HEALTH
健康信号Health signal
模型、检索与缓存分别报告可用性。Model, retrieval, and cache report health independently.
01 ·
导航没信号时，是显示旧地图还是自信地编一条新路01 · When navigation loses signal, should it show a cached map or
invent a road?
模型服务与检索服务可能分别掉线。用户最需要看到的是“能力变弱了”还是一个看似完整、其实不可验证的答案？Model and retrieval services can fail independently. Does the user need an explicit capability downgrade or a complete-looking answer that cannot be verified?
02关闭模型或检索服务，观察路径依次切到缓存、规则与人工并同步风险标签Turn Off Model or Retrieval and Watch the Path Fall Back Through Cache, Rules, and Human Review
能力阶梯 · 同步标签capability ladder · synced labels
状态 AMetric A
—
—
状态 BMetric B
—
—
状态 CMetric C
—
—
所有概率、分数、成本、token 与输出均为固定种子的教学模拟，不代表真实模型输出。把主变量拖回即可复核结论。All probabilities, scores, costs, tokens, and outputs are fixed-seed teaching simulations, not real model output. Move the main variable back to verify the conclusion.
03把刚才的变化拆成 4 个零件Break the Change into Four Parts
Degradation and FallbackORDER
回退顺序Fallback order
缓存保留已审定答案，规则只覆盖窄场景，最后交人工。Cache preserves reviewed answers, rules cover narrow cases, and humans take the rest.
LABEL
能力标签Capability label
路径一变，能力、延迟与风险说明必须同时变化。When the path changes, capability, latency, and risk labels change with it.
STOP
安全停点Safe stop
没有适用回退时停止自动出站，而不是偷偷继续主路径。When no fallback fits, stop automated egress instead of silently continuing.
04最小机制：主交互能逐项验证Minimal Mechanism: Verify Each Link in the Interaction
MECHANISM
route = first_healthy(primary, cache, rules, human)
回退按能力从高到低选择第一个健康路径；标签来自实际路径，而不是沿用主路径宣传语。Fallback selects the first healthy route from highest to lowest
capability. Labels describe the actual route, not the primary
path's promise.
关闭服务Disable service健康信号变红health turns red
选择下一级Select next tier能力与延迟变化capability and latency change
同步告知Sync disclosure用户知道风险user sees the risk
05同时关闭模型、检索与缓存，再强行请求自动回答Disable Model, Retrieval, and Cache, Then Force an Automated Answer
主动制造失败Create a failure边界实验Boundary experiment
回退链走到底必须进入人工或阻断。继续伪装成完整能力会把可控故障变成不可见风险。At the end of the fallback chain, route to a human or block. Pretending full capability turns a controlled outage into hidden risk.
尚未执行。先在主交互中观察正常机制。Not run yet. Observe the normal mechanism in the main interaction
first.
✗ 降级时界面不必告诉用户。Users need not know about degradation.→ ✓ 能力、延迟与风险标签必须跟路径同步。Capability, latency, and risk labels must follow the
route.
✗ 缓存永远比人工更可靠。Cache is always safer than a human.→ ✓ 缓存可能过期或不覆盖当前问题。Cache may be stale or irrelevant to the current
case.
✗ 主路径恢复就立即全量切回。Recovery means immediate full return.→ ✓ 恢复后仍要健康确认并受发布门控制。Recovery still needs health confirmation and release
gates.
06 · 一句话带走06 · One line to keep