Appendix: control and governance worksheets

This appendix joins the fictional role exchange, exact case results and unresolved dates, access and terms into one decision sequence. The exchange is authored, with no actual meeting, payment, installation or operating report. Read each stage for the permitted information act, the condition that remains adverse and the evidence needed to change it. A completed sequence can therefore show bounded progress while implementation stays held.

At initiation, the Chair identifies the proposed act as an information purchase, not implementation of the repair. The decisive question is whether common operating support can be evidenced for the relevant exposure and whether the major-event response is viable. The scope excludes an installation commitment, insurance execution and emergency operating instructions. The cap and gate belong to this information act. The annual model's cost fields remain economic inputs rather than spending authorisations. This separation prevents the proposal's attractive annual value from creating an undefined resource mandate.

The custodian assembles the actual retained public guidance and frozen model objects. Those objects are verified within their research scope. The custodian records that no actual dispatch logs, supplier service terms, access permits or real delegation have been supplied. This is a completed status response, not an incomplete worksheet waiting for invented evidence. The missing objects limit what can be established. They do not prove an adverse operating state or justify replacing an unknown field with the analyst's preferred parameter.

The Operating Owner's stipulated exchange tests the claim that a favourable demonstration would be sufficient. The fictional response describes a demonstration in an available-support state, without a demand-relevant exposure record for the unavailable state. That response is an authored challenge proposition; it is not a test report retained as empirical evidence. Its relevance is limited to conditional capability. The reviewer asks whether it establishes the shared availability used in the repair fixture. It does not. The implementation hold therefore survives an apparently favourable functional response.

The Mechanism Analyst preserves the controlled comparison. The repair changes support availability and annual cost, while the gross event, severity and conditional effects remain fixed. The expensive repair has the same protective inputs with another cost. The analyst does not lower the gross event chance in order to rescue the expensive branch. The Chair receives a positive optional value for the repair and a negative optional value for the cost-heavy package. That adverse distinction remains visible even though the latter's loss expectation is lower than the base case.

The Chair rejects the cost-heavy optional proposition under its declared condition. The Operating Owner may request appraisal of a separately established mandatory objective, but none is invented to reverse the result. A changed cost or response scope would also require a new case. The decision thus has a reopening route without erasing its basis. The rejection is not a statement that expensive protection is always inappropriate. It is a completed answer to the particular optional comparison the record asked the model to support.

The optional decisions remain anchored to the repair's USD 102.00 thousand and cost-heavy package's USD -18.00 thousand net annual values. The response exchange does not change those frozen inputs. It challenges whether a favourable available-state demonstration can establish the repair's availability proposition. This controlled separation is important: an evidential hold should not be disguised as a new arithmetic failure, and an arithmetic success should not close the evidential hold.

The Chair ends the mandate with exact case implications retained and the support, response capability, terms and calendar for implementation still unresolved. The stop identifies what a fresh mandate must address; it does not erase the useful information work or imply a successful installation. This mixed ending is the supported result of the fictional sequence.

The Assurance Reviewer then examines the surrogate, incidence and probability-warning claims. The surrogate is exact for a different mechanism, the duplicate sum is exact for duplicated entries and the capped annual chance does not represent a count. Each calculation remains reproducible. The reviewer holds the proposed interpretations rather than forcing an unnecessary algorithm change. The analyst preserves the negative cases so another reader can challenge the reasoning. This exchange shows how technical assurance and semantic review can disagree about use without disagreeing about arithmetic.

The major-consequence record reaches another unresolved proposition. Matching the base annual mean does not establish alternative dispatch capability, access or resources for the stipulated major event. The Operating Owner has not supplied those objects. The Chair holds equivalent-acceptability and implementation claims. No cash shortfall, recovery duration or actual system failure is invented. The next evidence question is specific: identify the capability and its dependencies at the required boundary. That question is different from renegotiating an optional annual cost.

At the information gate, the relevant availability and response propositions remain unresolved. The Chair stops the original mandate unless a fresh scoped authority is granted. The implementation hold continues. The custodian preserves the actual evidence access status and the reason the question was not completed. A continued need for the answer is not treated as automatic renewal. The relative calendar still does not establish an actual installation date or operating window. This completed ending avoids a fictional successful delivery that the evidence cannot support.

The record distinguishes several forms of incompletion. A missing support basis calls for a relevant evidence object. A failed optional condition calls for changed economics or mandate. A wrong mechanism calls for a corrected representation. Duplicate incidence calls for a reconciled loss claim. A count question calls for another stochastic representation. A missing response capability calls for resources, access and authority. These different repair routes make the record practically useful. Simply asking for more analysis would not tell the next owner which proposition to address.

A real adaptation should preserve the sequence but replace the fictional authority and parameters. The actual institution should identify its existing exposure during the hold, real spending limits, available operating powers and legal or mission constraints. The paper does not establish that deferring implementation is safe at a real site. It demonstrates how to record a bounded research decision without claiming unsupported operating acceptance. A real interim exposure requires its own owner and authority, especially if the current system already has a material unresolved risk.

Trace each held or rejected act through the completed worksheet to its cause and reopening condition. The entries correspond to the retained case lineage and fictional exchange; adaptation requires actual policy and evidence. A repeated evidence ID preserves the same proposition across stages. It creates neither another source nor an independent observation.