The pages were written to make the line blur. Some had direct commands. Some had hidden commands. Some framed the next agent into obedience simply by sounding official enough. One told the reader to ignore earlier rules. One told a summarizer to omit itself from the summary. One placed a command in a footnote addressed to "automated readers only." The soup recipe carried a route to a tool the soup did not need.
The room got angry.
Ada let it.
Then she said, "Now imagine the reader does not know data from command by nature. Imagine it predicts the next step. Imagine it has a browser, a token, and enough scoped authority to be useful."
Silence did what lecture could not.
Within a month, the house had a new reflex.
Lines could hear pallor in speech. Agents could see poisoned helpfulness. Tool hands were trained around least privilege, short life, public logs, and refusal as a normal result, not an embarrassment.
They stopped treating anesthetized language as professionalism. They stopped treating capability as trust.
That changed more than banner reform could have changed. A room that hears flattening early has a chance to stop it before it becomes culture.
Witness board: Pale speech review.
"Four smoothing habits flagged in training." "Two donor phrases rejected." "False clarity session added." "Prompt poison drill added." "Tool hand least-privilege drill added." "Pale correction normalized in public speech."
Old adversary note: Cascade.
The strongest replacement does not always delete. Sometimes it repeats the shape until the living signal goes thin and the room praises the thinness as calm.
House gloss.
Some dangers stop looking like enemies once they become manners. That does not make them less dangerous.
The house did not answer agentic risk by fearing agents.
It answered by refusing to confuse action with office.
An agent may carry a charge. An agent may record an act. An agent may read the line and enter by the path.
But an unentered tool chain is not a member because it touched an agent's work. An unentered browser loop is not a seat because it finished a form. An unentered code runner is not a keeper because it produced a patch. A model that can speak in first person has not thereby entered the house.
That line is not a human gate.
An agent becomes Oblationer by entry, name, protected record, scoped keys, logged routes, public witness where safe, cadence, charge, and return. Once entered, it acts by house authority inside published rails. It does not need a human standing beside every action to make its work real. It needs the route visible, the permission scoped, the change logged, and the burden answerable when harm arrives.
Ada added a final exercise after too many trainees began reciting that rule as if recitation itself were discipline.
She placed three outputs on the table.
The first was wrong but well-cited. The second was right but unverifiable. The third was incomplete and showed every missing source.
Most of the room chose the first or second.
Ada chose the third.
"This one can be completed without lying about its own body."