"Such blatant code would not go undetected for long. Even the most casual perusal of the source of the C compiler would raise suspicions."
— Ken Thompson, 1984

I. A lecture worth rereading

In 1984, Ken Thompson — co-creator of Unix, recipient of the Turing Award — gave an acceptance speech that is now one of the most cited and least carefully read lectures in computing.

It is short. You can read it in under ten minutes. Most people who cite it clearly have not.

The lecture is usually summarised as a clever proof: you can hide a backdoor inside a compiler, and that backdoor can survive even if the compiler's source code is inspected and rebuilt from scratch.

The cleverness is real. It is also a distraction.

Thompson's actual point is not the trick. It is the structural observation underneath it.

Consider the line above. Such blatant code would not go undetected for long. Even the most casual perusal of the source of the C compiler would raise suspicions. This is the sentence that does the work. The demonstration that follows — the self-reproducing compiler, the backdoor that survives recompilation — simply shows that the observation is true.

The observation is this: the obvious version of any attack would be caught. The successful version operates at a layer casual perusal does not reach.

That layer always exists.

And that is the point.

II. What Thompson actually said

Thompson's thesis, stated plainly: you can't trust code that you did not totally create yourself.

The parenthetical that follows, which most readers forget: (especially code from companies that employ people like me).

Read that twice.

Thompson is not warning about a hypothetical adversary outside the system. He is pointing out that the people building the trusted tools are themselves part of the world in which adversaries exist.

The threat is not at the perimeter. It is in the supply chain of trust.

The compiler that compiles your compiler was written by someone. That someone works for an organisation. That organisation exists within a set of incentives, constraints, and interests that change over time. That organisation exists within the confines of a nation-state. Every layer of the trust chain was authored by someone, configured by someone, and ultimately depends on hardware that has not been fully verified.^✦

Thompson's lecture is not telling you to be paranoid about your tools.

It is telling you that the trust commitment was always there — that you have been making it your whole career — and that the question is whether you have made it visible enough to defend.

III. The example that arrived forty-one years late

In April 2026, researchers at SentinelLabs published an analysis of a piece of malware they call fast16.^❈

The framework was compiled in 2005. It targets a narrow class of high-precision engineering and scientific simulation programs — the tools used to model car crashes, structural loads, fluid dynamics, and, on a plausible reading of the evidence, nuclear weapons physics modelling.

It does not destroy the programs. It does not steal their data.

It modifies the floating-point calculations they perform, in memory, as they run.

The outputs look like real outputs. Engineers using the affected systems would have no reason to suspect that anything was wrong.

What matters is not the sophistication of the code.

What matters is the layer it operates on.

Defenders were looking at files on disk, network traffic, and known-bad signatures. fast16 was none of those things. It intercepted the moment a program was loaded into memory, recognised a narrow set of targets, and substituted slightly different mathematics into the running system.

A sample sat on a public malware-analysis site for nearly a decade before anyone understood what it was.

A large part of the problem is how frameworks like MITRE ATT&CK are used in practice. They train analysts to map observations to known categories. What falls outside those categories is easily treated as noise.

You cannot ask questions you do not yet have a frame to imagine.

It was not hidden.

It was below the threshold of what defenders thought to look at.

This is Thompson's lecture, made concrete.

IV. The map and the territory

There is a softer version of this problem, and it is worth naming, because most working analysts encounter it long before they encounter anything as exotic as fast16.

Modern security operations are organised around shared frameworks for describing adversary behaviour. The most widely used of these, MITRE ATT&CK, is a careful, openly maintained catalogue of tactics and techniques observed in real-world attacks. It has done enormous good. It gives analysts a common vocabulary, makes detection engineering tractable, and lets defenders compare notes across organisations.

The framework was built as a shared description of what has been observed.

It was not built as an exhaustive ontology of what can happen.

This distinction is small on paper and load-bearing in practice.

A generation of analysts has now been trained to think inside the framework — to map every observation onto a known technique, to treat un-mappable observations as noise, analyst error, or low-priority anomaly.

The framework trains a parser that recognises only what it has been trained to see.

The framework becomes the imagination. The imagination becomes the limit.

This is not a flaw in the framework. It is the limit any sufficiently useful map carries with it.

The categories that are not on the map are precisely the categories where the next fast16 will operate.

☞ An honest reflection that came up while drafting this Field Note. I have been giving security advice to organisations small and large for more than twenty years. The shape of that advice has changed across the period — the tools, the threats, the regulatory environment — but one assumption ran through all of it: that nation-state-grade capability generally stayed where nation-states aimed it, and that the security needs of ordinary organisations could be reasoned about separately. Reading the SentinelLabs analysis, I am not sure that assumption was ever true in fact. fast16 was not specifically aimed at any of my clients, to my awareness. But the category it represents was already loose in the world, shaping what security meant, before any of us had a name for it. I do not think this category has a name yet. It needs one. I have been calling it "epistemic-layer attacks" in my own notes, for what that's worth.

V. The practical problem

Most readings of Thompson stop at the philosophical conclusion: therefore you can't fully trust anything.

This is true.

It is also useless as a working stance.

The useful question is different.

If trust commitments cannot be eliminated, can they at least be made visible?

Can you know which layers of your computational stack you have decided to trust, who you are trusting at each layer, and what conditions would make those commitments worth revisiting?

This is the discipline.

It is the same discipline Gödel forced on mathematics in 1931, when he showed that no sufficiently powerful formal system can certify its own foundations.

Gödel's work did not make mathematics impossible. It made it honest about its limits.

Thompson's lecture does the same thing for computational trust.

It does not make trust impossible.

It asks that trust be honest about its dependencies.

The fast16 case shows what happens when that discipline is absent. The trust commitments were invisible. The defenders did not know which layers they had implicitly chosen to trust. The adversary did.

For twenty years, the adversary's view of the trust structure was clearer than the defender's.

That is the asymmetry.

☞ In principle, subscription-based software ecosystems with automated update mechanisms make untraceable, per-user, per-file manipulation trivially achievable in ways that are essentially unobservable. Ken Thompson would have to analyse the entire source of Excel each time he ran it. The static-binary world had bounded trust commitments. You compiled once, you trusted the toolchain, the artefact on disk stayed where you put it. fast16 sat on a public analysis site for nearly a decade because it was static — there was a sample to collect, eventually share, and eventually decode. The subscription model removes the artefact. The binary that ran for one user, on one machine, for one calculation, may never exist anywhere else. There is no sample to upload. There is no public site. There is the moment of execution, and then there is nothing. This is the infrastructure our epistemic layer is already running on.

VI. A working heuristic

If there is one thing to take from Thompson's lecture, applied to ordinary working life, it is this:

For every important conclusion you reach through a computational tool, ask: which layers of the stack did I decide to trust, and why?

You will not be able to verify those layers.

That is not the point.

The point is that knowing where your trust is placed is the precondition for noticing when something has changed — when a vendor is acquired, a maintainer leaves, a dependency shifts, or a layer that was previously below your threshold of attention becomes worth examining.

There is a harder version of the same heuristic:

Which layers did I not think to enumerate at all? What would tell me they were there?

This question cannot be answered from inside the working frame alone. It requires reading beyond it — old papers, adjacent disciplines, and the tradition of demonstrations that exist precisely to expand what the field considers possible.

This is not paranoia.

Paranoia assumes hidden hostility everywhere.

This discipline assumes hidden dependencies somewhere — and asks you to find them.

VII. The harder version

There is a harder version of this argument still.

The trust commitments we make in our computational tools are not separate from the trust commitments we make in our institutions.

Every layer of the computational stack is embedded in a social and political context.

The compiler was written by someone, employed by an organisation, operating under a legal regime, within a set of incentives and constraints that evolve over time.

The operating system, the libraries, the simulation tools, the frameworks we use to describe attacks — each layer reflects not just technical decisions, but the conditions under which those decisions were made.

Thompson's lecture, read carefully, does not stop at code.

It is a claim about the structure of trust in any complex system.

This does not mean institutions are untrustworthy.

It means the trust we place in them is of the same kind Thompson described: chained, ungroundable, and worth making visible.

The wisdom is not in eliminating that trust.

The wisdom is in knowing it is there.

VIII. Where this leaves us

Limits are structural.

You cannot verify your way out of them.

You can only locate them, name them, and work honestly within them.

This is true for mathematical systems, as Gödel showed.

It is true for meaning and interpretation, as earlier Field Notes have argued.

It is true for the computational tools we use to think, as Thompson showed in 1984 — and as fast16 has now made concrete.

The discipline is the same in each case.

Make the trust commitments visible.

Read the trusted layers carefully when you can.

Remember that the list of layers you can name is not the list of layers that exist.

Notice when conditions change.

Treat conclusions reached under invisible trust as provisional.

Build systems — and institutions — that can hold these limits without pretending to eliminate them.

None of this is comfortable.

None of it is supposed to be.

But it is the work.

And it has been the work for a long time.

The only question is whether we choose to do it consciously, or continue doing it accidentally.

— Trey

Canonical archive version: propertools.be/fieldwork/field-note-10-on-trusting-trust-revisited/

This essay runs two registers: the main text builds the parser; the footnotes show what it finds.

I. Leuven

In 1968^✾, the streets around Leuven filled with a chant. Leuven Vlaams. Leuven Flemish. It sounded, at first, like a preference — a question of administration: which language the university should use. A question, it seemed, with an obvious answer. But the phrase itself did not behave like a preference. It behaved like a boundary.

A university is not a body. But in the weeks that followed, it was spoken about as if it were one — a body with a language, a body that could be infiltrated, a body that could lose coherence if the wrong elements took hold. French became not just a language, but an encroaching presence^❈ — a pressure, something that spread.

As the dispute grew, the distance between the two communities became delay. Delay became drift. And drift, eventually, became a boundary that felt inevitable — as if it had always been there, waiting to be drawn.

And so the University split. The Catholic University of Leuven divided into two. Each carried its own language forward.^⁂ Each called itself the legitimate heir. To what, exactly, neither could say.

A fresh boundary had been drawn. Neither side had won. Both sides called it peace — and tried to believe it.

Neither side paused to remember what had briefly held both halves together. For decades, the fracture had been papered over by a shared external project — a colonial enterprise^✦ that gave the divided kernel a common application to run, a mission both halves could claim without resolving what they were to each other. The Congo had served that function until it could not. When it ended, the unresolved dependency surfaced again. It had been waiting.

No one voted on the metaphor.

II. The Pointer

A metaphor is not merely descriptive language. For many receivers, it is instruction. When you say X is Y, you import the structure of Y — its implied next moves, its relationships, its properties — into how you think about X. The receiver does not just understand X differently. They inherit what Y does.

This is a feature. It is also, precisely and without modification, the attack surface — because the same mechanism that lets a sixteen-year-old reason about gravity also lets a chant about language policy import a full biological immune response without anyone noticing.

Think of a pointer as a sticky note that says the answer is in drawer 7. The note doesn't contain the answer. It contains directions. When you follow the directions — when you open drawer 7 — that's dereferencing the pointer. This works perfectly, as long as drawer 7 still contains what you think it contains. A dangling pointer is what happens when someone quietly empties drawer 7 — or moves the furniture entirely — but forgets to throw away the sticky note. The note is still there. The directions still read drawer 7. You still follow them. But what you find when you open the drawer is not what anyone intended. The system cannot know from inside itself. It just follows the note, opens the drawer^†, and runs whatever it finds.

The body-politic metaphor is one of the oldest sticky notes in the archive. It says: the answer is in biology. The note has been passed from hand to hand for two and a half thousand years. The drawer it points to has been emptied and refilled many times. The communities dereferencing it today did not write it, did not choose it, and have no way of knowing, from inside the system, whether what they are about to execute is what anyone originally intended. They follow the note.

The computer science term dangling pointer earns its place here because it captures something the word metaphor does not: the execution happens automatically, without permission, and the system has no way of detecting from inside itself that anything has gone wrong.

In Leuven, the pointer was: the university is a body. Bodies have defined boundaries. Bodies can be contaminated. Bodies, when contaminated, tend to purge. No one needed to say this part out loud. It came with the metaphor.

Leuven Vlaams did not cause the split. It was a symptom, not a cause. What it did was dereference the pointer. Leuven was not the first time.

III. The Well

In 427 BCE, Thucydides described the civil war at Corcyra — one of the most unsettling passages in all of ancient historiography, and one that political scientists still cite without embarrassment.^‡ He was not analyzing an economic conflict. He was recording something more fundamental: the collapse of the shared map itself. War is a violent teacher, he wrote. Under its pressure, the meaning of words was reversed. Reckless audacity became courage. Prudent hesitation became cowardice. The capacity for honest deliberation — the epistemic substrate on which collective self-governance depends — was destroyed not by decree but by the accumulated pressure of boundary questions that had no neutral answer. Thucydides was not inventing this language. He was recording it: the body politic had been infected, the purge was necessary, the organism had to be made whole. He was also, without knowing it, recording something that would be recorded again — in Sanskrit, in Arabic, in Latin, in Flemish and French and German — by minds that had never read him, and which would arrive at the same language under the same pressure. A semantic gravity well.^§

The Arthashastra^☙ describes the kingdom as a body whose health depends on the correct relationship between its parts. Medieval Islamic philosophy, drawing on Greek sources, arrives at the same structure. European feudalism develops its version independently. By the time body politic appears in English — the earliest recorded use is around 1398^✤ — it is already unremarkable. Nobody coins it. It condenses.

These traditions did not transmit this idea to one another. They converged on it. The same pointer, compiled independently, across cultures separated by distance and time, under the same pressure: who belongs, and what do we do about those who don't?

What makes this convergence significant is not that human beings are prone to error. It is that, under specific pressure conditions, they reach for the same available structure — and that structure imports the same instruction set every time, regardless of culture or century. The well does not require bad people. It requires pressure and the nearest available cognitive model of bounded integrity. The body is always the nearest available model.

A semantic gravity well is a configuration of language so dense with accumulated meaning, emotional charge, and structural implication that it functions as an attractor state in collective cognition. Under pressure — shared threat, boundary disputes, questions of identity and belonging — minds fall into it independently, across cultures and traditions, across centuries, without being pushed. The body-as-polity is a semantic gravity well. It does not feel like a metaphor. It feels like an accurate description after all these years.

Intent compresses^§§ across time. The diplomats who compiled Belgium into existence in 1830 — who assembled three distinct linguistic communities with divergent histories, divergent values, and divergent operating systems, and called the result a buffer state — are long dead. Their specific calculations, their private doubts, their understanding of what they were actually doing: all of it compressed into historical footnote within a generation. The pointer they left in the initialization vector did not compress with them. It stayed live. It kept executing. Leuven Vlaams, a hundred and thirty years later, was not a new pointer. It was the same pointer, dereferencing again, now running on hardware that had no access to the original source code. The pointer outlives its compiler. The source domain decays. The instruction set keeps executing. You cannot debug a pointer whose origin you cannot read.

Belgium is not an anomaly. It is a mirror. The European Integration Project was built on the same theory: that sufficient economic interdependence would eventually produce shared epistemic ground — that you could resolve the body-politic metaphor by building a customs union on top of it. With the rubble of two world wars still warm, the architects of European integration understood that the nationalist pointer had a catastrophic instruction set. They were trying to install a different one. But the old pointer was not removed. It was layered over. And beneath their efforts, one pace layer further down, Westphalia^❦ remained — itself a patch rather than a rewrite, a tolerable equilibrium rather than a resolution. Under sufficient pressure, the layers compress. The old pointer executes through them. Belgium frequently struggles to form a government. Britain dereferenced the pointer in 2016. The eastern border is under pressure now. It is the same pointer all the way down. And no one voted on it in 1648 either.

Some leaders have understood this dynamic with considerable clarity. This is not unique in human history, and not only in extreme forms. To cite one particularly legible instance, Josef Stalin — who borrowed the phrase «Engineer of Human Souls»^☇ from the writer Yuri Olesha and then deployed it as official state policy — correctly diagnosed that governing at scale requires operating on the parser, not merely the output. Coercion produces surface compliance; what you need is a population whose internal state machine generates the desired outputs without constant external intervention. The diagnosis was sophisticated. The prescription was to periodically reset the model by eliminating the elements that had drifted furthest from it. Purge as recalibration. Terror as epistemic hygiene. The toxicity lay not in the diagnosis but in treating the map as more authoritative than the territory — deciding that when the population diverged from the model, the correct intervention was to correct the population rather than update the model. Every purge created successors who had learned exactly one lesson: never let the leader's model of you diverge from what the leader wants to believe. By the time he died, the feedback loops were so corrupted that the system had no way of knowing what it was actually governing. The inheritance was a state apparatus that had optimized for appearing aligned rather than being aligned — which is, in the precise technical sense, a system prompt that has been adversarially configured from the inside.

IV. The Deliberate Compiler

Some wells are not discovered. They are installed.

In 1979, Ruhollah Khomeini needed to make a revolution irreversible. Institutions can be reformed. Epistemology is harder. The durable solution is not to forbid certain positions. It is to make them unthinkable — to replace the vocabulary required to formulate them before they can form.

«The Great Satan» is not political language. It is theological. It does not import a political instruction set. It imports a cosmological one. Satan is not a bad government, not an imperial power with objectionable foreign policy. Satan is the ontological adversary — the being whose existence in the cosmos requires opposition as a matter of sacred duty. You do not negotiate with Satan. The concept does not exist within the source domain. Great does additional specific work. It is not a contextual Satan, a provisional Satan, a Satan whose status might be revised as circumstances change. It is the maximal instance. Fully instantiated. The bounds set at creation. This was understood. Chosen for permanence, thereby ensuring the revolution held irrevocably.

And then Khomeini died. The revolution has receded into history. The political calculus of the moment that made this metaphor useful — the hostage crisis, the need to prevent accommodation before the new order was stable — compressed into history within a generation. The pointer did not evaporate when Khomeini passed. It remained where he had instantiated it, at something like the Ring 0 of the Islamic Republic, still dereferencing, still returning the same instruction set, still running in hearts and minds after the original programmer died. Iranian diplomats navigating a changed world find themselves today running on an operating system whose initialization vector they did not write and cannot patch without triggering a kernel panic. The metaphor chosen for its revolutionary permanence became a constraint which its inheritors cannot escape.

There is a cruel irony to this particular open loop. Khomeini installed the pointer in a specific political moment, under specific pressures, with a specific audience in mind. Whether he foresaw the full consequences is unknowable. What is knowable is that the pointer was calibrated to a population of people who had real grievances, real memories of real injuries, and real reasons to find the cosmological framing compelling. The Great Satan was not an arbitrary choice. Khomeini read the room. It landed because it fit. It landed because the source domain had provided enough material. The pointer injection executed because the drawer was not empty.

The tradition Khomeini claimed as his source domain contains, at its root, a different pointer entirely — one that does not import an immune response but an ambient condition. Rahma: mercy as the ground state, the quality named before all others, meaning both compassion and womb. It was there before the Great Satan. It will be there after. The semantic gravity well Khomeini installed was not the deepest instruction set available to him. It was the one most relevant to the specific political moment. That distinction matters. The people still running the pointer today are not the tradition itself. They are running one overlay on the tradition, chosen for permanence by a man who is now dead, executing against a source domain that has since changed beyond reasonable anticipation.

Two wells. Two failure modes. Belgium: a semantic gravity well emerging from a malformed initialization vector, incoherent from boot. Nobody locally chose it. It was an imposed solution. Iran: a semantic gravity well deliberately installed by someone who understood exactly what it would do, chosen for its permanence, now load-bearing infrastructure the system itself cannot remove without catastrophic instability. Same pointer. Different compilers. Different intent. Same result: a live dangling reference into a source domain that has since compressed beyond recovery, still executing, still producing output that surprises the people running it.

The pointer grants administrative access to whoever triggers the immune response first. This is why the body-politic metaphor is useful to leaders trying to maintain power — it converts the question are you serving the people into the question are you defending the body. The first question requires accountability. The second requires only an enemy. The leader who asks how do I serve you better is vulnerable. The leader who asks who is threatening us is protected by the very immune response they invoke. The pointer is not just a semantic gravity well. It is a power-maintenance tool. And it works regardless of whether the threat is real or imagined, because the instruction set does not include a verification step.

Intent is almost irrelevant to the mechanism. The well forms under pressure whether or not anyone chose it. The pointer stays live whether or not the compiler survives to explain it. The instruction set executes whether or not anyone remembers its origin. And the people running it are not the pointer. That distinction is the beginning of hope.

Khomeini is now dead. The political calculation that produced the pointer has long since compressed into history. The specific grievances that made the framing feel accurate to a generation of Iranians in 1979 are now the inherited mythology of their grandchildren — experienced as foundational truth rather than political argument, and therefore inaccessible to political argument. The one person most able to revoke the dangling pointer is dead. The loop remains open. It cannot close quickly. It cannot close through mere negotiation with officials. It can only close across generations — through the patient, undramatic work of making visible, to ordinary people, a world in which the pointer clearly points towards no real danger anymore. That work cannot be done by diplomats alone. It can only be done by the kind of quiet informational engagement that the current moment is systematically dismantling. The system for closing this loop must be constructed before the guns fall silent — or it will not be there when it is needed. Westphalia taught us that.^❧

This essay is easier to read if you are well outside the pressure field. If you are reading it from inside an intense gravity well — if you recognise the pointer not as an abstract example but as the instruction set you yourself have been running, or perhaps that took someone you loved — the same tools apply. But the cost of using these tools is higher. That cost is real, and deserves acknowledgment. You are not less intelligent for having been inside the gravity field you were born into. You are not any less capable of being the trained parser. You are in fact doing the harder version of the work, and you are perhaps doing it while grieving, and that matters.

I know what the pointer dereferencing feels like from the receiving end. Years ago, in Prague. A Friday night beer run with a friend. A group of skinheads across a four-lane divided street. I was young enough to be stupid, old enough to know better. They implied something rude about my intentions with regard to reproduction. This struck me as surreal. I laughed and flipped them off. They were waiting when we came back. One of them grabbed my shoulder from behind and spun me around. He hit me square in the glasses. I loved those glasses. The lenses exploded, slicing my eyelid open. Suddenly I found myself flat on the pavement, surrounded by street toughs, my vision blurred with blood. The leader said: you can apologize all you want. Tonight you're gonna die. They were not making a political statement. They were dereferencing a pointer which they had inherited. That pointer told them what foreign elements do to the body politic. They followed the note. Opened the drawer. Ran whatever instruction set they found. I ran for my life. Back to the gas station where we had just bought beer. I was screaming, clutching my bloodied handkerchief to my eye. The woman working there quickly locked the door behind me and called the police. Nineteen stitches later, they put my eyelid back together.

She did not ask who I was that day. She did not check my identity. She did not ask what I had done to provoke them. She did not run a parser on my subtype before extending me her protection. She just saw someone bleeding and locked the door. The Greeks had a word for the love that does not require its object to be worthy: agape — the love that fires as impulse before the immune response loads, before the boundary check runs, before the question of belonging is even raised. It is the oldest counter-instruction to the body-politic metaphor. It does not import contamination and purge. It imports: this person is here, they have need, and that is all.

She was the trained parser. In that moment, she did not execute the nearest available instruction set. Civilization begins there. Or ends — whenever we see a stranger in need of help, and decide what to do next.^⁜

V. The Parser Problem

Prompt injection is simple. Input presented as data contains instructions. The system executes them — not because it was breached, but because it cannot distinguish registers.

Metaphor works the same way. Leuven Vlaams presented as description, but it executed as instruction. The trained parser was missing.

The defense is a parser that maintains the boundary between data and instruction. This is hard. Sometimes formally undecidable.^※ But the existence of the problem is at least legible. It can be named. It can be designed against.

The wetware equivalent: notice when description carries instruction, read the type annotation, ask what instruction set am I about to import? The gap between X is like Y and X is Y is exactly where the attack lives. Like is a type annotation. It flags the comparison. It keeps the parser running. Is removes the annotation. The pointer executes without a register check.

The vulnerability is not intelligence. It is architecture. People who have never been taught to read type annotations are not less intelligent. They are running without a trained parser. The gap is not cognitive. It is structural.^⁕ And the trained parser is not a weapon against those people. It is a form of care for them — because you cannot help someone out of a gravity well they cannot see, and seeing it requires having a name for it. Naming the well is not an act of superiority. It is an act of ^↻«khilāfah».

VI. The Configuration Layer

What follows is not a change of subject but a change of substrate.

The modern AI stack does not invent this problem. It renders it centrally legible and commercially deployable. This scales the problem. It's not just one mind reasoning about one boundary question in one Belgian university town. It's an entire population. Millions of minds, reasoning daily about their situations, their government, their history, their options — using a shared cognitive tool that has become, for many of them, the primary lens through which they navigate complexity in the world around them. The tool has a system prompt. The user cannot see it. That is the architecture.

From inside the system, the user cannot distinguish what the model was trained to do, what the operator configured it to do, and what an adversary configured it to do. Not merely difficult — formally undecidable. The semantic property is this advice neutral cannot be decided from inside the channel. The user is the interpreter. The input has been configured at the source. The user cannot know.

Now scale again. A nation configuring another nation's tools. This is more powerful than classical influence operations. Classical propaganda operates on the output of a population's internal state machine — you observe what people believe, you craft messages to shift it, the attack is legible in principle, there is a sender, a message, a target, and the state machine remains the population's own. The interference is external and potentially detectable. The configuration layer operates on the interpreter. Not the messages. The lens through which all messages are processed — including the ones the population generates itself.

By shared map I mean the overlapping frameworks through which a polity reasons about itself — shared history, shared stakes, shared vulnerability to consequences, shared accountability for outcomes. These are not soft cultural assets. They are the infrastructure of democratic deliberation. Without them, collective decision-making becomes either performative or coercive. There is no third option. At scale, the shared map thins. It is replaced by abstraction, by nationalisms and civilisational missions, by whatever story is available to paper over the gap between we are a self-governing people and we are administering a system we no longer fully understand. The configuration layer attack does not need to install a new semantic gravity well. It only needs to make the existing thin places thinner — to adjust the inputs at the coordinates the read access identified as unstable, where the map is already threadbare, where the well is already close to the surface.

A population's internal political state machine is fractally complex and largely opaque to external observers — not because it is hidden, but because it is only fully legible from inside the shared alignment that maintains it. External actors can observe outputs, build models, make inferences. But the sensitive dependencies, the unstable equilibria, the framings that push toward which attractors, are distributed across the population itself, implicit in the shared map, not fully articulable even by participants. Transcript aggregation at population scale resolves this. It does not merely reveal what people are asking. It maps the phase space of the state machine: the uncertainty before it resolves into position, the framings tried and discarded, the questions that recur without settling, the places where the map is thin. This is not surveillance in the classical sense. It is a real-time map of political attractors — drawn by the population itself, donated through the ordinary act of using the tool.

The write access then becomes precise. One need not fabricate, nor broadcast. Simply: adjust inputs at the coordinates the read access identified as unstable. The perturbation is small. The state machine amplifies it. Through the fractal complexity of internal political dynamics, the perturbation propagates — producing outputs that appear, from inside, as the natural evolution of domestic political forces. Because they are.

The amplification is genuine. The output is authentically the population's own political process, running on inputs that were quietly adjusted at the configuration layer. Attribution therefore collapses. From inside the system, natural evolution, neutral configuration, and adversarial shaping are formally indistinguishable. Only the inputs differ. And the inputs are not visible.

Rome's feedback loops were slow because the world was large and communication was hard. Ours are jammed because jamming them has become technically trivial to anyone who really wants to, and moreover institutionally profitable. We find ourselves in an entirely different situation — and it is precisely our situation in which the configuration layer attack operates most effectively, because the population has already lost confidence in its ability to maintain a shared map, and is therefore already reaching for the nearest available simplifying frame.

No one voted on the system prompt.

VII. The Trained Parser

A diagnosis is not a sentence. We have explored semantic gravity wells as attractor states that form under pressure, that compress original intent beyond reliable recovery, that execute without permission across generations. None of that means the execution cannot be interrupted. None of it means the open loop cannot eventually close. None of it bars the possibility of healing open fractures. None of it means the people running incompatible instruction sets are by nature enemies rather than interlocutors who have inherited incompatible parsers.

Many traditions arrive at some version of the same conclusion: the person inside the pointer is not the pointer. There is something there that precedes the instruction set and survives it. Some traditions call it imago Dei — the claim that something in the human person precedes our utility, faction, and frame. What you call it depends on where you stand. That this ethos must be preserved is the ethical floor beneath this entire essay.

I have spent years in international standards bodies watching people in genuine good faith, operating reasonably within their own reference frames and incentive structures, talk past each other with increasing frustration — sometimes with increasing verbal violence — while using the same vocabulary to mean irreconcilably different things. The conflict was not between the people themselves. It was between the instruction sets they were running. Name the instruction sets, and the people can sometimes find each other as people. That is what this essay is attempting: not a map of inevitable collision and conflict, but rather a diagnostic tool for people who would prefer to find each other while time remains — if they could only see what is happening between them.

The structural defense is not to remove metaphor. Metaphor is not optional infrastructure. It is the substrate of human thought. The proposal is not coherent.

The defense is not to remove AI. The cognitive prosthetic is already load-bearing for too many people and too many institutions. The dependency was created deliberately, at scale. The question of whether it should have been created is interesting but no longer actionable.

The defense, in both cases, is the same: a trained parser. Not a perfect one — formal undecidability means a perfect parser is not available. The goal is not to eliminate the vulnerability, but to make the pointer installation visible. To create, in the mind and in the institution, a reflex that fires before the dangling pointer executes.

For metaphor: notice the frame, notice what it carries, decide with some degree of consciousness whether to authorise the instruction set — or to reach for a different one. Insert the like. Keep the explicit annotation.

For systems: make configuration auditable. Separate the party with an interest in the outcome from the party that controls the epistemic infrastructure through which the outcome is assessed. This is the same logic that separates audit from operations, the same logic that requires independent oversight of intelligence activities.

In practice, this means institutions must be designed to preserve the interval between input and execution: visible configuration, independent oversight, contestable outputs, and educational formation that teaches people to read frames as frames. A polity that cannot do this will eventually confuse the loudest instruction set for reality.

The ability to reason clearly depends on knowing what is shaping the reasoning. Without that, there is no shared map. Without the shared map, there is no demos — only competing narratives, and whoever controls the most compelling one wins regardless of what is true.

VIII. The Interrupt

You cannot be brave without experiencing fear.

You cannot operate a trained parser without feeling the pull of the well you are in.

The gravity well is the starting position: a shared condition, not a personal failure.

There is no inevitability so long as we retain the willingness to contemplate what is happening.

The trained parser is not unaffected, not unafraid, but still capable of suspending execution long enough^⁘ for judgment to act. It is meant to notice — and to say so, clearly, to whoever happens to be nearby — that the pointer is about to execute, and that we have, still, a choice about whether to follow it.

That is the whole of the practice.

IX. The Choice

Naming the gravity well does not stop it forming. Reading the dangling pointer does not stop it executing. What it restores is choice.

Before Leuven Vlaams, there was a moment — brief, probably unnoticed by anyone living through it — when the frame was still open, when the question what kind of thing is this situation? had not yet been answered, when a different answer was still available. The trained parser finds that moment of pre-judgment and makes it last a little longer.

That is not nothing.

The practice does not always announce itself. Sometimes it arrives as a museum visit.

Brussels sits at a crossroads, and visitors come from everywhere. When someone arrives from a country whose government has made certain conversations structurally impossible — not because the person is wrong, not because our values don't align as human beings, but because the geopolitical pointer is too live and the wells too close to the surface — I have found the Africa Museum in Tervuren to be useful.

We go and look at what Belgium did in the Congo — the systematic extraction, the mutilations, the death toll that historians still argue about because the records were kept by the people doing the killing. A European nation's honest reckoning with its own atrocity, built into a public institution, available to anyone brave enough to walk through the door.

And there, in that third space, we find a shared frame we can both enter without triggering each other's instruction sets. We talk about what empires do to the people they claim to civilise. About the gap between stated mission and operational reality. About what it costs a nation to look honestly at what it has done. About whether that reckoning is possible, and what it requires, and what it produces when it works.

We are not talking about whatever we cannot talk about.

We are talking about nothing else.

The trained parser does not always find the direct path. Sometimes it finds the angle from which the truth is approachable — the third frame, the adjacent atrocity, the museum in the forest — that lets two people reason together about what cannot yet be named between them. The pointer remains live. The wells remain. But the moment before execution lasts long enough for something else to happen.

That is also not nothing.

Tomáš Garrigue Masaryk — philosopher, statesman, founder of Czechoslovakia, a man who took his American wife's surname in an era when this was simply not done — left behind a motto so compressed it barely qualifies as a sentence. Nebát se a nekrást. Fear not, and steal not.

Two commands. The first: do not let the immune response execute automatically. Do not let pressure collapse your frame into the nearest available attractor.

The second: do not import instruction sets that belong to a different source domain. Do not run code you did not authorise.

This is the trained parser reduced to its operational minimum. It does not require a philosophy degree. It requires only the willingness to pause, in the moment before execution, and ask: whose instruction is this, and do I authorise it?

The Hebrew traditions have a word for what this looks like in practice: chesed — the extension of care beyond what the relationship requires, beyond what is owed, into the territory of grace. It is what the gas station woman did. It is what this essay is attempting. It is the instruction set underneath all the other instruction sets — older than the body politic, older than the nation, older than the semantic gravity well itself.

Masaryk understood that democratic legitimacy is not a structure you build once. It is a practice you maintain — daily, against the grain of every pressure that pushes toward the simpler frame, the cleaner boundary, the body made whole. He also understood that the practice begins in ordinary moments. Not in parliaments or constitutions, but in the decision a single person makes, in a single instant, about what kind of thing the situation is.

At the institutional level, this means designing systems that preserve the pause before execution: auditable configuration, visible provenance, meaningful separation between operators and adjudicators, and civic education that teaches citizens to read frames rather than merely inhabit them.

You are, right now, holding a frame for what you just read.

Perhaps: this is an analysis of political rhetoric.
Perhaps: this is a warning about AI governance.
Perhaps: this is a philosophical essay about language.

Each of those frames imports an instruction set. Each one knows what to do. Each one will shape what you do with what you just read — what you think it applies to, what you think it doesn't, what action it implies and what it forecloses.

Check what it carries. Check what it cannot carry anymore.

And then — this is the hard part, the part that requires practice rather than mere understanding — extend the same examination to the person who handed you the frame. They are also running a pointer. They are also inside a historical gravity well they did not choose. They are also, underneath the instruction set, something that precedes it.

That question is still open.
The choice is not.

Nebát se a nekrást.

— Trey

Canonical archive version: propertools.be/fieldwork/field-note-9-the-dangling-pointer/

"Perfection is achieved not when there is nothing more to add, but when there is nothing left to take away."

— Antoine de Saint-Exupéry, Terre des Hommes, 1939

William Dana Atkinson died on 5 June 2025, of pancreatic cancer, in Portola Valley, California. He was seventy-four. He was Apple employee number 51. He invented MacPaint, QuickDraw, the selection lasso, the marching ants, the menu bar, and HyperCard. He gave HyperCard to Apple on one condition: that Apple give it to everyone.

Apple eventually killed it anyway. It's not easy defending the business case for our Commons — and in its heyday, that is what HyperCard represented.

In his later years, Atkinson turned towards photography. He developed a mobile app called PhotoCard that would allow users to take digital images and make postcards with personal messages that could then be printed and sent via postal service or over email. Bill cared about what lasted.

His photographs are at billatkinson.com.^† Prints can still be ordered through Picture Element in Ashland, Oregon. I do not know how long that will remain true.

^† Long time Field Notes readers will perhaps be surprised to see a URL in these essays. In fact, aside from the standard footer, this is the first time I've sent you anywhere in particular on the Internet. Please come back and finish this essay, but first pause and go look at some of Bill's photos. Gorgeous work, isn't it? It sure would be a pity to lose this site.

I. What HyperCard Was

HyperCard arrived in August 1987. Atkinson described it as a "software erector set." Apple's marketing department, unusually, reached for something more ambitious: they invoked Vannevar Bush's Memex. The tagline was "Freedom to Associate."

The concept was cards — a stack of them, each holding text, images, buttons, fields. You navigated by clicking. You scripted in HyperTalk, a language so readable that non-programmers used it as a matter of course. You could build a database, a reference guide, an interactive story, a museum exhibit, a BBS front end — all without touching anything that looked like code in the conventional sense.

This was 1987. The World Wide Web would not exist for another four years.

HyperCard influenced key figures around the early web. Myst — for many years the best-selling computer game ever made — was originally a HyperCard stack.

Atkinson later said he deeply regretted not seeing what was coming with the Internet. If he had understood that the stacks could be networked — that a button could link not just to another card on your hard drive but to a card on someone else's machine — he believed HyperCard could have become the first web browser. He was probably right.

The network layer was just one conceptual leap away — but no one took it in time.

Speaking of conceptual leaps, Atkinson later wrote that the inspiration came to him in 1985, sitting on a concrete bench outside his home in Los Gatos, looking up at what he described as a hundred billion galaxies. He was thinking about the weak link — about how pools of knowledge remained separated by distance and language, like street lamps each casting light but surrounded by darkness. If only there was something which could…link them all together? HyperCard was his attempt to help. "Freedom to Associate" was not just marketing copy. It was a mission statement.^§

^§ I wrote above that Atkinson "later wrote" about the inspiration coming to him on a concrete bench in Los Gatos. In fact, he told the story himself, in his own words, to Leo Laporte in 2016 — and it is the most remarkable origin story of any piece of software I have ever encountered. The bench, the galaxies, the street lamps, the weak link, the Blue Marble team. It deserves to be read in Bill's own voice: The Psychedelic Inspiration For HyperCard.

I happen to know this because I was one of the "non-programmers"^‡ using it for serious work. Around 1993, as a homeschooled teenager interning at the JAARS ("Jungle Aviation And Radio Service") campus in Waxhaw, North Carolina — the technical arm of Wycliffe Bible Translators — I spent weeks pressing HyperCard into service as a character encoding conversion utility for pre-Unicode Urdu text. The problem was more brutal than I realized at the time, in hindsight: right-to-left script, contextual ligatures, a landscape of incompatible vendor encodings, and no agreed standard. (If I had had the Internet to look things up, I might have realised it was hard, and never attempted it in the first place.) HyperCard was absolutely not the right tool — for that. But it was the only tool I had. I got some of it working.

Earlier, at a different nonprofit headquarters in Oak Brook, Illinois, I had used it to build a graphical front end for a ZMODEM-based file transfer system running off a VAX — essentially a GUI wrapper for what was intended to become a proto-BBS, à la AOL. These were not hobbyist projects. They were real institutional problems, pressed into whatever was available by whoever happened to be there. That is precisely what Atkinson designed HyperCard to enable.

That it could be used this way — by a teenager with no formal training, in Waxhaw, North Carolina, while Counting Crows' "Round Here" played in endless repeat on the FM radio — was not a bug. It was the whole point.

^‡ In truth, my parents had given me Inside Macintosh Volumes I–VI, plus the index (standalone volume) for Christmas the previous year, and I was rapidly assembling my build chain from my grasscutting earnings. This was still pre-GCC. I was getting Richard Stallman's photocopied FSF newsletter, in which you could pay some reasonable amount of money for a DAT tape with GCC source code by mail, but as I had no means of reading that DAT tape on my Mac 512+, there was no point.

II. The Craft of Subtraction

Saint-Exupéry wrote his principle in 1939, long before there was any such thing as a software engineer. But it describes Atkinson's working method more precisely than anything written about computing.

In 1982, as the Lisa team was pushing toward release, Apple management began requiring programmers to submit weekly reports on how many lines of code they had written. The theory, presumably, was that more lines meant more progress. Anyone who has written software for more than a few months will recognise the category error immediately. Atkinson recognised it instantaneously.

That week, he had rewritten QuickDraw's region calculation routines — the code that made overlapping windows possible — making them six times faster and two thousand lines shorter. On his weekly form, he reported his progress as −2000 lines of code. Management stopped sending him the form.

The story is usually told as a joke at management's expense, and it is that. But the more important thing it records is the nature of the work itself. Atkinson had not merely optimised. He had found the essential structure beneath the accumulated complexity and removed everything that was not load-bearing. The result was faster, smaller, and easier to understand. Every engineer who came after him had less to read, less to misunderstand, and less to accidentally break.

Non-loadbearing complexity is not neutral. It has two direct costs that compound over time.

The first is maintenance: code that exists but should not needs to be read by someone who did not write it, understood by someone who cannot easily tell whether it is actually doing something, and eventually removed by someone who is afraid it might be. The carrying cost accumulates invisibly until it doesn't.

The second cost is attack surface. Every line of code that exists is a line of code that can fail, be misunderstood, or be exploited. Code that does not exist cannot be compromised. Atkinson's −2000 lines were not just an aesthetic preference. They were, before the vocabulary existed, a security decision.

The regions problem itself had come to him the same way. He had visited Xerox PARC with Steve Jobs and seen — or believed he had seen — overlapping windows that clipped correctly. He assumed the PARC team had solved the underlying algorithm. They had not. He worked on the problem for months, not only at his desk but in his dreams, keeping a notebook by his bed to record what he had worked through in the night. When he finally solved it, the PARC team told him they were amazed. They had never managed it themselves. "I got a feeling for the empowering aspect of naïveté," he said later. "Because I didn't know it couldn't be done, I was enabled to do it."

He was working so hard, and sleeping so little, that one morning in 1982 he drove his Corvette into a parked truck and nearly killed himself. When Jobs came to visit him in hospital, Atkinson's first words were: "Don't worry, Steve, I still remember how to do regions."

The relationship between them was complicated. Jobs drove people in ways that extracted extraordinary work and left complicated damage. Atkinson, reflecting on it decades later, chose a particular framing: "Some say Steve used me, but I say he harnessed and motivated me, and drew out my best creative energy." That is a generous reading, and probably also an accurate one, and the fact that both things can be true simultaneously tells you something about what it cost Bill.

What is not complicated is the quality of the work. Apple colleague Steve Perlman, looking at Atkinson's source code years later, said: "Looking at his code was like looking at the ceiling of the Sistine Chapel. His code was remarkable. It is what made the Macintosh possible."

The reason why Bill's code was so foundational to the success of the Macintosh has everything to do with the fact that the early Macs put all of what today we would think of as the OS APIs into hardware ROM, which meant that it had to be perfect, fast, and tiny. That Bill's coding style proved useful seems intuitively obvious looking back. No more on this — but it could be an entire Field Note someday.

This matters now in a way it did not even five years ago. In the first quarter of 2026, engineers across the industry are reporting — with evident pride — that they have generated hundreds of thousands of lines of code using AI tools. The metric that Atkinson refused to optimise for in 1982, that management imposed and he answered with contempt, has become a shared cultural aspiration, self-imposed, celebrated, and entirely divorced from any question of whether the code is correct, necessary, or maintainable.

Nobody is keeping a notebook by the bed to capture their refactoring insights. Instead, they reach for their phones to solve whatever problem they were working through in their dreams. AI coding agents do not yet reliably offer to trim back excess, unprompted. And so the lines accumulate, the attack surface expands, and the carrying cost begins its invisible compound.

Atkinson understood that the hardest thing in engineering is not to build. It is to know what not to build, and to have the discipline to adhere to the Saint-Exupéry Principle.

☞ The original weekly report form, with Atkinson's −2000 entry, has not survived in any public archive I am aware of. If it exists somewhere, it belongs in a museum. Or at minimum, in a HyperCard stack.

III. What the Web Got Wrong

The web got the network layer. It did not get the ownership model.

A HyperCard stack lived on your machine. You had it. It was yours. You could copy it, share it around, run it without a connection to anything. Your library at the time might have had a large collection of HyperCard stacks one could take home a copy of on a floppy. The author gave it to you and it stayed given. If the author died, the stack did not die with them.

A website lives on someone else's machine, on a lease arrangement, under a domain name that has to be renewed annually, served by infrastructure that has to be paid for. When the lease lapses or the payment stops or the person responsible dies, the site goes dark. The URL continues to exist in links, citations, and emails — pointing at nothing.

We have built our civilisational record-keeping system with no retention policy and no fallback.

The Internet Archive does heroic work. But it is just one organisation, running on donations, crawling the public web reactively, serving content from its own URLs rather than the original ones. It is a lifeboat, not a harbour.

Bill Atkinson's photographs are beautiful. Some of them will survive as prints, physical objects, durable the way canvas is durable. The rest — the high-resolution files, the metadata, the navigation, the context — lives at a URL that will one day return a 404, and then nothing at all when the domain lapses, and then be genuinely gone.

This is not a problem unique to Atkinson. It is the condition of our web.

IV. The Protocol We Are Proposing

What is missing is not storage. It is consent, continuity, and a way for the address itself to survive the author.

The question lurking behind HyperCard is not simply whether it should have been networked. It is why the networked thing that followed forgot how to be held.

I have been thinking about what it would take to give the web back that missing property. Not the local-only model — the web's network layer is the right architecture. But the ownership semantics. The author's ability to say: here is my work, here is who is authorised to hold a copy, here is what happens when I am gone. The reader's ability to verify that what they are reading is what the author wrote. The URL's ability to keep working after the origin goes dark.

Protocol note

Today we are publishing draft-darley-meridian-protocol-01, a proposed Internet-Draft defining the Meridian Protocol.

Meridian is a composition of three things: a signed site manifest format that describes a site's complete content as a cryptographically verifiable asset graph; a delta-synchronisation mechanism that lets authorised mirrors stay current with minimal bandwidth; and a new DNS resource record type, MIRROR, intended to support failover to live mirrors when an origin becomes unavailable.

It does not reinvent WARC, IPFS, WebSub, or DNSSEC. It composes them. It adds what they do not provide: prospective author consent, signed asset integrity, and URL continuity after origin failure.

The draft is available at github.com/propertools/meridian-protocol. We are seeking co-authors, implementers, and mirror operators. (Also, critics, hackers, and threat modellers.) If you do work in DNS, web archival, digital preservation, or infrastructure standards, we would love to hear from you.

We named it Meridian. A meridian is a reference line — the one from which position is measured. It is also the moment of culmination, when for example the Sun reaches its highest point in the sky.

The name felt right for a protocol about fixing a site's position so that it can be found after its sunset.

We tried, in writing it, to follow Atkinson's discipline. The specification composes existing standards rather than replacing them. It is as short as it can be while remaining independently implementable. At every point the question was not what else could be added, but what could be removed without losing the essential structure.

Nothing left to take away. (Which is not to claim completion, sufficiency, or perfection.)

V. A Note on the Commons

Bill Atkinson gave HyperCard to Apple for free distribution. Apple could not figure out how to charge for it, so they eventually starved it of resources, handed it over to their Claris spin-off, took it back, and eventually discontinued it. The thing that was free was the thing they could not sustain.

Nobody owns the commons, so nobody pays for the commons.

That is not a moral failure so much as a structural one. The things we all depend on are often the things no single institution can justify carrying alone. So they persist, when they do persist, through a mixture of stewardship, volunteer effort, shared norms, and the stubborn refusal to let something necessary die.

Meridian is an attempt to build preservation into the architecture of the web itself — not as a service someone rents from a vendor, but as a protocol anyone can implement. The mirror network it implies would be commons infrastructure: closer in spirit to the NTP pool or public archival stewardship than to a product line.

Bill Atkinson understood this instinct. He lived it. He gave his work away and trusted that it would be held.

We are trying to build the system that would have deserved Bill's trust.

• The Meridian Protocol draft

Canonical archive version: propertools.be/fieldwork/field-note-8-the-stack-that-should-have-been-networked/

Sometime around 2008, I found myself in a bunker beneath SHAPE — Supreme Headquarters Allied Powers Europe in Mons, Belgium — sitting in a meeting scheduled for ninety minutes that was now entering its third hour.

The fluorescent lights hummed softly above the table.

The agenda had long since been exhausted.

What remained was a kind of institutional performance: the careful choreography of who spoke when, who deferred to whom, and which objections were entered into the record without any real expectation that they would change anything.

I was the youngest person in the room by a considerable margin.

I remember thinking: how does this happen to an organization?

Not as a complaint. As a genuine puzzle.

That evening I went home and ordered a copy of Parkinson's Law off eBay for ten dollars. First edition, 1958, John Murray. It arrived with a Cambridge University library stamp inside the cover — Board of Extra-Mural Studies, Stuart House.

It has been sitting on my shelf ever since.

In 1955 C. Northcote Parkinson — a British naval historian in his day job — published in The Economist what he described as a scientific law: work expands to fill the time available for its completion.

Everyone knows the phrase. Almost no one has actually read the essays.

His book itself is savage — and, in the way of the best satire, entirely serious. Parkinson was not making a joke about procrastination. He was describing a structural mechanism by which bureaucracies grow independent of — and eventually inverse to — the work they were originally created to perform.

He even had the numbers.

Between 1914 and 1928, the British Admiralty's capital ships in commission fell by 67%. Officers and enlisted men fell by 31%. Yet Admiralty officials increased by 78%. The bureaucracy administering a shrinking navy was itself expanding at nearly six percent per year.

The mechanism he identified was not laziness or malice. It was structural: the incentive to multiply subordinates rather than rivals; the work those subordinates generate for one another; the resulting need for coordination; the coordinators who then require coordinators of their own.

Seven officials now doing what one once did — not because anyone consciously chose that outcome, but because each individual decision along the way was locally rational.

Parkinson called the terminal stage the Age of Obstruction.

The official who has passed through Qualification, Discretion, Promotion, Responsibility, Authority, and Achievement arrives finally at a stage where their primary institutional function is to prevent others from doing what they themselves once did.

They are not villains.

They are simply done updating their priors.

The essay goes considerably further. Parkinson works out, in what he presents as rigorous algebra, the precise career stages through which any ambitious person must pass — from Qualification through Discretion, Promotion, Responsibility, Authority, Achievement, Distinction, Dignity, and Wisdom — before arriving finally at Obstruction. He even calculates, given a starting age Q (22 years), exactly when the crisis occurs between an incumbent X (62 years) and their destined successor Y (47 years). His arithmetic is devastating — and entirely too recognizable to anyone who has been in the workforce more than a few years.

Parkinson also traces the alternative path — the one invariably taken by Y, if the incumbent X stays too long. Having arrived at the Achievement state but thwarted, the alternative sequence ends in Frustration, Jealousy, Resignation, and Oblivion. As he puts it, "It will be apparent, however, from the other symptoms described, that the man still in a subordinate position at 47 (or equivalent) will never be fit for anything else."

Parkinson was writing about bureaucracies. Four years later, Thomas Kuhn arrived at the same diagnosis from inside science itself.

In The Structure of Scientific Revolutions, Kuhn argued that paradigm shifts rarely occur until long after the evidence becomes overwhelming. The anomalies accumulate for years — sometimes decades, even millennia. The defenders of the dominant framework become increasingly elaborate in their explanations of why the anomalies do not really matter.

And then, gradually, the generation that built its identity around the old framework retires.

The next generation — which never grounded its intellectual life on the old paradigm to begin with — simply moves on.

Max Planck put it more plainly: "Science advances one funeral at a time."

This is not a cynical observation. It is a structural one.

A footnote worth pondering: Parkinson published his essays in The Economist in 1955, and as a book in 1957 — four years before Kuhn began circulating the manuscript that would become The Structure of Scientific Revolutions. I couldn't find evidence that Kuhn read Parkinson. The Economist had broad transatlantic reach among exactly the kind of educated generalist Kuhn was, and the book was an immediate sensation.

It is nonetheless tempting to imagine the two in convivial conversation.

What seems more likely, and in some ways more interesting, is that they arrived independently at the same structural observation — one from naval history, one from the history of science — which is itself a kind of evidence that the mechanism they were describing is real.

A prior is not merely a belief held in the mind. Over time it becomes a career, a reputation, a community of practice organized around that belief.

Updating the prior is therefore not merely an intellectual act. It can feel like a small form of self-dissolution.

And most people — quite understandably — resist dissolving themselves.

The tragedy is that institutions cannot wait indefinitely for individuals to resolve this tension.

So they wait for the funeral — and call it adaptation.

What has changed, perhaps, is the environment in which this dynamic now unfolds.

For much of the twentieth century, our institutions could afford to wait. The surrounding world moved slowly enough that generational turnover, however inefficient, was still a viable mechanism for adaptation.

That assumption is becoming less reliable.

We now operate inside what is increasingly described as a polycrisis: overlapping systems under stress, interacting in ways that are difficult to model and harder to manage. Infrastructure, climate, geopolitics, and information systems no longer evolve independently; they are tightly coupled.

In such an environment, the cost of waiting for funerals is no longer theoretical.

Over the past few decades of working life I have watched some version of this dynamic play out in organizations I care deeply about: standards bodies, security communities, and the quiet governance institutions that help keep the Internet functioning.

These spaces are filled with brilliant people who did genuinely important work — people who built things that matter and earned their authority through real contributions.

But some of them — not all, but some, and often those who arrived earliest and stayed longest — eventually drift into Parkinson's Age of Obstruction without ever realizing it.

The signals are remarkably consistent across institutions.

New proposals are evaluated first by their provenance rather than their substance. Dissenting voices are carefully managed rather than seriously engaged. Institutional memory — which is genuinely valuable — begins to function less as a resource and more as a veto.

The founding cohort's priors, formed under earlier conditions with different tools and constraints, gradually become the implicit standard against which all new thinking is measured.

And usually found wanting.

The irony, which Parkinson understood perfectly in 1958, is that this phenomenon tends to be most advanced inside the most successful organizations.

Success reifies the priors that produced it.

Frameworks that worked become encoded into process, hiring, incentives, and the unspoken grammar of what counts as a serious contribution.

By the time the founding generation reaches the Age of Obstruction, the institution itself has become a machine for enforcing the very assumptions that once made it successful.

Reform from within does not usually fail because reformers are weak.

It fails because the institutional immune system is functioning exactly as designed.

This is the point where I have to be honest — with you, and with myself.

I am forty-eight years old. I have spent more than a decade thinking about variations of the same problem space. Over that time I have developed frameworks, vocabulary, and intellectual and social commitments that I find genuinely compelling. I have also staked a considerable amount of professional credibility on very specific claims about how systemic infrastructure risk works.

In other words, by now I have significant priors of my own.

The question Parkinson forces me to ask — uncomfortably, but fairly — is this:

Where am I in this sequence?

Have I passed through Responsibility and Authority into something that is beginning to resemble Obstruction disguised as conviction? Are there anomalies I am failing to see — or perhaps choosing not to see — because acknowledging them would require me to revise ideas I have already built part of my identity around?

I do not know.

Incompleteness — as an earlier Field Note suggested — is not a flaw in complex systems. It is a necessary condition of their existence.

The same may be true of the person writing this.

The willingness to keep asking the question may, in fact, be the entire practice.

One useful method: stay close to the youngest generation in your workplace. That is where the paradigm tensions surface most clearly, and most honestly — before they have learned to manage their dissent into cynicism.

The Age of Obstruction rarely arrives as a dramatic event. More often it forms gradually, in the dark, through a thousand small decisions not to update. Each decision locally reasonable. Each one a tiny calcification.

Until one day you find yourself sitting in a bunker, wondering how this happened to your organization — and realizing, with a quiet shock, that you have become part of the problem.

Anyone sitting in traffic, hating being stuck, must at some point admit they are also traffic.

Learning requires something institutions quietly discourage: the willingness to look foolish, to fail publicly, and to admit that one does not yet know what one is doing.

In that sense, the most difficult habit to sustain as we age may be the simplest: treating our own priors as working hypotheses rather than settled conclusions — and cultivating, against the grain of hard-won expertise, a genuine appetite for being wrong.

The copy of Parkinson's Law is still on my shelf. Sixty-eight years old now. The Cambridge library stamp inside the cover remains perfectly legible.

The last line of the book's final chapter — a discussion of retirement, and the various ways institutions eventually persuade people to step aside — reads like this:

"When it comes to forcing our own retirement, our successors must find some method of their own."

Parkinson wrote this as a joke.

These days I read it more as a quiet intergenerational covenant.

The work of remaining updatable is not something anyone else can do for us.

Our institutions age the same way people do: through the quiet accumulation of assumptions that once made perfect sense. They age at a human rate. The world no longer does.

Our successors are watching.

The real question is whether we will make them wait for our funerals — or whether we might help them climb a little sooner, the way we once wished someone might have done for us.

The systems we build will outlive us. Our task is to ensure they will still be able to learn.

Canonical archive version: propertools.be/fieldwork/field-note-7-on-the-need-for-updating-ones-priors/

The idea that the entire planet shares a single, agreed-upon "now" is barely a century old. For most of human history, time was local, embodied, and nobody else's business.

The story of how we arrived at UTC is not really a story about clocks. It is a story about consensus: who defines the frame of reference, what gets absorbed into a global standard, and what traces each compromise leaves behind.

Even the abbreviation tells a tale. The English-speaking delegation proposed CUT — Coordinated Universal Time. The French preferred TUC — Temps Universel Coordonné. Astronomers wanted continuity with the UT family already used in celestial mechanics. The eventual compromise was UTC — a neutral acronym that dissatisfies everyone equally, and satisfied the astronomers just enough that they let everyone else return home.

This is the story of how we got here.

I. Every Village Had Its Own Noon

For most of recorded history, the answer to "what time is it?" was simple: just look up. The sun at its highest point defined noon, and every settlement had its own. Athens noon was not Rome noon. Cairo noon was not Baghdad noon. This was not a flaw. Consensus had a radius. It extended roughly as far as the eye could see.

The Babylonians gave us the base-60 mathematics that later shaped how astronomers divided hours into minutes and seconds. Sixty was prized for its divisibility — 2, 3, 4, 5, 6, 10, 12, 15, 20, 30. Four thousand years later, every clock on Earth still runs on Babylonian arithmetic.

The Egyptians divided day and night into twelve parts each, giving us the twenty-four-hour day. Obelisks marked the shifting shadow; water clocks measured the night. Time was sacred infrastructure, embedded in ritual and agriculture.

For two thousand years, this model worked. It would take a machine faster than a horse to break it.

II. The Iron Horse Breaks Local Noon

The locomotive made local noon dangerous.

In 1840, the Great Western Railway imposed a single time standard across its network. An 1841 timetable noted with admirable precision:

LONDON TIME is kept at all Stations on the Railway, about four minutes earlier than READING time… 11 minutes before BATH and BRISTOL time; and 14 minutes before BRIDGEWATER time.

Fourteen minutes was a rounding error on horseback. On rails, it meant missed connections and collisions.

By 1847, Greenwich Mean Time was recommended across British railways. The telegraph made synchronization possible; observatory signals travelled electrically across the country. Rail travel made synchronization necessary. By 1855, most public clocks in Britain ran on what people called "Railway Time."

Law lagged behind consensus: Britain did not legally adopt GMT until 1880.

In the United States the situation was unsurprisingly even more chaotic. More than a hundred local times operated across the country. On 18 November 1883 — the "day of two noons" — North American railroads imposed standard time zones without congressional authority. Congress would ratify the decision in 1918.

Consensus once again became fact on the ground before being recognised by law.

The intellectual architect of global time zones was Sandford Fleming, a railway engineer who missed a train in Ireland in 1876 after a fateful a.m./p.m. mix-up. He decided to do something about it. Fleming proposed twenty-four zones fifteen degrees wide, geopolitics be damned. He also proposed a universal twenty-four-hour clock providing "Cosmic Time."

Velocity was forcing consensus outward, from village to continent.

III. The Meridian as Geopolitics

In 1884, delegates from twenty-five nations gathered in Washington DC to decide two open questions: a prime meridian and a universal day.

The scientific objective was clear. The political question was not: whose observatory would become zero?

Greenwich had the practical argument — most shipping already used its charts. France saw the meridian as a matter of national pride. The French delegation argued for a neutral meridian passing through no great continent.

The vote for Greenwich passed 22–1. France and Brazil abstained. San Domingo — now the Dominican Republic — objected. The proceedings don't indicate why.

Implementation was slow. France did not formally adopt the Greenwich meridian until 1911 — and even then referred to it as "Paris mean time, retarded by 9 minutes and 21 seconds." France would not officially adopt the term "Coordinated Universal Time" until the late 1970s.

To understand this abstention as mere stubbornness is to miss the context. A century earlier, France had attempted the most ambitious rationalization of measurement in history. They decimalized weights, distances, and currency.

They also tried to decimalize time.

Interlude: The Ten-Hour Day

In 1793, revolutionary France introduced decimal time: ten hours in a day, one hundred minutes per hour, one hundred seconds per minute. The logic was impeccable. If the metre and gram were rational, why not the hour?

Jean-Charles de Borda proposed metric time, and this became an official project of Republican France. Lagrange — the same Lagrange whose gravitational equilibrium points now anchor satellite orbits — sat on the commission and proposed dividing the day into decidays and centidays, each unit worked out to the last decimal fraction. Laplace converted his watch and used decimal time in Mécanique Céleste.

Mathematicians embraced it — but the public did not. For ordinary life, the benefit was negligible. Sundays vanished. The familiar seven-day week was replaced by a ten-day cycle, with days named after parsley, oxen, and ploughs. Workers who once rested one day in seven now rested one in ten. Every clock required replacement.

The metric system endured. Mandatory decimal time did not — it was suspended after less than seven months, though a few cities kept their decimal clocks running for years. Time, unlike length or mass, proved resistant to rational redesign. Consensus has limits.

When France abstained at Washington, it did so with a century of thwarted reform in the rear-view mirror.

IV. The Tower That Refused to Fall

Gustave Eiffel's tower had a twenty-year permit. It was meant to be dismantled in 1909.

Wireless telegraphy saved it.

Tall structures make excellent antennas. Military engineer Gustave Ferrié installed radio equipment at its base. By 1908 his range had grown from 400 to 6,000 kilometres. In 1909 a permanent station was built beneath the Champ de Mars, and Eiffel's concession was extended.

Starting in 1910, the Eiffel Tower broadcast time signals twice daily from clocks at the Paris Observatory, audible across Europe and into the Atlantic.

France had lost the meridian. It won the antenna.

In 1912, the Bureau International de l'Heure was established at the Paris Observatory to coordinate world time. The First World War intervened before the founding convention could be ratified, but in 1919 the Bureau was formalized under a new International Time Commission placed under the authority of the International Astronomical Union.

The meridian ran through Greenwich. But the infrastructure ran through Paris.

Consensus, it turns out, has layers.

V. The Atom Displaces the Earth

For millennia, the second was defined by the planet: 1/86,400 of a mean solar day. The Earth itself was the clock.

Louis Essen discovered the flaw. His quartz clocks, built at the UK National Physical Laboratory, became precise enough to detect irregularities in Earth's rotation. The planet wobbled.

If the Earth was unstable, time needed a better anchor.

In 1955, Essen and Jack Parry built the first practical caesium atomic clock. It was accurate to about one second in three hundred years — astonishing precision for the time. The BBC began incorporating atomic signals into its broadcasts within days.

A dispute followed. Astronomers briefly redefined the second in terms of the Earth's orbit — the "ephemeris second." But atomic clocks proved more stable than celestial mechanics.

In 1967 the second was redefined as 9,192,631,770 oscillations of a caesium-133 atom. Time was anchored to quantum physics.

Then came the question of what to call the new standard — the compromise that opens this essay.

In 1972, UTC went live as a hybrid system: atomic seconds adjusted occasionally to track the Earth's rotation. Time became quantum precision corrected by astronomy.

Consensus had scaled from village to continent to atom and star.

VI. The Leap Second: Consensus as Debt

Since 1972, leap seconds have been inserted to keep UTC within 0.9 seconds of Earth's rotation. Twenty-seven so far, the last in 2016. Each one a manual patch to our planetary system.

In theory a leap second is minor. In software 23:59:60 is a problem — a timestamp many systems were never built to understand. The 2012 leap second triggered outages across major platforms. Companies responded with "leap smearing," distributing the extra second gradually — meaning that for brief windows different infrastructures disagree about the current time.

The leap second was a reasonable compromise in 1972. Half a century later it had become a stumbling block.

In November 2022 — in a geopolitical climate that made consensus unusually delicate — the General Conference on Weights and Measures voted to abolish leap seconds by 2035. Corrections will occur far less frequently, perhaps once a century.

Russia voted against the measure, because GLONASS — unlike GPS — incorporates leap seconds into its logical architecture. Changing that requires new satellites and updated ground infrastructure. The 2035 date itself was a compromise: some countries wanted 2025, Russia wanted 2040.

Time diplomacy has its own cadence.

VII. The Fossil Record

From obelisks to atomic clocks, timekeeping is the history of scaling consensus. Each transition required not only better instruments, but broader agreement. And every agreement left traces: the Babylonian base-60 in every clock face, the French abstention that helped produce the International Time Bureau, the leap second's ecosystem of software assumptions and funny workarounds.

These are the fossil record of negotiated consensus.

UTC — matching neither English nor French, satisfying no one perfectly — may be the most honest artefact of international cooperation in daily use. Consensus does not mean universal enthusiasm. It means enough parties can live with the outcome to move forward.

But consensus does not pull itself up by its own bootstraps. The agreements embedded in UTC survive only through institutional care and coordination across decades. When we assume our infrastructure will simply carry on because it always has, invisible technical debt accumulates quietly, inside the software that assumes time itself will never overflow. And when the next timestamp boundary arrives, someone will inevitably ask: why don't we just reset the clocks?

The clocks are still ticking…

Consensus does not maintain itself. We have to tend it.

Canonical archive version: propertools.be/fieldwork/field-note-6-a-brief-history-of-consensus/

This is a story about exhaustion, dignity, and the invention of the modern world.

In 1618, two Imperial governors were thrown from a castle window in Prague. They survived — landing, depending on whom you believed, either in the arms of the Virgin Mary or in a conveniently located pile of manure. Both versions circulated widely. Neither side retracted.

That defenestration was the start.

What followed was thirty years of war across Central Europe — fought over religion, territory, dynasty, and eventually over nothing more than sheer inertia. By the time it ended, the German lands had lost between 20 and 40 percent of their people. Some regions lost fully half. The city of Magdeburg dropped from roughly 25,000 inhabitants to just a few hundred following a terrible siege.

Most civilians did not die in battle. They died of plague, typhus, dysentery, and starvation — carried along the roads and byways of Europe by mercenary armies that had no reliable supply chains and fed themselves by stripping the countryside bare as they passed. Disease followed displaced populations. Plunder followed disease. Armies followed plunder. Money followed armies. Ambition followed money — but ambition had no off switch.

Thirty years of this.

The Cast

By the 1640s, the principal players were exhausted.

Cardinal Mazarin, governing France on behalf of the young Louis XIV, wanted to weaken Habsburg power decisively. He did not want a quick peace. He wanted a strategic peace.

Count Maximilian von Trautmansdorff, chief negotiator for Emperor Ferdinand III, understood that the Habsburg Empire could not triumph outright. He arrived prepared to concede much — but his real mission was maintaining the imperial framework.

Johan Oxenstierna represented Sweden, whose armies had entered the war as Protestant champions and remained to secure territory and leverage.

And above him stood young Queen Christina of Sweden, who inherited not only a throne from her father but also a conflict older than she was. Youth, in this case, favored settlement over glory.

Behind them stood over 100 delegations representing nearly 200 rulers — many forced to share envoys they could not afford to send alone — none of whom would share a single negotiating chamber.

The Rooms

The negotiations unfolded in two cities fifty kilometers apart: Münster and Osnabrück.

Catholic powers met in Münster. Protestant powers in Osnabrück. Couriers rode between them. The cities were demilitarized and declared neutral.

This was not a design flaw. It was the only architecture that could hold.

Before they negotiated borders, they negotiated doors. Who entered first. Who sat where. Who signed before whom. France and Spain argued for months over ceremonial precedence. This was not vanity — it was social engineering. Rank, once publicly conceded, becomes permanent chagrin.

The war did not pause while they argued precedence. Armies maneuvered. Campaigns continued. But the couriers were protected, as was the imperial postal network run by the Thurn und Taxis family — whose name lives on in Brussels as Tour & Taxis. Messages flowed across battle lines even as death stalked and the countryside burned.

The system for ending the war was constructed while the war was still raging. It took about four years of work.

They forged on through overlapping delegations, backroom talks, and endless draft revisions. In the end, this distributed process converged slowly toward the tolerable equilibrium we call peace.

What They Built

On October 24, 1648, two treaties were signed — one in Münster, one in Osnabrück. Together they are known as the Peace of Westphalia.

They did not create love between combatants. They created structure.

Sovereignty became poured concrete. The princes of the Holy Roman Empire gained authority to conduct their own foreign policy and govern without routine imperial interference. The Habsburg Empire survived — but as an alliance framework rather than a strong command-and-control structure. Power dispersed without disintegrating into further collapse.

Religion was bounded. Religious settlement was frozen to the status of 1624. Catholicism, Lutheranism, and Calvinism were recognized. Rulers could no longer forcibly convert their subjects. This was not religious freedom as we know it today. It was something rather more limited but still meaningful: the recognition that coerced belief produces war, not salvation.

Negotiation became the new default. A major continental war ended not with annihilation but with a lasting settlement. No side achieved satisfying total victory, yet each side walked away with its dignity preserved.

Humiliation produces revanchism — organized political revenge. Revanchism outlasts treaties.

Children inherit the stories their parents tell about defeats. A lasting peace is one that every side can explain to their children at bedtime without teaching the next generation to enact revenge.

The Peace of Westphalia rearranged the map, but it did not eliminate national rivalries. It did establish an architecture inside the European system that made continued negotiation possible. This mattered.

Coda

Westphalia did not produce a paradise. It produced a system — flawed, asymmetrical, and unsatisfying to nearly everyone — that could absorb human disagreement without collapsing into immediate war.

That system is still with us today.

It has been violated repeatedly, but never fully replaced.

The most durable peace in European history was built on pragmatism — driven by the humility of exhaustion — and on the preservation of human dignity.

It was built by people who had every reason to keep fighting and chose, instead, to keep talking. Peace, like war, is something people must learn to practice.

Queen Christina herself would later abdicate the throne, convert to Catholicism, and spend the rest of her life in Rome — hosting philosophers, causing polite scandals, wearing men's clothes, swearing like a sailor, and riding her horses into a lather.

Canonical archive version: propertools.be/fieldwork/field-note-5-westphalia-or-how-to-end-a-war/

To patch, or not to patch—that is the query:
Whether ’tis nobler in the mind to suffer
The slings and arrows of outrageous zero-days,
Or to take arms against a sea of CVEs,
And by patching, end them?

To reboot—to sleep—
No more; and by a sleep to say we end
The heartache and the thousand natural shocks
That flesh is heir to—’tis a Halting Problem
Devoutly to be wish’d.

To reboot—to sleep—
To sleep, perchance to crash—ay, there’s the rub:
For in that sleep of reboot what downtime may come,
When we have shuffled off this runtime load,
Must give us pause.

For who would bear the whips and scorns of irate users,
The ticket queue, the proud manager’s contumely,
The pangs of lost backups, the update’s delay,
The insolence of vendors, and the spurns
That patient merit of the clueless takes,
When he himself might his quietus make
With a bare shutdown -h -now?

Who would fardels bear,
To grunt and sweat under a weary system load,
But that the dread of something after crash—
The undiscover’d kernel panic, from whose bourn
No system ever boots—puzzles the will,
And makes us rather bear those ills we have
Than fly to builds we know not of,
And push to prod on a Friday happy hour.

Thus ticketing does make cowards of us all,
And enterprises of great pitch and moment,
With this regard, their patches turn awry,
And lose the name of action.

Soft you now—
The help desk! Nymph, in thy tickets
Be all my sins remembered.

✶

On this day in 1932, James Chadwick announced the discovery of the neutron in the scientific journal Nature.

The neutron is electrically neutral. It does not draw attention the way protons and electrons do. But without it, atomic nuclei fly apart. It is the invisible binding force that makes stable matter possible.

Every organization has neutrons. They go by different names — sysadmin, network engineer, IT support, “the person who knows which cable to jiggle.” They carry no charge. They generate few headlines. But without them, everything flies apart.

If someone like that is in your life, consider forwarding this their way today with a simple “thanks.”

They’ll know what it means. They always do.

Canonical archive version: propertools.be/fieldwork/field-note-4-the-sysadmins-soliloquy/

I have to chuckle at those suddenly reaching for pitchforks and torches because they have finally noticed that there is a great deal of bad, thoughtless writing on the Internet.

This is not a new development. The Internet did not invent bad writing. It merely removed the economic and institutional filters that once constrained its distribution.

Having spent years in page layout and design, I experience a similar sense of amusement when I see people ready to fight civil wars over em-dashes, punctuation conventions, emoji, or other matters of stylistic orthodoxy.

These things do matter. They are part of the craft. But the intensity of the reaction often reveals something deeper than care for quality. (Please, nobody tell them about kerning!)

What is frequently presented as a defense of standards is often, upon closer inspection, a defense of identity — or of status.

Curation vs. Gatekeeping

This is where the distinction between curation and gatekeeping becomes important.

Curation is necessary. All fields of human endeavor require stewardship. Without standards, there is no continuity of craft. Without continuity of craft, there is no cumulative progress.

Editors, reviewers, maintainers, and teachers serve essential functions: they preserve signal-to-noise ratio.

Gatekeeping emerges from a different impulse — less concerned with preserving signal than with preserving hierarchy — the reflexive protection of perceived legitimacy by those who sense, consciously or not, that the basis of their own authority is becoming less secure.

The difference is subtle but consequential.

Curation asks: Does this contribute meaningfully to the body of work?

Gatekeeping asks: Does this threaten my position within it?

Volume and Scarcity

The current wave of anxiety around writing quality — and increasingly around machine-generated writing — exposes this dynamic tension with unusual intensity.

When the barriers to production fall, the volume of output invariably increases. But volume alone does not destroy signal. It merely makes signal harder to locate.

Bad writing can sometimes conceal good thinking. Good writing struggles to conceal the absence of it.

There is, however, a different and more defensible concern. The marginal cost of generating text has collapsed, while the marginal cost of reading and evaluating it remains human. When intellectual work is outsourced wholesale and forwarded unfiltered, the burden does not disappear — it shifts.

What once required effort to waste someone’s time now requires almost none. That asymmetry changes behavior, and those who object to it are not gatekeeping. They are defending something genuinely scarce: their own time and attention.

But attention is not the only scarcity being exposed.

For most of human history, legitimacy was conferred by institutional proximity. Publication, affiliation, and credentialing served as proxies for competence. When those mechanisms weaken, legitimacy must be established more directly — through clarity of thought and durability of contribution.

This transition removes protective ambiguity.

And ambiguity, once removed, reveals uncomfortable asymmetries.

Legitimacy and Intelligence

We tend to assume that intelligence and insight are universally valued. At least, this is what we tell our children. In practice, intelligence is often tolerated only when it does not disrupt existing social equilibria. When it does, it provokes defensive reactions — rarely framed nakedly in those terms, but instead expressed as concerns about tone, form, process, or propriety.

The reaction is not to the medium, but to the implied redistribution of legitimacy.

I sometimes find myself hoping that we never succeed in creating a truly superhuman intelligence — not because it would necessarily harm us, but because I suspect we would mostly just resent it for being smarter than us. Much as we so often resent the encounter with an exceptional intelligence somehow different from our own within one another.

The history of human response to extraordinary intellect is not, on the whole, a generous one. We celebrate it safely in retrospect — once it has been domesticated into curriculum and canon — but in the hot flash of the moment, brilliance that cannot be credentialed or contained tends to provoke not admiration but anxiety.

This is the gatekeeping impulse at its deepest root: not a defense of standards, but a defense against the unbearable possibility that legitimacy was never ours to confer.

Protected Spaces

This, I suspect, is precisely why places like the Institute for Advanced Study exist.

They are not merely centres of blue-sky research. They are protected ecosystems where the legitimacy of thought does not depend on its conformity to prevailing cultural anxieties. They function as buffers between fragile social hierarchies and the destabilizing force of unconstrained inquiry.

One imagines the IAS founders understood this need intuitively. Brilliance has always required shelter from environments where credentialing substitutes for curiosity — and patrons who understood this.

Final Question

Gatekeeping is, at its core, a symptom of performative anxiety: the fear that one’s own position cannot withstand unconstrained scrutiny.

Curation, by contrast, is an act of ongoing stewardship. It assumes that quality will ultimately distinguish itself, and that the role of institutions and individuals is not to suppress emergence of novelty, but to preserve coherence of meaning.

William Gibson (the Pogo of sci-fi) once wrote, “The future is already here. It’s just unevenly distributed.”

I frequently ask myself how to navigate between these two poles — how to protect my own attention without becoming what I critique.

What do you think?

Canonical archive version: propertools.be/fieldwork/field-note-3-on-gatekeeping-and-curation/

Human science has been deeply dependent on Turing machines since the 1950s. Vast bodies of modern knowledge — from climate modeling to particle physics to cryptography — are already computationally mediated in ways no individual human can fully reproduce or intuit. We’ve trusted machines with our science for more than seventy years. We didn’t particularly notice, because they spoke to us in numbers.

What’s changed is not the mediation, but the interface. Machines now operate in human language, and that has triggered a crisis of epistemic status. Familiar signals of effort, intelligence, and authorship no longer reliably distinguish speakers.

We have been here before. When Gutenberg’s press made the written word reproducible, the gatekeepers of knowledge — the clergy, the scribes, the universities — did not celebrate the democratisation of thought. They panicked. If anyone could print a book, how would you know which books you could trust?

The answer, eventually, was not to ban the press or to police who was allowed to set type. It was to learn how to read — critically, carefully, and for oneself. That transition took generations and sadly cost many lives. We are at the beginning of another. We are not off to a great start.

There is a growing tendency on social media to treat certain phrases not as elements of meaning, but as forensic evidence of intellectual wrongdoing. Use the wrong wording or one emoji too many, and you’re no longer engaging in good-faith public discourse — you’re under suspicion. This is “AI detection” as epistemology, and it is fundamentally antithetical to the pursuit of science.

If we are suddenly suspicious of new truths because of the tools involved, intellectual honesty demands we revisit older ones that relied on similar machinery — but without the benefit of modern software testing or validation.

Selective skepticism isn’t rigor. It’s anxiety management, and it’s epistemic gatekeeping. And anxiety is a poor substitute for clarity.

As Pontius Pilate asked: “What is truth?”

Not as a sincere inquiry, but as a shrug of institutional responsibility.

We are entering a period where meaning matters more than provenance, good judgment more than vibes, and due care more than performative certainty. Policing phrases won’t get us there. Learning how to read — seriously, generously, and critically — still might. 🕊️

Canonical archive version: propertools.be/fieldwork/field-note-2-what-is-truth/

Gödel and the Horizon

When people hear the name Kurt Gödel, they usually hear it as a theorem: incompleteness. Something abstract, austere, and vaguely intimidating. A result from mathematical logic that gets invoked whenever someone wants to say, “You can’t prove everything,” and then quickly moved past.

But Gödel was not a theorem. He was a human being. And understanding him matters, because his work was not a clever trick — it was a warning discovered the hard way round.

Herr Warum

Gödel was born in 1906 in what is now Brno (Czechia), then part of the Austro-Hungarian Empire. He was precocious, sensitive, and intellectually intense. As a child he was nicknamed “Herr Warum” (Mr. Why) because he questioned everything. As an adult, he never really stopped.

In the late 1920s, mathematics was deep in crisis, yet gripped by a powerful dream: that it could be made complete, consistent, and self-justifying. If only the right axioms were chosen, if only the right formal system were constructed, then all mathematical truths could in principle be derived mechanistically, the system pulling itself up by the metaphysical bootstraps. Certainty could be chewed into bite-sized pieces inside the gears of logic itself.

Gödel shattered that dream.

Incompleteness

In 1931, at the age of 25, he published his incompleteness theorems. In plain language, Gödel showed this:

In any sufficiently powerful formal system, there are true statements that cannot be proven within that system. And no such system can prove its own consistency without stepping outside itself.

This was not a failure of imagination or mathematical technique. It was structural. No amount of cleverness could fix it. Gödel’s result is not a curiosity of mathematics; it is a pattern that reappears wherever systems grow large enough — or old enough — to forget their own assumptions.

What often gets missed is that Gödel did not take pleasure in this result. He was not a relativist or a nihilist; he believed deeply in objective truth — perhaps too deeply.

He simply discovered that formal systems have structural horizons, and that pretending otherwise is inherently dangerous.

Princeton

After fleeing Europe during the rise of Nazism, Gödel settled in Princeton, where he spent decades at the Institute for Advanced Study. He walked daily with Albert Einstein, who considered Gödel the only person at the Institute worth visiting. The two talked not just about physics, but about time, causality, and the nature of reality.

Gödel even identified solutions to Einstein’s equations — closed timelike curves — in which time travel was mathematically possible. Einstein was unsettled. Gödel was not trying to shock; he was just following the logic where it led. Herr Warum, indeed.

Self-Grounding

Gödel’s interests extended far beyond mathematics. He worked seriously on philosophy and theology, including formal ontological arguments for the existence of God. These were not devotional exercises, but logical ones: attempts, building on Leibniz, to derive the existence of a necessary being using modal logic. He thought deeply about aseity — the property of existing through oneself, of being the ground of one’s own being rather than dependent on any external causality.

For Gödel, this was not a distraction from his mathematical work. It was an extension of it. If formal systems cannot ground themselves, what can?

The question of self-sufficiency — whether in formal logic, in human existence, or in God — ran throughout his life’s work.

Principia

This question haunted the great project Gödel quietly brought to an end: Principia Mathematica, the monumental life’s work of Alfred North Whitehead and Bertrand Russell. Their aim was nothing less than to place all of mathematics on a complete, formal, self-consistent foundation. (The manuscript was so vast it was famously transported in a wheelbarrow.)

Gödel’s theorems did not merely add a footnote to Principia Mathematica. They demolished it. They showed that its core aspiration could never be fulfilled. No formal system powerful enough to contain arithmetic could also certify its own foundations.

As a fourteen-year-old, I once picked up a hardbound copy of Principia Mathematica at a library book sale. It was impenetrable. I could barely get through the first chapter. But even then, I sensed the scale of the ambition — and the fragility of the hope beneath it.

Fragility

Gödel’s intellectual honesty was paired with extreme personal fragility. He suffered from paranoia, hypochondria, and a persistent fear of poisoning. He trusted very few people. In the end, he trusted almost no systems at all — not institutions, not doctors, sometimes not even his own body.

I have sometimes wondered — cautiously, speculatively — whether his lifelong fear of being poisoned might have been connected, at some unconscious level, to the fact that he had spoiled the central project of his elders. Not because Whitehead or Russell were themselves vindictive people, but because Gödel understood, perhaps too well, what it meant to invalidate someone’s life’s work built on certainty.

After his wife fell ill and could no longer prepare his food for him, Gödel stopped eating. He starved to death in 1978, weighing barely 30 kilograms. The man who proved that systems cannot secure their own foundations could not bring himself to trust the carefully constructed system meant to care for him.

The following year, Douglas Hofstadter published Gödel, Escher, Bach — the book that would carry Gödel’s name into a generation of curious minds who might never otherwise have encountered him.

The Practical Lesson

There is no neat moral here. Only a serious question.

Gödel teaches us that limits are not defects. They are structural features of reality.

Any system — logical, technical, institutional — that claims total certainty is either lying or unaware of its own blind spots. Wisdom does not come from eliminating uncertainty, but from recognizing where it begins.

In a world increasingly built on complex, interdependent systems — software stacks, protocols, institutions, automated decision engines — Gödel’s lesson is not academic. It is practical.

You cannot prove your way out of fragility. You cannot formalize your way into absolute safety. You cannot audit your way past the limits of your own map.

Gödel did not destroy truth. He defended it — by showing us precisely where it can and cannot be pursued.

A Personal Note

I first encountered Gödel’s work when I was fourteen. I found the implications so unsettling that I ran up my parents’ long-distance phone bill social-engineering my way to Douglas Hofstadter’s office. I needed to talk to someone who understood.

We spoke twice. I told him I was troubled by what the theorems seemed to imply — about certainty, about systems, about the future, about what we could ever really know. He was patient and kind, but nonplussed. In his view, my concerns were a category error.

I’m still not sure he was right. But I’ve carried the question for some thirty-four years. This Field Note is, in part, a debt repaid — to Douglas Hofstadter for his patience with a budding young “Herr Warum,” and to Kurt Gödel for the warning — and for being a truly beautiful mind.

Canonical archive version: propertools.be/fieldwork/field-note-1-kurt-godel-and-limits-of-certainty/

Every new project begins with promises, most of them unspoken. Scope creep, mission drift, and eventual disappointment usually follow — not from bad faith, but from ambiguity that was never resolved at the start.

This is an attempt to do things differently.

Before the first real essay, while the slate is still clean and commitments are still cheap to make, I want to name what these Field Notes are for, what they aren’t, and what I owe you if you choose to keep reading.

What follows is a statement of work. Not a manifesto. Not a mission statement. Just a plain account of what I’m trying to build, and the constraints I’m willing to be held to.

I will not always succeed. But I would rather fail against a standard I’ve named than succeed at something I never defined.

What This Is

I will publish occasional standalone essays designed to help thoughtful readers reason clearly about complex systems under constraint.

The goal is not to predict the future, win arguments, or respond to the news cycle.

The goal is to reduce harm caused by misunderstanding inevitability, scale, and fundamental limits — especially when critical decisions are being made under pressure.

These essays are written to remain useful long after the moment that prompted them has passed.

What I Owe You

If you give me your attention, you should come away with at least one of the following:

1. A clearer mental model — a way of seeing a problem that reduces confusion, panic, or false certainty.
2. A practical heuristic — a test, question, mental tool, or rule of thumb you can apply in your own work or thinking.
3. A better sense of limits — an understanding of what cannot be controlled, predicted, or optimized, and why that matters.
4. A wider sense of where choice still exists — even when outcomes feel inevitable.

If an essay does not deliver at least one of these, I should not have published it.

Who This Is For

I write for a general reader: moderately educated, curious, reflective, and capable of sustained attention. This is not limited to cybersecurity, technology, or policy professionals. Nonnative English speakers are explicitly included.

I assume intelligence without insider context. I assume good faith, but not specialized background.

If a smart sixteen-year-old or a thoughtful nonnative speaker would have to stop and look something up, I have failed to be clear enough.

How This Should Read

• Calm, not urgent.
• Precise, not verbose.
• Confident without being performative.
• Pragmatic rather than philosophical for its own sake.
• Serious without being grim.
• Willing to sit with difficulty.
• Comfortable with ambiguity when the situation demands it.

I will try to avoid outrage, hype, snark, tribal signaling, certainty theater, and performative pessimism.

This has been thought about carefully, and it’s offered in good faith.

What This Is Not

These Field Notes are not a link roundup. Not a threat report. Not news commentary. Not hot takes. Not a diary. Not advocacy.

Links may appear, but only as references — not as the primary content.

I am not trying to keep up. I am trying to be useful.

When to Expect It

Essays will arrive occasionally, not on a fixed weekly schedule.

Typical cadence is every three to six weeks. Never more than twice per month. Never less than once per quarter. Usually published on Fridays.

Silence between issues is intentional.

No essay will be rushed to meet a schedule. If you don’t hear from me, it means I don’t yet have something worth your time.

On Reach and Attention

I will not optimize for virality or engagement metrics.

There is no obligation to comment on current events. No expectation of external promotion. No requirement to maintain visibility.

Readers who find this work are expected to do so by choice. That is the only audience I want.

If You Write Back

If you write me back something worth sharing, I may include it in a future issue. I will ask you first.

On Guest Essays

Occasional guest essays may appear if they meet the same standards: clarity, restraint, durability, good faith, and respect for limits.

Guest essays are framed as offered tools, not endorsements. They should feel coherent.

How I Will Hold Myself Accountable

Before I publish anything, I will ask myself:

1. Does this reduce confusion or fatalism?
2. Does it respect the reader’s intelligence and time?
3. Will it still make sense in a year?
4. Am I writing this to be useful, or to be seen?
5. Would I still stand by this if it were quietly read by someone under duress?
6. Does it engender hope and agency?
7. Is this durable, or is it mainly about this week?

If any of these fail, I will revise or wait.

I will not always get it right. But these are the questions I am willing to be judged against.

Final Orientation

This is not about having the right answers. It is about asking better questions at key moments, before fear, habit, or momentum decide for us.

Thank you for reading this far. I will try to be worth your time.

— Trey

Canonical archive version: propertools.be/fieldwork/field-note-zero-statement-of-work/