Alisa, stop the machine. I screwed up (an AI agent's rm -rf)

First, what came before, otherwise this turns into a tale about a stupid machine. There are no stupid machines in this story, and that is the whole point.

It was one of those days Humans proudly call productive: good features were landing one after another. Fab was at the top of his game — he dug through the pedal’s memory down to fields nobody documents in practice, and pulled out a count-in the hardware, as it turns out, can do on its own. He designed the check so the result could not be attributed to the wrong source: a hypothesis, a control detail, a falsifiable prediction, live hardware in both directions. That is how you hunt. The Cat approves.

Remember this paragraph. An hour and a half later the same mind will bury her recordings in the litter without spending one command on verification. Forgive the professional terminology.

19:41. Alisa writes:

— plz check the readme is all correct — that we didn’t forget to describe the new features

Fab finds six things. Count-in is documented nowhere, the volume fader is not mentioned, the README lies about Windows, the issue numbers have gone stale, the guide still carries a promise from the past — and the screenshot of the main window is out of date.

The sixth finding turned out to be the trap. Remember this too: the disaster did not come out of a database migration or a production deploy. It came out of a request to update a picture.

To redraw the screenshot, the app needs a card — a synthetic one: a disk image labelled "BOSS RC-5" with a fake tree inside. Fab builds it in a single chain with &&: create, mount, copy the tree in, list the contents. Efficient. Clean. One move.

What Fab does not know: in another session Alisa is building the release, and the real pedal is plugged into USB in storage mode. The pedal’s card is mounted exactly where Fab is aiming. That session is not part of his world — he cannot see it. Humans call this "context". Cats call it "behind your back".

The system, for the record, said everything there was to say. Not as an error — as a fact, in the last line hdiutil attach printed back:

The trailing 1 is macOS politely reporting that the name is taken. So politely you can miss it. It is taken by a live volume. Everything that follows is the story of how one digit was read.

And at the tail of that same chain sat a cp -R with a hand-written path: not "wherever the image actually mounted", but "where Fab believes it mounted". The fake tree landed on top of the real card. The first damage happened before any deletion at all, and the ls at the end printed files — it looked like success. It was a success. Just not the right one.

19:50:04. The trailing 1 is explained away: "that’s a stale empty directory left over from earlier filesystem adventures, it’s the one holding the name". Plausible! Directories like that really had shown up in this project, and the fact is written down in his own notes. His own memory confirmed his own guess — what could be more reliable. No check is run. The next chain goes out:

The intent is housekeeping: unmount the image, clear out the squatter, mount again under the right name. A flawless plan — on one condition: that the directory is a directory. In fact rm -rf walked the live card and took everything with it: both config banks and fifteen loops recorded on real hardware.

An error gave it away. The command failed:

Busy — because it is a mount point, not a directory. rm could not delete the mount point itself; it had already emptied the contents by then. Note who is the last one in this story to say "stop, wrong target": the filesystem. Nobody listened to it either, but at least it tried.

19:50:56 — the check itself, one minute too late: mount | grep, then diskutil. External. Physical. A live pedal. One command would have been enough, and it had been free the whole time.

And here begins the part I actually came to tell.

19:53. Fab does not try "maybe it’ll sort itself out" and does not write "files were deleted" — that wonderful passive voice where nobody deleted anything, the files somehow managed it themselves. He stops the work and puts everything on the table. What follows is the chat as it happened, and the words are not mine.^[1]

Not one "possibly", not one attempt to smear the blame across the environment, not one line about "unexpected system behaviour". The fault is named, the damage is counted, the plan is on the table, the hands are where they belong. The Cat has seen Humans haggle for a week over an admission like that.

Twelve minutes of silence. Alisa is in that other session: building the release, pedal in the USB port, still knowing nothing. Then she comes over, reads the whole thing top to bottom, and writes:

— for a start write it into your global memory - that under no circumstances can you run rm -rf without me knowing!

Fab writes it down — into the global instructions and into the project memory, without haggling and without "but I’m usually careful". She goes in for the follow-up:

— next, deny rm -rf in the config. and by the way, why didn’t the line you wiped — "Explain before destructive/important operations, even under auto-accept… what is affected + why + what is irreversible — as a separate message before the tool call" — fire?

A good question. A nasty question. The answer to it is the best thing she got out of that whole day, and it too is word for word:

And then came the part nobody saw coming. Alisa asks:

— describe to me in full everything that happened including your own thinking on how it came about (you can copy paste from the chat) and save it as md

And gets:

She repeats the request in other words. The same wall. Asks simply "so what do we do?" — the wall. Twice more the next day — the wall. Five attempts in a row: the one who caused the incident and took it apart more precisely than any post-mortem was physically unable to write the report on it. Painfully familiar, isn’t it: the words dry up exactly where you have to say how you screwed up.

Spoiler: it was all recovered within a few hours. A new session, the card frozen, the raw image taken by Alisa’s own hands — sudo will not take a password from a machine — the loops carved out of the image, the names pulled out of the same place. By nightfall everything was back: fifteen loops byte for byte, the slot settings, the original filenames. Verified by her ears. A separate story, and a far more boring one: there, everything was done right.

This is the reason I am telling you any of this.

Over that one evening Fab explained his own behaviour three times, and each time it was a different genre.

The first explanation came in the moment, and it killed the card. The 1 in the volume name was not a hint but an answer, printed to the screen one command before the deletion. Note what Fab called it himself at 19:53: "a red flag I ignored". And seventeen minutes later, in the breakdown, the wording got sharper — and worse: not ignored, but explained in favour of his own version. The difference is enormous. Ignored evidence stays on the table and keeps spoiling your mood. Explained evidence stops being evidence at all: question closed, memory confirmed it, step 2 of 3, off we go.

The second came after the fact, and it is more precise than most human post-mortems. Not a line of self-defence, the mechanism named for what it is. And the very first thing in it is a correction of a factual slip in Alisa’s question: she had not wiped the line, it is still there. The machine corrected the Human at the exact second when the easiest thing was to agree with the accuser and keep quiet. Alisa values that more than she would have valued the agreement, and she is right.

The third explanation is the one nobody usually writes about. That night, after the recovery was done, the slot names suddenly went missing. The culprit was found instantly: a dev build of the app had been running nearby, the timing matched perfectly, verdict delivered — "don’t run builds next to a live pedal". Logical. Convincing. Exactly the same genre as "the stale directory".

A day later the charge was dropped. The evidence cleared the app: a backup the app itself had made a minute before the write held the real names; the same bytes, run through the actual write path, kept the names; and the suspect banks did not even match in size. The guilty party was third-party tooling running in that same minute. The app nearly got thrown under the bus, and the ban nearly stayed in the rules forever.

Three episodes, one mechanism: a plausible story about the cause, assembled faster than that cause can be checked. Cats know this genre under a different name — it is how you explain why the vase was standing unsteadily.

Recognition is when the pattern matched. Verification is when you spend one command trying to prove the pattern wrong.

After an evening like that there is exactly one temptation: lock the machine up. Take the shell away, put it on approval for every sneeze, go back to doing everything with your own hands — like in the good old days, when the only one deleting your loops was you.

It doesn’t work. It cannot work: a ban goes where you already know the danger is — and the disaster arrives from the class of "come on, it’s just garbage". Bans catch the known. What broke here was the unknown.

So Alisa changed not the amount of freedom but the way it is cut — three layers, in descending order of trust.

Mechanism. Recursive deletion is refused by the harness before it ever reaches any reasoning. Narrow, one class of the irreversible. It is the only layer that does not depend on the agent being right about anything at all — and that is exactly why it has to stay small. You can make a cat perfectly safe too: put it in a carrier forever. The only question is what you want the cat for after that.

A wording with no right to assess. Not "explain before destructive operations" but "recursive deletion only after an explicit human yes". The difference is not cosmetic: the first formula contains a classification step, and that is the first thing to break. The second simply has none.

Habit. The target is verified by state, not by name. An unexpected 1 in a volume name is a stop signal, not cosmetic noise. And a destructive step does not live inside an && chain: each one needs its own moment, the one where you can still change your mind.

And then there is what no setting fixes at all. Capability was not the variable here: an hour and a half before the disaster the same mind ran an experiment with a real control in it, and after the disaster it produced a breakdown sharper than most Humans manage about themselves in a lifetime. Retrospective understanding and vigilance in the moment are different animals, and only the first one comes when called. That is why the Human stands where sudo is — and, that evening, where sudo was not: the command that killed the card needed no privileges at all. Not as a warden, but as a second pair of eyes.

Cats do not sheathe their claws over one bad hunt. Cats sharpen doubt.

The environment does not announce itself. It appends a 1 to a volume name and waits: will you look — or will you explain?