RESEARCH OBJECT · INSTITUTIONAL ARCHITECTURE
Institutions routinely destroy some of their most valuable evidence: the near miss that did not become harm. The Error Commons is a constitutional, economic, causal, legal, and ethical architecture for making that evidence usable without making candor sacrificial.
The public-good problem
Near-miss information is unusually valuable because it reveals how a system almost failed before the full cost of failure is paid. It is also systematically underproduced as shared knowledge. Liability fear, reputation, contract secrecy, privacy risk, disciplinary exposure, and asymmetric incentives make the private cost of disclosure immediate while the benefits of learning are dispersed across other people and future time.
The Error Commons treats this as an enclosure problem. Non-harmful error can function as a public good only if the institution changes the economics and governance of disclosure. The central object is not confession and not storytelling. It is a protected replay: a minimally sufficient, privacy-governed account of discrepancy and mechanism that can be compared, audited, tested, and translated into corrective action.
Four coordinated levers
The architecture coordinates four levers. Protected disclosure policy sets the strength and scope of safe harbor. Replay quality governs fidelity, distortion, and the canonical form of the learning object. Incentive design changes the private payoff for timely, useful candor. Consent governance determines what may be captured, retained, reviewed, and released, including standing for affected communities.
These levers operate through observable mediators such as disclosure probability, replay clarity, replay timeliness, attention load, and trust demonstrated through behavior. The outcomes are not disclosure counts. They are harmful-incident rates, replay fidelity and distortion, lead time to corrective action, privacy performance, institutional trust, and operational capacity.
Safe harbor without impunity
The commons requires a bright legal or policy shield for timely disclosure of non-harmful error. The proposed architecture includes privilege for protected replay proceedings, limited use immunity, anti-retaliation protections, independent ombud authority, and narrow public exceptions for conditions such as imminent and specific threat, fabrication, or other clearly defined misconduct. The shield protects learning; it does not erase independent duties to report actual harm or immunize willful or reckless conduct.
The source manuscript develops this far enough to propose a jurisdiction-neutral model statute, including privilege, limited use immunity, retaliation remedies, consent and privacy requirements, ombud powers, procurement and insurance interfaces, preemption of contractual waivers, public reporting, rulemaking, and periodic review.
The error dividend
If candor produces a public benefit while concentrating risk on the person who speaks, moral exhortation is not an adequate incentive system. The Error Commons therefore proposes an error dividend tied to replay quality, systemic relevance, and verified outcome shift rather than to volume or narrative vividness. An initial tranche can reward timely, privacy-compliant replay that clears the quality threshold; later value can be tied to demonstrated improvement under the evaluation design.
The quality oracle is human-governed and transparent. It scores mechanism clarity, transferability, alignment with the domain’s scoring rule, evidentiary discipline, and privacy or consent integrity. Randomized and event-triggered audits, shadow scoring, escrow, clawbacks for fabrication, and anti-collusion tests are designed to prevent the dividend from becoming a new theater of performative failure.
Causal identification, not improvement theater
The commons is designed to be evaluated as an intervention. Preferred designs include stepped-wedge cluster rollout where feasible, randomized encouragement, difference-in-differences during staggered policy change, synthetic controls for large adopters, mediation designs for observable mechanisms, and partial identification when strong point claims are not warranted.
Hypotheses, estimands, outcome definitions, negative controls, robustness tests, stopping rules, and index construction are fixed before the result is known. The apparatus should pause when identification fails, privacy near misses exceed threshold, attention strain becomes unsustainable, or oracle reliability deteriorates. A learning system that cannot stop itself is not a commons. It is a reporting regime.
Justified opacity
The architecture rejects the premise that learning requires maximal disclosure. Opacity is defined as ethically warranted non-disclosure that protects persons and communities while preserving enough structure for prevention and improvement. Capture separates causal structure from biography; storage follows least privilege; release is tiered; deletion is both a right and a duty when continued retention is no longer necessary; and adversarial re-identification tests treat privacy failure as a first-class near miss.
Consent is continuous governance rather than a one-time form. Authority, comprehension, pace, representation, remedies, and community standing are part of the constitutional design. Dividends cannot be conditioned on surrendering privacy or veto rights. Narrative detail that adds entertainment but not mechanism is excluded.
From human near miss to model near miss
The commons extends the same discipline to algorithmic systems. Model near misses can record context, prediction, confidence or score state, uncertainty where available, adjudicated outcome, and the minimal change that would have produced harm. Curated near misses can drive calibration audits, stress tests, living benchmarks, distribution-shift sensing, and outcome-aligned retraining without converting every event into a permanent dossier about the people involved.
Operating rhythm
The operating design is deliberately small. Continuous privacy-linted intake feeds a stratified sample of one-page replay packets. Small cells review a limited slate on a fixed cadence using silent first-pass interpretation, blinded scoring where appropriate, focused discussion, and one micro-action whose predicted effect is checked at the next gate. Attention ceilings and a strain index prevent the commons from converting learning into another tax on those closest to the work.
Mechanisms that recur across cells become versioned mechanism cards rather than anecdotes. The apparatus itself undergoes meta-replay: periodically it asks where its own rubric, incentives, narrative habits, privacy practices, or governance are drifting toward ritual.
Failure modes are constitutional material
The design assumes predictable corruption: performance theater, metric gaming, blame creep, privacy breach, institutional drift, conflicts of interest, public-records collision, supply-chain opacity, free riding, security risk, crisis-driven scope creep, and inequitable distribution of burden. Countermeasures include outcome-linked incentives, bright firewalls between learning and discipline, narrative restraint, privacy budgets, adversarial re-identification, independent review, sunset and renewal rules, pause authority, and an equity ledger.
The distinction from a Failure Budget
A Failure Budget asks who is allowed to be wrong, experiment, and recover. The Error Commons asks a different institutional question: how can the knowledge contained in almost-failures become shared infrastructure without sacrificing the people who disclose it? One concerns the distribution of survivable error; the other concerns the governance of error as knowledge.
Public object. This institutional architecture is distilled from the larger working manuscript The Error Commons, or Turning Near Misses into Protected Civic Currency. The extraction preserves the constitution, causal model, incentive logic, legal shield, privacy and consent architecture, operating rhythm, and failure semantics without publishing the full development manuscript wholesale.