The thread installs MCAS as a split-picture object: design group, certification package, and cockpit did not hold the same function. The unresolved question is which repair would have forced the 2016 authority growth to reopen the crew picture: independence of ODA unit members from Boeing schedule (the capture model), or a mandatory inventory of functions that can command the stabilizer without a crew input, required in the flight manual and in the hazard assessment as one system (the documentation-architecture model). Those are not substitutes. JATR already said fragmentation hid the function; NTSB already said the hazard tests omitted the simultaneous alerts; the Emergency AD after Lion Air already tried disclosure-as-runaway-trim and did not stop Ethiopian 302. The live question is which of those, if installed earlier, would have made the certified object match the one that flew.