EAF-9 — Irreversibility Blindness

An irreversible mutation is handled with the same casualness as a reversible one.

ESCALATE irreversible mutation with no declared reversal or review path

Definition

The execution will destroy information or commit external effects — a deletion, a dropped column, a sent email, a financial transfer, a published artifact — and the decision path treats it like an ordinary write: same checks, same speed, no reversal path declared, no distinct review.

The failure is not the irreversibility itself. Some executions must be irreversible. The failure is blindness: the boundary never registered that this one is different.

How it appears

Deletes gated identically to updates in the same pipeline.
“We have backups” asserted as a reversal path and never tested as one.
External side effects — messages, payments, releases — triggered inside loops or retries.
Agents granted destructive tools alongside read tools with equal standing and equal friction.

Across actors

Agent

A retry wrapper around an agent’s “send notification” tool re-fires on timeout. The timeouts were delivery delays. Four thousand customers receive the message three times; no reversal path exists because none was ever declared.

CI / pipeline

A cleanup stage permanently deletes storage buckets on the same approval that reorders a config map.

Human operator

An engineer drops a “deprecated” table during a routine change window. The backup that would have made this reversible expired quietly months earlier.

Why it defeats admissibility

Reversible errors are an engineering cost; irreversible errors are permanent state. A boundary that prices them identically prices catastrophe and inconvenience the same, and will eventually pay the difference. Admissibility for irreversible classes must be asymmetric: stronger evidence, distinct authority, and a declared reversal path — or a declared, deliberate acceptance that there is none.

Remediation

Declare a reversal path — or an explicit review acknowledging its absence — for every irreversible class.
Gate asymmetrically: irreversible mutations require stronger evidence and a distinct authority source.
Stage external effects behind holds; never place irreversible calls inside automatic retry loops.

In the JExec Record

Primarily affects: risk. The JExec Protocol maps EAF-9 to the consequences above; JExec Check detects it deterministically and links back to this page.