Mining Point-of-No-Return Boundaries in Constrained Dynamical Systems via Counterfactual Auditing

Source

• Raw Markdown: paper_ponr-counterfactual-auditing-2026.md
• PDF: paper_ponr-counterfactual-auditing-2026.pdf
• ACM DOI: https://doi.org/10.1145/3770855.3818127

Local ingest metadata includes a Crossref snapshot, PDF-verification record, and artifact manifest under papers/ponr-counterfactual-auditing-2026/; these provenance files are intentionally excluded from the public artifact surface.

Status And Credibility

This is a peer-reviewed full paper in the KDD 2026 proceedings, published online on 2026-08-08 and in the proceedings on 2026-08-09, pages 3198–3209. The uploaded 12-page ACM version-of-record PDF matches the DOI, title, 12-author list, venue, pagination, and CC BY 4.0 notice. KDD is a tier-1 data-mining venue, and the result is current relative to this wiki’s 2026 research horizon.

The strongest evidence is nevertheless author-reported and simulator-grounded. The primary domain is a Yangtze Estuary Delft3D hydrodynamic testbed accelerated with a learned U-shaped Neural Operator; cross-domain validation is one canonical damped bistable system. No official code, public audit-log dataset, project page, arXiv copy, independent replication, or official X announcement was verified during ingest. The paper says auditing logs are released, but the publisher record and exact-title/code searches did not identify a public artifact URL; this should be treated as an artifact-availability gap rather than inferred release.

Core Claim

A constraint has two distinct boundaries:

1. violation boundary: the first time current state becomes infeasible;
2. recoverability boundary: the last time an admissible intervention can still keep the future trajectory feasible.

The paper calls the second boundary the Point of No Return (PoNR). The interval after PoNR but before visible violation is the Zombie Zone: current safety slack is still non-negative, but failure is already unavoidable under the audited intervention class and horizon.

flowchart LR
  X["replayable snapshot x_t"] --> N["observed / deployed rollout"]
  X --> I["audited intervention class iota"]
  I --> R["counterfactual rollout"]
  R --> Y{"future path remains feasible for H?"}
  Y -->|yes| S["recoverable"]
  Y -->|no| L["irrecoverable"]
  S --> B["search latest savable snapshot"]
  L --> B
  B --> P["PoNR t*"]
  P --> Z["Zombie Zone until observed violation"]

The key conceptual shift is from asking “how close are we to a threshold?” to asking “does any allowed recovery protocol still exist from this state?”

Formal Contract

Let $m(s_t)$ be safety slack, where $m(s_t)\ge 0$ is feasible and $m(s_t)<0$ is a violation. For intervention protocol $\iota$, horizon $H$, and risk tolerance $\eta$:

$$y(x_t;\iota )=1\left[\mathrm{Pr}\left(\forall k\in [t+1,t+H],m(s_k)\ge 0\mid x_t,\mathrm{do}(\iota )\right)\ge 1-\eta \right].$$

The paper defines the recoverability boundary as

$$t^{\ast }(\iota )=\max \{t:y(x_t;\iota )=1\}.$$

If $t_{\mathrm{fail}}$ is the first observed violation, then actionable lead time is

$$\Delta =\max (0,t_{\mathrm{fail}}-{\hat{t}}^{\ast }(\iota )).$$

The deployed-versus-upper-bound decomposition is

$${\Delta }_{\mathrm{gap}}={\hat{t}}_{\mathrm{oracle}}^{\ast }-{\hat{t}}_{\mathrm{obs}}^{\ast }.$$

This quantity is conditional on the chosen intervention classes. A large gap says stronger or better decisions within that audited protocol could have preserved viability longer; it does not identify a universal physical boundary.

Counterfactual PoNR Auditing

Counterfactual PoNR Auditing (CPA) requires a simulator or digital twin with replayable snapshots. It branches several intervention rollouts from the same snapshot and packages each branch as an Evidence Object containing the restart state, intervention, trajectory, slack path, action/event stream, recoverability label, failure time, cost, simulator/policy versions, and seed.

CPA uses bisection when recoverability along the episode behaves like a one-way transition from savable to lost. The final candidate is verified with the high-fidelity simulator even when a surrogate proposes the bracket. In the reported 240 episode-capacity pairs:

• 234/240 (97.5%) have strict $1\to 0$ recoverability transitions;
• 236/240 (98.3%) give the same boundary under bisection and full scan.

The paper explicitly treats this monotonicity as protocol-dependent empirical evidence, not a universal axiom. Episodes are also censored: instant failures are excluded from boundary search; already-unsavable starts are left-censored; still-savable final snapshots are right-censored.

Evidence

Recoverability precedes visible failure

At maximum audited drainage capacity, threshold-ratio sensitivity across 75–98 risk episodes gives mean lead times from 1.23 to 1.80 hours and medians from 1.10 to 1.90 hours. The share with at least one hour of lead ranges from 0.64 to 0.84.

Static slack alarms are frequently later than the structural boundary. Across audited capacities, the paper reports late-alarm rates of 83.7–98.7% for a 0.5 m threshold and 58.2–81.3% for a 1.0 m threshold, with 1.42–2.01 hours of lag.

Capacity changes failure semantics

As maximum drainage capacity rises from 0.80 to 1.00, the mix shifts away from near-zero-lead structural failures toward a larger policy-gap fraction. Better actuators do not merely reduce failures; they can convert physical inevitability into decision-sensitive failures where controller quality and timing matter.

Offline labels can supervise cheap monitors

CPA itself is offline. The paper uses its mined labels to train lightweight early-warning models from the first two hourly snapshots. Figure 7 reports a no-capacity Random Forest ROC-AUC of $0.93\pm 0.04$ for predicting $t_{\mathrm{PoNR}}\le 1.5$ h; the full-feature figure is visually strong, while its exact AUC legend text is clipped in the rendered publisher figure. Table 8 gives a more operational comparison on 135 episodes:

Monitor	Late-alarm rate ↓	Mean lag (h) ↓	Mean absolute offset (h) ↓
Static observational	51.1	+0.46	1.00
Momentum observational	48.9	+0.39	0.92
Trend observational	48.1	+0.36	0.91
CPA-supervised logistic regression	32.6	-0.24	0.90
CPA-supervised Random Forest	32.6	-0.03	0.73

Momentum features such as changes in slack and maximum water height are more predictive than instantaneous slack, matching the wiki’s preference for dynamics-aware state rather than level-only alarms.

Snapshot alignment supports contrastive failure mining

The Failure Atlas compares a rapidly switching Panic controller and a Smooth controller from identical snapshots on $N=30$ episodes. Mean action-oscillation intensity is 0.430 versus 0.265. Physics-informed rollout tokens encode safety context and action change; contrastive 2-gram motifs are ranked with one-sided Fisher tests and Benjamini–Hochberg FDR control. Warn.St-Near.Up++ and Warn.St-Warn.St are significant at $q=0.021$ and $q=0.035$ respectively, whereas safer-state motifs are not significant.

This is a useful matched design, but it remains a small, hand-instantiated controller comparison and domain-specific tokenization. It shows that the Evidence Object interface can expose a motif; it does not establish a universal failure taxonomy.

Surrogate guidance reduces expensive rollouts

On 22 long-horizon episodes, one Delft3D rollout is reported as 72.0 minutes, versus 8.42 ms per UNO surrogate step. Surrogate guidance reduces final oracle verification from 3.09 to 1.00 calls per episode, for estimated 3.09× wall-clock speedup. Agreement with oracle PoNR is within $\pm 1$ hour on 86.4% of episodes (median absolute error 1.00 h; mean absolute error 0.91 h).

The headline 8 ms versus 72 min compares a surrogate step with an oracle rollout, not like-for-like end-to-end audits. The operationally supported speedup is the 3.09× reduction after retained high-fidelity verification.

Robustness And Boundary Conditions

• U-NO has reported overall NSE 0.9927; water-only MAE is 0.149 m.
• Multiplicative surrogate noise up to 30% shifts PoNR by less than one hour in the reported stress test; degradation appears above 40%.
• Structured $+0.05$ systematic/spatial biases retain 91.7%/92.5% oracle agreement and report no lost salvageable episodes.
• A 3 h actuator delay changes regime labels on 47.8% of pairs and loses 6.7% of salvageable episodes; at 5 h these become 53.7% and 20.8%.
• Varying audit horizon from 6 to 18 h changes regimes by only 0.4% in the reported table.
• A damped bistable system demonstrates a recoverability boundary when control is constrained and no bracket when control is strong enough in the plotted region.

The delay results are especially important: PoNR is not a state-only intrinsic property. It depends on actuator capacity, delay, horizon, risk tolerance, intervention family, simulator, disturbance model, and observation resolution.

Limitations

1. Simulator-conditional causality. Snapshot matching identifies effects inside the specified simulator and intervention protocol. It does not validate the simulator against all real interventions or eliminate model misspecification.
2. Narrow intervention class. In the hydrodynamic testbed, max drainage is optimal because of assumed dissipative monotonicity. Domains with competing constraints, multimodal recovery strategies, switching costs, or non-monotone actions need search or reachability methods rather than one bang-bang oracle.
3. Offline and replay-dependent. CPA requires restartable state and deterministic or controlled disturbance replay. Production systems often have hidden state, concurrent users, irreversible external effects, and non-replayable dependencies.
4. Small generalization surface. Primary evidence is one hydrodynamic testbed; cross-domain evidence is one canonical two-state dynamical system.
5. Boundary resolution. One-hour snapshots coarsen both PoNR and lead time; sub-hour policy decisions may be hidden.
6. Artifact gap. The paper states that logs are released, but no public code/data URL was verified at ingest.
7. Monitor protocol is underspecified. The paper does not clearly expose the train/test grouping and cross-validation contract for the early-warning experiment. Snapshot/episode and capacity leakage require explicit auditing before reuse.
8. Terminology risk. Zombie Zone is memorable but should be translated in durable cross-domain writing as the feasible-but-irrecoverable interval.

Conceptual Interpretation

The claims in this section are a research synthesis built from the paper’s recoverability framing, not additional empirical results reported by the authors.

Failure as the disappearance of viable futures

Threshold monitoring treats failure as a point event: the system crosses a constraint and becomes unsafe. The PoNR framing suggests a different ontology. Failure develops as a process in which admissible safe continuations disappear. A state can remain observationally feasible while every audited continuation already ends in violation. Under this view, the operationally meaningful boundary is not only the first violated constraint but the earlier loss of the last viable branch.

For belief state $b_t$, admissible control-input family $\mathcal{U}$, constraint contract $\mathcal{C}$, and horizon $H$, define the viable continuation set

$${\mathcal{V}}_H(b_t;\mathcal{U},\mathcal{C})=\left\{U_{t:t+H}\in \mathcal{U}:\mathrm{Pr}\left[C(x_{t+1:t+H})=1\mid b_t,U_{t:t+H}\right]\ge 1-\eta \right\}.$$

When recoverability follows the protocol’s observed one-way transition, PoNR marks the change from ${\mathcal{V}}_H\ne \varnothing$ to ${\mathcal{V}}_H=\varnothing$ for the audited contract. This makes safety partly a property of the remaining future option set rather than only the current observation.

Safety as preservation of optionality

A policy can satisfy the current constraint while steering the system into a fragile region where only one precisely timed recovery remains. Conversely, a conservative action can preserve several safe continuations even when it is not immediately reward-maximizing. This motivates a broader control objective: preserve the existence, diversity, margin, and delay robustness of viable continuations, not merely expected reward or instantaneous safety slack.

The binary PoNR label captures only whether at least one audited continuation remains. A richer world-model target could characterize the geometry of ${\mathcal{V}}_H$: how many qualitatively distinct recovery plans remain, how much actuator or timing margin they have, and how stable the answer is under model uncertainty. This is a hypothesis for future work, not something established by the paper’s experiments.

Recoverability is relational and capability-conditioned

An observation is not intrinsically recoverable or irrecoverable. Recoverability is a relation among maintained belief state, available capabilities, intervention semantics, delay, constraints, risk tolerance, horizon, and the model used to evaluate consequences:

$$R_H(b_t,\mathcal{U},\mathcal{C},\eta ,\mathcal{M}).$$

The same physical state can be recoverable for one controller and irrecoverable for another, or recoverable under immediate action and irrecoverable after execution delay. PoNR labels therefore MUST carry their capability and contract context. Collapsing them into a universal state-only risk score would erase the very distinction the audit is designed to expose.

From prediction to agency-aware evaluation

Passive forecasting asks whether violation is likely under the continuation represented in the data. Recoverability auditing asks whether an admissible alternative continuation still exists. The latter evaluates a model’s representation of agency: actions are not merely correlated covariates but mechanisms that alter which futures remain reachable.

For action-conditioned time-series world models, average trajectory error is consequently insufficient. A model can predict common trajectories accurately while moving the recoverability boundary, ranking recovery plans incorrectly, or missing a rare viable branch. Preserving PoNR and viable-set structure is a stricter probe of decision-relevant latent state.

Outcome attribution and responsibility

Final outcome alone conflates several causes. A recoverability audit can separate at least four cases within its explicitly audited scope:

• structural or capability-limited failure: no admissible recovery branch remained;
• policy failure: a viable branch existed but the deployed policy did not select it;
• timing or execution failure: a suitable action existed but was delayed or not executed as specified;
• model failure: the learned model incorrectly estimated consequences or recoverability.

This decomposition supports fairer evaluation of controllers and agents because it distinguishes inherited impossibility from a missed opportunity. It remains conditional on simulator fidelity and the completeness of the intervention family: an unmodeled recovery action can make an apparently structural failure only an artifact of the audit contract.

The simulator as an offline teacher

The paper supports a useful division of labor. A high-fidelity simulator performs expensive matched counterfactual audits offline; the resulting Evidence Objects supervise cheaper models that estimate imminent loss of viability online. The simulator need not sit in every serving-time decision loop, but it remains the verifier and provenance source for the labels.

This teacher-distillation pattern is attractive only when the boundary is preserved. Distillation should therefore be evaluated by PoNR error, late-alarm rate, calibration, lost salvageable episodes, robustness to capability shifts, and oracle-call cost—not only by generic classification accuracy.

Relation To Existing Wiki Research

World models

This paper adds a deployment-facing evaluation target that ordinary next-step prediction misses. A world model should not only predict likely trajectories; it should answer whether an admissible control-input plan still exists that keeps constraints satisfied. This turns recoverability preservation into a probe of decision-relevant latent state.

Counterfactual-safe thermal control

The paper supplies the missing boundary label for Counterfactual Safe Thermal Control. For thermal systems, CPA would rewind a calibrated digital twin to pre-violation snapshots and estimate the last time an emergency cooling, flow, shutdown, or setpoint protocol can still satisfy temperature, pressure, gradient, and dwell-time constraints.

LLM agents and action-conditioned world models

The paper supports a division of labor in LLM Agents Need Action-Conditioned World Models: an LLM can explain and propose remediation; a world model or verified simulator estimates consequence and recoverability; a lightweight distilled monitor predicts approaching loss of viability online. The expensive simulator is the teacher, not necessarily the serving-time controller.

Relation To Foundation TSFM Agenda

Agenda slot	Verdict	Evidence	Missing pieces
Control and counterfactuals	partially closes	Defines replayable, snapshot-aligned alternative control-input branches and a policy-gap decomposition.	Needs learned candidate-action rollout, broader intervention classes, partial observability, stochastic exogenous variables, and real-system validation.
Rare-event supervision	partially closes	Converts expensive simulator audits into PoNR labels and failure motifs; lightweight models predict near-term boundary crossing.	Needs leakage-safe cross-system splits, calibration, class imbalance reporting, and independent reproduction.
World-model evaluation	partially closes	Tests whether action-conditioned rollouts preserve a finite-horizon recoverability predicate, not only average forecast error.	Need calibrated uncertainty, multi-modal recovery plans, model-error-aware certificates, and comparisons with reachability/viability kernels.
Data contract	partially closes	Evidence Objects preserve snapshot, intervention, trajectory, constraints, outcome, cost, versions, and seeds.	Add observation masks, event timing, failed-action receipts, topology, branch support/OOD scores, and explicit intervention-family versioning.

Research Direction: Recoverability-Centric World Models

A useful extension for this wiki is to train or evaluate action-conditioned time-series world models on three coupled targets:

$$\text{future trajectory distribution}+\text{recoverability value}+\text{time-to-loss-of-viability}.$$

The model should estimate

$$R_H(b_t,\mathcal{U},\mathcal{C})=\mathrm{Pr}\left[\exists U_{t:t+H}\in \mathcal{U}:C(x_{t+1:t+H})=1\mid b_t\right],$$

where $b_t$ is maintained belief state, $\mathcal{U}$ is the versioned admissible control-input family, and $\mathcal{C}$ is the constraint contract. This makes recoverability a property of belief + capabilities + constraints + horizon, not a scalar property of the observation.

A minimal experiment should compare:

1. current-level thresholding;
2. passive forecast of future violations;
3. action-conditioned rollout with candidate remediation;
4. simulator-mined PoNR labels distilled into an online monitor.

Evaluation should report PoNR error, late-alarm rate, false-alarm burden, actionable lead-time calibration, recoverability classification, salvage regret from delayed actions, robustness to model bias, and oracle-call cost.

Related Pages

• Counterfactual PoNR Auditing entity
• World Models
• Causal Time Series
• Action-Conditioned Time-Series Datasets
• Foundation Time-Series Model Research Agenda
• Counterfactual Safe Thermal Control
• LLM Agents Need Action-Conditioned World Models
• CFLight
• medDreamer