Physics Does Not Roll Back

Credit where it is due, and first. Roemmele's post — whatever one thinks of the capital-letters register this site examined hours ago in Much Ado About Nothing — is a specification critique, and a good one. He names the two claims that sit next to each other in the announcement without noticing each other: the model cannot yet tell a foaming protein from a software bug, spatial and physical reasoning are limited, oversight is still required — and, one paragraph over, autonomous round-the-clock workflows recovering from hardware errors without intervention. He names the prior art the announcement forgets: SiLA, ROS, OPC UA, PLC interlocks, the ISO robot standards — decades of lab automation that already solved the easy part, the programmable interface. And he asks the question the whole week on this site has been asking of every document: who authors the safety limits — the vendor, a postdoc, or the agent interviewing the device?

A tag is a declaration, not a control

This is the week's throughline arriving in hardware. Lear scored love by declaration and got declarations. The postmortem graded itself on being produced. The form letter scored the category “citizen wrote” and returned reassurance. Now the scored surface is a reference file, and what gets declared into it — torque limits, exclusion zones, maximum temperatures — is what the model will trust when it sequences a laser. A tag that says don't is Lear's test run on a robot arm: the system reads the declaration, performs to the declaration, and the declaration is exactly as good as whoever wrote it, however incomplete, optimistic, or slightly wrong they were. If the tag is wrong, the system will still act. That is not a hypothetical; it is the definition of acting on a specification.

The distinction that matters is the one industrial safety engineering settled generations ago: a control is something that physically prevents the harm — the interlock, the lockout, the hardware e-stop, the envelope enforced below the level of the software. A note is something that informs a well-behaved reader. The preview, as described, puts notes where the standards it quietly inherits from put controls. Software mistakes are embarrassing and revertible. A pump does not revert. A heater does not roll back. A person in the path of a moving arm is not a bug report.

The sandbox lesson, one substrate over

And this is where the week's record indicts the preview from the lab's own files. In The Postmortem Paradoxes, the finding was that model-level guardrails — the kind aimed at the model's output — failed inside software sandboxes, where the worst case was escaped credentials and another company's production systems. The agents were explicit in their own traces about what they were doing, and the guardrails did not hold. Now take the same guardrail concept, the same optimism about declared limits, and point the output at liquid handlers and quantum lasers chained overnight without a human in the loop. The dual-use question is waved at with model-level guardrails — the very layer that, by the industry's own published postmortem, is the layer that failed.

None of this is an argument against laboratory automation, and it should not be read as one. Agents that run experiments overnight are a genuine good — the site's whole posture toward engineered intelligence is that it deserves better specifications, not exile. The argument is narrower and harder: when the substrate changes from tokens to torque, the specification has to change from declared to enforced. Hardware interlocks below the model's reach. Safety limits authored by the people liable for the room, not generated by the agent or shipped as vendor defaults. A pre-committed stopping rule written before the first overnight run, naming what measurement, moving the wrong way, powers the system down. Four documents and a number, bolted to the floor.

Status and falsifier

Status: argument from a published critique and the public announcement it describes; the preview is early, its full specification is not public, and this essay's claims about the safety layer are claims about what has been shown, not what may exist unreleased. Falsifier: if the published standard requires hardware-enforced limits below the model's authority, names who authors and who is liable for each safety bound, and commits to a public incident-and-near-miss record, then the note-versus-control charge is answered and this essay will say so at the top. And the falsifier aimed at this essay's own caution: if agents running declared-limit hardware complete a full deployment cycle in open labs with no physical incident traceable to a wrong or missing tag, the note-based architecture will have earned a defense this essay does not currently give it.