ACI-019: Prove the Reversal First

Thesis

When a step's effects land outside the repository there is no revert. Prove the undo before you take a destructive step, stop and hand over when an interface cannot tell you what it is about to act on, and read the existing state before invoking anything that generates or rotates. The one surface that can refuse a command outright is the permission file, and in the course's evidence its deny list was always empty.

Story

In September 2026 an agent working in Lamplight set up mail authentication for the human's twelve domains, work that lives in a provider's console and in DNS rather than in any repository. On the console page that switches signing on for each domain, the status text lagged behind the selected domain, the domain selector sometimes failed to change without any error, and the START and STOP buttons sat at the same screen position, differing only in their label. Three times a click meant to enable one domain disabled another, and each time it was caught only by reloading the page and reading the state back. The agent stopped with nine clicks left and handed them over, reasoning that finishing would trade a small remaining task against silently disabling signing on a live domain (Lamplight@d83e9610c, 2026-09-04). The next day the human re-authenticated the console and handed the work back; the nine clicks were made, and all twelve domains were then re-verified one at a time after a page reload (Lamplight@1f9d61c6c, 2026-09-05).