A geological repository cannot be tested for its entire intended lifetime. Its safety case has to connect metal, clay, rock and water without pretending that a short experiment has observed the distant future.
A permission is not a prediction of every future year
On 4 August 2026, Finland's Radiation and Nuclear Safety Authority, STUK, issued a favourable safety statement on Posiva's application for an operating licence for its spent-fuel encapsulation and geological disposal facility. The statement carefully separated three things that a headline could easily collapse: the regulator's assessment, the government's licensing decision, and a further regulatory decision required before operations could begin. Its positive conclusion addressed the safety requirements for granting the licence. It was not itself permission to start disposal. STUK's dated statement
That distinction is the right entrance to a much larger question. What does it mean to establish confidence in a structure whose relevant future cannot be watched from beginning to end? An engineer can inspect a material sample, compare a calculation with a temperature sensor, or observe water moving through a test volume of rock. None of those acts is a direct observation of a closed repository thousands of years later. Yet dismissing everything short of such an observation would confuse an impossible experiment with the possibility of disciplined inference.
The useful argument lies between two unhelpful claims. One says that several protective layers make the problem disappear. The other says that any uncertainty makes all assessment meaningless. Both avoid the actual work: identifying what each component is meant to do, finding observations that test those functions, and examining how an error in one part of the argument could propagate into another. A repository is not made credible by the length of a time axis on a diagram. It is made more or less credible by the connections between evidence and the claims drawn from it.
This article examines those connections, not the merits of nuclear power as a whole or instructions for handling radioactive material. It also does not update the August statement into an assertion about the facility's operating status on every later date. The statement supplies a verified decision point. The scientific question is how a decision point can be supported when direct experimentation and the period of concern are so radically different in length.
Start with functions, not a stack of reassuring colours
Posiva's public safety-case introduction describes an argument assembled from evidence, analyses and reasoning. Its reference concept combines a copper canister with a load-bearing cast-iron insert, a surrounding swelling-clay buffer, and the host rock. The public introduction also identifies the site and the spent fuel as starting constraints, rather than treating a repository as a universal object that can be placed anywhere. The underlying operating-licence safety-case reports are a separate portfolio; reading the public introduction is not equivalent to examining every model and dataset in that portfolio. Posiva's public introduction
A useful way to read any such design is to replace the picture of nested shells with a series of verbs. What is intended to contain material? What supports another component mechanically? What limits a supply of reactive substances? What slows transport after material has entered water? What changes the conditions experienced by the next component? These are different functions, and a claim about one should not be silently substituted for evidence about another.
Imagine an entirely fictional design review. A slide shows a sealed vessel, a surrounding material and a geological formation. A speaker calls all three barriers. The word is not wrong, but it is incomplete. If the vessel is supposed to prevent release while the surrounding medium is supposed to reduce transport after release, their performance measures cannot be identical. A test of the surrounding material does not establish that the vessel remains intact. A test of the vessel does not establish where dissolved material would go after a hypothetical loss of containment.
The review becomes more informative when each arrow in the slide receives a question. Which environmental conditions reach the vessel surface? Which observations constrain the evolution of that environment? Which physical quantities pass from one model into the next? Which changes are deliberately included in a difficult scenario? Where is a favourable assumption necessary rather than merely convenient? This turns a comforting illustration into an argument that can be challenged.
It also makes comparisons between countries less superficial. Two programmes may both use the word clay while assigning different roles to engineered clay and a clay-rich host formation. Two metal components may look similar while differing in geometry, manufacture, loading or environmental setting. An experiment can be relevant without being interchangeable. The transferable object is often a tested process or a measurement method, not the complete performance claim attached to another nation's design.
The distinction matters for public communication. A reader should be able to follow the logic without being asked to accept a visual metaphor as a calculation. Labels such as containment, transport and exposure are more useful than a generic promise of protection, because they reveal where evidence is still needed. They also allow a disagreement to become specific. One can question a transport assumption without pretending that every observation of the metal has thereby been invalidated.
Three barriers are not three independent coin tosses
The multiple-barrier idea invites an attractive but often unjustified calculation. Suppose a fictional presenter assigns each of three barriers a one-in-ten chance of failing and multiplies the numbers to obtain one chance in a thousand for all three. The arithmetic is correct only under the chosen probability model. It is not evidence that the model describes a repository. Independence, the definition of failure, the relevant interval and the meaning of the assigned probabilities all need justification.
Here is a deliberately abstract counterexample. Consider one hundred equally weighted fictional scenarios, not real repository outcomes. Component A performs poorly in ten scenarios. Component B also performs poorly in ten. If the two sets overlap in only one scenario, simultaneous poor performance occurs in one of the hundred. If the sets are exactly the same ten scenarios, it occurs in ten of the hundred. The individual totals have not changed. Their relationship has changed the joint result by a factor of ten.
Now add component C. It might respond to a different disturbance, or it might depend on the same environmental condition as A and B. Merely drawing C as a separate coloured ring does not resolve that question. The imagined numbers demonstrate why a list of components is not itself a calculation of system reliability. They are not estimates of failure frequency, and no real design should inherit the convenient independence assumption from this example.
The word failure can conceal another problem. A component need not jump instantaneously from perfect performance to no performance. A fictional buffer might retain one function while another becomes less effective. A vessel could be treated as breached in a scenario while the release of material and its subsequent movement remain separate processes. Turning all of these into a single yes-or-no label can remove the very mechanisms that the assessment is meant to examine.
A better review therefore asks how the components interact in the relevant scenario. Does one change cause another? Does a model assume that a protective condition persists after the event that challenges it? Are the same uncertain parameters being varied consistently across calculations? The practical value of several functions lies partly in avoiding dependence on one perfect assumption. Demonstrating that value requires analysis of dependencies, not an optimistic multiplication performed after the diagram is finished.
There is a communication benefit here too. Admitting that components interact is not an admission that the design has no defence. It is an admission that it is a physical system rather than a collection of slogans. The stronger claim is not that nothing can affect several components. It is that the relevant combinations have been identified, bounded where possible, and examined with a clear explanation of what the evidence does and does not establish.
Heating the experiment is not accelerating every process
The full-scale emplacement experiment at Switzerland's Mont Terri rock laboratory offers a concrete example of a test with a deliberately bounded purpose. Herwig Müller and colleagues' paper, published on 16 February 2017, describes a disposal-tunnel experiment using heaters to represent waste heat, bentonite material, instrumentation and the surrounding Opalinus Clay. It reports implementation and early measurements relevant to coupled thermal, hydraulic and mechanical behaviour. The experiment uses simulated heat sources, not an emplaced inventory of spent fuel, and its early observations are not a direct measurement of geological-time performance. Müller and colleagues
There is an important intellectual discipline in that last qualification. An experiment can be impressive in scale and still answer a narrow question. Full scale refers to aspects of geometry and implementation; it does not turn elapsed months into elapsed millennia. A scientifically useful account tells the reader which features have been represented and which remain outside the test. Calling a demonstration realistic without specifying the dimension of realism can conceal as much as it reveals.
Consider a hypothetical laboratory programme in which a model predicts three sensor readings before an experiment begins. After the readings arrive, the model matches the first, overestimates the second and underestimates the third. The team changes two parameters and obtains agreement everywhere. That may be valuable learning. It is not the same evidential event as a successful prediction using parameters fixed beforehand. Both results belong in the record, but they answer different questions about the model.
A separate Mont Terri study makes that distinction explicit. B. Garitte and colleagues' January 2017 paper describes eight teams modelling the HE-E heater experiment. It separates a blind-prediction stage, informed by earlier experiments, from an interpretation stage after the new observations became available. Its accessible abstract bounds the support to thermal and hydraulic process understanding over the experiment's short duration. That is a useful claim precisely because it does not present a fitted short experiment as an observation of the distant future. Garitte and colleagues
For a fictional review panel, the resulting questions would be quite concrete. Which parameters were fixed before the observations? Which were changed afterwards? Did several models agree because they independently captured a process, or because they shared the same input and calibration target? Was a disagreement traced to measurement uncertainty, an omitted process, or a simplification that remains unresolved? A summary saying that model and experiment agree would be insufficient to distinguish these possibilities.
Nor should every experimental disturbance be treated as a miniature version of the entire future. Increasing a test's severity can expose a weakness, but it does not automatically preserve every relationship among processes. An accelerated test needs a reason why its results remain relevant to the conditions being assessed. The burden is to explain the bridge, not simply to multiply the experimental duration by a large factor and rename the answer a lifetime.
The point is not to demand that every experiment answer every question. That would make experimentation less useful. A well-chosen test isolates a process, checks a coupling, or reveals an implementation difficulty. Its value increases when the safety argument uses it for that purpose and records the remaining gap. A weak test report overclaims its reach; an equally weak public debate dismisses the test because it did not accomplish something it was never designed to accomplish.
Water needs more than one clock
A familiar phrase in repository discussion is that groundwater is very old. Even when a groundwater-age interpretation is well supported, it is not automatically the answer to how long material released at a particular location would take to reach a boundary of concern. The direction of the question matters. An estimate about the history of water already present and a calculation about future transport from a specified source are not interchangeable descriptions of the same clock.
F. J. Cornaton and colleagues developed a framework based on groundwater lifetime expectancy, with analytical and numerical examples that examine fracture-network uncertainty. The work is associated with a 2008 Water Resources Research paper; its author manuscript was deposited on arXiv in 2011. It treats the remaining travel-time distribution from locations in the subsurface as an assessment quantity, rather than relying on a single generic label of old groundwater. The opened manuscript is a theoretical and modelling contribution, not a measurement of travel times at Posiva's facility. Cornaton and colleagues
An original toy example shows why a distribution is useful. Imagine a hundred equal tracer parcels in a fictional transport model. Ninety take one hundred arbitrary time units to reach a chosen boundary; ten take one unit. Their mean arrival time is 90.1 units. That number is mathematically correct, but it conceals the early-arriving tenth. If the question concerns early arrival, reporting only the average would obscure a feature the calculation actually contains.
Reverse the mix: ten parcels take one hundred units and ninety take one. The mean becomes 10.9 units. Neither fictional distribution can be summarized adequately by saying that some paths are long. The relevant summary depends on the decision: early arrivals, a specified percentile, total transported amount over a period, or another explicitly defined quantity. There is no single number that is automatically best for every safety question.
Different dissolved species also need not behave alike. In their 2017 synthesis of Mont Terri experiments, Olivier Leupin and colleagues compare laboratory and field evidence on diffusion and retention in Opalinus Clay. Their discussion distinguishes species, accessible pore space, sorption and direction relative to rock layering. It supports the need to investigate transport at several scales rather than substituting one convenient tracer for every substance. It is a research synthesis, not an additional independent experiment for each study it cites. Leupin and colleagues
The underlying vocabulary deserves care. Advection concerns transport with moving water; diffusion concerns spreading associated with concentration differences and molecular motion. Sorption describes interaction with solid surfaces, rather than disappearance of the material. These distinctions identify different parts of a model. They do not establish a universal ranking in which every clay, every fracture and every dissolved species behaves the same way.
For another explicitly idealized calculation, suppose a one-dimensional diffusion model has constant coefficient D and characteristic spreading distance proportional to the square root of two times D times elapsed time. Quadrupling elapsed time doubles that characteristic distance; doubling it does not double the distance. No value of D is supplied here, and the calculation is not a repository forecast. It illustrates why a description such as twice as long requires a specified physical relationship before it can become a statement about twice as far.
The same caution applies to changing model boundaries. A computed arrival at the edge of a small laboratory sample, the edge of a geological unit and a location used in an exposure assessment are different events. A reader needs to know where the clock starts, where it stops, what is travelling, and what has been left out. Without those definitions, a very precise transport time can be less informative than a modest but clearly bounded experiment.
A corrosion rate is a history, not a warranty
A material test can produce a number with the dimensions of thickness lost per unit time. It is tempting to divide an available thickness by that number and announce a service life. That calculation quietly assumes that the measured rate remains applicable throughout the extrapolated period, that the relevant form of degradation is adequately represented, and that environmental changes do not invalidate the premise. A numerical result can be exact under assumptions that the experiment never established.
Claire Tully and colleagues' 2023 study of copper materials in bentonite illustrates why the environment matters. Their reported average corrosion rates decreased with experimental time, while surface observations still indicated continuing corrosion. The paper examines compaction and changing conditions rather than presenting a constant-rate clock. It also states that the research data are not shared. Those limits matter when assessing reproducibility and prevent the published account from being treated as access to an underlying dataset. Tully and colleagues
An elementary fictional example separates two quantities that readers can easily confuse. Suppose a sample loses six arbitrary thickness units during an initial interval and two more during an equally long second interval. The cumulative loss has risen from six to eight. The average loss per interval has fallen from six to four. Both statements are true. A declining time-averaged rate does not mean that the sample regained material or that degradation stopped.
Now imagine a third interval that has not yet occurred. Continuing the most recent rate would give one answer, continuing the average would give another, and introducing a changed environment could give a third. None becomes an observation merely because it is plotted beside the first two measurements. The important question is what mechanism and evidence justify the extrapolation. This example uses no measured corrosion value and is not a design calculation.
A newer study by Louisa Panjiyar and colleagues, available through KIT's repository in October 2026, considers iron and copper in compacted bentonite and an evolving oxygen environment. The repository lists advance online publication on 23 September 2026. Its opened abstract connects laboratory observations with material examined after an underground research-laboratory exposure. Only that abstract and metadata are used here; they do not justify reconstructing detailed results or projecting a container lifetime. Panjiyar and colleagues
The juxtaposition is useful without requiring a contest over which single study settles the subject. A material response belongs to a set of conditions. A claim imported into another design needs an explanation of which conditions match, which differ and how the differences are handled. Sharing a chemical element in the name of a component is not enough. The safety argument has to preserve the experimental context as it transfers knowledge.
Deliberately challenging a component can also be informative. N. R. Smart and A. P. Rance's July 2009 report for SKB describes inactive miniature canister experiments with intentionally introduced leaks, reporting work through May 2008. The purpose was to investigate internal corrosion evolution under a specified challenge. These were model experiments, not observations of failed radioactive-waste containers in an operating repository. The report identifies its commissioning relationship and assigns its conclusions to its authors. Smart and Rance
That kind of experiment should neither be hidden because it studies an adverse condition nor sensationalized as proof that the adverse condition has occurred in service. It asks a conditional question. If a specified challenge is imposed, what follows in the experimental system? A good assessment needs such questions because its credibility should not depend on considering only ideal performance. A good account keeps the imposed condition visible whenever it reports the result.
An ancient analogue can answer the wrong modern question
Natural systems offer evidence over periods no laboratory can reproduce directly. Their appeal is obvious: a geological history has already happened. The difficulty is deciding what, exactly, that history is evidence for. A deposit is not a manufactured container, and the behaviour of one element is not a guarantee about every radionuclide that could appear in a different inventory. An analogue is informative through a specified similarity, not through resemblance alone.
The Canadian Nuclear Safety Commission's research-support summary for 2022–2023 describes University of Ottawa work revisiting the Cigar Lake uranium deposit. Its account reports a contrast between the earlier uranium-retention picture and evidence concerning iodine-129 movement beyond the ore zone. The useful lesson is species specificity: evidence that supported one retention argument did not settle the behaviour of another substance. This article relies on the regulator's commissioned-research summary, not an independently inspected raw dataset or a complete underlying thesis. CNSC research summary, RSP-691.2
Consider how an original public-facing evidence card might handle an analogue. Its first line would state the process being compared. Its second would list the important differences between the natural setting and the proposed engineered system. Its third would identify the observation that constrains the process. Its fourth would explain what conclusion would remain unsupported even if the observation were beyond dispute. That last line is essential, because the persuasive power of deep time can otherwise spill into unrelated claims.
A fictional ancient metal object makes the logic easy to see. Suppose it has survived in one environment. That demonstrates survival under the history it experienced, subject to what is known about that history. It does not establish survival in every environment where someone might use the same metal. Conversely, finding corrosion in a different setting does not automatically invalidate all favourable evidence from the first. The comparison requires conditions and mechanisms, not competing photographs.
The same discipline protects against selective analogy. A safety argument should not accept a natural example because it is reassuring and reject another because it complicates the story. It should ask whether either example tests a relevant proposition. Sometimes a complication improves the assessment by revealing that two substances or pathways must be treated separately. A revised model can be a sign that the evidence is doing work, rather than that the original research was pointless.
The rock is not one average sample
In a June 2026 review of the Swiss geological safety case, Raphael Wüst and colleagues describe an integrated assessment using seismic information, boreholes, laboratory work and site-scale geological interpretation. Their discussion treats a containment-providing rock zone rather than reducing the argument to a single specimen. The authors are principally affiliated with Nagra, the implementing organization; the paper is an account of the geological evidence and argument, not an independent licensing decision. Its findings about a Swiss clay-rich setting should not be relabelled as measurements of a Finnish crystalline-rock site. Wüst and colleagues
A hypothetical sampling example illustrates the issue without borrowing the paper's measurements. Imagine ten measurements from a material whose composition varies by location. Nine values cluster tightly and one differs. There are several possibilities: the unusual value could reflect measurement error, a small isolated feature, or a feature connected to a much larger volume. Averaging the ten values cannot decide among those possibilities. The spatial relationship is part of the evidence.
Now suppose the unusual observation is omitted as inconvenient. The average becomes more stable, but the argument becomes less informative. Suppose instead that it is assumed to represent the entire site. That can be equally unjustified. The appropriate response is to investigate what the observation means in context and how much the safety-relevant conclusion depends on it. The point is not that every outlier dominates. It is that neither numerical tidiness nor worst-case rhetoric substitutes for interpretation.
This is where different kinds of investigation can complement one another. A broad survey and a detailed sample do not have the same resolution or limitations. Agreement is valuable when each constrains a distinct part of the interpretation. Disagreement is valuable when it reveals a missing connection. A persuasive synthesis explains why the observations belong to one geological picture and where more than one picture remains plausible.
For a reader, a useful question is whether the assessment has represented heterogeneity or merely mentioned it. If different regions receive different properties, how were those regions defined? If several conceptual models are retained, what observation would discriminate between them? If a simplified model is used, why is the simplification appropriate for the particular result being reported? These questions are more revealing than demanding either a perfectly uniform formation or an impossibly detailed description of every grain.
Release, concentration and exposure are different outputs
A repository assessment can contain several quantities that sound alarming or reassuring in isolation: an amount released from a waste form, a concentration in water, an arrival time at a boundary, and an estimated dose for a specified exposure scenario. These are not synonyms. A chain of reasoning connects them. A result from an earlier part of the chain cannot be presented as a result from the last part without supplying the intervening assumptions.
Caitlin Condon and colleagues' biosphere-model development paper provides an explicit example of such an interface. The conference work, posted to arXiv in June 2023, describes connecting subsurface transport outputs to a generic model of exposure pathways. Its account distinguishes a developed prototype from the fuller model then under development. It is not a site-specific finding that a particular population has received, or will receive, a particular dose. The opened four-page paper supports discussion of the model architecture and its stated development stage. Condon and colleagues
An original dimensional example shows why the interface matters. Suppose a fictional model outputs a concentration of three arbitrary units per litre and a separate scenario specifies consumption of two litres over a chosen interval. Multiplication gives six arbitrary units taken in during that interval. It does not, by itself, give a biological effect or a dose. Those would require additional substance-specific and exposure-specific information. The invented units deliberately prevent the calculation from masquerading as a health assessment.
Change the scenario to one litre and the calculated intake changes even though the concentration has not. Change the source concentration and the result changes even if the scenario does not. Both are legitimate sensitivity questions. Neither variation tells us which scenario will occur in a distant society. The role of a specified scenario is to make the consequence of assumptions examinable, not to claim clairvoyance about future behaviour.
A simple unit check can expose another fictional reporting error. Suppose one calculation returns a total for a century and another returns an annual quantity. Putting their numerical values in adjacent columns without the time units could suggest an enormous disagreement that is largely a comparison error. The correction is not to pick the more reassuring number. It is to define a common comparison and retain the original outputs so that the conversion can be checked.
A strong public summary should therefore name the output it is discussing and retain the conditions attached to it. The phrase below a criterion is informative only if the reader knows which quantity, which scenario and which criterion are involved. This article supplies no numerical compliance judgement for any repository. The point is to make clear why a compliance conclusion must be read with its defined analytical context rather than detached from it as a universal assurance.
A safety case should show how it could change
The International Atomic Energy Agency's guidance on geological disposal describes stepwise development, with iterative evaluation and updated safety cases at relevant decisions. The accessible passage links site characterization, design, assessment and monitoring rather than treating them as independent files. It is general guidance, not an approval of a particular facility, and only that official passage is relied on here. IAEA SSG-14, stepwise development
The idea becomes concrete when a hypothetical project keeps an evidence-to-decision register. One entry might concern a material property whose uncertainty has little effect on the calculated outcome across the investigated range. Another might concern an environmental assumption that strongly affects the outcome. A third might concern an implementation feature that must be demonstrated before a later decision. Calling all three uncertainties without distinguishing their roles would hide where additional work is most valuable.
Such a register would not need to promise that every uncertainty can be eliminated. It would need to show why the remaining uncertainty is acceptable for the decision being requested and which later decisions require more evidence. A preliminary choice among investigation options and an irreversible closure decision need not demand identical information. The reason for staging decisions is lost if every earlier milestone is advertised as though all later questions have already been answered.
A useful original stress test is to ask the author of a safety claim to complete a sentence: this conclusion would need reconsideration if a specified observation changed in a specified way. The answer need not be a single numerical threshold. It could concern a process previously considered unimportant, an inconsistency between datasets, or an implementation that differs from the evaluated design. The purpose is to distinguish a revisable technical argument from a statement that has been insulated against contrary evidence.
Another stress test concerns the history of revisions. Did a new observation narrow uncertainty, move a parameter, change a conceptual model or alter the design? A polished final curve does not reveal that history by itself. Recording it allows later reviewers to understand why the present argument differs from an earlier version. Otherwise, an apparently stable conclusion can conceal substantial changes in the reasoning that supports it.
Public confidence should not be made dependent on pretending that revision is embarrassing. The more useful standard is whether revision is traceable and proportionate to the evidence. A change made openly in response to a relevant finding is different from silently changing an assumption to preserve a preferred result. Both may produce a new document; only one provides a clear account of learning.
A sensitivity table is not a probability table
A final hypothetical calculation makes the distinction between exploring uncertainty and assigning probabilities explicit. Suppose a deliberately simplified assessment uses two uncertain inputs, A and B. With both at their reference settings, a dimensionless comparison score is one. Changing A alone produces a score of two; changing B alone produces a score of three. If changing both together produces six, the combined response is not the sum of the separate increases. There is an interaction in this invented model.
Nothing about these four results tells us the probability of any setting. Giving each row equal space in a table does not make each row equally likely. Nor does calling the largest result conservative establish that it bounds every physically possible combination. The table demonstrates how this particular model responds to these particular choices. A probabilistic result would require a justified account of input distributions and relationships, not merely a set of sensitivity runs.
Now change the fictional model so that the combined score is one and a half rather than six. The separate changes still increase the score when examined alone, but together they partly offset one another. This is a warning against an automatic recipe of setting every uncertain input to its individually adverse extreme. Such a recipe might be deliberately cautious for one output, physically inconsistent for another, or simply uninformative about the combinations that deserve attention. The answer depends on the model and the question.
An honest report would preserve the four rows, state what the score means, explain why the inputs were chosen, and identify whether the combinations are physically plausible. It would not turn the fictional score into a dose, a failure frequency or a prediction of a real repository. It would also distinguish changing a parameter inside one model from changing the model's underlying description. Running the same structure many times does not test a process that the structure never includes.
For a technical reviewer, that distinction can guide a request for further evidence. If the outcome barely changes across a defensible input range, more precise measurement of that input may have limited decision value. If a plausible alternative description changes the result substantially, another decimal place on the original model's output will not settle the issue. The useful next investigation is the one that can discriminate between explanations or constrain a decision-relevant uncertainty, not necessarily the one that generates the most additional numbers.
What the evidence must carry forward
Conceptual evidence map, not a repository design or performance forecast. Observations, analytical inferences and a defined decision are distinct parts of an argument.
The strongest repository argument is not a single dramatic experiment. It is a set of claims whose links remain visible: what was observed, what was inferred, which conditions were represented, and which uncertainties matter to the decision. Short experiments, underground demonstrations, natural histories and models contribute different kinds of information. Their differences are not defects to erase. They are the reason the argument needs more than one kind of evidence.
For a reader confronted with the next announcement, a few concrete distinctions do most of the work. An assessment is not automatically a licence; a licence is not automatically permission to begin every operation. A material sample is not a whole engineered system. A fitted observation is not a blind prediction. A transport average is not the entire arrival distribution. An analogue is not a replica. A generic scenario is not a forecast of a named future person's life.
These distinctions do not decide the policy debate by themselves. They make it possible to have a policy debate about the actual technical proposition instead of an inflated or diminished version of it. People can disagree about acceptable burdens, institutions or decisions while still requiring an accurate account of what the experiments establish. Acknowledging a limit is not the same as rejecting the evidence within that limit.
The distinctive demand of geological disposal is that the evidence must remain intelligible after the experiment has ended and after the people who designed it have moved on. That makes careful boundaries part of the engineering argument. A defensible claim carries its assumptions with it. The task is not to make the future look observed. It is to make the reasoning about that future clear enough to test, challenge and improve while decisions can still respond to what is learned.