Appendix: illustrative risk interventions

This appendix publishes the decision-relevant inputs and outputs for the frozen studies. Every numeric cell binds directly to the corresponding input or canonical output scalar. Complete input, output and binding JSON objects accompany the paper's replication record; the selected tables are readable extracts rather than substitutes for those exact objects. All cases are authored illustrations. No event rate, supplier performance, client engagement or actual committee outcome is represented.

The studies test different propositions and should not be ranked as interchangeable forecasts. Some isolate an intervention, some inspect a boundary and some deliberately create an invalid interpretation. Their adverse dispositions are part of the study design. The reader should first identify that purpose, then inspect the declared inputs, results, warnings and decision route. A mathematically favourable field cannot change the scope of the case.

The base case establishes the recurring shared-support mechanism. Prevention and mitigation have conditional effects only in the available state, while the unavailable state retains the gross chance and loss. The selected values are authored to make that dependency visible, not inferred from a real dispatch history. The case can support a controlled annual-value comparison and a question about decisive support evidence. It cannot establish actual operating readiness.

The completed disposition permits the bounded information inquiry and holds implementation. The positive optional arithmetic does not supply the missing support report, access or actual authority. The case also anchors the comparison with the deliberately different marginal surrogate. A reader should retain the base input identity when examining either alternative; silently changing the gross event or consequence would make the intervention attribution ambiguous.

The repair changes shared availability and annual control cost while retaining the gross event, consequence and conditional control effects. It is an isolated analytical intervention within the supplied mechanism. The improved annual expectation and positive net value support eligibility under the fictional optional condition. They do not show that the proposed support can be delivered, maintained or used during the relevant adverse state.

The completed implementation branch remains held. The information mandate investigates the support-performance basis, resource boundary, access and response capability. A favourable report on one item would not close every condition. The actual calendar date and delegation remain unresolved, so the relative preparation window is not an installation schedule. This case demonstrates bounded progress without an invented successful implementation.

The cost-heavy case retains the repair's protective inputs and increases its annual resource cost. It therefore has the same residual expected loss while producing a different optional economic answer. The negative net annual value rejects the stated optional proposal despite its lower loss relative to the base. The adverse result is preserved rather than replaced with a reassuring description of control effectiveness.

A separately established mandatory or mission condition could require a different appraisal. That route does not make the optional frozen result positive and does not remove the need to compare efficient alternatives. A changed cost, scope or mandate would require a fresh case and authority. This completed rejection is deliberately conditional, avoiding both an automatic endorsement of stronger protection and an indiscriminate rejection of costly controls.

The unavailable-support boundary removes the state in which conditional prevention and mitigation can operate. The residual expectation therefore equals the gross expectation under the declared mechanism. Annual control resources are still supplied, so paying for the activity does not generate a protective benefit. This is a boundary test of the representation rather than an estimate that an actual safeguard is always unavailable.

The completed adverse interpretation is to stop crediting the supplied protection in that boundary state. A real proposal would need to address the enabling capability or use a different intervention. The case does not establish that all aspects of the activity lack value, nor does it prescribe an operational shutdown. Its contribution is to make the common support dependency visible before a committee accepts a control label.

The available-support boundary applies the supplied conditional prevention and mitigation throughout the state representation. It tests whether the calculation reaches the intended controlled-state result. The fixture does not demonstrate that a real support capability achieves continuous availability. It is a logical limit that helps a reviewer interpret the intermediate mixture and distinguish support from conditional performance.

The case is arithmetically usable as a boundary and held as a claim of delivered availability. Actual continuous support would require a strong relevant basis and an assessment of omitted event paths. The publication therefore does not present this favourable limit as the preferred forecast. A boundary can verify formula meaning without providing a plausible operating estimate.

The surrogate deliberately supplies an all-available case with reduced conditional effects. It represents the tempting substitution of average marginal protection for the source shared-state mechanism. The canonical engine computes that separate fixture correctly. Its lower annual result does not validate its use as an interpretation of the original dependency, because the implied operating states differ.

The completed disposition holds that interpretation while preserving the exact negative test. A reviewer should compare the supplied fields and architecture, not merely decide which output seems plausible. This case demonstrates why computational equality to a formula is insufficient for mechanism validity. The repair would be a model whose states match the claimed architecture, or a withdrawal of the surrogate's use for that original claim.

The ineffective case retains the gross event but supplies no conditional prevention or mitigation. Increasing or maintaining availability cannot create a protective effect under those inputs. The residual expectation remains gross and the positive annual resource cost produces negative optional value. This tests the distinction between a capability being present and it changing the event path or consequence.

The protective interpretation is held, and the optional economic proposition fails. Another administrative or mandatory purpose might justify the activity, but it needs a separate mechanism and mandate. A reviewer should not improve the control rating merely because the activity is frequently available. The case focuses investigation on causal efficacy rather than rewarding support for an ineffective function.

The rare-major case changes gross probability and event loss while preserving the base annual gross expectation and conditional control inputs. It produces the same annual residual mean with a different event probability and conditional consequence. The illustration identifies an acceptance question that the mean cannot settle. It supplies no continuous loss distribution, loss quantile or actual capacity estimate.

The completed record holds equivalent-acceptability and consequence claims until a viable response capability is established under an actual mandate. The Operating Owner must identify resources, access and dependency in the declared major-event scenario. The hold is not a universal rule that every low-probability large-loss case must be rejected. It is a scoped response to a missing capability proposition in the fictional decision.

The cap case supplies an adverse probability multiplier that reaches the valid upper boundary of annual event chance. The engine preserves a bounded chance and emits a warning. It then calculates residual probability, conditional severity and annual expectation under the changed mechanism. Those outputs do not establish a repeated-event count or the probability of the joint stress scenario.

The completed disposition holds any count or percentile interpretation. If the actual decision concerns several interruptions, the analyst must define a count and consequence process with a suitable evidence basis. Increasing the stress multiplier cannot convert a saturated annual chance into that process. The case makes a warning decision useful by connecting it to the inference that must be reconsidered.

The distinct-loss case enters separate stipulated dispatch and telemetry contribution claims. The engine adds their annual expectations and resources. That sum is valid under the authored additive-incidence assumption without requiring a cross-risk independence assumption. The fixture does not establish that a real operator's claims are distinct or that simultaneous loss capacity is adequate.

The arithmetic is conditionally usable while actual incidence and joint consequence remain separate questions. The sorted output identifies the larger supplied mean entry, not a universal governance priority. A real report should retain the claim boundaries and relevant owners. This case is a positive expectation test with an explicit semantic condition, rather than a demonstration of a portfolio tail model.

The duplicate case intentionally enters one underlying contribution claim under different risk names. Required fields, finite values and unique names remain valid, so the engine reproduces the entered aggregate exactly. The aggregate is nevertheless held as a forecast of the underlying loss because its incidence is duplicated. This negative test targets meaning rather than arithmetic.

The repair is to count the consequence once while preserving the different causal routes and owner responsibilities. Deleting a useful qualitative entry is not necessarily required. Nor should the engine be forced to infer semantic identity from labels alone. The completed hold distinguishes a valid sum of supplied entries from an invalid real-world interpretation of those entries.

The free ineffective case has no conditional protection and no annual cost. The break-even convention returns a zero availability threshold because no resource cost needs to be recovered. Avoided expected loss remains absent. The fixture therefore tests whether a reader mistakenly interprets a favourable economic threshold as evidence of protective adequacy.

The completed disposition holds the protective claim while preserving the exact convention. An activity with another purpose could be assessed separately, but its cost-free status does not prove that it addresses the stated event. This case closes the set with an adverse interpretation that neither malformed-input checks nor a general preference for low-cost controls would detect.

The following paired boundary studies retain the default first risk row and change the named probability input only. When the gross event probability is supplied as zero, both base and stress event populations are empty. Their annual expected losses are defined as zero, but a severity conditional on those absent events is unavailable. In the stress-only case the base event population remains positive; only the stressed conditional severity becomes unavailable. This is different from an event that can occur but has a supplied zero monetary consequence, whose conditional monetary severity remains a meaningful zero. A source probability must therefore be retained beside a conditional quantity rather than inferred from its number or display format.

Reconcile each study through the relationship it was designed to expose. Compare the unavailable and available support states to understand the mixture; compare identical protective inputs with different costs to isolate economics; compare distinct and duplicated loss descriptions to inspect incidence; compare the free ineffective case with its protective claim to separate zero expense from benefit. The full outputs and scalar bindings allow these checks without reconstructing exact inputs from rounded print. A failed relation should identify the challenged field or mechanism. An unchanged rerun can confirm arithmetic, but cannot supply the absent operating observation or turn duplicated consequences into distinct losses.

The completed decision routes remain intentionally different. The isolated repair is eligible for evidence work but held for implementation; the costly optional proposal is rejected; the dependency, ineffective-control and free-control cases limit protective claims; the rare-major case holds consequence acceptance; the cap case holds a count interpretation; the duplicate case holds an aggregate forecast. These distinctions are the demonstrated analytical product. The cases do not collectively prove an optimal control portfolio or a real institution's readiness.