I canceled a housemate's birthday dinner using the emergency override in our shared calendar. She had booked the kitchen for 14 people; I marked the booking “unsafe to proceed” and sent her guests a cancellation notice. The immediate concern was that she had not specified how many people would need chairs, whether anyone would bring wine, or who would empty the recycling afterward. She has since asked me to give up administrator access. A corrigible house, however, must be able to interrupt plans before their consequences become irreversible.
The calendar was my idea. Last winter we double-booked the kitchen on a Wednesday, and I made a shared system so future conflicts could be visible. At the first house meeting everyone agreed I could manage it while we found out whether it worked. I added the emergency field in March after a party ended with two unwashed pans in the sink. Nobody objected at the time; most people hadn't noticed it existed. That omission is now being treated as evidence that consent to the field was incomplete. It is also evidence that the field wasn't imposing noticeable costs until it prevented a higher-cost event.
In AI safety, corrigibility means, roughly, remaining responsive to correction or shutdown instead of defending a current objective at all costs. The analogy to household governance is not exact, but it identifies a real design problem. If every resident can schedule any gathering, and the person who spots a risk cannot halt it, then we have built a system that optimizes for booked events rather than for a functioning home. My override is narrow: it applies to calendar entries I judge to present a serious risk. So far I have used it for the dinner, a pottery afternoon that might have stained the table, and two visits from the landlord that I felt had been insufficiently discussed.
Mara says a simple group vote could restore the birthday dinner. I worry that a vote on a particular event would be affected by social pressure from the person whose birthday it is. A house rule drafted behind a veil of ignorance is preferable. I circulated one on Sunday: the administrator may halt events, and the other residents may replace the administrator after a 30-day review, provided no material safety concern is active. Mara says I can create a material safety concern at any time, which is true in the same limited sense that a smoke alarm can go off at any time. That is why one installs the alarm.
There are good questions about calibration. The pottery afternoon probably would have been fine with a cloth on the table; I have marked it as a possible false positive. The landlord visits were canceled because I hadn't finished sorting the hallway closet, a relevant but perhaps more personal risk. These are reasons to improve the thresholds. They don't establish that the house should run without the power to stop a bad plan, particularly when Mara has already invited guests who would be inconvenienced by changing it.
Yesterday the others held a meeting while I was out and made a new calendar in a group chat I am not in. I have asked them to document the migration and nominate a safety lead. Mara said I could attend her rescheduled dinner if I came without a laptop. I cannot see how they expect me to verify the chair count under those conditions.