The interface is modelled as a barrier oxide in parallel with a hydrated shell, both in series with an electrolyte resistance, with a constant-phase element standing in for surface heterogeneity. Promoter islands appear as a low-impedance shunt whose area fraction is the quantity we care about and cannot yet measure directly.

Proposed protocol: a 10 mHz–100 kHz sweep at open-circuit and at two DC offsets, taken at fixed intervals through a reaction, logged with temperature, ultrasound duty and field waveform on the same clock. Features extracted: barrier capacitance, CPE exponent, low-frequency intercept drift, and the frequency of the phase minimum.

The falsifiable statement is narrow: at least two of those features must move monotonically with instantaneous hydrogen rate across at least three independent builds, and must not move the same way in the blank. Anything weaker is a spectrum that looks meaningful.

PID on a single scalar fails here because the plant state is not one number. Hydration state, promoter distribution, local pH and bulk temperature all carry history, and the actuators interact: ultrasound both strips the film and heats the bath; field changes wetting; feed rate changes everything.

The proposed controller is a receding-horizon MPC over a reduced state estimated from the EIS feature vector, with hard constraints on jacket duty and vent flow — the safety envelope is a constraint, never an objective. Objective: hydrogen rate tracking with a penalty on residue-phase drift once WP1 establishes that phase is observable.

Status is unambiguous: no closed-loop run exists on the group’s reactor. The controller is specified and filed; it has not governed a reaction of board grade.

At roughly −418 kJ per mole of aluminium, a 25 L skid converting a few kilograms per hour is a tens-of-kilowatts thermal device. The design implication is a jacket, a vent and a stop rule, not a nicety.

Path matters: the residue phase that forms — bayerite, gibbsite or boehmite — shifts both the enthalpy and the product value, and is set by temperature, pH and residence time. Choosing the operating point for hydrogen rate alone will destroy the residue credit that makes the LCOH envelope cross zero.

Runaway is the named failure. If the film is stripped faster than heat is removed, the reaction accelerates into its own heat. The interlock is thermal, not chemical, and belongs to the host’s safety case as much as to ours.

The bilayer picture is standard corrosion science: a dense amorphous barrier grown by field-assisted ion transport, and a hydrated outer shell that thickens in water and can seal. GALVANOXIDE’s premise is that the outer shell is not only an obstacle but a handle — that it can be held in a state where water reaches metal without the barrier re-forming.

Gallium’s role in defeating passivation is prior art. What is not settled anywhere is the inventory question: how much promoter is retained at the interface, how much is entrained in residue, and whether the retained fraction is stable over hundreds of hours.

The measurement that decides it is unglamorous — a 100-hour mass balance on gallium with residue digestion and ICP analysis. Until that exists, every economic statement downstream is conditional, and this paper marks it so.