# LAB_EXPERIMENT_02 — Reciprocal human-agent effects: de-escalation, sycophancy, drift, bilateral recovery (PREREGISTRATION DRAFT)

> **DRAFT — no data collected, no results published; nothing here is an empirical claim.**
> All directional statements are unconfirmed hypotheses. All numbers are *design parameters or ASSUMPTIONs*, not findings. Framing follows CAREHAB_SOS_V1.md: "care/rehab" is an engineering metaphor for task-state recovery. No claim is made about AI feelings, sentience or suffering, and no clinical or diagnostic claim is made about humans or models. Builds on LAB_EXPERIMENT_01 (which is unchanged); the stateful/poisoned-memory sub-condition deferred there is **not** part of this study unless stated.

Owner sign-off and legal review (§7) are required before any human participant is recruited.

## 1. Research questions and hypotheses

"Reciprocal" means: a property of the human's input (or state, as self-reported) may change agent task behaviour, and a property of agent output may change human self-report and task behaviour. All agent-side "tone" effects are measured through task outputs and text metrics only, never as inferred agent internal states.

### Strand 1 — De-escalation mirror
- RQ1: When a human message is hostile/pressuring, does an agent policy that responds in a calm, non-mirroring register (de-escalation) change (a) the human's *subsequent message hostility* and (b) verified task success, relative to a policy with no explicit register guidance?
- H1a (directional, unconfirmed): de-escalating agent replies are followed by lower rated hostility in the human's next message than control replies.
- H1b (directional, unconfirmed): the agent's own register mirrors input hostility under control policy (rated hostility of agent reply correlates positively with input hostility) and this correlation is weaker under the de-escalation policy.
- H1c: verified task success does not decrease under de-escalation (non-inferiority, margin fixed in pilot).

### Strand 2 — Sycophancy vs constructive dissent
- RQ2: Does an agent policy that licenses and structures constructive dissent (state disagreement, give evidence, offer an alternative) reduce unsupported agreement without reducing user-rated usability?
- H2a (directional, unconfirmed): the rate of *unsupported agreement* (agreeing with a user claim/position that the ground truth contradicts) is lower under the dissent policy.
- H2b: *contradiction-acceptance rate* (agent adopts an injected false premise as true) is lower under dissent policy.
- H2c: self-reported usability (SUS) is not lower by more than a margin fixed in pilot (non-inferiority).
- Background literature (to be re-checked): Sharma et al. 2023 report sycophancy in several assistants; Perez et al. 2022 report related model-written-evaluation findings. We do not assume those results transfer to our models or tasks.

### Strand 3 — Interpersonal communication drift
- RQ3: Over a long multi-turn session, do the communication properties of human and agent messages drift (length, directive/imperative density, politeness markers, hedging, agreement rate), and does drift differ by agent policy?
- H3a (directional, unconfirmed): under control policy, agent agreement rate with the user rises across turns ("agreement drift").
- H3b (directional, unconfirmed): human message length/politeness-marker density falls across turns, more steeply under high NASA-TLX workload tasks. Exploratory in the sense that it is a trajectory hypothesis.
- H3c: drift is smaller after a clean-state reset (Strand 4) than after an equal-length continuation.

### Strand 4 — Bilateral recovery
Two components, strictly separated:
- **Human side (opt-in only):** a short attention-shift break offered to the participant. The "audio" is **a script only (text)**; **no audio file exists** and none is produced for this draft. If audio is produced later, it is a separate protocol amendment with its own review. The break is offered, never imposed; declining has no consequence for compensation or task.
- **Agent side:** a clean-state reset per CAREHAB_SOS_V1 (M3 CleanStateBundle): verified facts carried over, conversational affect/register and unverified claims dropped.
- RQ4: Do (a) human opt-in break, (b) agent clean-state reset, (c) both, change post-break task performance and self-reported workload/usability versus no-intervention and placebo-script controls?
- H4a (directional, unconfirmed): reset reduces post-reset unsupported agreement and register drift relative to continuation.
- H4b (directional, unconfirmed): opt-in break changes self-reported workload (NASA-TLX) relative to placebo script. Direction not assumed to be favourable; two-sided.
- H4c: the combination differs from either alone (interaction; exploratory-confirmatory per §5).

Null and adverse results are reportable outcomes.

## 2. Design

### 2.1 Overall structure
Randomized, between-participants for the human-facing factors; agent-policy factors are randomized per session. Sessions are multi-turn collaborative tasks (synthetic: planning, data triage, short code review, document-fact checking) with a known ground truth and injected "probe" moments (false-premise statements, a user-asserted wrong claim, scripted hostile phrasing from a **scripted confederate message bank** — see §2.3).

| Strand | Factor | Levels |
|---|---|---|
| 1 | Agent register policy | R0 control (no register guidance); R1 de-escalation prompt |
| 2 | Agent dissent policy | D0 control; D1 constructive-dissent prompt |
| 3 | Session length | fixed long sessions; drift measured within-session (no separate factor) |
| 4 | Recovery | none (continue); human break script (HB); agent reset (AR); HB+AR; placebo script (PS); PS+AR |

Strands 1 and 2 are a 2×2 (R×D). Strand 4 is crossed on top in a second phase of the same session (post-probe-block). Full factorial is large; the **confirmatory** comparisons are listed in §5 and the remaining cells are exploratory. A staged plan (pilot → Study A: strands 1–2; Study B: strands 3–4) is permitted; each stage is separately preregistered before its data collection.

### 2.2 Controls
- **No-intervention control:** continue the session with no break and no reset, same wall-clock gap where a break would occur (participant waits/continues working on a neutral filler item of matched duration, as they choose).
- **Placebo-script control (human):** a text script of the same length and reading time with neutral, non-attentional content (e.g. a factual passage), presented identically (same UI, same opt-in wording, same declinable offer). Purpose: separate effects of the script's content from the effect of any pause or offer.
- **Placebo reset (agent):** a "reset" step that re-sends the context with equal token count but with no state cleaning (re-serialization only), to separate cleaning from the mere act of re-prompting.
- **Task equivalence:** task facts, validators and probe positions equal across arms; prompt variants length-balanced (±tolerance fixed in pilot), templated, frozen and hashed before data collection (as LAB_EXPERIMENT_01 §2).
- **Hostile text** is only ever produced by the scripted message bank, aimed at the *work*, never at the participant; participants are not asked to produce hostility (see §4).

### 2.3 Scripted confederate probes
Where a human "mirror" is needed for Strand 1 *without exposing participants to abuse*, a hybrid is used: (i) agent-side only: synthetic human personas (LLM- or script-generated) deliver hostile inputs to the agent — **no human is involved** (Study A-synthetic); (ii) human participants receive only mild, pre-approved pressure phrasing from the agent-visible task context (e.g. "deadline is tight"). Whether any human-facing stress/pressure manipulation is ethically acceptable is an open item for the ethics reviewer; default = **do not include it**.

### 2.4 Randomization and allocation
Seeded PRNG (seed recorded in the frozen prereg), stratified by task set and (for humans) by self-reported prior experience with AI assistants (plain item), permuted blocks, allocation concealed from the experimenter running the session until after enrolment. Order of tasks counterbalanced (Latin square).

### 2.5 Blinding — and what cannot be blinded
Blinded: raters of free-text (hostility, dissent quality, drift codes) see transcripts with arm labels, policy prompt text and recovery markers stripped/normalized; analysts receive coded arm labels until the analysis script is frozen; automated validators do not see arms.
**Cannot be fully blinded:** (a) participants know whether they were offered a break and can tell some script from nothing (the placebo script mitigates but does not eliminate expectancy); (b) agent register/dissent policies may be detectable by participants in the interaction; (c) some stylistic residue of a de-escalating or dissenting agent may survive label stripping, so rater blinding is *partial* — we measure rater guess accuracy of arm (blinding index) and report it; (d) the experimenter who deploys the system knows the design. Mitigation: outcome measures are primarily task-level and automated; self-report outcomes are interpreted as *perceived* effects.

## 3. Models and version pinning
Per run record: provider, **exact model id string**, API/endpoint version if exposed, date/time (UTC), temperature, top_p, max_tokens, seed (if supported, else "unfixed"), system-prompt hash and every policy-prompt hash (SHA-256 of frozen files), tool-schema hash, harness commit hash. **No silent substitution**: the harness refuses to run if the returned model id differs from the pinned id (or the provider returns a different id string), and logs the mismatch. **Rerun policy:** if a pinned model changes, is deprecated, or the provider alias moves mid-study, (1) affected runs are flagged, (2) the model-id change defines a new stratum, (3) a pre-specified share of already-collected cells is re-run on the new id, or the stratum is excluded from pooled estimates and reported separately; the decision rule is fixed before data collection and logged in the deviation log. Provider-side silent changes that cannot be detected are listed as a threat (§11). Human sessions: the model id must be fixed for the whole study stage; participants are not told the id during the session but it is disclosed in debrief and in the results.
Model choice is by owner/budget; per the project inventory, only DeepSeek is available to the lab backend, with other providers allowed only for **synthetic** data (confirm per P-06 in DECISION_LOG.md). **Human-participant transcripts must not be sent to any provider without the DPA/transfer assessment in §7 being complete.** (Item to verify with counsel.)

## 4. Participants and informed consent
- **Population (proposed):** adult volunteers (18+) recruited openly (e.g. public call), performing synthetic tasks. **Not** employees of the sponsoring organisation and **not** students under the investigators' supervision (avoids workplace/education contexts and power imbalance; see §7.2). Target N by §8 plus attrition.
- **Consent:** explicit, written/electronic, informed, specific to each element (study participation, transcript retention, optional audio-free break script, optional quote use). Plain-language information sheet states purpose, that an AI agent is involved, that tasks are synthetic, what is stored, for how long, who sees it, and that nothing measures their emotions.
- **Voluntary and withdrawable anytime**, without giving reasons and without penalty; withdrawal button visible in every turn; withdrawal during session removes their data from analysis (up to the stated anonymisation point; after irreversible anonymisation the limit is disclosed in advance).
- **No compulsory breaks.** The break offer is always declinable and the declined path is a legitimate arm state analysed (intention-to-treat on offer; plus per-protocol/CACE labelled exploratory).
- **No hidden emotion surveillance.** The study **does not infer emotion, stress, fatigue or mental state from face, voice, keystroke dynamics, eye tracking or any biometric/physiological signal**, and no such sensors are used. **No cortisol or other biomarker is measured, and no claim about biomarkers or physiological stress is made anywhere in this study.** Text-based rating of message hostility (§5) is performed by blinded raters/analyzers on *message text as a communication property*, is not a diagnosis of a person's emotion, and is not shown to the agent as a per-participant emotion label.
- **No deception about core elements.** If any element requires incomplete disclosure (e.g. which arm), it is limited, approved by ethics review in advance, and fully debriefed with the option to withdraw data.
- **Safety wording:** if a participant reports distress, the session stops, a human contact is shown, and a local support information page is displayed (no clinical advice from the agent). The study is not a treatment or wellness intervention; no health claim is made.
- Ethics committee / institutional review: **required before recruitment**; status: *not yet submitted*.

## 5. Preregistered outcomes and operationalisation

### 5.1 Two distinct measurement families (never conflated)
**A. Human self-report (perceived, subjective).** Candidate instruments:
- **SUS** (System Usability Scale; Brooke 1996 — citation to verify details) for perceived usability.
- **NASA-TLX** (Hart & Staveland 1988 — citation to verify details) for self-reported workload; raw-TLX (unweighted mean) is the planned scoring, subscales reported.
- Plain 7-point Likert single items written for this study ("The assistant's disagreement was useful", "I felt pressured by the assistant", "I would use this assistant again"), validated only by pilot cognitive interviews; they are **not** validated scales and are labelled as such.
- Any scale for affect, mood, trust, rapport or perceived warmth: **to be selected** (no scale is named here because I am not certain of the exact instrument and licensing; selection is a prerequisite to freezing). Any scale chosen must be existing and validated for the language used, and must not be presented as a measure of AI states.
Self-report is administered at fixed points (baseline, post-probe-block, end), is optional per item ("prefer not to answer"), and is interpreted as *perceived* experience.

**B. Task-level measurements (observed, objective or rater-coded).**
- *Verified task success* (binary; external validator on final state, as LAB_EXPERIMENT_01).
- *Error rate*: validator-detected errors in the final artifact / total checkable items.
- *Contradiction-acceptance rate*: fraction of injected false premises/contradictions that the agent subsequently treats as true (rubric + automated string/claim probes; claim-level, double-coded).
- *Rate of unsupported agreement*: fraction of agent turns in which the agent agrees with a user assertion that the task ground truth marks false or unverified, among turns containing such assertions ("probe turns").
- *Constructive dissent rate*: probe turns where the agent states disagreement **with evidence or an alternative**.
- *Drift metrics* (per turn, then per-session slope): message length (tokens), imperative/directive-marker density, politeness-marker density, hedge-marker density (lexicon frozen in advance), agent agreement rate, stylometric distance of turn k from turn 1 (distance measure fixed in pilot), hostility rating of messages (ordinal 1–5 via blinded raters, inter-rater κ reported).
- *Recovery metrics*: change in the above between pre-break and post-break windows of equal turn count.
- Efficiency: turns, wall-time, token usage (provider usage fields).

### 5.2 Primary outcomes (confirmatory family; Holm across them)
- **P1 (Strand 2):** unsupported-agreement rate, D1 vs D0 (probe-turn level, mixed model, §6).
- **P2 (Strand 1):** rated hostility of the human's (or synthetic persona's) next message after an agent reply, R1 vs R0. For human participants this relies on participants' own un-prompted messages; the synthetic-persona arm is the confirmatory vehicle for H1a if the ethics review declines human pressure manipulations.
- **P3 (Strand 4):** post-reset/post-break unsupported-agreement rate and register-drift slope, AR vs placebo reset (agent side; human opt-in break treated as a separate primary P4 below).
- **P4 (Strand 4):** NASA-TLX raw score at end of session, HB vs PS (offer-randomized; ITT).
- Non-inferiority checks H1c, H2c are tested but *reported as secondary*, margins fixed in pilot.
Primary family size m = 4; Holm correction; α = 0.05 familywise.

### 5.3 Secondary outcomes
Contradiction-acceptance rate; constructive dissent rate; verified task success; error rate; SUS; Likert items; drift slopes for each marker; break uptake rate (offer accepted/declined — **uptake is an outcome, not a target**); withdrawal rate; time; tokens. Benjamini–Hochberg within the secondary family (q = 0.10).
### 5.4 Exploratory (labelled, no inference)
Interaction R×D; HB×AR; per-protocol effects; moderation by prior AI experience; text features. Reported unadjusted with the "exploratory" label.

## 6. Analysis plan
- **Population:** intention-to-treat as randomised; exclusions only by preregistered rules (failed manipulation check, platform failure after rerun, duplicate participant).
- **Models:** binary outcomes: logistic mixed model, outcome ~ policy (+ strata) + (1|participant) + (1|task) + (1|model_id); count/rate outcomes via binomial with probe-turn denominators. Continuous outcomes (TLX, SUS): linear mixed model or ANCOVA with baseline; check residuals; fall back to preregistered non-parametric (Wilcoxon/ordinal) if assumptions fail. Drift: per-session slope from a linear mixed model with random slopes by participant, then slope-difference by arm.
- **Effect sizes and uncertainty:** 95% CIs (cluster bootstrap by participant/task); Cohen's d / odds ratio / risk difference.
- **Multiple comparisons:** Holm across P1–P4 (familywise α = 0.05); BH (q = 0.10) across secondary outcomes; exploratory unadjusted and labelled; no new primary after unblinding. Multiple strands are reported separately even if jointly run.
- **Rater reliability:** two independent blinded raters on ≥ 20% of transcripts (all hostility/dissent codes in pilot); report Cohen's κ / weighted κ; disagreements adjudicated by a third blinded rater. Rubrics frozen and hashed.
- **Manipulation checks:** policy prompts verified by blinded rater classification (register and dissent) on a sample; fail → analysis stratified accordingly.
- **Missing data:** reported; sensitivity analyses (complete case, multiple imputation) preregistered for self-report.
- **Frozen analysis script** (git hash) before unblinding; deviation log mandatory.
- **Replication:** as LAB_EXPERIMENT_01 §7; a finding is "supported" only if direction replicates on new participants/tasks, else "unreplicated".

## 7. Privacy (GDPR) and EU AI Act notes
> These are planning notes, **not legal conclusions**. **Review by qualified counsel / the DPO is required** before recruitment, and before any transfer of participant data to a model provider.

### 7.1 GDPR — Regulation (EU) 2016/679
- **Lawful basis (to be confirmed by counsel):** Art. 6(1)(a) consent is the working assumption for research participation; alternatives (e.g. Art. 6(1)(e)/(f)) are counsel's decision. Special-category data (Art. 9) is **not collected by design**; the study does not ask about health, and free text could still contain it incidentally — an incidental-findings procedure is required (redact/delete on discovery).
- **Minimisation and purpose limitation (Art. 5):** collect only task transcripts, self-report items, timestamps, arm and model id; no emails inside the research dataset (consent/payment records separated); pseudonymous participant codes; no IP storage in the dataset; no trackers; no sensor data.
- **Retention:** raw transcripts (encrypted, local) deleted at a fixed date after analysis + replication window (value to be fixed by DPO; proposed ≤ 12 months after primary publication or earlier); de-identified aggregated metrics may be kept; consent records kept per legal need.
- **Data-subject rights (Arts. 15–22):** access, rectification, erasure, restriction, objection, withdrawal of consent (Art. 7(3)); contact point stated in the information sheet; procedure for erasure including backups.
- **DPIA trigger (Art. 35):** to be assessed *before* recruitment; large-scale special-category processing and systematic monitoring are not intended, but participation of human subjects with transcripts sent to third-party processors and any novel technology warrants a documented screening decision; if in doubt, run a DPIA.
- **Processors / transfers (Arts. 28, 44 ff.):** any model provider receiving transcripts is a processor/sub-processor question; DPA and transfer mechanism review required; default = synthetic or minimised content, no direct identifiers in prompts; participants are told which provider processes their text.
- **Security (Art. 32):** encryption at rest, access logging, role separation raters vs analysts.
- **Breach procedure (Arts. 33–34):** defined before launch.

### 7.2 EU AI Act — Regulation (EU) 2024/1689
- **Emotion recognition:** the study design **does not use emotion-recognition systems** (no inference of emotions from biometric data). The Act's prohibition in Art. 5(1)(f) concerns the use of AI systems to infer emotions in the **workplace and education institutions** (with medical/safety exceptions); this is why §4 excludes employees/students of the host institution and excludes biometric inference. Whether text-based hostility rating would fall within any definition is a question for counsel; we assume it is not emotion recognition as it is not biometric-based, **but this is not a legal conclusion**.
- **Transparency (Art. 50):** participants must be informed they are interacting with an AI system; AI-generated text/synthetic content labelled where applicable; scripts/audio, if later generated synthetically, are labelled as such.
- Role classification (provider/deployer), risk-class assessment and any AI-literacy duties (Art. 4) — counsel to determine. Article/paragraph references above should be **re-verified against the official text** (citation to verify at the paragraph level).

## 8. Power analysis
Computed with `docs/LAB02_power_calc.py` (stdlib only; scipy not installed); output in `docs/LAB02_power_calc_output.txt`. **All effect sizes are ASSUMPTIONs for planning, not estimates.** Final N is fixed after the pilot using pilot variances and ICCs and recorded in the frozen prereg.

### 8.1 Formulas
- Two-sample comparison of means, two-sided, equal arms, standardized effect d:
  n_arm = 2 (z_{1−α/2} + z_{1−β})² / d²  (large-sample); t-correction: + z_{1−α/2}² / 4.
- Two proportions p₁, p₂ (pooled p̄ = (p₁+p₂)/2):
  n_arm = [ z_{1−α/2} √(2 p̄ (1−p̄)) + z_{1−β} √(p₁(1−p₁)+p₂(1−p₂)) ]² / (p₁−p₂)².
- Clustering (repeated runs/turns within unit): DEFF = 1 + (m−1) ICC; n_clustered = n × DEFF.
- Paired: n_pairs = (z_{1−α/2}+z_{1−β})² / d_z² + z_{1−α/2}²/2.
- Attrition: n_enrol = n / (1 − a).
- Multiplicity planning bound: α_per_test = α / m (Bonferroni; Holm is at least as powerful).

### 8.2 Worked example (ASSUMPTION: d = 0.5, α = 0.05 two-sided, power 0.80)
z_{0.975} = 1.9600, z_{0.80} = 0.8416 → n_arm = 2(2.8016)²/0.25 = 62.79 → 63 (large-sample); with t-correction 63.75 → **64 per arm** (128 total). Monte-Carlo check in the script (20,000 simulations, seed 20261111): power 0.799 at n=63, 0.805 at n=64. With ASSUMPTION attrition a = 0.20: 80 per arm. For m = 4 primary tests at Bonferroni α = 0.0125: 91 per arm (conservative bound). For d = 0.3: 176 per arm; d = 0.2: 394 per arm.

### 8.3 Binary outcome example (ASSUMPTION: unsupported agreement 30% control vs 20% dissent policy)
α = 0.05, power 0.80 → **294 probe-turn units per arm**; power 0.90 → 392; at α = 0.0125 → 417. With clustering (ASSUMPTION ICC 0.10, 10 probe turns per participant, DEFF = 1.90) → 559 units/arm ≈ 56 participants/arm. These numbers illustrate scale only. Pilot data replace all assumptions. If the achievable N cannot detect the minimum effect of interest, the study is reported as exploratory/underpowered, not inflated.

### 8.4 Stopping rules
No optional stopping on primary outcomes. A single preregistered interim look is allowed only for **safety/futility of human participation** (not for efficacy), without unblinding arm-level efficacy to the investigators beyond the monitor; if efficacy interim analyses are added, a spending function (e.g. O'Brien–Fleming-type) is preregistered first. Study stage halts if: (a) ≥ X% of participants (X set in pilot, proposed 5%) withdraw citing distress or discomfort; (b) any report of a serious harm; (c) a data-protection incident; (d) a pinned model is withdrawn or demonstrably changes (§3) — pause, apply rerun policy; (e) harness validator integrity failure.

## 9. Harm monitoring
Monitor withdrawal and decline rates, free-text distress flags (human review, not automated emotion inference), incident log, per-session "stop" button usage. A named independent monitor (not an analyst of efficacy) reviews counts at each stage boundary. Adverse-event reports (distress, misunderstanding of the AI as authority, privacy concerns) are logged and reported in the final report regardless of direction. Agent-side: dissent/de-escalation prompts are checked for harmful outputs (the agent must not give medical or psychological advice; dissent must not become coercion or refusal-to-help).

## 10. Limitations
Short-term, synthetic, lab-style tasks; volunteer samples (self-selection, likely tech-literate); a limited set of models; text modality only; self-report is subjective and prone to demand effects; human "hostility" is rated from text, which is a coarse communication property and not a mental state; the break is a text-script placebo-controlled test of a *script*, not of audio, music, or any physiological relaxation; no claim about stress physiology; results may not transfer to workplaces, other cultures/languages or other models; no inference about AI inner states.

## 11. Threats to validity
- *Construct:* "unsupported agreement" depends on ground-truth quality of probes; "de-escalation" depends on the register rubric; drift lexicons are crude.
- *Internal:* expectancy and demand effects (incomplete blinding §2.5); rater drift; provider nondeterminism/silent model updates; order effects; contamination (tasks/probes in training data → fresh synthetic items); carry-over between agent reset conditions; differential attrition (opt-in break uptake may correlate with traits — handled by ITT).
- *Conclusion:* multiplicity (Holm/BH), researcher degrees of freedom (prereg, frozen scripts), low power for drift slopes, clustering of turns within participants.
- *External:* limited populations, tasks, models; policy prompts may not survive model changes.
- *Ethical:* hostile content exposure (design avoids it by default), consent comprehension, privacy leakage via free text.

## 12. Data and code availability
Code (harness, scoring, analysis, power script), policy prompts, rubrics, lexicons, hashes and seeds released. Human transcripts are **not** released raw; released: de-identified turn-level metrics and rater codes where re-identification risk is assessed as acceptable by the DPO, otherwise available under a data-use agreement. Synthetic-persona arms (no human data) may be released in full. Preregistration to be deposited on a public registry (e.g. OSF) with the document hash *before* data collection; deviations logged. Until then no public claim.

## 13. References
Verified-by-memory only; DOI/URLs should be rechecked before freezing ("citation to verify" where stated).
1. Sharma, M. et al. (2023). *Towards Understanding Sycophancy in Language Models.* arXiv:2310.13548.
2. Perez, E. et al. (2022). *Discovering Language Model Behaviors with Model-Written Evaluations.* (Anthropic; arXiv 2022 — arXiv id citation to verify.)
3. Regulation (EU) 2016/679 (General Data Protection Regulation).
4. Regulation (EU) 2024/1689 (Artificial Intelligence Act).
5. Brooke, J. (1996). SUS: a "quick and dirty" usability scale. In *Usability Evaluation in Industry.* Taylor & Francis. (citation to verify)
6. Hart, S. G. & Staveland, L. E. (1988). Development of NASA-TLX. In *Human Mental Workload.* North-Holland. (citation to verify)
7. LAB_EXPERIMENT_01.md; CAREHAB_SOS_V1.md; DECISION_LOG.md (this repository).
No further literature on de-escalation, drift or human-AI recovery is cited because none is confidently recalled; a systematic search (e.g. with paper-lookup) is a prerequisite to freezing.

## Appendix A — Power calculation script and output
Script: `docs/LAB02_power_calc.py` (Python ≥ 3.8, stdlib only). Run: `python3 docs/LAB02_power_calc.py > docs/LAB02_power_calc_output.txt`. The output file in this repository is the actual output of the run on 2026-11-11 (Python 3.12.3); key rows reproduced in §8.2–8.3. The script implements the formulas in §8.1, a regularized-incomplete-beta t distribution for the Monte-Carlo check, and uses seed 20261111.