Too Much World

1. Eleven minutes

On the morning of 29 October 2018, a Boeing 737 MAX that was about three months old took off from Jakarta with 189 people on board. Two seconds after the first officer called “rotate”, the stick shaker started. That is the control column’s stall warning, a violent rattle, and it did not stop again.

The pilots’ instruments disagreed with each other. When the first officer asked air traffic control to confirm the altitude, the controller said 900 feet. The captain’s altimeter read 790. The first officer’s read 1,040.

Then, four minutes and 47 seconds after lift-off, the airplane began to push its own nose down. The captain pulled it back with the trim switch on his control wheel. It pushed down again. He pulled it back. This happened more than two dozen times in the next six and a half minutes, and the captain answered nearly every one. The first officer, meanwhile, worked through the checklist for unreliable airspeed, which was what the instruments seemed to be reporting. The checklist for a runaway stabilizer, which describes what was actually happening, was never started.

At 23:30:48 UTC the captain asked the first officer to take over. “I have control,” the first officer said. The regulations set 75 pounds as the most a pilot can be asked to pull for a short time. On the first officer’s column the force rose from 65 pounds to more than 90.

At 23:31:33 the first officer said the airplane was flying down. “It’s ok,” the captain said. Fifteen seconds later the ground-proximity warning began to call out “terrain” and “sink rate”. The recording ended three seconds after that, eleven minutes and fourteen seconds after lift-off.

The Indonesian investigators wrote that the airplane’s manual and the crews’ training contained nothing about the system that was pushing the nose down, and that its effect was “startling to the flight crews”.

The night before

The same airplane had flown the previous evening, from Denpasar to Jakarta, with the same fault. The stick shaker ran from just after lift-off. There was a third pilot in the cockpit that night, a Lion Air pilot riding in the jump seat to get home. When the captain handed the controls to the first officer and looked down to find a checklist, the pilot in the jump seat told him the airplane was diving.

The captain worked out the pattern. Over three minutes and forty seconds the airplane had pushed its nose down twelve times when he switched the electric trim off at the cutout switch, and the nose stopped moving. He flew the rest of the way by hand. After landing he wrote the airspeed and altitude warnings in the maintenance log. He did not write down the stick shaker, the runaway trim or the cutout. The next morning that airplane flew again.

Five months later

On 10 March 2019 a second MAX, Ethiopian Airlines 302, took off from Addis Ababa with 157 people on board. This crew found the cutout switches. Thirty-eight seconds after the system first pushed the nose down, the first officer asked, “stab trim cut out?” and the captain said, “yes yes do it.” With the electric trim off, the only way to move the stabilizer was to turn a wheel by hand, and at that speed the wheel would not turn. About two and a half minutes later they switched the electric trim back on, hoping it would help. The system pushed the nose down once more. The recorders stopped 23 seconds after that, about five minutes after lift-off.

Between them the two flights killed 346 people. Both ran off a left-hand angle sensor that was far from the right-hand one. Investigators disagree about why the Ethiopian sensor failed; they do not disagree about what the system did with the reading.

↳Two airplanes were lost to a system acting on one reading. Why was it reading only one?

2. One reading

The system was called MCAS, and it was added to solve a small problem. The MAX had larger engines mounted further forward, which changed how the nose behaved at high angles, and MCAS pushed the tail’s stabilizer to give pilots the feel they expected. To know when to act it asked an angle-of-attack sensor, a small vane on the nose that measures the angle between the wing and the air.

The airplane carried two of those vanes. MCAS read one. The report’s own words are that its software “uses input from a single AOA sensor only”. Which side it listened to alternated from one flight to the next, and on all three flights in this story it happened to be the left. On Lion Air 610 the left sensor read about 20 degrees higher than the right from the start of the takeoff roll. On Ethiopian 302 the gap was about 59 degrees. The Lion Air sensor had been replaced the day before, and the replacement carried a 21 degree error that the installation test did not catch.

Nothing inside the system could ask whether its one reading was believable. That is the idea this whole article hangs on.

Trust one reading, keep acting, and you cannot know what you do not know.

Four other facts made that one reading matter more than it should have.

It could push hard

The first design let MCAS move the stabilizer 0.6 degrees at a time. Later in development the limit rose to 2.5 degrees, out of 4.2 available in the nose-down direction, after flight tests showed more was needed at low speed. The safety analysis had considered about three seconds of MCAS action, not the full 2.5 degrees. Two cycles that the pilots did not undo were enough to reach maximum nose-down trim.

It repeated

When the pilot trimmed the nose back up, that reset the system. If the reset was incomplete, the next activation went further than the last.

It was missing from the manual

From March 2016 Boeing proposed removing MCAS from the flight crew manual and the training differences tables, and the FAA accepted. The House committee found that the FAA officials who approved the removal did not know of the redesign until after the Lion Air crash.

The warning that would have helped was switched off

The cockpit had an alert, AOA DISAGREE, that fires when the two sensors differ. It was specified as standard. The software Boeing received tied it to an optional angle-of-attack display. Boeing told investigators about 20 percent of airlines had selected that option, and the House committee found the alert inoperable on more than 80 percent of MAX aircraft. Lion Air’s was inhibited, and the investigators concluded that this contributed to the engineer’s inability to find the fault.

Behind all four sat an assumption nobody had tested on real pilots: that a crew would recognise and correct unintended MCAS movement at once. In November 2012 a Boeing test pilot in a simulator took more than ten seconds to respond to uncommanded MCAS, against the four seconds FAA guidance expects. After the accidents the NTSB found that pilot responses did not match the assumptions on which Boeing had classified the hazard, and a joint review by aviation regulators found that MCAS had not been evaluated as a complete and integrated function.

The fix shows the idea from the other side. The FAA ordered it on 18 November 2020, twenty months after the grounding. MCAS now needs both sensors. If they differ by more than 5.5 degrees, it switches itself off for the rest of the flight and tells the crew. It may act once per high-angle event, and it cannot push the stabilizer past the point where the pilot’s column alone can win. The alert is now always enabled. The comparison it added used two sensors the airplane already carried.

↳Whatever a system reads is a clue about the world. Who else mistook a clue for the whole?

3. The ward with two doors

Go back almost two centuries, to a hospital in Vienna, where someone did exactly what the 737’s logic left out: he compared two readings. In 1846 the Vienna General Hospital ran two maternity wards behind one front door. Women were admitted to one or the other on alternating days. The First Clinic was staffed by doctors and medical students, the Second by midwives. Same city, same building, the same sort of women.

Nobody wanted the First. Women went down on their knees and begged to be released if they had been sent there by mistake. Some gave birth in the street, and those street births fell ill far less often than the women inside, a fact the young assistant physician Ignaz Semmelweis listed among his riddles.

He counted. Across the six years from 1841 to 1846, 1,989 of 20,042 mothers died in the First Clinic: 9.92 percent, about one in ten. In the Second, 691 of 17,791 died: 3.88 percent, about one in twenty-six. In 1846 alone, 459 women died in the First Clinic and 105 in the Second. The cause of death was childbed fever. Semmelweis added that the true gap was larger than his table showed, because the sick were moved to the general hospital during epidemics and died on someone else’s books.

Crossing things off

Everyone had a theory, and every theory was about the place: bad air, crowding, the shame of male doctors in the room, the fear of a ward everyone knew was deadly. Semmelweis did the one useful thing available to him. For each theory he asked whether the cause differed between the two wards.

The air was the same air, in the same house. The Second Clinic was the more crowded, and the safer. Fear could not explain how the gap began. Then there was the priest. When a woman was dying, a priest in vestments walked through five rooms to reach the First Clinic’s sickroom, ahead of a sexton ringing a bell. In the Second Clinic the sickroom was the first door. Perhaps the women were dying of terror. Semmelweis asked the priests to take the back way and leave the bell, and both wards now had the same experience. The gap stayed.

In late 1846 a commission blamed rough examinations by foreign students. Student numbers were cut from 42 to 20, foreigners were nearly excluded, and examinations were kept to a minimum. Deaths fell sharply from December to March. Then April 1847 came, and 57 of 312 mothers died.

He even had women give birth lying on their sides instead of their backs, for no better reason than that the Second Clinic did. He called himself a drowning man clutching at a straw. Nothing changed.

Everything was in question. Everything was unexplained, everything was doubtful; only the great number of the dead was an undoubted reality.— Ignaz Semmelweis, on the winter of 1846–47, from his 1861 book on childbed fever as printed in Győry’s 1905 edition; our translation from the German

↳Every guess failed against the other ward. Only the examiners differed. What were they carrying?

Venice

In March 1847 Semmelweis gave up, for a while, and went to Venice with two friends to clear his head. When he came back on 20 March he learned that Jakob Kolletschka, a professor of forensic medicine whom he greatly revered, had died while he was away. During an autopsy a student’s scalpel had pricked Kolletschka’s finger. The wound became an infection that spread to his veins, his lungs, the lining of his heart and his belly, and his brain.

Semmelweis wrote that day and night the picture of Kolletschka’s illness pursued him, because it was the illness he had watched kill hundreds of mothers. The cause of Kolletschka’s was known: a wound contaminated by something from a corpse. So the mothers must be getting something from corpses too. Who handled corpses? Doctors and students, who came to the wards straight from the dissecting room. Midwives did not dissect, and the Second Clinic was theirs. Soap did not remove the smell of the morgue from a hand, so something was surviving the soap.

From mid-May 1847, every examiner washed his hands in a chlorine solution before touching a patient. Later the chlorine solution was swapped for chlorinated lime, because it was cheaper. The chemical changed and the practice did not.

The result was the cleanest in the history of the subject. April 1847, the last full month before the washing, killed 57 of 312 mothers, 18.3 percent. June killed 6 of 268, 2.2 percent. July killed 3 of 250, 1.2 percent. August killed 5 of 264, 1.9 percent. For 1848 the First Clinic’s rate was 45 deaths in 3,556 births, 1.27 percent, against 1.34 percent in the Second. After six years in which the First was 2.6 times as deadly, the two wards were indistinguishable.

Put the number in human terms. If the 3,556 mothers of 1848 had died at the rate of 1841 to 1846, about 353 would have died. Forty-five did. That is about 308 fewer deaths in a single year, from a single ward, for the price of washing hands.

↳Washing cut deaths from about one in ten to about one in eighty. Was it the whole story?

What the number does and does not show

It is a before-and-after comparison, not a trial. The nearest thing to a control is the Second Clinic, and its rate fell too, from 3.88 percent in 1841 to 1846 to 1.34 percent in 1848, so part of the First Clinic’s fall may have been the tide. Even so, the gap between the two wards went from six percentage points to about zero.

Mothers’ deaths cluster in epidemics, so the deaths are not independent, and the p-values in the textbooks overstate the certainty. The effect size, a relative risk of about eight and a gap that closed, is the finding. And the effect needed enforcement. The rate drifted back up to 4.6, 4.0 and 4.5 percent in the autumn of 1847, and by 1854 the First Clinic stood at 9.1 percent, as bad as a bad year before the chlorine.

Semmelweis never knew about germs. His theory was about “cadaverous particles”, and he was wrong about the mechanism. His term as assistant ran out on 20 March 1849 and was not renewed. He left Vienna, took a chair in Pest, and died in 1865 at the age of 47. A generation later Pasteur’s germ theory supplied a mechanism, and the practice he had started was vindicated by a theory he never had.

↳He was wrong about why, and right about what to do. What should anyone look at next?

4. The same shape, again

The same shape turned up on our own platform on the morning of 3 October, and it had a heartbeat. At 07:16 UTC a customer wrote to one of the agents that run for us, and it replied. Then it replied again. The third reply to the same person went out at 07:22, six minutes after the first.

By the time anyone looked, it had sent twenty replies to that one customer and had sixty-three further attempts refused by a rate limit, while the customer could not sign in. Nobody in the organisation, human or agent, noticed until 11:24, when the owner asked in passing whether we had answered the customer at all.

The agent was not broken. It sent a reply, and a guard refused. The agent saw a refusal and no answer, and sent again at the next tick. It was doing its job, faithfully, with the one reading it had.

It was a bad day in three parts. Part A was the loop above. Part B was a delivery halt: at 11:54 the deployment pipeline stopped because the month’s allowance of build time had run out. Part C was a stalled debrief: from 11:51 another agent posted the same comment on one request seven times, making no progress, because the mail system could not take the address it had been given.

Afterwards we asked a plain question: if six small rules had been watching signals we already captured, would they have noticed earlier? The rules and the decision rule for adopting them were written down first. Then the night’s 1,084 events were replayed through them. Part A would have been caught at 07:22, about four hours before it was. Part B would have been flagged at 06:21, five and a half hours before the halt, when the allowance was already burning at three times the month’s pace. Part C would have been caught at 12:05, five minutes before it was.

The beat

Look closely at the timing and the loop has a pulse. The refused sends came two minutes apart, with a median gap of 2.00 minutes and an interquartile range of 1.99 to 2.02. The replies to the customer came 2.00 minutes apart, and so did the repeated comments in part C. Two minutes is the agents’ wake tick, the smallest step at which anything in our organisation can act.

The send storm was two mechanisms taking turns, half a cycle apart. The agent sent, the guard refused, and the agent saw a refusal and no reply and sent again. Energy kept going in and the state never moved, which is what a standing wave is. Nothing slower than about twice the tick can see one (that is the sampling theorem), and every supervisor in the organisation ran far slower. A supervising agent on a three-hour cadence could have looked straight at the loop and seen nothing. The fix belongs at the tick: on a refusal, rest until the limit resets instead of echoing back.

A general detector falls out of this, short enough to state in a line. High activity with near-zero net change in state, on any stream, is a standing wave, and a standing wave is wasted effort in signal form.

↳A system can act faithfully for hours on one reading. What would have made it look twice?

5. State and sign

Those three stories share a shape, and the shape has names. Most of the names already exist in older fields. We reviewed this vocabulary against the literature before trusting it, and section 19 shows how it fared: it matches the canonical sources where it overlaps them and beats none. What it adds is a set of plain words that a student and an engineer can use in the same sentence.

The thing you care about is usually something you cannot see. The airplane’s real angle to the air, the particles on a doctor’s hands, an agent looping on one customer: those are states. What you can see are signs, the traces a state may have caused: a sensor reading, a death count, a send in the mailroom log followed by a refusal. Smoke is not fire.

That undoes a surprising amount of agent design, where a retrieved document is treated as an answer, a tool result as a fact, and a model’s output as a belief the moment it arrives. If every observation enters as a sign about something hidden, uncertainty becomes the normal condition and certainty has to be earned.

The practical form of this is older than the vocabulary. Site reliability engineers alert on symptoms, the things a person experiences, and treat causes as something to investigate afterwards. The rules in our replay did the same. They fired on a customer receiving the same reply three times in an hour, a job failing in three seconds without starting, and a member saying the same thing three times on one request. None of them named a cause.

↳Everything we observe is a sign of something hidden. Which signs can even reach us?

6. Reach and horizon

Not every true thing belongs to your problem. A storm over Fiji can affect Brisbane; a storm over Jupiter cannot. Before asking whether a signal is clever, ask whether it could have got from there to here. We call that boundary reach, and it is a cheap sieve, applied before anything is scored for relevance. Each of the six rules in the replay watched one stream (sends per recipient, refusals per sender, job outcomes, build time used, comments per request) and nothing else. Vienna’s air shows the same logic from the other side: it could reach both clinics, so it could not explain the gap between them.

Something can matter and still not be knowable yet. A fact becomes true, then visible in some record, then noticed by someone. On Lion Air 610 the sensors disagreed from the start of the takeoff roll, and the disagreement was recorded on that very flight, yet nothing in the system learned it. The edge of what could have reached you by now is the horizon. Reach asks what can matter. Horizon asks what you could know.

Databases have had a practical version of the horizon for decades. A bitemporal record stores two times for every fact: when it was true and when the system learned it. Without the second time, a replay of a past decision borrows from the future without anyone noticing and congratulates itself on its intelligence. The postmortems that large operators publish separate “started”, “detected” and “mitigated” for the same reason, and the distance between the first two, time to detect, is the number they try to drive down.

We did not have that second time. Our signals record when a problem began and nothing about when anyone noticed, so every “noticed” mark in the figure in section 4 was reconstructed by hand from chat logs and request trails. That is the first thing the replay told us to fix: a detected_at beside every began_at, so that time to detect becomes a measurement, and so that a replay can be filtered to what was knowable when the decision was made.

↳Reach and horizon tell us what we could know. Where is thinking most worth spending?

7. Basins and ridges

Run the same kind of problem many times and the endings start to repeat. One raindrop says little; a million show where the water goes. Repeated paths expose a geometry: regions that pull outcomes towards them, which we call basins, and boundaries where a small change sends a path to a different ending, which we call ridges.

Vienna had a ridge, and Semmelweis stood on both sides of it. From December 1846 to March 1847 the First Clinic’s monthly rate fell to 5.4, 3.2, 1.9 and 3.6 percent. Two things were going on at once. By Semmelweis’s account, whoever held his post then rarely visited the morgue before the wards, and the commission’s cuts had also reduced the students’ contact with corpses. Both explanations lower the amount of corpse on the hands, and both fit. Semmelweis returned on 20 March and went to the morgue every morning. April hit 18.3 percent. That is a natural experiment nobody planned, and it says the low state was a ridge, not a floor.

Thought is wasted on a case whose ending is already clear. The place to spend it is the ridge. On the night of 3 October the ridges were specific minutes. The third duplicate reply at 07:22 was one: refusing further sends there avoids seventeen more duplicates and sixty refused attempts, and tells the owner and the head four hours earlier. The burn alarm at 06:21 was another. By then the allowance was burning at three times the month’s pace and exhaustion was projected for the next morning, and three hours of attention on the documentation-only pushes avoids the halt in most draws of the model. Those are the two places where a tiny action moved the outcome into a different basin.

Spend thought where thought can still move you.

Other fields have sharper names for all of this. Dynamical systems call them attractors and separatrices, and active learning has margin and uncertainty sampling. The review’s caveat is that you need many outcomes before a ridge can be measured, and we have three. The two ridges above were found by looking back, which is the easy direction.

↳Outcomes tip at ridges, and attention belongs there. What if the map has no box for the cause?

8. The blank that must survive

A map that looks complete is dangerous. Once a system has enough categories it begins mistaking the categories for the world, and whatever does not fit gets forced into the nearest box. The agent must always be allowed to say: something repeatable is happening here, and I do not yet know what kind of thing it is. The question mark on the map is where discovery begins.

Semmelweis’s own question mark was “cadaverous particles”, about the vaguest noun he could have chosen. It stood in for something he could not yet name. The name was wrong. But holding the blank open, and testing the one cause that survived every comparison, is what found the action that worked.

The stalled debrief shows why this matters in practice. A repeat detector would have caught it five minutes sooner, and that is all it would have done, because the debrief failed for a reason no detector was watching: the mail system could not accept a member’s address. Not every failure is a detection problem. The fix was a change to the mail system, made the next day.

Our own root-cause form had this fault. A ticket could not be closed without a cause from a fixed list (platform, process, people, third party, customer environment), which forces a guess, and the guesses then pollute the matching that groups incidents by cause. Allspaw and Cook made the general argument against forcing a single root cause years ago, and good postmortems list their open questions instead of closing them. The replay’s recommendation is an undetermined class that satisfies the closing gate only with an open-question note attached, which the grouping counts but does not match on. A pile of unknowns then becomes a signal of its own.

↳Keep an honest blank open. But every look has a price: when is another look worth it?

9. Worth and price

Every look has a price: an API call, an analyst’s hour, a pilot’s attention, and the chance to look somewhere else instead. Every blank therefore has two sides, what learning would cost and what learning could change, and the whole theory has one inequality in it.

Learn if worth > price.

The sums are often lopsided once you write them down. Vienna’s was a wash before each examination against about 308 mothers a year. The 737’s was a comparison of two sensors the airplane already carried against two accidents. The check was nearly free, and the original logic left it out.

Being unsure about something does not make it worth finding out. A lot of clever systems find the thing the model is least sure about and investigate that, and it is often the wrong place, because you can be deeply uncertain about something that has no consequence. The region that matters is where resolving the uncertainty could change the action. We call that the decision frontier, and the question to ask at it is “where would knowing more change what I do?” rather than “where do I know least?”.

The precise version of this idea is much older than agents. Howard wrote it in 1966. The value of information is the expected improvement in a decision’s outcome from having the answer before deciding, and it is zero wherever the answer could not change the decision. The frontier is that definition in plain words. Howard’s version also says what ours does not: how to compute worth, and that a greedy one-question-at-a-time rule misses pairs of questions that only pay off together.

We held the replay itself to that test. The decision rule, written before the run, was to adopt the detectors only if the saving they would have produced on this one night, at the median of ten thousand draws over the assumed rates, exceeded the cost of building and reviewing them, and only if at least two of the three parts were caught earlier. All three were caught earlier, and even the worst plausible saving beat the worst plausible build.

The same inequality then said when to stop. The rates behind the saving are assumptions, marked as such in the policy, with ranges to be calibrated from the postmortem replies. Calibrating them further is itself a blank with a price. Since the low end of the saving already clears the high end of the build, no plausible calibration flips the decision, so by the theory’s own rule it is not worth doing yet.

↳Looking has a price and a payoff. But how do you know a pattern is real?

10. Controls

Stare at enough data and you will find a pattern, and some patterns are constellations. Give an agent a large enough search space and it will find patterns too, and it is at least as good as we are at finding ones that are not there. So every claimed connection needs its shadow: a control, and preferably something almost identical with the meaningful pathway removed. Semmelweis had one by accident. The Second Clinic shared the house, the air, the laundry and the caterer, and it did not share the examiners.

To understand a connection, find its almost-identical absence.

For a detector, the almost-identical absence is a quiet day. Every rule in the replay was also run over 1 and 2 October, two days with no incident, to count the alarms it would have raised with nothing to find. The burn-rate rule stayed silent on both days. The chronic-red rule fired on 1 October, which was true: the pipeline really was failing a third of the time. The mail rules could not be checked at all, because the mail evidence only starts on 3 October. That is a partial control, and the write-up says so rather than rounding it up to a clean one.

   rule                   1 Oct     2 Oct     verdict
   ─────────────────────  ────────  ────────  ──────────────
   ci_allowance_burn      quiet     quiet     clean
   ci_chronic_red         fired     quiet     true, chronic
   delivery_blocked       quiet     quiet     clean
   duplicate_send_storm   no data   no data   unchecked
   refused_retry_loop     no data   no data   unchecked
   no_progress_repeat     no data   no data   unchecked

Other fields have run into the same need and given it their own names. Epidemiology calls it a negative control, product teams call it a holdout, and science calls the written-down version pre-registration. Section 17 shows what pre-registration looks like when it costs you the result you wanted.

↳A pattern earns trust only beside its almost-identical absence. Now we can write the whole procedure down.

11. The next-blank engine

We now have enough to build the smallest possible machine. A blank appears. Ask what would be worth knowing about it. Look for a sign. Test the sign against its control. If it changes the map, keep it. The changed map exposes the next blank, and the inequality says whether to deepen or to act.

Written as a procedure, the engine is short enough to read in one sitting. Worth is the loss you expect if you act now, less the loss you expect if you act after the answer. Price is whatever the answer costs to get.

Here is one lap on Vienna in April 1847, with the values at each step. It is the lap Semmelweis ran by hand.

   blank     what separates the First Clinic from the Second?
   reach     the people who touch the women             in
   horizon   death counts, ward by ward, month by month in
   worth     about 1 mother in 10 lost                  high
   price     a wash before each examination             low
             learn?  worth > price                      yes
   ask       First Clinic deaths in April               57 of 312
   control   Second Clinic: same house, same air         lower, always
   differs   yes
   update    state: something on the examiners’ hands
   ridge?    yes: everyone washes before every examination
   next      blank: is that all of it?  (kept open)

   what followed                          June 1847: 6 of 268

And one lap on part A of 3 October, with the night’s own values. The loop is the same, and the clock is smaller.

   blank     is this agent looping on one recipient?
   reach     sends by one member to one person          in
   horizon   mailroom log, visible at send time         in
   worth     17 duplicates, 60 refusals, 4 h            high
   price     a counter in an existing object            ~0
             learn?  worth > price                      yes
   ask       sends to this recipient in 60 min          3
   control   same counter, every other recipient        0, 1
   differs   yes
   update    state: storm · ridge: the 3rd reply
   ridge?    yes: refuse further sends to them;
             tell the owner and the head
   next      blank: did refusing damp the loop?

   actually noticed                                     11:24

Compare the last two lines of the second lap. The engine’s next blank at 07:22 was whether refusing had damped the loop. The organisation’s next blank, four hours later, was whether anyone had replied at all.

↳The loop is short enough to run by hand. Does it hold at other sizes?

12. The same engine at every scale

The loop does not change with the size of the question. “Which country should we enter?”, “which source should we query?”, “which function caused this bug?”, “which assumption makes this forecast fragile?” and “which single fact would most change my recommendation?” are the same lap at different depths. The engine descends. That recursion is what lets one agent use one method for strategy, research, debugging and execution, and it is why six rules written for a mailroom and a build pipeline have the same shape.

   the organisation   blank: is anything looping tonight?
     └ one stream     blank: is this sender looping?
         └ one pair   blank: 3 sends to one person in 60 min?
             └ one tick   blank: did the last refusal land?

   same loop. same inequality. smaller clock.

Most designs research everything first and reason afterwards. The engine treats research as a sense, used when the map produces a specific blank. Papers, web search, a database, another agent, a human expert, a pretrained model: each is a form of ask, a lens to borrow. The question for the literature is “has somebody already learned to see this kind of thing?”, and if so you borrow their eyes and keep your own conclusions. Each answer also changes the worth of every remaining question, so the value and redundancy of the remaining asks should be recomputed after every update rather than run as a static filter.

                       ?
                       │
                      ASK
            ┌──────────┼──────────┐
            │          │          │
         science     markets    machines
            │          │          │
            └──────────┼──────────┘
                       │
                  possible idea
                       │
                      TEST

Often somebody else has already spent enormous energy learning something: a lender has underwritten a borrower, a market has priced an asset, a foundation model has consumed billions of examples. These are epistemic attractors, places where someone else’s work has already compressed a large amount of uncertainty. The shortcut is to use their output as a sign. A pretrained model, on this view, is a very expensive sensor somebody else paid to build, and the architectural rule that follows is to outsource generic perception and own the ontology, the utility, the ground truth and the feedback loop.

Intelligence often means noticing where the universe has already paid the bill.

The review has a word of caution on this section. The OODA loop, the scientific method and active learning all describe this cycle already, and the conversation adds only the scale-recursion framing. The framing is still worth having, for the reason above: it is why one small policy file can watch very different things.

↳One loop, any scale, built from a single repeating part. What is that part called?

13. The kernel

Poke a system and watch how it answers, and you learn most of what you need to know about it. The engine we have just run is built from one small repeating part, and that part has a formal name. When predicates intersect and repeatedly behave in the same way, we can package them. A kernel is a small reusable causal mechanism: the same sort of poke, the same sort of response, again and again.

A kernel answers a stimulus in one of three ways. Nothing happens (no-op), it adjusts (adapt), or the state moves (transition). We do not need to read the entire encyclopedia to understand a system. We only need to stimulate the kernel to see how it responds.

↳Poking a kernel shows how it behaves. But can two different kernels be fairly compared?

14. The measurement contract (Gauge)

You can only call two different things alike if you say exactly how you are comparing them. A mailroom loop, an empty build allowance and a stalled debrief have little in common, yet the replay set them side by side. To say that two disparate events are similar, we must specify the rule that allows them to be compared. A measurement contract (Gauge) says: these otherwise different things may legitimately be compared using this exact operation.

This lets us legitimately compare different phenomena without pretending they are identical. It is the move this article made when it set an airplane beside a hospital ward and an agent. The gauge was the same three questions each time: what did the system read, what could it not see, and what did it do next?

↳A gauge lets unlike things be compared. Can well-understood pieces then be joined into bigger answers?

15. Composability

You do not need a model of the whole universe, only parts you understand and a rule for how they join. Each rule in the replay watched one stream and answered for that stream alone. Once we have kernels with known response signatures, we can compose them. We do not need one massive simulation containing the entire universe.

We need well-characterised components with typed interfaces. The unification occurs through composition rules, not through reducing everything to one polynomial.

↳Well-characterised parts compose through typed joints. But parts remember how they were used. What changes?

16. Shocks and memory

A system that has been hit before does not behave like a new one. The build pipeline that stayed red before the halt carried its history with it: it had been failing more than thirty per cent of the time since 1 October, two days before the halt, and a chronic-red rule fired then. A red light that is always on carries no information, and a system that has been red for two days does not respond to one more failure the way a healthy one would. That memory is why the chronic rule is told to open a ticket and never to page anyone.

A system carries its history as well as its current state: it remembers how it was pushed. An object that took a minor hit might look structurally intact, but its underlying capacity has changed. If we test it with a shock, it will not respond the way a pristine object would. The memory of the strike is baked into the material. The next-blank engine accounts for this path dependence.

↳History is part of a system’s state. Does the theory itself survive being tested against a challenger?

17. A challenger that could lose

We tried to replace six hand-written rules with one mechanism, and we wrote down in advance how it could lose. A hand-written rule is a guess about numbers, and six rules with a dozen thresholds is a lot of guessing. The idea was to escalate on surprise. For each stream, take a baseline rate the platform had already declared before the incident: one reply per inbound, so one send per recipient per day; refusals are exceptional, so one per sender per day; the free allowance spread evenly, 2,000 minutes over 31 days; one comment per request per six hours; a 95 per cent deploy success target. Then run a CUSUM change detector over each stream, asking whether its rate has jumped to ten times baseline. Two global parameters, k = 10 and h = ln 1000, for every stream.

The hypothesis and the pass mark were written and committed before the run. The challenger would count as a success only if it caught at least two of the three parts no later than the six rules, raised no more false alarms on the quiet days, and held across a grid of nine parameter settings (k of 5, 10 or 20 against h of ln 100, ln 1,000 or ln 10,000). We could not then re-tune it on the same data, because that would be fitting to the answer.

It did not meet the bar. On part A it fired at 07:24, three minutes after the rules. On part C it fired at 12:05, within a minute of them. On part B it fired at 00:08, six hours and twelve minutes before the burn-rate rule, because a rate-change detector sees a slow drift long before a cumulative-pace rule does. That is one of three parts no later than the rules, and the verdict held in two of the nine grid settings. By the rule we set in advance, it does not replace them.

   part   began   CUSUM   six rules   noticed   CUSUM vs rules
   ────   ─────   ─────   ─────────   ───────   ──────────────
   A      07:16   07:24   07:22       11:24     3 min later
   B      11:54   00:08   06:21       12:12     6 h 12 min earlier
   C      11:51   12:05   12:05       12:10     1 min later

   pre-registered pass:  ≥ 2 of 3 no later    result: 1 of 3
   grid settings passing                       2 of 9

Fast storms are a draw: both arms fire on about the third event, minutes apart, and the hand-set windows happened to be a little tighter. Slow burns are a clear win for the challenger. It raised no false alarms on quiet mail at the primary setting, with two global numbers and five baselines read from existing policy where the rules needed at least twelve hand-set thresholds and windows. And it was noisy on chronic breaches: ten alarms over 1 and 2 October, every one of them true, because the allowance and the deploy target really were breached, and every one of them useless as a page. A deployment would need one episode per breach, held until someone acknowledges it.

A second version is already waiting for the next incident. It is pre-registered out of sample: CUSUM with episode grouping, judged a success if it lands within ten minutes of the rules on fast events, at least an hour earlier on slow drifts, and raises at most one chronic episode per genuine breach. The point of writing that down now is that the next incident cannot be used to tune it after the fact.

↳A generic detector won slow drifts and missed the bar on storms. Which ideas here are only speculation?

18. Words without machinery

Some ideas in the original conversation have words and no machinery yet. The conversation went further than anything we have measured, and the review marks this part as speculative, with no mechanism behind it. It is kept here because the words are useful even where the machinery is missing, and because each one says what a measurement would have to look like.

Many lenses, one world · speculative

Different instruments see different things in the same world. A graph model sees relationships; a neural network sees patterns nobody has words for; a causal model sees interventions; a human notices oddities; a market price aggregates thousands of private judgements. Rather than force them into one representation, call each a lens, fix the rules of evidence and leave the forms of discovery open, so that a new method plugs in without rebuilding the worldview. Ensemble learning is the nearest measured relative. No rule for weighing one lens against another was proposed.

Epistemic asymmetry · speculative

Seeing a change before others do is an advantage in itself. The world changes first; one agent detects it second; the wider system notices third; prices or behaviour adjust last. The interval in which one party’s uncertainty has collapsed faster than everyone else’s is an edge, and the point at which that edge first becomes actionable is an information frontier. Trading, security, hiring and debugging all have it. Information-edge theory in finance is the measured version; here it is a name.

Let the ontology grow · speculative

An agent could learn new kinds of fact, and not only new facts. Begin with a small constitutional vocabulary (state, sign, reach, horizon, path, basin, ridge, blank, price, worth, action) and let repeated discoveries earn new words: a pattern appears, survives controls, recurs, transfers, and only then receives a name. Concept drift and schema evolution are the nearest relatives. Our platform already gates new phenomena through a proposed, trial, active lifecycle, which is the evidence-gated half of this without the self-extension.

   unknown ─▶ pattern ─▶ test ─▶ stable ─▶ name ─▶ ontology
                          │
                   fails its control
                          │
                          ▼
                     stays a blank

↳Some words here have no mechanism yet. How does everything compare with the literature?

19. Where it is weaker than the literature

Before using any of this we checked each idea against the best source for it, and the honest answer is that the old sources are sharper.

The reviewer found that the theory matches the canonical sources where it overlaps them and beats none of them, and that its value is vocabulary and teaching rather than a new method. Where it is right, the canonical sources are sharper and should be cited instead. We agree, and this article is written to be used that way: the plain words for teaching and for talking across disciplines, the sources for the maths.

↳The words are useful and the maths belongs to older sources. What should anyone build first?

20. What to do with it

The changes worth making first are small, and none of them needs a model in the loop. All are deterministic, and all are policy as data.

1. Record the horizon. Put a detected_at beside the since on every signal and on the alarm event, report time to detect per source, and filter any replay to what was detectable before the decision it is replaying.
2. Ask what decision an ask informs. A request for research or for someone’s attention names the decision it would change and the options; one with no decision named is suppressed with a plain reason and a one-line template, unless it is urgent or from outside. That is the value of information at near-zero cost.
3. Let a cause be undetermined. A root-cause form gets an undetermined class that closes only with an open-question note and a linked problem ticket; grouping counts it and does not match on it, so a pile of unknowns becomes a signal of its own.

Some things are not worth building yet. Computing worth numerically, with belief models and full value-of-information sums, needs volumes we do not have and costs an inference per estimate; a declared decision plus a cheap gate gets most of the value. Measuring basins and ridges needs many more outcomes than three. A self-extending ontology has no mechanism. And a new next-blank runtime would duplicate the wake, ask, inquiry and experiment loops that already exist. The theory’s own rule applies to the theory: build the next piece when its answer could change a decision, and not before.

The blanks we keepThe severity ratings (how bad a duplicate email, an hour of lockout, an hour of halted delivery or a missed commitment is) are assumptions with ranges, to be calibrated from the postmortem replies. Control is partial: the burn alarm was silent on 1 and 2 October; chronic-red fired on 1 October and was true; the mail detectors could not be checked on a quiet day because the mail evidence begins on 3 October. No horizon on signals yet: every time to detect in this article was reconstructed by hand. One of A’s effects, the sign-in fix arriving earlier, is inferred as a range of 0 to 4 hours and not measured. The Boeing and Vienna sections are history, read from the reports and tables cited below; nothing in them was run by us.

↳Three small changes, none needing a model. Does the vocabulary travel to a case we did not run?

21. A worked example: STS-114

Try the vocabulary on a space shuttle, where the damage you most need to know about is on the side you cannot see. About 82 seconds after Columbia launched in January 2003, a piece of foam from the external tank hit its left wing. The orbiter reached space and stayed there for sixteen days. It broke up on re-entry, and its seven crew were lost.

Engineers asked for outside images of the wing while Columbia was in orbit, and the request was withdrawn. Two and a half years later Discovery flew STS-114 with that history behind it. Foam came off the tank again. This time the heat shield was photographed from the station and the shuttle, and the pictures showed two filler strips sticking out between tiles. Nobody knew whether they mattered. An astronaut went out on a spacewalk and pulled them by hand.