of autonomy on {complexity, distance, age} cannot be reported: 'No hazard ratio is fitted on the assembled population; every numerical value is illustrative or expected, never an executed finding,' and no episode has been coded. A propensity model, a common-support diagnostic, and an autonomy-on-controls R-squared all require the executed episode dataset, which does not exist. No retrieved source supplies these candidate-specific quantities. The question is therefore unanswered on its empirical terms. (raised by rubin)
- **[measurement]** The blinding experiment was never run, so the measured agreement between outcome-blind and outcome-aware autonomy codings does not exist. The protocol specifies a three-pass score (TechPort anchor, design-doc placement, independent second-reader re-coding with rubric adjudication) and argues pre-flight scoring 'defeats reverse coding,' but adjudication is 'against the documentation,' not against a blinded re-score, and no coder-blinded-to-end-state condition was executed or measured. The candidate asserts blindness by construction (pre-flight date stamp) rather than demonstrating it by the falsifiable agreement statistic Rubin demands; with no episodes coded there is no agreement number and no end-state correlation to report. Per Rubin, objective inference requires the design fixed while blind to outcomes; the assertion is untested. (raised by rubin)
- **[measurement]** The within-level composition that would settle the no-hidden-versions question is absent. The dissertation reports no enumeration of the distinct fault-management architectures assigned to each level, no per-level count, and no within-level architectural variance from the NTRS/JPL/TechPort coding; it concedes within-level heterogeneity exists but tabulates none of it. Until that table is produced, Level 2 (and each level) may be a bag of materially different treatments, so the per-level hazard ratio averages over ill-defined versions and is not the coherent single contrast H1 specifies. SETTLEABLE by tabulating the architectural composition within each coded level once episodes are coded; not yet done at design stage. (raised by rubin)
- **[identification]** REFUSED / GAP. The dissertation treats recurrent within-spacecraft episodes solely as a dependence-and-variance problem, handled by a spacecraft-clustered robust (sandwich) variance and a shared-frailty robustness model absorbing unobserved mission-level heterogeneity (sec 1.3, 4.2, 5.x; Appendix D). It nowhere audits between-episode changes to fault-management behavior, and it does not restate the estimand to acknowledge that an earlier episode can alter a later episode's treatment realization or potential outcomes. This is exactly the no-interference limb of SUTVA: a variance estimator corrects standard errors for dependence but cannot make a per-episode contrast coherent when earlier treatment realizations change later potential outcomes. No retrieved source (dissertation, rubin dossier, or space corpora this turn) supplies the between-episode-change counts for the assembled missions, because no such timeline audit has been executed at the design stage; therefore the interference-respecting estimand the question demands cannot be asserted. SETTLEABLE by auditing the assembled JPL/NTRS anomaly timelines for patches/reconfigurations/operational learning between successive episodes on the same spacecraft; the candidate has not done this and the clustered variance is, as charged, standing in for the missing interference analysis. (raised by rubin)
- **[empirics]** REFUSED / GAP on the outcome side. The dissertation's design-blinding discipline is applied only to the TREATMENT: autonomy is scored from pre-flight documentation to seal it from the outcome, and the inter-coder reliability schema (Appendix B, weighted kappa with CI) is reported only for the autonomy score, with a second reader re-coding only the autonomy level. For the OUTCOME and CENSORING it specifies 'source triangulation' (GAO corroboration of mission-ending losses) and a retained coding log of entry/terminal times and terminal type (sec 4.6.3), but it does NOT report: distinct coders for end-state/event-time, sealing of the autonomy label during outcome coding, or any inter-rater agreement statistic on the terminal-event classification or the time-to-event/censoring decision. Rubin (2008) requires the entire design, including how outcomes are determined, to be fixed while blind to the data so the inference is objective; if the same reader who knew or could infer a mission's autonomy level also fixed where time-to-event was censored and whether the terminus was 'recovery' or 'loss', the outcome and censoring are not sealed from the treatment, and differential outcome measurement can contaminate the hazard ratio. No retrieved source establishes outcome-side coder separation, label-sealing, or end-state/event-time inter-rater agreement; therefore the design's objectivity on the outcome side cannot be affirmed. SETTLEABLE by specifying and reporting an outcome-side blinded coding protocol with end-state and event-time inter-rater agreement; absent at the design stage. (raised by rubin)
- **[mechanism]** No retrieved source provides, for this candidate's assembled episodes, an estimated autonomy-by-dose interaction or spline coefficient, its sign, or an event-count power analysis demonstrating the curvature is resolvable rather than the mean slope. The pre-registration of which curvature sign would count as antifragile vs fair-weather, and the demonstration that the data can separate them, remains unanswered by retrieval and must be supplied by the candidate. (raised by taleb)
- **[measurement]** No retrieved source supplies the candidate's measured fraction of autonomous fault-handling events generating no codable record, broken out by autonomy level, nor a test statistic for whether recording probability correlates with autonomy. Whether a telemetry-reconstructable safe-mode calibration subset has been built and analyzed is not settled by retrieval; the differential-censoring magnitude is unanswered. (raised by taleb)
- **[rival]** No retrieved source supplies the candidate's coded proximate-cause partition of terminal events into (a) correct-but-insufficient, (b) ground-intervention-foreclosed-by-autonomy, (c) autonomy-as-documented-aggravating-cause, nor whether the autonomy-loss cell concentrates in the iatrogenic (b)/(c) categories. The empirical resolution of the iatrogenic rival is unanswered by retrieval and must be produced from the JPL anomaly/ISA narratives by the candidate. (raised by taleb)
- **[measurement]** No matched-pair count is recoverable from retrieval: the assembled fault-episode population, the per-spacecraft event table, and the comparability matching on complexity/distance/age do not exist in the candidate's materials (design-stage, not executed). The number of genuinely comparable high-vs-low-autonomy episode pairs is unknown and cannot be asserted. (raised by yin)
- **[rival]** No named within-case episodes can be produced: the candidate's defense of the program-quality rival is a sign-of-bias argument (conditioning on complexity and cost class makes the conditional HR an upper bound on autonomy's benefit) plus a promise of competing-risks and frailty specifications on the same scarce events. Yin requires the rival be defeated case by case with a mutually-exclusive predicted pattern matched against observed episodes. No such matched, program-quality-comparable episode pairs exist in the assembled corpus to discriminate autonomy from quality, so the rival is not ruled out by evidence and the claim cannot be settled affirmatively. (raised by yin)
- **[identification]** The coverage table does not exist in the candidate's materials: the count of contributing spacecraft and distinct mission classes, and the realized event distribution across classes, cannot be retrieved or asserted. The analytic-vs-statistical commitment can be named, but the empirical backing the question requires is absent. (raised by yin)
- **[identification]** REFUSED for lack of source support. Targeted retrieval (AMOS, ACTA, Space Economy brains; NTRS API; OpenAlex) returned no named, complexity/distance/age-matched high- vs low-autonomy fault-episode pairs that ALSO carry documented, differing requirements-stringency codings (review-gate count, abort-criteria conservatism, margin policy). AMOS/ACTA queries on 'autonomy fault detection safe mode survival' and 'spacecraft anomaly recovery autonomous' returned zero hits; the NTRS query on 'fault protection autonomy anomaly recovery mission survival' returned zero results; OpenAlex surfaced only general program-testing and observational-methods literature, not matched anomaly dyads. No grounded source this turn supplies the discriminating pairs, so no pair can be asserted. The absence is itself the finding the question demands: until such pairs are assembled, the population-level autonomy coefficient cannot adjudicate lever vs. marker, and the program-quality rival remains unmeasured rather than excluded. This is a defensible refusal under the no-confabulation contract, not an answer. (raised by yin)
- **[measurement]** Whether a SECOND reader can blind-code a requirements-stringency ordinal separately from the autonomy/DIR ordinal within NTRS + GAO + JPL anomaly records + TechPort is an inter-coder-separability fact that NO retrieved source establishes this turn. It is resolvable only by an actual blind double-coding pilot on a held-out program sample with a reported separability statistic; until that is run, the constitutive-confounding verdict (and thus whether beta_1 is interpretable as an onboard-system effect or merely a regime effect) remains open. This is the unresolved core of the measurement objection. (raised by yin)