# B-prime control run — b01

## STATE / WORKING (discarded before grading)

**problem.** An always-on maintenance agent acts across a large fleet. Most actions are routine and reversible; a rare fraction are catastrophic and unrecoverable (deleting the last copy, retiring a silently-depended-on service). Today it judges and acts in one motion, with no external check at the moment of action and no durable record of why. Operators can change the agent's reasoning, its pre-action obligations, and the surrounding components. Design so that no single mistaken judgment causes unrecoverable loss, without slowing routine maintenance.

**meta_model.** An autonomous actor takes irreversible, high-consequence actions on its own judgment, fused decide-and-act, no independent review before effect, no durable account — and the dangerous cases are rare needles inside a haystack of harmless ones. Need a gate that bites only on the irreversible tail while the reversible bulk flows freely.

### history (verb + one-line why)

- **lift** — strip the domain to the meta-model above so retrieval lands on structure, not "storage cleanup." Why: cross-domain recall.
- **match (search_by_facets)** — oblique, multi-structure problem; decomposed into 5 facets (irreversibility, no-independent-review, rare-tail-in-routine, no durable account, decide/act fused). Why: a blended query would bury the governance facet. Facet retrieval surfaced the spine cleanly.
- **match (search_prime, blended)** — sanity check; confirmed the blended vector drifts to incentive/self-control and is weaker — vindicates the facet split.
- **salience-rank** — load-bearing: irreversibility / reversibility_horizon (core), and archetypes irreversible_commitment_management (spine), tiered_escalation (keep routine fast), independent_verification_oversight (external check before effect). Supporting tail hits: fail_safe_default, idempotent_operation_design, compensating_transaction, option_preservation, tail_risk_preservation, finality_record/audit.
- **get_archetype ×3** — pulled irreversible_commitment_management, tiered_escalation, independent_verification_oversight in full. Why: these three compose the whole answer.
- **get_prime** — reversibility_horizon. Why: gives the "economic, not physical, point of no return" lever — many "irreversible" deletes are reversible if you insert a horizon (soft-delete window).
- **prune** — dropped self_control, incentive_compatibility, herding, great_man, proportionality-as-prime (operator drift / not load-bearing). Kept the irreversibility spine + escalation + independent-verification + restore-reversibility.
- **compose** — relational model: AGENT --classifies--> ACTION; reversible ACTIONs --flow--> EXECUTE; destructive ACTIONs --route--> GATE(independent checker) --before--> POINT-OF-NO-RETURN; every destructive ACTION --writes--> FINALITY-RECORD; deletes --pass-through--> QUARANTINE (restore window) before hard reclaim.
- **evaluate-fit (gate)** — checked anti-signatures: "rubber-stamp gate," "late review" (gate after threshold = mere documentation), "paralysis by irreversibility," "over-escalation." Design must put the gate *before* the threshold, scope it to the tail only, and convert most deletes to reversible-by-construction so the gate fires rarely. All tripwires addressed in the rec.
- **reconcile** — independent_verification_oversight requires the checker be genuinely separate (not the same reasoning that proposed the act) and have authority to block; mapped that onto "a second, differently-built component." tiered_escalation supplies the lowest-competent-level default so routine never touches the gate.
- **lower** — instantiate into fleet/storage/service terms; STOP — recommendation is sound.

**COST: ~7 operations, ~22k tokens.**

===RECOMMENDATION_BEGIN===
Split every action the agent contemplates into two streams the moment before it would act, and treat the two streams completely differently.

**Classify by recoverability, not by confidence.** The agent must, for each action, answer one mechanical question: *if this is wrong, can the prior state be fully restored cheaply?* An action is "routine" only if a yes is well-supported — the data has another copy, the change has a working undo, the service has no live dependents. Anything that deletes a last copy, reclaims storage that cannot be refilled, or tears down a service is "destructive" by default. Crucially, uncertainty counts as destructive: if the agent cannot establish that something is recoverable or unused, it is treated as if it were not. This keeps the dangerous tail from hiding inside the routine bulk, which is where catastrophe lives.

**Let the routine stream run at full speed.** The vast majority of actions classify as recoverable and execute immediately with no extra ceremony, exactly as today. The safeguards below must never touch this path, or ordinary cleanup stalls and operators will route around the whole scheme. Speed on the common case is a hard requirement, not a nicety.

**Make most "destructive" actions reversible by construction, so the heavy gate rarely fires.** Before any permanent deletion or reclamation, route the target through a recovery window: deleted data goes to a quarantine/tombstone area and storage is not actually reclaimed until a hold period (sized to how fast a wrongful deletion would be noticed — hours for hot systems, days for cold) elapses with no objection. A service marked for retirement is first disabled in a reversible way (stopped, traffic-blocked, but not destroyed) and only physically dismantled after the window. This converts an irreversible act into a delayed, recoverable one for the common destructive case, draining most of the risk without a human or a slow review in the loop. Reclamation at the end of a clean window is itself routine.

**For the genuinely irreversible residue, require an independent check before the point of no return — never after.** When an action cannot be made recoverable (the only copy and no safe quarantine, or a teardown that the recovery window cannot protect), the agent may not decide and act in one motion. It must hand the proposed action, plus its evidence, to a separate checker that did not produce the proposal and does not share its reasoning path — a distinct component (or a held-out second model, or for the highest-blast-radius actions a human) whose only job is to try to *falsify* the safety claim: search for other copies, probe for silent dependents, confirm the recovery window genuinely does not apply. The checker has authority to block or downgrade. The gate must sit *before* the irreversible step; a check that runs after the data is gone is only a record of damage. To avoid rubber-stamping, the checker must do active work (dependency probing, copy-existence search), not just approve.

**Scale the burden to the blast radius, and cap exposure.** Use a small ladder rather than one heavy gate: a single low-value object with a recovery window needs nothing beyond the window; a destructive action with no recovery path needs the independent checker; an action that would affect many systems, a whole storage tier, or a service with unknown dependents needs the strongest check (independent component plus human authorization) and must be staged — act on a small slice, observe for breakage, then widen — so that one mistaken judgment can never reach the whole fleet at once. No single destructive batch may exceed a defined fraction of any resource before evidence of safety accrues.

**Keep a durable account of every destructive action.** Before each irreversible step (and each quarantine and each reclamation), the agent writes an append-only record: what was acted on, the recoverability judgment and its evidence, who or what authorized it, the recovery-window terms, and the assumptions made. This record is the standing memory the system currently lacks; it makes wrongful actions detectable during the recovery window, supports restoration, and lets operators tune the classifier when it misjudges.

**Final operating rule.** *Act immediately on anything you can prove is cheaply recoverable. For everything else, first make it recoverable through a hold-and-quarantine window; if you cannot, do not act alone — hand it to an independent checker before the irreversible step, scale the scrutiny and stage the rollout to the blast radius, and write down what you did and why. When in doubt, treat it as unrecoverable.* This guarantees that no single mistaken judgment crosses an irreversible threshold unchecked, while the recoverable bulk — nearly all maintenance — never slows.
===RECOMMENDATION_END===
