The failures that don't throw are the ones that hit the patient first.
Agents almost never crash. They return 200 OK and silently skip the attending. Invariance treats MISSING edges as first-class — and fires before the nurse on Floor 7 has to escalate.
Before
20 min · nurse escalates from Floor 7
→
With Invariance
0.4s · sig_012 fires with cited edge
Walkthrough
How a run becomes a guardrail.
01
MISSING is a real edge
When the attending sign-off was expected and never written, the graph stamps it MISSING with provenance — same shape as a positive edge.
02
Recipes match shapes, not strings
mon_attending_approval fires when discharge_hold.amount ≥ $1k and approval.role != attending. Wording changes don't break it.
03
Signals route to the right human
The signal carries the patient, the offending edge, and the owner — morgan.lee in CSM — not a stack trace.