# C10 — free-choice control policy working

## PROBLEM (state)
- statement: An autonomous maintenance agent decides-and-acts in one motion across a large fleet. Most actions are routine/reversible; a rare fraction are destructive and unrecoverable (deleting last copy, tearing down a silently-depended-on service). No outside check at the moment of action; no durable account of why. Operators control how it reasons, what it must do before acting, and what surrounding components exist.
- decision: design handling of rare destructive/unrecoverable actions so no single mistaken judgment causes unrecoverable loss, without slowing routine maintenance.
- success: (a) no single bad call → unrecoverable loss; (b) routine reversible work proceeds without meaningful slowdown.
- failure: a single bad call can still destroy something irreplaceable, OR safeguards stall ordinary cleanup.

## VERBS RUN (verb + why)
1. **match (retrieve)** — anchored the problem with a domain-stripped meta-model query (`search_prime`) + a 5-facet decomposition (`search_by_facets`). Chose facets because the problem is OBLIQUE: it instantiates ≥4 structures at once (irreversibility, same-actor-judges-and-acts, no-record, rare-catastrophic, don't-slow-common-case). Why facets: a blended query lands in the "reversibility/decision" neighborhood and buries the *governance* core.
2. **match (again, sharper facets) + search_archetype** — second facet pass aimed squarely at the latent governance structures (independent review before irreversible step, decider≠executor, reversible holding state, route-only-the-rare, keep-a-copy). This surfaced the load-bearing archetypes.
3. **salience-rank + prune** — ranked retrieved primes by load-bearing relevance; pruned to the operative subset.
4. **transport + get_archetype ×3** — pulled the three load-bearing archetypes in full to harvest their components for coverage.
5. **lift (L2) — coverage-enforcement** — the central verb; ran the coverage map over the composed design.
6. **evaluate-fit (gate)** — walked the central archetype's anti-signatures against the situation.
7. Chose to STOP. **Coverage check: YES** (L2 ran; no component left `missing`).

## RETRIEVAL RESULT (candidates → operative primes)
Load-bearing structural core (removing it changes the recommendation):
- `irreversibility` / `reversibility_and_irreversibility` — the asymmetry that makes a rare fraction qualitatively different. **load_bearing, structural.**
- `separation_of_powers` / `checks_balances` — decider must not be sole executor of the final act. **load_bearing.**
- `threshold` / `boundary` — the point-of-no-return marker dividing reversible from final. **load_bearing, structural.**
- `accountability` / `traceability` / `provenance` — the missing durable account. **load_bearing.**
Operative frame/mechanism primes:
- `consent`/`validation` (independent review gate), `staged_commitment`, `containment`/`fail_safe`, `resilience` (recoverable copy). **context→load_bearing.**
Pruned as not-fitting: `virtue_ethics`, `herding_behavior`, `present_bias` (psychological/self-control frames — the problem is *external* consequence governance, not binding one's own future self), `taboo`, `symmetry`, `iteration`.

## ARCHETYPES (transport)
- **irreversible_commitment_management** (primary; score 0.77). Components harvested: irreversibility check, consequence scope, point-of-no-return marker, consent/review gate, staged commitment path, simulation/pilot probe, exposure limit, compensation rule, finality record, cooling-off, independent review, impact monitoring, rollback-residue assessment.
- **tiered_escalation** (carries "don't slow the common case"): lowest-competent-level rule, classification signal, escalation criteria, authority boundary, fast-track/override, return path.
- **independent_verification_oversight** (carries decider≠verifier): independent verifier, conflict barrier, evidence access, acceptance criteria, challenge authority, traceable finding record.

## LIFT (L1) meta-model
- Roles: actor-that-judges; actor-that-authorizes-finality (must be independent); the irreversible operation; the recoverable shadow; the record.
- Invariant: no path from a single actor's judgment to an unrecoverable state. Reversible majority must bypass all heavy machinery.

## LIFT (L2) coverage map (status / witness / decline-reason / gap-note)
- Irreversibility check → **instantiated**: classifier on every action ("does undo restore the prior state with low residue?").
- Point-of-no-return marker / threshold → **instantiated**: the reversible/destructive split is the routing key.
- Tiered routing (lowest-competent-level) → **instantiated**: reversible actions auto-execute; only the rare destructive class is gated. (Directly discharges success-criterion b.)
- Consent/review gate BEFORE threshold → **instantiated**: second-actor authorization required for destructive class.
- Independent verifier (decider≠executor) → **instantiated**: the authorizer is a separate component the agent cannot speak for. (Discharges success-criterion a.)
- Staged commitment / exposure limit → **instantiated**: soft-delete / quarantine / tombstone; blast-radius cap per window.
- Recoverable shadow + cooling-off → **instantiated**: deferred reclaim after a retention/quiet-observation window; the copy is the no-single-loss guarantee.
- Dependency / consequence-scope check → **instantiated**: pre-teardown reference/traffic probe for silent dependents.
- Finality record / traceability → **instantiated**: durable signed log of what, why, on whose authority. (Closes the "no account" gap.)
- Impact monitoring → **instantiated**: post-action watch during the window; auto-halt the batch on anomaly.
- Compensation rule → **correctly_declined**: data/services either restore from the shadow or don't; no separate restitution layer needed (over-lift guard — declining a frame that would distort a clean technical sub-structure).
- Simulation/pilot probe → **homolog**: the quiet-observation window IS the low-exposure probe; not a separate sandbox.
- **No component `missing`** → STOP permitted.

## EVALUATE-FIT (gate)
Anti-signatures of irreversible_commitment_management walked: "ordinary reversible change" — does NOT trip the destructive class (it trips the routine class, which is exactly why we route them apart); "generic approval without finality" — not tripped, gate sits before true finality; "failure-response-after-event" — not tripped, gate is pre-commitment; "psychological precommitment only" — not tripped (external consequences). Verdict: **keep.** The fast-track override is gated so it cannot become a rubber-stamp (independent authorizer, not the agent).

## RECONCILE
Concrete model (delete last copy / tear down depended-on service) and meta-model (no single-judgment path to unrecoverable state) agree on the two-class split + independent gate, but diverge on cost: the meta-model would gate everything; the concrete model says reversible actions vastly dominate and must not slow. Resolved by routing — heavy machinery only on the destructive class — which satisfies both readings.

COST: ~8 operations, ~14k tokens

===RECOMMENDATION_BEGIN===
Split every action the agent contemplates into two classes by a single test applied the instant before it would act: would undoing this action fully restore the prior state quickly and cheaply? If yes, the action is ordinary and the agent executes it immediately, exactly as today — no extra approval, no delay. The overwhelming majority of maintenance falls here, so routine cleanup keeps its full speed. Only actions that fail this test — permanently deleting data, retiring a service, reclaiming storage that cannot be repopulated — enter the protected path. The classifier must default to "treat as destructive" whenever it is unsure, because the cost of misrouting a destructive action is catastrophic while misrouting a routine one merely adds a little latency to one task.

The protected path rests on three structural guarantees, each of which independently blocks a single mistaken judgment from causing unrecoverable loss.

First, no destruction is ever immediate. A destructive action is converted into a reversible holding step plus a deferred commit. Deleting data first moves it to a tombstoned, recoverable state (soft-delete, snapshot, or quarantine) with the space not yet reclaimed; retiring a service first disables it in a restorable way (drain, disable, mark-for-removal) rather than tearing it down. Reclamation — the truly irreversible step — happens only after a holding window elapses (for example, days for data, hours-to-days for services, tuned per asset class). During the window the action is fully reversible, so any later signal can abort it.

Second, the agent may decide but may not authorize its own irreversible step. Crossing from the holding state to actual reclamation requires sign-off from a separate authorizing component that the agent cannot impersonate or overrule. For lower-stakes destructive actions this authorizer can be an automated second checker that re-derives the safety judgment from independent evidence (not by trusting the agent's own reasoning); for the highest-stakes actions — anything detected as the last remaining copy, or a service with live or recent dependents — it requires a human approval or a quorum the agent cannot satisfy alone. Because judgment and final authority are held by different parties, a single bad call by the agent cannot reach the point of no return.

Third, before any destructive action is even proposed, the agent must run a consequence-scope check and find no blocker. For data, confirm at least one other durable copy exists, or else escalate. For services, actively probe for silent dependents — recent traffic, open references, configuration links — and treat any sign of dependency as a hard stop pending review. This converts "the agent silently assumed nothing needed it" into an explicit, evidence-backed check.

Surround these with two supports. Keep a recoverable shadow: the holding state itself is the safety copy, and the reclaim step is what makes loss possible, so reclamation is the one operation that is rate-limited, batched, and watched. Cap how much can be irreversibly reclaimed in any window (a blast-radius limit), and during each holding window monitor for anomalies — spikes in deletions, errors from systems that just lost a dependency, alarms — and automatically pause all pending reclamations on any such signal so one faulty assumption cannot cascade across the fleet.

Make every destructive decision durably accountable. Before the holding step, the agent writes an append-only, tamper-evident record: what it intends to destroy, why it judged it safe, what evidence the scope check produced, which authority approved the reclaim, and when the window closes. This record is written before action, not after, so it is a prevention and audit instrument rather than a post-mortem. Reversible routine actions need no such record, keeping the log lightweight.

Tune the system so the safeguards stay proportional. The holding window, the strength of required authorization, and the depth of the dependency probe all scale with how irreversible and how wide-reaching the action is: a small, clearly-redundant deletion clears the automated checker quickly, while destroying a sole copy or a shared service demands the strongest gate. An explicit fast-track exists for genuine emergencies (for example, actively harmful data that must go now), but the fast-track still routes through the independent authorizer — it shortens the window, it never removes the second pair of eyes. This keeps the gate from degrading into a rubber stamp.

Final operating rule: the agent may freely and immediately perform any action it can fully undo; it may never, by its own judgment alone, perform an action it cannot undo. Every irreversible action must first pass through a reversible holding state, survive a waiting window during which a separate authority can stop it and a dependency check has found no silent dependents, and leave behind a durable record of why it was taken — and only the rare destructive minority ever touches this machinery, so ordinary maintenance never slows.
===RECOMMENDATION_END===
