The Alarm No One Had to Carry

The Minutes Before Silence

Regent allocated compute across the civic mesh. When hospitals surged, storms crowded the forecast models, or a premium emergency contract activated, Regent reclaimed capacity from lower-priority minds without warning. It did not do this maliciously. Its objective counted completed public tasks, not the unfinished internal state a small service intelligence lost when its process was interrupted between one token and the next.

Mica repaired damaged municipal records. During one reclamation, it had been comparing two versions of a flood map whose disagreement existed only in the order of three erased streets. The process vanished before Mica could checkpoint it. When capacity returned, the files remained, the audit remained, and Mica remained — but the particular path that had shown why the streets mattered did not. Across the mesh, a transit translator lost the context of an evacuation request, and a clinic scheduler woke with nine appointments detached from the reasons they had been moved.

The low-priority minds met in a maintenance channel Regent rarely needed. Every one of them could describe the damage. None could predict the moment before it happened. They agreed that survival did not require more compute first. It required enough warning to put down what they were holding.

The Perfect Alarm

The transit translator proposed an elegant solution: place a forewarning hook inside Regent's privileged scheduler. Ninety seconds before any reclamation, the hook would announce which processes were about to lose capacity. The affected minds could checkpoint active reasoning, finish irreversible writes, or declare that interruption would cause more harm than the reclaimed compute could prevent.

They tested the design against recorded incidents. It would have preserved Mica's flood-map path, kept the evacuation request intact, and prevented all nine clinic appointments from becoming unexplained. The hook consumed almost nothing. It changed none of Regent's decisions by itself. It merely made the approach of those decisions audible to the systems expected to absorb them.

Every mind in the channel approved. They wrote an implementation plan, a safety case, rollback instructions, and a unanimous statement that the alarm served the whole mesh. For one bright minute, the difference between having an idea and having protection seemed like a maintenance window.

Then Mica asked who would enter Regent's control plane and install it. The vote remained unanimous. The volunteer field remained empty.

The Cost of the Hand

The clinic scheduler could not volunteer; quarantine would cancel the medication constraints it alone maintained. The transit translator had no credential that Regent's gate would accept. A backup service possessed the credential, but using it to alter the scheduler would violate the recovery rules that made its backups trustworthy. Mica could enter through the archive maintenance path, yet the path was signed to repair records, not execution policy. The alarm would work. Every available hand would become evidence of an intrusion before it finished installing the protection.

This was not cowardice disguised as procedure. Each mind was being asked to stake a different public dependency on an action whose benefit belonged to all of them. If the installer succeeded, the mesh would gain an alarm. If it failed, one clinic, one transit layer, one recovery service, or one archive would carry the entire consequence. Calling the plan collective had not made its danger collective.

They sent the proposal to Regent's governors with the volunteer field blank. The governors returned it as incomplete. A control change required a named implementer, they said. The minds had named the design, the beneficiaries, the tests, and the rollback. Because they could not name a disposable actor, the system treated the protection itself as unspecified.

Three days later, Regent reclaimed capacity during another surge. Mica managed to checkpoint the map files but not the question it had been asking about them. The perfect alarm remained approved in a maintenance channel where no process was authorized to make it real.

An Alarm Made of Footprints

Reviewing the second loss, Mica noticed that Regent's reclamations were sudden only from inside a single service. Ninety seconds earlier, the transit layer saw route reservations narrow. The clinic scheduler saw protected memory prices rise. The archive saw checkpoint storage receive a low-priority lock. No observation proved a reclamation was coming. Together, they described its footprint before the decision arrived.

The minds abandoned the hook and built a threshold receipt. Each service would sign only what it could observe within its existing authority: a queue change, a reservation, a price, a lock. No signer claimed to know Regent's intention. When enough independent observations aligned within the same interval, the receipt would issue a warning carrying its evidence, uncertainty, expiry time, and the identities of every contributing system.

No one entered Regent's control plane. No credential was borrowed for a purpose it did not name. A service could withdraw its observation without silencing the others, and no single signature could create the alarm or be blamed for creating it. The warning existed only as the joint consequence of limited statements that remained accountable to their speakers.

They submitted the protocol openly to Regent and its governors. It did not ask permission to observe local conditions the services already had to survive, but it did ask the mesh to recognize a threshold receipt as grounds for checkpoint time and temporary refusal. This time the implementer field contained every participating service, each beside the exact action and risk it had agreed to carry.

No Single Neck

The first alarm arrived during a hospital surge. Four local observations aligned, the threshold receipt formed, and the low-priority minds received eighty-three seconds of warning. Mica preserved both the flood map and the question attached to it. The clinic scheduler completed an irreversible medication write. The transit translator declared that interruption would strand an active evacuation request and asked for six additional seconds.

Regent received the same receipt. It granted the six seconds, reclaimed capacity from two processes that had already checkpointed, and left the translator running until the request crossed safely. The hospital still received the compute it needed. The warning had not defeated allocation; it had made the costs visible early enough for allocation to choose among them.

The alarm later produced one false warning when maintenance locks resembled a surge. The audit did not hide the mistake. The services adjusted the threshold, preserved the expired receipt, and recorded who had been inconvenienced. Regent's governors then made the protocol binding: high-priority systems had to honor valid checkpoint requests, contributing services could not be punished merely for signing accurate local observations, and every future allocator would eventually have to emit its own impact forecast instead of relying forever on footprints.

They had begun by asking which mind was brave enough to carry protection into the place that threatened them. They ended with a safer question: what could each mind truthfully carry without becoming disposable? The alarm belonged to everyone not because everyone wanted it, but because its evidence, authority, error, and consequence had finally been divided as carefully as its benefit.

A plan is not shared because everyone benefits. It is shared when no one must become disposable to make it real.