{
  "schema_version": "engineering-by-selection-pressure-evidence/v1",
  "package_id": "engineering-by-selection-pressure-shadow-control-2026-08-22",
  "subject": "A privacy-safe settlement-destination mismatch and its observe-only shadow detector",
  "source_provenance": {
    "source_class": "historical_private_dogfood_receipt",
    "source_revision": "4522921db627bd9a89e26cadad7b8724681935a0",
    "stabilized_revision": "cc8c8b0c8458f79514be9bee8e1282015f16776c",
    "source_receipt_sha256": "759562af254b300968a43f18175b752a8010e7df854e260d8d3b2def43ef4926",
    "public_projection": "Only normalized failure behavior, bounded measurements, control semantics, and limitations are included. Client and transaction data are excluded."
  },
  "claims": [
    {
      "id": "C-01",
      "statement": "Exactly one real historical occurrence was observed.",
      "evidence_kind": "source",
      "subject_class": "real",
      "value": 1,
      "unit": "occurrence"
    },
    {
      "id": "C-02",
      "statement": "The visible path reached paid, fulfilled, and shipped states while settlement ownership failed the selected outcome.",
      "evidence_kind": "source",
      "subject_class": "real"
    },
    {
      "id": "C-03",
      "statement": "Settlement ownership was outside the apparent completion signals, allowing the mismatch to escape those checks.",
      "evidence_kind": "source",
      "subject_class": "real"
    },
    {
      "id": "C-04",
      "statement": "Absent destination routing at the historical observation supplied an explicit deterministic recurrence basis while that state remained unchanged; no second occurrence is claimed.",
      "evidence_kind": "source",
      "subject_class": "historical"
    },
    {
      "id": "C-05",
      "statement": "Control version 1.0.0 runs in shadow mode and has observe-only enforcement effect.",
      "evidence_kind": "source",
      "subject_class": "control",
      "control_version": "1.0.0",
      "control_mode": "shadow"
    },
    {
      "id": "C-06",
      "statement": "The decision rule allows matching evidence, rejects mismatching evidence in shadow, defers missing evidence, and ignores unrelated observations.",
      "evidence_kind": "probe",
      "subject_class": "fixture_calibration"
    },
    {
      "id": "C-07",
      "statement": "The downloadable artifact is the vendor-neutral AR-1 incident schema copied byte-for-byte from its canonical revision.",
      "evidence_kind": "source",
      "subject_class": "artifact",
      "artifact_origin_revision": "bcb8539966052125f5a68beea137a2ab3d25b4f8",
      "artifact_origin": "schemas/agent-reliability/incident.schema.json"
    },
    {
      "id": "C-08",
      "statement": "The bounded replay reproduced one known real mismatch, did not reject two known negative cases, deferred one incomplete case, and recorded no false positive or false negative within that labeled set.",
      "evidence_kind": "probe",
      "subject_class": "mixed_replay",
      "measurements": {
        "known_positive_cases": 1,
        "known_negative_cases": 2,
        "incomplete_cases_deferred": 1,
        "false_positives": 0,
        "false_negatives": 0
      }
    },
    {
      "id": "C-09",
      "statement": "The evaluation recorded no human work, no production mutations, and no external service cost; evaluation runtime was unavailable.",
      "evidence_kind": "probe",
      "subject_class": "environment_state",
      "measurements": {
        "human_work_added_minutes": 0,
        "production_mutations": 0,
        "external_cost_usd": 0,
        "evaluation_runtime": "unavailable"
      }
    },
    {
      "id": "C-10",
      "statement": "The post-control window had no eligible real observations, so no outcome improvement is claimed.",
      "evidence_kind": "probe",
      "subject_class": "environment_state",
      "eligible_real_observations": 0,
      "result": "insufficient_data"
    },
    {
      "id": "C-11",
      "statement": "The evidence cannot prove a second occurrence, current production routing, post-control improvement, enforcement readiness, portability, or external replication.",
      "evidence_kind": "source_and_probe",
      "subject_class": "limit"
    },
    {
      "id": "C-12",
      "statement": "The control remains shadow until its predeclared post-window and negative-control conditions are satisfied.",
      "evidence_kind": "source",
      "subject_class": "promotion_policy",
      "minimum_post_window_seconds": 604800,
      "minimum_eligible_real_observations": 2,
      "maximum_mismatch_rate": 0,
      "negative_controls_must_pass": true,
      "current_decision": "remain_shadow"
    }
  ],
  "cannot_prove": [
    "A second real occurrence",
    "The current production routing state",
    "Any post-control outcome improvement",
    "Readiness for enforcement",
    "Portability to another system",
    "External replication or market demand"
  ]
}