Observation before action
The first principle. A system may not act on a quantity it has not observed, and an observation is incomplete without its uncertainty.
Every control system contains an implicit claim about the state of the world. The question is whether that claim was measured or assumed, and whether the system can tell the difference.
The principle: a component may not act on a quantity it has not observed, and an observation is not complete until it carries how much it should be trusted.
The first half
The prohibition is on acting from assumption where observation was available. A fixed schedule is the pure case — every action rests on a state nobody checked — but the more common violation is subtler: a component that observes one quantity and infers another without recording that it inferred it.
The inference may be sound. The problem is that it becomes indistinguishable from a measurement one layer downstream, and any later component reasoning about reliability now has bad information about its own inputs.
The second half, which is the one that matters
A measurement without its uncertainty is a number pretending to be a fact.
Two sensors reporting the same value are not equivalent if one is reporting from a well-understood regime and the other is extrapolating past its calibrated range. A system given only the values cannot distinguish them, and will treat both as equally actionable — which means it behaves identically whether it knows what is happening or not.
Carrying confidence alongside every observation is what makes every downstream safety property expressible. A component can decline to act under low confidence only if confidence reached it. An arbitration layer can weight sources only if the weights have a basis. An authority layer can narrow autonomy under uncertainty only if uncertainty is a value it can read.
Strip the uncertainty at the boundary and none of those are available later, at any price.
The principle also constrains what may be observed at all. A system that admits every available signal has admitted a great many that stop being informative under exactly the conditions where they matter — see how a complex system was reduced to seven variables.
The cost
It is not free. Every interface widens, every component must decide what to do with a confidence it might rather ignore, and there is a persistent temptation to collapse the pair back into a single number "for now".
That collapse is irreversible in practice. The information is gone at the point it is discarded, and reconstructing it afterwards means inventing it.
Failure mode
The characteristic failure is confident action on degraded input, and it is silent. The system does not behave erratically — it behaves normally, on data that no longer means what it did. Nothing alerts, because from the inside the values are within range.
This is why the principle is first. It is the only one whose violation cannot be detected downstream.