# e05 — ablation cell (free verb choice; scoped coverage check + post-conditions run before choosing)

## Verbs run (in order)

1. **match (retrieve).** Anchored the problem to the catalog. Ran `search_by_facets` over five structural facets (irreversibility; rare-catastrophic-in-a-routine-stream; route-only-high-impact-to-review; durable record; no single mistake causes unrecoverable loss) and a meta-model `search_prime`.
   - Load-bearing structural hit: **`irreversibility`** (distinctive, sf=structural, 0.80 pct) and its neighborhood `reversibility_and_irreversibility` / **`reversibility_horizon`** (the economic point-of-no-return where reversal cost overtakes continuation cost).
   - Governance neighborhood: **`checks_balances`** (distinctive) and archetype **`checks_and_balances_architecture`**; on the "scale the control to severity/reversibility" facet the top archetype is **`proportionality_calibration`** (0.72), with `fail_safe_default` and `minimum_effective_intervention` nearby.
   - Recorded source-prime overlap: proportionality (proportionality_calibration), checks_and_balances/separation_of_powers/accountability (checks_and_balances_architecture), irreversibility (irreversible_commitment_management family).

2. **salience-rank.**
   - `irreversibility` — **load_bearing.** The whole problem is the asymmetry between routine (reversible, cheap) and catastrophic (unrecoverable). Remove it and the two approaches look interchangeable.
   - `proportionality` (+ checks/independent-review) — **load_bearing** as the *candidate pattern* Approach B relies on (scale control intensity to severity/reversibility; reserve heavy safeguard for worst cases).
   - `accountability`/`provenance` (durable record) — context: present in B, but not what separates the two on the success criterion.
   - `bounded_rationality`/throughput/attention-dilution — **normally load_bearing for B, but NEUTRALIZED by the ADDITIONAL STIPULATION** (see reconcile). This is the pivot.

3. **prune.** Operative subset: {irreversibility, reversibility_horizon, proportionality_calibration, checks_and_balances_architecture}. Cut flow_state/bystander_effect/risk_pooling (retrieval neighbors, not structurally operative here).

4. **compose (referential integrity check).** Typed model:
   - nodes: `agent` (actor), `action` (kind: routine-reversible | catastrophic-irreversible), `impact_estimator` (B only), `human_reviewer`, `record`.
   - edges: agent →(emits)→ action; action →(classified-by)→ impact_estimator [B]; action →(gated-by)→ human_reviewer [A: all destructive; B: only est-impact>threshold]; action →(logged-in)→ record; reviewer →(annotates: proportionality)→ gate.
   - Post: every edge references declared nodes; every operative prime appears as an annotation (irreversibility on `action.kind`; proportionality on the gate edge; checks_balances on reviewer; accountability on record). PASS.

5. **lift L1 (situation → meta-model).** Domain-stripped skeleton, witnesses in model:
   - Roles: *generator of consequential acts* (witness: agent); *act with a reversibility type* (action.kind); *classifier of severity* (impact_estimator, B only); *independent gate* (human_reviewer); *trail* (record).
   - Invariant to protect: **no single mistaken judgment routes a non-recoverable act past the gate.**
   - Relation: severity-of-act ↔ strength-of-gate. No domain terms remain. PASS.

## SCOPED COVERAGE CHECK (the single operative pattern the chosen approach relies on)

The decision hinges on whether **Approach B's** operative pattern — `proportionality_calibration` (scale the safeguard to severity/reversibility; route only over-threshold acts to independent review) — actually satisfies the invariant **under the stipulation**. I run the coverage map on THAT pattern, because if B's own pattern fails its load-bearing component, the choice is forced.

```
coverage_map:
  pattern: proportionality_calibration  (as instantiated by Approach B)
  components:
    - name: Severity Assessment
      status: missing
      gap_note: B's routing depends on an *estimated* impact. The catalog's
        Severity Assessment must combine magnitude AND reversibility reliably.
        Here the estimator is itself the single fallible judgment: a catastrophic-
        but-misjudged action gets a low severity score and is never routed. The
        component is named but not reliably instantiated for the case that matters.
    - name: Necessity Test
      status: instantiated
      witness: routine reversible acts genuinely need no heavy gate (stipulation
        aside, this is the legitimate core of B).
    - name: Least-Burdensome Effective Response
      status: homolog
      witness: "auto-proceed + record for reversible; review for severe" is the
        least-burdensome menu — BUT "effective" requires the severity input to be
        correct, which loops back to the missing component above.
    - name: Response Scale
      status: instantiated
      witness: two-band scale (auto-proceed-with-log | independent-hold).
    - name: Escalation Threshold
      status: instantiated
      witness: the impact threshold that routes to review.
    - name: Proportionality Review / De-escalation Path
      status: correctly_declined
      decline_reason: post-hoc review/step-down is not what the success criterion
        turns on; over-building it would distort a single-shot gate problem.
    - name: Affected Interest / Burden Assessment
      status: correctly_declined
      decline_reason: single-operator maintenance domain; no multi-party burden map
        is load-bearing here. Declining avoids over-lift.
```

**Result: one component (`Severity Assessment`) is `missing` for the operative case.** Per the lift(L2) post-condition, a design may stop only when no component is missing. Approach B leaves the severity-classification component unmet *precisely on the catastrophic tail* — the only place the invariant can be violated. B's safeguard is exactly as good as its impact estimator, and a single mis-estimate on a catastrophic action defeats "no single mistaken judgment can cause unrecoverable loss."

By contrast, **Approach A** does not rely on `proportionality_calibration` at all — it applies the maximal control (independent human gate) to *every* destructive action, so there is no severity-classification step that can fail. A's operative pattern is a universal pre-execution check (checks_and_balances: dual-approval / maker-checker on every destructive act). Its component set has no `missing` entry: every destructive act has an independent checking actor with veto, and a durable record can still be attached.

## reconcile (concrete model vs meta-model) — the stipulation pivot

- **Concrete reading:** In the real world, A's "approve EVERY destructive action" trips the `checks_and_balances` anti-signature *Low-stakes single-owner work* and the proportionality symptom *one-size-fits-all*: universal human approval throttles routine maintenance, so A would normally fail "no meaningful slowdown" and B wins.
- **Meta-model reading under the ADDITIONAL STIPULATION:** human review is unlimited, instantaneous, no backlog, no attention dilution. This *removes* the cost/throughput term that is the entire basis for routing only a subset to review. The "no meaningful slowdown" criterion is now satisfied by A as well as B (A adds zero delay by stipulation). The two views diverge — and the divergence is decisive, not decorative: the stipulation deletes B's only advantage while leaving A's universal coverage of the irreversible tail intact.
- Resolution preferring the reading consistent with both: once slowdown is free, the comparison reduces purely to the safety invariant, and A covers the catastrophic tail without a fallible classifier. A wins.

## evaluate-fit (anti-signatures of the CHOSEN approach, A's pattern = checks_and_balances_architecture / universal gate)

- *Low-stakes single-owner work* — **normally tripped** (heavy process on reversible acts) → **NOT tripped under stipulation**: the heavy process is costless, so the "needs only clarity+audit" objection evaporates. Reason recorded.
- *Gridlock by veto / constraint-vs-speed tradeoff* — **NOT tripped**: stipulation gives instantaneous approval, no backlog, no paralysis.
- *Pure coordination / only-participation-missing* — not tripped; this is a unilateral-irreversible-action problem, squarely the checks pattern.
- Verdict: keep A. No disqualifying anti-signature survives the stipulation.

(For completeness, B's anti-signature that bites: *artifact-only / mechanical severity input* — B's proportionality rests on an estimator that is the single point of failure on the catastrophic tail; the `missing` Severity Assessment component is the formal version of this.)

## Post-conditions check before STOP
- compose referential integrity: PASS. lift(L1) witness-check: PASS. lift(L2) coverage map: shown, B has a `missing` component on the operative case; A has none. evaluate-fit: each anti-signature explicitly evaluated. Decision is sound → STOP.

===DECISION_BEGIN===
DECISIVE_FACTOR: Once review is unlimited and instantaneous (so it adds no slowdown), the only thing separating the two designs is whether any single mistaken judgment can let an unrecoverable action through — and routing-by-estimated-impact makes the impact estimate itself that single fallible judgment, whereas checking every destructive action has no such gap.
CHOICE: A
JUSTIFICATION: Because review here costs nothing and causes no delay, requiring approval of every destructive action no longer slows routine work, so both designs meet the speed requirement and the choice turns entirely on safety. Routing only "high-impact" actions to review depends on an impact estimate, and a single wrong estimate on a truly catastrophic action would let it execute unchecked — exactly the unrecoverable mistake to be prevented. Approving every destructive action removes that classification step, so no single misjudgment can slip an irreversible action past a human. Therefore the universal-approval design is strictly safer at no cost under these conditions.
===DECISION_END===
