3. Restore parity and choose the next probe

The comparison uses the same three operating conditions, commissioning date, field interfaces, configuration evidence, assurance burden, data access, support horizon, internal capability consequence, expected change latency, and exit condition. The provider demonstration is not compared with an unfinished internal prototype; both are compared with the accepted GH-2 configuration and representative conditions.

The internal-only and custom-provider arrangements fail the need-date condition. The ready-controller and hybrid arrangements form a tie-set because the hybrid arrangement is better for later greenhouse-specific change only if the vendor interface preserves timing, configuration export, and supported fallback.

The ready-controller arrangement costs EUR 84,000 and eighteen internal engineering days; the hybrid costs EUR 96,000 and thirty-two internal engineering days. Both fit the need date. The operating plan expects at least three greenhouse-specific changes in the next three years, so the deciding management team will prefer the hybrid when its added price stays within EUR 15,000 and its added internal burden stays within fifteen engineering days, but only after the protected interface and fallback claims are supported.

The same team is authorized to spend up to EUR 7,000, forty engineering hours, two hardware-in-the-loop laboratory days, and five elapsed working days on this decision. The safety specialist separately authorizes the failed- sensor injection in the laboratory. ChoiceResult-GH2-1 is probe again: a EUR 5,500 replay uses thirty-two controls-engineering hours, eight integrator hours, two laboratory days, and the available five-day reserve.

The decision rule distinguishes three outcomes. Unsafe fallback or unusable configuration export rejects both survivors. Safe fallback and export combined with failed supervisory timing or unsupported API retains only the ready-controller arrangement. If fallback, export, API support, and timing all pass, both survive and the stated price-and-burden rule selects the hybrid. Without the replay, neither survivor has enough evidence for a choice under the declared rule; rejecting both would discard an arrangement that the bounded replay can retain.

The performed replay returns the third outcome: the local controller enters the supported fallback without an unsafe actuator command, the supervisory command round trip remains below the application-profile limit, and the configuration export reidentifies the tested controller and software values. The safety specialist limits the first observation to the tested failure and configuration. The deciding Agent applies C.11 again and records ChoiceResult-GH2-2: choose now for the hybrid arrangement under that basis. A different safety limit or withdrawn vendor-update support would reopen the choice.