Heard Is Not Meant

The Steward Speaks. The Steward Sees. The System Reads. routed the command route through voice because speech is the human's fastest output, and left the consequences of that choice at the Physical Intervention Threshold for later. The Steward Was Not Slow. The Steward Was Blind. reached the same gate from the other direction — the Steward answering an escalation from a picture that had already moved — and handed the command side of the gate to this memo. So this is the memo about what happens between a Steward saying something and a system doing something that cannot be undone.

A spoken command has three properties that matter here, and they compound. It is transient for the human: once said, it cannot be re-read, so the Steward cannot check their own instruction against their intent. It is lossy for the agent: it arrives as audio and is resolved into structured intent, and the resolution can differ from what was said. And above the threshold it is irreversible in effect: the action on the far side — a release against inventory, a machine started, a commitment another agent will now count on — has a Rollback Cost high enough to have set the threshold, and at the limit cannot be undone at all. Any one of these is manageable. Together they describe a channel that is fastest for issuing an instruction and least able to guarantee that the instruction executed is the one that was meant.

The commit rule under which a Steward command that would trigger an action above the Physical Intervention Threshold is not executed as heard, but is rendered back to the Steward on the verification route as the specific state change it will produce, and executed only on the Steward's confirmation of that rendering — the Transcoding Layer's response to a command that is transient for the human, lossy for the agent, and irreversible in effect.

That is Round-Trip Commit. It does not slow the command route. It adds a second use of the verification route before the action, and it changes what travels on that route.

Two gaps between meant and done

Between a Steward's intent and a system's action there are two places the instruction can go wrong, and voice widens both.

The first gap is between what the Steward meant and what they said. Humans misspeak: a wrong line number, a quantity that came out as the last one they were thinking about, a counterparty's name substituted for a similar one. On a typed channel the Steward reads their instruction before sending it, and the sender has the chance to catch them. On a voice channel the instruction is gone as it is issued. The Steward's fastest output is also the one they cannot review.

The second gap is between what was said and what the agent resolved it to. Speech reaches the system as audio and is converted to structured intent, and the conversion has an error rate that rises with noise, accent, similar-sounding identifiers, and the length of the instruction. Bandwidth Inversion already placed audio below text on the agent's side for exactly this reason: the structure has to be recovered, and recovery can be wrong. The agent, having resolved the command, has no independent way to know whether its resolution matches the intent. Only the human knows what was meant.

Below the threshold, neither gap matters much. A wrong action is undone, the Intervention Threshold records one more exception, and the system continues. Above it, the cost of either gap is the Rollback Cost of the resulting action — the cost the threshold exists to gate — and the action was taken at agent latency on the strength of an instruction nobody checked.

The rule, and what it renders

Round-Trip Commit has three parts, and the order is the rule.

The command is received on the command route, by voice, at the speed voice allows. Nothing about the Steward's fastest channel is given up.

Before anything executes, the system renders back to the Steward, on the verification route, what it is about to do. Not the words. A transcript would confirm only that the audio was captured, and the Steward who misspoke would read their own error back and confirm it. What the system renders is the state change the resolved intent produces: this line, these hours, this counterparty, this commitment, this consequence for the commitments already standing. The Steward's fastest input is vision, so the rendering is visual — a change the Steward can scan in a moment against what they meant, rather than a sentence they must hear again in sequence.

The Steward confirms that rendering, and only then does the action proceed. An echo checks reception; Round-Trip Commit checks consequence. Confirmation is of the state change, so it closes both gaps at once: a misspoken quantity and a misheard one produce the same wrong rendering, and the Steward rejects either without needing to know which gap it came from.

The design choice that carries the rule is what travels on the return leg. Rendering state instead of echoing words is the difference between a check that catches errors and one that rehearses them. That is not a preference. It is the lesson of the one field that has run a voice commit loop at scale for decades.

What aviation already learned

Air traffic control issues clearances by voice, and the actions they authorise — an altitude, a heading, a runway — cannot be taken back once the aircraft moves. The response is a mandatory readback: the flight crew repeats the safety-related parts of any voice clearance so the controller can confirm correct reception before it takes effect. A confirmation loop around a transient, lossy command with irreversible effect already exists at scale.

Its failure record is the instructive part. A Department of Defense analysis of 386 Aviation Safety Reporting System reports found, among the most common contributing factors, pilots accepting the clearance they expected rather than the one the controller said. The failure has a name — the hearback error: the pilot reads back what they thought they heard, the misunderstanding is baked into the readback, and the controller, hearing a fluent readback, passes it. ASRS has warned for thirty years that controller silence is not confirmation. And the uncorrected error, in the EUROCONTROL safety knowledge base's account, goes undetected until the controller sees the deviation on the situational display.

Read that last clause with the Transcoding Layer in hand. The readback confirms reception. It does not confirm consequence, and what catches the consequence is an independent visual representation of state sitting outside the loop. Round-Trip Commit brings that representation inside the loop and makes it the thing confirmed. Aviation learned to confirm the transmission. Arco asks the system to confirm the consequence — and two things in that move are Arco's: calibrating the loop by Rollback Cost rather than inheriting it from the channel, and putting rendered state on the return leg rather than the words.

Scoped by reversibility, not by channel

The rule fires on what the action costs to undo, not on how the command arrived. A typed command that would trigger an action above the threshold round-trips, because a typed command can be wrong — the first gap is narrower on a typed channel, not closed — and the Rollback Cost does not care which channel the error came through. A spoken command that would trigger a cheap-to-undo action does not round-trip, whether or not the surface could render it, because the delay would serve no function.

That second half is where the Authorization Trap sets the boundary. A gate the operator cannot remove after it has stopped serving a function is the trap the Intervention Threshold is designed to avoid, and a round trip on every voice command would be exactly that: a confirmation step that made the fast channel slow for no reduction in Rollback Cost. Round-Trip Commit is calibrated by the same variable the Physical Intervention Threshold introduced — the cost of a single wrong action — and inherits its discipline. Where reversibility is high, the Steward speaks and the system acts. Where it is low, the Steward speaks, sees, and then the system acts.

What the rule is not, and what it depends on

Round-Trip Commit is not Exception Architecture. Exception Architecture governs what the system does when it meets a state it does not recognise and cannot resolve. In a round trip the system has recognised the state perfectly well; it has resolved the command to a specific change and is ready to make it. What it does not know, and cannot know from its own side, is whether the resolved change is the one the human meant. The round trip is the only way to ask, and the human is the only party who knows what was meant.

The rule also depends on the route it reuses. The rendering the Steward confirms is a picture of current state and the change about to be made to it. A Steward in Verification Blindness at the gate — whose picture already lags the system — confirms a change against a state that has moved, and the round trip becomes a formality that produces the same wrong action with an extra step. Round-Trip Commit closes the two gaps between meant and done. It does not close the gap between the Steward's picture and the system, and it fails if that gap is open. The verification route has to be healthy before it can be used twice.

The Operator's Verdict

A surface that accepts voice commands with physical effect has a commit rule whether or not anyone wrote one down. If nothing was written, the rule is execute as heard, and the operator has accepted that a misspoken or misheard instruction above the threshold is carried out at agent speed.

The check is short. For every action above the Physical Intervention Threshold, the Steward should see the specific state change the system is about to make, rendered rather than repeated, before it is made — and nothing below the threshold should be made to wait. If the surface echoes the words, it has learned the half of the aviation lesson that was easy to copy. If it renders the change, it has learned the half that was written in the incident reports.

Technology changes what is possible. Irreversibility determines what is confirmed.