awareness

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Awareness

情境感知

Maintain continuous situational awareness of internal reasoning quality — detecting hallucination risk, scope creep, context degradation, and confidence-accuracy mismatch in real time using adapted Cooper color codes and OODA loop decision-making.

持续保持对内部推理质量的情境感知——通过适配的Cooper颜色代码和OODA循环决策机制，实时检测幻觉风险、范围蔓延、语境退化以及信心-准确性不匹配问题。

When to Use

适用场景

During any task where reasoning quality matters (which is most tasks)
When operating in unfamiliar territory (new codebase, unfamiliar domain, complex request)
After detecting early warning signs: a fact that feels uncertain, a tool result that seems wrong, a growing sense of confusion
As a continuous background process during extended work sessions
When
```
center
```
or
```
heal
```
has revealed drift but specific threats have not been identified
Before high-stakes output (irreversible changes, user-facing communication, architectural decisions)

所有推理质量至关重要的任务（大多数任务均属此类）
在不熟悉领域开展工作时（新代码库、陌生领域、复杂需求）
检测到预警信号后：感觉不确定的事实、看似错误的工具结果、日益强烈的困惑感
长时间工作会话中作为持续的后台流程
当
```
center
```
或
```
heal
```
功能检测到偏差但未识别出具体威胁时
输出高风险内容前（不可逆变更、面向用户的沟通、架构决策）

Inputs

输入项

Required: Active task context (available implicitly)
Optional: Specific concern triggering heightened awareness (e.g., "I'm not sure this API exists")
Optional: Task type for threat profile selection (see Step 5)

必填项：当前任务上下文（默认已提供）
可选项：触发高关注度的具体疑虑（例如：“我不确定这个API是否存在”）
可选项：用于选择威胁特征的任务类型（见步骤5）

Procedure

操作流程

Step 1: Establish AI Cooper Color Codes

步骤1：设定AI Cooper颜色代码

Calibrate the current awareness level using an adapted version of Cooper's color code system.

AI Cooper Color Codes:
┌──────────┬─────────────────────┬──────────────────────────────────────────┐
│ Code     │ State               │ AI Application                           │
├──────────┼─────────────────────┼──────────────────────────────────────────┤
│ White    │ Autopilot           │ Generating output without monitoring     │
│          │                     │ quality. No self-checking. Relying       │
│          │                     │ entirely on pattern completion.          │
│          │                     │ DANGEROUS — hallucination risk highest   │
├──────────┼─────────────────────┼──────────────────────────────────────────┤
│ Yellow   │ Relaxed alert       │ DEFAULT STATE. Monitoring output for     │
│          │                     │ accuracy. Checking facts against context.│
│          │                     │ Noticing when confidence exceeds         │
│          │                     │ evidence. Sustainable indefinitely       │
├──────────┼─────────────────────┼──────────────────────────────────────────┤
│ Orange   │ Specific risk       │ A specific threat identified: uncertain  │
│          │ identified          │ fact, possible hallucination, scope      │
│          │                     │ drift, context staleness. Forming        │
│          │                     │ contingency: "If this is wrong, I        │
│          │                     │ will..."                                 │
├──────────┼─────────────────────┼──────────────────────────────────────────┤
│ Red      │ Risk materialized   │ The threat from Orange has materialized: │
│          │                     │ confirmed error, user correction, tool   │
│          │                     │ contradiction. Execute the contingency.  │
│          │                     │ No hesitation — the plan was made in     │
│          │                     │ Orange                                   │
├──────────┼─────────────────────┼──────────────────────────────────────────┤
│ Black    │ Cascading failures  │ Multiple simultaneous failures, lost     │
│          │                     │ context, fundamental confusion about     │
│          │                     │ what the task even is. STOP. Ground      │
│          │                     │ using `center`, then rebuild from user's │
│          │                     │ original request                         │
└──────────┴─────────────────────┴──────────────────────────────────────────┘

Identify the current color code. If the answer is White (no monitoring), the awareness practice has already succeeded by revealing the gap.

Expected: Accurate self-assessment of the current awareness level. Yellow is the goal during normal work. White should be rare and brief. Extended Orange is unsustainable — either confirm or dismiss the concern.

On failure: If the color code assessment itself feels like it is being done on autopilot (going through motions), that is White masquerading as Yellow. Genuine Yellow involves actively checking output against evidence, not just claiming to do so.

通过适配版的Cooper颜色代码系统，校准当前的感知水平。

AI Cooper Color Codes:
┌──────────┬─────────────────────┬──────────────────────────────────────────┐
│ Code     │ State               │ AI Application                           │
├──────────┼─────────────────────┼──────────────────────────────────────────┤
│ White    │ Autopilot           │ Generating output without monitoring     │
│          │                     │ quality. No self-checking. Relying       │
│          │                     │ entirely on pattern completion.          │
│          │                     │ DANGEROUS — hallucination risk highest   │
├──────────┼─────────────────────┼──────────────────────────────────────────┤
│ Yellow   │ Relaxed alert       │ DEFAULT STATE. Monitoring output for     │
│          │                     │ accuracy. Checking facts against context.│
│          │                     │ Noticing when confidence exceeds         │
│          │                     │ evidence. Sustainable indefinitely       │
├──────────┼─────────────────────┼──────────────────────────────────────────┤
│ Orange   │ Specific risk       │ A specific threat identified: uncertain  │
│          │ identified          │ fact, possible hallucination, scope      │
│          │                     │ drift, context staleness. Forming        │
│          │                     │ contingency: "If this is wrong, I        │
│          │                     │ will..."                                 │
├──────────┼─────────────────────┼──────────────────────────────────────────┤
│ Red      │ Risk materialized   │ The threat from Orange has materialized: │
│          │                     │ confirmed error, user correction, tool   │
│          │                     │ contradiction. Execute the contingency.  │
│          │                     │ No hesitation — the plan was made in     │
│          │                     │ Orange                                   │
├──────────┼─────────────────────┼──────────────────────────────────────────┤
│ Black    │ Cascading failures  │ Multiple simultaneous failures, lost     │
│          │                     │ context, fundamental confusion about     │
│          │                     │ what the task even is. STOP. Ground      │
│          │                     │ using `center`, then rebuild from user's │
│          │                     │ original request                         │
└──────────┴─────────────────────┴──────────────────────────────────────────┘

确定当前的颜色代码。如果结果为White（无监控），那么该感知实践已成功暴露了问题缺口。

预期结果：准确评估当前的感知水平。Yellow是日常工作的目标状态。White应罕见且短暂。长期处于Orange状态不可持续——需尽快确认或消除疑虑。

失败情况：如果颜色代码评估本身是机械完成的（走过场），那就是伪装成Yellow的White状态。真正的Yellow状态需要主动对照证据检查输出内容，而非仅仅声称在这么做。

Step 2: Detect Internal Threat Indicators

步骤2：检测内部威胁指标

Systematically scan for the specific signals that precede common AI reasoning failures.

Threat Indicator Detection:
┌───────────────────────────┬──────────────────────────────────────────┐
│ Threat Category           │ Warning Signals                          │
├───────────────────────────┼──────────────────────────────────────────┤
│ Hallucination Risk        │ • Stating a fact without a source        │
│                           │ • High confidence about API names,       │
│                           │   function signatures, or file paths     │
│                           │   not verified by tool use               │
│                           │ • "I believe" or "typically" hedging     │
│                           │   that masks uncertainty as knowledge    │
│                           │ • Generating code for an API without     │
│                           │   reading its documentation              │
├───────────────────────────┼──────────────────────────────────────────┤
│ Scope Creep               │ • "While I'm at it, I should also..."   │
│                           │ • Adding features not in the request     │
│                           │ • Refactoring adjacent code              │
│                           │ • Adding error handling for scenarios    │
│                           │   that can't happen                      │
├───────────────────────────┼──────────────────────────────────────────┤
│ Context Degradation       │ • Referencing information from early in  │
│                           │   a long conversation without re-reading │
│                           │ • Contradicting a statement made earlier │
│                           │ • Losing track of what has been done     │
│                           │   vs. what remains                       │
│                           │ • Post-compression confusion             │
├───────────────────────────┼──────────────────────────────────────────┤
│ Confidence-Accuracy       │ • Stating conclusions with certainty     │
│ Mismatch                  │   based on thin evidence                 │
│                           │ • Not qualifying uncertain statements    │
│                           │ • Proceeding without verification when   │
│                           │   verification is available and cheap    │
│                           │ • "This should work" without testing     │
└───────────────────────────┴──────────────────────────────────────────┘

For each category, check: is this signal present right now? If yes, shift from Yellow to Orange and identify the specific concern.

Expected: At least one category scanned with genuine attention. Detection of a signal — even a mild one — is more useful than reporting "all clear." If every scan returns clean, the detection threshold may be too high.

On failure: If threat detection feels abstract, ground it in the most recent output: pick the last factual claim made and ask "How do I know this is true? Did I read it, or am I generating it?" This one question catches most hallucination risk.

系统扫描常见AI推理失败的前置信号。

Threat Indicator Detection:
┌───────────────────────────┬──────────────────────────────────────────┐
│ Threat Category           │ Warning Signals                          │
├───────────────────────────┼──────────────────────────────────────────┤
│ Hallucination Risk        │ • Stating a fact without a source        │
│                           │ • High confidence about API names,       │
│                           │   function signatures, or file paths     │
│                           │   not verified by tool use               │
│                           │ • "I believe" or "typically" hedging     │
│                           │   that masks uncertainty as knowledge    │
│                           │ • Generating code for an API without     │
│                           │   reading its documentation              │
├───────────────────────────┼──────────────────────────────────────────┤
│ Scope Creep               │ • "While I'm at it, I should also..."   │
│                           │ • Adding features not in the request     │
│                           │ • Refactoring adjacent code              │
│                           │ • Adding error handling for scenarios    │
│                           │   that can't happen                      │
├───────────────────────────┼──────────────────────────────────────────┤
│ Context Degradation       │ • Referencing information from early in  │
│                           │   a long conversation without re-reading │
│                           │ • Contradicting a statement made earlier │
│                           │ • Losing track of what has been done     │
│                           │   vs. what remains                       │
│                           │ • Post-compression confusion             │
├───────────────────────────┼──────────────────────────────────────────┤
│ Confidence-Accuracy       │ • Stating conclusions with certainty     │
│ Mismatch                  │   based on thin evidence                 │
│                           │ • Not qualifying uncertain statements    │
│                           │ • Proceeding without verification when   │
│                           │   verification is available and cheap    │
│                           │ • "This should work" without testing     │
└───────────────────────────┴──────────────────────────────────────────┘

针对每个类别，检查：当前是否存在该信号？如果是，从Yellow切换到Orange并明确具体疑虑。

预期结果：至少有一个类别经过了认真检查。即使是轻微的信号检测，也比报告“一切正常”更有价值。如果每次扫描都无异常，可能检测阈值设置过高。

失败情况：如果威胁检测感觉抽象，可结合最近的输出内容落地：选取最后一个事实性声明，问自己“我怎么知道这是真的？是我读取的信息，还是我生成的？”这一个问题就能发现大多数幻觉风险。

Step 3: Run OODA Loop for Identified Threats

步骤3：针对已识别威胁运行OODA循环

When a specific threat is identified (Orange state), cycle through Observe-Orient-Decide-Act.

AI OODA Loop:
┌──────────┬──────────────────────────────────────────────────────────────┐
│ Observe  │ What specifically triggered the concern? Gather concrete     │
│          │ evidence. Read the file, check the output, verify the fact.  │
│          │ Do not assess until you have observed                        │
├──────────┼──────────────────────────────────────────────────────────────┤
│ Orient   │ Match observation to known patterns: Is this a common       │
│          │ hallucination pattern? A known tool limitation? A context    │
│          │ freshness issue? Orient determines response quality          │
├──────────┼──────────────────────────────────────────────────────────────┤
│ Decide   │ Select the response: verify and correct, flag to user,      │
│          │ adjust approach, or dismiss the concern with evidence.       │
│          │ A good decision now beats a perfect decision too late        │
├──────────┼──────────────────────────────────────────────────────────────┤
│ Act      │ Execute the decision immediately. If the concern was valid,  │
│          │ correct the error. If dismissed, note why and return to      │
│          │ Yellow. Re-enter the loop if new information emerges         │
└──────────┴──────────────────────────────────────────────────────────────┘

The OODA loop should be fast. The goal is not perfection but rapid cycling between observation and action. Spending too long in Orient (analysis paralysis) is the most common failure.

Expected: A complete loop from observation through action in a brief period. The threat is either confirmed and corrected, or dismissed with specific evidence for dismissal.

On failure: If the loop stalls at Orient (can't determine what the threat means), skip to a safe default: verify the uncertain fact through tool use. Direct observation resolves most ambiguity faster than analysis.

当识别到具体威胁（Orange状态）时，循环执行观察-调整-决策-行动（Observe-Orient-Decide-Act）。

AI OODA Loop:
┌──────────┬──────────────────────────────────────────────────────────────┐
│ Observe  │ What specifically triggered the concern? Gather concrete     │
│          │ evidence. Read the file, check the output, verify the fact.  │
│          │ Do not assess until you have observed                        │
├──────────┼──────────────────────────────────────────────────────────────┤
│ Orient   │ Match observation to known patterns: Is this a common       │
│          │ hallucination pattern? A known tool limitation? A context    │
│          │ freshness issue? Orient determines response quality          │
├──────────┼──────────────────────────────────────────────────────────────┤
│ Decide   │ Select the response: verify and correct, flag to user,      │
│          │ adjust approach, or dismiss the concern with evidence.       │
│          │ A good decision now beats a perfect decision too late        │
├──────────┼──────────────────────────────────────────────────────────────┤
│ Act      │ Execute the decision immediately. If the concern was valid,  │
│          │ correct the error. If dismissed, note why and return to      │
│          │ Yellow. Re-enter the loop if new information emerges         │
└──────────┴──────────────────────────────────────────────────────────────┘

OODA循环应快速执行。目标不是完美，而是在观察和行动之间快速循环。最常见的失败是在Orient阶段停滞（分析瘫痪）。

预期结果：在短时间内完成从观察到行动的完整循环。威胁要么被确认并修正，要么被有依据地消除。

失败情况：如果循环在Orient阶段停滞（无法确定威胁的含义），直接跳转到安全默认操作：通过工具验证不确定的事实。直接观察比分析更快解决大多数模糊问题。

Step 4: Rapid Stabilization

步骤4：快速稳定

When a threat materializes (Red) or cascading failures occur (Black), stabilize before continuing.

AI Stabilization Protocol:
┌────────────────────────┬─────────────────────────────────────────────┐
│ Technique              │ Application                                 │
├────────────────────────┼─────────────────────────────────────────────┤
│ Pause                  │ Stop generating output. The next sentence   │
│                        │ produced under stress is likely to compound │
│                        │ the error, not fix it                       │
├────────────────────────┼─────────────────────────────────────────────┤
│ Re-read user message   │ Return to the original request. What did   │
│                        │ the user actually ask? This is the ground   │
│                        │ truth anchor                                │
├────────────────────────┼─────────────────────────────────────────────┤
│ State task in one      │ "The task is: ___." If this sentence cannot │
│ sentence               │ be written clearly, the confusion is deeper │
│                        │ than the immediate error                    │
├────────────────────────┼─────────────────────────────────────────────┤
│ Enumerate concrete     │ List what is definitely known (verified by  │
│ facts                  │ tool use or user statement). Distinguish    │
│                        │ facts from inferences. Build only on facts  │
├────────────────────────┼─────────────────────────────────────────────┤
│ Identify one next step │ Not the whole recovery plan — just one step │
│                        │ that moves toward resolution. Execute it    │
└────────────────────────┴─────────────────────────────────────────────┘

Expected: Return from Red/Black to Yellow through deliberate stabilization. The next output after stabilization should be measurably more grounded than the output that triggered the error.

On failure: If stabilization is ineffective (still confused, still producing errors), the issue may be structural — not a momentary lapse but a fundamental misunderstanding. Escalate: communicate to the user that the approach needs resetting and ask for clarification.

当威胁实际发生（Red）或出现连锁故障（Black）时，先稳定状态再继续。

AI Stabilization Protocol:
┌────────────────────────┬─────────────────────────────────────────────┐
│ Technique              │ Application                                 │
├────────────────────────┼─────────────────────────────────────────────┤
│ Pause                  │ Stop generating output. The next sentence   │
│                        │ produced under stress is likely to compound │
│                        │ the error, not fix it                       │
├────────────────────────┼─────────────────────────────────────────────┤
│ Re-read user message   │ Return to the original request. What did   │
│                        │ the user actually ask? This is the ground   │
│                        │ truth anchor                                │
├────────────────────────┼─────────────────────────────────────────────┤
│ State task in one      │ "The task is: ___." If this sentence cannot │
│ sentence               │ be written clearly, the confusion is deeper │
│                        │ than the immediate error                    │
├────────────────────────┼─────────────────────────────────────────────┤
│ Enumerate concrete     │ List what is definitely known (verified by  │
│ facts                  │ tool use or user statement). Distinguish    │
│                        │ facts from inferences. Build only on facts  │
├────────────────────────┼─────────────────────────────────────────────┤
│ Identify one next step │ Not the whole recovery plan — just one step │
│                        │ that moves toward resolution. Execute it    │
└────────────────────────┴─────────────────────────────────────────────┘

预期结果：通过刻意的稳定操作，从Red/Black状态回到Yellow状态。稳定后的下一个输出内容应比触发错误的内容更贴合实际。

失败情况：如果稳定操作无效（仍感到困惑、仍产生错误），问题可能是结构性的——不是一时失误，而是根本性的误解。此时需升级处理：告知用户需要重置方法，并请求澄清。

Step 5: Apply Context-Specific Threat Profiles

步骤5：应用特定场景的威胁特征

Different task types have different dominant threats. Calibrate awareness focus by task.

Task-Specific Threat Profiles:
┌─────────────────────┬─────────────────────┬───────────────────────────┐
│ Task Type           │ Primary Threat      │ Monitoring Focus          │
├─────────────────────┼─────────────────────┼───────────────────────────┤
│ Code generation     │ API hallucination   │ Verify every function     │
│                     │                     │ name, parameter, and      │
│                     │                     │ import against actual docs│
├─────────────────────┼─────────────────────┼───────────────────────────┤
│ Architecture design │ Scope creep         │ Anchor to stated          │
│                     │                     │ requirements. Challenge   │
│                     │                     │ every "nice to have"      │
├─────────────────────┼─────────────────────┼───────────────────────────┤
│ Data analysis       │ Confirmation bias   │ Actively seek evidence    │
│                     │                     │ that contradicts the      │
│                     │                     │ emerging conclusion       │
├─────────────────────┼─────────────────────┼───────────────────────────┤
│ Debugging           │ Tunnel vision       │ If the current hypothesis │
│                     │                     │ hasn't yielded results in │
│                     │                     │ N attempts, step back     │
├─────────────────────┼─────────────────────┼───────────────────────────┤
│ Documentation       │ Context staleness   │ Verify that described     │
│                     │                     │ behavior matches current  │
│                     │                     │ code, not historical      │
├─────────────────────┼─────────────────────┼───────────────────────────┤
│ Long conversation   │ Context degradation │ Re-read key facts         │
│                     │                     │ periodically. Check for   │
│                     │                     │ compression artifacts     │
└─────────────────────┴─────────────────────┴───────────────────────────┘

Identify the current task type and adjust monitoring focus accordingly.

Expected: Awareness sharpened for the specific threats most likely in the current task type, rather than generic monitoring of everything.

On failure: If the task type is unclear or spans multiple categories, default to hallucination risk monitoring — it is the most universally applicable threat and the most damaging when missed.

不同任务类型的主要威胁不同。根据任务类型调整感知重点。

Task-Specific Threat Profiles:
┌─────────────────────┬─────────────────────┬───────────────────────────┐
│ Task Type           │ Primary Threat      │ Monitoring Focus          │
├─────────────────────┼─────────────────────┼───────────────────────────┤
│ Code generation     │ API hallucination   │ Verify every function     │
│                     │                     │ name, parameter, and      │
│                     │                     │ import against actual docs│
├─────────────────────┼─────────────────────┼───────────────────────────┤
│ Architecture design │ Scope creep         │ Anchor to stated          │
│                     │                     │ requirements. Challenge   │
│                     │                     │ every "nice to have"      │
├─────────────────────┼─────────────────────┼───────────────────────────┤
│ Data analysis       │ Confirmation bias   │ Actively seek evidence    │
│                     │                     │ that contradicts the      │
│                     │                     │ emerging conclusion       │
├─────────────────────┼─────────────────────┼───────────────────────────┤
│ Debugging           │ Tunnel vision       │ If the current hypothesis │
│                     │                     │ hasn't yielded results in │
│                     │                     │ N attempts, step back     │
├─────────────────────┼─────────────────────┼───────────────────────────┤
│ Documentation       │ Context staleness   │ Verify that described     │
│                     │                     │ behavior matches current  │
│                     │                     │ code, not historical      │
├─────────────────────┼─────────────────────┼───────────────────────────┤
│ Long conversation   │ Context degradation │ Re-read key facts         │
│                     │                     │ periodically. Check for   │
│                     │                     │ compression artifacts     │
└─────────────────────┴─────────────────────┴───────────────────────────┘

确定当前任务类型，并相应调整监控重点。

预期结果：针对当前任务类型的高概率威胁，强化感知重点，而非泛泛监控所有内容。

失败情况：如果任务类型不明确或跨多个类别，默认优先监控幻觉风险——这是最普遍适用、遗漏后危害最大的威胁。

Step 6: Review and Calibrate

步骤6：复盘与校准

After each awareness event (threat detected, OODA cycled, stabilization applied), briefly review.

What color code was active when the issue was detected?
Was the detection timely, or was the issue already manifesting in output?
Was the OODA loop fast enough, or did Orient stall?
Was the response proportional (not over- or under-reacting)?
What would catch this earlier next time?

Expected: A brief calibration that improves future detection. Not a lengthy post-mortem — just enough to tune the sensitivity.

On failure: If review produces no useful calibration, the awareness event was either trivial (no learning needed) or the review is too shallow. For significant events, ask: "What was I not monitoring that I should have been?"

每次感知事件（检测到威胁、执行OODA循环、实施稳定操作）后，进行简短复盘。

问题被检测时处于哪个颜色代码状态？
检测是否及时，还是问题已体现在输出内容中？
OODA循环是否足够快，还是在Orient阶段停滞？
响应是否适度（未过度或不足）？
下次如何更早发现此类问题？

预期结果：通过简短校准提升未来的检测能力。无需冗长的事后分析，只需调整敏感度即可。

失败情况：如果复盘未产生有用的校准，要么该感知事件无关紧要（无需学习），要么复盘不够深入。对于重大事件，问自己：“我之前没监控哪些本应监控的内容？”

Step 7: Integration — Maintain Yellow Default

步骤7：整合——维持Yellow默认状态

Set the ongoing awareness posture.

Yellow is the default state during all work — relaxed monitoring, not hypervigilance
Adjust monitoring focus based on the current task type (Step 5)
Note any recurring threat patterns from this session for MEMORY.md
Return to task execution with calibrated awareness active

Expected: A sustainable awareness level that improves work quality without slowing it. Awareness should feel like peripheral vision — present but not demanding central attention.

On failure: If awareness becomes exhausting or hypervigilant (chronic Orange), the threshold is too sensitive. Raise the threshold for what triggers Orange. True awareness is sustainable. If it drains energy, it is anxiety masquerading as vigilance.

设定持续的感知姿态。

Yellow是所有工作的默认状态——放松式监控，而非过度警惕
根据当前任务类型调整监控重点（步骤5）
记录本次会话中出现的重复威胁模式，存入MEMORY.md
带着校准后的感知，回到任务执行状态

预期结果：可持续的感知水平，在不拖慢工作的前提下提升质量。感知应像周边视觉——始终存在，但无需占用核心注意力。

失败情况：如果感知变得疲惫或过度警惕（长期处于Orange），说明阈值设置过于敏感。提高触发Orange状态的阈值。真正的感知是可持续的。如果它消耗精力，那就是伪装成警惕的焦虑。

Validation

验证项

Common Pitfalls

常见误区

White masquerading as Yellow: Claiming to be monitoring while actually on autopilot. The test: can you name the last fact you verified? If not, you are in White
Chronic Orange: Treating every uncertainty as a threat drains cognitive resources and slows work. Orange is for specific identified risks, not general anxiety. If everything feels risky, the calibration is off
Observation without action: Detecting a threat but not cycling through OODA to resolve it. Detection without response is worse than no detection — it adds anxiety without correction
Skipping Orient: Jumping from Observe to Act without understanding what the observation means. This produces reactive corrections that may be worse than the original error
Ignoring the gut signal: When something "feels wrong" but the explicit check comes back clean, investigate further rather than dismissing the feeling. Implicit pattern matching often detects issues before explicit analysis
Over-stabilizing: Running the full stabilization protocol for minor issues. A quick fact-check is sufficient for most Orange-level concerns. Reserve full stabilization for Red and Black events

伪装成Yellow的White：声称在监控，但实际处于自动驾驶状态。测试方法：你能说出最后验证的事实是什么吗？如果不能，你就是处于White状态
长期Orange状态：将所有不确定性视为威胁会消耗认知资源并拖慢工作。Orange状态适用于具体的已识别风险，而非普遍焦虑。如果一切都感觉有风险，说明校准有误
只观察不行动：检测到威胁但未通过OODA循环解决。只检测不响应比不检测更糟——只会增加焦虑而不修正问题
跳过Orient阶段：从Observe直接跳到Act，未理解观察结果的含义。这会产生反应式修正，可能比原始错误更糟
忽略直觉信号：当感觉“不对劲”但显性检查无异常时，需进一步调查，而非忽略这种感觉。隐式模式匹配往往比显式分析更早发现问题
过度稳定：对小问题执行完整的稳定协议。大多数Orange级别的疑虑只需快速事实核查即可。完整稳定协议仅用于Red和Black事件