The Asymmetric Cost of Being Wrong

A single-thesis essay that transfers to any system with asymmetric failure costs: circuit breakers, retry policies, auto-scalers.

The lopsided matrix

Neurotoken is a prompt scorer that routes each Claude Code prompt to one of eleven model/effort tiers. Its tuning is deliberately crooked: modifier escalation caps at +2, de-escalation caps at -1. The bucket threshold was lowered from 3 to 2 at neurotoken-signals.mjs:45, with an inline note: over-classifying stakes is cheaper than under-classifying.

That lopsidedness is not a bug I am confessing to. It is the design, and it is the thesis: when the two directions of being wrong cost different amounts, a symmetric system is the mistake.

Why this is load-bearing

In ceiling mode, under-scoring routes a hard prompt to Haiku. Haiku fails. The retry costs more than the Opus call you were trying to avoid: you pay for the failed attempt, the diagnosis, and the escalation you should have made the first time. Over-scoring routes an easy prompt to Opus and wastes cents. The asymmetry isn't stylistic. It's economic.

So the scorer leans the way the costs lean. It will overpay on some easy prompts, and that overpayment is visible in the logs: a labeled premium, not a hidden one. What it will not do is quietly feed hard problems to a model that cannot hold them.

The same crooked rule, five more times

Once you see the shape, it turns out I had been building it all over GBuild's fleet infrastructure without naming it:

Circuit breakers. An autonomy playbook that faults trips its breaker after three strikes (the threshold is a constant in the source) and stops acting until a human resets it. A breaker that trips too eagerly pauses real work for a while. A playbook that keeps acting while wrong compounds its damage on a cron schedule. The breaker leans toward stopping.

Spend ceilings. The LLM proxy enforces tier-aware daily dollar ceilings at the request path. Refusing a request over the ceiling annoys one user once. An unbounded bill is a different category of morning. The ceiling leans toward refusal.

Sandbox spawns. A third-party app process launches only if a sandbox profile can be generated for it; no profile, no spawn. Refusing to launch a legitimate app is a support ticket. Launching an unconfined untrusted process is an incident report. The spawn path fails closed.

Revocation. A pulled app stays revoked from a local cache even when the machine is offline. Blocking a wrongly-revoked app until the next sync is friction. Letting a known-bad bundle re-enable itself because the network was down is the exact hole revocation exists to close.

Alerting. The heartbeat monitor pages on the absence of a signal, not just on errors. A false alarm about a healthy install costs a glance. A silently stalled install costs however long it stays silent. The alert leans toward paranoia, with dedupe and suppression windows, because a system that cries constantly gets unplugged, and then you have chosen the expensive direction after all.

What travels

None of this is an AI insight. Retry policies, auto-scalers, rate limiters, medical screening: every one of them has a direction in which being wrong is merely annoying and a direction in which it is catastrophic, and every good one is calibrated crooked on purpose.

The failure boundary is real: crooked systems overpay, by design, and the premium has to stay visible or it silently grows. But the alternative is symmetric neatness that treats a wasted cent and a compounding failure as the same event.

You do not get to stop being wrong. You get to pick the direction. Pick the one you can afford.