never-twice
Never Twice
Categorically eliminate the problem so the failure class cannot recur, through better architecture or a better choice of data structures. That beats fixing its instances one at a time.
Every failure that passes the floor below, most corrections of an agent among them, gets the most durable response reachable:
| Rung | Response | What the class can still do | Preference |
|---|---|---|---|
| 1 | better architecture or data structures | cannot recur | the goal |
| 2 | a lint rule or test in CI | recurs, but cannot land | acceptable |
| 3 | a skill or written rule | recurs, but the next agent knows | fallback |
| 4 | human vigilance | anything | avoid |
The ladder is not a menu, and preference decays exponentially down it. Rung 1 is the goal, and rung 2 a clearly weaker but acceptable gate. Rungs 3 and 4 are each another large step down, taken only when every higher rung is genuinely unreachable.
A rung-3 or rung-4 landing is a debt, not a resolution. When a higher rung becomes reachable, convert the rule or vigilance entry up the ladder.
The floor the ladder stands on: whether a failure earns a guard is a judgment weighed scenario by scenario, never a count and never a lookup. Four questions carry it: can the failure be reproduced, is the cause understood concretely, how often will normal operation produce the trigger, and what would the guard cost and where would it live?