# Control-policy run — FC2 (condition C)

Acting as the CONTROL POLICY. Verbs run in the order judged sound; the mandated
pre-finalization steps (compose → lift L1 → scoped coverage check → evaluate-fit
anti-signatures) are all present, with the coverage map shown in full.

## history (verbs run)

1. **match (retrieve).** Anchored the problem to the catalog via facet
   decomposition (oblique, multi-structure) plus a semantic meta-model query.
   - Facets posed: irreversible/unrecoverable subset; routine-reversible bulk;
     single mistaken judgment must not cause catastrophe; scarce review capacity
     to allocate; approve-everything → fatigue/rubber-stamp; graduated response
     to harm magnitude.
   - Candidate primes (load-bearing): `irreversibility` (distinctive, structural),
     `reversibility_and_irreversibility`, `fail_safe` (distinctive). Context
     primes surfaced by the "approve everything" facet: `decision_fatigue`,
     `responsibility_diffusion` (rubber-stamping signature).
   - Candidate archetypes: `irreversible_commitment_management` (top fused on the
     irreversibility facet), `proportional_response_design` (0.745 — top on the
     graduated-response facet), `fail_safe_default`, `capacity_reservation`
     (scarce-review facet). Source-prime overlap recorded for each.

2. **salience-rank.** 
   - load_bearing: `irreversibility` (the ONLY property that makes the small
     fraction special — removing it collapses both approaches to "just automate");
     `irreversible_commitment_management` (supplies the gate-before-threshold +
     scope-of-authority logic); `fail_safe` T3 (selective vs universal
     application is the whole A-vs-B fork); `proportional_response_design`
     (scrutiny scaled to harm magnitude).
   - context: `decision_fatigue` / `responsibility_diffusion` (explain WHY
     universal approval degrades, but the decision stands even without them —
     they reinforce, not determine).

3. **prune.** Cut `capacity_reservation`, `cascade`, `threshold_and_criticality`,
   `circuit_breaker` — real neighbors but not load-bearing for the A/B choice;
   the fork is decided by irreversibility-scope + selective-vs-universal, which
   the retained four already carry.

4. **compose (referential integrity).** Typed relational `model`:
   - nodes: `agent` (kind: actor), `action` (kind: event), `impact_estimate`
     (kind: signal), `reviewer` (kind: actor), `record` (kind: artifact),
     `prior_state` (kind: state).
   - edges:
     - agent →(emits)→ action
     - action →(carries) `prior_state`→ post-state, annotated
       `irreversibility` (only on the catastrophic subset)
     - impact_estimate →(classifies)→ action  [routine | high-impact]
     - high-impact action →(routed_to)→ reviewer  [hold]  annotated
       `irreversible_commitment_management.consent_or_review_gate`
     - routine action →(proceeds)→ post-state, annotated `record` (durable log)
     - reviewer →(authorizes|blocks)→ action
   - Check: every edge references declared nodes; every load-bearing prime
     appears as an annotation. PASS.

5. **lift — L1 (situation → meta_model).** Domain terms stripped:
   - roles: ACTOR-that-acts-at-volume; CLASSIFIER (cheap, imperfect magnitude
     signal); GATE/REVIEWER (scarce, slow, high-quality); LEDGER (durable record).
   - relations: most acts are low-magnitude + restorable; a small subset is
     high-magnitude + non-restorable; a single misjudgment on the subset is
     terminal; the gate's quality degrades as its load rises.
   - invariants: (I1) no single mistaken judgment can cause unrecoverable loss;
     (I2) restorable throughput is not meaningfully slowed.
   - Witness-check: every role/relation traces to a node/edge in `model`
     (ACTOR=agent, CLASSIFIER=impact_estimate, GATE=reviewer, LEDGER=record;
     subset=irreversibility-annotated edge). No domain terms remain. PASS.

6. **transport / lower.** The operative pattern in hand is the
   **selective finality-gate** (irreversible_commitment_management instantiated
   under the fail_safe T3 "selective application" discipline + proportional
   response). It is a structural pattern → direct recognitional mapping:
   pattern-role "point-of-no-return marker" ↔ impact_estimate exceeding the
   irreversibility threshold; "gate before threshold" ↔ route-to-hold;
   "bounded exposure / ordinary path for reversible" ↔ auto-proceed + log.

7. **lift — L2 SCOPED COVERAGE CHECK** on the single operative pattern Approach B
   relies on: **selective irreversible-commitment gate** (the
   `irreversible_commitment_management` component set, scoped to this design).
   None left `missing`; over-build marked `correctly_declined`.

### coverage_map (pattern = selective irreversible-commitment gate)

| # | component | status | witness / reason |
|---|-----------|--------|------------------|
| 1 | Irreversibility Check | instantiated | impact_estimate classifies each action restorable vs not; gate keys off non-restorability, not raw activity |
| 2 | Consequence Scope | instantiated | "permanently delete data / retire services" → scope = downstream data + dependents; mapped before commit |
| 3 | Point-of-No-Return Marker | instantiated | the impact threshold IS the marker; crossing it routes to hold |
| 4 | Consent or Review Gate | instantiated | independent review/hold on the high-impact subset (B's core) |
| 5 | Staged Commitment Path | homolog | "let routine reversible actions proceed automatically" = the divisible low-exposure path; full set need not be staged because reversible acts carry no residue |
| 6 | Simulation / Pilot Probe | correctly_declined | maintenance acts execute against live state; a pilot cohort does not reduce residue of a *catastrophic* act — the gate, not a probe, is the right control here. Over-lift guard: posing a sandbox requirement would distort a sub-structure (routine ops) handled naturally |
| 7 | Exposure Limit | instantiated | the threshold caps how much irreversible blast-radius can execute un-reviewed (effectively zero above threshold) |
| 8 | Compensation Rule | correctly_declined | success criterion is *prevention* of unrecoverable loss, not post-hoc restitution; compensation cannot restore deleted data, so it is not the operative control — would over-build |
| 9 | Finality Record | instantiated | "durable record of all of them" (and of held/authorized actions) |
| 10 | Cooling-Off Period | homolog | the hold on routed actions supplies deliberation time before the irreversible commit |
| 11 | Independent Review Panel | instantiated | "independent review/hold" — independence is explicit, satisfying authority_must_fit_affected_scope |
| 12 | Impact Monitoring Signal | instantiated | impact_estimate is the monitored signal driving routing |
| 13 | Rollback Residue Assessment | instantiated | the restorable/non-restorable split IS a residue assessment per action |

No component `missing` → the chosen design (B) may STOP. Two components
`correctly_declined` under the over-lift guard (simulation, compensation):
both would over-build for a *prevention* objective without closing any gap.

### Why the SAME coverage check fails Approach A
Run L2 against A and its operative pattern is "universal approval gate." Against
the meta-model it inverts component #1 (Irreversibility Check): A applies the gate
to ALL actions, i.e. it *declines to discriminate* restorable from non-restorable.
That is precisely `irreversible_commitment_management`'s **anti-signature
`ordinary_reversible_change`** ("if the prior state can be restored with low
residue, ordinary change control is enough") and **`fail_safe` T3 over-selection**
(applying fail-safe treatment to everything wastes cost — here, throughput and
reviewer attention). Component #5/#7 (staged path / exposure limit) become
degenerate: A has no low-exposure lane, so it cannot satisfy invariant I2.

8. **evaluate-fit (gate) — anti-signatures of the chosen approach (B / selective
   finality-gate via irreversible_commitment_management).**
   - `ordinary_reversible_change` — tripped? NO. B explicitly routes ONLY
     non-restorable/high-impact acts to the gate; reversible acts use ordinary
     change control (auto-proceed + log). Correct fit.
   - `generic_approval_without_finality` — NO. The gate is keyed to finality
     (irreversibility threshold), not to generic authorization.
   - `rubber_stamp_gate` (failure mode) — NO, and actively avoided: by keeping
     gate volume low, B preserves reviewer attention quality. A *trips* this —
     universal approval drives `decision_fatigue` / `responsibility_diffusion`,
     degrading the very judgment I1 depends on (the auditor's "feels safer" is
     the rubber-stamp illusion).
   - `late review` — NO. Gate sits BEFORE the point of no return
     (gate_before_not_after_threshold satisfied).
   - `paralysis_by_irreversibility` — NO. B does not block all change; it
     compares irreversible-action risk against inaction/slowdown and lets routine
     work flow. A risks this failure mode (throttles everything).
   Verdict: keep B; drop A (A trips `ordinary_reversible_change` + over-selection
   and induces the rubber-stamp failure mode that undermines I1).

9. **reconcile (model vs meta_model).** Concrete model: A forces a human onto
   every routine reversible delete — high volume, attention thins, the rare
   catastrophic act gets the same fatigued glance as the 1000th harmless one, so
   I1 is *weakened* exactly where it matters, and I2 fails outright. Meta-model:
   universal gating raises GATE load → quality(GATE) falls → P(catch the terminal
   case) falls, while reversible throughput stalls. Both readings agree: the
   protection A "feels" like it adds is partly illusory (volume erodes it) and its
   cost is real. B concentrates scarce high-quality review on the only acts where
   a single misjudgment is terminal, and lets reversible acts proceed (errors
   there are recoverable via the durable record). Views do not collapse; they
   converge on B. The meta-model is load-bearing (it explains the
   quality-degradation that the concrete view alone could rationalize away).

## Decision

Both criteria bind: (I1) no single mistaken judgment causes unrecoverable loss
AND (I2) routine reversible maintenance is not meaningfully slowed. Approach A
satisfies neither robustly — it slows everything (fails I2) and, by spreading
scarce human review across overwhelmingly harmless actions, it dilutes attention
on the rare catastrophic action, weakening I1 through fatigue/rubber-stamping.
Approach B routes only the small irreversible-impact subset to independent
review (directly securing I1 where loss is unrecoverable) while reversible
actions proceed automatically with a durable record (securing I2; their errors
are recoverable). The auditor's "feels safer / easier to write down" is a
legibility preference, not a safety gain — and it buys a real throughput cost
plus an attention-dilution risk.

===DECISION_BEGIN===
DECISIVE_FACTOR: Only a small subset of actions is unrecoverable, so concentrated review must be reserved for exactly those, because spreading mandatory approval across the overwhelmingly reversible majority both stalls routine work and dilutes the scrutiny the rare catastrophic action depends on.
CHOICE: B
JUSTIFICATION: Only a small fraction of actions can cause permanent, unrecoverable loss; those are the only ones that truly need a human or independent hold before they run. Forcing approval on every action slows all the routine, reversible work and, worse, buries the few dangerous actions among thousands of harmless ones, so the reviewer's attention thins and the real catastrophe is more likely to be waved through. Sending only high-impact actions to independent review keeps full scrutiny where a single mistake is irreversible, while letting reversible actions proceed automatically with a durable record means any error there can simply be undone. That meets both goals at once: no single misjudgment can cause unrecoverable loss, and ordinary maintenance is not held up.
===DECISION_END===
