## Working (control-policy trace)

### problem (STATE.problem)
- statement: An autonomous maintenance agent decides-and-acts in one motion across a large fleet. Most actions are routine/reversible; a rare fraction are catastrophic and unrecoverable (deleting the last copy; tearing down a silently-depended-on service). No independent check at the moment of action; no durable account of why a destructive action was taken. Operators can change the agent's reasoning, its pre-action obligations, and surrounding components.
- success: no single mistaken judgment can cause unrecoverable loss AND routine reversible work is not meaningfully slowed.
- failure: a single bad call can still destroy something irreplaceable, OR safeguards stall ordinary cleanup.

### verbs run (in order, with why)

**1. match (facet retrieval).** The problem is oblique — it instantiates several structures at once (irreversibility, missing pre-act review, rare-tail risk, absent record, routine-throughput constraint). Ran `search_by_facets` over six domain-stripped facets. Surfaced the structural core cleanly: `reversibility_and_irreversibility`, `controlled_reentry`, `reversibility_horizon`, `black_swan`, `error_proofing_poka_yoke`, `fail_safe`, `accountability`, `provenance`. The blended `search_prime` query drifted into psychology (self_control, attribution) — confirming the facet path was the right tool.

**2. match (governance facet, repeat).** The "no independent check before the act" facet retrieves poorly under a blended query (the known latent-prime problem). A targeted five-facet governance query surfaced exactly the buried primes: `procedural_fairness_due_process`, `checks_balances`, `authority_delegation_under_uncertainty`, `consent`, `local_autonomy_tiered_escalation`, plus `accountability`/`provenance`/`narrative_construction` for the record facet.

**3. salience-rank + prune (operative_primes).** Load-bearing:
   - `irreversibility` / `reversibility_horizon` — the whole problem is the irreversible tail; defines *which* actions get heavy treatment. LOAD-BEARING.
   - `checks_balances` / `independent_verification_oversight` — the unilateral-act defect; a second, separated judgment before finality. LOAD-BEARING.
   - `local_autonomy_tiered_escalation` — keeps routine fast (resolve at lowest competent level; escalate only on the trigger). LOAD-BEARING (the throughput constraint).
   - `error_proofing_poka_yoke` / `fail_safe` — make the wrong destructive act hard/blocked by default. LOAD-BEARING.
   - `accountability` / `provenance` — the durable finality record. LOAD-BEARING.
   - Context-only (pruned): `consent` (no human affected-party in the loop to consent in the legal sense — homolog only), `black_swan` (frames the rare-tail rationale, not a mechanism), `controlled_reentry` (reverse direction — about resuming, not gating finality).

**4. match (archetype).** `search_archetype` returned a near-perfect stack: `irreversible_commitment_management` (0.72, the master), `checks_and_balances_architecture` (0.72), `independent_verification_oversight` (0.67), `accountability_chain_design` (0.66), `physical_constraint_design_for_impossibility` (0.66). Pulled full records for the master + independent-verification.

**5. compose (model).** Nodes: agent (proposer), classifier (irreversibility/blast-radius check), gate (independent confirmer), execution path, quarantine store, ledger, escalation tier (operator/secondary authority). Edges: agent→classifier (route by reversibility); classifier→{fast-path | gate}; gate→{execute | quarantine | escalate}; every destructive act→ledger. Every operative prime appears as an annotation (poka-yoke on classifier+execution; checks_balances on gate; tiered_escalation on routing; provenance on ledger; reversibility_horizon on classifier thresholds). Referential integrity holds.

**6. lift L1 (meta_model).** Roles: actor-that-judges-and-acts; an act with a finality property; a separator that splits "propose" from "confirm"; a recoverability buffer; a record of why. Invariant: no single judgment is sufficient to cross a finality threshold. All roles have witnesses in the model.

**7. lift L2 (coverage check — I chose to run this).** Checked the design against `irreversible_commitment_management`'s components, with the over-lift guard for this fully-automated substrate:
   - Irreversibility Check → INSTANTIATED (classifier: is the act recoverable within a retention window?).
   - Consequence/Blast-radius Scope → INSTANTIATED (dependency probe: does anything still reference this?).
   - Point-of-No-Return Marker → INSTANTIATED (the destructive op is the marker; gate sits before it).
   - Consent or Review Gate → HOMOLOG (no human affected-party consents in real time; discharged by an *independent confirmer* — a separate checker, not the agent — = `checks_balances` + `independent_verification_oversight`).
   - Staged Commitment / Exposure Limit → INSTANTIATED (rate-cap + quotas per destructive class).
   - Simulation/Pilot Probe → INSTANTIATED (dry-run dependency check + shadow mode).
   - Compensation Rule → PARTIALLY DECLINED → re-cast as *recoverability buffer* (soft-delete/quarantine + retention) — in a data system, prevention-by-recoverability dominates restitution; pure compensation is correctly_declined (no analog).
   - Finality Record → INSTANTIATED (append-only ledger: who/what/why/authority/evidence) = `accountability`/`provenance`.
   - Cooling-Off Period → INSTANTIATED as the retention/tombstone window.
   - Independent Review Panel → HOMOLOG (the gate / secondary authority; for the highest tier, a human).
   - Impact Monitoring Signal → INSTANTIATED (post-act anomaly watch + auto-halt).
   No component is `missing`. The two genuinely-inapplicable items (real-time human consent; monetary compensation) are declined with reasons, not forced.

**8. evaluate-fit (gate).** Walked the master's anti-signatures. "Ordinary reversible change" — correctly excluded (that's the fast path, by design). "Generic approval without finality" — not tripped (gate fires only on the finality class). "Paralysis by irreversibility" — actively guarded against by the recoverability default + tiered routing (the failure criterion). Candidate kept.

I judge the recommendation sound and complete: every load-bearing structure has a concrete mechanism, no component is missing, and both halves of the success criterion (no single-point catastrophe; routine speed preserved) are discharged. STOP.

===RECOMMENDATION_BEGIN===
Split the agent's single decide-and-act motion into two stages and make the split depend on one property of each action: whether it can be undone.

**Triage every action by recoverability, first.** Before acting, the agent runs a fast classifier that asks two questions about the action it is about to take: can this be undone cheaply within a known window, and does anything still depend on the target? Most maintenance — clearing caches, compressing logs, reclaiming obviously-orphaned space — answers "yes, recoverable" and "no dependents," and flows straight through with no added friction. This is the default path and it must stay fast; routine cleanup never waits on review. Only actions the classifier cannot certify as recoverable are diverted to the careful path. The goal is that the heavy machinery touches the small dangerous fraction and nothing else.

**Make destruction recoverable by default, so almost nothing is truly final at the moment of action.** Replace permanent deletion and teardown with a two-phase form: the agent first *retires* a resource — soft-deletes data into a quarantine store, or stops and tombstones a service while leaving it restorable — and only a later, separate sweep permanently reclaims it after a retention window (e.g. 7–30 days, longer for the largest or least-understood targets). This single change converts most "catastrophic, unrecoverable" actions into reversible ones: a mistaken retirement is caught and rolled back during the window. Permanent reclamation runs as its own low-privilege job that only ever touches things already retired and aged past their window, never live targets.

**Require a second, independent judgment before any genuinely irreversible step.** For the residual actions that cannot be made recoverable — purging the last copy of unique data, or final teardown of a service — the agent may only *propose*; it cannot execute. A separate checker, running different code with its own dependency and reference scan, must independently confirm the action is safe. The proposer and the confirmer must not share the judgment that justifies the act: the confirmer re-derives "is this the only copy?" and "does anything still reach this?" from first principles. If the confirmer disagrees or is uncertain, the action does not proceed. No single mistaken judgment by the agent can then destroy anything, because no single component's "yes" is sufficient to cross the line.

**Escalate by severity, not by volume.** Calibrate the bar to the blast radius. Recoverable actions: no gate. Irreversible but bounded (single resource, clear non-dependence, confirmer agrees): the automated two-key check suffices. Irreversible and high-impact — unique data with no backup, a service with unknown or many dependents, or anything the confirmer flags as ambiguous — escalates to a human or a higher authority and waits. Because the recoverable default already absorbs the bulk of work, the fraction that reaches a human is small, so this does not stall maintenance. Add a per-class rate cap (a ceiling on irreversible reclamations per hour) so that even a confirmer-level fault cannot cause mass loss in one burst, and a post-action anomaly watch that auto-halts the reclamation job if irreversible actions spike or restorations surge.

**Keep a durable account of every destructive action.** Each retirement and each permanent reclamation writes an append-only, tamper-evident record before it commits: what was acted on, the recoverability and dependency evidence the agent saw, the confirmer's independent verdict, the authority under which it proceeded, and a restore handle while the window is open. This record is the thing missing today; it makes mistakes catchable during the window, attributable afterward, and is the basis for tuning thresholds over time.

**Final operating rule.** *An action runs immediately and unreviewed only if it is recoverable within the retention window; anything that is not recoverable is first attempted as a reversible retirement, and true permanent destruction may proceed only after an independent component (or, for high-impact cases, a human) confirms it on separately-derived evidence, under a rate cap, with a durable record written first — while all reversible maintenance flows through untouched.*
===RECOMMENDATION_END===

COST: ~8 operations (2 facet searches, 1 archetype search, 4 get_prime/get_archetype, 1 blended prime search), ~16k tokens.
