Fact-Value Distinction

one_liner: Keep descriptive claims about what is or occurs distinct from evaluative claims about what is good, justified, or ought to be done, so evidence can constrain a value judgment without silently supplying the value premise that turns description into prescription.

origin_domain: philosophy

core_idea:
The fact-value distinction is the discipline of typing claims according to whether they describe what is or occurs, or evaluate what is good, justified, permissible, required, or worth pursuing. It prevents an evidential record from being read as though it already contained the standard by which the record should be judged. A description can constrain a choice, eliminate an option, expose a consequence, or show that a goal is infeasible; it does not silently create the value premise that makes one feasible outcome preferable to another.

The distinction is therefore more than the slogan that facts and values differ. It couples a two-class contrast to an explicit bridge requirement. When reasoning moves from a descriptive claim to an appraisal, ranking, entitlement, or recommendation, the analyst asks which value-bearing standard, reason, institutional mandate, or decision criterion licenses the move. If that bridge is absent, the conclusion has acquired evaluative force that the stated premises do not account for. If the bridge is present, facts and values can interact without being collapsed.

The prime does not require a metaphysical claim that facts and values occupy wholly separate worlds. It remains useful under moral realism, naturalism, constructivism, pragmatism, and value-laden accounts of inquiry. Those positions disagree about how facts and values are grounded and entangled. They can still distinguish the role of evidence from the role of a standard in a particular decision record and ask what authorizes movement between them.

structural_signature:
*a descriptive claim class* — *an evaluative or normative claim class* — *a typing rule* — *an attempted crossing* — *a value-bearing bridge* — *facts that constrain without silently prescribing* — *an auditable conclusion*

- **Descriptive class:** claims about states, events, causes, probabilities, measurements, or observed regularities.
- **Evaluative class:** claims that rank, commend, condemn, permit, require, justify, or supply reasons for action or belief.
- **Typing rule:** a way to tell which role a claim plays in the argument, even when ordinary language mixes the two.
- **Attempted crossing:** an inference, policy recommendation, appraisal, or design choice that moves from a factual record toward an evaluative verdict.
- **Value-bearing bridge:** an explicit standard, goal, right, duty, authority, priority, or reason that gives the conclusion its evaluative force.
- **Constraining evidence:** facts may change which actions are possible or which actions serve the standard without becoming the standard themselves.
- **Auditability:** disagreements can be located in evidence, values, priorities, or the bridge instead of being hidden in the conclusion.

The signature is present only when both claim classes and their relation matter. A classification among two descriptive data types is not a fact-value distinction, and a free-standing norm with no descriptive contrast is simply normativity.

what_it_is_not:
- **Not a claim that facts are irrelevant to values.** Evidence can determine consequences, feasibility, causal efficacy, and risk. Those facts can decisively alter what follows once a value premise is supplied.
- **Not a claim that values never shape facts.** Measurement choices, categories, thresholds, and research agendas may be value-laden. The distinction asks that those roles be identified; it does not assume a view from nowhere.
- **Not moral subjectivism.** A moral realist can hold that evaluative claims are objectively true while still distinguishing them from descriptive claims and requiring the relevant bridge in an argument.
- **Not the Is-Ought Problem.** Is-Ought is the strict inferential specialization concerning deductive entailment from an all-descriptive premise set to a normative conclusion. The broader distinction also governs semantic typing, evidential authority, decision records, and institutional role separation.
- **Not Moore’s Naturalistic Fallacy.** Moore’s thesis concerns whether “good” can be defined as a natural property. Fact-value distinction is broader and does not settle that definitional debate.
- **Not a strict MECE partition of every sentence.** Mixed utterances, thick concepts, and institutionally loaded measurements can have both descriptive and evaluative functions. The prime requires the roles to be inspectable, not every sentence to occupy one context-free box.

clarity:
The prime clarifies two errors that otherwise look like opposites. *Value smuggling* presents a recommendation as the inevitable output of neutral facts, concealing the criterion that selects it. *Fact exclusion* treats value judgment as insulated from evidence, as though causal consequences and feasibility could not defeat a proposed means. The distinction rejects both. It says that evidence and standards do different work and that sound reasoning often needs both.

This yields a practical diagnostic. Given a conclusion, label every load-bearing statement as descriptive, evaluative, or bridge-forming. Then ask whether changing the evaluative standard while holding the facts fixed could change the conclusion, and whether changing the facts while holding the standard fixed could do the same. If both counterfactuals are live, the decision genuinely depends on both kinds of input and should represent them separately.

manages_complexity:
Controversies at policy and design boundaries often entangle at least four disputes:

1. What happened or is likely to happen?
2. Which outcomes, rights, or obligations matter?
3. How should competing values be prioritized?
4. Does the proposed action actually serve those priorities under the evidence?

Without typed separation, a disagreement anywhere in that stack becomes a global fight over the final recommendation. The fact-value distinction decomposes the record so that empirical disagreement can be investigated, normative disagreement deliberated, priority conflict negotiated, and means-end fit tested. It turns one opaque controversy into several smaller and differently resolvable questions.

The same decomposition supports institutional division of labor without pretending the roles are independent. Analysts can own the factual model, authorized decision-makers can own the governing criteria, and the decision record can show the bridge between them. Accountability improves because neither expertise nor authority is allowed to masquerade as the other.

abstract_reasoning:
The prime licenses several reasoning moves.

**Claim typing.** Determine whether a statement reports a condition, supplies a standard, or connects a condition to a standard. Ordinary words are not decisive: “unsafe” may summarize a measured threshold fixed by regulation and therefore contain both descriptive and normative work.

**Bridge extraction.** Rewrite a fact-to-recommendation argument until the missing goal, right, duty, priority, or authority becomes an explicit premise. The repair may make the inference valid while relocating disagreement to that premise.

**Paired counterfactuals.** Hold the facts fixed and vary the value standard; then hold the standard fixed and vary the facts. This reveals which input controls which part of the verdict.

**Standing analysis.** Ask who is authorized to certify the facts, who is authorized to adopt the standard, and whether one actor has silently crossed from one role into the other.

**Value-sensitive measurement.** Inspect whether choices of variable, threshold, population, or time horizon already encode priorities. Such findings do not abolish the distinction; they locate evaluative content earlier in the pipeline.

knowledge_transfer:
A clinical guideline and an engineering design review share the same structure. The guideline records treatment effects and adverse-event probabilities, then combines them with patient values, equity commitments, and an acceptable-risk threshold. The design review records load tolerance, failure rates, cost, and latency, then combines them with safety margins and prioritized requirements. In both, measured facts constrain the available choice, an evaluative standard ranks the remaining options, and an explicit bridge explains the recommendation.

The transfer extends to law and public policy. An analyst may estimate that a rule reduces emissions, increases prices, and distributes burdens unevenly. None of those findings alone selects the rule. A decision follows only after commitments concerning climate harm, affordability, distribution, rights, and institutional mandate are introduced. The same audit learned in clinical evidence grading—separate effects, confidence, values, and recommendation—ports directly to the policy record.

formal_abstract:
Suppose a model supports the descriptive claims: action A reduces harm by ten units, costs two units, and transfers one unit of burden to group G. The conclusion “choose A” does not follow until the decision record supplies standards governing harm reduction, cost, and distribution. With a utilitarian aggregation rule the recommendation may favor A; with a side constraint forbidding the burden transfer it may reject A. The facts remain fixed while the value standard changes the verdict, showing that the standard is load-bearing rather than decorative.

**Mapped back:** the model outputs are the descriptive class, the aggregation rule or side constraint is the evaluative class, and the decision rule joining them is the explicit bridge.

notes: This prime was authorized by the missing-node adjudication at `workspace/mixed_dag_2026/missing_node_adjudications/fact_value_distinction.yaml`. Its initial prose and examples require independent editorial and citation review.


Factorial Design

type: prime

one_liner: Multiple variables tested together.

status: draft

core_idea: (1) **A factorial design varies two or more factors simultaneously at multiple levels within a single integrated experiment, so that every combination of factor levels (or a carefully balanced subset) is observed, rather than studying one factor at a time while holding others fixed.** (2) This structure reveals not only each factor's *main effect* — its average influence across levels of the other factors — but also *interactions*: situations where a factor's effect depends on the level of another factor, which are invisible to one-factor-at-a-time (OFAT) designs. (3) Factorial designs are also statistically efficient: a 2×2×2 design with 8 runs estimates three main effects with the same precision as three separate two-level OFAT experiments using 12 runs, while additionally providing interaction estimates the OFAT approach cannot produce. (4) The deeper abstraction is that **real-world systems rarely decompose into additive single-factor effects; interactions are the rule rather than the exception, and factorial structures are the design-based tool for detecting and characterizing them.**

structural_signature:
Factorial designs presume the experimenter can independently manipulate multiple factors at multiple levels. The design is a Cartesian product (full factorial) or balanced subset (fractional factorial) of factor-level combinations. Analysis via ANOVA or regression decomposes variance into main effects, two-way interactions, three-way interactions, and higher-order terms. Full factorials estimate all interactions but grow combinatorially in run count (a 2^k design requires 2^k runs); fractional factorials trade the ability to estimate high-order interactions for dramatic reductions in run count, built on the assumption (often justified) that third- and higher-order interactions are typically small. Response surface methodology, central composite designs, and Plackett-Burman screens are specialized factorial variants developed for process optimization. The distinguishing structural feature is the deliberate crossing of factors rather than their sequential manipulation.

The **structural signature** of factorial design comprises six core elements:

1. *The multi-factor combinatorial enumeration* — the design explicitly covers all (or balanced subsets of) combinations of factor levels so that each factor is studied not in isolation but across multiple contexts (levels of other factors), enabling detection of context-dependent effects<!-- FACT-D24-136 -->[^fisher-1935].
2. *The interaction-effect detection via crossed structure* — the factorial crossing of factors permits estimation and statistical testing of interaction terms (e.g., temperature × catalyst, price × channel) that reveal whether a factor's effect depends on another factor's level, an insight invisible to one-factor-at-a-time designs<!-- FACT-D24-137 -->[^yates-1937].
3. *The main-effect efficiency via shared replication* — a full 2×2×2 factorial with 8 runs estimates three main effects as precisely as three separate two-level OFAT experiments using 12 runs (one per factor), gaining the interaction estimates as a bonus from the same runs and resource investment<!-- FACT-D24-138 -->[^box-hunter-hunter-1978].
4. *The fractional-factorial trade-off (resolution and aliasing)* — fractional designs (2^(k-p) designs studying k factors in fewer than 2^k runs) trade the ability to estimate high-order interactions for dramatic run-count reduction, via aliasing assumptions: high-order interactions are assumed small or absent<!-- FACT-D24-139 -->[^plackett-burman-1946].
5. *The response-surface optimization foundation* — factorial designs characterize the response landscape across multiple factors, providing the geometric structure and curvature estimates needed for sequential optimization (steepest ascent, central composite designs, response-surface methods)<!-- FACT-D24-140 -->[^box-wilson-1951].
6. *The orthogonality property simplifying analysis* — balanced factorial designs produce uncorrelated factor columns in the analysis matrix, making main effects and interactions orthogonal (independent) and separable, which simplifies interpretation and protects against multicollinearity bias in effect estimation<!-- FACT-D24-141 -->[^bose-1947].

what_it_is_not:
- Not the same as multifactor observational analysis — factorial design requires controlled manipulation of each factor.
- Not a blocking design, though block structures can be crossed with factorial treatment structures; blocking controls nuisance factors, factorial design studies multiple factors of interest.
- Not one-factor-at-a-time experimentation — the distinguishing feature is that factors are varied *simultaneously* rather than sequentially.
- Not the same as a screening experiment alone, though fractional factorials are often used for screening; full factorial analysis produces interaction estimates that screens deliberately sacrifice.
- Not inherently Bayesian or frequentist — factorial designs work under either analytic framework.
- Not limited to two-level factors; three-level, mixed-level, and continuous factor designs are common in response surface methodology.
- Not free from assumptions — standard factorial ANOVA assumes effects are additive on the outcome scale and errors are independent and identically distributed, assumptions that may require transformations or mixed models when violated.
- Not guaranteed to detect all meaningful interactions — power for interactions is typically lower than for main effects, so small-but-real interactions may be missed.
- Not the same as a correlational multivariate analysis — factorial design establishes causal effects through random assignment to factor combinations.
- Not sufficient alone for optimization — factorials characterize the response surface but typically require follow-up confirmatory runs or sequential designs for optimization.

broad_use: Factorial designs are ubiquitous across science and industry. In manufacturing and chemical engineering, Design of Experiments (DOE) built on factorial structures has been the dominant approach to process optimization since the mid-twentieth century; companies like DuPont, 3M, and Toyota have embedded factorial DOE in their continuous-improvement cultures. In pharmaceutical formulation science, factorial designs test combinations of excipients, particle sizes, and compression forces to optimize tablet performance. In marketing and advertising, conjoint analysis and multi-variate testing use factorial structures to study how price, messaging, channel, and creative interact to drive purchase intent. In agricultural research, factorial experiments on fertilizer, irrigation, and seed variety have been standard since Fisher's Rothamsted work. In food science, factorial designs characterize how ingredient proportions, processing temperatures, and storage conditions jointly affect sensory and shelf-life outcomes. In human factors and ergonomics, factorial studies examine how lighting, workstation configuration, and task demand interact to affect performance and fatigue. In software engineering, combinatorial testing (a variant of fractional factorial) is used to efficiently cover interactions among configuration parameters. In public-health field trials, factorial randomization of intervention components allows identification of which elements of a multi-component program are driving effects.

clarity: Factorial designs make the interaction structure of a system explicit<!-- FACT-D24-148 -->[^montgomery-2017]. Where OFAT approaches implicitly assume that each factor acts independently of the others — an assumption that is often wrong in nonlinear systems — factorial structures force the experimenter to confront and quantify interactions. A "temperature × catalyst" interaction that reveals a specific combination produces dramatically higher yield than either factor alone would predict is not merely a statistical curiosity; it is often the most commercially and scientifically important finding of a study. Reporting main effects alone, without checking for interactions, can actively mislead when interactions are present: the marginal average of a factor with a large interaction is an artifact of the particular mix of other factor levels in the dataset. Factorial designs, properly analyzed, produce a clearer picture of the causal structure than any sequence of single-factor studies.

manages_complexity: Factorial designs are a core tool for managing the complexity of multi-factor systems<!-- FACT-D24-149 -->[^box-hunter-hunter-1978]. A full factorial with k factors at 2 levels each requires 2^k runs — 8 for k=3, 16 for k=4, 64 for k=6. Beyond six or seven factors, full factorials become prohibitive, and fractional factorials trade information about high-order interactions for drastic run-count reductions. A 2^(7-3) fractional factorial studies 7 factors in just 16 runs, estimating all main effects and some two-way interactions under the assumption that three-way and higher interactions are negligible — an assumption generally supported by the empirical principle of "effect sparsity" (in most real systems, a small number of factors and two-way interactions dominate, while high-order interactions are small and noisy). Combined with blocking, factorial designs can simultaneously control nuisance variation and study multiple factors of interest. The art of experimental design is matching the design structure to the research question: screening designs to identify active factors, response-surface designs to optimize continuous processes, mixture designs when factors must sum to a constant, and so on.

abstract_reasoning: Factorial designs embody a fundamental insight: systems are not generally decomposable into independent factor effects<!-- FACT-D24-150 -->[^fisher-1935]. The OFAT approach — vary one factor while holding others fixed, then move to the next — implicitly assumes additivity and independence and, when these assumptions fail (which is most of the time in nonlinear systems), produces misleading or suboptimal conclusions. The deeper principle is that interactions are information: knowing that a factor's effect depends on another factor's level tells us about the structure of the underlying process, and can point toward mechanism hypotheses that purely additive analyses cannot generate. Factorial designs also illustrate a broader design-of-experiments philosophy: efficient learning requires deliberately structured exploration of the design space, not random or opportunistic sampling. The same principle appears in machine learning (active learning, experimental-design for acquisition-function optimization) and in scientific strategy more generally (planned coverage vs opportunistic investigation).

knowledge_transfer:
| Domain | Factors | Levels | Interaction Insight Typically Sought |
|--------|---------|--------|---------------------------------------|
| Chemical process optimization | Temp, pressure, catalyst, flow rate | 2-3 each | Temp×catalyst: which catalyst is best at which temp |
| Pharmaceutical formulation | Excipient type, particle size, compression force | 3-4 each | Which excipient-compression combinations give target dissolution |
| Marketing conjoint | Price, brand, feature set, channel | 2-5 each | How price sensitivity varies by channel and feature |
| Agricultural trial | Seed variety, fertilizer, irrigation | 2-4 each | Variety × irrigation (drought-tolerance confirmation) |
| Software combinatorial test | Config parameters A, B, C, D, E, F | 2-3 each | Which parameter combinations trigger defects |
| Food science | Sugar, fat, baking time, flour type | 2-3 each | How sugar × fat interaction affects texture at each flour type |
| Ergonomics study | Lighting, task pace, rest interval | 2-3 each | Whether rest intervals matter more under high pace |
| Clinical factorial RCT | Treatment A (yes/no), Treatment B (yes/no) | 2 each | Whether combining A and B is synergistic, additive, or antagonistic |
| Semiconductor DOE | Wafer temp, etch time, gas mix, spin speed | 2-3 each | High-order interaction typically negligible; 2-way critical |
| Environmental exposure | Pollutant type, concentration, duration | 2-4 each | Dose × duration (acute vs chronic effect profiles) |

formal_abstract:
George Box's collaboration with industrial chemists at Imperial Chemical Industries (ICI) and later his consulting and academic work established factorial design as the dominant methodology for industrial process optimization. The canonical case is a 1955 study by Box and Youle on the yield optimization of a chemical reaction, published as a landmark paper demonstrating how a 2^3 factorial design (three factors — temperature, concentration, time — each at two levels, for 8 runs) revealed a significant temperature × concentration interaction that one-factor-at-a-time experimentation had missed. OFAT studies, conducted by varying temperature first (at fixed concentration and time), then concentration, then time, had identified incremental improvements in each factor but had converged to a local optimum that was substantially below the true global optimum. The factorial design, by contrast, systematically covered the interaction space and revealed that the best yield occurred at a temperature-concentration combination that OFAT could not have found because the optimum depended nonlinearly on both factors jointly.

Box subsequently developed response surface methodology (RSM), which extends factorial thinking to continuous factor levels with central composite designs and sequential experimentation for optimization. The methodological ideas from Box, Hunter, and Hunter's *Statistics for Experimenters* (1978, 2nd ed. 2005) shaped industrial experimentation globally. Factorial DOE was central to the Six Sigma movement at Motorola, General Electric, and thousands of other companies; a 1996 General Electric internal review estimated that Black Belt projects using factorial DOE had generated over $1 billion in annual savings, largely by uncovering interaction effects that traditional engineering intuition had missed. A 2-level full factorial in 5 factors (32 runs) routinely became the standard "characterization" design for process development, with fractional factorials (e.g., 2^(5-1) in 16 runs) used for screening larger factor sets. The factorial structure made interactions visible, analyses reproducible, and optimization sequential — each successive experiment informed by the geometric structure of the previous one.

**Mapped back:** This case illustrates the structural signature of factorial design—systematically varying multiple factors (temperature, concentration, time) across all level combinations, allowing analysis of main effects and all interactions through the geometric factorial structure—and the core principle that "factorial arrangements reveal interactions that one-factor-at-a-time studies miss"; the key insight that OFAT converged to a local optimum while the factorial design found the global optimum exemplifies how the interaction-detection capability (encoding the non-additivity in the factor relationships) creates actionable intelligence that simple one-at-a-time approaches cannot provide.

applied_industry:
A national quick-service restaurant chain was redesigning its mobile ordering app and wanted to understand how three design choices jointly affected average-order-value (AOV) and checkout-completion rate: (A) whether to surface a "pair with a side" upsell prompt at item-add time (prompt / no prompt), (B) whether to default the drink size to medium or small (medium-default / small-default), and (C) whether to show estimated calorie count on the cart screen (shown / hidden). Product management's initial plan was a sequential OFAT rollout: test A for four weeks, then B, then C. The data-science team pushed back, arguing that the three factors would plausibly interact — for example, the calorie display (C) might reduce the effectiveness of the upsell prompt (A), and the medium-default drink (B) might interact with the calorie display (C) because larger drinks display larger calorie counts. The team proposed a 2×2×2 full factorial randomized across users, with users randomly assigned at first-login to one of the 8 combinations and observed over a 6-week period spanning all 8 cells.

With 1.8 million active app users per week, statistical power was not a concern; each of the 8 cells had enough users to detect even small effect differences. The analysis used a linear model with main effects and all two-way and three-way interactions for the two outcomes. Results: the upsell prompt (A) alone increased AOV by $0.82 (95% CI $0.65–$0.99) and reduced completion rate by 1.1 percentage points (95% CI -1.7 to -0.5). The small-default drink (B) reduced AOV by $0.31 and had negligible effect on completion. The calorie display (C) had a small negative effect on AOV (-$0.11) and negligible effect on completion. Two interactions were statistically and practically significant: the A×C interaction showed that the upsell prompt's AOV boost was cut roughly in half ($0.41 vs $0.82) when calorie counts were displayed, suggesting the health-salience cue offset the promotional nudge. The A×B interaction was small and not statistically reliable, but the B×C interaction showed that the calorie display produced a meaningful 0.9-percentage-point completion-rate drop only when the medium-default was active — consistent with the hypothesis that larger drink calorie numbers discouraged some users from completing. The three-way interaction was not distinguishable from zero.

The rollout plan incorporated the interaction structure: the prompt (A) was enabled, the calorie display (C) was delayed to a later phase (because it diluted A's revenue lift), and the small-default drink (B) was not adopted (because its AOV cost was not offset by completion-rate gains). Critically, an OFAT sequence would have found each main effect roughly correctly but would have missed the interactions entirely — it would have launched both the prompt and the calorie display together expecting additive effects and observed disappointing revenue performance without understanding why. The factorial design, at no additional operational cost (the 8 cells were run concurrently rather than sequentially), produced a causally cleaner and commercially more actionable analysis.

**Mapped back:** This case exemplifies the structural signature of factorial design applied to digital product optimization—a 2×2×2 randomized assignment producing 8 cell combinations, analysis of main effects and two-way interactions revealing the A×C interaction (upsell prompt effectiveness reduced by calorie display) and B×C interaction (calorie-count completion-rate penalty only under medium-default drink)—and the core principle that interaction detection (encoded in the cross-cutting factorial structure) produces both causal clarity and practical actionability that sequential OFAT studies would not achieve; the equivalence in total cost between concurrent factorial and sequential OFAT testing shows how the factorial design framework enables better science at no additional expense.

prose:
_(Pass B — deferred)_

### Catalog cross-references (v1, batches 02–29)

Solution archetypes that reference this prime (per `solution_archetypes/_catalog/catalog_v1_batches_02_29.yaml`):

**As source prime (1):** `interaction_effect_mapping`

**As related prime (2):** `catalytic_pairing`, `controlled_randomization`

notes: Factorial design is one of Fisher's three foundational design principles in extended form (the other two being randomization and blocking, covered in companion primes). Core references: Fisher *The Design of Experiments* (1935); Yates *The Design and Analysis of Factorial Experiments* (1937); Box, Hunter, Hunter *Statistics for Experimenters* (2005); Montgomery *Design and Analysis of Experiments* (2019, 10th ed.). The modern industrial DOE tradition developed through the work of Box, Taguchi (who championed robust-design factorials with emphasis on signal-to-noise ratios), Plackett-Burman (who developed screening designs for many factors), and response-surface methodology. In contemporary A/B testing practice, "multivariate testing" (MVT) is essentially factorial experimentation on digital systems, often with the additional advantage of very large sample sizes that make even small interaction effects detectable.


Factorization

slug: factorization

one_liner: Expressing one object as a product of same-type factors under its native operation.

origin_domain: mathematics

core_idea:
Factorization expresses a single object as a product of simpler factors
under a defined *combining operation*, such that the factors are of the
same type as the parent (closure), each is closer to the operation's
identity or to a fixed library of irreducibles, and recombining them
under the operation recovers the original exactly. The structural
commitment is sharper than "break a thing into parts." The parts must
compose *multiplicatively* — or, more generally, under the system's
native binary operation — rather than merely additively, and the move is
meaningful only when the parent admits a non-trivial decomposition into
smaller factors that the operation can put back together.

The pattern carries three structural consequences wherever it appears. It
*exposes hidden generative structure*: 12 = 2 × 2 × 3 reveals primes
invisible in the surface number, a product form inside a joint
distribution exposes independence hidden in the joint table, a
singular-value decomposition reveals rank structure invisible in the raw
matrix.<!-- FACT-D63-401 -->[^golub-vanloan-2013] It *enables divide-and-conquer over operations the system already
supports*: once factored, any transformation respecting the operation can
be applied factor-by-factor. And it *bottoms out at a library of
irreducibles* — primes in integers, simple groups in finite groups,
indecomposable representations in linear algebra, atomic mechanisms in a
causal factorization — and the catalog of irreducibles is itself a deep
structural fact about the system.<!-- FACT-D63-402 -->[^dummit-foote-2004] What distinguishes factorization from
generic decomposition is its commitment to a combining operation the
system *natively supports*, so the factors stay in the same algebra as the
parent and recombination is automatic. That single commitment is what
makes factorizations so leverageable, and it is substrate-neutral: the
algebra may be arithmetic, probability, chemistry, or organizational
coordination.

structural_signature:
*a composite object* — *a native combining operation under which the kind
is closed* — *a set of factors of the same kind as the parent* — *a
library of irreducibles the factors bottom out at* — *the exact-recovery
invariant under recombination* — *the uniqueness-or-its-failure of the
decomposition*

An expression is a factorization when the following hold:

- **A parent object of some kind.** A single object — number, matrix,
  distribution, molecule, output — drawn from a system that has a definite
  type.
- **A native combining operation.** A binary operation belonging to that
  system (multiplication, composition, conditional product, synthesis)
  under which the kind is closed: combining two objects of the kind yields
  an object of the kind.
- **Same-type factors.** The parent is written as a combination of
  factors that are themselves objects of the same kind, each typically
  simpler — closer to the operation's identity or to an irreducible.
- **A library of irreducibles.** Decomposition bottoms out at a catalog of
  atoms that admit no further non-trivial factoring (primes, simple
  groups, atomic mechanisms); the catalog is itself a structural fact
  about the system.
- **Exact recovery.** Recombining the factors under the native operation
  returns the original parent precisely — the decomposition is a faithful
  recipe, not an approximation.
- **Uniqueness status.** Whether the factorization is essentially unique
  (up to reordering or units) is a determinate property of the system, and
  its presence or failure shapes which proofs and algorithms apply.

These compose into one move: name the operation, decompose the parent into
same-type factors over a library of irreducibles such that recombination
is exact, and thereafter make any operation respecting the operation
factor-local.

what_it_is_not:
- **Not generic `decomposition`.** Decomposition breaks a thing into parts
  by *any* split; factorization demands the parts compose back under a
  *native binary operation* under which the kind is closed, so the factors
  stay in the same algebra as the parent and recombination is exact.
- **Not `partition`.** A partition divides a set into disjoint covering
  blocks (additive, set-theoretic); factorization writes one object as a
  *product* of same-type factors — multiplicative, with no requirement of
  disjointness or coverage.
- **Not `compositionality`.** Compositionality is the property that a
  whole's meaning is determined by its parts and their mode of combination;
  factorization is the *act* of finding such a product form, and it
  requires closure and a library of irreducibles that compositionality does
  not.
- **Not `superposition` or `linear_combination`.** Those combine components
  *additively* (weighted sums); factorization combines *multiplicatively*
  under the system's product, and bottoms out at irreducibles rather than
  at a spanning basis.
- **Not approximate `dimensionality_reduction`.** A low-rank approximation
  trades exactness for compression; factorization (in its strict sense)
  recovers the parent *exactly* on recombination — the decomposition is a
  faithful recipe, not a best fit.
- **Common misclassification.** Calling any "breaking into pieces"
  factorization. Catch it by asking whether the pieces recombine under a
  native operation to recover the original exactly, and whether they bottom
  out at a library of irreducibles — if not, it is decomposition or
  partition, not factorization.

broad_use:
The skeleton recurs across substrates. In mathematics it is prime and
polynomial factorization, group decompositions, matrix factorizations
(LU, QR, Cholesky, eigendecomposition, SVD), and convolution as
multiplication after a Fourier transform.<!-- FACT-D63-403 -->[^golub-vanloan-2013] In probability and statistics
it is factoring a joint distribution into conditionals and marginals
along a graphical-model DAG — the explicit content of Bayesian networks —
and latent-factor models that recover hidden generative factors.<!-- FACT-D63-404 -->[^koller-friedman-2009] In
causal inference it is factorizing the joint over a causal DAG into local
mechanisms, so that an intervention becomes substitution at a single
factor without disturbing the others. In chemistry it is factoring
molecules into functional groups for synthesis, with retrosynthesis as
factorization in reverse.<!-- FACT-D63-405 -->[^corey-cheng-1989] In economics it is Cobb–Douglas production
factoring output into input contributions, and factor models decomposing
returns into exposures.<!-- FACT-D63-406 -->[^cobb-douglas-1928] In computer science it is code refactoring,
database normalization, and the Chinese Remainder Theorem enabling
computation across coprime moduli.<!-- FACT-D63-407 -->[^hardy-wright-2008] In design and engineering it is
separating coupled concerns into independently variable components — the
principle behind modular architectures. In linguistics it is
morphological factorization of words into root plus affixes, and in music
the separation of a piece into harmony, rhythm, and instrumentation. In
each case the factors stay in the parent's algebra and recombine under
its native operation.

clarity:
The prime forces three structurally informative commitments: *what
combining operation governs this system?* (multiplication, composition,
conditional product, concatenation), *what counts as a factor?* (an
object of the same kind as the parent), and *what are the irreducibles?*
(the bottom-out atoms in this algebra). Naming the combining operation is
what distinguishes factorization from looser splittings — factoring a
corporation into independent business units that recombine under
organizational coordination is sharper than just "breaking into parts."
The pattern also clarifies the difference between *the object* and *its
generative recipe*: the number 60 is one object, its factorization
2²·3·5 is a recipe; two objects can be equal yet have different
factorizations (in non-unique-factorization rings — a structural alarm
bell), and two factorizations of the same object are typically related by
reordering or by units. Unique-factorization domains are precisely the
systems where the recipe is essentially unique, and whether that property
holds shapes which proofs and algorithms work. The clarifying force is to
separate the surface object from its generative decomposition and to make
the combining operation, the factor type, and the irreducibles explicit.

manages_complexity:
Once a problem is factored, operations that respect the combining rule
become *factor-local*. The cost of working with the parent drops from
"handle the whole composite" to "handle each factor and reassemble,"
which is exponentially cheaper whenever the combining rule is the
cost-driver. Fast-Fourier-based multiplication, exponentiation by
squaring, factored-form matrix algorithms, dynamic programming over
factored state spaces, and inference over factored probability
distributions are all instances of the same complexity gain.
Factorization is also a *complexity-tuning lever*: the same object often
admits several factorizations, and the engineering choice is which one to
compute in. A matrix may be factored as LU (good for solving linear
systems), QR (good for least squares), or SVD (good for rank truncation),
the same object but each factorization making a different operation cheap.<!-- FACT-D63-408 -->[^golub-vanloan-2013]
The management payoff is twofold — operations localize to factors, and
the choice of factorization becomes a tunable that matches the
decomposition to the operation one most needs to be fast.

abstract_reasoning:
Recognizing factorization licenses a cluster of structural moves. The
first is *independence-as-factorization*: two variables are independent
exactly when their joint factors as a product of marginals — the formal
content of "they don't talk to each other" — and the same test detects
independence in probability, separability in optimization, and modularity
in engineered systems. The second is *intervention-as-replace-one-factor*:
in a factored causal model, an intervention replaces a single mechanism
without touching the others, which is why factored causal models support
counterfactual reasoning at all. The third is *library-of-irreducibles
reasoning*: once the catalog of irreducibles is known (primes, atoms,
simple groups, elementary cycles), every parent object is a multiset over
the catalog, and many global properties reduce to per-irreducible
properties. The fourth is *hidden-factor hypothesis testing*: when raw
data look complicated, ask whether a small number of latent factors
explains the variance, since the success or failure of low-rank
factorization is itself a strong structural signal. The reasoner asks, of
any composite: under what operation does it factor, what are its
irreducibles, and what becomes factor-local once it is decomposed?

knowledge_transfer:
The intervention catalog transfers cleanly, and the historical record of
transfer is among the strongest in the corpus. Causal-DAG factorization
moved from statistics into program evaluation, letting policymakers reason
about "if we change this one mechanism, what propagates?" without
re-estimating the whole system. Matrix factorization moved into
recommender systems as the "users and items in a shared latent space"
pattern now standard in collaborative filtering and embedding-based
retrieval.<!-- FACT-D63-409 -->[^koren-etal-2009] Retrosynthesis in chemistry — factoring a target molecule into
convergent precursors — is structurally identical to backward planning in
AI, and the transfer runs both ways. FFT-style algebraic factorization
underlies MP3, JPEG, and modern neural compression — all instances of
"find the factorization that concentrates mass on few terms."<!-- FACT-D63-410 -->[^wallace-1992]
Production-function factorization gives growth accounting its decomposition
into capital, labour, and total factor productivity.<!-- FACT-D63-411 -->[^solow-1957] The role mappings are
direct: object ↔ integer / matrix / joint distribution / molecule /
output, combining operation ↔ multiplication / composition / conditional
product / synthesis, factors ↔ primes / matrix factors / local mechanisms
/ functional groups / input contributions, irreducibles ↔ primes / simple
groups / atomic conditionals. A statistician who reads independence as
"the joint factors into marginals" recognizes the identical test as
separability in an optimization and as modularity in a hardware design;
an engineer who knows a do-intervention replaces exactly one factor in a
causal model sees the same modularity when refactoring extracts a shared
subroutine that can be changed without disturbing the rest. Because the
decomposition skeleton is substrate-neutral while only the algebraic
vocabulary is mathematical, the transfer is recognition of one shape —
multiplicative recipe plus modular updates plus a library of irreducibles
— across arithmetic, causality, chemistry, economics, and computation.

formal_abstract:
Take the factorization of a joint probability distribution over a Bayesian
network as a worked instance. The *parent object* is a joint distribution
$P(X_1, \dots, X_n)$ — a single object in the kind "probability
distributions over $n$ variables." The *native combining operation* is the
conditional product: distributions of this kind are closed under
multiplying a conditional by a marginal. A directed acyclic graph nominates
a *same-type factoring*:
$P(X_1,\dots,X_n) = \prod_i P(X_i \mid \text{parents}(X_i))$, writing the
parent as a product of local conditional factors, each itself a
distribution of the same kind. The *library of irreducibles* here is the
set of local conditional mechanisms — one per node — that admit no further
non-trivial splitting once the graph is fixed. The *exact-recovery
invariant* holds: multiplying the local factors back reconstructs the
original joint precisely, not approximately. The structural payoff is the
prime's signature move, *intervention-as-replace-one-factor*: a $do(X_3 =
x)$ intervention deletes the single factor $P(X_3 \mid \text{parents})$ and
substitutes a point mass, leaving every other factor untouched — which is
exactly why a factored causal model supports counterfactual reasoning that
an unfactored joint table cannot.<!-- FACT-D63-412 -->[^pearl-2009] The same factorization also exposes
*independence-as-factorization*: $X_i \perp X_j$ precisely when the joint
factors with no shared term linking them, a property invisible in the raw
joint table but legible in the product form.

**Mapped back:** The Bayesian-network factorization instantiates every
role — composite joint as parent, conditional product as the native
operation, local mechanisms as same-type factors and irreducibles, exact
reconstruction — and shows the decomposition turning intractable global
inference into factor-local computation and single-factor intervention.

applied_industry:
Consider matrix factorization in a recommender system, with a chemistry
synthesis case alongside. In the recommender the *parent object* is a
sparse user–item rating matrix $R$ in the kind "real matrices." The *native
operation* is matrix multiplication, under which the kind is closed. The
factorization writes $R \approx U V^\top$, a product of a tall user-factor
matrix $U$ and a wide item-factor matrix $V$ — both same-type objects whose
inner products reconstruct ratings. The *hidden generative structure* the
prime promises surfaces directly: the columns of $U$ and $V$ are *latent
factors* (taste dimensions) never present in the raw matrix, and the
success of a low-rank factorization is itself the structural signal that
few latent tastes explain most variance. The intervention this enables:
recommend by computing a single user-row times the item matrix —
factor-local work — rather than reasoning over the whole dense matrix, and
*tune which factorization* (SVD for rank truncation, non-negative matrix
factorization for interpretable parts) to match the operation you most need
cheap. The identical shape governs retrosynthesis: a target molecule is the
parent, chemical synthesis the native combining operation, and the chemist
factors it backward into convergent precursor fragments drawn from a
*library of irreducible* commercially-available building blocks, such that
running the reactions forward recovers the target exactly. Backward
planning in chemistry and backward planning in AI are the same
factorization run in reverse.

**Mapped back:** The recommender and the synthesis route both run the prime
end-to-end — a composite parent, a native operation, same-type factors over
a library of irreducibles, exact (or quantifiably approximate) recovery —
and in both, factoring localizes the expensive operation and exposes
generative structure hidden in the surface object.


Fading

slug: fading

one_liner: Gradual withdrawal of instructional support as competence grows.

core_idea:
Fading is the deliberate, graduated *withdrawal* of support — prompts, guidance, props, or external assistance — timed so that a learner or system progressively assumes the function unaided, terminating in independent performance. The defining commitment is intentional, scheduled removal: support is not merely present or absent but is *tapered* along a trajectory that tracks growing competence, so that the helper engineers its own obsolescence. <!-- FACT-D54-421 -->[^cooper-heron-heward-2007] The concept is sharpest in instructional psychology, where it was operationalized as the systematic withdrawal of teacher-supplied prompts so that responding comes under the control of the natural task rather than the helper, but the same shape recurs wherever a temporary support is installed precisely so that it can later be removed. <!-- FACT-D54-422 -->[^terrace-1963]

Fading answers a recurring design problem: a support that solves the immediate performance gap can, if left in place, become a permanent crutch that prevents the very independence it was meant to enable. The prime names the third option between "always help" and "never help" — *help on a decreasing schedule* — and makes the withdrawal itself an object of design with its own rate, its own milestones, and its own failure modes. <!-- FACT-D54-423 -->[^collins-brown-newman-1989]

structural_signature:
Fading encodes a structural pattern: **support installed → competence monitored → support tapered in step with competence → support fully removed, function self-sustaining**. It separates two states (a dependent, supported performance and an autonomous, unsupported one) and names the *scheduled removal* that carries the system from the first to the second without collapse. The distinguishing feature is that the trajectory of withdrawal is itself engineered — a control variable — rather than a side effect. <!-- FACT-D54-424 -->[^cooper-heron-heward-2007]

**Recurring features:**

- Graduated withdrawal of support tracking growing competence
- The helper engineering its own obsolescence
- A temporary scaffold removed on a designed schedule
- Transfer of control from external prop to autonomous function
- Tapering rather than abruptly cutting assistance
- An exit ramp built into the help itself
- Fade at the pace of acquired capability, not the calendar

The structural insight is robust: a reading teacher who prompts less at each session, a clinician who dials down ventilator pressure as a patient's respiratory drive recovers, a shared-autonomy controller that returns steering authority as the operator's skill grows, and an onboarding flow whose tooltips disappear as the user becomes fluent all instantiate the same logic. Each installs a support deliberately, watches a competence signal, and reduces the support in step with that signal until the function stands alone. <!-- FACT-D54-425 -->[^collins-brown-newman-1989]

what_it_is_not:
Fading is **not** the mere absence of support, nor the failure to provide it. A system that was never scaffolded is not "faded"; fading requires that support was first installed and then deliberately removed. The defining work happens in the *removal phase*, which presupposes a prior support phase. A claim that "we faded the help" is empty unless there was help to fade and a schedule on which it came down. <!-- FACT-D54-426 -->[^wood-bruner-ross-1976]

Nor is fading the same as abrupt termination. Cutting support at a single moment — pulling the scaffold all at once — is a *cliff*, not a fade. The prime specifically denotes a *graduated* taper across a transition window: support is reduced in increments small enough that the system can absorb each one by taking over a little more of the function. Abrupt removal that happens to coincide with readiness is a lucky cutoff, not a managed fade; fading names the gradual trajectory, not the endpoint alone. <!-- FACT-D54-427 -->[^terrace-1963]

Fading is also **not** passive decay or unwanted weakening. A signal that attenuates under physical decay laws, a skill that erodes from disuse, or a material that wears out are all losing strength *without anyone intending it and against the system's interest*. Fading is purposeful and aims at *improved* function: the support goes away precisely because the supported party no longer needs it. Decay leaves a system worse off; a completed fade leaves it independent and better off. The two can be confused because both end in "less of something," but their causal structure (intended vs. unintended) and their valence (toward competence vs. toward loss) are opposite.

Finally, fading makes no claim that withdrawal is always safe or always succeeds. The prime describes a designed trajectory; it does not guarantee the trajectory is well-calibrated. Fading too fast collapses performance; fading too slowly entrenches dependence. Naming the pattern does not certify that any particular schedule is correct — it only makes the schedule visible as the thing to get right.

broad_use:
**Education:** Scaffolding is faded as students master a skill, transferring responsibility from teacher to learner — the "gradual release of responsibility" in which a teacher moves from modeling, to guided practice, to independent practice, deliberately reducing input at each stage. <!-- FACT-D54-428 -->[^pearson-gallagher-1983]

**Behavioral psychology:** Prompt fading gradually removes cues — verbal, gestural, then physical — so that a target behavior comes under the control of naturally occurring stimuli rather than of the trainer's prompts; most-to-least and least-to-most prompting hierarchies are explicit fading schedules. <!-- FACT-D54-429 -->[^macduff-krantz-mcclannahan-2001]

**Rehabilitation medicine (non-obvious):** Assistive support — parallel bars, a therapist's steadying hand, exoskeleton torque, supplemental oxygen, ventilator pressure-support — is dialed down as motor or physiological function returns, so the patient does not learn dependence on the aid; ventilator weaning protocols are formalized fading curves. <!-- FACT-D54-430 -->[^ely-1996]

**Robotics and shared autonomy:** Control systems fade machine assistance as the human operator's skill or measured trust grows, returning authority along a blending schedule so the operator ends in full manual control rather than permanent reliance on the assist.

**Product design and onboarding:** Tooltips, coach marks, tutorials, and "training wheels" interfaces are progressively withdrawn as users demonstrate proficiency, so the interface does not remain cluttered with guidance the now-expert user has outgrown.

**Pharmacology and policy:** A drug dose is tapered to wean a system off dependence rather than provoke withdrawal shock; analogously, subsidies, guarantees, or oversight regimes are stepped down on a schedule rather than cut, so the supported actor adjusts incrementally.

clarity:
A core function of naming fading is to make visible that *withdrawal is itself a designed act* with its own schedule, instruments, and risks — distinct from giving support and distinct from never giving it. Without the prime, withdrawal tends to be treated as a non-event ("we just stopped helping"), which hides the two characteristic failure modes: support that is never faded, producing dependence, and support faded too fast, producing collapse of performance. <!-- FACT-D54-431 -->[^collins-brown-newman-1989]

Fading clarifies the difference between a *crutch* and a *scaffold*. A crutch is support with no exit plan — its continued presence is the design. A scaffold is support that is temporary by construction, defined as much by its planned removal as by its initial provision. Many supports look identical in their installed state; the prime forces the question that distinguishes them: *on what schedule does this come down, and what signal triggers each step?* That question reframes a thousand "should we keep helping?" debates into a single design problem: *how do we taper?*

manages_complexity:
Fading turns the binary "support or no support" into a controllable trajectory, letting designers manage the hand-off of a function across a transition window rather than at a single cliff-edge. The intractable question "is the learner ready?" becomes the tractable, iterable question "what is the next small reduction we can make, and does competence hold after it?" <!-- FACT-D54-432 -->[^wood-bruner-ross-1976]

It bounds dependence by building an exit ramp into the help itself. Instead of separately provisioning support and later worrying about how to retract it, fading designs provision and retraction as one coupled process: the support arrives already carrying its own schedule of decline. This collapses two problems (give help; remove help) into one (taper help), and it makes the dangerous middle region — where the system is neither fully supported nor fully autonomous — into a navigable corridor with intermediate checkpoints rather than a chasm to be leapt.

abstract_reasoning:
Recognizing fading supports reasoning about *timing*: the taper should track acquired competence rather than the calendar, so the rate of withdrawal becomes a function of a measured capability signal, not a fixed clock. It supports reasoning about *hysteresis*: a well-designed fade re-introduces support if performance regresses, so the schedule is not strictly monotonic but responsive, stepping back up when a competence check fails. <!-- FACT-D54-433 -->[^ely-1996]

It also frames autonomy as the *endpoint of a managed withdrawal* rather than a default starting condition or a switch to be flipped. This reframing enables counterfactual reasoning across domains: if a ventilator can be weaned on a schedule indexed to spontaneous breathing trials, could organizational oversight be tapered on a schedule indexed to demonstrated compliance? If prompt fading prevents learned dependence on a trainer's cues, could a subsidy be faded to prevent dependence on the subsidy? The reasoning is not a loose metaphor but a transfer of the same control structure — monitor competence, reduce support in step, restore support on regression — into a new substrate.

knowledge_transfer:
The teacher's practice of gradually releasing responsibility transfers directly to the therapist's tapering of physical assist, to the behaviorist's prompt fading, and to the UX designer's disappearing onboarding cues. A practitioner who has internalized one of these recognizes the others as the same move on a different substrate, and can import specific techniques — fixed milestones, competence-gated steps, planned regression handling — across the boundary. <!-- FACT-D54-434 -->[^collins-brown-newman-1989]

The pharmacological notion of *weaning to avoid withdrawal shock* transfers to organizational change, where subsidies, guarantees, or supervisory controls are tapered rather than cut so that the supported actor adjusts incrementally instead of failing at a cliff. Conversely, the clinical insistence on objective readiness criteria before each reduction transfers back into education and product design, sharpening vague "they seem ready" judgments into explicit competence gates. Because the underlying structure — install, monitor, taper, release — is identical, the transfer carries not just inspiration but reusable schedule designs and instrumentation. <!-- FACT-D54-435 -->[^asam-2025]

formal_abstract:
**Reading instruction (gradual release):** A reading teacher first reads a passage aloud with a child, carrying nearly the whole task. In the next phase the teacher prompts only at hard words; later, only when the child explicitly requests help; finally, not at all. Each step is a deliberate reduction in support, timed to the child's growing fluency, until the child reads independently. The support was real, its removal was scheduled, and the schedule was indexed to a competence signal (where the child stumbled). **Mapped back:** This is the canonical fade — support installed (full read-aloud), competence monitored (where prompts are still needed), support tapered in step (prompt only at decreasing classes of difficulty), function self-sustaining (independent reading). The teacher engineered her own obsolescence on a trajectory that tracked the child's capability, not the calendar.

**Prompt fading (behavior acquisition):** A trainer teaching a new skill begins with a full physical prompt (hand-over-hand guidance), then fades to a partial physical prompt, then to a gesture, then to a verbal cue, then to no cue at all, so that the behavior comes under the control of the natural task stimulus rather than the trainer's prompt. A most-to-least hierarchy makes the taper explicit and gated: the trainer drops to the next-lighter prompt only when responding is reliable at the current level, and steps back up if errors return. **Mapped back:** The same structure recurs — the prompt is the installed support, reliability of responding is the monitored competence, the prompt hierarchy is the taper schedule, and naturally-controlled behavior is the self-sustaining endpoint. The built-in step-back on errors is fading's hysteresis: the schedule is responsive, not strictly monotonic.

applied_industry:
**Ventilator weaning (rehabilitation medicine):** A critically ill patient on mechanical ventilation cannot be extubated abruptly without risking respiratory collapse, yet leaving the ventilator in place too long causes diaphragm atrophy and ventilator dependence. Clinicians therefore wean: pressure support and supplemental oxygen are reduced in steps, each step gated by a readiness assessment (a spontaneous breathing trial in which the machine's contribution is briefly minimized and the patient's own respiratory drive is measured). If the patient tolerates the trial, support drops another increment; if not, support is restored and the patient rests before the next attempt. **Mapped back:** The structure is identical to the classroom fade on a biological substrate: support installed (full ventilation), competence monitored (spontaneous breathing trials), support tapered in step with recovering respiratory function, function self-sustaining (extubation). The explicit readiness gate and the willingness to step support back up are exactly the competence-indexing and hysteresis the abstract pattern predicts — and they exist precisely to avoid both failure modes, dependence (weaning too slow) and collapse (weaning too fast).

**Onboarding overlays (product design):** A software product ships tooltips, coach marks, and a guided first-run tutorial so that new users can complete key tasks. If those overlays stayed forever, expert users would face permanent clutter and the product would never feel like *theirs*. Instead the guidance is faded: a coach mark disappears after the user performs the action a few times, the tutorial does not reappear once completion is recorded, and contextual hints decay as usage telemetry shows the user has become fluent. A well-built flow also re-surfaces a hint if a long-dormant user returns and stumbles — restoring support on regression. **Mapped back:** Tooltips are the installed scaffold, usage telemetry is the competence signal, the disappearance schedule is the taper, and the uncluttered expert interface is the autonomous endpoint. The re-surfacing of hints for a regressed user is the same hysteresis seen in ventilator weaning and prompt fading, confirming that "fade with a step-back path" is one cross-substrate design, not three coincidences.

title: Fade too fast and performance collapses; fade too slow and dependence entrenches

body: Fading lives between two failure modes that pull in opposite directions. Removing support faster than competence accrues drops the system below the level it can sustain alone, producing the very failure the support was preventing. Removing it slower than competence accrues leaves the support in place after it is needed, where its continued presence actively teaches reliance on it. Every fading schedule is a bet about the rate of competence acquisition, and the correct rate is rarely known in advance, so practitioners must instrument the taper and adjust it rather than set it once.

title: The competence signal that should gate the taper is often noisier than the taper steps it controls

body: A clean fade reduces support only when a competence measure says the system is ready, but the measure is frequently coarse, delayed, or confounded. A child who reads fluently today may be having a good day; a spontaneous breathing trial samples minutes of a process that plays out over days; usage telemetry conflates a fluent user with a lucky one. When the readiness signal is noisier than the increments it gates, the schedule either over-reacts to noise (premature withdrawal) or is detuned until it ignores genuine readiness (over-long support). The quality of the fade is capped by the quality of its competence instrument.

title: A monotonic fade is simpler to run but brittle; a responsive fade is robust but can mask non-progress

body: Fading can be designed to only ever reduce support (clean, predictable, easy to communicate) or to step support back up whenever competence regresses (robust to setbacks, but oscillating). The monotonic version is brittle: a single bad patch can push the system past a point of no return. The responsive, hysteretic version survives setbacks but introduces a new hazard — indefinite oscillation that looks like ongoing support delivery and quietly disguises the fact that the system is not actually progressing toward independence. Re-introducing support to prevent collapse can become a comfortable equilibrium that never resolves into autonomy.

title: Building the exit ramp into the help can degrade the help

body: Designing support so that it is easy to withdraw — modular, gated, instrumented, conspicuously temporary — can make the support itself less effective while it is present. A scaffold optimized for clean removal may be thinner than one optimized purely to maximize current performance; a prompt designed to fade gracefully may be a weaker prompt than the most effective one. There is a real trade-off between how much a support helps now and how cleanly it can be retracted later, and over-designing for the fade can starve the support phase.

title: Who reads the competence signal owns the taper, and their incentives may not favor independence

body: Fading hands enormous leverage to whoever controls the schedule, because they decide when the supported party is "ready" for less help. That controller's incentives are not always aligned with reaching autonomy: a vendor benefits from onboarding that never fully fades into self-service, a service provider from clients who remain dependent, an institution from supervised actors who never graduate to unsupervised. The same structural move that engineers obsolescence in good faith can be deliberately stalled to manufacture dependence, and from the inside the two are hard to distinguish — the support simply never quite comes down.

title: A completed fade erases the evidence that support was ever needed

body: When fading succeeds, the support is gone and the function stands alone, which makes the prior dependence invisible and easy to under-value. Observers see only autonomous performance and may conclude the support was unnecessary all along, defunding the scaffolding that produced the independence they now take for granted. This creates a perverse dynamic: the better a fade works, the more it tempts everyone to skip the support phase next time, and the more fragile the next cohort that is thrown straight to the autonomous endpoint without the taper that made autonomy reachable.

prose: _No catalogued solution archetypes reference this prime yet._

notes:
Fading clusters tightly around *agent–support relationships*: there is a helped party (learner, patient, operator, user) and a helping party or apparatus (teacher, clinician, controller, interface) whose contribution is reduced over time. This is why the prime scores high on structural abstraction (the install–monitor–taper–release shape is fully substrate-agnostic) but only moderate on domain breadth: it has no clear physical or purely formal instance, and its examples all involve a function being handed off from a support to a self-sustaining performer.

The prime's two named failure modes — dependence (fade too slow) and collapse (fade too fast) — are not symmetric in their visibility. Dependence is quiet and accretes invisibly: a support that overstays simply continues to be delivered, and nothing alarms. Collapse is loud and immediate: pull support too fast and performance visibly fails. This asymmetry biases real-world fading toward the dependence error, because the salient, punished failure (collapse) is the one practitioners instinctively guard against, leaving the silent failure (entrenched dependence) to grow unchecked.

Fading is frequently paired with, but should not be collapsed into, *scaffolding* — the prime it was encountered alongside during harvest. Scaffolding names the *provision* of temporary support; fading names its *scheduled withdrawal*. They are two phases of one lifecycle, and a complete design specifies both, but the structural commitments differ: scaffolding is about installing the right support at the right grain, fading is about retracting it at the right rate. A support can be well-scaffolded and badly faded (or never faded at all), which is precisely the dependence failure mode.

The hysteresis property — restoring support when competence regresses — is what separates a sophisticated fade from a naive countdown. A naive fade is an open-loop schedule on a clock; a robust fade is a closed loop on a competence signal, with the schedule responsive to setbacks. Where the competence signal is cheap and reliable, the closed-loop fade dominates; where it is expensive or noisy (Tension T2), designers are forced back toward riskier open-loop schedules, which is a recurring source of fading failures across domains.


Fail-Safe

one_liner: Default to safe state on failure.

aliases:
fail-safe design
safe default state
safe failure mode
passive safety

core_idea: Fail-Safe is a design pattern characterized by (1) the deliberate arrangement of a system's failure behavior so that, when a critical component or control mechanism fails, the system's default state is the least harmful of the possible post-failure states rather than devolving into an uncontrolled or catastrophic condition, (2) the explicit acceptance that system failures will occur and that containment and safe degradation — not their elimination — is the pragmatic and often cost-effective design goal, (3) implementation through mechanisms whose natural, unpowered, or disconnected state produces the safe condition (brakes that engage when power is lost, valves that close when signal is lost, systems that default to deny when authentication services fail), and (4) a corresponding discipline of failure-consequence analysis: identifying what "safe" means for each critical failure mode, mapping that safe state, and ensuring the mechanism that must hold that state does so passively (without continued power or signal). The deeper insight is that active control — pumps, solenoids, powered brakes, continuous signals — requires constant energy and working components; when the power fails or components break, active control collapses. Passive mechanisms (gravity, spring tension, mechanical detents, default-deny logic, stateless processes) operate with no external input and therefore persist even when the control system itself has failed. Routing critical failures through passive mechanisms inverts the failure-mode relationship: failure of the control system does not cause failure of safety; it triggers the safety mechanism. The practice originated in mechanical safety systems (elevator brakes, train dead-man's switches, pressure relief valves in the 19th century) and has evolved into a foundational principle across every domain with critical safety requirements: aviation (runaway-trim disable, autopilot disengagement), nuclear engineering (passive cooling, gravity-driven emergency shutdown), medical devices (pacemakers reverting to fixed rate on sensor failure), cybersecurity (deny-by-default authorization, circuit breakers, default encryption), software engineering (transaction rollback, safe mode), and industrial safety (interlocks, emergency stops)<!-- FACT-D34-016 -->[^otis-1853].

structural_signature:
- *The identification of critical failure modes and definition of what constitutes a "safe" state for each* <!-- FACT-D34-017 -->[^leveson-2011]
- *The mechanism design ensuring the safe state is achieved passively (gravity, spring, mechanical detent, signal loss) not by active control* <!-- FACT-D34-018 -->[^westinghouse-1872]
- *The separation of control logic (which may fail) from safety logic (which must succeed via passive routing)* <!-- FACT-D34-019 -->[^leveson-2011]
- *The default-to-safe routing that assumes control pathway failure and maps failure to the predetermined safe state* <!-- FACT-D34-020 -->[^perrow-1984]
- *The cost-safety trade-off: fail-safe design often costs more (dual mechanisms, mechanical linkages) but is justified when failure consequence is catastrophic* <!-- FACT-D34-021 -->[^lees-2005]
- *The distinction between fail-safe (safe state on failure) and fail-secure (locked-down state on failure) as contextual design choices* <!-- FACT-D34-022 -->[^hollnagel-2014]

what_it_is_not:
- **Not the same as Robustness.** Robustness is the general functional property of maintaining performance across variation and disturbance; fail-safe is a specific design pattern for handling the failures that robustness cannot prevent. A robust system might maintain normal function under wide variation; a fail-safe system accepts that it will eventually fail but ensures that failure does not cause catastrophe.

- **Not the same as Redundancy.** Redundancy provides duplicate capability so that failure of one component is masked — the system continues to operate normally. Fail-safe does not mask failure; it accepts failure and routes it to a safe state. Elevator systems often use both: redundant cables for robustness, and mechanical over-speed governors that engage on cable breakage for fail-safety. The two mechanisms serve different purposes.

- **Not the same as Fault Tolerance.** Fault tolerance (via redundancy, voting, error correction) aims to make system failure invisible to the user — the system continues to deliver service despite component failures. Fail-safe does not hide failure; it makes failure visible but non-catastrophic. A voting system can tolerate one-out-of-three sensor failures (fault tolerance); a dead-man's switch is fail-safe because it stops the train when the operator fails but does not mask the failure.

- **Not the same as Error Proofing or Poka-Yoke.** Error proofing prevents human operator error by restricting possible actions (a part that can only fit one way, a machine that refuses wrong-sequence operations). Fail-safe handles component or control failure, not operator error. An elevator with interlocks (poka-yoke: prevents simultaneous door and motion commands) and with mechanical brakes (fail-safe: engages on power loss) uses both strategies.

- **Not the same as Fail-Secure.** Fail-safe and fail-secure are opposite contextual choices. Fail-safe defaults to an open, permissive, or flowing state on failure (fire doors open to allow evacuation, electrical fuses blow to open the circuit, elevator doors unlock to release passengers). Fail-secure defaults to a closed, restrictive, or locked state (vault doors lock when power is lost, authentication systems deny when identity service is down). Which is truly "safe" depends entirely on the context: fire safety (fail-safe = evacuate) requires doors to open; security (fail-secure = lock down) requires doors to remain closed.

- **Not universal to all failure modes.** Fail-safe is a design pattern for critical-consequence failures that the designer decides must not propagate catastrophically. Not every system component requires fail-safe treatment; a non-critical feature can fail with modest consequences and be repaired during normal maintenance. Applying fail-safe design to everything wastes cost and complexity.

- **Not a substitute for failure prevention.** Fail-safe accepts failure but does not cause or encourage it; the goal remains to reduce failure probability. A system with excellent fail-safe design that fails frequently is poorly designed overall. The goal is low failure rate (through robustness) combined with safe failure modes (through fail-safe design).

broad_use: Mechanical engineering (elevator brakes engaging on loss of power or cable breakage, train dead-man's switches that stop the engine if the operator releases the handle or becomes incapacitated, pressure relief valves that open passively if system pressure exceeds setpoint, tip-over shutoff switches on power tools), electrical engineering (circuit breakers that trip and open circuits on overcurrent, fuses that melt and open on overcurrent, ground-fault interrupters that trip on stray current, thermal cutoffs that interrupt power on temperature rise), aviation (runaway-trim disable that prevents autopilot from driving control surface to mechanical limit, electrical switches that disconnect autopilot on pilot input, mechanical stops on control surfaces preventing over-deflection, fuel shutoff systems activating on impact), marine engineering (through-hull fittings with check valves, bilge-pump automatic shutoffs when tank is empty), medical devices (pacemakers reverting to fixed rate and fixed AV delay when sensors fail, infusion pumps defaulting to off if motor control fails, defibrillators locking out on electrical noise), nuclear engineering (passive emergency cooling loops driven by gravity and thermosiphon without pumps, control-rod gravity insertion if power is lost), chemical and process safety (interlocks that prevent dangerous operation sequences, emergency-shutdown systems that default to safe state on power loss, relief-valve systems sized for worst-case relief without active control), building safety (fire doors closing on temperature rise or alarm activation, stairwell pressurization failing open to allow evacuation, emergency lighting on battery backup, panic bars releasing on manual push), software systems (transaction rollback reverting database to consistent state on failure, circuit breakers defaulting to open on sustained errors, caching defaulting to cached value on backend failure, asymmetric cryptography defaulting to deny on authentication-service failure, safe mode loading on corruption detection), financial markets (trading halts and circuit breakers that trigger on extreme price moves, position limits that automatically cap exposure, margin calls and liquidation that execute on account degradation), and cybersecurity (default-deny authorization policies, whitelisting rather than blacklisting, encryption defaulting on, secure-channel negotiation with fallback to failure rather than insecure operation).

clarity: Naming the pattern explicitly distinguishes safe-default design from the broader robustness and reliability commitments, forcing the analytical work: identifying what "safe" means in the specific context (safe for whom, under what hazard), which failure modes route to the safe state by construction, and which require active handling. Without the explicit concept, organizations default to pursuing "reliability" (preventing failures) and treat failures as unforeseen anomalies rather than as predictable events requiring deliberate design. Un-named fail-safe thinking tends to disappear and be reinvented from scratch in each domain. With the concept named and practiced, design reviews are more likely to ask "if this component fails, what is the safe default state, and how is it achieved?" rather than only asking "how can we prevent this from failing?"

manages_complexity: Attempting to design a system that never fails is often impossible, costs excessive, and distracts from the pragmatic task. Fail-safe thinking instead decomposes the problem: (1) identify critical failure modes — which failures are consequences unacceptable (catastrophic), (2) define the safe state for each — what condition minimizes harm, (3) design the mechanism to achieve that state passively — without relying on power, control signals, or the failed component to work correctly, (4) accept that the system will reach safe state when failures occur (not continue normal operation), and (5) manage the system's transition through the failure (restart, repair, diagnosis). This reduces the complexity-management burden from "prevent all failure" to "design safe failure modes + manage recovery," which is more tractable. For complex systems with many components, fail-safe is often applied selectively: critical failures (loss of containment, loss of braking, loss of patient consciousness) trigger fail-safe mechanisms; non-critical failures (secondary features, diagnostics) tolerate repair-in-the-field or deferred maintenance.

abstract_reasoning: The analyst asks: What are the critical failure modes — the component or control failures that, if uncontrolled, would produce catastrophic outcomes? For each critical failure, what is the safe state — what condition minimizes harm? Can the safe state be achieved passively (gravity, springs, mechanical locks, signal loss), or does it require active control (pumps, solenoids, continuous signals)? If active control is required, what mechanisms back up that control if it fails? What is the failure-propagation pathway — if this component fails, does the system naturally drift toward the safe state, or does it drift toward danger, requiring explicit routing to safety? What are the costs of fail-safe design (extra mechanisms, complexity, weight, latency) and how do they compare to the cost of failure? For systems with multiple components, should all failures be routed to safe state, or only critical ones? What is the definition of "safe" in this context — is it the same for all stakeholders (operator, passenger, public, environment)? Mature practice recognizes that fail-safe design is not one-size-fits-all but must be analyzed per context, and that the distinction between fail-safe and fail-secure (which state is truly safe?) requires understanding the specific hazards and constraints.

knowledge_transfer:
| Domain | Critical failure mode | Safe state | Passive mechanism |
| --- | --- | --- | --- |
| Elevator | Loss of braking force | Brakes engaged | Mechanical spring + gravity |
| Train control | Loss of brake command | Brakes applied | Spring load + mechanical detent |
| Pressure vessel | Loss of relief control | Pressure vents | Mechanical spring-loaded valve |
| Aviation autopilot | Loss of signal from autopilot | Autopilot disengages | Electrical disconnect; pilot inputs override |
| Medical infusion | Loss of motor control | Pump stops | Spring-return to off position |
| Fire door | Loss of power or alarm signal | Door closes | Spring hinge + gravity |
| Authentication system | Identity service unavailable | Access denied | Default-deny logic; no bypass |
| Database transaction | Hardware failure mid-transaction | Transaction rolls back | Atomic logging + replay; never half-state |
| Nuclear shutdown | Loss of electrical power | Control rods drop into core | Gravity insertion; no pump required |
| Gas pipeline | Loss of pressure regulation | Flow stops | Check valves; no signal needed |

Across rows: each domain's critical failure mode, the safe state (what should happen when failure occurs), and the passive mechanism that achieves it without requiring the failed component to work. Transfer principle: the pattern is domain-independent; the details (what is safe, how to passively route) are context-specific.

formal_abstract:
Reason's *Human Error* (1990) and Perrow's *Normal Accidents* (1984) both analyze fail-safe design in complex sociotechnical systems, with aviation providing a canonical example. The story of "Gimli Glider" (Air Canada Flight 143, 1983) illustrates fail-safe design success and failure interplay. A Boeing 767 running on metric fuel (liters) was refueled by ground crew using imperial units (pounds), resulting in only half the fuel needed for a transatlantic flight. The crew discovered the error at 41,000 feet with 24 minutes of fuel remaining. The aircraft's primary engines flamed out; the backup systems (hydraulic pumps, electrical generators) lost power. However, the airplane's fail-safe design routed the failure toward recovery: the engine failure triggered automatic gliding descent (passive fail-safe: losing power does not cause uncontrolled pitch-down but rather safe descent toward available airports); the loss of engine-driven generators triggered battery-powered essential systems (fail-safe: critical systems have battery backup); the loss of hydraulic pressure activated ram-air turbine (RAT) — a small fan that deploys in the airstream, turns a generator, and provides minimal hydraulic and electrical power (fail-safe: loss of main power automatically deploys mechanical backup). The crew glided to a former airfield in Gimli, Manitoba, and landed safely with fuel exhausted. Contrast: had the aircraft been designed with active-only systems (relying on engine-driven power with no passive backup), the failure to flame-out would have cascaded: no electrical power = no instruments = no guidance = unrecoverable descent. The fail-safe mechanisms (passive RAT, battery backup, descent gliding) were not designed specifically for this combination of failures but rather designed to ensure that any power-loss scenario routes the aircraft to a survivable state. Leveson's *Engineering a Safer World* (2011) extends the analysis to argue that fail-safe design must be intentional and system-wide, not ad-hoc. The success of fail-safe in aviation has driven adoption across medical devices, nuclear engineering, and process safety as the foundational safety principle<!-- FACT-D34-023 -->[^leveson-2011].

**Mapped back:** This instantiates the signature directly — identification of critical failure (loss of all engines and power, D34-017), definition of safe state (gliding descent toward airport, not uncontrolled drop, D34-017), passive mechanism routing to safety (RAT deployment is mechanical, not power-dependent; battery is passive storage; gravity enables gliding, D34-018), separation of control from safety (engine failure disables active control but triggers passive safety, D34-019), and cost-safety trade-off (the RAT and battery systems cost money and weight but are justified by the catastrophic consequence of power loss, D34-021).

applied_industry:
A pharmaceutical manufacturing facility produces injectable medications in sealed vials. The production line includes a pressurized sterilization chamber (an autoclave operating at 15 psi, 120°C). The chamber has manual and automated shut-off mechanisms. Design challenge: if the pressure relief system fails to open at setpoint, the chamber pressure will rise uncontrolled, potentially rupturing the vessel (catastrophic consequence: explosion, chemical release, injuries). The automated relief system (solenoid-piloted valve) requires electrical signal and pilot pressure to function; if either fails, the active relief fails. The fail-safe solution: install a mechanical pressure relief valve (spring-loaded, pilot-independent) set to open at 16 psi, below the rupture threshold. The mechanical valve requires no electrical signal, no pilot pressure, and no active control — it opens passively as pressure rises and closes as pressure drops. The solenoid valve (automated) can be faster and more precise, but failure of solenoid or signal does not cause catastrophe because the mechanical valve is always present and will open. This is fail-safe design: the critical failure mode (loss of active relief control) is routed to a passive safe state (pressure relief continues to function via mechanical spring). Cost: the mechanical valve is simpler and cheaper than the solenoid, so fail-safe design actually saves money here. Contrast: if the design used only the solenoid valve with no mechanical backup, failure of the solenoid would lead to uncontrolled pressure rise and vessel rupture. Historical analysis: early industrial autoclave failures were precisely this kind of failure; the shift to mechanical relief valves (1920s-1930s) reduced autoclave explosions dramatically. Modern regulations require both active and passive relief systems on pressure vessels, institutionalizing fail-safe design<!-- FACT-D34-024 -->[^lees-2005].

**Mapped back:** Shows fail-safe as contextual design — the safe state is defined (pressure relief below rupture limit, D34-017), achieved passively (spring-loaded valve, no signal needed, D34-018), separate from active control (solenoid and mechanical are independent pathways, D34-019), routing failure to safety (solenoid failure triggers mechanical relief, D34-020), and economically justifiable (mechanical relief is cheaper and simpler anyway, D34-021).

title: Fail-safe versus fail-secure

body:
Fail-safe (safe state on failure) and fail-secure (locked/restricted state on failure) are opposite design choices, and the right choice depends on the context. Fire evacuation requires fail-safe (doors open on power loss to allow escape); security perimeter requires fail-secure (doors lock on power loss to prevent intrusion). The tension arises in systems with mixed hazards: a hospital has both safety (escape routes must remain open) and security (controlled access to restricted areas). The resolution requires explicit hazard analysis per zone, not a universal policy<!-- FACT-D34-026 -->[^hollnagel-2014].

- **T2: Passive safety versus speed and precision.**
  Passive mechanisms (springs, gravity, mechanical detents) are reliable and require no power but are often slow and inflexible. Active control (solenoids, pumps, servo loops) can be fast and precise but requires power and working components. A fail-safe design trades speed and precision for reliability in critical scenarios. A common optimization is hybrid: active control in normal operation (fast, precise) with passive backup on failure (slow, reliable). The tension is in the design and testing complexity — hybrid systems must be tested to ensure both active and passive pathways work correctly<!-- FACT-D34-027 -->[^westinghouse-1872].

- **T3: Universal fail-safe versus selective application.**
  Designing every component to fail-safe is comprehensive but expensive. Selective application (critical failures only) is cost-efficient but requires explicit prioritization of which failures are critical. The tension is in the analysis: missing a critical failure mode (under-selection) can produce catastrophe; over-selecting non-critical failures (over-selection) wastes cost. Mature practice uses structured failure mode and effects analysis (FMEA) to identify critical modes, then applies fail-safe design selectively<!-- FACT-D34-028 -->[^lees-2005].

- **T4: Passive mechanism reliability versus maintenance burden.**
  A passive mechanism (spring, mechanical valve) that sits unused for years may degrade (corrosion, fatigue, setting-drift) and fail to function when needed. Ensuring reliability of dormant passive mechanisms requires periodic testing and maintenance — bench-testing relief valves, actuating deadman switches, validating battery charge. The tension is between never-fail-on-demand (perfect maintenance) and cost of maintenance. Regulatory standards (e.g., ASME for pressure vessels) specify minimum testing intervals<!-- FACT-D34-029 -->[^nureg-1150].

- **T5: Fail-safe definition versus stakeholder disagreement.**
  Different stakeholders may disagree on what constitutes "safe." An elevator operator prefers fail-safe-to-stop (remains stationary if brake fails), minimizing rescue requirements. A passenger in an elevator prefers fail-safe-to-open (doors open if power is lost), minimizing entrapment anxiety. A building manager prefers fail-secure-to-stay-put (elevator remains in place if power is lost, reducing security risk of unattended cars). Resolving this requires explicit stakeholder analysis and often leads to hybrid solutions (doors open, but car remains in place and locked).

- **T6: Detection latency versus default-state safety.**
  Some failures are immediate and obvious (power loss); some are slow and subtle (sensor drift, corrosion, gradual degradation). Immediate failures can route to passive safe state almost instantly (power loss triggers gravity-return valve closure in ~100ms). Slow failures may not be detected before the passive safe state is reached, leaving the system in a potentially degraded mode (a pressure relief valve that slowly drifts off setpoint might reach its limit without operator awareness). The tension is between fail-safe-on-obvious-failure (fast, reliable) and fail-safe-on-subtle-failure (requires active monitoring and detection)<!-- FACT-D34-025 -->[^reason-1990]<!-- FACT-D34-030 -->[^perrow-1984].

prose:
_(Pass B — deferred)_

### Catalog cross-references (v1, batches 02–29)

Solution archetypes that reference this prime (per `solution_archetypes/_catalog/catalog_v1_batches_02_29.yaml`):

**As source prime (1):** `fail_safe_default`

**As related prime (8):** `checkpoint_and_rollback`, `closure_preserving_operation`, `control_surface_creation`, `fault_tolerant_operation`, `guarded_state_transition`, `harmful_emergence_containment`, `invariant_guarding`, `liquidity_reserve`

notes: Fail-safe design origins lie in 19th-century mechanical safety (Elisha Otis's safety catch for elevators, 1853; Westinghouse's air brake with automatic application on air-line rupture, 1872; mechanical pressure relief valves). The formalization as a design principle is due to aviation (Weibull analysis of failure modes, Fault-Tree Analysis developed at Boeing), nuclear engineering (post-Three Mile Island, 1979, passive cooling requirements), and chemical process safety (Lees, 2005, *Loss Prevention in the Process Industries*). Modern applications include cybersecurity (default-deny authorization, circuit breakers), software engineering (transaction rollback, safe mode), and distributed systems (Byzantine fault tolerance, quorum-based consensus). The concept interfaces closely with Robustness (#282) as orthogonal strategies (robustness prevents failure, fail-safe handles failure when prevention fails), with Redundancy (#287) as a complementary approach (redundancy masks failure, fail-safe accepts failure but routes it safely), with Margin of Safety (#283) as a different uncertainty-handling approach, and with Error Proofing (#296) as a complementary human-factors strategy.