Containment, or halting a broken agent before it spreads

There is one triage situation that overrides everything else in this track: an agent that is actively taking actions and getting them wrong. When that is happening, you do not diagnose first. You contain first. Stop the thing, then figure out what went wrong. A broken agent left running does not wait politely while you investigate, it keeps acting, and every action can deepen the damage.

Containment is the reflex to build before you need it. The instant an agent's behavior looks wrong, the first move is halt, not steer. Do not try to correct it in flight with another instruction, because a confused agent plus a new instruction is often just a differently confused agent, still acting. Kill the process, revoke the access, pull the plug on whatever loop it is in. You can always restart from a known-good state. You cannot un-take the ten wrong actions it fires off while you are typing a clarification.

Why stop first instead of trying to fix it live?

Because a misbehaving agent is compounding, and compounding is the enemy. Recall from the foundations track that errors in an autoregressive system feed forward: each wrong step becomes the context for the next, so a small drift becomes a large one fast. An agent taking actions on a bad premise is that same compounding, except now it is touching the real world, not just text. Every second it runs, it is building more wrong on top of wrong. Halting stops the compounding at its current size. Steering while it runs lets the compounding continue while you hope to redirect it.

After the halt comes the calm part: assess from a stopped state. Now you can apply the rest of this track safely. What did it do, what is the actual failure, was it a one-line bug or a foundational one, does the situation call for repair or rebuild. All of that is fine to do slowly once nothing is actively getting worse. The stop buys you the time to think, which is the whole point.

This is the operational face of the reversibility track. There, you gated the irreversible actions so an agent could not take them unsupervised. Here, when something slips through and goes wrong anyway, containment is the backstop: halt fast, limit the blast radius to what already happened, and only then investigate. Fast to stop, slow to diagnose, in that order.

The takeaway: When an agent is actively going wrong, contain before you diagnose. Halt it, don't steer it, because a running broken agent compounds its mistakes while you type. Stop the damage first, investigate from a standstill.