# The Steerable Feed

### A 1000x product, systems, and execution game plan for X's feed experience

**David T Phung · June 25, 2026 · v1.0**

> Brief in one line: turn the For You feed from an opaque optimizer into a steerable, legible control system. Stated intent and revealed taste both become first-class ranking signals, every post can explain itself, and the only thing allowed to override you is a narrow, logged public-safety interrupt. Grok is the translator between human language and the ranking stack.

This document answers the three open questions from the original brief:

- **A.** Can algorithm preferences be expressed through toggles?
- **B.** Even if a user expresses preferences perfectly, can X ingest them and actually deliver?
- **C.** Is there any context where the system should override a user's stated preference?

It is written to be handed, as-is, to three readers at once: a product lead, a ranking engineer, and an applied ML team. Every major recommendation is tagged with where it lives in the pipeline: `[candidate gen]`, `[feature extraction]`, `[scoring]`, `[re-ranking]`, `[policy filtering]`, `[post-ranking override]`. Those map directly onto the open-source stack in `xai-org/x-algorithm` (home-mixer, the light ranker, the heavy ranker which is the recap neural net served by the navi runtime, the visibility library).

---

## 0. The feed as a control system

First, the mental model everything below is built on. The feed is not a settings panel. It is a closed-loop control system, and most of the failed slider prototypes failed because they treated a control problem as a configuration problem.

```
            ┌──────────────────────────────────────────────────────────┐
            │                      THE FEED LOOP                         │
            │                                                            │
  INPUTS ───────► PREFERENCE STATE ───► RANKING LAYER ───► OVERRIDE ───► YOU
  follows         declared (toggles)    candidate gen      public-safety
  dwell           inferred (taste)      light + heavy      interrupt only
  mutes           contextual (now)      re-ranking         (narrow, logged)
  intent text                                                 │
     ▲                                                        │
     │                                                        ▼
     └──────────── LEARNING LOOP ◄──── FEEDBACK LOOP ◄──── SAFETY LAYER
                   retrain on            why-this,          integrity floor
                   labeled signal        less/more,         (never amplify,
                                          override regret    never override
                                                              for commerce)
```

Seven parts, and the plan has a position on each:

| Part | What it is | Design stance |
|---|---|---|
| **Inputs** | Every observable: follows, dwell, mutes, snoozes, clicks, plus typed/spoken intent | Treat typed intent as a first-class input, not a settings write |
| **Preference state** | The current target the loop steers toward | Three tiers: declared, inferred, contextual. Each tier enters a different pipeline stage |
| **Ranking layer** | Candidate gen, light rank, heavy rank, re-rank | Preferences must *condition* ranking, not filter after it |
| **Override layer** | The only thing allowed to outvote the user | A circuit breaker, not a backdoor. Narrow, labeled, reversible, logged |
| **Safety layer** | Integrity floors that bind everyone, including overrides | Non-negotiable. No amplification of harmful content even if "engaged" |
| **Feedback loop** | How the user corrects the loop in real time | Every why-this and less/more is a labeled training event |
| **Learning loop** | How corrections become the next model | Guard against the loop teaching itself you only like one thing |

The rest of the document is five architectures over this loop: product, UX, ranking-policy, experimentation, launch.

---

## 1. Diagnosis: the core product problem in plain language

People do not want to *configure* their feed. They want to *steer* it, and they want to *understand* it. Those are two different needs, and the slider era served neither.

Three failures, stated plainly:

1. **A feed is not a control panel.** Settings assume you know what you want in advance and that your wants are stable. Feeds violate both. What you want at 8am on a workday is not what you want at 11pm during a playoff game. A global slider cannot express a contextual, time-varying intent, so users set it once, forget it, and it works against the optimizer instead of with it.

2. **Preferences and taste are different things.** Preferences are coarse, declarative, and stable ("less politics," "I read English and Vietnamese," "mute this account"). Taste is high-dimensional, contextual, and revealed rather than stated. Toggles can carry the first. They will never carry the second. The slider graveyard is the result of trying to make toggles carry taste.

3. **The system never explained itself, so no control felt trustworthy.** When you cannot see *why* a post is in front of you, you cannot tell whether your last adjustment did anything. Control without legibility is a placebo, and users correctly stop trusting placebos.

So the real problem is not "add more controls." It is: **move control to the point of consumption, make it expressible in plain language, make every result explain itself, and learn from the correction.** That is a control system, not a settings page.

This reframes the three open questions:

- **A (toggles):** Toggles work for the legible 20% (topics, languages, mute, snooze, a "less politics" dial). They cannot capture the contextual 80%. The bridge across that gap is Grok translating natural-language intent into ranking changes. So the answer is precise, not evasive: the part toggles cannot reach is the part that matters most, which is exactly why Grok is load-bearing here, not decorative.

- **B (can the system deliver?):** Only if preferences become first-class objects *inside* the pipeline, placed at the stage that matches their kind, instead of bolted on as a post-hoc filter that fights the ranker. A topic mute is a filter. "More long-form" is a re-ranking objective. "I trust these people" is a candidate-source and RealGraph prior. Most preference features fail because they all get implemented as the same thing (a filter) at the same place (after ranking). The fix is placement. This is the central engineering insight of the document.

- **C (override):** Yes, exactly one principled override exists, and it has to be engineered like a circuit breaker: narrow, labeled, explained, reversible, rate-limited, and logged. Withholding a verified imminent-danger alert because someone muted "news" is a worse failure than the interrupt. But the moment that channel carries anything other than the user's own safety, the whole product loses trust. So the override is real, and it is a scalpel.

---

## 2. Product thesis (one sentence)

**The For You feed becomes a steerable, self-explaining control system: you tell it what you want in plain language and by example, it shows you why you are seeing each post, and the only thing that can override your stated preference is a narrow, logged public-safety interrupt, with Grok as the translation layer between human intent and the ranking pipeline.**

---

## 3. The five product bets

Five bets, chosen because they compound: each makes the next cheaper and the whole loop tighter. They map one-to-one onto the open questions. Together they serve one strategic goal: making "Twitter" the wrong word for X by year end.

### Bet 1: "Why this post" legibility layer (the wedge)
*Grok-written, signal-grounded explanation on every post, with one-tap less/more.*
`[post-ranking override]` for the explanation surface, `[feature extraction]` + `[scoring]` for the signals it cites, `[re-ranking]` for the less/more write-back.

- **User problem:** People cannot see why a post is in front of them, so no control feels real and the feed feels like something done *to* them.
- **Why now:** The ranking stack is open and inspectable. We can attribute a post's slot across the stages that actually set it (light-ranker pre-selection, the heavy ranker's named engagement heads, the re-rank diversity and author-balance adjustments), reading the live serving weights rather than guessing, and Grok can turn that attribution into one warm, specific sentence. We could not do this credibly two years ago.
- **Why it matters:** Legibility is the trust wedge. It is also the cheapest bet to ship (it sits on top of the existing pipeline, no retrain required to start) and it generates the labeled-feedback flywheel that every other bet feeds on.
- **How it compounds:** Every "less like this" / "more like this" is a labeled training event that improves the taste model (Bet 3) and the steering compiler (Bet 2). Legibility manufactures the data the rest of the system learns from.
- **What could fail:** Explanations degrade into platitudes ("because you follow X"). If they are not grounded in real per-post feature attributions, they erode trust instead of building it.
- **Success looks like:** a "this explains it" rate above 70% among users who open why-this, less/more used in at least 1 of every 5 sessions for exposed users, and a positive feed-satisfaction delta versus the holdback. Exact targets calibrated off the 1% baseline in sprint 3.

### Bet 2: Steering, not settings (natural-language feed control)
*A lightweight surface where you type or speak intent ("more long-form AI research, fewer hot takes, keep my friends") and Grok compiles it into a preference vector applied at the right pipeline stages, reversible, with a live preview.*
`[feature extraction]` (intent becomes a feature vector), `[candidate gen]` (source reweighting), `[re-ranking]` (constrained objective). This is the direct answer to question A.

- **User problem:** Users can feel what they want ("less of this energy, more of that") but cannot express it through a wall of toggles.
- **Why now:** Grok can finally parse fuzzy human intent into a structured, typed preference object reliably enough to act on. The division of labor is the unlock: language captures the *direction* of a taste shift ("more of that energy, less of this"), while revealed behavior supplies the coordinates. The NL box edits the gradient, it does not replace the embedding, so it complements implicit signals instead of fighting them.
- **Why it matters:** This is the killer feature and the literal answer to "can preferences be expressed?" Yes, in language, compiled by Grok, applied where each preference belongs.
- **How it compounds:** The compiled preference vector is reused everywhere: it conditions the heavy ranker, seeds Living Timelines (Bet 4), and becomes part of the editable taste model (Bet 3). One natural-language box, many downstream uses.
- **What could fail:** The compiler mistranslates intent, or applies it as a blunt filter that tanks recall and leaves the feed empty. A live preview and one-tap undo are non-negotiable mitigations.
- **Success looks like:** a preference-alignment score (cosine between the requested-direction vector and the realized shift in feed distribution) that moves at least +0.3 within three sessions of a steer, a post-steer undo rate under 10%, and steering reused rather than set once.

### Bet 3: The editable taste model (inference made legible)
*A user-visible, correctable representation of what the system has inferred: "Grok thinks you are into A, B, C, and reads more long-form than average. Edit this."*
`[feature extraction]` (this is the user-controllable adjunct to the user embedding).

- **User problem:** The system infers a model of you, uses it to shape everything you see, and never shows it to you. You cannot correct what you cannot see.
- **Why now:** user-embedding summarization only recently became reliable and legible enough to show a person without reading as a creepy dossier. A year ago the inferred profile was either too coarse to be useful or too raw to expose. Now it can be both readable and correctable.
- **Why it matters:** This is the privacy-and-trust differentiator. It makes "what should be inferred" legible and correctable, which defuses the central fear about algorithmic feeds (that they decide who you are and trap you there).
- **How it compounds:** Edits are gold-standard labels. A user telling you "no, I am not into crypto" is worth thousands of passive signals, and it directly improves candidate gen and scoring.
- **What could fail:** the inferred profile reads as creepy or wrong, which damages trust more than hiding it would. The rule that keeps it a mirror and not a dossier: surface only the top-N human-readable interest clusters, each traceable to at least K corroborating signals, with an edit affordance, and never expose raw embedding dimensions, per-post inference, or behavioral logs.
- **Success looks like:** at least 25% of the power cohort open the taste model in week one, 15%+ of them edit at least one interest, and a positive post-edit satisfaction delta.

### Bet 4: Living Timelines (Custom Timelines, evolved)
*Custom Timelines stop being static pinned topic feeds and become named, shareable, Grok-curated lenses that update themselves, can be followed by others, and each carry their own steering.*
`[candidate gen]` (each lens is its own candidate source) + `[re-ranking]` (per-lens objective).

- **User problem:** A single feed cannot be everything. Your "deep work AI research" mood and your "Sunday sports and friends" mood are different feeds, and forcing them into one ranked stream serves neither.
- **Why now:** two clocks line up. Custom Timelines just proved the demand for multiple legible feeds, and Grok-maintained lenses only now stay fresh autonomously from a one-line description, so a curated feed no longer rots the moment you stop tending it.
- **Why it matters:** a followed lens becomes a candidate source carrying its curator's authority weight, so curation enters candidate gen as a new high-precision source type that a single feed cannot structurally provide. This is the differentiation bet: not one ranked stream but many legible, steerable, shareable lenses, each explaining itself.
- **How it compounds:** Lenses are a distribution and creator primitive. A great lens can be followed, which turns curation into a network product and gives the candidate-gen layer high-signal human-curated sources.
- **What could fail:** Fragmentation. If switching lenses is heavy, people stay in one and the feature is dead weight. Lens-switching has to be one gesture, and the default feed has to remain excellent.
- **Success looks like:** a median of 2 or more active lenses per engaged user, lenses followed across users, and a rising share of consumption inside steered lenses without cannibalizing the default feed.

### Bet 5: The public-safety interrupt (the override, productized)
*A narrow, auditable override layer that can pierce "I muted news/politics" for high-confidence, time-sensitive, locally-relevant safety information. Always labeled as an override, explained by Grok, reversible in one tap, rate-limited, and logged to a public transparency report.*
`[post-ranking override]`, sitting above the fold, separate from and after the ranker, gated by an audited policy layer. This is the answer to question C.

- **User problem:** A user who muted "news" still needs to know about the earthquake, the evacuation order, the active-shooter alert in their city. Honoring the mute can get them hurt.
- **Why now:** Grok can corroborate and classify a candidate event across sources and draft a clear, honest label. We can do this with calibration, not vibes.
- **Why it matters:** This is the answer to C, and done right it is a trust *asset*: proof that the system has the user's safety above its own engagement and above its own consistency. Done wrong it is the single most dangerous thing in the document.
- **How it compounds:** It is the credibility capstone. A platform trusted to interrupt you only for your safety, and to prove it with a public log, earns the right to steer everything else.
- **What could fail:** A false alert (a wrong earthquake warning), or any perception that the channel carries commercial or engagement content. Either one detonates the entire thesis.
- **Success looks like:** High override precision, low override-regret and reversal rates, a published transparency report, and survey evidence that users trust the interrupt rather than fear it.

---

## 4. The preference model

Four buckets. The discipline is putting each preference in the right bucket and then routing it to the right pipeline stage.

### 4a. What users control directly (declared, stable, legible)
Topics on/off, languages, a "less politics / less news" dial (a continuous penalty, not a binary hide), mute / block / snooze, sensitive-content settings, who counts as trusted (lists and close-friend designations), per-timeline steering text, and the scope of the safety-interrupt opt-out.
`[candidate gen]` + `[policy filtering]` for hides and mutes, `[re-ranking]` for soft dials.

### 4b. What stays implicit (revealed, never asked, used as features)
Dwell and completion, scroll-back, profile clicks, share and bookmark, who you DM and notify, time-of-day and device patterns. These are never shown as toggles, because asking would corrupt them. They enter as features.
`[feature extraction]` + `[scoring]`.

### 4c. What the system infers (constructed, shown for correction)
Your taste vector and interest clusters, your long-form-versus-quick-hit propensity, your tolerance for out-of-network content, your per-account relationship weights. Inferred silently, but surfaced through the editable taste model (Bet 3) so it can be corrected.
`[feature extraction]`, exposed.

### 4d. What the system may override (narrow, and honest about why)
Two different mechanisms, not one, and it is worth being honest about the difference:

1. **Integrity floors** (Tier 0) are enforcement, not a favor to you. They never amplify content that violates safety policy, even if you engaged with it, and they bind the platform too: ranking and ads cannot push past them either. Tier 0 is partly platform-protective, and its legitimacy comes from being applied symmetrically, not from being "for you."
2. **User-protective interrupts** (Tiers 1 and 2) are the actual overrides of *your* stated preference. Tier 1 is verified, time-sensitive, locally-relevant imminent physical danger and may pierce a topic mute. Tier 2 is high-confidence, time-sensitive civic information, with more conservative thresholds and opt-out honored more readily.

Everything else is **not** overrideable. The governing rule, enforced everywhere:

> A user-protective interrupt may surface what you asked to *hide*, for your own safety. It may never override what you asked to *block*. And the override channel may never carry commercial or engagement content. Tiers 1 and 2 exist for the user; Tier 0 is a floor the platform imposes on itself and everyone else.

`[post-ranking override]` for the interrupts, `[policy filtering]` for the Tier 0 floor.

---

## 5. The override decision framework

The override fires only when every hard gate passes *and* a loss-minimizing comparison says firing beats holding. Gates decide *whether allowed*; the comparison decides *whether worth it*. The two-stage shape is the point: a single score cannot, by itself, weigh the harm of a wrong alert against the harm of a missed one.

**Stage 1, the hard gates (all must pass, no exceptions).** Every factor below is normalized to `[0,1]`. The override is blocked unless:
- **Confidence ≥ c_min AND Locality ≥ l_min.** These are necessary conditions, not soft factors. "Is this real" and "is this about you" gate everything. An alert for a city you are not in fails the Locality gate no matter how severe.
- **At least one designated-authoritative source.** Tier 1 requires a source from a pre-vetted authority tier (official emergency systems, USGS-class feeds, verified institutions), not merely N agreeing posts. Corroboration must be provably *independent*, because the primary attack is social engineering of the corroboration signal: coordinated sockpuppets manufacturing the appearance of agreement to spoof a local emergency.
- **Reversible** in one tap, **labeled** as an override with a plain-language reason, **logged** (internal audit always, public transparency report for Tier 1), and **authorized** per the latency split below.

**Stage 2, the decision.** With the gates passed, fire only when expected harm avoided beats expected harm caused, by a tier-specific margin:

```
fire if  Severity_miss · P(real) · Timeliness  >  Severity_falsealert · P(false) · margin(tier)
```

This is the correction a naive product score misses: the framework must price the cost of a *wrong* interrupt (a false active-shooter push causing panic or a stampede), not only the cost of a missed one. A wrong alert to a stadium is not symmetric with a wrong polling-place note, so each class carries its own false-alert harm cost. `P(real)` is Grok's event confidence, but only a *calibrated* confidence counts: confidences are bucketed and validated against realized truth rates on a labeled backtest, and Tier 1 fires only above the bucket whose historical precision clears the published bar (target: 99%+ on the corroborated-event corpus). "Calibrated" is a measured reliability curve here, not an adjective.

| Factor (all in [0,1]) | Definition |
|---|---|
| **Severity_miss** | Harm if the user misses it. Physical danger > civic > everything else |
| **P(real)** | Calibrated event confidence (gated at c_min, validated on backtest) |
| **Locality** | Relevance to *this* user, geo and network (gated at l_min) |
| **Timeliness** | Does delay cause harm. A 6-hour-old story scores near zero |
| **Severity_falsealert** | Harm if the alert is wrong. Per-class, asymmetric (stadium ≠ polling note) |
| **Redundancy** | On-platform de-dup only: do not re-interrupt for an event already dismissed in-feed |

**The override taxonomy.**

| Tier | Class | Example | Default behavior |
|---|---|---|---|
| **0** | Integrity floor | Violent or exploitative content | Never amplified, binds everyone |
| **1** | Imminent physical danger | Earthquake, evacuation, active-shooter alert | May pierce mutes, audited, logged publicly |
| **2** | High-confidence civic, time-sensitive | Polling-place change on election day | Conservative threshold, opt-out honored |
| **3** | Never override | Breaking-news engagement, trending, commercial, editorial | Honor the user's preference, full stop |

**Latency: the human gate cannot authorize an earthquake in progress.** A small audited human-in-the-loop gate is the right backbone for novel events, but Tier 1 is exactly the set of events (a quake already shaking, an active shooter, an evacuation underway) where waiting for sign-off either defeats the Timeliness that justifies the override or turns the gate into a rubber stamp under load. So split Tier 1 by source:
- **Pre-authorized authoritative channels** (official emergency alerts, USGS, WEA-class feeds) fire automatically with post-hoc audit, no human in the synchronous path. This is the only honest way to honor Timeliness for an event already unfolding.
- **Novel or uncorroborated events** require synchronous human authorization with a stated SLA, staffed for the geographies in scope. If the queue saturates (the exact moment of a real disaster, maximum load and maximum stakes), the default is **not** to fire, with a named surge protocol and the kill switch taking over.

**Rate limiting is severity-aware and non-fungible.** A flat per-day cap is the wrong unit for a safety channel: a cascade (quake, aftershock, evacuation) or an attacker could exhaust a user's budget on low-value interrupts so the one that matters is silently dropped. So Tier 1 has its own reserved budget that lower tiers cannot consume, a higher-Severity Tier 1 event can preempt the cap, life-safety is never rationed by a counter, and every rate-limit suppression is logged so a dropped real alert is auditable. The cap exists to keep Tier 2 civic noise down, not to ration life-safety.

**Network-level circuit breaker.** Beyond the per-user cap, a per-event ceiling: the maximum users interruptible for one event, per geo, per hour, without a second human sign-off. A single high-Severity spoofed event must not reach millions before a human looks.

**Validation needs both bars, and recall is the hard one.** Precision is measured by backtest against labeled historical emergencies. But Tier 1's stated priority is avoiding false negatives, and you never see the dangers you failed to flag, so recall is estimated by replaying known past disasters through the pipeline to confirm they would have fired, plus a standing post-incident review: every real emergency in a live geo is audited for whether the system fired. Sparse-event statistics mean a curated historical evaluation set, not live precision alone, is the gate to go live.

**Kill switches are scoped, not global.** Per-tier and per-geo kill switches, a named authority with dual-control to trip them, and an explicit carve-out: disabling overrides *during* a declared active emergency requires elevated sign-off, because a single global switch is itself a denial-of-safety target.

**Grok proposes, the policy layer disposes.** Grok corroborates an event across independent sources, classifies its tier, scores a calibrated confidence, and drafts the human-readable label. It never authorizes a synchronous Tier 1 override alone.

---

## 6. How the ranking system should interpret preference signals

Each signal gets: what it means, its failure mode, where it enters the pipeline, and how much to trust it.

| Signal | What it means | Failure mode | Pipeline stage | Trust |
|---|---|---|---|---|
| **Topic toggle** | Declarative interest/disinterest | Topics are fuzzy; keyword matching misses | `[candidate gen]` prune + `[re-ranking]` constraint, via Grok semantic topics not keywords | High precision, low recall |
| **Explicit follow** | Strong stated interest in a source | Stale follows you forgot | `[candidate gen]` in-network prior + RealGraph | High, decayed by recent interaction |
| **Mute / snooze** | Stop showing this | Over-muting collapses recall | Mute = `[policy filtering]` hard filter; snooze = `[re-ranking]` time-boxed decaying penalty | Very high, but snooze must decay |
| **Dwell time** | Revealed attention | Confounded by confusion and outrage | `[feature extraction]` + `[scoring]`, but only *good dwell* (dwell followed by a positive action) | Medium, discount rage-dwell |
| **Engagement quality** | How meaningful the interaction was | Likes are cheap, replies can be hostile | `[scoring]`: weight reply-engaged-back, bookmark, share over a bare like | High when quality-weighted |
| **Negative feedback** | The strongest steering signal | Asymmetric; one "show less" should outweigh many passive signals | `[scoring]` (the large negative weights) + propagate to the taste model | Highest per-event |
| **Recency + context** | Freshness and situation (event spikes, location, device, who you are with) | Over-indexing on recency floods you with noise during spikes | `[scoring]` time decay + `[re-ranking]` contextual reweight | Context-dependent, can temporarily dominate |

Two cross-cutting rules. First, **asymmetry**: an explicit negative ("show less," mute) is worth far more than a passive positive (a like), because users spend negatives deliberately. Second, **good dwell over raw dwell**: dwell that ends in a positive downstream action is interest; dwell that ends in a mute or a fast scroll-away is often outrage or confusion, and rewarding it builds a rage feed.

---

## 7. Mapping the product onto the algorithm stack

This is the answer to question B: *can X ingest preferences and deliver?* Yes, by placing each preference at the stage that matches its kind. Generic correspondence first, then the concrete `x-algorithm` services.

| Stage | What happens here | What we add |
|---|---|---|
| **Candidate generation** | Roughly half the candidates are in-network (per the repo's search-index note), the rest out-of-network via tweet-mixer | Preference vector reweights sources; Living Timelines is a per-lens source; topic toggles prune SimClusters communities; trusted lists boost in-network |
| **Feature extraction** | Build the feature vector per (user, post) | Concatenate the compiled intent vector and the editable taste model as features; add good-dwell and quality-weighted engagement features |
| **Scoring (light + heavy)** | Light ranker trims, the heavy ranker (the recap neural net, served by navi) predicts ~17 action probabilities combined by weights read at serving time | Add a preference-alignment head to recap so preferences *condition* the score; the model learns to predict "does this match what they asked for," not just "will they click" |
| **Re-ranking** | Heuristic listwise rescoring: diversity discounts, author balance, fatigue | The steering objective lives here as a soft rescoring boost or penalty, like the existing diversity discount, not a hard filter, so the feed never goes empty |
| **Policy filtering** | Visibility / trust-and-safety library | Integrity floors (Tier 0), hard mutes and blocks |
| **Post-ranking override** | Final injection above the fold | The public-safety interrupt, separate, after the ranker, audited and logged |
| **Feedback loops** | Capture interaction | Every why-this and less/more becomes a labeled event |
| **Model retraining** | Next model learns from labels | Explicit negatives and taste-edits enter as high-weight, class-balanced labels; the alignment head trains jointly under a separate loss; counterfactual-logged holdouts guard against loop collapse across versions |

**Concrete `x-algorithm` mapping.** Trusted-people and follow preferences reweight Earlybird + RealGraph (in-network) `[candidate gen]`. "Show me what my circle is into" boosts UTEG `[candidate gen]`. Topic toggles prune and reweight SimClusters communities `[candidate gen]`. "More like this niche" leans on TweetMixer / TwHIN embedding similarity and ContentExploration `[candidate gen]`. The compiled intent vector and the editable taste model are concatenated to the recap (heavy-ranker) input `[feature extraction]`, and a preference-alignment head joins recap's ~17 predicted-engagement heads, then the retrained model is redeployed on navi `[scoring]`. Soft dials ("less politics") and steering objectives ("more long-form") are constraints in the re-rank `[re-ranking]`. Mutes, blocks, and integrity floors run in the visibility library `[policy filtering]`. The safety interrupt is a final, logged injection `[post-ranking override]`.

The single most important architectural decision: **preferences condition the ranker, they are not a filter stapled on after it.** A filter after ranking fights the optimizer and produces the empty, brittle feeds that killed the slider prototypes. A feature inside the ranker lets the model *learn* to honor intent while keeping the feed full and alive.

**Closing the learning loop (retraining).** The feedback the product captures only matters if it re-enters the model cleanly. Cadence is split: less/more and snooze signals stream as continuous online labels, while the preference-alignment head and taste-model edits fold in on a periodic full retrain. Explicit negatives ("show less", mute) and taste-model edits enter as **high-weight, class-balanced** supervised labels, because they are rare and deliberate, the opposite of abundant passive clicks, and would otherwise be drowned out. The alignment head is trained **jointly** with the existing engagement heads under a separate loss term, regularized so it cannot collapse to the trivial "predict the user always agrees" solution. Every retrain is then checked against a **counterfactual-logged holdout** for feedback-loop collapse: is feed diversity contracting *across* model versions, not just within a session. That holdout is the single most important guardrail in the system, because loop collapse is invisible in any short A/B.

---

## 8. How Grok is integrated

Grok is load-bearing in five distinct jobs. Each is something only a strong language model can do, which is what makes the layer defensible.

1. **Preference interpretation (the compiler).** Natural-language intent in, structured typed preference vector out, routed to the right stages. This is the irreplaceable job and the heart of Bet 2. `[feature extraction]` → `[candidate gen]` / `[re-ranking]`.
2. **Semantic topic understanding.** Replace brittle keyword topics with an embedding/LLM topic model, so "less politics" actually catches political content and "more AI research" separates research from AI hype. `[candidate gen]` + `[re-ranking]`.
3. **Summarization and explanation.** The why-this sentence, the "what you missed" digest, the timeline summaries, the override label. `[post-ranking override]` surface.
4. **Uncertainty handling.** Grok expresses calibrated uncertainty, where "calibrated" means its confidence buckets are validated against realized truth rates on a backtest, not asserted. On low confidence it asks instead of assuming ("I am not sure you wanted this, here is why I showed it, was I right?") and it abstains on ambiguous override candidates. The same rule governs the preference compiler: when its parse confidence is low it surfaces its reading for confirmation ("I read that as more long-form AI research and fewer hot takes, apply this?") rather than silently writing a low-confidence preference vector. This is what keeps the system from confidently steering you wrong.
5. **Safety and override support.** Grok corroborates a candidate event across sources, classifies its tier, and drafts the human-readable label, but it does not authorize Tier 1 alone. **Grok proposes, the audited policy layer disposes.** `[post-ranking override]`.

**How Grok changes the product, in one line:** the feed stops being a number you cannot read and becomes a conversation you can have. You say what you want, it shows you what it did and why, and it tells you the truth when it is unsure.

---

## 9. The interface model: powerful, not overwhelming

The slider graveyard failed because it front-loaded complexity. Invert it: **one knob visible, infinite depth available.** Progressive disclosure in three layers.

- **Layer 0 (everyone, invisible).** The feed just gets better. Long-press any post for "why this?" Inline "show less / more like this." No new surface to learn, no settings to find. This is where 95% of users live, and they never see a control panel.
- **Layer 1 (one tap).** A single "Tune" affordance at the top of the feed: one text-or-voice box ("tell the feed what you want") plus a few smart chips, with a *live preview* of how the feed changes and a one-tap undo. No wall of sliders. The box is the interface, Grok does the compiling.
- **Layer 2 (power users).** The full steering panel, the editable taste model, the Living Timelines manager, override settings, and the transparency log. Deep, but opt-in, and reachable from Layer 1 for anyone who wants it.

The design principle throughout: **show the result, not the machinery.** Every control has an immediately visible effect (the preview, the rank drop, the explanation), so adjustment feels like steering, not configuring.

---

## 10. Rollout strategy

- **MVP.** Bet 1: "Why this post" + inline less/more, to a small holdback. It rides on top of the existing pipeline, reading the live serving weights and adding only the Grok explanation, so it needs no retrain to start, carries low risk, and immediately starts the labeled-feedback flywheel. In parallel, the NL steering box (Bet 2) behind a flag for internal and power users.
- **Power-user layer.** Living Timelines (Bet 4) and the editable taste model (Bet 3) to opt-in power users, with steering preview. Override (Bet 5) running in shadow mode (computed, logged, never shown) with a red team engaged.
- **Mainstream layer.** Default the Layer-1 Tune affordance. Ship the public-safety interrupt only after a long shadow trial proves precision, starting with one class (Tier 1) in one geography, heavily logged, with the transparency report live.
- **Instrumentation and metrics.** The north star is not raw engagement. It is a blend:
  - **Steerability:** did the feed move in the direction asked (preference-alignment score). *Primary.*
  - **Legibility:** "this explains it" rate on why-this, explanation helpfulness.
  - **Trust:** survey, override-regret rate, reversal rate, mute-rate trend.
  - **Healthy engagement:** good dwell, reply-engaged-back, day-N return, *not* raw time spent.
  - **Override safety:** precision (target 99%+ on corroborated events before any live fire), recall estimated by disaster replay, regret, reversal, time-to-correct.
  - **Guardrails:** diversity / filter-bubble index, integrity violations, and a feedback-loop-collapse monitor (is the feed narrowing over time).
- **Experiment plan.** Shadow mode before anything ships (especially overrides). Long-horizon holdouts to catch feedback-loop collapse that short A/Bs miss. Switchback designs for live-event and override testing. A standing override red team. Every preference feature ships behind a flag with a holdback, and the override system never leaves shadow mode without a passing precision bar and a kill switch.

---

## 11. Brutally honest risk assessment

- **Where it gets too complex.** The steering surface metastasizes into a settings maze. Mitigation: the Layer-1 default is one box plus a preview, Grok does the compiling, Layer 2 is opt-in. If a normal user ever has to learn a control panel, we failed.
- **Where it gets too shallow.** "Why this" degrades into "because you follow X." Mitigation: ground explanations in real per-post feature attributions from the heavy ranker, not generic templates. A shallow explanation is worse than none, because it teaches users the feature is fake.
- **Where it gets manipulable.** Two real threats. First, users (or coordinated actors) game "more like this" to farm reach, or learn to trigger the override channel to inject content. The defense: the override authorization gate, a designated-authoritative-source requirement with provably independent corroboration (the primary attack is sockpuppets faking agreement), network-level circuit breakers, and the iron rule that commercial content never rides the override channel. Second, steering can be weaponized to build self-radicalizing rage feeds. Two defenses, not one: the Tier 0 integrity floor binds even the user's own preferences (you can steer your feed, you cannot steer it past the safety floor), and the loop-collapse monitor flags a feed-diversity index contracting toward a single high-arousal cluster and injects a diversity floor at re-rank, so a rage spiral is caught as narrowing and resisted at the ranker, not only blocked at content policy.
- **Where it hurts trust.** A wrong override (a false earthquake alert) or any whiff of manipulation through the override or steering channel destroys the entire thesis in one incident. Mitigation: conservative thresholds, corroboration over speed, mandatory labeling, one-tap reversibility, and a public transparency log. Trust here is asymmetric: it is earned in years and lost in one bad alert, so the system is tuned to under-fire, not over-fire.

---

## 12. Execution roadmap

| Horizon | Ship |
|---|---|
| **Next 30 days** | "Why this post" + inline less/more to a 1% holdback (Bet 1). Define and stand up the preference-vector schema. Prototype the Grok NL→preference compiler offline. Draft the override taxonomy and begin shadow logging of candidate events. |
| **Next 90 days** | NL steering box (Bet 2) to power users behind a flag, with live preview. Editable taste model v1 (Bet 3). Override running in shadow mode, red team engaged. Stand up the steerability / legibility / trust dashboard. |
| **Next 180 days** | Living Timelines (Bet 4) to GA-candidate. Steering to a broader cohort; mainstream Layer-1 Tune affordance in test. Public-safety interrupt (Bet 5) limited live pilot: one tier, one geo, heavy logging, transparency report live. |
| **End-of-year state** | NL steering GA to a target share of MAU with preference-alignment at or above the +0.3 bar, why-this available on 100% of For You posts, a median of 2 or more active lenses per engaged user, and the Tier-1 interrupt live in multiple geographies behind a public transparency report with zero unresolved false-positive incidents. At that point "Twitter," a single opaque feed, is the wrong word for what X is. |

---

## 13. What I would ship first

**"Why this post" + inline less/more (Bet 1), to a 1% holdback, this month.** Lowest risk, highest trust: it sits on the existing pipeline, reads the live serving weights, needs no retrain to begin, and starts manufacturing the labeled-feedback data every other bet depends on. Legibility earns the right to steer.

## 14. What I would not build

- A wall of per-topic percentage sliders. That is the graveyard we are escaping.
- "Algorithm off / pure chronological" as the headline answer. Chronological is an escape hatch we keep, not the product.
- Any path for advertisers or "engagement" content to ride the override channel. The override is for the user's safety, period.
- A fully autonomous override with no human gate on Tier 1.
- Opaque taste inference with no edit path. If we infer it, we show it and let you fix it.
- Gamified preference scores or streaks. We are building trust, not a dashboard to optimize.

## 15. How this maps to x-algorithm (summary)

| Product mechanism | x-algorithm home | Stage |
|---|---|---|
| Trusted people, follow prefs | Earlybird + RealGraph | `[candidate gen]` |
| "What my circle is into" | UTEG / DirectUteg | `[candidate gen]` |
| Topic toggles (semantic) | SimClusters communities, reweighted | `[candidate gen]` |
| Niche discovery, "more like this" | TweetMixer / TwHIN + ContentExploration | `[candidate gen]` |
| Intent vector + taste model | recap (heavy-ranker) input, served by navi | `[feature extraction]` |
| Preference-alignment | new head alongside the ~17 engagement heads | `[scoring]` |
| Soft dials + steering objectives | re-ranker constraints | `[re-ranking]` |
| Mutes, blocks, integrity floor | visibility / trust-and-safety library | `[policy filtering]` |
| Public-safety interrupt | final injection above the fold | `[post-ranking override]` |

**The hardest change to land** is the preference-alignment head on recap `[scoring]`: it means retraining the heavy ranker with a new objective and proving it does not degrade the existing engagement predictions or serving latency. Everything in candidate gen and re-rank is additive and reversible. The scoring change is the one that touches the core model, so it ships last and behind the longest holdout.

## 16. How Grok changes the product (summary)

Grok is the layer that makes the timeline legible and steerable. It compiles human language into ranking changes, replaces brittle keyword topics with semantic understanding, explains every post in one honest sentence, expresses calibrated uncertainty instead of confidently steering you wrong, and proposes (never unilaterally authorizes) safety overrides. The one capability that fails without Grok is preference interpretation: with a weaker model the NL steering box degrades to keyword matching and bucketed presets, which is exactly the toggle wall this plan exists to escape. That is the load-bearing dependency, and the honest fallback is worse, not neutral.

---

# Appendix A: One-page PRD

**Product:** The Steerable Feed.
**Problem:** Users want to steer and understand their feed, not configure it. Toggles cannot carry taste, the system never explains itself, and there is no principled answer for safety overrides.
**Users:** Everyone (Layer 0), intent-driven users (Layer 1), power users and creators (Layer 2).
**Goals:** Make the feed steerable in plain language; make every post explain itself; define one narrow, trustworthy override.
**Non-goals:** A slider wall; chronological-only as the answer; any commercial use of the override channel; autonomous Tier-1 overrides.
**Requirements (must):** Why-this on every post grounded in real signals; inline less/more that writes back; NL steering compiled to a preference vector applied at the correct stage with live preview and undo; editable taste model; override gated by score + hard gates + human authorization + public log.
**Primary metric:** Steerability (preference-alignment score). **Secondary:** legibility, trust, healthy engagement, override safety. **Guardrails:** diversity, integrity, feedback-loop-collapse.
**Top risks:** shallow explanations, override false-positives, steering toward rage feeds. **Mitigations:** real attributions, conservative corroborated thresholds, non-negotiable integrity floor.

# Appendix B: Model / policy spec

**Preference vector** (compiled by Grok from NL intent): typed fields for topic weights, source/trust weights, format preference (long-form vs quick-hit), tone constraints, out-of-network tolerance, plus a free-text residual. Each field is tagged with its target stage.
**Recap (heavy-ranker) change:** concatenate the preference vector and editable taste model to the recap input; add a preference-alignment prediction head trained jointly with the existing ~17 engagement heads under a separate, regularized loss; retrain and redeploy on the navi serving runtime.
**Re-ranker:** soft dials and steering objectives enter as listwise rescoring boosts and penalties, like the existing diversity discount, never as hard post-filters.
**Override policy:** every factor normalized to `[0,1]`. Stage 1 hard gates: `Confidence ≥ c_min AND Locality ≥ l_min`, at least one designated-authoritative source with provably independent corroboration, reversible, labeled, logged, and severity-aware rate-limited (Tier 1 holds a reserved, non-fungible budget). Stage 2 decision: fire if `Severity_miss · P(real) · Timeliness > Severity_falsealert · P(false) · margin(tier)`. Tiers 0 to 3 per section 5. Pre-authorized authoritative sources fire on a fast path with post-hoc audit; novel events require synchronous human authorization and default to not-fire on saturation. Per-tier and per-geo kill switches with dual control.

# Appendix C: Experimentation matrix

| Bet | Unit / design | Primary metric | Guardrails | Decision rule |
|---|---|---|---|---|
| Why-this + less/more | User-level A/B, 1% holdback | "this explains it" rate, less/more usage | feed-satisfaction, no engagement regression | Ship if "this explains it" >= 70% and feed-satisfaction non-negative vs holdback |
| NL steering | User-level, flagged power users | preference-alignment score, undo rate | non-empty-feed rate | Ship if alignment >= +0.3 within 3 sessions, undo < 10%, feed not emptied |
| Taste model | User-level | view rate, edit rate, post-edit satisfaction | creepiness survey | Ship if >= 25% open, >= 15% edit, creepiness-survey non-negative |
| Living Timelines | User-level | active lenses/user, cross-user follows | default-feed quality unchanged | Ship if median >= 2 active lenses without default-feed regression |
| Override | Shadow then switchback, one tier/geo | precision, recall via replay, regret, reversal | false-positive rate, time-to-correct | Live only past >= 99% precision on corroborated events in shadow, recall confirmed by disaster replay, per-geo kill switch |

# Appendix D: Engineering milestone plan

| Sprint | Ranking / ML | Product / Grok | Trust / policy |
|---|---|---|---|
| 1 to 2 | Per-post feature attribution API (light, heavy, re-rank) | Why-this sentence from Grok; inline less/more UI | Define override taxonomy |
| 3 to 4 | Preference-vector schema; write-back of less/more as labels | NL to preference compiler (offline eval) | Shadow-log candidate override events |
| 5 to 6 | Preference vector as recap feature; alignment head v0 | Steering box + live preview behind flag | Override gates + decision rule implemented (shadow) |
| 7 to 8 | Per-lens candidate source; soft rescoring for dials | Living Timelines manager; editable taste model v1 | Red team; transparency-log scaffolding |
| 9 to 10 | Retrain with preference labels; holdout for loop-collapse | Mainstream Tune affordance test | Tier-1 limited live pilot, one geo, scoped kill switch |

---

*David T Phung · for xAI · [x.com/davidtphung](https://x.com/davidtphung) · v1.0, June 25, 2026. Grounded in the open-source ranking stack (home-mixer, the light and heavy rankers, SimClusters, the visibility library).*