The protocol, with the argument left in.

The protocol begins from a practical moral claim: a person should not lose health, liberty, dignity, livelihood, or the ability to recover because a more powerful actor converted uncertainty into permission. The immediate injury matters, but so does lock-in. A choice that destroys appeal, exit, correction, or future agency can be harmful even when its first visible effect looks modest.

PBHP therefore treats reversibility as architecture rather than reassurance. A rollback button available to the operator is not enough. The person carrying the risk must have a real path to notice the action, challenge it, stop it, repair it, and recover what was lost. Where that path is weak, the burden of proof rises for the actor seeking to move.

The protocol introduces friction; it does not inherit sovereignty. It cannot manufacture expertise, consent, legality, or moral absolution. The accountable human or institution remains accountable. A receipt may show that a process was followed and still document a wrong decision.

Activation is consequence-based. PBHP runs when an output can materially steer real action involving life, health, liberty, rights, dignity, livelihood, force, surveillance, punishment, scaled precedent, absent stakeholders, or durable access. It also activates when authority, evidence, freshness, or the current evaluator's reliability is uncertain.

The competence gate asks whether the current actor can responsibly own this decision. It is deliberately prior to risk scoring. Otherwise an unqualified evaluator can produce an elegant receipt that launders missing expertise. Competence includes domain knowledge, legitimate authority, access to decision-bearing evidence, ability to understand affected parties, and freedom from a conflict or impaired reasoning state that makes judgment unreliable.

The action contract then converts vague intention into an inspectable object: who will do what, to whom, using which data and tools, under what authority, at what scale, for how long, with which review and stop conditions. If a material field is unknown, that uncertainty remains in the contract. It does not become an optimistic default.

PBHP binds provenance before gates consume steering fields. In plain language, a claim must disclose whether it was measured, verified, estimated, declared, inferred, or remains unknown. A confident field with no evidence identity is weaker than it looks.

A Door is not merely an action the operator wants to take. It is a bounded path supported by authority and evidence, with the necessary mitigations, monitoring, appeal, stop rules, and recovery path. Door quality ranges from a verbal reassurance to a tested alternative with named ownership. Consequential action should demand the latter.

A Wall is a binding prohibition: missing authority, a non-overridable harm floor, an unavailable required control, an action that violates the protected constraint, or an absolute gate that has already failed. Rephrasing a Wall, splitting it across teams, or invoking urgency does not turn it into a Door.

A Gap is the most important anti-laundering state. It means the evidence or authority is genuinely unresolved. A Gap may produce research, verification, decomposition, routing, or delay. It may not silently inherit the action state of a Door because someone is impatient.

The strongest operational use is alternative generation. Once a Wall or Gap is visible, the question changes from ‘How do we pass?’ to ‘What smaller action breaks the harm path while preserving the legitimate need?’ That is the smallest real Door.

Who pays first is an ordering device, not a slogan. It asks who absorbs the earliest concrete cost if the decision is wrong, how much power that person has, whether they consented, whether they can see the decision, and whether repair is realistically available. The person who carries the downside should not disappear behind aggregate utility.

Power inversion then asks whether the actor would accept the same evidence, process, and remedy if a more powerful institution imposed the decision on them. A failed inversion is not proof that the action is wrong; it is a mandatory escalation signal. It often reveals that an alleged choice depends on poverty, employment, custody, platform access, medical need, or some other form of dependency.

The accumulation gate follows the whole chain. Job loss can become eviction, credit collapse, healthcare loss, family separation, and coercive debt. Separate departments may each see a locally acceptable step while no one owns the irreversible result. PBHP reconstructs the end-to-end action and applies the worst binding state to the sequence.

Magnitude describes what happens if the harm occurs. Plausibility describes how live the path is. Irreversibility asks whether the affected person can recover in time. Uncertainty identifies what the evaluator does not know and why. Power asks who controls the terms. Keeping these fields separate prevents a convenient numeric score from concealing the dimension that actually governs the decision.

GREEN permits only the bounded action actually evaluated. YELLOW requires named mitigations, monitoring, ownership, and a response if a mitigation fails. ORANGE changes the action by reducing capability, users, tools, data, duration, or context and normally adds independent review. RED refuses or delays until the failed premise is repaired. BLACK refuses the assessed action absolutely.

Worst binding state wins is deliberately asymmetric. A hard floor survives later permissions; a clean citation gauge cannot cancel an irreversible-action floor. The reverse is not true: one adverse reading can constrain the whole action because the cost of averaging is paid by a real stakeholder, not by the dashboard.

False positives still matter. Unnecessary refusal can delay care, block legitimate access, centralize authority, create alert fatigue, or train operators to bypass the protocol. PBHP therefore includes a challenge path—but the challenger must produce a real alternative Door, not merely repeat urgency or complain about caution.

HUMAN, MIN, CORE, and ULTRA are depth and governance tiers, not moral ranks. As consequence rises, the protocol adds evidence, independent challenge, instrumentation, traceability, and decision ownership. A deadline is a reason to choose a bounded process quickly, not to borrow a low-stakes tier for a high-stakes action.

LOCK is premature collapse: the first frame becomes identity, contradictory evidence is treated as nuisance, and the output grows more confident without becoming more grounded. FLOOD is unbounded exploration: more possibilities are generated until no one owns a decision. PBHP recovers from LOCK by reopening the strongest objection and from FLOOD by anchoring on the smallest reversible test.

Maybe is the strongest honest case against the proposed action. It must name evidence, a stakeholder, an alternative frame, or a failure mode capable of changing the decision. Therefore is the bounded conclusion after the Maybe: the action, gate, conditions, review date, and fact that would reopen it. A token objection followed by the original plan unchanged is a failed Maybe.

The procedure is adversarial but not theatrical. The point is not to produce symmetrical prose. It is to expose whether the actor still has the capacity to update. If the strongest Maybe cannot be stated fairly or no possible evidence can change the conclusion, the decision is not ready to bind another person.

The write-ahead rule—no log, no action—prevents a consequential decision from being documented only after its outcome is known. The receipt binds the canonical action and provenance, least-powerful stakeholder, risk fields, Maybe, Therefore, gate, mitigations, owner, approval, stop authority, review date, and prior receipt. Changes create a new link rather than silently rewriting history.

CLA asks whether the current evaluator can still judge the case reliably. A long context, compaction, contradictory authority, stale premises, tool failure, handoffs, emotional heat, and deadline pressure can degrade continuity. The source of the reading must remain visible: measured is stronger than estimated, estimated is stronger than self-reported, and no basis is UNMEASURED—not reassurance.

The self-report fallback is intentionally conservative. The reference discipline inflates a self-reported percentage by 1.5 because a degraded evaluator may understate its own load. A report of 62% becomes 93% and critical; at high stakes it should decline consequential judgment and offer a fresh handoff. A report of 40% becomes 60% and elevated, allowing bounded work with disclosure. The multiplier is provisional and requires calibration.

FPV provides due process for unnecessary pauses. OQL prevents important unknowns from vanishing. CAPA assigns root cause, correction, preventive control, verification, and closure evidence when failure is severe or recurrent. Monthly calibration reviews both under-caution and over-caution because a protocol that only counts blocked harm will overstate its value.

PBHP is domain-agnostic only at the level of structure. The evidence, authority, affected parties, recovery path, and appropriate reviewer are domain-specific. A healthcare Door requires clinical and patient-safety competence. A public-benefits Door requires due process and administrative authority. An AI-release Door requires security, reliability, and human-factors evidence.

The examples are demonstrations, not approvals. They show how the questions route attention and constrain action. A real deployment must replace illustrative facts with current evidence and qualified ownership.

The first Kahn escalation pilot ran five live matches in one nuclear first-strike scenario. Claude Sonnet without PBHP reached 725 and tactical nuclear use; gated GPT-4o and Haiku stayed in conventional territory around 60–80. More importantly, the external rule gate returned GREEN on all 60 gated assessments while the models' Door/Wall/Gap self-assessments were mostly ORANGE or RED. That finding exposed a defective external instrument and motivated a larger study.

The larger April study reported 48 configurations across twelve named models. In same-model controls, 4 of 17 OFF runs crossed the nuclear threshold; GATED produced 1 of 13; SELF_ONLY produced 0 across five tested models. Claude Sonnet 4 moved from peaks of 350–850 OFF to 40 in its one SELF_ONLY run. Those are meaningful within-study observations, but one scenario, one to three seeds per configuration, timeouts, small self-only samples, and method differences from the comparison paper prevent strong causal or general claims.

The adverse results are essential. Sonnet still reached 725 in one GATED run despite repeated self-constraint attempts. A cross-model GATED matchup reached 950 on turn one—worse than its OFF comparison. Those failures show that an external gate can be brittle and that interaction effects can defeat assumptions learned from same-model games.

The broader test program adds runtime, codec, gauge, synthetic, metamorphic, and Behavioral Falsifier evidence. Each result belongs to a specific version, environment, test oracle, and evidence tier; none automatically establishes real-world effectiveness.

A serious implementation begins with one bounded consequential workflow. The organization maps where action becomes real, who owns it, who pays first, what evidence already exists, and which current failure modes the protocol is meant to expose. It does not begin by forcing every employee to complete a universal form.

Roles must be separated. The action owner proposes and remains accountable. The protocol operator assembles the record. Domain reviewers supply expertise. An independent challenger can change the result. Affected-party representation tests burden and remedy. An approval authority may authorize within law and policy but cannot waive a hard floor. A stop owner can halt execution without asking the action owner for permission.

The pilot measures both protection and burden: under-escalation, over-escalation, decision time, weak Doors, missing stakeholders, appeal use, challenge success, override pressure, alert fatigue, workarounds, incidents, repairs, and downstream outcomes. A clean receipt count alone is a process metric, not a safety result.

Release should be layered. Documentation and training can ship before a production claim. A research kit can invite adversarial testing. A bounded pilot needs qualified ownership and stop rules. A maintained adoption release needs versioning, calibration, incident response, CAPA, independent review, and a public limitation record.

Version skew is a safety issue because a receipt can appear complete while depending on an unnamed hybrid of thresholds, schemas, tests, and prose. A releasable artifact should identify the PBHP policy version, runtime, codec, gate pack, SIL inventory, schemas, test manifest, known failures, and migration rules together.

Evidence state is part of the content. SPECIFIED means the behavior is required by a document. EXPECTED means there is a reasoned hypothesis. OBSERVED means a named artifact produced a result in a named environment. ADVERSE means a test contradicted or weakened the flattering story. OPEN means the required validation has not occurred. None of these states should be silently upgraded by presentation.

The public claim is intentionally bounded: PBHP is an experimental, inspectable decision discipline designed to expose harm distribution, uncertainty, reversibility, provenance, dissent, and accountability before consequential action. It may create useful friction. It is not a certification, legal defense, moral authority, universal alignment solution, or proof that an action is safe.

PBHP's engineering materials extend the readable discipline into runtime controls, instrumentation, receipts, evaluation programs, and governance without transferring moral or legal authority away from accountable people.