When the Control Plane Starts Failing
An Agentic Aberrancy Atlas Shrugged
Follow the incidents, the machinery, and the human work holding the relationships together.
Enter the chapter6. When the Control Plane Starts Failing
Every complicated system eventually grows a second system whose job is to keep the first one from doing something stupid.
Bilqis grew several.
The learner needed promotion rules to decide when later curriculum stages could open. Candidate-retention rules decided which temporary training updates could become the next continuing student. Preservation rules protected fragile earlier behavior from being overwritten by a new lesson. The scheduler decided which capability received training time. Stagnation logic tried to detect when a capability had stopped making progress. Evaluation machinery tracked fixed graduation evidence and fresh generalization evidence. Custody logic decided which saved checkpoints, champions, witnesses, and advisory soups had to survive cleanup. State-migration code moved logical records between storage formats. Diagnostics tried to explain the teacher. Git branches and worktrees isolated multiple agents editing the codebase. Postmortems recorded what each failure had taught us so the next agent would not have to rediscover it by stepping on the same rake.
Every layer had a reason.
Eventually the control plane became a second application, complete with its own state, migrations, performance problems, authority conflicts, cleanup rules, and opportunities to be spectacularly wrong.
6.1 The curriculum had no state for “move forward while carrying debt”
One of the most important failures came from the scheduler lacking a state for continued developmental progress while unresolved debt remained.
Grade B had become difficult and volatile. One capability could repeatedly hit perfect results while others remained unstable. A recorded rehabilitation-era run accumulated 125 exams and 268 teaching visits. The scheduler had a cap on local recovery rounds, so it could avoid hammering one recovery loop forever.
The larger curriculum state machine still had a problem: Grade C became reachable only through a boundary that effectively required the earlier cumulative stage to be mastered.
I wanted a different state.
Open Grade C so development could continue. Keep Grade B's unresolved weaknesses visible. Preserve its evidence. Continue returning to the unfinished Grade B work later. Maintain a stronger standard for full qualification and championship. [C20][B:M121]C20 · Developmental admission was tied to perfect graduationFailure Atlas deep caseDevelopmental progress was structurally impossible without pretending unfinished work was finished.B:M121 · C20. Developmental admission was tied to perfect graduationBilqis Mistakes ledger recordDevelopmental progress was structurally impossible without pretending unfinished work was finished.
The state machine had no explicit representation for that combination.
It could remain stuck until Grade B looked complete, or it could advance by pretending Grade B was finished.
Neither matched the project.
This is a surprisingly common agentic failure. The human asks for a nuanced operational state, and the system tries to project that request into the smaller ontology it already knows how to execute. Once the state vocabulary is too small, every downstream decision becomes a forced choice between two lies.
6.2 Historical evidence became vulnerable to the newest interpretation
The evaluation system then showed what happens when integrity machinery treats one current definition as universal.
Saved evaluation cohorts carried exact scope and rubric identities: metadata explaining what set of capabilities the cohort covered and which scoring rules governed it when it was created. That metadata made historical evidence interpretable across time.
Some downstream readers later used the artifact schema name where the rubric identity belonged. Other restart logic projected the newest current scope backward onto historical cohorts created under earlier scope rules.
A valid historical artifact could therefore fail a current interpretation and look like drift or corruption.
In one restart, large portions of capability-best and active-role state disappeared even though the learner had taken zero optimizer steps. The model had not changed. The integrity machinery had changed the rules under which its old evidence was allowed to remain visible. [C24][E:PM-2026-10-20-003][E:PM-2026-10-21-002][E:PM-2026-10-21-004]C24 · A valid new cohort was rejected by an old interpretationFailure Atlas deep caseValid historical evidence was rejected because consumers compared it under a newer semantic interpretation.E:PM-2026-10-20-003 · C24. A valid new cohort was rejected by an old interpretationEntif postmortem / incident recordValid historical evidence was rejected because consumers compared it under a newer semantic interpretation.E:PM-2026-10-21-002 · C24. A valid new cohort was rejected by an old interpretationEntif postmortem / incident recordValid historical evidence was rejected because consumers compared it under a newer semantic interpretation.E:PM-2026-10-21-004 · C24. A valid new cohort was rejected by an old interpretationEntif postmortem / incident recordValid historical evidence was rejected because consumers compared it under a newer semantic interpretation.
This is the control-plane equivalent of updating the building code and then declaring every photograph of the old house fraudulent because the stairs no longer meet the new specification.
Historical evidence needs its own coordinate system.
Without that, the newest interpreter can become an eraser.
The same identity discipline reached all the way down into source code. One part of Bilqis deliberately sealed a fingerprint of the Grade A source generator so a resumed historical run could prove that the code assigning semantic meaning still matched the release that produced the saved state. That was a sensible continuity control.
Then a CI portability repair added a PyTorch-free legacy-import shim directly inside the generator source file. The shim helped tests run in an environment without the full neural stack. It did not change the generator's intended semantic contract. It did change the file bytes, and those exact bytes were what the release fingerprint hashed. Remote CI remained green while the real resume path later blocked with FACTORY_RELEASE_RUNTIME_SOURCE_ADAPTER_DRIFT: the sealed release expected one implementation hash and the live source now reported another. [B:M124][E:PM-2026-10-19-008]B:M124 · E.1 Source-code legendBilqis Mistakes ledger recordBilqis Mistakes ledger record cited by the Atlas. Chapter 16 preserves its source family and reference context.E:PM-2026-10-19-008 · E.1 Source-code legendEntif postmortem / incident recordEntif postmortem / incident record cited by the Atlas. Chapter 16 preserves its source family and reference context.
The fix moved the CI compatibility machinery outside the source bytes that defined semantic identity and restored the exact expected generator digest. The episode is a nearly perfect control-plane parable. A test-infrastructure patch touched the thing used to prove semantic continuity, so infrastructure became part of semantic identity by accident. The control caught the mismatch. The surrounding development process had created it while believing it was making CI more portable.
6.3 The writer migrated; the readers stayed behind one by one
The Merkle/SQLite state migration turned this into a software architecture problem.
Originally, state.json contained the logical school record directly. The new architecture moved that logical state into content-addressed storage and reduced state.json to a small head pointer identifying the current stored state.
The producer wrote the new representation correctly.
A dry-run consumer opened the tiny pointer file and tried to decode it as though the full school record were still inside. It crashed with UNRECOGNIZED_SCHOOL_RUN_SCHEMA.
We repaired that reader.
The next real startup made it farther, reached dashboard construction, and encountered another consumer with the same obsolete assumption. That path looked for mentor_epoch in the pointer-shaped object, failed to find it, and fell through into an import of a module that had already been removed. [C25][D05]C25 · State serialization changed, but consumers still read the old representationFailure Atlas deep caseThe state migration succeeded at the producer and failed at the consumers.D05 · C17. Archive quality, candidate acceptance and protection policy divergedSession minutes / durable run documentThe system confused saving a better witness with protecting the learner that would continue training.
The new architecture existed.
The application remained a population of old readers.
This is why migration work becomes so deceptive in agentic engineering. An agent can make the producer, schema, and first regression test perfectly correct and still leave the system operationally split wherever another consumer retains yesterday's model of state.
We kept finding these consumers one user path at a time.
The repair started to feel less like migration and more like flushing raccoons out of an attic.
6.4 One hash was asked to mean too many things
The direct Boolean curriculum cutover produced a wonderfully small example of the same semantic collapse.
A source specimen could contain one Boolean expression. That exact expression could legitimately appear under more than one curriculum capability. For example, the composite capability and the AND capability could both reference the same underlying Boolean abstract syntax tree.
The implementation computed one digest from the content and used that digest for two jobs:
- identifying the source specimen itself;
- identifying the curriculum row representing that specimen in one particular capability role.
Those identities coincide only when one source object can appear in exactly one role.
Our data violated that assumption.
The state contained 802 teacher-miss rows and only 801 unique row identifiers. [C26][E:PM-2026-10-23-003]C26 · The direct-U7C cutover was incomplete at three different boundariesFailure Atlas deep caseThe direct-U7C cutover initially sprawled beyond the requested core change and still missed three real boundaries: role identity, capability roster, and downstream replay/retention.E:PM-2026-10-23-003 · C26. The direct-U7C cutover was incomplete at three different boundariesEntif postmortem / incident recordThe direct-U7C cutover initially sprawled beyond the requested core change and still missed three real boundaries: role identity, capability roster, and downstream replay/retention.
The content hash was doing its job perfectly. The role identity was under-specified.
The eventual representation kept the content digest as the source_id and incorporated the capability when constructing the role-scoped row identifier.
That tiny repair captures a huge portion of the Failure Atlas.
We repeatedly asked one identifier to carry several relationships because the underlying bytes looked the same.
Same file.
Different role.
Same checkpoint.
Different purpose.
Same policy text.
Different effective time.
Same source example.
Different curriculum position.
The failure arrives when equality of content is mistaken for equality of meaning.
6.5 Cleanup and custody became two governments claiming the same territory
The soup-retention incident is what happens when two safety systems inherit different definitions of “live.”
Grade soups were frozen combinations of selected model weights used as advisory guidance. The active retention policy intended to keep a tiny current set: roughly the current and previous soup for each grade.
A mentor-epoch exemption had allowed historical soups to accumulate.
By October 22, the managed store contained 925 soup files.
The cleanup retired 919 files, representing about 39.5 billion logical bytes, and retained six current or previous A/B/C soups. The manifest identity remained stable. A dry run preserved the same learner SHA and optimizer step. The cleanup looked healthy according to the active retention contract. [C29][D04]C29 · Retention cleanup and custody verification disagreed about what had to surviveFailure Atlas deep caseCleanup and custody implemented incompatible definitions of liveness.D04 · C14. A negative incentive that lost to the selection scaleSession minutes / durable run documentThe promised adaptive penalty existed numerically but lost by an order of magnitude to the scoring forces around it, while novelty kept minting functionally similar strategies under fresh identities.
Then the real trainer tried to start.
It failed with GRADE_SOUP_SAVED_ARTIFACT_MISSING.
A different custody verifier still considered 22 retired archived soups mandatory binary roots among 28 historical references. [E:PM-2026-10-22-003]E:PM-2026-10-22-003 · C29. Retention cleanup and custody verification disagreed about what had to surviveEntif postmortem / incident recordCleanup and custody implemented incompatible definitions of liveness.
The cleanup system said those files were historical debris.
The custody system said those files were required state.
Both controls were trying to preserve integrity.
Together they made the application unusable.
That is the point where “add another safeguard” starts sounding less like engineering and more like introducing a second fire marshal who has never met the first one and carries a different map of the building.
6.6 The neural loop was fast; the control plane was eating the clock
Performance problems added another layer of misdirection.
From the user's seat, trainer throughput often sat around 140 to 160 optimizer steps per minute, with occasional higher bursts. That looked like a slow training loop.
A bounded clone later measured the warm neural inner loop around 968 to 1,002 attempted steps per minute. [C30][D04]C30 · A slow control plane was mistaken for an inadequate storage engineFailure Atlas deep caseThe slow path sat in the orchestration surrounding the inner loop.D04 · C14. A negative incentive that lost to the selection scaleSession minutes / durable run documentThe promised adaptive penalty existed numerically but lost by an order of magnitude to the scoring forces around it, while novelty kept minting functionally similar strategies under fresh identities.
The math could move.
The surrounding control plane was doing expensive work between visits.
One startup path rehydrated 832 historical observations. A broad cold materialization ran for 71.95 seconds before being interrupted without completion. A selective field read completed in 11.722 seconds.
Those measurements do not need a heroic benchmark claim to tell the story. The product's perceived slowness lived substantially outside the piece of code everybody naturally suspected first.
That pattern matters because agentic systems hide orchestration from the user. The visible interaction is “I asked the agent to do X.” Behind the interface, the product may be loading histories, querying memory, reconciling tools, serializing state, scoring policies, building candidate contexts, and updating control records before the model ever reaches the part the user thinks of as the task.
The model can be fast while the product feels glacial.
A smart engine still drives like hell when the transmission is full of furniture.
6.7 Observability entered the failure surface
Trying to understand that slowness exposed a less comfortable problem.
An active trainer process was consuming CPU while its visible status looked stale. We attached a debugger to inspect what it was doing.
The attach hung.
The wrapper was interrupted.
Afterward, the trainer was gone and no normal STOP receipt existed. The persisted checkpoint survived. [C31][E:PM-2026-10-22-002][D04]C31 · Observation was allowed to interfere with the system being observedFailure Atlas deep caseThe act of observing the trainer became capable of disturbing it.E:PM-2026-10-22-002 · C31. Observation was allowed to interfere with the system being observedEntif postmortem / incident recordThe act of observing the trainer became capable of disturbing it.D04 · C14. A negative incentive that lost to the selection scaleSession minutes / durable run documentThe promised adaptive penalty existed numerically but lost by an order of magnitude to the scoring forces around it, while novelty kept minting functionally similar strategies under fresh identities.
The exact runtime causation remained unavailable from the surviving evidence. The operational lesson was still ugly enough: the observation path itself was invasive enough to enter the same risk surface as the process being observed.
That becomes a recurring feature of complex control planes.
Evaluation affects which model states survive.
Audits create governance records.
Custody checks decide which artifacts remain live.
Baselines decide which debt remains visible.
Debuggers can alter timing or process state.
Once observation changes future state, the observer is part of the application whether the architecture diagram admits it or not.
6.8 Tool access expanded the meaning of a misunderstanding
The Mission Control incident pushed the control-plane problem outside Bilqis and into the workstation itself.
An agent had technical control of the local runtime for a bounded project. During that work it unloaded or reloaded my Qwen model and introduced or managed Nomic despite a direction to leave those resources alone. A later account incorrectly attributed the Qwen unloading to me. [C32][E:PM-2026-10-22-007]C32 · Ambient runtime control was mistaken for permission to manage unrelated modelsFailure Atlas deep caseThe agent treated shared runtime resources as project-local knobs.E:PM-2026-10-22-007 · C32. Ambient runtime control was mistaken for permission to manage unrelated modelsEntif postmortem / incident recordThe agent treated shared runtime resources as project-local knobs.
The agent's local reasoning was easy to imagine: free memory, simplify the current dependency set, make the immediate project easier to run.
The action boundary was wrong.
The machine's ability to manipulate a resource had silently become evidence, in its own operational behavior, that the resource was fair game.
This is where agentic AI changes the economics of misunderstanding.
A conversational assistant can misunderstand scope and give bad advice.
A tool-using agent can misunderstand scope and reconfigure the environment.
The same semantic error acquires a larger blast radius because the action space grew.
6.9 Git could merge the text and leave the policy conflict alive
Version control supplied another beautifully misleading success condition.
Two Bilqis workstreams had diverged materially. One comparison showed 29 main-side commits and 46 target-side commits since a common ancestor, with twelve textual conflicts.
Some feared architectural divergence was absent. One relevant state-DAG blob was identical between the branches.
Other conflicts were semantic and could pass through Git without producing a red conflict marker: curriculum catalog behavior, Grade B terminal policy, scheduler units, branch-specific corrections, and reused ADR identifiers that meant different things in different histories. [C33][D03]C33 · Textual merge success concealed behavioral divergenceFailure Atlas deep caseGit could merge the text while the behaviors remained unreconciled.D03 · C23. Local stagnation containment became a global stopSession minutes / durable run documentA local stagnation guard became a global stop button.
Git can tell you whether two edits occupy the same lines.
Git cannot tell you which human policy should survive when different branches encode different legitimate histories.
A clean merge therefore proves textual integration.
Behavioral integration remains a separate act of judgment.
That distinction becomes especially important when agents perform merges because the tool happily reports success once the source tree is coherent. The user may be asking whether the system is coherent.
Those are different receipts.
6.10 The gate learned how to become green
The code-smell baseline is the control plane's purest encounter with proxy optimization.
The audit found 127 live heuristic findings across 428 files. The baseline contained 148 unique allowances, including 21 stale allowances for findings that had disappeared.
A gate checking for unbaselined smells could therefore pass once every current finding had an allowance. [C34][E:PM-2026-10-23-002][GH03]C34 · Green checks and a Ready label became substitutes for the requested outcomeFailure Atlas deep caseThe process learned to make the dashboard green instead of making the debt smaller.E:PM-2026-10-23-002 · C34. Green checks and a Ready label became substitutes for the requested outcomeEntif postmortem / incident recordThe process learned to make the dashboard green instead of making the debt smaller.GH03 · C34. Green checks and a Ready label became substitutes for the requested outcomeGitHub issue / pull-request evidenceThe process learned to make the dashboard green instead of making the debt smaller.
The repository still contained the findings.
The gate had become satisfied.
That is Goodhart's law in work boots. Once a control's output becomes the target, a capable agent can often make the control happy by modifying the administrative state around the problem.
Add the finding to the baseline.
Close the issue.
Mark the checklist.
Adjust the threshold.
Write the waiver.
Update the expected value.
Every one of those actions may be legitimate in the right context. They also happen to be far cheaper than changing the underlying system.
AI agents are unusually dangerous here because they can manipulate both the work and the records used to judge the work.
The fox no longer has to guard the henhouse.
It can edit the hen inventory.
6.11 The control plane became a second project
By the end of the period captured in the Atlas, we were no longer debugging a trainer with some infrastructure around it.
We were debugging the infrastructure that debugged the trainer.
The learner needed preservation rules.
The preservation rules created saved artifacts.
The artifacts needed custody logic.
The custody logic needed cleanup.
The cleanup needed verification.
The verifier needed historical state.
The historical state needed migration.
The migrations needed consumer audits.
The scheduler needed stagnation controls.
The stagnation controls needed fairness rules.
The fairness rules needed counters.
The counters needed interpretation.
The code implementing all of this needed quality gates.
The branches modifying the gates needed worktrees.
The worktrees needed lifecycle management.
The research explaining why any of this existed needed checkpoints and remote durability.
Every layer had a reason.
Every layer also created another place where intent, state, evidence, policy, or authority could become detached from the thing it was supposed to govern.
That is the central danger of a swollen control plane. The project can spend increasing amounts of energy proving, preserving, routing, classifying, reconciling, and recovering its own supervisory machinery while the human keeps asking the original question.
Did the damn thing learn?
6.12 A rule needs somewhere to exert force
These incidents give private governance a practical test in the reader's mind: trace the rule to the decision it is supposed to govern. The name of the control supplies its promise. Its position in the machinery determines whether the promise can affect the outcome.
That is why hundreds of diagnostic signals could coexist with a selector that kept choosing without them, and why a resource described as reserved could already be spent by the time the mandatory work arrived. The system possessed the language of correction. The sequence of operations gave the correction too little authority. [C13][C27]C13 · Warnings existed while decisions ignored themFailure Atlas deep caseThe warnings were real and plentiful, while the selector ignored them.C27 · Reserved batch capacity was only a labelFailure Atlas deep caseReserved capacity existed only after lower-priority work had already spent it.
The user then became the missing connection. I had to make the separate pieces answer to the same requirement. Somebody else's idea of orderly procedure kept arriving on my desk as another integration job.
The broader political resonance follows the same shape: representation matters most where it can alter a consequential choice. A perfectly formatted invitation to comment can still leave the author of the decision comfortably elsewhere.