Worked examples
Examples across domains
The eight examples below are Section 7 of the canonical definition, reproduced verbatim. Each is followed by the three-condition check and the counterfactual that would reveal it.
They are illustrative composites, written to be recognizable rather than sourced to a named organization; documented cases reconstructed from primary investigation reports are on the Evidence page. Sourced cases — each passing the inclusion test against published records, or labeled as a composite — are the work of the forthcoming Field Manual (see Section 9). Every record in every example is correct; that is the point.
How to read the check §
Silent Expiry is present when, and only when, three conditions hold together: a reason existed; the premise lies outside the control’s verification; the failure is mute (Section 1). The check states, for each example, why each condition holds — and then the counterfactual: the question that would have revealed the fallen premise, and who could have answered it. A verdict is a finding, and is marked as one.
Manufacturing — the sampling plan §
Manufacturing. Incoming inspection samples eight castings per lot — a sound plan when the supplier’s reject rate sat below one percent. The supplier changes its sand source; the rate quadruples. Sampling continues, correctly executed, and the plan protects a supplier that no longer exists.
| 1 · A reason existed | Eight per lot was adequate for a reject rate under one percent, and the rate was under one percent when the plan was written. |
|---|---|
| 2 · Separated | The plan records the sample size. The reject rate it assumed is recorded nowhere the receiving audit looks. |
| 3 · Mute | Sampling continues on every lot; lots are dispositioned; records are complete. The supplier’s change of sand source reaches nothing connected to the plan. |
| Counterfactual | Is the supplier’s reject rate still where the plan assumes? The supplier-quality engineer could answer in a day. Nobody is asked. |
| Verdict | All three conditions hold |
Engineering — the calibration interval §
Engineering. A machine’s calibration interval was computed from the duty cycle at commissioning. Throughput has since doubled. Every calibration is on time, certified, and scheduled for a machine that retired years ago without moving.
| 1 · A reason existed | The interval was computed from the duty cycle at commissioning, which was real. |
|---|---|
| 2 · Separated | The interval is in the calibration schedule. The duty cycle it was computed from is not. |
| 3 · Mute | Every calibration is on time and certified. Doubled throughput changes nothing the calibration record can see. |
| Counterfactual | Are the machine’s hours per week still what the interval assumes? The production planner knows. |
| Verdict | All three conditions hold |
Healthcare — the screening protocol §
Healthcare. A deterioration-screening protocol was validated on the ward’s 2019 patient population. The catchment has aged; acuity has shifted. The protocol is applied to every patient, perfectly, with quietly degraded sensitivity — and every chart is complete.
| 1 · A reason existed | The protocol was validated on the ward’s patient population of the time. |
|---|---|
| 2 · Separated | The protocol is in the clinical procedure. The validation population is in a study file no chart audit opens. |
| 3 · Mute | The protocol is applied to every patient and every chart is complete. Degraded sensitivity produces no signal of its own. |
| Counterfactual | Does the current catchment’s age and acuity profile still match the validation cohort? Admissions could answer in an afternoon. |
| Verdict | All three conditions hold |
Aviation — the maintenance interval §
Aviation. A maintenance interval assumes the utilization profile the operator flew when the program was approved — sector length, cycles per day. The route network changes; compliance with the interval remains exact.
| 1 · A reason existed | The utilization profile at approval — sector length, cycles per day — was real. |
|---|---|
| 2 · Separated | The interval is in the maintenance program. The profile it assumed is in the approval file, which compliance monitoring does not re-open. |
| 3 · Mute | Compliance with the interval remains exact. A changed route network alarms nothing in the maintenance record. |
| Counterfactual | Do sector length and cycles per day still match the approved profile? Network planning knows. |
| Verdict | All three conditions hold |
Defense — spares provisioning §
Defense. Spares provisioning for a land-vehicle fleet was computed from a training tempo set years ago. The tempo changed; the inventory records reconcile to the unit; readiness erodes with every accurate stock count.
| 1 · A reason existed | The training tempo the provisioning was computed from was real when it was set. |
|---|---|
| 2 · Separated | The stock levels are in the inventory system. The tempo is not. |
| 3 · Mute | Every stock count reconciles. Readiness erodes without any inventory discrepancy. |
| Counterfactual | Is the tempo still what the provisioning assumed? The unit’s training officer knows. |
| Verdict | All three conditions hold |
Software — the firewall rule set §
Software. A firewall rule set enforces a network boundary designed in 2021. A later integration bridged the segments. The rules are applied faithfully, audited annually, and defend a perimeter that is no longer where they think it is. (The TLS certificate that expires loudly at 2 a.m. is the self-revealing cousin — engineering alarms what it can. The bridged segment alarms nothing.)
| 1 · A reason existed | The rule set enforced a boundary that was real in 2021. |
|---|---|
| 2 · Separated | The rules are in the configuration. The topology they assumed is in a diagram nobody audits against. |
| 3 · Mute | Rules are applied and audited annually. The bridged segment raises nothing. (The expiring certificate is the self-revealing cousin, and is out of scope.) |
| Counterfactual | Did any later project connect the segments? The integration team knows. |
| Verdict | All three conditions hold |
Finance — the credit model §
Finance. A credit model was validated under one interest-rate regime and borrower mix. The regime turned. Model governance — where it exists and is honored — is the one discipline that schedules the question; where revalidation lags, the model prices faithfully in a world it was never shown.
| 1 · A reason existed | The model was validated under the rate regime and borrower mix of its validation date. |
|---|---|
| 2 · Separated | Where model governance runs, the assumptions are recorded and revisited on schedule. Where it lags, the validation report sits unread while the model prices daily. |
| 3 · Mute | The model produces prices every day. A turned regime alarms nothing in the model itself. |
| Counterfactual | Model governance schedules the question. The lag between the regime turning and the next revalidation is the exposure. |
| Verdict | All three conditions hold where revalidation lags |
Government — the flood-plain map §
Government. A flood-plain map encodes the storm statistics of the 1980s. Permits are issued against it daily, each one correct to the map, the map correct to a climate that has moved on.
| 1 · A reason existed | The storm statistics of the 1980s were the best available when the map was drawn. |
|---|---|
| 2 · Separated | The map is the artifact permits are checked against. The climate assumptions behind it are in a hydrology study no permit review opens. A boundary case — obsolescence in form, Silent Expiry in effect (Section 4). |
| 3 · Mute | Permits issue daily, each correct to the map. A moved climate alarms nothing in the permitting record. |
| Counterfactual | Do the return periods the map encodes still hold? A hydrologist could answer; the permit process never asks. |
| Verdict | All three conditions hold |
The source text of these examples is Section 7 of the canonical definition. The checks above are derived from it and do not modify it.
The complete investigation §
These examples illustrate isolated situations, each shown at the moment the three-condition test resolves. The Norwood Files follows an entire investigation instead — from the first weak signals, through the work that mistakes them for something else, to the final understanding of what had expired.