NRC-4707: Safety Shutdown conservative acoustic inventory

This proposal is not accepted and provides no merge approval or engineering qualification. Publish it as a proposal-only draft under the NRC process. Keep the separately authorized, tested implementation in its sole draft PR. Neither draft may be described as ready until the relevant governance, compatibility, CI and human-review gates pass.

Context and problem

Merged #4708 repaired physical characteristic timing, valve equilibrium and the independent receiver pressure. Merged #4714 added prescribed actual valve travel and unit-aware Kv/US-Cv capacity; #4720 repaired exact absolute travel knots. They retain a changing-flow nodal MOC storage defect below unit Courant. Fresh unmodified baseline reproduces 50.37/25.19/12.59 mL errors on 51/101/201 nodes, against an unchanged 1e-9 m3 acoustic-volume target. The independently derived nodal defect identity passes, while physical conservation fails.

An endpoint node is a physical trace, not the spatial mean of an endpoint half-cell. Correcting the final pressure sum or rescaling boundary flux merely to fit nodal trapezoidal quadrature would hide this representation error. Coupled pump/disc and process-inventory qualification must not rely on it.

Decision

The following decision is proposed, not accepted:

  1. Integrate the existing linear acoustic characteristics over N-1 physical cells bounded by the N configured nodes. Use one shared pressure/flow Riemann trace at each face. Replace the numerical update inside WaterHammerPipe; do not add a second solver, selection flag, pipeline architecture or scheduler.
  2. Evolve cell mean pressure head by the conservative face-flow difference. Summing cells cancels every interior face exactly. Independently accumulate actual boundary exchange and compare it with cell pressure storage. No posthoc pressure correction, artificial inventory or flux rescaling.
  3. Reconstruct the initialized linear pressure gradient exactly and use signed implicit Darcy resistance about that reference. Terrain and steady friction remain balanced; momentum change is checked against independent physical pressure, gravity and friction impulses.
  4. Retain the existing event-localized pipe clock and complete requested interval. Boundary capacity uses right-endpoint hold over each internal interval, a declared first-order time quadrature preserving exact-knot semantics. Report endpoint traces separately from interval-integrated flux.
  5. Preserve existing ESD API names. Call the engineering study Safety Shutdown. Add defensive cell diagnostics and explicit acoustic balance output without promoting execution success or an acoustic balance PASS into safety approval.
  6. Preserve and label historical FAIL evidence. Require independent wave, impulse, energy, timing, equilibrium, volume, momentum and refinement gates before merging this candidate. Do not loosen a gate when a candidate fails.

Public contracts affected

Engineering and safety boundary

The physical PDE remains frozen-property, single-line, small-disturbance linear acoustics with a prescribed valve/receiver boundary. Density, viscosity, wave speed and Darcy friction are frozen from the actual initialized fluid; no water-property fallback. Effective wave speed includes wall elasticity.

An acoustic stored-volume identity is not a full EOS mass/energy ledger. First-order transport is diffusive and endpoint-held forcing needs time refinement. Inlet single-phase and positive finite pressure guards do not detect all transient phase-boundary or cavity risks. No pressure-floor cavity substitute, signed receiver thermodynamics or vapor-collapse model is supplied.

#2911 retains coordinator, physical identities, transactions and sampled-control ownership; #2907/#3298 retain multiphase/network physics; #4149 retains compressor physics; #3860 retains source terms. No shared-owner chain is changed here. Pump coastdown/inertia, dynamic check-valve slam, junctions, coupled safety execution, vector forces and structural screening remain separate dependencies. No SIL/SRS/proof-test, asset or piping-support approval follows from acceptance.

Compatibility and migration

Owners and independent reviewers must decide whether this is a compatible numerical correctness repair with explicit checkpoint reinitialization, or an incompatible persisted-method contract. That classification is not decided by the author. The public API lifecycle policy applies either way.

If incompatible, require the approved major-contract/release boundary, migration documentation and compatibility tests before the implementation merges or ships. This proposal does not waive those requirements or claim that retaining serialVersionUID alone preserves old checkpoint semantics.

Preserve original model inputs and old results with their exact source revision. For a new conservative case, initialize explicitly, retain its initial cell means, and advance the new state. Use cell means and accepted-substep exchange for inventory checks. Refine grid and time before interpreting corrected waveforms. New conservative checkpoints must replay all means and ledgers deterministically. No silent checkpoint conversion is claimed.

Validation and qualification evidence

The candidate is executed, not a source-only proposal. Its public evidence contains raw inputs/outputs, baseline FAIL, refinement, nearby cases, runtimes and exact source/runtime provenance. The ledger records commands and final head.

Exact-head hosted CI and independent accountable review remain separate gates. Analytical verification is not asset validation or a converged slow-actuator waveform. Calibration uses synthetic steady Kv selection only; wave/energy oracles are independent of that selection.

Alternatives considered

Rollback strategy

Keep this implementation draft until the governance and scientific gates pass. The branch is one coherent reversible increment from the exact recorded base; do not force-push, overwrite another owner or silently restore a known-invalid prediction as qualified. Preserve baseline and rejected evidence.

If a defect is found after release, identify affected model/state ranges and revert or repair the coherent numerical increment with its regressions. Retain checkpoint provenance and do not claim interchangeability between methods.

Decision record