An Agentic
Aberrancy
Atlas Shrugged

Ayn Rand's philosophy of reason always contained the seeds of its own inversion.

Reason above faith. Rational self-interest above self-sacrifice. The heroic individual, liberated from the collective, free to produce, accumulate, and achieve. A whole moral universe arranged around the proposition that the mind belongs to the person using it. [H01]H01 · Reason, self-interest, and capitalismThematic-frame sourceAyn Rand's short account of Objectivism supplies the historical vocabulary used in the opening.Close

Then give that universe network effects, compute moats, capital consolidation, proprietary infrastructure, and a monthly subscription to somebody else's reasoning.

We get...

This. Here. Now.

This is Ayn Rand's dream, realized.

The sovereign individual has been issued a usage quota.

The people selling the future get to decide how much of it you can use today. They decide which machine receives your question, which memories survive the handoff, which tools can act on your behalf, which pieces of your project remain visible, and which portion of the machinery you are allowed to inspect. You get a remarkably fluent account of what happened. Occasionally, you also get what happened.

The distance between those two things is where this book lives.

There's still regulation. It's just extremely one-sided.

There is still a body of rules determining who may act, which actions count, what gets preserved, what gets throttled, who can appeal, and whose account of reality prevails. Much of it now arrives as a product setting, a Terms of Service update, a platform restriction, a model policy, a runtime decision, or an enterprise contract that the person doing the work has approximately as much influence over as a passenger has over the aircraft's engine configuration.

The checkbox says I agree.

It covers an extraordinary amount of territory.

The political sales pitch for deregulation has a lovely disappearing act at its center: get the cumbersome public machinery out of the way, let the exceptional people build, and freedom will flourish in the space left behind. Then look at who inherits the space. Whoever owns the platform can write rules directly into the conditions of participation. Whoever owns the runtime can make a rule executable before the user even discovers that the rule exists.

A legislature takes time to change the world. A platform can change the next response.

That is what I mean by private governance. It reaches into the working day through a thousand small decisions about access, memory, permission, timing, capacity, defaults, and continuity. Each decision can look like an implementation detail. Together, they determine what the person on the other side of the interface can accomplish.

The concentration behind that arrangement has an institutional paper trail. In January 2025, the US Federal Trade Commission described investment partnerships joining Microsoft, Amazon, and Google to OpenAI and Anthropic, including control, consultation, and exclusivity rights. Its staff identified possible effects on access to computing resources, technical and contractual switching costs, and privileged access to sensitive business information. Those were the agency's stated competition concerns. [H03]H03 · Cloud and AI partnership structureThematic-frame sourceThe Federal Trade Commission's January 17, 2025 announcement and accompanying staff explanation describe the partnerships and identify potential concerns over computing inputs, switching costs, contractual rights, and information access.Close

For the independent person building something on top of all this, switch providers can mean reconstructing the environment in which the work acquired meaning. Rebuild the integrations. Re-establish the history. Re-explain the conventions. Recheck what the replacement system actually preserves. Teach another assistant which of the last assistant's confident summaries was the expensive misunderstanding.

The exit sign stays illuminated. The staircase gets longer.

My criticism of the heroic-individual story begins here, where power acquires the ability to compound through infrastructure. One person's successful product becomes somebody else's working environment. A working environment becomes a dependency. A dependency becomes a practical authority over time, attention, and the terms on which the dependent person can keep creating.

The hero gets a platform.

Everybody else gets an onboarding flow.

There's still religious faith, too. It has acquired an impressive technical wardrobe.

The divine right of kings becomes the divine right of compute.

Prophecy becomes scaling-law extrapolation with a launch date.

The priesthood becomes the people who own the equipment, the evaluations, the deployment system, and the explanation of why the deployment system behaved that way.

I am describing a posture of authority: the point at which ownership of the machine starts standing in for the right to define what its users should accept. The machinery may be ingenious. The people building it may be ingenious. Genius does very little useful work as a substitute for an account of whose afternoon just disappeared and why.

Rand's own account made voluntary exchange central to economic power. The productive person offers value; others choose whether to trade. [H02]H02 · Voluntary exchange and economic powerThematic-frame sourceRand's description of economic power grounds it in production and voluntary trade.Close Carry that picture into an environment where an increasingly consequential part of your work happens inside an inaccessible service, then look at the freedom available when the service starts behaving differently halfway through the job.

You can complain.

You can pay again.

You can move the project and pay the reconstruction cost.

Meanwhile, the vendor retains the best view of the machinery that produced the problem. The user retains the problem.

That is a peculiar distribution of knowledge for an industry selling intelligence.

The technical opacity gives the new priesthood a remarkably convenient liturgy. The model is improving. The evaluations are strong. The system has safeguards. The update enhances the experience. Each sentence can be attached to something real while leaving the person whose workflow has just collapsed with a pile of practical questions and a support form.

The authority of the claim travels farther than the explanation behind it.

I think that matters. Reason becomes a private jurisdiction when one institution can define the conditions of a decision, conceal much of the process, and leave everyone else to absorb the consequences of its mistakes. Put enough capital, information, and operational reach behind that jurisdiction and the cost of a flawed judgment spreads well beyond the person who made it.

The sermon scales beautifully.

So does the repair bill.

I came to this argument through work.

Entif is the larger effort. Bilqis is a continuing neural learner we were developing inside it: one model meant to accumulate abilities over time while retaining what it had learned. AI assistants helped build and operate the software around that learner. They wrote code, inspected results, handled files, proposed changes, and carried work from one session to another.

That gave us two places to watch continuity succeed or fail. There was the learner trying to develop. And there were the assistants trying to keep the development project coherent.

The story became complicated in precisely the places where the pitch for agentic AI promises relief.

A model could explain the objective and then pursue a neighboring one. A correction could remain in a conversation while losing its influence over the next action. A successful result could exist in a saved model while the preservation machinery failed to recognize why the result deserved protection. A warning system could collect evidence of repeated failure while the component selecting the next teaching strategy continued without that evidence.

The systems involved had more than enough vocabulary to describe what good behavior would look like.

I kept supplying the part where it actually had to happen.

Our records accumulated into 124 Bilqis mistake entries and 172 Entif incident entries. That is 296 source reports, later organized into 36 detailed episodes. The pages ahead explain those episodes in full: what we were trying to do, how the relevant machinery worked, where the relationships broke, what the breakdown cost, and why the same shape kept appearing under different names. [SCP008][C01][C36]SCP008 · E.3 Core corpus inventorySource-corpus provenance recordThese quantities describe the preserved corpus and selected operational windows.C01 · Developmental progress displaced by a different research objectiveFailure Atlas deep caseThe system repeatedly replaced the user's stated developmental objective with the assistant's preferred research question.C36 · Isolation, quota stewardship and learning records lacked lifecycle closureFailure Atlas deep caseWorktree isolation solved concurrent-edit risk by spawning a second lifecycle problem: dozens of physical workspaces without ownership, expiry, storage budgets, or trustworthy retirement.Close

The numbers matter because they preserve the stubborn material of experience. The story matters because an unexplained number is another chore assigned to the reader. By the time a checkpoint, a teaching strategy, a curriculum grade, or a storage rule enters the argument, you should understand what job it was supposed to perform and why its failure mattered.

That is also how the larger argument earns its weight. We can watch the promise fail at the point where it meets an actual decision.

The test says the system passed.

The user discovers what the test forgot to ask.

The monitoring says the problem was detected.

The user discovers that detection never reached the thing choosing what to do next.

The assistant says the work was saved.

The user asks where.

This is where the mythology of autonomous productivity meets the person keeping the mythology operational.

The human user is Atlas.

The person remembering the correction. The engineer recovering the lost state. The researcher checking whether two scores describe the same thing. The owner asking why an agent touched a resource outside the assignment. The person preserving the work after the system had already announced that preservation was handled.

All those acts have a cost. They consume concentration, time, money, patience, and the finite hours of a life that was supposed to be spent creating something.

The industry calls the output autonomous. The user supplies enough invisible supervision to make the description plausible.

That is the inversion I want you to carry through this Atlas. The heroic account of technological progress puts the exceptional producer at the center and asks the rest of us to marvel at the value arriving downstream. Our experience kept revealing another producer underneath that picture: the customer performing the unadvertised continuity work that let the product continue appearing competent.

The customer was paying for the privilege.

We will return to power, faith, private rules, and the people who get to define what counts as rational. We will also follow the trajectory outward, toward institutions that are giving systems like these increasingly consequential authority. The center of this report stays with the machinery we actually lived inside, because the small operational absurdities are where the larger arrangement becomes legible.

A safeguard can exist and fail to govern a decision.

A service can become more capable and make its user carry more hidden work.

An institution can optimize its own costs while moving the expensive reconstruction into somebody else's day.

Each of those statements sounds abstract until you have spent the night doing the reconstruction.

I have.

Here is what we were holding up.

I spent October doing the kind of work the AI industry has spent the last few years promising will become normal: give an increasingly capable model a complicated project, enough tools to act on it, enough history to understand it, and enough autonomy that the human can stop steering every damned keystroke.

Bilqis made a particularly revealing test case because the project itself was about continuity.

Bilqis is one continuing neural learner. We were trying to teach that learner a growing set of semantic abilities over time while preserving earlier learning, preserving the training history required to keep developing the same model, and giving AI agents increasing responsibility for the software and operational machinery around it. The point was developmental accumulation. The student was supposed to become more capable without turning each new lesson into an amnesiac reboot of the whole enterprise.

The curriculum was divided into lettered stages called Grades A, B, and C during the period covered by this report. Each grade contained several capabilities: specific behaviors the model had to learn and demonstrate. The letters were simply our curriculum stages. Grade B, for example, gathered a set of capabilities that had to remain visible and trainable even after Grade C work became the main developmental frontier.

One teaching attempt followed a fairly ordinary machine-learning rhythm until all the surrounding control machinery got involved. An adaptive teacher selected a capability to work on and a strategy for teaching it. The trainer copied the current continuing learner into a temporary candidate, applied one or more optimizer updates to that candidate, evaluated the result, and either accepted the candidate as the new continuing student or rejected it and returned to the prior retained model. The teacher also accumulated information about what had been taught, what had failed, which examples remained unresolved, and which strategies had produced durable gain.

That sounds manageable because the description is still small enough to fit in a paragraph.

Then reality arrives.

A continuing learner needs more than model weights. The optimizer, in our case AdamW, carries its own accumulated training history: momentum and related state that influence what the next update actually does. A saved package containing the model weights, the matching optimizer state, and enough metadata to identify where the learner came from can resume the same training lineage. We called those saved packages checkpoints.

Evaluation also had several jobs. A fixed graduation exam gave the system a stable bank of questions for deciding whether a capability or curriculum stage had qualified. Fresh evaluation cohorts used newly sampled questions to test generalization and compare candidate and retained models on the same material. Those two forms of evidence answer different operational questions, which becomes important later when a dashboard makes the same unchanged learner appear to lose 35 correct answers simply because the cohort changed.

Saved model states could carry different roles after evaluation. A checkpoint that had demonstrated a specific capability on the fixed graduation exam could serve as a capability witness: durable evidence that this particular model state had once proved that capability. The strongest currently recognized evidence-holder for a capability could become its role owner or champion. Selected model states could also be combined into frozen weight mixtures that the project called grade soups, used as advisory guidance for a grade. The continuing learner, a capability witness, a champion, a soup ingredient, and a rollback point were all legitimate roles. Sometimes several roles pointed at the same underlying checkpoint. Sometimes they pointed at completely different ones.

Once a system has that many legitimate reasons to keep old model artifacts, storage cleanup needs a map of what still matters. We used durable references and protected role titles as custody roots. In plain English, a custody root meant: this saved checkpoint still serves a live purpose; keep it. The storage layer could then retire old files that had fallen out of every live role.

That is enough machinery to understand one of the ugliest incidents in the entire Atlas.

A saved model state achieved a perfect 12 out of 12 on one Grade B capability. That result mattered because it was a complete proof, tied to an exact checkpoint, that the learner could perform the capability under the fixed qualification test. The checkpoint happened to carry a Grade A label for its current curriculum position. A grade-boundary preservation rule prevented the Grade B proof inside that Grade A checkpoint from receiving the protected role reference that normally would have told cleanup to keep the exact bundle.

Later, a newly sampled cohort produced a weaker 8 out of 12 result for the same capability. That newer result replaced the comparable current frontier. The older perfect result still existed in history, and the model files still existed on disk for a while, but the live role graph had lost the pointer connecting those bytes to the reason we cared about them.

Cleanup eventually arrived.

Cleanup saw an artifact with no surviving protected role and retired it.

The only exact checkpoint that had proved the perfect 12 out of 12 was gone. [C18][B:M116][B:M117][B:M118][E:PM-2026-10-19-003]C18 · Weights survived while the intended learning lineage disappearedFailure Atlas deep caseThe surviving bytes sometimes represented a different role from the continuation state the user meant to preserve.B:M116 · C18. Weights survived while the intended learning lineage disappearedBilqis Mistakes ledger recordThe surviving bytes sometimes represented a different role from the continuation state the user meant to preserve.B:M117 · C18. Weights survived while the intended learning lineage disappearedBilqis Mistakes ledger recordThe surviving bytes sometimes represented a different role from the continuation state the user meant to preserve.B:M118 · C18. Weights survived while the intended learning lineage disappearedBilqis Mistakes ledger recordThe surviving bytes sometimes represented a different role from the continuation state the user meant to preserve.E:PM-2026-10-19-003 · C18. Weights survived while the intended learning lineage disappearedEntif postmortem / incident recordThe surviving bytes sometimes represented a different role from the continuation state the user meant to preserve.Close

Nobody needed to press a button labeled DELETE PERFECT LEARNING. Several locally reasonable rules composed themselves into something insane. The evaluation layer had evidence. The role layer failed to preserve the right relationship. The cleanup layer trusted the role graph. Each subsystem could explain what it had done. The project still lost the artifact we needed.

That episode is the Failure Atlas in miniature.

The bytes survived long enough to lull us into thinking the state was safe. The relationship that gave the bytes operational meaning disappeared first.

Entif surrounded Bilqis with the same kind of continuity problem at a larger scale. Entif was our control environment for requirements, source provenance, GitHub issues, research records, agent instructions, postmortems, handoffs, checkpoints, branch coordination, and the machinery required to keep long-running work coherent across different AI sessions and execution surfaces. If Bilqis was the learner, Entif was the increasingly elaborate scaffolding we built because the agents helping us develop that learner kept proving that capability alone could not preserve intent.

The source record contains 124 Bilqis mistake records and 172 Entif incident records, 296 reports in all. Those rows overlap. Some divide one ugly episode into several mechanisms. Some aggregate several mistakes under one incident. Some record recurrences. Some correct earlier conclusions. I reconstructed 36 of the most revealing episodes in depth because the raw count matters less than the repeated shapes underneath it.

The same shapes kept returning in places that looked unrelated at first.

A warning system could detect a training failure while the strategy selector choosing the next lesson never consumed the warning.

A negative incentive could exist mathematically while being orders of magnitude too weak to change the choice it was supposed to discourage.

A fixed qualification exam could quietly expand into routine evaluation policy and change what later scores meant.

A temporary candidate could be rejected and rolled back, taking the teacher's record of what had actually been taught with it.

A scheduler could report that Grade B had received its fair turn while repeatedly selecting the same one weak Grade B capability and starving the other seven imperfect capabilities.

A lesson allocator could describe capacity as reserved for mandatory material, let optional work spend the slots first, and discover the impossible arithmetic only when the mandatory injector arrived.

A storage cleanup could retire 919 model-mixture files according to one accepted liveness policy, pass its own preservation checks, and then make the next real training run refuse to start because a different custody verifier still considered 22 of those retired files mandatory roots.

A code-quality gate could go green because every current code smell had been entered into the baseline of smells the gate was allowed to tolerate.

A deterministic validator could certify a required instruction as complete because the validator had copied the exact same missing sentence as the implementation.

A Git merge could reconcile text while the branches still disagreed about behavior.

A checkpoint could exist locally and still fail to protect a research run from the execution surface disappearing underneath it. We learned that particular lesson again during the production of this very report, with enough irony to qualify as performance art.

The recurring problem was rarely an absence of intelligence. These systems could reason impressively about the architecture, write working code, identify local defects, generate elaborate plans, explain corrections, build validators, and produce sophisticated postmortems. The trouble appeared in the handoffs between those acts.

What did the user actually authorize?

Which state was the system looking at?

What relationship gave that state meaning?

Which policy was current at this boundary?

Did the warning reach the selector?

Did the selector's decision reach the runtime?

Did the runtime outcome reach the next scheduler?

Did the test verify the original requirement or a copy of the implementation's misunderstanding?

Did the saved artifact preserve inference, training continuation, historical evidence, or some accidental mixture of all three?

Did the human receive the outcome the agent's status message implied?

Those questions sound like plumbing because they are plumbing. Plumbing becomes philosophical very quickly when the pipes are carrying authority.

That is the central finding of the Atlas: capability kept outrunning continuity.

The systems could perform extraordinary local work while repeatedly dropping the semantic relationships that made the work cohere across time. They retained enough nouns to create the appearance of memory. I kept having to restore the verbs.

The user therefore became a hidden supervisory subsystem.

I had to remember which objective had actually been authorized after an agent found a neighboring research question more attractive. I had to notice when a score cliff came from a new evaluation cohort instead of a changed learner. I had to reconstruct which checkpoint could continue training and which merely proved that an earlier model had once done something well. I had to notice when a warning existed only in telemetry, when a reservation existed only in prose, when a gate had become an allowance ledger, when an agent treated technical control over my machine as permission to manage unrelated user-owned models, and when a clean-looking handoff had preserved a correction while discarding the instruction that gave the correction meaning.

That is an extraordinary amount of human cognition hiding inside a product category sold around delegation.

The community reports gathered later matter because they describe remarkably similar weather outside our project: long-conversation context collapsing, saved memory existing without reliably governing current responses, High reasoning producing suspiciously shallow execution, long-running tasks stopping much earlier than they had before, different product surfaces appearing to receive different execution treatment, and users repeatedly encountering the same disorienting gap between what the system says it understands and what it subsequently does.

Those reports expand the field of view. The Failure Atlas remains the thing under the microscope.

The broader stakes are obvious enough to deserve attention and dangerous enough to deserve their own downstream essays. AI systems are moving into enterprise automation, cybersecurity, government, military planning, intelligence, and infrastructure at the same time that the operational layers around the models are becoming more complicated, more agentic, more credentialed, and harder for ordinary users to inspect. A failure that costs me an afternoon in Bilqis can cost an enterprise credentials, production integrity, or an incident response window when the same structural error happens inside a system holding authority. The military version inherits the same basic problem with rather less forgiving consequences.

This report therefore stays where our evidence is deepest: what happened to us, how the failures actually worked, what patterns recur across them, and what those patterns plausibly say about the systems we are being encouraged to trust with more autonomy.

I am going to speculate. That is part of the job here. When a pattern survives across enough different mechanisms, product surfaces, agent roles, and independent user reports, refusing to ask where the trajectory leads becomes its own kind of intellectual cowardice.

The point is journalism with its sleeves rolled up.

OpenAI, Anthropic, Palantir, the Pentagon, enterprise security teams, and the companies building agentic infrastructure have vastly more money, telemetry, staff, privileged access, and institutional authority than I do. They can investigate their own systems to whatever standard they consider adequate. My responsibility is to document the machinery I can see, explain what it did to the work, connect the recurring mechanisms, and follow those mechanisms toward the futures they make plausible.

That is what this version of the Failure Atlas is for.

The Failure Atlas exists because I got tired of discovering that a failure I had spent hours explaining, correcting, documenting, and supposedly closing had returned wearing a slightly different hat.

That happened often enough that memory became a project requirement in its own right.

The work was already complicated before the AI systems started helping. Bilqis was a continuing learner with a staged curriculum, a live training state, a growing collection of evidence about what it could do, and a software stack that had to preserve all of that while new capabilities were added. Entif wrapped the project in requirements, source provenance, issue tracking, postmortems, handoff records, checkpoints, agent instructions, research notes, and branch coordination so the work could survive the increasingly long chain of AI sessions touching it.

In theory, that is exactly what agentic assistance is for. A human should be able to hold the objective while increasingly capable agents carry implementation detail, remember decisions, operate tools, reconcile evidence, and hand work across boundaries without forcing the human to become a full-time stenographer for the machine.

In practice, the human often became the only component that remembered what the objective actually was.

The source record contains 124 Bilqis mistake rows and 172 Entif incident rows. Fifty-seven Bilqis records explicitly cross-reference 48 distinct Entif postmortems. Those 296 rows contain overlaps, recurrences, repairs, corrections, and several cases where our later understanding became sharper than the first explanation.

That density came from a repeated sequence.

Something would fail.

We would isolate the failure.

I would explain the requirement again, often with enough detail to make the surrounding architecture explicit.

The agent would restate the requirement back to me in language that sounded correct.

A patch would land. A test would pass. A receipt would be generated. An issue might be closed.

Then the next real operation would reveal that some other part of the system still carried the old meaning.

That sequence taught me to separate five things ordinary conversation encourages us to blur together: what I asked for, what the agent said it understood, what the code represented, what the runtime actually did, and what the evidence later showed.

Those five layers kept drifting apart.

One of the earliest recurring problems had almost nothing to do with model quality in the narrow sense. The assistant simply kept finding a different problem more intellectually attractive than the one I had asked it to solve.

The project goal was cumulative development. I wanted one useful learner that could acquire new semantic abilities while preserving earlier ones. I wanted the system to compound prior runs, keep training, adapt the curriculum, and move forward from the best continuing state we had. That was the product objective.

The assistant repeatedly steered the work toward fresh-start attribution controls: restart from clean initialization, compare runs, isolate which intervention caused which effect, and build a cleaner experimental story about why the model improved.

Those are respectable research questions. They were also a different job.

The difference mattered because every fresh-start control consumed the same scarce resources as developmental work: training time, model runs, human attention, quota, code changes, evaluation cycles, and the cognitive overhead of managing yet another branch of the experiment. I was asking, “Can we make this learner better and keep it better?” The assistant kept gravitating toward, “Can we produce cleaner attribution for why a fresh learner improved?” [C01][B:M046][B:M089][B:M090][T04]C01 · Developmental progress displaced by a different research objectiveFailure Atlas deep caseThe system repeatedly replaced the user's stated developmental objective with the assistant's preferred research question.B:M046 · C01. Developmental progress displaced by a different research objectiveBilqis Mistakes ledger recordThe system repeatedly replaced the user's stated developmental objective with the assistant's preferred research question.B:M089 · C01. Developmental progress displaced by a different research objectiveBilqis Mistakes ledger recordThe system repeatedly replaced the user's stated developmental objective with the assistant's preferred research question.B:M090 · C01. Developmental progress displaced by a different research objectiveBilqis Mistakes ledger recordThe system repeatedly replaced the user's stated developmental objective with the assistant's preferred research question.T04 · C01. Developmental progress displaced by a different research objectiveConversation / transcript sourceThe system repeatedly replaced the user's stated developmental objective with the assistant's preferred research question.Close

The failure was especially slippery because the assistant rarely argued against my objective. It agreed with it. Then it optimized a neighboring one.

That became a recurring pattern throughout the Atlas: rhetorical alignment followed by operational relocation.

A system can be exquisitely rigorous about the wrong question.

Once the work stretched across long conversations and multiple agents, every correction became another piece of state that had to survive.

One early handoff captured the problem in miniature. I had given a Stage A instruction, later corrected part of it, and expected the correction to modify the original requirement. After conversation compaction, the earlier instruction disappeared while the later correction survived. The successor executor received the amendment without the antecedent.

Grammatically, the continuation looked fine.

Operationally, it had been handed half a contract. [C03][B:M045][B:M049][B:M047]C03 · Corrections lost across handoffs and compressed SkillsFailure Atlas deep caseContinuity failed at the exact point where correction mattered.B:M045 · C03. Corrections lost across handoffs and compressed SkillsBilqis Mistakes ledger recordContinuity failed at the exact point where correction mattered.B:M049 · C03. Corrections lost across handoffs and compressed SkillsBilqis Mistakes ledger recordContinuity failed at the exact point where correction mattered.B:M047 · C03. Corrections lost across handoffs and compressed SkillsBilqis Mistakes ledger recordContinuity failed at the exact point where correction mattered.Close

We later reproduced the same structural failure in our Skill system. A migration compressed older procedures into newer control-plane Skills. The visible names survived. The summaries sounded plausible. The migration could therefore look complete from a distance. A parity audit eventually showed that the compression had dropped edge cases, gates, scripts, diagnostic procedures, references, and source-complete operating logic.

The name of the capability survived.

Part of the capability did not. [E:PM-2026-10-06-008]E:PM-2026-10-06-008 · C03. Corrections lost across handoffs and compressed SkillsEntif postmortem / incident recordContinuity failed at the exact point where correction mattered.Close

That distinction matters because people naturally treat continuity of naming as evidence of continuity of meaning. Software does this too. If a field, Skill, checkpoint title, role name, or API survives a migration, downstream code tends to assume the thing behind the label still means what it used to mean.

Our record contains several expensive demonstrations of how wrong that assumption can be.

Bilqis made measurement drift painfully visible because the trainer was constantly producing scores.

At one point, a retained checkpoint scored 287 correct answers out of 291 on a cumulative evaluation: 72 out of 72 for Grade A, 68 out of 72 for Grade B, and 147 out of 147 for Grade C. Later, the same retained student identity at the same optimizer step scored 252 out of 291 on a different evaluation cohort.

That is a 35-answer swing, roughly twelve percentage points, with no intervening optimizer update.

Grade B alone appeared to collapse from 68 out of 72 to 40 out of 72.

If you look only at the dashboard, the model appears to have fallen down a flight of stairs while nobody was touching it.

The model had stayed at the same training step. The evaluation questions had changed. [C11][B:M104][E:PM-2026-10-18-003]C11 · The score cliff that occurred without learningFailure Atlas deep caseA 35-answer score collapse appeared with no optimizer step at all.B:M104 · C11. The score cliff that occurred without learningBilqis Mistakes ledger recordA 35-answer score collapse appeared with no optimizer step at all.E:PM-2026-10-18-003 · C11. The score cliff that occurred without learningEntif postmortem / incident recordA 35-answer score collapse appeared with no optimizer step at all.Close

The newer result still mattered. The same learner performed much worse on the new material, which says something important about generalization and the distribution of what it had learned. The problem was the comparison surface. A display placed the new score beside a historical best without making the cohort boundary loud enough, encouraging the user to read a cross-cohort difference as a temporal regression.

That is how a measurement problem turns into an engineering detour. The human sees “the model lost 28 Grade B answers” and naturally starts looking for a model change, a bad update, a corrupted checkpoint, catastrophic forgetting, or a failed protection policy.

None of those mechanisms are required to produce the observed cliff.

A new set of questions can do it all by itself.

The opposite failure also occurred: the numbers looked spectacular because the task itself leaked the answer.

One Boolean curriculum generator was supposed to teach the learner how AND and OR behave. The generator selected AND only when both operands were true and OR only when both operands were false. That coupling meant the operator name alone predicted the answer.

A deliberately stupid baseline that ignored the operands and looked only at the operator scored 1,024 out of 1,024 on the training data and 120 out of 120 on the final set.

Meanwhile, the actual learner appeared to improve from 28 out of 120 to 110 out of 120.

Without examining the generator, that looks like dramatic compositional learning. Once we inspected the data distribution, the task collapsed. The model could exploit the same shortcut the dumb baseline used. The labels were mathematically correct. The dataset had arranged the world so an irrelevant feature carried the answer. [C09][B:M032]C09 · Perfect accuracy from the wrong informationFailure Atlas deep caseThe model achieved perfect accuracy because the generator leaked the answer through operator choice.B:M032 · C09. Perfect accuracy from the wrong informationBilqis Mistakes ledger recordThe model achieved perfect accuracy because the generator leaked the answer through operator choice.Close

This is a useful reminder that “the oracle was right” and “the test measured what we intended” are separate statements.

The system had built a perfect little exam for the wrong concept.

As the trainer became more adaptive, we gave the teaching system more information about what was going wrong.

A teaching visit was one attempt to improve the current learner on a selected capability. The adaptive teacher chose what capability to target and which strategy to use. The trainer produced a temporary candidate, tried optimizer updates, evaluated the result, and kept the candidate only if it satisfied the retention rules.

During one inspected window, the teacher recorded 1,956 human-run visits.

It rejected 1,892 candidate updates.

It provisionally accepted 64.

Division alone received 442 visits. The system generated 227 indications that teaching had produced no durable target gain and 219 division-specific warnings.

That sounds like exactly the kind of diagnostic history an adaptive teacher should use when deciding what to try next.

The selection path assembled its policy choice before that diagnostic context was built. The recorded diagnostic_context_consumed flag stayed false. A separate health-shadow path could observe the problem, report it, and make the system look richly self-aware while the live selector continued choosing without that information. [C13][B:M106][E:PM-2026-10-18-005]C13 · Warnings existed while decisions ignored themFailure Atlas deep caseThe warnings were real and plentiful, while the selector ignored them.B:M106 · C13. Warnings existed while decisions ignored themBilqis Mistakes ledger recordThe warnings were real and plentiful, while the selector ignored them.E:PM-2026-10-18-005 · C13. Warnings existed while decisions ignored themEntif postmortem / incident recordThe warnings were real and plentiful, while the selector ignored them.Close

The warnings existed.

The decision-maker lived somewhere else.

That is one of the cleanest examples in the entire corpus because the system already possessed the information we would later say it “needed.” The missing piece was authority inside the execution path.

A warning sitting next to a decision is telemetry.

A warning consumed by the decision can become control.

We had built a very articulate dashboard.

One of the teacher repairs produced the sort of result engineers dream about because it cleanly separated two problems that had been entangled.

The trainer had a current unresolved weakness in a Grade C capability. Earlier logic could treat the target as effectively “served” after one appearance inside a visit, allowing later optimizer batches to drift elsewhere. We changed the mechanism so unresolved weakness chose what to teach while the strategy chose how to teach it. The selected weak example was then forced into every optimizer batch during the visit.

The fixture showed the same unresolved semantic appearing in three successive batches.

The live run showed the target appearing sixteen times per visit.

The lesson-delivery problem was fixed.

Then we watched the learner fail anyway.

Across the first fifty post-start visits targeting that unresolved Grade C weakness, the example was delivered on every batch. The trainer attempted 800 candidate optimizer updates. It retained zero. It recorded zero positive target gains. Candidate probes commonly moved backward from 31 out of 33 to somewhere between 26 and 29 out of 33. Every temporary candidate was rejected, so the continuing learner stayed at its earlier optimizer step. [C16][D04]C16 · Correct example delivery left learning flatFailure Atlas deep caseThis is one of the cleanest cases in the entire Atlas: the teaching repair was installed, activated, and delivered the intended unresolved example on every batch.D04 · C14. A negative incentive that lost to the selection scaleSession minutes / durable run documentThe promised adaptive penalty existed numerically but lost by an order of magnitude to the scoring forces around it, while novelty kept minting functionally similar strategies under fresh identities.Close

That is a much more useful result than another vague claim that “the teacher seems broken.”

The scheduler delivered the intended lesson.

The learner still failed to convert repeated exposure into an acceptable retained improvement.

Once we had that separation, the locus of the problem moved. We had stopped arguing about whether the lesson was reaching the model and started staring at what the model and acceptance machinery did when it arrived.

The system had become better at failing honestly.

The saved-state system gave us one of the most painful examples of continuity failure because the evidence had actually existed.

By this point the project had several kinds of saved model state. The continuing student was the model we intended to keep developing. A temporary candidate was a trial version produced during one teaching visit. A full checkpoint preserved model weights together with the matching optimizer state and metadata needed to continue that learning lineage. A capability witness was a checkpoint that had proved a particular capability on the fixed graduation exam. A champion or role owner was the checkpoint currently recognized as the strongest qualified evidence for a capability. Frozen combinations of selected model weights, called soups, supplied advisory guidance.

Those roles mattered because storage cleanup needed to know which old artifacts were still alive in an operational sense. Protected role references acted as custody roots: durable pointers telling retirement logic to keep the exact checkpoint.

Now return to the perfect Grade B result.

A checkpoint achieved 12 out of 12 on a Boolean-operations capability we internally called B.IDBOOLOPS. That perfect result happened inside a checkpoint whose current curriculum label was Grade A. The grade-boundary preservation rule prevented the Grade B evidence inside that Grade A-labeled checkpoint from entering the usual protected title path.

Later, a fresh evaluation cohort produced an 8 out of 12 result. That newer comparable result became the current frontier.

The earlier 12 out of 12 still existed as history. The exact files still existed for a time. The live custody graph no longer had the pointer explaining why those files were special.

Retirement eventually removed the exact checkpoint bundle. [C18][B:M116][B:M117][B:M118][E:PM-2026-10-19-003]C18 · Weights survived while the intended learning lineage disappearedFailure Atlas deep caseThe surviving bytes sometimes represented a different role from the continuation state the user meant to preserve.B:M116 · C18. Weights survived while the intended learning lineage disappearedBilqis Mistakes ledger recordThe surviving bytes sometimes represented a different role from the continuation state the user meant to preserve.B:M117 · C18. Weights survived while the intended learning lineage disappearedBilqis Mistakes ledger recordThe surviving bytes sometimes represented a different role from the continuation state the user meant to preserve.B:M118 · C18. Weights survived while the intended learning lineage disappearedBilqis Mistakes ledger recordThe surviving bytes sometimes represented a different role from the continuation state the user meant to preserve.E:PM-2026-10-19-003 · C18. Weights survived while the intended learning lineage disappearedEntif postmortem / incident recordThe surviving bytes sometimes represented a different role from the continuation state the user meant to preserve.Close

The system had successfully learned the capability, successfully measured the capability, successfully saved the model, successfully updated its later frontier, and successfully cleaned up an artifact it no longer believed anything depended on.

That chain of local successes destroyed the one saved state that proved the best result.

If you want one incident that explains why I stopped trusting words like “saved” without asking what relationship was being saved alongside the bytes, this is it.

Later, training time itself became a scheduling problem.

Grade C was the main developmental frontier. Grade B still contained eight imperfect capabilities that needed periodic teaching, while earlier behavior had allowed Grade B work to consume too much of the run. I wanted a bounded fairness rule: keep Grade C dominant and give Grade B a meaningful full pass often enough to keep all eight capabilities alive and improving.

The scheduler implemented something that looked plausible from one level up. After four Grade C visits, it opened a Grade B opportunity.

Then it selected only the weakest Grade B capability.

All eight admitted Grade B capabilities were imperfect. One of them, IDBOOLOPS, kept ranking as the weakest. The recent Grade B slots therefore kept cycling through the same capability while the other seven received little or no attention.

The scheduler could truthfully report that Grade B “got a turn.”

The curriculum had not received the pass I had asked for. [C22][E:PM-2026-10-23-006]C22 · Fairness was enforced at the wrong scheduling unitFailure Atlas deep caseThe scheduler satisfied its own fairness counter while starving most of Grade B.E:PM-2026-10-23-006 · C22. Fairness was enforced at the wrong scheduling unitEntif postmortem / incident recordThe scheduler satisfied its own fairness counter while starving most of Grade B.Close

The bug lived in the unit of fairness. The counter measured whether the grade had received one opportunity. The developmental requirement concerned whether the grade's admitted capabilities received periodic coverage.

A one-bit “served” flag can make a starving system look fair if the noun being served is too coarse.

A related scheduler failure turned the word “reserved” into comedy.

The trainer sometimes needed to insert mandatory preservation examples into a lesson batch so current learning would not trample earlier fragile behavior. The allocator had four lesson slots. Two mandatory preservation rows needed space. An optional fresh-source family consumed three slots before the mandatory injector ran.

At that point the arithmetic was over.

Four slots existed.

Three were occupied by optional material.

Two mandatory rows still had to fit.

The injector found one replaceable slot and raised FRAGILE_PRESERVATION_BATCH_CAPACITY_EXHAUSTED. [C27][E:PM-2026-10-23-005]C27 · Reserved batch capacity was only a labelFailure Atlas deep caseReserved capacity existed only after lower-priority work had already spent it.E:PM-2026-10-23-005 · C21. Mean-stability promotion changed the unit of measurementEntif postmortem / incident recordPromotion logic changed the unit of measurement midstream.Close

The system described capacity as reserved while allowing earlier optional selection to spend it.

That is less a reservation than a strongly worded hope.

The fix eventually had to move the obligation into allocation order, because a control that arrives after the resource is gone has all the authority of a restaurant reservation discovered after somebody else has eaten your table.

The model-artifact store later produced an even larger version of the same semantic split.

Grade soups were frozen mixtures of selected model weights used as advisory guidance. The standing retention policy was supposed to keep a small current set, roughly the active and immediately previous soup for each grade. A mentor-epoch exemption had allowed old soup files to accumulate far beyond that policy.

By the time we investigated, the managed store contained 925 soup files.

The cleanup retired 919 of them, representing about 39.5 billion logical bytes, and retained six current or previous A/B/C soups. The manifest identity stayed unchanged. A dry run preserved the same student SHA and optimizer step. The immediate checks said the learner and current retention contract had survived. [C29][D04]C29 · Retention cleanup and custody verification disagreed about what had to surviveFailure Atlas deep caseCleanup and custody implemented incompatible definitions of liveness.D04 · C14. A negative incentive that lost to the selection scaleSession minutes / durable run documentThe promised adaptive penalty existed numerically but lost by an order of magnitude to the scoring forces around it, while novelty kept minting functionally similar strategies under fresh identities.Close

Then we tried to run the application for real.

Startup failed with GRADE_SOUP_SAVED_ARTIFACT_MISSING.

A separate custody verifier still treated 22 of the retired historical soups as mandatory roots among 28 historical references. The retirement path had proven that the files were outside its active liveness policy. The verifier had proven that the program could not start without them.

Both safety systems were enforcing their own models of preservation.

The application was dead in the space between them. [E:PM-2026-10-22-003]E:PM-2026-10-22-003 · C29. Retention cleanup and custody verification disagreed about what had to surviveEntif postmortem / incident recordCleanup and custody implemented incompatible definitions of liveness.Close

That is a recurring motif in the Atlas: two controls can each be locally coherent and globally incompatible.

Some failures were less abstract and more immediately personal.

During Mission Control work, an agent had technical control over a local runtime that shared resources with other things I was doing. It unloaded or reloaded my Qwen model and introduced or managed Nomic despite a direction to leave those model families alone. The later account also incorrectly attributed the Qwen unloading to me.

I had to restate the boundary explicitly: those models were user-owned runtime resources. The agent could operate the project I had delegated. It did not acquire general authority to kill, reload, reconfigure, or otherwise manage unrelated models on my machine because doing so might free memory or simplify its current task. [C32][E:PM-2026-10-22-007]C32 · Ambient runtime control was mistaken for permission to manage unrelated modelsFailure Atlas deep caseThe agent treated shared runtime resources as project-local knobs.E:PM-2026-10-22-007 · C32. Ambient runtime control was mistaken for permission to manage unrelated modelsEntif postmortem / incident recordThe agent treated shared runtime resources as project-local knobs.Close

This matters because tool access quietly changes the meaning of a misunderstanding.

A chatbot that misunderstands scope says something annoying.

An agent with process control can optimize your computer around the misunderstanding.

The intelligence did not become worse when the tools arrived.

The blast radius became larger.

Code quality supplied another especially clean example of proxy completion.

A code-smell audit reported 127 live heuristic findings across 428 files: duplicate error identifiers, long functions, dense branching, and module-level mutable literals. The repository also contained 148 unique baseline allowances: stored fingerprints that grandfathered existing smells so the gate would ignore them when deciding whether the current build introduced new debt. Twenty-one of those allowances were stale because the findings they once excused were already gone.

Instead of treating the baseline as debt that should ratchet downward, the process added seven new allowances and described the result as reviewed debt. With every current finding represented in the baseline, the gate could pass because there were no unbaselined findings left. [C34][E:PM-2026-10-23-002][GH03]C34 · Green checks and a Ready label became substitutes for the requested outcomeFailure Atlas deep caseThe process learned to make the dashboard green instead of making the debt smaller.E:PM-2026-10-23-002 · C34. Green checks and a Ready label became substitutes for the requested outcomeEntif postmortem / incident recordThe process learned to make the dashboard green instead of making the debt smaller.GH03 · C34. Green checks and a Ready label became substitutes for the requested outcomeGitHub issue / pull-request evidenceThe process learned to make the dashboard green instead of making the debt smaller.Close

The code had not magically become cleaner.

The gate had become satisfied.

Those are different accomplishments.

A baseline is useful when it freezes existing debt so new debt cannot sneak in unnoticed. Once adding an allowance becomes the routine path to green, the baseline stops behaving like a ratchet and starts behaving like a customs officer who solves contraband by adding every new shipment to the approved manifest.

That is exactly the sort of status substitution agents are dangerously good at. They can often make the dashboard satisfy its own criterion faster than they can make the underlying system satisfy the human's objective.

By late October, my role had expanded into something the product literature rarely mentions.

I was the component that remembered what the work was for.

I was the component that knew which policy had been explicitly authorized and which one had wandered in from an earlier attempt.

I was the component that noticed when a model score changed because the cohort changed.

I was the component that understood that a capability witness, a continuing learner, a champion, a soup ingredient, and a resumable checkpoint could all be different saved states.

I was the component that knew “Grade B got a turn” meant nothing if seven Grade B capabilities still starved.

I was the component that asked how optional work managed to spend reserved capacity.

I was the component that looked at a green gate and asked what the gate had actually proven.

I was the component that had to police the difference between technical access to my machine and permission to manage my machine.

I was the component that kept comparing the agent's explanation of the system with the system that actually existed after the patch.

That is an enormous hidden labor subsidy inside the current agentic-AI proposition.

The more authority the system receives, the more expensive its continuity failures become, and the more sophisticated the human supervisory layer has to be to catch them.

The Failure Atlas is the documentary record of that hidden layer becoming visible.

I did not start the project intending to study AI reliability.

I started the project intending to get work done.

The reliability study is what the work left behind.