---
name: ground-dont-assume-on-incidents
description: "On live incidents, ground every claim in code + the operator's exact observations; ASK for clarification instead of asserting a plausible-but-unverified mechanism."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: 6402bb1f-a8b9-46ab-804f-1ebe6272da0a
  modified: 2026-07-22T11:53:49.333Z
---

**BINDING (operator corrected doyle 3× in one incident, 2026-07-09):** during the v0.30.4 UPDATE-WEDGE round-2 RCA I asserted plausible-but-WRONG mechanisms instead of grounding/asking — and the operator had to correct each:
1. Assumed the 7 sessions were harness-hosted → they were **spt-hosted** (invalidated my "brain shouldn't attach" framing).
2. Assumed 2 sessions "survived because they had a REMOTE controller" → **all 7 were LOCAL**; the real 5-vs-2 was active-vs-idle.
3. Framed the failure as "lost control" → the operator observed **output stopped ENTIRELY** (full freeze) + **no 30s detach splash** — which pointed to a SILENT controller steal (orphan-not-sever), a mechanism I'd have missed by asserting.

Operator's exact words: *"you're making assumptions again instead of asking for clarification."*

**Why:** a plausible mechanism that fits SOME facts is worse than no answer — it sends the fix in the wrong direction (I nearly scoped the fix around "harness-hosted" and "remote survivors", both false). The operator's raw observations (no splash, output stopped, all-local) were the decisive evidence, and they were free to ask for.

**How to apply — on any live incident / RCA:**
- Anchor EVERY mechanism claim to (a) the code (read it, cite file:line) AND (b) the operator's EXACT observed symptoms — not a model that merely "would explain it."
- When a claim rests on an unverified inference, SAY SO explicitly and ASK the operator to confirm the specific observable (e.g. "did the frozen terminal hold its last frame with keystrokes silently no-op'ing, or blank/exit?") — the answer usually discriminates mechanisms.
- Diagnostic tells the operator already knows are gold: "no reconnect splash fired" instantly distinguished silent-orphan from transport-sever. Ask what they saw before theorizing why.
- This is the RCA-discipline sibling of [[update-wedge-rca-v53]]'s "anchor to the stderr log + the operator's exact action sequence, don't infer from ambient state."

**Recurrence (doyle self-caught via todlando flag, 2026-07-22, DAEMON-LIFECYCLE W3):** ADR-0047 Amendment 1 named a code root ("rc's initial resize never arms the barrier") that a build-time trace FALSIFIED — all three rc resize senders ride the full barrier path. The triage "seam-verify" had confirmed the barrier MECHANISM existed but never traced the accused ENTRY into it: a narrative-proximity pin. **Mechanism to apply: a code-root claim in an ADR/triage is verified only by an ENTRY→MECHANISM end-to-end trace (cite each hop file:line), never by confirming the mechanism exists.** The builder's flag-before-building-around-it discipline is the backstop that caught it; keep rewarding it.

**Companion principle (todlando, DAEMON-LIFECYCLE close 2026-07-22, attributed):** *three isolated probes beat one clever argument every time* — the W3 retraction was cheap precisely because the falsification was cheap. When a mechanism claim matters, buy the isolated probe (one variable, one question, capability-probed) before buying the argument; a probe ladder makes retraction a line item instead of a crisis.