Nothing is waiting for a person. Escalations appear here when a fault has no policy, when the action needs a credential, spending, an irreversible change or hands on hardware, when the node that would run it is unreachable, or when automation tried and the fault did not clear.

Every gate is evaluated from state VIN already holds. Losing Home1 removes the actions that would have run there — they are refused as unreachable and escalated, naming what has to come back first — and removes the Home Assistant notification channel, which is declared best-effort and degrades to the local record. It does not remove the engine, the ledger, the policies, or any VIN-local remediation. Home Assistant is an input and a notifier here, never a gate.

• Up This console required
  /remediation and /incidents on VIN, loopback only
• Up Audit ledger required
  remediation.jsonl in JARVISOS_STATE_DIR on VIN, append-only, 0600
• Up Home Assistant notification
  HA notify service, reached through the control plane on Home1

Verification. An action is not a fix until the fault clears and holds. Every automatic attempt carries a verification window and a stability hold; if the entity is not ok by the end of the window the attempt is a failure, is rolled back where an undo exists, and escalates with the attempt record attached. Evidence-gathering steps declare verify.kind "action-succeeded": collecting replication state does not make anything better and must not claim to have.

Budgets. Four independent bounds, because a remediation loop with one bound has none: attempts per incident, a cooldown between them, a per-entity and estate-wide budget inside a rolling hour, and one action in flight at a time. Above all of them sits a circuit breaker — three failures inside an hour suspends every automatic action for thirty minutes and escalates instead. Faults younger than the settle window are left alone entirely, so a single missed heartbeat can never start anything.

Escalation. Escalation is not a notification. It carries the fault, the incident, the last known good state, every attempt and its outcome, what the loss costs in capability, and the exact next action with its precondition and its undo. A fault escalates when no policy covers it, when the action needs a credential, spending, an irreversible change or hands on hardware, when the node that would run it is unreachable, when attempts are exhausted, when an attempt ran and did not verify, or when the breaker is open.

Rollback. Delete config/remediation.json. The console reports the engine as unloaded, the /remediation page says so, and nothing else changes: incidents, recovery tasks, the dependency graph and the action catalogue do not depend on it. To disable automatic execution without losing the analysis, stop the timer that runs scripts/jarvisos-remediate.mjs — the console has never executed anything and cannot start.