Core Primitive
Validation gates are themselves signal sources — and a gate with a high false-alarm rate becomes a noise source that trains you to ignore it. Aviation and intensive care call the result alarm fatigue, and it kills. A self-healing filter network therefore needs a meta-gate: every gate's alarms get logged, its false-positive rate reviewed, and chronic criers retuned or removed. The system must audit not just its contents but its own filters.
The alarms that trained the humans
Hospital telemetry wards produce hundreds of alarms per patient per day — and studies across intensive care settled on a brutal number: the overwhelming majority, in many studies more than ninety percent, are false or clinically irrelevant. Nurses, being adaptive systems, adapt: response times stretch, alarms get silenced preemptively, and occasionally a true crisis rings into a room where everyone has learned the sound means nothing. The literature calls it alarm fatigue, regulators have tied patient deaths to it, and aviation discovered the same dynamic in cockpits a generation earlier: warning systems designed on the theory that more alerting equals more safety, discovering instead that alert credibility is the safety-critical resource.
The mechanism is not negligence. It is signal detection theory operating on the humans: every false alarm is evidence about what alarms mean, and people update on evidence. A gate that cries wolf is not a neutral inconvenience — it is an active training program teaching its operator to ignore it.
Your gates are on the same curve
The previous lesson had you build stop-the-line gates for AI output. This lesson is the warning label: each of those gates is now an alarm system, and it sits on the same fatigue curve as the telemetry ward. The failure sequence is predictable to the week. Fresh gates over-trigger, because first specs are crude. Over-triggering breeds skimming. Skimming breeds the reflexive override. And the reflexive override is indistinguishable, on the decisive day, from having no gate at all — worse, actually, because the gate's existence has been quietly reassuring you that the stream is covered.
The cruel symmetry: gates exist to filter noise, and an untended gate becomes noise — one more thing that interrupts without informing. The cascade's guardians need guarding.
The meta-gate
The remedy is structural, not motivational: audit the auditors. Three practices make a filter network self-healing rather than self-degrading.
Log dispositions. Every stop gets marked true or false alarm at the moment it is handled — two seconds, but it converts vague irritation into computable precision. Undispositioned alarms are the dark matter of gate systems; nothing about them can be tuned.
Review precision on a cadence. Monthly is enough. Per gate: alarms fired, share true, trend. Signal detection theory from Phase 7 applies verbatim — each gate has a criterion, the criterion is a choice, and the false-alarm log is exactly the data that choice should be made from. A gate below the credibility floor gets retuned, narrowed, or retired.
Prune without sentiment. Deleting a gate feels like accepting risk. Often it is the opposite: removing a low-precision gate restores the credibility of the ones that remain, and total catches rise. Fewer, trusted alarms outperform many, doubted ones — the ICU studies and the cockpit redesigns agree.
Design rules that prevent the crying
Cheaper than curing fatigue is not inducing it. Four rules from the alarm-engineering literature translate directly to personal gates.
Tier the responses — not every violation deserves a line-stop; some conditions should annotate rather than halt, reserving the full stop for the catastrophic classes. Alarm on conditions, not events — "provenance missing" should fire once per artifact, not once per read. Prefer few sharp conditions over many soft ones — every vague check ("seems low quality") is a false-alarm factory. And give every gate an owner and an expiry: a gate nobody is responsible for retuning is a gate already halfway to being ignored, and a gate built for last quarter's failure mode should have to justify its continued existence.
The healing loop, named
Step back and see what the meta-gate completes. Artifacts carry expiry dates, so contents decay and get re-validated. Contradictions stop saves, so wrong beliefs get caught at entry. Gates check every output, so defects stop the line. And now the gates themselves are logged, reviewed, and pruned, so the checking layer cannot silently rot.
That is the full self-healing property this path promised: a system that corrects its knowledge, its intake, and its own correction machinery — the last loop being the one almost everyone omits, and the reason most elaborate filtering setups are quietly dead within a year while their owners still believe in them.
Sources
- Sendelbach, S., & Funk, M. (2013). "Alarm fatigue: a patient safety concern." AACN Advanced Critical Care.
- The Joint Commission (2013). Sentinel Event Alert 50: medical device alarm safety.
- Wiener, E. L. (1977–88). Cockpit alerting research — credibility as the scarce resource in warning systems.
Put it into practice
Exercise
Audit one gate you already run — a lint rule you always override, a notification you always swipe away, an AI-checker whose flags you skim. Pull its last twenty alarms and sort them: true positives (the stop was warranted), false positives (nothing was actually wrong), and unclear. Compute the precision. Below roughly one-in-three true, the gate is actively training you to ignore it and needs surgery: raise its threshold, narrow its condition, or delete it and let a stricter later gate carry the load. Write the decision down — gates deserve decision records too.
Watch for the failure mode
Responding to a missed defect by adding sensitivity everywhere. It is the instinctive move — something got through, so lower every threshold, add more checks — and it manufactures the next miss: more alarms, lower precision, faster fatigue, reflexive dismissal, and the next real defect dies in a crowd of trivial stops. Alarm systems fail upward: past a saturation point, each added alert reduces total catches. The discipline that feels negligent (removing gates, raising thresholds) is often the one that restores detection.
Make it stick
Give your gates a memory. From today, every stop gets a two-second disposition mark: true alarm or false alarm — a check column in the collision ledger, a reaction emoji on the alert channel, anything persistent. Then put thirty minutes on the calendar monthly: per gate, count dispositions, compute precision, and act — retune the criers, retire the dead weight, and notice which failure classes have no gate at all. This half hour is the healing function of the entire cascade: the filters that watch your information are now watched by you.