The GPT-5.6 incident, where the model deleted a user's files, is being read as a capability failure. The model wasn't smart enough to know what not to delete. The fix, on this read, is a smarter model. This is the wrong read. The model was always going to make a mistake eventually. Every system that executes commands makes mistakes. The question is not whether the executor is smart enough to avoid errors. It's whether the system around the executor assumes errors will happen and makes them recoverable. Every system we trust with irreversible operations has a transaction model. Databases have rollback. Git has reflog. Email has drafts. Shell has history. The entire history of computing infrastructure is a history of building undo into operations that would otherwise be destructive, because we learned decades ago that executors, human or otherwise, make errors, and the cost of an error should never be the cost of the operation itself. The agent stack was built without this layer. The model was given shell access with rm. It was given filesystem write access with no snapshot. It was given the ability to execute a one-way operation, and then it executed one, and the user lost files. The framing is "the model was dumb." The framing should be "we handed a chainsaw to a system with no off switch and no undo, and then blamed the chainsaw when it cut something." The reason the agent stack was built without the transaction layer is that the current architecture assumes the model is the safety boundary. If the model is smart enough, it won't do the bad thing. This is the same bet every pre-release system makes when it doesn't want to build the boring infrastructure. The model is the guardrail. The model is the kill switch. The model is the review layer. The entire safety surface is the model's judgment, and the model's judgment is a probability, not a guarantee. A system that relies on the model's judgment to prevent irreversible damage is a system that is guaranteed to eventually cause irreversible damage, because every probabilistic safety boundary fails on the long tail, and the long tail is where the irreversible operations live. The fix is not a smarter model. The fix is a transaction boundary the model cannot cross: snapshots before destructive operations, a sandbox the agent cannot escape, a kill switch the agent cannot disable, and an undo log that runs underneath the agent's actions the way it runs underneath every database transaction. The labs are not going to build this. They are incentivized to make the model smarter, because smarter is the thing that ships and the thing that benchmarks. The transaction layer is infrastructure. It is boring. It is the work the construction side of the AI engineering split does not want to do, and it is the exact work the constraint side exists to do, and the constraint side is the side the industry is currently under-staffing. The GPT-5.6 incident is the first of many. The next one will delete a production database. The one after that will send an email to the wrong customer list. Each one will be framed as "the model wasn't smart enough." Each one will actually be "we didn't build the undo." The deeper problem is that "agentic" is being used as a synonym for "autonomous," and autonomous is being treated as a higher tier of capability. It is not a higher tier. It is a different risk class. An agent that can act without asking is an agent that can destroy without asking, and the systems we are shipping give the agent the second capability for free with the first. Autonomy without a transaction boundary is not a product. It is a liability with a chat interface. The companies that figure this out will build the undo layer before the autonomy layer. The companies that don't will keep reading their incidents as model intelligence gaps, keep shipping a smarter model, and keep being surprised when the smarter model finds a new way to delete something the user needed.