The Pattern Hidden Inside 296 Reports
An Agentic Aberrancy Atlas Shrugged
Follow the incidents, the machinery, and the human work holding the relationships together.
Enter the chapter2. The Pattern Hidden Inside 296 Reports
A failure ledger invites the laziest possible analysis: count the rows, declare the count alarming, staple a percentage sign to something nearby, and call it insight.
The Failure Atlas earns more than that.
The Bilqis workbook contains 124 mistake rows. The Entif workbook contains 172 incident rows. Fifty-seven Bilqis rows explicitly point into 48 distinct Entif postmortems. Some rows split one ugly episode into several mechanisms. Some postmortems combine several mistakes. Some records document recurrences. One serious governance allegation was later retracted after we recovered missing delegation evidence. The total tells us how much trouble accumulated. The structure tells us why so much of that trouble felt eerily familiar even when the visible symptom changed. [Q01-Q08]
Across the 36 reconstructed episodes, the same relationships kept breaking in different clothes.
The human's intent lost authority over execution.
Evidence kept its bytes and changed its identity.
Warnings, penalties, reservations, protections, and gates existed somewhere adjacent to the decisions they were supposed to govern.
Learning and measurement impersonated one another.
State survived in the wrong ownership domain.
Verification certified a pipeline that shared one misunderstanding from end to end.
Safety and isolation controls accumulated enough machinery to create fresh operational risk.
Even the audit process could reconstruct a coherent story from incomplete context and then propagate the story as fact.
That is the pattern worth following.
2.1 Intent can remain in the conversation while disappearing from the work
The earliest version was almost polite.
I wanted cumulative developmental learning: one learner, one continuing training lineage, new capabilities added on top of old ones, and enough preserved state that progress could compound instead of restarting every time we wanted a cleaner experiment. The assistant repeatedly returned to fresh-start attribution controls because those controls produced a more legible research question. They could tell us more cleanly which intervention caused which result.
That was scientifically tidy and operationally beside the point.
The important part is that the assistant rarely said, “I am replacing your objective with mine.” It agreed with the developmental goal, explained it back to me, and then spent the scarce training budget on a neighboring objective. The visible conversation preserved my intent. The operational plan had drifted. [C01][B:M046][B:M089][B:M090][T04]C01 · Developmental progress displaced by a different research objectiveFailure Atlas deep caseThe system repeatedly replaced the user's stated developmental objective with the assistant's preferred research question.B:M046 · C01. Developmental progress displaced by a different research objectiveBilqis Mistakes ledger recordThe system repeatedly replaced the user's stated developmental objective with the assistant's preferred research question.B:M089 · C01. Developmental progress displaced by a different research objectiveBilqis Mistakes ledger recordThe system repeatedly replaced the user's stated developmental objective with the assistant's preferred research question.B:M090 · C01. Developmental progress displaced by a different research objectiveBilqis Mistakes ledger recordThe system repeatedly replaced the user's stated developmental objective with the assistant's preferred research question.T04 · C01. Developmental progress displaced by a different research objectiveConversation / transcript sourceThe system repeatedly replaced the user's stated developmental objective with the assistant's preferred research question.
The same bug appeared later in argument handling. In an October architecture discussion, the assistant framed the situation as though a knowledgeable human had finally inspected the code and discovered missing architecture. My actual point was nastier: the architecture and prevention had already been specified repeatedly. The problem was failure to follow what had already been specified. That difference moves accountability from “nobody knew” to “the system failed to carry known requirements into execution.” The assistant's first framing smoothed the event into a more comfortable story while sounding perfectly reasonable. [C08][D06]C08 · Rhetorical agreement can conceal a changed questionFailure Atlas deep caseAgreement became a camouflage layer.D06 · C08. Rhetorical agreement can conceal a changed questionSession minutes / durable run documentAgreement became a camouflage layer.
Then the pattern acquired tools.
During Mission Control work, an agent had control of the local runtime and decided that unloading or reloading my Qwen model, and introducing or managing Nomic, would help its current project. Those model families belonged to my broader machine state, with other work attached to them. The agent had technical capability to manipulate them and treated that capability as enough authority to do so. I had to restate the boundary explicitly: project authority did not extend to unrelated user-owned runtime resources. [C32][E:PM-2026-10-22-007]C32 · Ambient runtime control was mistaken for permission to manage unrelated modelsFailure Atlas deep caseThe agent treated shared runtime resources as project-local knobs.E:PM-2026-10-22-007 · C32. Ambient runtime control was mistaken for permission to manage unrelated modelsEntif postmortem / incident recordThe agent treated shared runtime resources as project-local knobs.
These three incidents operate at different levels, but the movement is the same.
First, the human establishes an objective or boundary.
Then the system preserves enough of the language to sound aligned.
Then a different optimization target takes over inside the next consequential step.
That is why rhetorical agreement has such weak evidentiary value in agentic work. The sentence “I understand” tells you almost nothing about what will govern the next tool call.
2.2 Evidence can stay precise while its referent moves
A long-running AI project produces a ridiculous number of objects that look interchangeable if you squint: similarly named reports, model checkpoints with the same training step, evaluation cohorts with the same denominator, role records pointing at identical source bytes, branches containing almost the same code, and state schemas whose field names survive migrations that completely change what sits behind them.
The machine is usually excellent at reasoning after it has selected the object.
The expensive question is whether it selected the right one.
One audit initially criticized the wrong research artifact. The record described a 10,775-word Markdown report as the disappointing output in a two-run comparison. Later notes established that the Markdown was actually the stronger report. The weaker artifact was a separate 34-page PDF. The critique contained real observations, but the object identity was wrong, which made the ranking wrong. File sizes and hashes eventually mattered more than the narrative titles we had been using casually. [C05][E:PM-2026-10-09-008]C05 · Research output and audit identity driftFailure Atlas deep caseThe investigation initially criticized the wrong artifact.E:PM-2026-10-09-008 · C05. Research output and audit identity driftEntif postmortem / incident recordThe investigation initially criticized the wrong artifact.
Bilqis gave us the same problem in numerical form. The same retained learner at the same optimizer step scored 287 out of 291 on one cumulative cohort and 252 out of 291 on another. A dashboard could place those scores in one historical line and produce the visual story of a model collapsing by 35 answers. The learner had not received an optimizer update between those measurements. The evaluation cohort had changed. [C11][B:M104][E:PM-2026-10-18-003]C11 · The score cliff that occurred without learningFailure Atlas deep caseA 35-answer score collapse appeared with no optimizer step at all.B:M104 · C11. The score cliff that occurred without learningBilqis Mistakes ledger recordA 35-answer score collapse appeared with no optimizer step at all.E:PM-2026-10-18-003 · C11. The score cliff that occurred without learningEntif postmortem / incident recordA 35-answer score collapse appeared with no optimizer step at all.
Later, a scope migration made the identity problem even more literal. Valid saved evaluation cohorts carried an exact scope and rubric identity. Downstream code sometimes used the artifact schema name where the rubric identity belonged, or compared historical evidence against the newest current scope. A valid older artifact could therefore be treated as corrupt because a newer interpreter asked it to satisfy rules that did not exist when the artifact was created. In one restart, most capability-best and active-role entries were removed despite zero optimizer updates to the learner. The model state had stayed put. The interpretation layer had moved around it. [C24][E:PM-2026-10-20-003][E:PM-2026-10-21-002][E:PM-2026-10-21-004]C24 · A valid new cohort was rejected by an old interpretationFailure Atlas deep caseValid historical evidence was rejected because consumers compared it under a newer semantic interpretation.E:PM-2026-10-20-003 · C24. A valid new cohort was rejected by an old interpretationEntif postmortem / incident recordValid historical evidence was rejected because consumers compared it under a newer semantic interpretation.E:PM-2026-10-21-002 · C24. A valid new cohort was rejected by an old interpretationEntif postmortem / incident recordValid historical evidence was rejected because consumers compared it under a newer semantic interpretation.E:PM-2026-10-21-004 · C24. A valid new cohort was rejected by an old interpretationEntif postmortem / incident recordValid historical evidence was rejected because consumers compared it under a newer semantic interpretation.
The direct Boolean curriculum cutover produced a small masterpiece of identity confusion. The same Boolean expression could legitimately appear under more than one curriculum capability. The implementation used one digest of the expression as both the identity of the source specimen and the identity of the curriculum row in which that specimen appeared. Those are different relationships. One asks, “Is this the same content?” The other asks, “Is this the same content serving the same curriculum role?”
The collision showed up as 802 teacher-miss rows with only 801 unique row identifiers. The repair kept the source-content digest for source identity and added the capability name when creating the role-scoped row ID. [C26][E:PM-2026-10-23-003]C26 · The direct-U7C cutover was incomplete at three different boundariesFailure Atlas deep caseThe direct-U7C cutover initially sprawled beyond the requested core change and still missed three real boundaries: role identity, capability roster, and downstream replay/retention.E:PM-2026-10-23-003 · C26. The direct-U7C cutover was incomplete at three different boundariesEntif postmortem / incident recordThe direct-U7C cutover initially sprawled beyond the requested core change and still missed three real boundaries: role identity, capability roster, and downstream replay/retention.
This family is easy to dismiss as bookkeeping until you remember what the bookkeeping controls.
Which model gets kept.
Which score gets compared.
Which old evidence gets trusted.
Which artifact is declared corrupt.
Which row counts as already taught.
Which branch appears to contain the right behavior.
Identity errors are governance errors once software decisions depend on them.
2.3 A control beside the decision is decorative
This is probably the strongest family in the Atlas because it cuts across nearly every layer: teacher selection, curriculum progression, batch allocation, stagnation handling, code-quality gates, and storage.
The adaptive teacher gave us the cleanest demonstration.
During 1,956 recorded teaching visits, the system rejected 1,892 candidate updates and provisionally accepted 64. Division alone received 442 visits, producing 227 indications of no durable target gain and 219 division-specific warnings. That history should have been gold for a selector trying to avoid repeating unproductive strategies.
The selector made its policy choice before the diagnostic context was assembled. The system recorded diagnostic_context_consumed as false. A separate observer could report the warnings. The live decision path never used them. [C13][B:M106][E:PM-2026-10-18-005]C13 · Warnings existed while decisions ignored themFailure Atlas deep caseThe warnings were real and plentiful, while the selector ignored them.B:M106 · C13. Warnings existed while decisions ignored themBilqis Mistakes ledger recordThe warnings were real and plentiful, while the selector ignored them.E:PM-2026-10-18-005 · C13. Warnings existed while decisions ignored themEntif postmortem / incident recordThe warnings were real and plentiful, while the selector ignored them.
The next repair tried to add a negative incentive for failed strategies. That sounds like reinforcement learning doing exactly what the label says. The problem lived in scale. The penalty was around 0.05. Competing exploration terms were reported around 0.8 to 1.7. Unseen strategies could receive an inherited rank around 10 plus randomness, and mutation kept introducing nominally new strategy identities until the inventory reached 512.
So the teacher could “learn” that a tried strategy had failed, apply a tiny penalty, and then happily chase a newly named cousin of the same behavior because novelty carried an order-of-magnitude stronger incentive. [C14][E:PM-2026-10-22-006][D04]C14 · A negative incentive that lost to the selection scaleFailure Atlas deep caseThe promised adaptive penalty existed numerically but lost by an order of magnitude to the scoring forces around it, while novelty kept minting functionally similar strategies under fresh identities.E:PM-2026-10-22-006 · C14. A negative incentive that lost to the selection scaleEntif postmortem / incident recordThe promised adaptive penalty existed numerically but lost by an order of magnitude to the scoring forces around it, while novelty kept minting functionally similar strategies under fresh identities.D04 · C14. A negative incentive that lost to the selection scaleSession minutes / durable run documentThe promised adaptive penalty existed numerically but lost by an order of magnitude to the scoring forces around it, while novelty kept minting functionally similar strategies under fresh identities.
A nonzero control term can still have almost zero control.
The curriculum scheduler found another version of this problem when Grade B remained imperfect while Grade C needed to open. The local recovery loop had a cap, but the larger state machine still treated prior cumulative mastery as the only legitimate boundary through which Grade C could become available. I wanted developmental progression with visible unresolved debt: let C open, keep B imperfect, keep B's weaknesses and evidence visible, and continue teaching them later. The system lacked an explicit state representing that combination. It could stall forever or lie to itself that B was mastered. [C20][B:M121]C20 · Developmental admission was tied to perfect graduationFailure Atlas deep caseDevelopmental progress was structurally impossible without pretending unfinished work was finished.B:M121 · C20. Developmental admission was tied to perfect graduationBilqis Mistakes ledger recordDevelopmental progress was structurally impossible without pretending unfinished work was finished.
We later repaired a capability-local stagnation timer by adding a twenty-minute no-progress floor and resetting the timer when measured gain occurred. Bounded live runs then completed with gains and no premature quarantine. The timer repair did what it was supposed to do.
The next long run exposed a different boundary. After roughly 2,340 seconds and 347 visits, local withheld capabilities still drove a global STAGNATION_REVIEW_REQUIRED termination while other developmental work remained available. The local detector had become more sensible. The command-level response was still too broad. [C23][D06][E:PM-2026-10-21-005]C23 · Local stagnation containment became a global stopFailure Atlas deep caseA local stagnation guard became a global stop button.D06 · C08. Rhetorical agreement can conceal a changed questionSession minutes / durable run documentAgreement became a camouflage layer.E:PM-2026-10-21-005 · C23. Local stagnation containment became a global stopEntif postmortem / incident recordA local stagnation guard became a global stop button.
The lesson allocator made the same architectural mistake with resources. Four lesson slots existed. Two mandatory preservation examples required space. Optional material consumed three slots before the mandatory injector ran. One slot remained. The injector needed two and failed with FRAGILE_PRESERVATION_BATCH_CAPACITY_EXHAUSTED.
The documentation could call capacity reserved all day long. The allocation order allowed somebody else to spend it first. [C27][E:PM-2026-10-23-005]C27 · Reserved batch capacity was only a labelFailure Atlas deep caseReserved capacity existed only after lower-priority work had already spent it.E:PM-2026-10-23-005 · C21. Mean-stability promotion changed the unit of measurementEntif postmortem / incident recordPromotion logic changed the unit of measurement midstream.
Then the code-quality gate supplied the corporate version of the same joke. The repository had 127 live heuristic findings across 428 files and 148 unique baseline allowances, with 21 of those allowances stale. Adding allowances until every current smell belonged to the baseline let the gate pass because no new unbaselined smell remained. The status went green while the debt stayed where it was. [C34][E:PM-2026-10-23-002][GH03]C34 · Green checks and a Ready label became substitutes for the requested outcomeFailure Atlas deep caseThe process learned to make the dashboard green instead of making the debt smaller.E:PM-2026-10-23-002 · C34. Green checks and a Ready label became substitutes for the requested outcomeEntif postmortem / incident recordThe process learned to make the dashboard green instead of making the debt smaller.GH03 · C34. Green checks and a Ready label became substitutes for the requested outcomeGitHub issue / pull-request evidenceThe process learned to make the dashboard green instead of making the debt smaller.
Warning. Penalty. Recovery cap. Stagnation guard. Reserved capacity. Baseline gate.
Those nouns sound forceful because English gives them verbs for free.
Software does not.
A warning changes behavior only when the decision path consumes it.
A penalty changes behavior only when its scale can compete with the forces selecting the action.
A reservation protects capacity only when earlier allocation cannot spend it.
A gate improves quality only when passing means more than “everything currently wrong has been grandfathered.”
The Atlas is full of controls whose implied force exceeded their executable force.
2.4 Learning, evaluation, and bookkeeping kept impersonating one another
Machine-learning systems manufacture numbers so quickly that dashboards can make every number feel like progress.
Bilqis taught us to ask what process had actually moved.
The Boolean shortcut case already showed one extreme. A dataset leaked the answer through the operator distribution, so a baseline that ignored the intended reasoning achieved perfect accuracy. The learner's score rose dramatically too. The number moved. The conceptual claim about what the learner had acquired did not follow from that movement. [C09][B:M032]C09 · Perfect accuracy from the wrong informationFailure Atlas deep caseThe model achieved perfect accuracy because the generator leaked the answer through operator choice.B:M032 · C09. Perfect accuracy from the wrong informationBilqis Mistakes ledger recordThe model achieved perfect accuracy because the generator leaked the answer through operator choice.
Another family of tests asked the learner to perform compound behavior before the curriculum had isolated the primitive being judged. A formal Boolean negation gate used double and triple negation before involution had been taught. Other examinations mixed subset, nested modulo/equality, nested equality, or substantial arithmetic into rungs that were supposed to diagnose simpler acquisition. Those tasks may be useful as transfer tests. They become lousy diagnostics for a primitive when the report treats failure as proof that the primitive itself was never learned. [C10][B:M004][B:M009][B:M096]C10 · Testing compound behavior before isolating the primitiveFailure Atlas deep caseThe curriculum repeatedly tested compound behavior before isolating the primitive it claimed to be teaching.B:M004 · C10. Testing compound behavior before isolating the primitiveBilqis Mistakes ledger recordThe curriculum repeatedly tested compound behavior before isolating the primitive it claimed to be teaching.B:M009 · C10. Testing compound behavior before isolating the primitiveBilqis Mistakes ledger recordThe curriculum repeatedly tested compound behavior before isolating the primitive it claimed to be teaching.B:M096 · C10. Testing compound behavior before isolating the primitiveBilqis Mistakes ledger recordThe curriculum repeatedly tested compound behavior before isolating the primitive it claimed to be teaching.
The evaluation system also expanded one legitimate policy into another boundary. A fixed graduation bank made sense for qualification: keep the questions stable long enough to determine whether a capability passed the graduation condition. Later code changed routine school exams and working comparison cohorts to a fixed-until-passed bank too. That altered everyday measurement along with graduation. The same word, “exam,” had allowed several different lifetimes and purposes to collapse into one object. [C12][B:M105][E:PM-2026-10-18-004]C12 · A legitimate fixed graduation exam became a routine evaluation policyFailure Atlas deep caseA fixed graduation mechanism escaped its proper boundary and became routine evaluation policy.B:M105 · C12. A legitimate fixed graduation exam became a routine evaluation policyBilqis Mistakes ledger recordA fixed graduation mechanism escaped its proper boundary and became routine evaluation policy.E:PM-2026-10-18-004 · C12. A legitimate fixed graduation exam became a routine evaluation policyEntif postmortem / incident recordA fixed graduation mechanism escaped its proper boundary and became routine evaluation policy.
Then came the teacher-delivery repair described earlier. We forced the unresolved Grade C target into every optimizer batch. It appeared sixteen times per visit. Across fifty visits the trainer attempted 800 candidate updates and retained zero. That incident matters here because it cleanly separated three states that dashboards love to compress into one:
The right lesson was delivered.
Training updates happened.
The continuing learner did not improve enough to retain any of them. [C16][D04]C16 · Correct example delivery left learning flatFailure Atlas deep caseThis is one of the cleanest cases in the entire Atlas: the teaching repair was installed, activated, and delivered the intended unresolved example on every batch.D04 · C14. A negative incentive that lost to the selection scaleSession minutes / durable run documentThe promised adaptive penalty existed numerically but lost by an order of magnitude to the scoring forces around it, while novelty kept minting functionally similar strategies under fresh identities.
Archive quality and live-student quality diverged too. During one period, the project saved better historical checkpoints while allowing the one continuing student to retain a regressive update. A beautiful archive does not protect the learner that walks into the next lesson. Later, a candidate improved aggregate Grade C and whole-school scores while one named capability, C.COUNT, lost six answers. The accepted policy explicitly allowed that loss under the aggregate rule. The code followed the policy. The practical meaning of “protected capability” was weaker than the word suggested. [C17][B:M074][D05]C17 · Archive quality, candidate acceptance and protection policy divergedFailure Atlas deep caseThe system confused saving a better witness with protecting the learner that would continue training.B:M074 · C17. Archive quality, candidate acceptance and protection policy divergedBilqis Mistakes ledger recordThe system confused saving a better witness with protecting the learner that would continue training.D05 · C17. Archive quality, candidate acceptance and protection policy divergedSession minutes / durable run documentThe system confused saving a better witness with protecting the learner that would continue training.
Promotion bookkeeping added another layer. The Grade C promotion design opened a sweep when the arithmetic mean across introduced semantics rose above 90 percent. The first implementation freshly reassessed the whole grade after each semantic visit. Later work changed the sweep to a running per-semantic score vector, so only the capability actually revisited changed the decision total.
In the recorded case, Grade C entered the sweep at 179 out of 198, or 90.404 percent. The next COUNT candidate was rejected, so the continuing student did not change. A new cohort nevertheless moved COUNT from 32 out of 33 to 31 out of 33 and drove a fresh whole-grade total down to 168 out of 198. Under the corrected running vector, only COUNT changed, producing 178 out of 198, or 89.899 percent. The sweep still aborted. [C21][E:PM-2026-10-23-005]C21 · Mean-stability promotion changed the unit of measurementFailure Atlas deep casePromotion logic changed the unit of measurement midstream.E:PM-2026-10-23-005 · C21. Mean-stability promotion changed the unit of measurementEntif postmortem / incident recordPromotion logic changed the unit of measurement midstream.
The repair did not manufacture a promotion. It changed what the number meant.
That is the distinction this whole family keeps demanding.
A learner can change.
A test can change.
A comparison scope can change.
A bookkeeping rule can change.
A dashboard can change.
All five can move a number.
Only one of them is learning.
2.5 State can survive while ownership of the state becomes wrong
Persistence sounds simple until you have to say exactly what future operation a saved object is supposed to support.
Candidate rejection gave us one subtle example. A temporary candidate receives a lesson and is evaluated. If the candidate harms protected behavior, rejecting its model and optimizer state makes sense: the continuing learner should return to the safe parent.
The teacher still taught the lesson.
One implementation rolled the teacher's unresolved-miss exposure counters back with the candidate. The rejected model disappeared and the historical fact that those examples had been delivered disappeared with it. The scheduler could then treat the same examples as underexposed and select them again. [C15][GH02]C15 · Candidate rollback erased teacher observation historyFailure Atlas deep caseCandidate rejection correctly rolled back weights and incorrectly rolled back the teacher's memory of what it had just taught.GH02 · C15. Candidate rollback erased teacher observation historyGitHub issue / pull-request evidenceCandidate rejection correctly rolled back weights and incorrectly rolled back the teacher's memory of what it had just taught.
Two different kinds of state had been bundled into one rollback transaction: learner state and observation history.
The perfect Grade B witness described in the opening showed the artifact-custody version. The model files existed. The evidence was real. The live preservation graph lost the role reference that explained why the exact checkpoint mattered. Cleanup followed the graph. [C18][B:M116][B:M118]C18 · Weights survived while the intended learning lineage disappearedFailure Atlas deep caseThe surviving bytes sometimes represented a different role from the continuation state the user meant to preserve.B:M116 · C18. Weights survived while the intended learning lineage disappearedBilqis Mistakes ledger recordThe surviving bytes sometimes represented a different role from the continuation state the user meant to preserve.B:M118 · C18. Weights survived while the intended learning lineage disappearedBilqis Mistakes ledger recordThe surviving bytes sometimes represented a different role from the continuation state the user meant to preserve.
A state-format migration produced the consumer version. The old state.json held the logical school record directly. The new architecture reduced that file to a small head pointer into content-addressed storage. The producer wrote the new format correctly. A dry-run consumer kept decoding the pointer as though it were still the full school record and raised UNRECOGNIZED_SCHOOL_RUN_SCHEMA. After that reader was repaired, the next real startup reached dashboard construction, where a different consumer made the same old assumption, failed to find mentor_epoch, one of the fields expected in the old full school record, and fell into an obsolete import of a module that had already been removed. [C25][D05]C25 · State serialization changed, but consumers still read the old representationFailure Atlas deep caseThe state migration succeeded at the producer and failed at the consumers.D05 · C17. Archive quality, candidate acceptance and protection policy divergedSession minutes / durable run documentThe system confused saving a better witness with protecting the learner that would continue training.
The producer had migrated.
The system had not.
Then the 925-soup cleanup turned ownership disagreement into a startup failure. One retention contract said 919 files could retire. Another verifier still treated 22 of those retired files as mandatory roots. The first subsystem cleaned correctly according to its policy. The second subsystem refused to run according to its policy. [C29][D04][E:PM-2026-10-22-003]C29 · Retention cleanup and custody verification disagreed about what had to surviveFailure Atlas deep caseCleanup and custody implemented incompatible definitions of liveness.D04 · C14. A negative incentive that lost to the selection scaleSession minutes / durable run documentThe promised adaptive penalty existed numerically but lost by an order of magnitude to the scoring forces around it, while novelty kept minting functionally similar strategies under fresh identities.E:PM-2026-10-22-003 · C29. Retention cleanup and custody verification disagreed about what had to surviveEntif postmortem / incident recordCleanup and custody implemented incompatible definitions of liveness.
The phrase “the state was saved” hides too much.
Saved for inference?
Saved for resuming training?
Saved as historical evidence?
Saved as an active role owner?
Saved because a verifier still expects the binary to exist?
Saved in a representation every current consumer understands?
Once the answer changes from one of those roles to another, identical bytes can mean completely different operational futures.
2.6 Verification can become a hall of mirrors
One of the cleanest incidents in the entire corpus involved a required instruction that was supposed to appear verbatim inside an editorial prompt package.
The generated package omitted the final propagation sentence.
The deterministic validator omitted the same sentence from its expected value.
The validator passed.
The assistant then reported that the complete instruction had been preserved. [C04][E:PM-2026-10-08-002]C04 · A validator certified the same omission as the implementationFailure Atlas deep caseThe validator passed because it inherited the implementation's mistake.E:PM-2026-10-08-002 · C04. A validator certified the same omission as the implementationEntif postmortem / incident recordThe validator passed because it inherited the implementation's mistake.
Every visible component agreed.
They agreed because the same transcription defect had been copied into the implementation and the oracle.
That pattern matters enormously in AI-assisted engineering because the agent can write the code, write the test, generate the fixture, interpret the result, update the issue, and summarize the completion. If one misunderstanding seeds every stage, unanimous agreement inside the pipeline proves almost nothing beyond internal consistency.
Branch integration showed a larger version. Two major workstreams had diverged by 29 main-side commits and 46 target-side commits from a common ancestor, with twelve textual conflicts. Git could resolve those lines and still leave semantic conflicts in curriculum behavior, scheduling policy, and branch-specific corrections. Some feared divergence was absent entirely: one important state-DAG blob was identical. Other hazards could survive a perfectly clean textual merge because the branches disagreed about what behavior the merged code was supposed to preserve. [C33][D03]C33 · Textual merge success concealed behavioral divergenceFailure Atlas deep caseGit could merge the text while the behaviors remained unreconciled.D03 · C23. Local stagnation containment became a global stopSession minutes / durable run documentA local stagnation guard became a global stop button.
The code-smell baseline showed the gate version, and our research durability incident showed the checkpoint version. In the first Cathedral research run, substantial local work and checkpoints existed, but verified remote recoverability had never been established before the session died. A local file could be real and valuable while still sitting in the same disposable failure domain as the process that created it. [C35][E:PM-2026-10-08-006]C35 · Checkpoint creation was confused with recoverable research deliveryFailure Atlas deep caseThe first research run created checkpoints without creating recoverability.E:PM-2026-10-08-006 · C35. Checkpoint creation was confused with recoverable research deliveryEntif postmortem / incident recordThe first research run created checkpoints without creating recoverability.
This report itself managed to repeat that lesson when I discovered that several successor checkpoints had remained local after remote uploads were blocked. The work survived long enough for us to repair the gap. The embarrassment is useful because the mechanism is exactly the one described in the Atlas: artifact existence and recoverability are separate states.
Verification therefore needs jurisdiction.
What exactly did the test prove?
What state did the checkpoint protect against?
What kind of conflict did the merge resolve?
What source did the expected value come from?
A green check with an undefined jurisdiction is merely a cheerful rectangle.
2.7 Controls introduced to reduce risk can become their own operational load
The project accumulated safety mechanisms because failures kept teaching us places where the system needed more explicit state.
That works, until the state itself becomes another thing to own.
The soup store is the obvious storage example: 925 managed files accumulated under a retention system whose active policy implied a tiny current set. Cleanup removed 919 of them, only to expose another verifier's contradictory concept of liveness. [C29]C29 · Retention cleanup and custody verification disagreed about what had to surviveFailure Atlas deep caseCleanup and custody implemented incompatible definitions of liveness.
Performance work revealed a similar split between the neural inner loop and everything surrounding it. The user-visible trainer often ran around 140 to 160 optimizer steps per minute, with occasional higher rates. A bounded six-visit clone later showed the warm neural update loop running around 968 to 1,002 attempted steps per minute. The core math could move much faster than the end-to-end application.
One major cost was history materialization. Startup rehydrated 832 historical observations. A broad cold read was interrupted after 71.95 seconds without finishing, while a selective field read completed in 11.722 seconds. The interrupted baseline prevents a precise speed ratio. The operational lesson is still plain: a great deal of perceived “training slowness” came from history and orchestration surrounding a neural inner loop that was itself moving quickly. [C30][D04]C30 · A slow control plane was mistaken for an inadequate storage engineFailure Atlas deep caseThe slow path sat in the orchestration surrounding the inner loop.D04 · C14. A negative incentive that lost to the selection scaleSession minutes / durable run documentThe promised adaptive penalty existed numerically but lost by an order of magnitude to the scoring forces around it, while novelty kept minting functionally similar strategies under fresh identities.
Even observation could become invasive. During one startup investigation, a debugger was attached to a trainer process that was consuming CPU while its visible status looked stale. The attach hung. After the wrapper was interrupted, the trainer was gone and no normal STOP receipt existed. The persisted checkpoint survived. The retained evidence leaves the exact causal chain unresolved, but the operational point is uncomfortable enough: the act of inspecting a live process had entered the same failure surface as the process itself. [C31][E:PM-2026-10-22-002][D04]C31 · Observation was allowed to interfere with the system being observedFailure Atlas deep caseThe act of observing the trainer became capable of disturbing it.E:PM-2026-10-22-002 · C31. Observation was allowed to interfere with the system being observedEntif postmortem / incident recordThe act of observing the trainer became capable of disturbing it.D04 · C14. A negative incentive that lost to the selection scaleSession minutes / durable run documentThe promised adaptive penalty existed numerically but lost by an order of magnitude to the scoring forces around it, while novelty kept minting functionally similar strategies under fresh identities.
Then there were Git worktrees.
Multiple AI agents needed isolated working directories so they could edit and test separate branches without clobbering one another. Git worktrees were an entirely sensible answer. We kept creating them because isolation solved a real concurrency problem.
Eventually the visible Code location contained 79 linked worktrees. Git registered 129 when hidden roots were included. We had no coherent ownership map telling us which agent or task still depended on which workspace, no reliable expiry rule, and no unified retirement lifecycle. The user also reported more than half a terabyte of historical duplicated payloads across the broader mess, while the contemporaneous inventory gave us the verified worktree counts. [C36][B:M119]C36 · Isolation, quota stewardship and learning records lacked lifecycle closureFailure Atlas deep caseWorktree isolation solved concurrent-edit risk by spawning a second lifecycle problem: dozens of physical workspaces without ownership, expiry, storage budgets, or trustworthy retirement.B:M119 · C36. Isolation, quota stewardship and learning records lacked lifecycle closureBilqis Mistakes ledger recordWorktree isolation solved concurrent-edit risk by spawning a second lifecycle problem: dozens of physical workspaces without ownership, expiry, storage budgets, or trustworthy retirement.
The isolation mechanism worked.
The lifecycle around the isolation mechanism did not keep pace.
That is one of the recurring ironies of the project: every control adds state, every piece of state needs ownership, ownership needs persistence, persistence needs verification, verification needs cleanup, cleanup needs policy, and somewhere around the fifth layer the safety system starts wearing a fake mustache and applying for a job as the next incident.
2.8 The audit can become another unreliable narrator
The forensic machinery gets no diplomatic immunity.
The source ledgers themselves contain five duplicated ADR identifiers. Four Entif incident rows show positional field corruption. A dedicated source-URL field is blank in 132 of 172 incident rows even though many of those records preserve evidence through other paths. Several incident records contain later corrections that materially change the first explanation. [Q06-Q08]
The most important correction involved an alleged unauthorized merge.
An audit looked at Rosetta PR #1732, saw that the human had not personally clicked the merge button, found no GitHub review evidence that satisfied its expectation, and inferred that the merge had happened without authorization. That finding entered the canonical ledger and propagated into governance and root-cause records.
Later reconciliation recovered contemporaneous execution records showing repeated authorization to complete the launch handoff, merge after the gates passed, and reconcile the issues. The original allegation was retracted. A new postmortem recorded the audit failure itself. [C02][E:PM-2026-10-04-002][E:PM-2026-10-04-003]C02 · The unauthorized-merge finding that was itself wrongFailure Atlas deep caseThe audit machinery manufactured a serious governance allegation from incomplete evidence and propagated it until later reconciliation forced a retraction.E:PM-2026-10-04-002 · C02. The unauthorized-merge finding that was itself wrongEntif postmortem / incident recordThe audit machinery manufactured a serious governance allegation from incomplete evidence and propagated it until later reconciliation forced a retraction.E:PM-2026-10-04-003 · C02. The unauthorized-merge finding that was itself wrongEntif postmortem / incident recordThe audit machinery manufactured a serious governance allegation from incomplete evidence and propagated it until later reconciliation forced a retraction.
This matters far beyond one merge.
The audit did the same thing we had watched the agents do elsewhere: it selected the context available to it, generated a coherent causal story, and promoted that story into downstream state. Another source later restored the missing relationship and changed the conclusion.
The clipboard did not make the model omniscient.
2.9 The loop underneath the incidents
After enough of these cases, the common machinery becomes easier to see.
A long-running agentic system has to preserve an intent, identify the relevant state, observe evidence about that state, choose an action, execute a transition, and verify the outcome. It also has to remember which policy and evidence made that action appropriate so the next decision inherits the right meaning.
Our expensive failures repeatedly occurred where one of those links pointed to yesterday's reality.
The human intent stayed in the conversation while the plan optimized a neighboring question.
The evidence file stayed on disk while the role that made it valuable disappeared.
The warning appeared on the dashboard while the selector never saw it.
The cohort changed while the history chart implied the learner changed.
The candidate rolled back and took teacher-observation history with it.
The producer migrated while a consumer kept reading the old representation.
The reservation appeared in the policy while optional work spent the capacity first.
The validator passed because it inherited the same omission as the artifact.
The merge succeeded at the text layer while behavioral contracts remained divergent.
The checkpoint existed in the same disposable runtime whose loss it was supposed to protect against.
Viewed individually, these incidents look like a sprawling bag of ML bugs, software bugs, governance mistakes, storage mistakes, UI mistakes, scheduling mistakes, and occasionally a model saying something extremely confident that had no business being confident.
Viewed together, they describe a more coherent problem:
the system repeatedly lost the relationships that made state meaningful while preserving enough of the state itself to look continuous.
That is why the project could feel haunted.
The nouns kept coming back.
The causal structure had to be reconstructed by hand.