Mining Point-of-No-Return Boundaries in Constrained Dynamical Systems via Counterfactual Auditing

Source

• Raw Markdown: paper_ponr-counterfactual-auditing-2026.md
• PDF: paper_ponr-counterfactual-auditing-2026.pdf
• ACM DOI: https://doi.org/10.1145/3770855.3818127

Local ingest metadata includes a Crossref snapshot, PDF-verification record, and artifact manifest under papers/ponr-counterfactual-auditing-2026/; these provenance files are intentionally excluded from the public artifact surface.

Status And Credibility

This is a peer-reviewed full paper in the KDD 2026 proceedings, published online on 2026-08-08 and in the proceedings on 2026-08-09, pages 3198–3209. The uploaded 12-page ACM version-of-record PDF matches the DOI, title, 12-author list, venue, pagination, and CC BY 4.0 notice. KDD is a tier-1 data-mining venue, and the result is current relative to this wiki’s 2026 research horizon.

The strongest evidence is nevertheless author-reported and simulator-grounded. The primary domain is a Yangtze Estuary Delft3D hydrodynamic testbed accelerated with a learned U-shaped Neural Operator; cross-domain validation is one canonical damped bistable system. No official code, public audit-log dataset, project page, arXiv copy, independent replication, or official X announcement was verified during ingest. The paper says auditing logs are released, but the publisher record and exact-title/code searches did not identify a public artifact URL; this should be treated as an artifact-availability gap rather than inferred release.

Core Claim

A constraint has two distinct boundaries:

1. violation boundary: the first time current state becomes infeasible;
2. recoverability boundary: the last time an admissible intervention can still keep the future trajectory feasible.

The paper calls the second boundary the Point of No Return (PoNR). The interval after PoNR but before visible violation is the Zombie Zone: current safety slack is still non-negative, but failure is already unavoidable under the audited intervention class and horizon.

flowchart LR
  X["replayable snapshot x_t"] --> N["observed / deployed rollout"]
  X --> I["audited intervention class iota"]
  I --> R["counterfactual rollout"]
  R --> Y{"future path remains feasible for H?"}
  Y -->|yes| S["recoverable"]
  Y -->|no| L["irrecoverable"]
  S --> B["search latest savable snapshot"]
  L --> B
  B --> P["PoNR t*"]
  P --> Z["Zombie Zone until observed violation"]

The key conceptual shift is from asking “how close are we to a threshold?” to asking “does any allowed recovery protocol still exist from this state?”

Formal Contract

Let $m(s_t)$ be safety slack, where $m(s_t)\ge 0$ is feasible and $m(s_t)<0$ is a violation. For intervention protocol $\iota$, horizon $H$, and risk tolerance $\eta$:

$$y(x_t;\iota )=1\left[\mathrm{Pr}\left(\forall k\in [t+1,t+H],m(s_k)\ge 0\mid x_t,\mathrm{do}(\iota )\right)\ge 1-\eta \right].$$

The paper defines the recoverability boundary as

$$t^{\ast }(\iota )=\max \{t:y(x_t;\iota )=1\}.$$

If $t_{\mathrm{fail}}$ is the first observed violation, then actionable lead time is

$$\Delta =\max (0,t_{\mathrm{fail}}-{\hat{t}}^{\ast }(\iota )).$$

The deployed-versus-upper-bound decomposition is

$${\Delta }_{\mathrm{gap}}={\hat{t}}_{\mathrm{oracle}}^{\ast }-{\hat{t}}_{\mathrm{obs}}^{\ast }.$$

This quantity is conditional on the chosen intervention classes. A large gap says stronger or better decisions within that audited protocol could have preserved viability longer; it does not identify a universal physical boundary.

Counterfactual PoNR Auditing

Counterfactual PoNR Auditing (CPA) requires a simulator or digital twin with replayable snapshots. It branches several intervention rollouts from the same snapshot and packages each branch as an Evidence Object containing the restart state, intervention, trajectory, slack path, action/event stream, recoverability label, failure time, cost, simulator/policy versions, and seed.

CPA uses bisection when recoverability along the episode behaves like a one-way transition from savable to lost. The final candidate is verified with the high-fidelity simulator even when a surrogate proposes the bracket. In the reported 240 episode-capacity pairs:

• 234/240 (97.5%) have strict $1\to 0$ recoverability transitions;
• 236/240 (98.3%) give the same boundary under bisection and full scan.

The paper explicitly treats this monotonicity as protocol-dependent empirical evidence, not a universal axiom. Episodes are also censored: instant failures are excluded from boundary search; already-unsavable starts are left-censored; still-savable final snapshots are right-censored.

Evidence

Recoverability precedes visible failure

At maximum audited drainage capacity, threshold-ratio sensitivity across 75–98 risk episodes gives mean lead times from 1.23 to 1.80 hours and medians from 1.10 to 1.90 hours. The share with at least one hour of lead ranges from 0.64 to 0.84.

Static slack alarms are frequently later than the structural boundary. Across audited capacities, the paper reports late-alarm rates of 83.7–98.7% for a 0.5 m threshold and 58.2–81.3% for a 1.0 m threshold, with 1.42–2.01 hours of lag.

Capacity changes failure semantics

As maximum drainage capacity rises from 0.80 to 1.00, the mix shifts away from near-zero-lead structural failures toward a larger policy-gap fraction. Better actuators do not merely reduce failures; they can convert physical inevitability into decision-sensitive failures where controller quality and timing matter.

Offline labels can supervise cheap monitors

CPA itself is offline. The paper uses its mined labels to train lightweight early-warning models from the first two hourly snapshots. Figure 7 reports a no-capacity Random Forest ROC-AUC of $0.93\pm 0.04$ for predicting $t_{\mathrm{PoNR}}\le 1.5$ h; the full-feature figure is visually strong, while its exact AUC legend text is clipped in the rendered publisher figure. Table 8 gives a more operational comparison on 135 episodes:

Monitor	Late-alarm rate ↓	Mean lag (h) ↓	Mean absolute offset (h) ↓
Static observational	51.1	+0.46	1.00
Momentum observational	48.9	+0.39	0.92
Trend observational	48.1	+0.36	0.91
CPA-supervised logistic regression	32.6	-0.24	0.90
CPA-supervised Random Forest	32.6	-0.03	0.73

Momentum features such as changes in slack and maximum water height are more predictive than instantaneous slack, matching the wiki’s preference for dynamics-aware state rather than level-only alarms.

Snapshot alignment supports contrastive failure mining

The Failure Atlas compares a rapidly switching Panic controller and a Smooth controller from identical snapshots on $N=30$ episodes. Mean action-oscillation intensity is 0.430 versus 0.265. Physics-informed rollout tokens encode safety context and action change; contrastive 2-gram motifs are ranked with one-sided Fisher tests and Benjamini–Hochberg FDR control. Warn.St-Near.Up++ and Warn.St-Warn.St are significant at $q=0.021$ and $q=0.035$ respectively, whereas safer-state motifs are not significant.

This is a useful matched design, but it remains a small, hand-instantiated controller comparison and domain-specific tokenization. It shows that the Evidence Object interface can expose a motif; it does not establish a universal failure taxonomy.

Surrogate guidance reduces expensive rollouts

On 22 long-horizon episodes, one Delft3D rollout is reported as 72.0 minutes, versus 8.42 ms per UNO surrogate step. Surrogate guidance reduces final oracle verification from 3.09 to 1.00 calls per episode, for estimated 3.09× wall-clock speedup. Agreement with oracle PoNR is within $\pm 1$ hour on 86.4% of episodes (median absolute error 1.00 h; mean absolute error 0.91 h).

The headline 8 ms versus 72 min compares a surrogate step with an oracle rollout, not like-for-like end-to-end audits. The operationally supported speedup is the 3.09× reduction after retained high-fidelity verification.

Robustness And Boundary Conditions

• U-NO has reported overall NSE 0.9927; water-only MAE is 0.149 m.
• Multiplicative surrogate noise up to 30% shifts PoNR by less than one hour in the reported stress test; degradation appears above 40%.
• Structured $+0.05$ systematic/spatial biases retain 91.7%/92.5% oracle agreement and report no lost salvageable episodes.
• A 3 h actuator delay changes regime labels on 47.8% of pairs and loses 6.7% of salvageable episodes; at 5 h these become 53.7% and 20.8%.
• Varying audit horizon from 6 to 18 h changes regimes by only 0.4% in the reported table.
• A damped bistable system demonstrates a recoverability boundary when control is constrained and no bracket when control is strong enough in the plotted region.

The delay results are especially important: PoNR is not a state-only intrinsic property. It depends on actuator capacity, delay, horizon, risk tolerance, intervention family, simulator, disturbance model, and observation resolution.

Limitations

1. Simulator-conditional causality. Snapshot matching identifies effects inside the specified simulator and intervention protocol. It does not validate the simulator against all real interventions or eliminate model misspecification.
2. Narrow intervention class. In the hydrodynamic testbed, max drainage is optimal because of assumed dissipative monotonicity. Domains with competing constraints, multimodal recovery strategies, switching costs, or non-monotone actions need search or reachability methods rather than one bang-bang oracle.
3. Offline and replay-dependent. CPA requires restartable state and deterministic or controlled disturbance replay. Production systems often have hidden state, concurrent users, irreversible external effects, and non-replayable dependencies.
4. Small generalization surface. Primary evidence is one hydrodynamic testbed; cross-domain evidence is one canonical two-state dynamical system.
5. Boundary resolution. One-hour snapshots coarsen both PoNR and lead time; sub-hour policy decisions may be hidden.
6. Artifact gap. The paper states that logs are released, but no public code/data URL was verified at ingest.
7. Monitor protocol is underspecified. The paper does not clearly expose the train/test grouping and cross-validation contract for the early-warning experiment. Snapshot/episode and capacity leakage require explicit auditing before reuse.
8. Terminology risk. Zombie Zone is memorable but should be translated in durable cross-domain writing as the feasible-but-irrecoverable interval.

Relation To Existing Wiki Research

World models

This paper adds a deployment-facing evaluation target that ordinary next-step prediction misses. A world model should not only predict likely trajectories; it should answer whether an admissible control-input plan still exists that keeps constraints satisfied. This turns recoverability preservation into a probe of decision-relevant latent state.

Counterfactual-safe thermal control

The paper supplies the missing boundary label for Counterfactual Safe Thermal Control. For thermal systems, CPA would rewind a calibrated digital twin to pre-violation snapshots and estimate the last time an emergency cooling, flow, shutdown, or setpoint protocol can still satisfy temperature, pressure, gradient, and dwell-time constraints.

Kubernetes OTEL Control Gym

For Kubernetes OTEL Control Gym, the direct analogue is an operational recoverability boundary: the latest telemetry state from which one of the allowed remediation plans—rollback, scale-out, load shed, circuit breaking, traffic shift, queue drain, or restart—can still avoid an SLO or safety violation. Incident labels then separate:

• structural/operationally unavoidable: no audited remediation can recover in time;
• policy gap: an allowed remediation could have preserved viability, but the deployed agent did not choose it;
• manageable: substantial recovery window remained.

This is stronger supervision than incident/no incident, because it labels when options disappeared and whether failure was due to capacity or decision quality.

LLM agents and action-conditioned world models

The paper supports a division of labor in LLM Agents Need Action-Conditioned World Models: an LLM can explain and propose remediation; a world model or verified simulator estimates consequence and recoverability; a lightweight distilled monitor predicts approaching loss of viability online. The expensive simulator is the teacher, not necessarily the serving-time controller.

Relation To Foundation TSFM Agenda

Agenda slot	Verdict	Evidence	Missing pieces
Control and counterfactuals	partially closes	Defines replayable, snapshot-aligned alternative control-input branches and a policy-gap decomposition.	Needs learned candidate-action rollout, broader intervention classes, partial observability, stochastic exogenous variables, and real-system validation.
Rare-event supervision	partially closes	Converts expensive simulator audits into PoNR labels and failure motifs; lightweight models predict near-term boundary crossing.	Needs leakage-safe cross-system splits, calibration, class imbalance reporting, and independent reproduction.
World-model evaluation	important new probe	Tests whether predicted dynamics preserve a finite-horizon recoverability predicate, not only average forecast error.	Need calibrated uncertainty, multi-modal recovery plans, model-error-aware certificates, and comparisons with reachability/viability kernels.
Data contract	partially closes	Evidence Objects preserve snapshot, intervention, trajectory, constraints, outcome, cost, versions, and seeds.	Add observation masks, event timing, failed-action receipts, topology, branch support/OOD scores, and explicit intervention-family versioning.

Research Direction: Recoverability-Centric World Models

A useful extension for this wiki is to train or evaluate action-conditioned time-series world models on three coupled targets:

$$\text{future trajectory distribution}+\text{recoverability value}+\text{time-to-loss-of-viability}.$$

The model should estimate

$$R_H(b_t,\mathcal{U},\mathcal{C})=\mathrm{Pr}\left[\exists U_{t:t+H}\in \mathcal{U}:C(x_{t+1:t+H})=1\mid b_t\right],$$

where $b_t$ is maintained belief state, $\mathcal{U}$ is the versioned admissible control-input family, and $\mathcal{C}$ is the constraint contract. This makes recoverability a property of belief + capabilities + constraints + horizon, not a scalar property of the observation.

A minimal experiment should compare:

1. current-level thresholding;
2. passive forecast of future violations;
3. action-conditioned rollout with candidate remediation;
4. simulator-mined PoNR labels distilled into an online monitor.

Evaluation should report PoNR error, late-alarm rate, false-alarm burden, actionable lead-time calibration, recoverability classification, salvage regret from delayed actions, robustness to model bias, and oracle-call cost.

Related Pages

• Counterfactual PoNR Auditing entity
• World Models
• Causal Time Series
• Action-Conditioned Time-Series Datasets
• Foundation Time-Series Model Research Agenda
• Counterfactual Safe Thermal Control
• Kubernetes OTEL Control Gym
• LLM Agents Need Action-Conditioned World Models
• CFLight
• medDreamer