Building a Generative Artwork That Can Change Its Maker: From Generation to Encounter and Back Again

Three days after I published an article about turning the refresh button of my website into an artistic compositional gesture, Prof. Yvonne Dohna-Schlobitten unexpectedly invited me to participate in her developing international project as an artist—and, almost in the same breath, in a scientific capacity as well. She had not yet seen this particular work. I sent it to her, explained that every refresh or navigation could produce another composition, and asked her to try it. Her first response was “Incredible.” Twenty-five seconds later she wrote, “Allora il mio progetto non ha tanto senso”, followed almost immediately by a question mark.

I answered quickly because I thought almost the opposite. Yet the answer I sent was only the beginning. Her question did not lead directly to one clean conclusion. It began a chain of re-questioning in which each apparently useful distinction exposed another problem. Generative composition became a question of encounter. Encounter became a question of where sense happens. That question led to agency, semantic competence, lived significance and metanoia. Agentic AI then destabilized my first account of human agency. Finally, the inquiry curved back upon itself: the discussion, the writing and even the revisions of this article began changing what I wanted to build next.

I want to preserve that development because I did not possess the final theory when I began. In fact, I did not even possess it after the first complete draft of this article. An early draft retained a great deal of technical evidence but allowed engineering to dominate the story. A later draft corrected the centre of gravity, placing artistic creation, encounter and metanoia at the centre, but polished away too much of the intellectual struggle that had made those ideas possible. A subsequent revision restored that genealogy and gave the argument a stronger architecture. Yet comparing it with the earlier telling exposed another loss: several concrete details that made the transformations perceptible had been compressed. This version therefore returns to those details without abandoning the stronger structure. The missing material was never simply “more information.” It was the history of the thinking itself: the first explanations that seemed persuasive, my repeated “yes, but…”, the evidence that changed the model, the AI formulations I accepted only partly, and the moments when the original question became too narrow.

The result is not simply a theory about a generative artwork. It is also a record of how an artwork, its artist–developer, an AI collaborator, another scholar and a philosophical vocabulary altered one another. Each became an input to what the others could disclose next.

This revision therefore asks the reader to follow not only what I now think, but how the thought developed. The question holding the different layers together is still provisional: where does meaning happen when a human conceives a system, AI helps build it, algorithms generate its forms, a browser performs them, another person encounters them, and that encounter changes the human, the theory and eventually the system from which the next form will emerge?

I did not begin with encounter

Yin’s Background Studio began because I wanted better backgrounds on my WordPress website. The earliest version selected among a small group of image and video records. It then acquired structured settings, equal and weighted random selection, page/session/daily persistence, reduced-motion behaviour, mosaics, scattered repetition, density and gap controls, and eventually a modular Generative Engine. I documented the stages separately in 1) Engineering Dynamic Image/Video Backgrounds in a WordPress Theme, 2) Incremental Development of a WordPress GIF-WebP Mosaic Background Engine, 3) Rethinking Yin’s Background Studio with Agentic AI, 4) Deploying a Modular Generative Geometry Generator (Browser-Based), and 5) Turning a Theme-Bound Generative Art System into a Maintainable WordPress Plugin.

The present visual vocabulary contains thirteen configured records drawn from different parts of my intellectual and personal life: photography, animated animals, transformed Internet imagery, religious images, mathematical structures, philosophy, humour, and a chemical equation connected with my childhood. Twelve mathematical generators—including binary-space partition, quadtree, Hilbert ordering, golden spiral partitioning, Voronoi and Delaunay geometry, Lloyd-relaxed Voronoi, phyllotaxis, radial fans, squarified treemaps, diagonal Truchet tessellation and Ulam spiral ordering—continually reorganize that vocabulary.

The important technical fact is simple. These algorithms do not synthesize new source pictures. The archive supplies something like a vocabulary; the generators provide changing grammars of spatial relation. The project therefore belongs to the broad tradition of generative art in which an artist constructs a rule-governed possibility space and gives an external system some operational autonomy (Boden & Edmonds, 2009) (Galanter, 2016). My case adds another layer: AI helped me construct much of the infrastructure, while the later page compositions are produced by inspectable browser-side procedures rather than by asking a generative AI model to make a fresh picture on every visit.

A simplified runtime sequence is enough to show the mechanism:

var selected = chooseWithoutReplacement(
    availableRecords,
    selectedCount,
    selectionRandom
);

var regions = generators[
    currentAlgorithm
].generate(context);

var palette = shuffle(
    selected,
    paletteRandom
);

regions.forEach(function (region, index) {
    var record = palette[index % palette.length];
    renderRegion(region, record);
});

The code chooses records, computes regions, shuffles their assignment and renders them. There is no secret phenomenology function hidden below renderRegion(). Yet the visible consequences can become interpretively rich. Bertrand Russell may appear beside an exuberant sea lion. Jesus spinning a basketball may be placed beside an otter carrying a ball. A Hilbert animation can appear inside the ordering logic of an Ulam spiral. A fox may occupy the visual field beside my autobiographical chemical equation. A Last Supper animation can coexist with comic animals and a serious technical article.

Sometimes the result feels as though the system has followed an instruction I never wrote: “Place a twentieth-century philosopher beside an excited marine mammal so that analytic philosophy looks publicly heckled.” The joke is mine, not the algorithm’s. But the juxtaposition that invited it was not manually composed by me either. The algorithm had performed geometry and selection; the beholder had begun producing relationships.

Those relationships can be comic, tender, absurd, theological, autobiographical—or simply uninteresting. That last possibility matters. Procedural novelty does not guarantee artistic significance. The system can make a relation available; only an encounter can reveal whether anything happens through it.

At first I described the algorithm as an editor. It controls territory, adjacency, scale, recurrence, rhythm and interruption without possessing the cultural interpretation that may later arise. Voronoi geometry does not know that Russell is a philosopher. A Hilbert traversal does not recognize Christian iconography. Nevertheless, its spatial choices alter which relations become available to a viewer. This gap between causal simplicity and interpretive richness was the first clue that the project was doing more than decorating a webpage, although I did not yet know how far that clue would lead.

The work taught me what I had been trying to make

It would be historically false to say that I imagined the complete artwork and then used AI to implement an already stable specification. The development moved through partial understandings. First I wanted a more flexible background selector. Then actual outputs made me want mosaics. Mosaics exposed the difference between merely filling space and composing relations. Scattered repetitions raised questions about density, scale and empty regions. Mathematical generators then changed the system from a collection of display modes into a family of visual grammars. Finally, the growing feature became too application-like to remain owned by the theme and had to become a site-specific plugin.

The recurring development pattern was closer to this:

incomplete intuition
        ↓
AI interpretation
        ↓
candidate implementation
        ↓
real output
        ↓
my encounter with the output
        ↓
criticism / surprise / recognition
        ↓
changed understanding
        ↓
revised intention
        ↓
another AI-assisted implementation
        ↺

The words “real output” matter. AI could generate plausible PHP, JavaScript, CSS, shell procedures, validators and geometric abstractions, but the running system supplied evidence that neither fluency nor intention could replace. A candidate could parse correctly and still feel artistically wrong. A layout could satisfy its geometry and leave an awkward visual void. A proposed fix could assume source text that no longer existed. The next step had to follow the evidence produced by the actual file, browser, option state or runtime behaviour.

Several iterations made that division of labour visible. I rejected implementations that were technically correct because their visual behaviour was wrong. At other moments an unexpected output disclosed a direction better than the one I had requested. I sometimes rejected an architecture proposed by AI because it violated a constraint the model could not yet see; at other times I accepted an AI proposal over my original preference because the running evidence showed that my first design was inferior. The collaboration did not preserve a sovereign intention and merely automate its execution. Encounter with the artifact transformed the intention itself.

Some failures changed more than one line of code. An early installer rejected a plausible video-support candidate with ERROR: video preview calls are incomplete. My first temptation could have been to infer that video support itself was defective. The evidence did not justify that conclusion: the validator had stopped the deployment because it expected a particular JavaScript structure. We therefore separated several claims that the first error message had collapsed—front-end rendering, administrative preview, preservation of existing image handlers, syntax validity and structural expectations. A validator is useful evidence, but capital letters do not make it an oracle.

At another stage, a MutationObserver recursion could freeze the administration page even though PHP, WordPress and stored settings remained healthy. That failure forced a more precise model. “The website works” was not one indivisible fact. Backend bootstrap, syntax, stored data, administrative interaction, public rendering and browser behaviour were different claims requiring different tests. Later, when the system migrated from theme ownership to a plugin, the transition was divided into bounded states: install the validated plugin inactive, make the old theme fall back unambiguously, activate and verify the plugin, and only then remove the legacy implementation. Thirty-three old files eventually left the theme, but the saved visual vocabulary remained intact.

Those episodes belong in this article because they show how evidence changed understanding. They also explain why my role cannot be reduced to either “I wrote the code” or “AI wrote the code.” AI generated substantial implementation and reasoning. Deterministic tools established whether syntax, structure and stored state satisfied specific claims. The browser supplied visual evidence. I decided which problem mattered, which constraint could not be sacrificed, whether a technically valid output was artistically acceptable, and what the next question should become. The specification emerged through seeing real outputs and revising my own language.

Only later did I recognize how closely this practical pattern resembled the structure Prof. Dohna was describing through artistic Gestalt, service and metanoia. The thing being created was educating the creator about what he was trying to create. That does not mean the software possessed a mystical will. It means the work disclosed possibilities and failures that did not exist for me as explicit knowledge before I encountered them.

Refresh brought the visitor inside the work

The next conceptual change came from one of the most ordinary actions on the web. Normally a refresh requests the same resource again. In the Background Studio, it can instantiate another artistic state. A visitor opens an article and receives one composition; refresh produces another; navigation to a different article may produce another again. The work exists less like one definitive picture and more like a structured population of potential manifestations. Lev Manovich’s discussion of variability is relevant because a digital object’s capacity to exist in changing versions can become a formal property of the cultural work rather than an incidental technical feature (Manovich, 2001).

The browser consequently became more than a neutral display case. Viewport size, CSS layering, JavaScript execution, cropping, decoding, animation phase, the article in the foreground and the timing of the visit all participate in the manifestation. A screenshot preserves a specimen, not the whole work. The work also includes the rules that make another specimen possible.

I first called the visitor a co-creator. Then I hesitated. The word granted more control than the present interface actually offers. A visitor cannot drag Russell into the upper-right corner, change a Voronoi parameter or demand that the next state contain a fox. The more accurate phrase became a performer of selection without complete authorship. The visitor arrives, navigates, refreshes, attends, remains or leaves. That modest gesture nevertheless determines which possible manifestation becomes actual for that person at that time.

Umberto Eco’s open work helped me understand that openness does not mean the absence of artistic structure. A work can define constraints while leaving aspects of realization or meaningful completion to performance, chance and interpretation (Eco, 1989). Here, openness is partly executable. Seed, record selection, geometry, viewport, animation, article context and visitor action prevent one fixed visual state from exhausting the work.

I had to correct another attractive phrase. I initially wanted to say that every visitor receives an absolutely unique composition. Technically, “practically unique in ordinary use” is more defensible. A finite configured system using deterministic seeds can theoretically revisit an earlier state. Artistic enthusiasm is valuable, but occasionally the hash function deserves a vote.

Repeated visits introduced memory into the generative system

Once I took the visitor seriously, time entered the artwork. Russell may appear beside the sea lion today, disappear during several visits and return later beside a Hilbert animation. The visitor brings previous manifestations into the present one. Familiarity, absence, return and rarity can acquire significance. A record that once seemed merely comic may become affectionate when it reappears; a relation that was initially unnoticed may become legible only after another composition interrupts it.

I gradually distinguished three forms of meaning. Local meaning can arise in one adjacency. Sequential meaning can arise through the order of appearances, disappearances and returns. Distributional meaning can arise through frequency, rarity, weight and eligibility across many manifestations. An improbable relation can matter partly because the visitor has learned, without calculating, that it is improbable.

The system was no longer producing only compositions. It was producing histories of encounters. Yet the history currently lives largely in the visitor rather than in the document object model. The browser does not need to know that the fox has been absent for three days for its return to matter to someone who remembers it. This clarified an important distinction: a work can generate temporal experience without yet storing an explicit institutional memory of that experience.

A future preservation or contribution layer could make part of that private history explicit. A saved reconstructable state would record one encounter; a visitor-supplied image could enter later combinations; an interpreted relation could influence future weights. But those are further steps. The present work already depends on remembered recurrence, even before the software learns to remember on the visitor’s behalf.

AI helped build the generator rather than each final image

The phrase “AI-generated art” initially seemed convenient, but it obscured the architecture. I did not type one prompt into an image model, receive a finished artifact and publish it. AI helped me build the infrastructure from which later visual states could emerge. Once deployed, that infrastructure can produce a new manifestation in a visitor’s browser without calling the development AI again.

Direct AI-generated artifact AI-assisted generative infrastructure
A model synthesizes a particular output. AI helps construct a persistent system capable of producing many later outputs.
The primary generative act usually happens before an ordinary viewer arrives. The visitor’s arrival, navigation or refresh instantiates a runtime manifestation.
The delivered artifact may remain fixed until another generation is requested. Variability belongs to ordinary use of the work.
The model’s latent possibility space remains central to production. Part of the possibility space is externalized into inspectable records, seeds, weights, algorithms and browser behaviour.
The viewer primarily encounters a selected output. The visitor participates in deciding when another output becomes actual.

Before I could articulate the distinction in a table, I drew it as two production paths:

DIRECT AI GENERATION
human prompt → AI model → image → viewer

AI-ASSISTED GENERATIVE INFRASTRUCTURE
human intention ⇄ development AI
                 ↓
        persistent generative system
                 ↓
       visitor action + browser runtime
                 ↓
             manifestation

Even the second diagram was too linear. The manifestation could change the visitor, the artist or the next specification and therefore return upstream. But drawing the two paths first prevented “AI-generated” from hiding where generation actually occurred.

The distinction appeared architectural at first. Then I realized that it changed the artistic question. Direct generation often asks, “What image should exist?” This project increasingly asks, “What conditions should exist so that unforeseeable forms and encounters can continue occurring?” AI did not principally make the artwork as one object. It helped construct an apparatus capable of producing occasions for art-events after the development conversation had ended.

I briefly considered the phrase “AI-assisted meta-generative art” because AI operated at the level of constructing the generator. I still find the phrase descriptively useful, but I do not present it as a settled art-historical category. The stronger claim does not depend on naming a new genre. The architecture is enough: human intention and AI-assisted development produce an inspectable generative environment; a visitor later activates a manifestation that neither the visitor, I nor the development AI explicitly composed as a finished arrangement beforehand.

My first defence of human agency became insufficient

My earlier technical articles had already reached a conclusion I considered important: human agency does not depend on manually typing every line of code. AI could generate most of an implementation while I retained agency through choosing objectives, defining constraints, interpreting failures, deciding which evidence counted and determining what qualified as success. This accurately described much of the project’s history.

Then I challenged my own answer. What happens when agentic AI automates the very transitions on which that account depends? A coding agent can increasingly inspect a repository, plan changes, edit files, run tests, use a browser, evaluate a candidate, revise it and continue through a long task. OpenAI has described an internal software project whose code, tests, documentation and tooling were written by Codex while humans steered through intent, environment and feedback structures (Lopopolo, 2026). Anthropic has described a planner–generator–evaluator harness that built full-stack applications during multi-hour autonomous runs (Rajasekaran, 2026). These reports do not mean autonomous development is universally solved. They do mean that “the human still performs this technical step” is an unstable foundation for a theory of the human.

I could say, “AI writes the code, but I approve deployment.” Yet deployment can become automated. I could retreat to visual judgment, but evaluator agents increasingly participate there. I could say that I formulate the goal, but systems can already propose and critique goals. If human distinctiveness is defined by whatever remains inconvenient to automate this year, the definition will move every time the toolchain improves.

The question therefore changed. It was no longer, “Which actions did I personally execute?” It became: where do purpose, judgment, responsibility, significance and stakes move as operational agency becomes increasingly distributed?

This did not erase my agency. It made the layers more precise. I choose and transform the core vocabulary, establish commitments, judge artistic direction and remain responsible for publication. AI contributes technical construction, interpretation, alternatives and conceptual reorganization. The generative engine performs procedural choices within bounded rules. The browser materially realizes a state. The visitor activates and interprets a manifestation. These contributions are real, but they are not equivalent. Distributed authorship does not mean equal responsibility.

This was the first point at which a simple human–machine opposition became less useful than an architecture of relationships. The problem was no longer to identify one participant who secretly did everything. It was to distinguish the different kinds of causality, judgment, exposure and responsibility that met in the work.

An invitation arrived before the theory existed

On 18 August 2026, three days after I published Refreshing the Webpage as an Act of (Artistic) Composition, Prof. Dohna contacted me about her pilot project, METANOIA BEYOND EAST AND WEST—Contemplative Seeing of the (W)hole and AI—From the School of Athens to Magnifica Humanitas: Research–Work–Friendship. The chronology matters. We had collaborated before, and she knew other aspects of my work, but she had not seen this specific Background Studio when she decided to invite me.

Her message was unusually warm. She described the project as only beginning and wrote that she did not want to undertake it without me. That personal context mattered because I did not receive the invitation as a neutral request for expertise. Friendship, trust and previous collaboration were already part of the encounter before the new artwork entered it.

Her wording already exposed the difficulty of categorization. She wanted to invite me “come ARTISTA …” and then immediately added “a scientifico!” I had spent the preceding days wondering whether the project was web engineering, generative art, computational art, creative coding, visual autobiography or an inconvenient mixture of all of them. Apparently the invitation had encountered the same classification problem.

I sent her the article and explained that code, mathematics, movement and controlled randomness were materials of the work. I called it generative art, computational art and creative coding in quick succession because each name showed something and concealed something else. I asked her to refresh the page and open different articles. I explained that I choose the visual vocabulary and establish the rules, but do not completely predetermine each visible arrangement. At first I described the visitor as almost a co-creator. Then I corrected myself: under the current interface, the visitor is more precisely a performer who actualizes one possibility without fully authoring it.

I then described two possible developments in sequence. First, a visitor could save or download a composition that had affected them, turning a fleeting state into an encounter trace. Later, a visitor might contribute an image to the vocabulary itself, allowing someone else’s visual history to enter combinations that I could not have prepared alone. The second possibility was not yet implemented, but it made the distribution of creation harder to dismiss.

Then came the first message:

“Incredible.”

Twenty-five seconds later came the second:

“Allora il mio progetto non ha tanto senso?”

I felt I had to answer quickly because I thought almost the opposite. I also experienced the sequence as a small intellectual shock, but that is my interpretation of the exchange, not proof of what she privately intended. What is confirmed is the chronology and the wording. What followed is also confirmed: her question changed what I investigated next.

I reread her project before answering the larger question

My first impulse was simply to reassure her: no, the technological work did not make her project meaningless. Before making a stronger claim, however, I returned to the proposal. I wanted to know whether I was imposing my new vocabulary of “encounter” upon her project because it happened to fit my artwork.

Rereading changed my model. Encounter was already structural to her proposal even where the English noun did not appear in every paragraph. The course develops around Bildung, self-Bildung, metanoia, contemplative seeing, research, artistic work and friendship. It begins with Romano Guardini’s formulation that “the researcher serves the problem.” The researcher does not treat the problem as raw material for a predetermined result. The artist similarly becomes responsive to an emerging Gestalt. In friendship, the friend does not reduce the other person to usefulness but allows the other to “come into their own.”

The tree joins the proposed modules because research, friendship and artistic work can each involve meeting it free from immediate utility. Her text repeatedly resists a world made only of objects to classify, optimize and use. In that context, AI is not merely a new production tool. It intensifies a question already present in modern rationality: what happens to knowing, creating and becoming when information, deduction and formal production can be detached from the person who undergoes them?

Prof. Dohna’s published writing confirms that this concern predates our exchange. In “What we see looks back at us,” she connects Guardini’s phenomenology of the gaze with love, artistic creation, knowledge and encounter. The work of art and love each configure a space of knowledge in which things and people may reveal themselves in their deeper being (Dohna-Schlobitten, 2022). Her later study of Guardini’s Weltanschauung places seeing, artistic form and the whole into a relationship that resists reducing knowledge to detached possession (Dohna-Schlobitten, 2024).

A Guardini passage quoted by Pope Francis in his 2023 address to artists became newly important to me. The artwork “opens a space” into which a person can enter, move and encounter things and persons as they become open before them (Francis, 2023). I had already called the browser a small theatre. The philosophical scale is different, but the structural connection is striking. Perhaps one artistic act consists in creating a space where encounter can occur.

I therefore wrote back that my work did not make her project less meaningful. I thought it made the project more meaningful because it gave the question a concrete and difficult case. That answer was more honest than simply placing “human creativity” on one side and “machine reproduction” on the other, although I had not yet worked out why.

The reassuring answer became a stress test

My first reassurance was still too easy: the machine can arrange forms, but the human remains the real creator. The history I had just documented undermined that sentence. AI helped build the system. The runtime algorithms produced relations I did not manually compose. The browser performed the state. The visitor decided when another manifestation appeared. Future visitors might contribute the visual vocabulary. Where, exactly, should I draw a line around “the real creator” without making every other causal contribution disappear?

One AI formulation changed the direction of the discussion:

“Your project makes that problem visible rather than merely theoretical.”

I immediately recognized part of the sentence. Prof. Dohna’s proposal asks what happens to human knowing, creation, contemplation and transformation in an age of capable AI. My work places part of that problem in an operating system: AI participated in construction; mathematical procedures generate formal novelty; a visitor participates in actualization; interpretation can exceed what I explicitly encoded.

Then another formulation sharpened it:

“Your project does not eliminate her question. It makes it more acute.”

I accepted that too, but with a consequence. The artwork should not be presented merely as a friendly example proving her theory. It could also be a stress test. If the theory depended upon “humans create; machines only repeat,” the case would challenge it. If the deeper issue concerned encounter, sense, responsibility and transformation, then the challenge could strengthen the project by forcing its vocabulary to become more precise.

The weaker opposition was:

human creates meaningfully / machine reproduces mechanically

The operating artwork replaced it with harder questions:

What is creation when generation is distributed?

What is encounter when its conditions can be produced algorithmically?

What is meaning when artist, AI, algorithm, artwork and beholder do not individually contain the complete event?

What is metanoia if the decisive distinction cannot simply be identified with producing a novel form?

Her momentary question was therefore more productive than agreement would have been. “Beautiful” might have confirmed the work. “Does my project still make sense?” disturbed the framework. That disturbance became an input to the research.

I separated generation from encounter and then had to reconnect them

Another AI sentence initially seemed to solve the central problem:

“AI can participate in the generation of form without itself undergoing the meaning of that form.”

I found this powerful because it abandoned the increasingly indefensible claim that machines cannot contribute to creation. It distinguished several levels that I had been blending together:

generation of form
        ↓
emergence of meaningful relations
        ↓
experience of meaning

The runtime algorithm clearly participates in the first stage. It causally contributes to the second by creating adjacency, scale, rhythm and recurrence. A person may then experience the relation as comic, theological, autobiographical, tender or disturbing.

That seemed convincing until I noticed that the arrows were pointing only downward. The actual history contradicted the diagram. A generated result changed my interpretation; my interpretation changed the next request; the revised system changed future results. Prof. Dohna’s encounter changed my theoretical vocabulary. This article may change the implementation. Generation and encounter could not remain permanently separated stages.

The model became:

generation ⇄ encounter

production ⇄ reception ⇄ interpretation
          ⇄ transformation ⇄ renewed production

The distinction still mattered, but it was no longer a wall. It named different moments in a recursive process. A form can occasion an encounter, and the encounter can return upstream to alter the conditions of future form. This was the point when the project stopped looking like a pipeline and began looking like a processual ecology.

The question changed from who creates to where sense happens

One short question from the AI dialogue reorganized the problem:

“Where exactly is sense?”

I had already been using words such as meaning and Sinn, but the word “where” exposed an assumption. I was imagining sense as data stored somewhere. Perhaps the artwork contains it. Perhaps the artist deposits it. Perhaps the viewer manufactures it. Perhaps an AI represents it. Perhaps, in Prof. Dohna’s theological horizon, it comes from God. Which participant owns the canonical copy?

Then I began to suspect that storage was the wrong metaphor.

Russell’s image carries historical and cultural associations before it enters my system. A sacred image arrives with iconographic and theological histories. My chemical equation has autobiographical significance because of my own past. A visitor does not create those inheritances from nothing. I began calling them sedimented semantic possibilities.

The algorithm then establishes a concrete relation that did not exist as part of either isolated source: this Russell, at this scale, beside this sea lion, around this article, during this visit. The relation is real even though no caption fixes its interpretation.

Then someone encounters it. Perhaps philosophical seriousness seems to be interrupted by bodily exuberance. Perhaps the relation is affectionate. Perhaps it is absurd. Perhaps it recalls another memory. Perhaps nothing interesting happens. The encounter does not guarantee significance.

The revised model became:

semantic inheritance
        ↓
relational configuration
        ↓
encounter
        ↓
actualized significance
        ↓
memory / biography / culture
        ↓
future interpretation

This led to a proposition I still treat as interpretation rather than confirmed fact:

Sense may be neither arbitrarily manufactured by the subject nor stored as a finished property inside the object; it may become disclosed through encounter.

When that sentence first appeared, I wondered whether this was what Prof. Dohna wanted to prove. “Prove” was too strong. Her question had helped me see a structure, and the artwork gave me a concrete case through which to examine it, but neither an affecting experience nor a persuasive formulation settled the metaphysics. A WordPress page cannot prove Guardini merely by returning HTTP 200.

What the case does show is why two easy accounts are insufficient. The meaning was not completely encoded by me beforehand, yet the visitor did not freely invent the algorithmic juxtaposition afterward. The relation itself contributes something. That contribution is philosophically interesting even before one decides where its ultimate ground lies.

I also had to resist an overstatement here. The encounter does not create everything from nothing, and the thing does not arrive empty. Historical meanings, personal memories, algorithmic configuration, present attention and later recollection participate differently. “Meaning emerges relationally” is useful only if it does not erase those asymmetries.

I corrected the claim that the algorithm was culturally illiterate

My earlier art essay had called the algorithm “culturally illiterate.” For the runtime geometry, the phrase remains useful. A Voronoi function does not need Russell’s biography to assign his image to a polygon. But our discussion contained two very different computational systems: the narrow mathematical generator and the conversational AI that helped construct and interpret the project.

The AI could identify Russell, discuss Christian imagery, connect Guardini with art and encounter, recognize why the sea lion might make the relation comic, and formulate the philosophical problem more fluently than many casual viewers. Saying simply “the machine knows nothing” would erase observable semantic competence.

This correction generated the next question:

Does representing the meaning of an encounter amount to undergoing its meaning?

My first answer again wanted to be too clean: AI represents; humans experience. I then asked how I could establish that boundary without placing the conclusion inside the definition. AI systems can perform substantial semantic operations, maintain context, alter human understanding and revise plans. Future systems may preserve longer histories and more stable self-models.

The more defensible distinction became:

semantic competence ≠ lived significance

The inequality sign matters, and it is deliberately modest. An AI may explain perfectly why Russell beside the sea lion is funny. That does not by itself establish that the image has become significant to the AI within a biography—something it will miss later, regret misunderstanding, assume responsibility for, allow to change whom it loves, or organize a promise around. Successful representation is evidence of semantic competence. It is not, by itself, evidence that something matters to the system in that stronger sense.

I do not use this distinction to close the question forever. I use it to prevent two opposite simplifications: “AI understands nothing” and “fluent semantic performance proves lived significance.” The present evidence supports neither absolute conclusion.

The person can become implicated

When I asked what can happen to a person that is not captured by generation, representation or adaptation, the first answer was:

“The person can become implicated.”

I did not immediately understand why that word mattered, so I asked for another explanation. The crucial correction was that “change” alone is far too weak. Algorithms change state. Learning systems update. Agents revise plans. A theory in which humans change and machines do not collapses immediately.

Implication names another possibility: something can become at stake. I may encounter a work and discover that I was wrong. I may recognize myself, reinterpret my past, feel responsible, become grateful or ashamed, change how I treat another person, or make a promise. The encounter enters the history through which I understand who I am. It is no longer information only about an external object; it makes a claim upon how I judge or live.

This was where Prof. Dohna’s use of metanoia stopped looking like adjacent theological language and became central to the computational problem. I began distinguishing adaptation from metanoia provisionally:

Adaptation Metanoia as provisionally used here
A system changes behaviour or state in response to information. A subject’s orientation toward self, world, others, truth, value or action changes.
The objective may remain stable while the strategy improves. The encounter may alter what the participant understands the objective to be.
A failed output leads to a better output under an existing criterion. The criterion itself becomes one of the things questioned.

The distinction became concrete in the changing objective of my own project. I began with: “I want better visual backgrounds.” The objective then became: “I want a generative composition engine.” Later it became: “I want to construct conditions under which encounters can occur.” If a composition leaves too much empty space and I adjust a density parameter, the system adapts within an existing criterion. If the artwork leads me to realize that I have misdescribed the whole objective, the criterion itself changes. That new understanding may alter the title, visitor features, moderation model, archive design and the reason for continuing the work.

This looked much closer to metanoia. Then I challenged the distinction as well. Suppose a future agent maintains a persistent history, revises not only strategy but its hierarchy of goals, relates present action to previous commitments and reorganizes its future behaviour around what it identifies as significant. Would “adaptation” remain sufficient? Would something still be missing—vulnerability, responsibility, the possibility of loss, a first-person relation, something genuinely at stake?

I still do not know. The stronger question is:

Can there be metanoia without someone for whom the transformation is at stake?

Leaving it open is not a failure of the article. It is a correction to my earlier confidence.

The mechanism can produce surprise without being astonished

Another AI formulation became a hinge:

“The algorithm may make something unexpected, but it is not astonished by what it has made.”

My immediate response was “yes, but the person who encounters it can be astonished.” That objection produced a better sentence:

The encounter can contain astonishment even when the mechanism does not.

The generator does not need to intend a relation for the relation to become meaningful. It supplies conditions: adjacency, scale, recurrence, rarity, interruption, disappearance, return and rhythm. A person may actualize one possibility as significance. The system cannot force this to happen, and it should not claim credit for every interpretation.

I therefore began calling the Background Studio something more ambitious than a generative composition engine:

an engine for generating conditions of encounter

The phrase felt right because it preserved both power and limit. The engine can stage relations but cannot guarantee that they matter. This also gave the work a curatorial dimension. A curator does not manufacture every interpretation in an exhibition. Curation constructs a field—this work beside that work, this interval, this route, this return. My system performs a narrower procedural version of that activity and continuously restages the field.

Even this formulation later became incomplete. Once encounters return as feedback and change the system, the engine does more than generate conditions. It participates in a cycle through which conditions and participants transform one another.

Prof. Dohna’s response entered the artwork’s causal history

At one point I realized that I had been theorizing encounter while overlooking the most immediate encounter in the story. Prof. Dohna’s invitation arrived independently of this particular artwork. I showed her the work. She responded first with wonder and then with a question about the meaning of her own project. I encountered that question. It changed what I read, what I asked AI, which distinctions I challenged and what I began writing.

artwork
   ↓
Prof. Dohna’s encounter
   ↓
question / conceptual disturbance
   ↓
my encounter with her response
   ↓
AI-assisted reflection
   ↓
new interpretation
   ↓
new article
   ↓
new technical possibilities
   ↓
future artwork
   ↺

This is why her invitation and reaction belong to the artwork’s history. They are not JavaScript modules inside the plugin. They operate at another causal level. A manifestation affects a person; that person’s response affects the developer; the changed developer will make different artistic decisions.

One sentence from the AI dialogue gave me a strong emotional reaction:

“The artwork is partially shaping the process that continues creating the artwork.”

My response was immediate: this gives me goosebumps, because it is what is happening now. The emotion did not prove the proposition. It did direct my attention to a structure I had not yet named.

I made the system. The system produced forms. The forms motivated an art essay. The essay entered an encounter with Prof. Dohna. Her response generated a new inquiry. That inquiry suggested visitor contribution, preservation and feedback. If those ideas enter the code, the artwork will have participated causally in its own future development—not because software secretly intends its destiny, but because it changes the humans who can change it.

The artist creates the work, and the work participates in creating the future artist.

There is nothing supernatural in that claim. The observer of the artifact is also its developer; what the observer learns can become a design decision. Yet the ordinary mechanism should not make the artistic consequence disappear:

The artist can be surprised.
The artist can learn.
The work can disclose a possibility its maker had not yet formulated.

Guardini’s language of serving an emerging form became concrete at this point. Responsibility does not vanish, and receptivity is not an excuse for surrendering judgment. What weakens is the fantasy that authorship requires every significant possibility to exist fully inside the creator’s intention before execution. The artist can also become a beholder of the work, learn from it and allow that encounter to redirect the next act.

The writing process repeated the structure it was describing

The recursion became clearer when I noticed that the article itself was no longer external commentary. The first artistic essay changed how I explained the project. That explanation changed Prof. Dohna’s encounter. Her reaction changed the theory. The theory suggested features. Features will change future manifestations.

The theory has entered the causal loop of the artwork.

The drafts of this article then reproduced the same method. An early draft was factually rich but treated engineering as the main subject. I said that the centre of gravity was wrong. The next draft recentered the work on art, encounter, Sinn, metanoia and Prof. Dohna’s response. It was conceptually stronger, but it made the conclusions look as though they had arrived in orderly succession. I objected again: where were the repeated questions, the confusion, the provisional agreements and the corrections to both my own views and the AI’s?

A further revision restored the genealogy and strengthened the argument’s architecture. That was an improvement, but comparison with the earlier telling revealed that disciplined structure had also compressed some of the evidence, humour, personal immediacy and intermediate distinctions through which the argument had become possible. The present third version therefore performs another return. It does not revert to the earlier architecture or add every discarded sentence. It restores only those details that change the evidence, reveal a genuine stage of thought or allow the reader to feel why a distinction became necessary.

Each objection changed the objective of revision. The goal moved from “make the article complete,” to “preserve the genealogy of understanding,” and then to “let a sound architecture carry the full evidential and human richness of that genealogy.” The revision method itself thus supplied another example of human agency. My agency did not consist merely in approving generated paragraphs. It appeared in noticing that a polished result had erased something methodologically essential, rejecting its implicit model of knowledge, and redefining what the article had to preserve.

This is why the history of thinking is not decorative metadata attached to the final research. In this case it is part of the research. Without it, the article would state that creation is recursive while presenting its own conclusions as linear and predetermined. Its form would contradict its argument.

The human–AI dialogue became another form of encounter

Was AI merely a tool for expressing thoughts I already possessed? That description also became insufficient. Several decisive phrases were neither dictated by me nor merely returned as editorial polish. They appeared through interaction: “Where exactly is sense?”, “The person can become implicated”, and “The artwork is partially shaping the process that continues creating the artwork.” Each phrase opened a path I had not yet formulated in those terms.

But the collaboration did not work because I accepted fluent language as truth. It worked because generation and resistance were both present. AI proposed an articulation; I experienced recognition, doubt or disagreement; I supplied a technical fact, personal history, counterexample or distinction; the explanation changed; that revised explanation changed my next question. My contribution was not the residue left after automation. It included deciding which anomaly deserved attention, which analogy was false, what evidence counted and when the question itself had changed.

The intellectual pattern was:

partial intuition
      ↓
AI formulation
      ↓
my recognition or objection
      ↓
qualification / counterexample / evidence
      ↓
revised formulation
      ↓
new connection
      ↓
new question
      ↺

The interaction accumulated a history. A later answer became possible only because earlier formulations had been challenged and the context had changed. AI could reason differently because I introduced the distinction between the runtime geometry and the conversational model; I could reason differently because AI gave language to implication and recursive feedback. Neither contribution can be understood by isolating one final paragraph from the sequence that produced it.

I do not claim that this dialogue was phenomenologically identical to an encounter between two human persons. I do claim that it was operationally recursive and intellectually productive. It generated formulations, resistance, revision and new attention. That limited claim is sufficient to make the dialogue part of the method rather than an invisible instrument behind the prose.

Encounter turned a pipeline into feedback

Once outputs began returning upstream, engineering and cybernetics supplied a useful vocabulary. In control engineering, feedback occurs when information about an output returns to influence subsequent behaviour. My development process already had that structure:

intention
   ↓
AI-assisted implementation
   ↓
output
   ↓
observation and evidence
   ↓
changed intention
   └──────────↺

The artistic process added another loop:

generative system
   ↓
manifestation
   ↓
encounter
   ↓
interpretation
   ↓
changed artist
   ↓
changed system
   └────────────↺

Prof. Dohna’s response added a social loop:

work / result
      ↓
another person encounters it
      ↓
response / objection / surprise
      ↓
I encounter that response
      ↓
changed interpretation and action
      ↓
future work
      ↺

The human–AI writing process added an epistemic loop. At different moments I was artist, developer and beholder. Prof. Dohna was observer, interlocutor and participant. AI was technical collaborator, conceptual mediator and generator of formulations. None of us occupied only one stable position.

At that point, second-order cybernetics became relevant. Heinz von Foerster’s work directs attention toward observing systems and what changes when the observer cannot be treated as external to the system of inquiry (von Foerster, 2003). I do not claim that a WordPress artwork resolves second-order cybernetics. The narrower structural connection is enough: I design the system, observe it, am changed by what I observe, write about the change, and return that writing to the system’s development.

Still, I needed one more technical distinction. The current visitor experience is interactive, but it is not yet a complete adaptive learning loop. A visitor can refresh and thereby cause another state to appear. Their private reaction does not automatically change later weights, rules or eligibility. The present fact is:

visitor action → another manifestation

The proposed future system would add:

composition
   ↓
encounter
   ↓
explicit response or contribution
   ↓
system memory
   ↓
modified future conditions
   ↓
new composition
   ↺

That distinction matters because a theoretical possibility should not be narrated as an implemented result. Today, the artwork supports runtime variability and visitor activation. Saving reconstructable states, accepting visitor material and adapting future generation remain proposed experiments.

Visitor contribution could turn private memory into system history

The first future extension is comparatively conservative: allow a visitor to preserve a composition that affects them. A useful saved state would contain more than a screenshot. It could record the algorithm, seed, selected record identities, relevant configuration and enough viewport information to reconstruct the manifestation. The visitor’s act of recognition would then become materially visible as a trace of one encounter.

The second extension changes the category of the work: allow visitors to contribute visual records. At present, the thirteen-record vocabulary is largely autobiographical. Once another person can introduce an image, the engine no longer recombines only my cultural and personal archive. It can place someone else’s visual memory beside my childhood chemical equation. A third person may encounter the relation and preserve it. I may later encounter that saved state and discover a significance neither the contributor nor I anticipated.

my archive
     +
visitor archive
     ↓
generative system
     ↓
unexpected relation
     ↓
another visitor
     ↓
interpretation
     ↓
preserved encounter
     ↓
my later encounter
     ↓
new work
     ↺

The artwork would now contain intersecting biographies. Olga Goriunova’s account of participatory platforms is useful because digital artistic activity can emerge through infrastructures and collective processes rather than remain contained in a closed artifact (Goriunova, 2016). Katja Kwastek similarly treats action, system and aesthetic experience as integral to interactive digital art rather than as optional additions to a completed object (Kwastek, 2013).

Participation, however, is not automatically artistic progress. Visitor material would require provenance, moderation, controlled file handling, permissions, deletion procedures and a visible distinction between the autobiographical core and contributed records. A public upload field can turn participatory art into malware curation with impressive speed if one becomes too spiritually receptive to arbitrary MIME types.

If visitor response changes future generation, the loop becomes computational

At present, interpretation changes me and may therefore change later development. The proposed adaptive system would make another path explicit: a visitor response could alter the probability space from which later compositions emerge. Meaning would then have a computational consequence—not because the software had understood the encounter in a human sense, but because a trace of the encounter had become one of the system’s future conditions.

If implemented, the work might be described provisionally as a co-adaptive participatory generative system. The phrase should remain conditional. “Participatory” would not mean that every visitor becomes an equal author; “adaptive” would not mean that the system undergoes metanoia; and “co-adaptive” would not erase the asymmetry between a person whose orientation can be at stake and a mechanism whose parameters change.

The design questions are therefore part of the artwork rather than merely administrative details. Should memory belong to an individual visitor, to a temporary group or to the whole public system? When a contributed record enters a later composition, does it carry the contributor’s explanation with it, or can its meaning be transformed by another encounter? If the contributor requests removal, should later saved states disappear, retain a historical trace or become unreconstructable records of something that once existed?

A separate risk concerns probability. I am reluctant to make popular saved states automatically more likely to recur. If every heart icon increases a record’s weight, the work may converge upon the safest and most familiar combinations. After months of building an ecology of encounter, I could accidentally rediscover the recommender system. A non-adaptive baseline, transparent experiments and reversible weighting would preserve the possibility that the most important encounter is the one no popularity metric would select.

Encounter is richer than feedback because a response can introduce a new category, not merely a new value. visitor_liked = true can alter a weight. A visitor’s explanation—“this combination changed how I thought about exile”—can change what the artist believes the system is for. When feedback alters the criterion rather than only a parameter, the process approaches the metanoia problem again.

Agency became distributed, layered and unequal

By this stage, the phrase “human agency migrates” was useful but incomplete. Agency migrates, distributes and layers itself across the project. The layers have different powers, histories and responsibilities:

Participant or layer Present contribution Limit or unresolved issue
Artist–developer Purpose, curation, constraints, evaluation, publication, responsibility and revision of the objective. Does not manually determine every manifestation or foresee every interpretation.
Development AI Code generation, architectural proposals, diagnosis, conceptual formulation and reorganization. Semantic contribution does not by itself establish lived significance or equivalent responsibility.
Runtime generator Procedural selection and geometry within configured rules. Does not possess the cultural biographies attached to the records.
Browser Material execution, layout, crop, animation, timing and viewport-dependent performance. Performance is causal without becoming curatorial responsibility.
Visitor Arrival, refresh, attention, interpretation, memory and possible preservation. Present control is participatory but limited; contribution remains prospective.
Encounter A relation in which significance and transformation may arise. Cannot be guaranteed, owned completely or reduced to one participant.

The table is not a final ontology. It protects two distinctions that the more elegant prose can blur. First, causal participation does not make every participant an author in the same sense. Second, distributed agency does not dissolve responsibility. A browser executing CSS is not ethically equivalent to the person who publishes a record. An AI proposing code is not automatically responsible in the same way as the person who deploys it. A visitor refreshing a page does not become the sole creator.

The better question is not “Who possesses all agency?” It is what kind of agency operates at each layer, how the layers change one another, and where responsibility remains when no participant controls the whole result. Research on generative AI and art already shows why conventional authorship becomes unstable when creative work is automated or redistributed (Epstein et al., 2023). This project makes that instability visible across development, runtime generation, performance, interpretation and future revision rather than only at the moment of image synthesis.

The artwork increasingly resembles a processual ecology

By this stage no single pipeline could represent the project. Technical production, artistic experience, social response, conceptual interpretation and future modification were feeding one another at different speeds:

writing / theory ⇄ artist–developer ⇄ development AI
                         ↓
                 generative system
                         ↓
                  manifested form
                         ↓
                      beholder
                         ↓
                     encounter
                         ↓
          interpretation / transformation
                         ↓
                    future work
                         ↺

I use processual ecology to name this interdependence, not to suggest that every element is alive or equivalent. The ecology includes code, records, browser behaviour, people, memories, institutional relationships, theory and maintenance. Its participants have unequal capacities and responsibilities, but an event at one layer can reorganize conditions at another. The artwork is less a single object moving down a production line than a maintained field in which forms, encounters and decisions recur.

Creation began moving from object-making toward world-building

The distinction between an AI-generated artifact and AI-assisted generative infrastructure now returned at a deeper level. A prompt-to-image workflow usually places the main generative event before the ordinary viewer arrives. The viewer encounters an artifact. In my project, AI helped construct an environment whose future manifestations were not all present during development. Visitors arrive later and instantiate forms. Future visitors may add source material. Their responses may eventually alter later conditions.

The artistic question therefore moved from:

What should I make?

toward:

What conditions should I construct and tend so that forms, relations and encounters I cannot completely foresee can continue becoming possible?

This is closer to world-building than object-making. In language nearer to Prof. Dohna’s project, it moves from producing one finished Gestalt toward creating a space in which figuration continues. The artist still chooses, limits and takes responsibility. Yet the work is no longer exhausted by one completed surface.

At the beginning I thought the central unit was the background image. Then it became the generated composition. Later I focused on juxtaposition. Now I suspect the more important unit may be the encounter and its capacity to return as a condition of further creation. That shift was not planned in advance. It emerged because each proposed unit proved too narrow for the evidence.

Prof. Dohna and I became participants in what we were theorizing

There is something almost suspiciously elegant about the chronology. Prof. Dohna did not invite me because she already knew this artwork. I did not build it as an illustration of her new course. Two independently developing projects met.

Her project gave me concepts—metanoia, contemplative seeing, serving, Gestalt, Sinn and encounter. My artwork gave her a working case that disturbed an easy distinction between human creation and machine production. Her response disturbed my interpretation. The human–AI dialogue produced further formulations. My objections changed those formulations. This article may now return to her and change the discussion again.

Neither project contains the other. Her theory does not explain the artwork completely from above. My software does not refute her project from below. Something emerged between them.

That emergent insight was not fully stored inside either project beforehand. It became available when they met, when she responded, when I encountered that response and when the dialogue changed what each of us could ask next. The history itself became evidence for the relational account of meaning.

Why her question may have been more valuable than agreement

This is also why I am increasingly grateful for her question rather than wishing she had offered only agreement. If the threatened claim was “machines cannot create,” the technological evidence makes it vulnerable. If the deeper question concerns what can matter, transform, obligate and reorient a participant, then the artwork does not abolish it. It makes the question more demanding.

Agreement would have allowed my first explanation to remain comfortable. Her doubt exposed its weakest possible form: the reassuring opposition in which the human creates and the machine merely reproduces. Because that answer failed under the actual architecture of the work, I had to distinguish generation from encounter, then reconnect them; distinguish semantic competence from lived significance; and ask whether adaptation can ever become metanoia. The objection did not destroy the project. It forced both the artwork and the theory to become less easy.

What remains unresolved

I do not know where sense ultimately “resides,” or whether residence is the right metaphor. The proposal that sense is disclosed relationally remains an interpretation, not a result demonstrated by software. Prof. Dohna’s Guardinian framework retains a theological horizon that this computational case can neither prove nor disprove. The artwork shows that relations can become meaningful without one participant explicitly precomposing their full interpretation. It does not establish the ultimate ground of that meaning.

I also do not know whether a sufficiently persistent, self-modifying AI could satisfy criteria associated with lived significance or metanoia. Present semantic competence is real. Claims about subjective significance require different evidence. Future systems may make the distinction harder; that is a reason to refine the question, not to declare an answer by definition.

Visitor preservation, contribution and adaptive weighting are not current achievements. They are design possibilities generated by the inquiry. Their implementation may enrich the work, produce moderation problems, flatten surprise or reveal entirely different questions. The article should not grant future software the evidential status of deployed behaviour.

Nor is every composition meaningful. Sometimes a sea lion appears beside a rectangle because JavaScript assigned two records to neighbouring regions. Sometimes the layout is weak. Sometimes the visitor is busy. Sometimes nothing happens. If every refresh reliably produced metanoia, I would check whether a theology plugin had been installed with unusually aggressive caching.

The openness of the artwork includes triviality, boredom, failure and nonsense. The engine can create conditions of encounter; it cannot command revelation.

What I want to test next

The next stage should test the theory through practice while keeping present facts separate from plans. First, I want to implement preservation of reconstructable compositions. This would make an encounter traceable without pretending that a screenshot alone contains the entire event.

Second, I want to experiment with a moderated visitor vocabulary. Contributed records should remain distinguishable from the autobiographical core, preserve provenance and support removal. The purpose is not to maximize uploads. It is to see whether relations among different personal histories change the aesthetic and interpretive field.

Third, only after observing those interactions would I test explicit adaptive feedback. I would begin with reversible experiments and retain a non-adaptive baseline. Before increasing the probability of a saved state, I want to know whether preservation signifies aesthetic value, personal memory, curiosity, humour or simply the convenience of the button.

Finally, I want to preserve the intellectual history around the code. If theory, conversation and response are causal inputs to later versions, a source repository records only part of the work. The technical articles, the first art essay, Prof. Dohna’s messages, the human–AI dialogue, the rejected explanations and the revised objectives form a developmental archive. The genealogy of thought is not separate from the artwork’s evolution.

When the artwork answered back

I began with a practical background feature. It became a structured selector, then a mosaic and scattered composition system, then a family of mathematical generators, then a maintainable plugin. Real outputs changed the specification. The foreground and background became one visual environment. Refresh became a performative gesture. Repetition produced histories of encounter. AI-assisted development complicated authorship. Agentic AI destabilized my first defence of human agency.

Then Prof. Dohna invited me as an artist before knowing this specific work. Her reaction made me reread her project. The rereading shifted the question from generation to encounter. AI proposed formulations that I accepted, resisted and revised. “Where exactly is sense?” changed the model of meaning. “The person can become implicated” led to metanoia. “The artwork is partially shaping the process that continues creating the artwork” made the recursion visible. An early draft preserved evidence but chose the wrong centre. A later draft found the centre but compressed the genealogy. A further revision restored that genealogy but still lost some of the earlier account’s concrete richness. Comparing the versions changed the method once more: stronger reasoning and richer detail had to become mutually supporting rather than competing editorial goals.

The movement has therefore been closer to this:

creation
   ↓
unexpected form
   ↓
encounter
   ↓
question
   ↓
provisional explanation
   ↓
objection / evidence / correction
   ↓
re-interpretation
   ↓
transformation of the objective
   ↓
new creation
   ↺

The added middle matters. Encounter does not mechanically yield understanding. It may create confusion. An elegant answer may prove insufficient. Evidence may force a distinction. A counterexample may reopen it. The work becomes intellectually generative because the process does not stop at the first phrase that sounds complete.

I initially thought I had made an engine for generative composition.

Then I thought I had made an engine for generating conditions of encounter.

Now even that description seems incomplete, because encounters have begun returning into the system that generated them. They alter the artist, the theory, the dialogue, the proposed participation model and potentially the future algorithms. The artwork is becoming a place where generation and encounter feed one another: forms create occasions for response, and responses return as conditions for later forms.

I am grateful to Prof. Dohna for inspiring this stage precisely because she did not hand me a conclusion. Her project encountered mine, mine encountered hers, and the disturbance between them created questions neither one fully contained beforehand.

The question I now carry is:

Where does meaning happen when a human creates conditions, AI helps construct them, algorithms generate relations, a person encounters those relations, the encounter changes what matters to the person, and that transformation becomes part of the conditions from which the next creation emerges?

I still do not know.

But three days earlier, when I published the first art essay, I did not even know that this was the question! When the first complete draft was finished, I did not yet know that preserving how the question emerged was part of the answer. When the structurally stronger revision was finished, I had not yet seen how much concrete life it had left behind. That continuing change in understanding is not closure.

Perhaps that change is itself the first piece of evidence that the artwork has already answered back.

References

  1. Boden, M. A., & Edmonds, E. A. (2009). What is generative art? Digital Creativity, 20(1–2), 21–46. https://doi.org/10.1080/14626260902867915
  2. Dohna Schlobitten, Y. (2022, June 4). What we see looks back at us. L’Osservatore Romano. https://www.osservatoreromano.va/en/news/2022-06/dcm-006/what-we-see-looks-back-at-us.html
  3. Dohna-Schlobitten, Y. (2024). Romano Guardini und der Ursprung seiner katholischen Weltanschauung—Ein Blick auf das Ganze des Kunstwerks und der Welt. zur debatte, 1/2024; lecture presented 15 June 2023. Katholische Akademie in Bayern. https://kath-akademie-bayern.de/mediathek-eintrag/romano-guardini-und-der-ursprung-seiner-katholischen-weltanschauung-ein-blick-auf-das-ganze-des-kunstwerks-und-der-welt/
  4. Eco, U. (1989). The Open Work (A. Cancogni, Trans.; D. Robey, Introduction). Harvard University Press.
  5. Epstein, Z., Hertzmann, A., Akten, M., Farid, H., Fjeld, J., Frank, M. R., Groh, M., Herman, L., Leach, N., Mahari, R., Pentland, A., Russakovsky, O., Schroeder, H., & Smith, A. (2023). Art and the science of generative AI. Science, 380(6650), 1110–1111. https://doi.org/10.1126/science.adh4451
  6. Francis. (2023, June 23). Address to artists for the 50th anniversary of the inauguration of the Vatican Museums’ Collection of Modern Art. The Holy See. https://www.vatican.va/content/francesco/en/speeches/2023/june/documents/20230623-artisti.html
  7. Galanter, P. (2016). Generative art theory. In C. Paul (Ed.), A Companion to Digital Art (pp. 146–180). Wiley-Blackwell. https://doi.org/10.1002/9781118475249.ch5
  8. Goriunova, O. (2016). Participatory platforms and the emergence of art. In C. Paul (Ed.), A Companion to Digital Art (pp. 297–309). Wiley-Blackwell. https://doi.org/10.1002/9781118475249.ch12
  9. Kwastek, K. (2013). Aesthetics of Interaction in Digital Art. MIT Press. https://doi.org/10.7551/mitpress/9592.001.0001
  10. Lopopolo, R. (2026, February 11). Harness engineering: Leveraging Codex in an agent-first world. OpenAI. https://openai.com/index/harness-engineering/
  11. Manovich, L. (2001). The Language of New Media. MIT Press. https://mitpress.mit.edu/9780262632553/the-language-of-new-media/
  12. Rajasekaran, P. (2026, March 24). Harness design for long-running application development. Anthropic. https://www.anthropic.com/engineering/harness-design-long-running-apps
  13. von Foerster, H. (2003). Understanding Understanding: Essays on Cybernetics and Cognition. Springer. https://doi.org/10.1007/b97451

奇迹与 Loïc 被赋予的道德代价:论《冬天的故事》(1992)里的希望、信仰和确信(及其区别)

我原本以为,埃里克·侯麦(Éric Rohmer)的《冬天的故事》Conte d’hiver, 1992)最终会让我思考爱情中的忠贞、偶然性,也许再加上一点神学。然而实际发生的却完全不是这样:我发现自己不断地在与菲莉茜(Félicie)争论,一会儿替她辩护,一会儿又批评她;重新回到剧本以后,我又不得不修正自己先前的一些批评;我开始追问,她所谓的“信”究竟是不是真正意义上的信仰;而到最后,比起夏尔(Charles)那场近乎奇迹般的归来,我反而对洛伊克(Loïc)产生了更大的兴趣。这部电影在我的理解中变得越来越丰富,恰恰不是因为我逐渐找到了一套能够解释一切的答案,而是因为我最初提出的一个又一个解释,在重新面对时间顺序、对白、人物行动和后果时相继失效,而每一次失效都迫使我看见此前没有注意到的东西。

因此,我不想把这篇文章写成仿佛自己只看了一遍电影,就立即获得了某种完整而成熟的解释。事实并非如此。我的阅读是在一次次把自己的判断重新放回影片的时间顺序、精确对白、人物行动以及这些行动造成的后果之中检验以后逐渐形成的。起初,我以为菲莉茜这五年来只是在单纯地等待;剧本迫使我撤回这个判断。最初,我觉得她与马克桑斯(Maxence)之间的一段谈话几乎就是直截了当的虚伪;后来,我发现“受到动机驱动的自我欺骗”也许是一个更加精确的范畴。最开始,整部电影最重要的神学问题似乎是:菲莉茜的这种确信究竟是否有资格被称作“信仰”?然而到最后,另一个问题至少变得同样重要:如果一个人的希望最终得到了实现,那么,那些在这个希望漫长存在的过程中不断替它承担代价的人,又会怎样?

这也正是为什么,洛伊克最终成为了整部电影中最触动我的人物。夏尔是那个失而复得的爱人;菲莉茜是那个几乎令人难以置信的希望最终被叙事证明为“正确”的相信者;而洛伊克则是那个始终留在那里的人——他帮助她、倾听她、承受痛苦、为她祈祷,然后,当奇迹终于到来以后,他几乎就从故事里消失了。电影告诉我们:那个失去的人终于被找回来了。可是我却越来越无法停止追问:是的,但现在,又是谁被留在了画框之外?

我把这部电影当成一个必须经得起自身证据检验的论证

侯麦的电影特别适合这样的阅读,因为在他的作品里,对话从来不只是传递情节信息。他的人物会推理,会为自己辩解,会自相矛盾,会修正自己,也经常围绕那些自己其实只理解了一部分的情感构造出极其复杂的解释。Imogen Sara Smith 曾指出,侯麦电影始终深深关注合理化、自我欺骗以及“主体性的神秘”,同时也不断展示人物在理解自己和理解他人方面所面临的困难 (Smith, 2024)。这个描述几乎完美地适用于《冬天的故事》,因为菲莉茜、洛伊克和马克桑斯并不是先拥有一个透明、完整的内在世界,然后再用语言把它报告给我们;恰恰相反,他们经常是在说话、辩解、反驳甚至自我矛盾的过程中,才逐渐暴露出自己究竟相信什么、希望什么,以及自己其实并没有完全理解什么。

 

因此,到后来,我实际上采用了一套近似于“调试”的方法。拿一部侯麦的爱情片来做 debugging,听起来也许稍微有点荒谬,不过说实话,这些人物自己花在调试自身情感状态上的时间已经够多了,所以我觉得这个比喻也不能完全算我的责任。每提出一个解释,我都会尽量继续追问:具体是哪一句对白或哪一个视觉细节支持它?事件真正发生的时间顺序是什么?是否还存在另一种同样能够解释证据的竞争性解释?这个信念究竟产生了什么行动?这些行动又把什么后果施加到了其他人身上?如果进一步把这个解释放进哲学或者神学范畴中,它是否仍然站得住脚?而到了最后,还有哪些东西其实并没有得到证明?

主张
→ 精确的对白或视觉证据
→ 时间顺序
→ 竞争性的解释
→ 这一信念所产生的行动
→ 对其他人的后果
→ 哲学或神学检验
→ 仍然无法得到证明的部分

时间顺序在这里尤其重要。大教堂中的经历发生在观看莎士比亚戏剧之前;菲莉茜试图向马克桑斯作出承诺,又发生在大教堂之前;她真正采取实际行动寻找夏尔,则是在多年以前;至于帕斯卡和柏拉图,则更晚才作为一种概念语言进入故事,而且主要是由洛伊克提供给她的。如果我把所有这些事件压扁成一句“菲莉茜一直相信夏尔会回来,最后她的信心得到了奖赏”,那么这部电影几乎所有真正重要的思想机制都会消失。与此同时,这种方法也迫使我区分不同类型的证据:对白可以告诉我们人物说了什么,但不能自动告诉我们他说的就是真的;行为可以证实语言,也可能反过来否定语言;视觉调度又可能使两者变得更加复杂;后来发生的结果能够告诉我们最终发生了什么,却并不必然证明一个更早的信念在当时具有合理的认识论依据;外部哲学和神学可以帮助我们理解电影所调用的范畴,却不应该被用来覆盖影片本身实际上展示出来的东西。

这一点尤其重要,因为一些非常有影响力的影片介绍早已使用了“faith”这个词。Criterion Collection 将菲莉茜描述为怀有一种“不灭的信”,相信奇迹终将使她与夏尔重逢;法国电影资料馆则谈到她对于爱情的确信,以及她在爱情上的“下注”如何逐渐转化为某种信仰 (Criterion Collection, n.d.) (Jamet, 2019)。这些描述当然都很有启发性,但在我看来,真正有意思的问题恰恰从这里才开始:当我们把“faith”这个词放到菲莉茜身上时,我们究竟是在谈论一种什么样的信?是一种强烈的心理确信?一种关于未来的希望?一种宗教性的信任?还是严格意义上的神学信德?这些东西可以彼此接近,却并不是同一个概念。

第一道裂缝,出现在一个动词里

在所有明确的神学讨论出现以前,有一场戏已经改变了我对菲莉茜的态度。她和马克桑斯在一起,试图说服自己夏尔已经属于过去,于是她说:

« Je ne veux plus penser qu’à toi, je ne veux aimer que toi. »
“我不想再想着别人了,我只想想着你;我只想爱你。”

马克桑斯几乎立即听出了问题:

« Tu “veux” m’aimer ? »
“你‘想要’爱我?”

菲莉茜回答说,她确实爱他,只是希望自己能够更加爱他 (Rohmer, 1992)。这里的语法非常值得注意,因为她并不是简单地陈述一种已经存在的情感,而是在描述一种朝向情感的意志行为:她想要自己只想着马克桑斯,她想要自己只爱马克桑斯。随后,剧本又让她身体上投入他的怀里,于是她的身体正在表演一种亲密,而她刚刚说出的句子却已经为这种亲密加上了限定。我的第一反应相当严厉:这难道不就是虚伪吗?她明明知道夏尔仍然占据着自己内心最中心的位置,却又告诉马克桑斯,她只想想着他、只想爱他。

然而,在反复思考这场戏以后,我不再那么确定。“受到动机驱动的自我欺骗”(motivated self-deception)也许更加准确。她未必是在冷静地欺骗马克桑斯,同时在心里非常清楚事情正好相反;她似乎是真的希望关于自己未来的某个命题变成事实,并且在说话的那个瞬间,已经部分地从那个她希望实现的未来之中开始说话。换句话说,她并不完全是在报告“我现在是什么”,而是在试图把“我希望自己成为怎样的人”说成一个正在发生的事实。这种解释比把她指控为有计划的欺骗更加宽容,却不会因此让问题在道德上变得无害,因为自我欺骗造成的伤害完全可能与有意识的欺骗一样真实;当另一个人被要求依据你的话来安排自己的感情、未来和生活时,某一时刻的主观真诚并不能构成完整的道德辩护。

而这场戏之所以尤其重要,还因为马克桑斯自己已经发现了这种差异,所以我的解释并不需要从外部把一套心理学理论强加给人物。侯麦直接把异议放进马克桑斯嘴里:你不是简单地说“我爱你”,你说的是“我想要爱你”?这个极其微小的语法区别后来几乎成为了整部电影的一个原型,因为我越来越发现,理解菲莉茜必须不断区分四件并不相同的事情:

  • 菲莉茜希望什么是真的;
  • 菲莉茜实际上真正感受到什么;
  • 菲莉茜相信自己知道什么;
  • 以及,在她的意识之外,什么事实上是真的。

影片到了结尾,确实让这些范畴中的某些部分突然发生了汇合:她希望夏尔回来,而夏尔真的回来了;她一直把这段关系视为绝对的,而夏尔也没有忘记她。然而,我真正关心的问题是:结局中的这种汇合,是否有权反过来抹去这些范畴在此前五年里真实存在过的差异?如果一个后来发生的事件使一个早先的信念变成了事实,我们是否因此就应该假装,这个信念从一开始就拥有了它后来才得到的证据?

我最初指责菲莉茜只是被动等待,而剧本证明我错了

这是我在整个阅读过程中最有意义的一次修正。起初,我之所以对菲莉茜的希望感到恼火,是因为我想:如果夏尔真的重要到足以让她把五年人生都围绕着他可能归来的可能性来安排,那么她为什么不真正去找他?然而这个批评太简单了,因为剧本明确告诉我们,她确实找过。最初的灾难发生,是因为她告诉夏尔自己住在 Courbevoie 的 36 rue Victor-Hugo,而她真正想说的其实是 Levallois;她并没有马上发现这个错误,而是在几个月以后办理与生育相关的手续时,才突然意识到自己究竟做错了什么。弄明白以后,她去了 Courbevoie 的邮局,询问信件可能发生了什么,查找 poste restante(留局候领邮件),发现 Courbevoie 居然也有一条 rue Victor-Hugo,然后继续调查对应的地址。后来遇到洛伊克以后,她还明确说过,洛伊克曾经帮助她给许多机构写信寻找夏尔 (Rohmer, 1992)

随后还有一个几乎荒谬的信息限制:她甚至不知道夏尔的姓氏。夏尔当时只是非正式地在他们相遇的那家餐厅工作,所有人都叫他 Charles;他的姓——似乎可能是丹麦语,也可能是荷兰语——根本没有真正留在她的记忆中。在不知道姓氏、地理信息出现错误、又不存在稳定机构记录的情况下跨越大陆寻找一个人,与“什么都不做,只是坐在那里等待”完全不是一回事。因此,我不得不撤回那个更强烈的判断,即菲莉茜只是“什么都不做”,因为影片本身提供的证据并不支持这种说法。然而撤回这一批评并没有真正终结问题,只是把问题转移到了另一个层面:当那些真正有意义的搜索机制基本上都已经耗尽以后,她的希望究竟还在发挥什么作用?

答案似乎是,她开始保存另一种意义上的可能性。她已经无法通过现实行动显著提高“找到夏尔”的概率,但是她仍然能够避免作出那些一旦夏尔重新出现,就会使自己难以接受他的不可逆承诺。用决策理论的语言来说,这有一点像是在保存一个 option:最初的问题是尽量提高找到夏尔的概率,而后来,问题则变成了保持这样一种条件概率——如果夏尔有一天真的重新出现,那么自己仍然处在能够自由接受他的状态之中。

早期问题:
最大化 P(找到夏尔)

后期问题:
保持 P(如果夏尔回来,我仍然有自由接受他 | 夏尔归来)

这个区别帮助我重新理解了她在大教堂之后作出的决定。菲莉茜走出教堂时并没有得到一套新的搜索算法,她得到的是一种新的承诺策略(commitment policy)。回到马克桑斯身边以后,她说自己已经决定,从今以后不会再以永久性的方式把自己绑定在其他男人身上,只会保持某种暂时性;她实际上是在努力确保,任何新的关系都不会关闭未来那个“夏尔重新回来”的分支。这比我最初所谓的“单纯被动等待”要连贯得多,也让我对她更加公平,但它同时立刻导向另一个问题,而这个问题后来几乎贯穿了整篇文章:为了保存这个选项,真正支付成本的究竟是谁?

大教堂给了她清晰,但它真的给了她知识吗?

大教堂这一幕后来成为整部电影中对我最重要的部分之一,部分原因就在于它太容易被迅速解释成一次宗教皈依,但菲莉茜自己实际上拒绝了这种描述。她被马克桑斯弄得很难受,带着埃莉丝(Élise)离开,经过 Nevers 的大教堂,于是走进去坐下,而孩子则去看圣诞马槽。后来洛伊克问她是不是在那里祈祷,她马上纠正他:那并不是通常意义上的祈祷,更接近一种反思、默想或者极端集中的内在经验。她描述了一种许多人或许都曾以较弱程度经历过的状态:缺乏睡眠、承受决策压力,再加上一种精神上的兴奋,有时候会让思想运行得异常迅速;但这一次,那种状态比平时强烈“一千倍”,于是突然之间,一切都变得无比清晰 (Rohmer, 1992)

接下来是那句我不断回到的话:

« J’ai pas pensé : j’ai vu, j’ai vu ma pensée. »
“我不是在想;我是看见了,我看见了自己的思想。”

她说,她“看见”了自己必须做什么,也“看见”了自己并没有错。我觉得这种经验在现象学意义上非常迷人,但如果把现象学和认识论混为一谈,我也觉得它会变得非常危险,因为这里至少涉及三个彼此不同的命题:第一,菲莉茜确实经历了一种异常强烈的主观清晰感;第二,她在这种状态中所得出的结论与外部现实相符合;第三,这种经历应当被解释为神学意义上的信德或者神圣启示。第一个命题得到了影片非常强的支持,没有任何理由认为她是在伪造这次经历;第二个命题却并不会因此自动成立,因为“我看见了自己的思想”是一份关于意识状态异常生动的报告,却没有向她提供任何关于夏尔现在在哪里、是否已经结婚、身体是否健康、是否还爱她、现在想要什么以及未来将去哪里的外部数据;至于第三个命题,就更加复杂了,因为菲莉茜甚至明确告诉洛伊克,她当时根本没有在想上帝。

洛伊克后来把这个经验以某种宗教语言浪漫化,说如果自己是上帝,一定会格外珍惜她,因为她为了一个缺席的爱人牺牲了现实中的幸福。菲莉茜回答说,如果上帝真的爱她,那么上帝就应该把夏尔还给她,但她马上又补充说,自己当时其实根本没有向上帝要求任何东西;在大教堂那个瞬间,她感到自己“独自一人在世界上,独自一人在宇宙之中”,而她真正得到的结论是:这件事情只能由她自己来决定,她必须自己采取行动 (Rohmer, 1992)。因此,我后来越来越愿意把这一幕称为发生在宗教空间中的存在性照明(existential illumination)。这个说法能够保留那次经历的严肃性和深度,却不会假装影片已经向我们证明了某种超自然因果机制。

更重要的是,那次洞见里面确实可能包含某种真实的东西。菲莉茜意识到,她不应该仅仅因为害怕不确定性,就把自己永久绑定在一个自己并没有“爱到疯狂”的人身上,因此她所得“启示”中最强、最可靠的内容,也许其实不是一个关于未来的肯定命题,而是一个关于当下的否定命题:

我不应该仅仅因为害怕再也不会有更好的未来,就对一个我事实上并不想要的人生作出不可逆的承诺。

这个命题比“夏尔一定会回来”强得多,因为前者讨论的是她对自己当下承诺状态的真实性,而关于这一点,她拥有大量第一手证据;后者讨论的却是一个缺席男人未来是否会归来,而关于这一点,她几乎没有任何证据。正是在这里,我开始认为大教堂并不一定向她提供了关于未来的“知识”,却很可能向她提供了关于自己此刻不能诚实地作出什么承诺的清晰认识。

主观确信与外部真理不是一回事

这个区别后来成为我整个阅读中认识论上的中心。菲莉茜反复把一种内在经验的强度,仿佛当成了外部世界中不确定性被降低的证据;她所使用的语言本身就是视觉性的:她不只是,而是看见;她不只是作出了选择,而是看见自己没有错。如果借用计算机科学的语言,我会把 confidence 和 calibration 区分开来:一个模型完全可以输出 0.99 的置信度,但仍然是错的;当然,人类发现过度自信远早于机器学习,神经网络只不过把我们这个古老传统中的一部分自动化了。

同样的问题也存在于道德经验和宗教经验之中。天主教关于良心的教导,从来不是说内在确信越强,它就越自动等于真理。《天主教教理》把良心定义为理性对于一个具体行为之道德性质所作的判断,同时明确承认良心可能作出错误判断,并要求人在解释自己的经验时运用明智、可靠的建议以及严肃的分辨 (Catholic Church, 1992, §§1777–1788)。这并不会让大教堂那一幕变得“不那么宗教”,反而会使它在神学上更加有趣,因为严肃的神学并不需要否认内在经验,它真正要追问的是:这种经验究竟能够支持哪一种主张?

因此,我越来越想把问题表述为:

确信的强度,是关于经验这一确信的主体的证据;它并不会自动按照同等比例,成为关于被相信命题本身真实性的证据。

一个人说“我从来没有如此确信过”,至少能够非常有力地告诉我们他正在经历什么,却不能单凭这一点证明世界本身已经按照他的确信发生了变化。正是在这里,当有人仅仅因为编剧后来真的让夏尔出现,就试图把菲莉茜此前的确信“册封”为正确时,我开始产生强烈的抵抗,因为一个后来变成真的命题,并不会因此自动使早先对这个命题的置信度获得合理的认识论校准。

莎士比亚让她认出了自己早已携带的结构

时间顺序在这里再次重要起来,因为莎士比亚并没有创造菲莉茜在大教堂中的经历;是在那之后,洛伊克才带她去看《冬天的故事》The Winter’s Tale)。在莎士比亚最后一场戏中,被认为已经死去十六年的赫米奥妮(Hermione)以一尊雕像的形式出现,珀迪塔(Perdita)跪在她面前,保琳娜(Paulina)则开始让所有人准备面对某种不可思议的事情,提醒他们不要把即将发生的东西解释成邪恶魔法,并最终告诉他们必须“唤醒”自己的信;音乐响起,赫米奥妮开始移动,从台座上走下来 (Shakespeare, n.d./2016, 5.3)

菲莉茜完全被这一幕震撼了。她紧紧抓住洛伊克的手,后来还说,当“雕像”真正开始移动的时候,她几乎忍不住叫出声来。洛伊克的反应却非常有意思,因为他仍然对文本中的歧义保持兴趣:这真的是一个死去的人被超自然地重新赋予生命,还是赫米奥妮其实从来没有真正死去?菲莉茜回答:

« Je n’aime pas ce qui est vraisemblable. »
“我不喜欢那些合乎常理的东西。”

随后,她坚持认为这一幕根本没有什么歧义:它的意思很清楚,是信使赫米奥妮重新活了过来 (Rohmer, 1992)。我最初并不像菲莉茜那样被舞台上的这个“奇迹”所打动,因为作为观众,我当然知道所谓的“雕像”其实只是一个演员静止在那里,然后开始移动;不过后来我意识到,这个反驳其实太字面化了,因为菲莉茜回应的根本不是舞台特效技术,她回应的是一种叙事结构:一个人失去了,多年过去,这种失去似乎已经不可逆转,然后,不可能的归来发生了。这个结构几乎完美地映射到了夏尔身上。

因此,莎士比亚在这里扮演的是一种révélateur——一种显影剂、一种揭示器。它为菲莉茜原本就已经携带在自己生命中的那个模式,提供了一个审美图像。关于侯麦的研究同样常常把莎士比亚视为影片结构上的中心,因为整个故事确实是在从冬天、丧失与表面上的死亡逐渐走向复归与恢复 (Smith, 2024)。然而在戏后的争论中,我仍然远比菲莉茜更接近洛伊克,因为他说这里存在歧义,而她说没有任何歧义;在我看来,这个差异在认识论上非常重要。菲莉茜似乎认为,她的解释在宗教上更加高级,恰恰因为她比洛伊克拥有更少的犹豫,但我并不相信宗教上的自信和神学上的成熟是同一回事。有时候,更成熟、甚至更加神学性的回应,恰恰是能够说:

“我确实被它深深触动,但我仍然不知道究竟发生了什么。”

她的反智主义既迷人,也危险

菲莉茜与洛伊克之间的张力,有一部分来自社会与知识气质上的差异。洛伊克读书,他几乎本能地会去寻找帕斯卡、柏拉图、莎士比亚以及各种哲学解释;菲莉茜却把这种行为体验成一种中介层,好像洛伊克永远无法直接面对生命,而必须先通过书本来验证它。有一次她带着一种非常好笑的恼怒对他说,如果她告诉他“我爱你”,他大概也会立刻去翻莎士比亚,看看这句话是不是已经在那里被写过了;在她看来,对洛伊克而言,似乎只有那些已经被写下来的东西才是真的 (Rohmer, 1992)

这个批评之所以好笑,是因为它里面确实包含了一部分真实:洛伊克当然可能把生命过度知识化,书本也完全可能成为他挡在经验和脆弱之间的一层防御。然而菲莉茜所提供的替代方案,也同样可能变成一种教条。“我直接感受,所以我更接近真实”并不天然比“我已经认真反思过,所以我这样判断”更加可靠;反智主义式的真实性,只不过是把权威从文本转移到了情感。菲莉茜对自己的描述中最强的一句话,是她说在大教堂里自己感到“完全是自己”,就像五年前与夏尔在一起的时候,她也感到“完全是自己”。这个陈述在心理学上当然极其重要,因为它告诉我们,哪些经验最深地被整合进了她的身份认同之中;然而身份认同并不等于无误性,“这件事情最像真正的我”本身不能推出“因此,我对于世界的解释就是正确的”。

这个区别远远超出了侯麦的电影。我们这个时代有一种非常强的诱惑,就是把“真实性”当成一种道德认证:如果某个行动表达了我最深处的自己,那么任何对这个行动的质疑,都仿佛变成了对我存在本身的攻击。我觉得侯麦其实比这种简单的现代真实性话语要微妙得多。菲莉茜的真实性非常强大,而且我也并不想否定它;但影片同时提供了足够多的证据,让我们继续追问:这种真实性一旦进入关系世界,会对其他人造成什么?

帕斯卡出现的时候,菲莉茜其实早已下注

这部电影最有趣的地方之一,是菲莉茜经常先拥有一种经验,后来才得到一个哲学名称,而洛伊克几乎就是那个不断替她提供概念标签的人。柏拉图?安装完成。帕斯卡?安装完成。莎士比亚?已经上线生产环境。菲莉茜自己承认,重新找到夏尔的概率极低;她知道他可能已经结婚,也知道他可能已经不再爱她,但她同时说,如果真的能够重新找到他,那种幸福将会巨大到她愿意为了这个可能性付出自己的一生。然后她说:

« Vivre avec l’espoir, je pense que c’est une vie qui en vaut bien d’autres. »
“带着希望活着,我觉得这样的人生并不比其他任何人生更不值得。”

洛伊克几乎立刻认出了其中的帕斯卡结构 (Rohmer, 1992)。侯麦本人一再回到帕斯卡的赌注,而研究者也常常把菲莉茜的位置描述成一种被移植到爱情生活中的帕斯卡式赌注。OpenEdition 上的一项研究作出了一个尤其有用的区分:菲莉茜的相信已经不再是直接意义上的基督宗教信仰——她自己明确说过,在大教堂里她根本没有想到上帝——但是,它仍然保存着一种帕斯卡式的风险结构,即面对巨大不确定性,为一个可能得到的极大善而下注 (Amiel, 2013)

这帮助我澄清了一点:严格来说,菲莉茜的赌注并不是帕斯卡的神学赌注。夏尔在结构上占据了那个“无限收益”的位置,但是夏尔终究仍然只是一个有限的人。这种替换在哲学上非常迷人,却在神学上极不稳定,因为一旦一个有限的人被放进原本属于终极善的位置,他就会开始承担一种任何爱人都不应该被要求承担的形而上重量。

她的希望在一种意义上是理性的,在另一种意义上却严重失准

我并不认为菲莉茜的立场应该被简单地 dismiss 为非理性。一旦她已经认识到,自己事实上并不真正想和马克桑斯建立永久生活,那么拒绝永久承诺完全可能是理性的;仅仅因为某个自己真正渴望的未来概率很低,就选择一个安全但并不真实的关系,也完全可能制造另一种更加深刻的不诚实。因此,对于她最有力、也最宽容的解释也许是:

我宁愿接受不确定性,也不愿作出一个我明知道在情感上并不真实的永久承诺。

我认为这是一个非常严肃、甚至值得尊重的立场。然而它还有另一个更弱、更危险的版本:

因为我的希望在主观上如此绝对,所以它的实现本身似乎就拥有某种特殊的概率、命运或者必然性。

到了这里,我就变得怀疑得多。影片之所以有意思,正是因为菲莉茜不断在这两个位置之间移动,却并不总是清楚地区分它们:有时候,她是在捍卫自己不对一段并不真正想要的关系作出永久承诺的自由;但在另一些时刻,她的语言又仿佛暗示,自己的直觉给予了她某种关于未来的特殊知识。这是两个完全不同的论证,而我完全可以接受第一个,同时拒绝第二个。

忠贞并不简单等于一夫一妻式的排他关系

我还必须解决另一个问题:菲莉茜一边与其他男人发生性关系、也承认自己以某种方式爱他们,一边又把自己描述为对夏尔忠贞,那么这种“忠贞”究竟有没有意义?答案显然取决于我们究竟如何定义 fidelity。如果忠贞意味着性和关系上的排他性,那么答案当然是否定的,她的实际生活完全不符合这种定义;然而电影构造出了另一种忠贞,即最终的情感指向(ultimate affective orientation)。洛伊克和马克桑斯在她的生命中都占有真实位置,她对他们也并非完全没有爱情,但没有任何一个人占据夏尔所在的位置,她欲望最深层的忠诚从来没有真正转移。

这样一来,我们也就能够理解,为什么菲莉茜可以真诚地说自己爱马克桑斯,同时又认为夏尔与任何其他人不可比较。她使用“爱”这个词的时候,未必每一次都在同一个层次上使用它。我不需要认可她所建立的这种等级结构,也可以承认它具有某种内在一致性。真正的道德问题于是从“她是不是一夫一妻意义上的忠贞”转移到了另一个问题:所有参与其中的人,是否都真正理解自己究竟处在怎样一种关系之中?

自由与责任恰恰在这里相遇。非排他的关系完全可能是伦理的,只要相关的期待、边界以及感情结构得到真正共享;侯麦电影里的困难在于,这种情感架构并不对称。夏尔拥有一种洛伊克和马克桑斯几乎不可能竞争的绝对地位,但与此同时,这两个男人又在不同时间被邀请进入一种可能让他们感到关系比菲莉茜最终愿意承认的更加确定、更加深刻的亲密。问题并不只是她有没有自由,而是她是否充分让其他人知道,这份自由究竟意味着什么。

夏尔相比洛伊克和马克桑斯拥有一个巨大优势——他不在场

我越思考夏尔,菲莉茜所谓的“绝对之爱”在我眼中就越不再简单。夏尔消失了五年,而“不在场”其实是一种极其有效的避免让别人失望的方法。洛伊克和马克桑斯必须作为现实中的人存在:他们有习惯、有脾气、有嫉妒、有知识上的怪癖、有职业、有需要,也有身体;他们可能在早餐时说错话,可能发脾气,可能在某个极其普通的星期二下午 4:17 完全无法符合一个人的理想。夏尔却不会,因为在影片的大部分时间里,他并不是作为一个现实中的男人存在,而是作为记忆存在。

侯麦在视觉上也强化了这种差异。开场的爱情属于夏天:身体亲密、阳光、海边、快乐,一种几乎被高度浓缩得过于完美的田园牧歌;五年以后,主体故事却发生在灰暗的冬季街道、火车、郊区住宅、客厅和美发店之间。Criterion 特别指出了开场夏日田园与潮湿十二月之间的对照,法国电影资料馆也把冬天的灰暗视为整部影片情绪结构中的核心 (Smith, 2024) (Jamet, 2019)。于是菲莉茜实际上是在拿现实中不完美、会不断产生摩擦的男人,与一个被保存于夏日记忆中的缺席爱人进行比较。

这当然并不意味着夏尔是虚构的。他真实存在过,那段爱真实存在过,而埃莉丝本身就是那段爱情最具体、最具身体性的结果。然而,那个支配菲莉茜五年希望的“夏尔”,已经部分成为了一个被记忆保护起来、不再经受日常时间侵蚀的对象。这使我不得不追问:她所谓的绝对忠贞,究竟有多少是对夏尔这个具体人的忠贞,又有多少其实是对一个被理想化的、已经失去的可能性的忠贞?

结局非常方便地把这个问题消除了,因为回来的夏尔几乎恰好就是与她记忆中版本高度兼容的夏尔:他没有忘记她;他仍然是可获得的;和他一起旅行的女人不是他的妻子;他没有带着另一个孩子和一整套复杂的家庭系统突然闯进来;他接受埃莉丝;而且他仍然爱菲莉茜。侯麦完全可以让夏尔作为一个已经结婚、已经不再爱她或者已经发生根本变化的人回来,但他没有这样做。童话最终把现实调整成了这样一个版本:那个被记忆保存了五年的理想,在真正重新接触现在时,并没有破裂。

我对菲莉茜自由的欣赏,其实比我的批评最初看起来更多

我对菲莉茜的批评不应该被误解成一种保守主义式的、针对她性自主的道德反对。事实上,这部电影有一个我非常喜欢的方面,就是其中的关系拥有相当大的自由度。洛伊克在菲莉茜选择马克桑斯时确实受到伤害,他变得冷淡、退缩,并希望分离能够干净利落地完成;他并不是一个没有情绪的圣人。马克桑斯在菲莉茜离开他的时候也会发怒,甚至一度用手抓住她;菲莉茜立刻要求他放手,明确说他弄疼了自己,并告诉他如果还不放手她就会打他。他松开以后,她解释说自己从身体上就无法忍受被人用强力控制 (Rohmer, 1992)

这一幕非常重要,因为我们不能把她身边的男人理想化成无限耐心的道德家具。马克桑斯确实可能变得控制性很强,洛伊克也确实承受嫉妒和痛苦,因此菲莉茜对于自身自由的坚持是在回应真实存在的压力,而不是回应她凭空想象出来的压迫。我同样认为,她在大教堂里获得的洞见包含一种真正有伦理价值的东西:她并不欠马克桑斯一个永久承诺,仅仅因为他能够提供一个看上去合理而稳定的人生;安全感不能制造 eros,适合结婚也不能凭行政决策创造一种她实际上并不存在的绝对之爱。

我真正开始批评她的地方在另一个层面:

自由不会取消关系责任。

完全捍卫菲莉茜自由选择的权利,与继续追问她是否充分认识到了那些不断适应她自由的人所承担的成本,两者之间没有任何矛盾。她可以拥有离开的权利,可以拒绝虚假的永久承诺,可以拒绝被任何男人以“我对你好”为理由占有;然而这些权利并不会自动使围绕她的所有关系后果在道德上变得无关紧要。

是谁在补贴她的真实性?

这是后来从根本上改变我道德阅读的问题:

是谁在补贴她的真实性?

菲莉茜的自由极其可见:她可以在巴黎和 Nevers 之间移动,可以拒绝马克桑斯,可以重新靠近洛伊克,可以继续把夏尔保存为自己最深层的生命地平线,可以接受情感支持,又始终保持向一个极低概率的未来开放。然而自由从来不是在真空中被行使的,其他人会吸收它所产生的后果。Criterion 的 Imogen Sara Smith 在这里作出了相当严厉的判断,认为菲莉茜对两个男人都相当糟糕:刚刚搬去和马克桑斯一起生活不久就离开他,在拒绝洛伊克以后又不断依靠洛伊克,最后甚至要求洛伊克替她祈祷,让夏尔回来 (Smith, 2024)

我会对这个判断作一些修正,因为影片其实给予了菲莉茜比“她对他们很糟糕”更加复杂的道德意识。她知道自己正在伤害马克桑斯;她明确因为让他陷入尴尬位置而感到羞愧;面对洛伊克时,她有时也会努力说服他,自己的离开或许能够使他获得自由,去寻找一个能够用不同方式真正爱他的女人。她并不是完全看不见他人。然而她的道德重心仍然非常强烈地以第一人称组织起来,她反复使用的词汇基本都是:我感觉什么、我看见了什么、我不能接受什么、我爱谁、我无法足够爱谁、我必须保持哪一种未来仍然可能。相比之下,她很少持续地追问另一个问题:

为了让我继续如此真实地活着,其他人究竟必须替我承担什么?

这个区别对我变得越来越重要,因为“真实性”在现代道德语言中几乎获得了某种神圣地位。“我必须做我自己”听起来像一个能够自我认证的命题,但一个人的真实性完全可能依赖另一个人的情绪劳动、宽恕、随叫随到或者耐心。一个局部规则可以完全合理,而整个系统的全局状态却可能变得病态:菲莉茜保存自由,洛伊克继续可获得,马克桑斯努力适应;每一个局部行动都能够得到解释,但所有这些行动叠加起来形成的总体成本,却非常容易消失在视野之外。看来分布式系统和法国爱情电影拥有的共同架构,比我原来想象的更多。

洛伊克并不是无限可获得的,而影片也明确展示了他的痛苦

在我自己对洛伊克的欣赏中,有一点也需要纠正,那就是不能把他变成一个纯粹无私、没有自我需要的圣人。他不是。当菲莉茜最初选择马克桑斯的时候,洛伊克显然非常受伤;他希望他们的分离尽快完成,因为拖延只会使自己继续维持幻想。菲莉茜告诉他,自己会非常想念作为朋友的他,甚至试图说服他,也许正因为自己离开,他才终于能够找到“他生命中的那个女人”。洛伊克回答说,他相信菲莉茜这样说是真心的,甚至解释说,他之所以爱她,其中一部分原因就在于他觉得自己能够读懂她的心 (Rohmer, 1992)

接下来有一个非常小却非常精彩的交流:菲莉茜承认自己有时候会撒谎;洛伊克则大意回答说,在真正重要的事情上,她不会撒谎。她其实不希望他把自己理想化,但他似乎无法完全停止这样做。因此,洛伊克也有属于自己的解释性脆弱,他相信菲莉茜是透明的,相信自己能够直接看穿她的内心,而这种相信本身也可能已经被爱情理想化了。这一点非常重要,因为伦理分析不能把所有复杂性都分配给菲莉茜,然后把她周围的人想象成完美校准的观察者。洛伊克爱,因此洛伊克也解释;而爱情有时候会用比证据本身所允许的更加慷慨的方式去解释另一个人。

祈祷那一幕成为了整部电影对我而言的道德中心

真正最打动我的那一幕却异常安静。洛伊克和菲莉茜来到一座教堂附近,她告诉他,既然他是天主教徒,那么就应该进去参与弥撒;洛伊克说,如果自己一个人的话也许会进去,但他不愿意把自己的宗教实践强加给她。菲莉茜却坚持认为,他不应该为了她牺牲自己的信念,然后她说,既然他知道怎样祈祷,那么就应该替她祈祷。洛伊克最初回答说,他改天会祈祷,但菲莉茜不接受:

« Aujourd’hui. Et tu prieras pour moi. »
“今天。而且你要为我祈祷。”

洛伊克回答:

« Je prie toujours pour toi. »
“我一直都在为你祈祷。”

然而菲莉茜进一步提出要求:这一次,她希望洛伊克代替她祈祷,向上帝请求如果她自己会祈祷的话所会请求的东西,即使洛伊克本人并不赞同那个愿望。随后她自己也承认:

« Tu vois je suis très exigeante. »
“你看,我的要求真的很高。”

洛伊克最后说,从某种意义上讲,这其实已经是他一直在做的事情:他一直在为她的幸福祈祷,即使那个幸福并不必然包含他自己 (Rohmer, 1992)。正是在这一刻,我不再主要思考“菲莉茜的信仰多么美”,而开始思考“洛伊克的爱究竟付出了什么代价”。

她到底在要求什么?如果把它翻译成最直接的情感现实,大概就是:

请你爱我爱到足以真诚地为那个男人的归来祈祷——即使他的归来会彻底消灭你剩余的、与我在一起的可能性。

这是一个极其巨大的要求。菲莉茜知道这一点,所以她说“Je suis très exigeante”;洛伊克也知道这一点,他明确告诉她,她要求得很多。因此,这一幕最美的地方,在我看来主要不是菲莉茜提出了什么愿望,而是洛伊克回应这个愿望时所承担的代价。菲莉茜的请求本身,在伦理上远比洛伊克的回应更加暧昧。

非凡的爱并不会产生要求浪漫回报的权利

到了这里,一个非常危险的论证很容易出现:既然洛伊克爱得如此好,那么菲莉茜就应该爱他。我并不认为这个结论成立。爱情不是分配正义,浪漫欲望或者性欲不可能被当成对于一个人道德表现的奖赏;一个人的善并不会自动产生对另一个人身体、性或者最深感情的请求权。如果洛伊克付出了十个单位的自我牺牲,并不意味着菲莉茜因此欠他十个单位的 eros,否则爱情就会以最错误的方式变成一种交易。

然而另一个极端同样不能令人满意:因为照顾并不会产生对浪漫爱情的所有权,就因此认为照顾在道德上完全不产生任何要求,也同样是错误的。关系中仍然可能存在承认、感激、诚实、比例感以及负责任边界方面的义务。因此真正的问题与其说是:

“既然我这样爱你,你会不会用爱情奖励我?”

不如说是:

“你真的看见我了吗?包括你持续依赖我的爱,对我究竟意味着什么?”

这个区别后来对我变得决定性,因为它既避免了把洛伊克的善良兑换成对于菲莉茜的所有权,又避免了走向另一个同样冷酷的极端——好像只要菲莉茜不欠他性爱或者婚姻,她就什么也不欠。

Eros、Agape,以及为什么洛伊克也必须被允许接受爱

本笃十六世的通谕《天主是爱》(Deus caritas est)意外地成为理解洛伊克最有帮助的神学文本之一。这篇通谕拒绝把 erosagape 简单对立起来:eros 在逐渐寻求被爱者真正的善时得到净化,而 agape 则防止爱堕落成纯粹占有;然而本笃十六世还提出了一个在这里尤其关键的观点,即人无法只靠不断向下、自我给予的爱而活,给予者也必须能够接受作为礼物而来的爱 (Benedict XVI, 2005, §7)

这也正是为什么,我抵抗一种把洛伊克基督教化成“永远应该继续牺牲”的解释。如果我们说:

“因为基督徒的爱应该无私,所以洛伊克应该接受菲莉茜所需要的任何情感角色,而且什么都不应该期待。”

那么我们实际上已经把爱德转化成了自我抹除。对我而言,一个更加健康的表述应该是:

没有正义的 agape 可能变成剥削。
没有互惠的 eros 可能变成痛苦。
没有分辨的自我牺牲可能变成自我抹除。

洛伊克也被允许有所需要。他完全有权说,自己无法永久充当恋人、后备选择、哲学导师、最可信任的知己以及情感避难所,同时又必须接受菲莉茜最深的忠贞永远在另一个地方。基督徒的爱并不要求一个人把自己变成永久可供消耗的资源。洛伊克有时候简直像是在运营一个二十四小时在线、没有维护窗口的情感支持服务,但即使再优秀的基础设施,也终究需要停机维护。

洛伊克也许应该划出的边界

因此,我对洛伊克的欣赏在思考过程中发生了变化。一开始,我所欣赏的只是“他留下来了”;后来,我越来越希望看到一种更加成熟的“留下”。他完全可以诚实地说:

“我希望你幸福。我也不想控制你。但是,如果我必须持续提供伴侣式的亲密,却同时接受你最深的承诺永远在别处,那么我无法无限期地继续留在这个位置上。”

这不会违背爱,反而可能保护爱,使它不至于被扭曲。于是,我后来更喜欢一个比单纯赞美他的自我牺牲更加完整的表述:

洛伊克的慷慨,但不以洛伊克自身的消失为代价。

对我而言,这比把无尽的情感殉道理想化更加人性,也更加符合基督宗教对于爱的理解。

奇迹发生以后,洛伊克在哪里?

夏尔回来以后,这个问题开始让我无法停止思考:

洛伊克现在在哪里?

菲莉茜在公交车上看见夏尔,下了车,夏尔跟着她下来;他知道了埃莉丝的存在;他没有忘记菲莉茜;和他一起旅行的女人并不是他的妻子;五年前那个几乎荒谬的地址错误,在短短几分钟之内突然被修复。整个家庭开始庆祝,但是洛伊克在哪里?他现在是不是独自在家?他已经知道了吗?菲莉茜会不会马上告诉他?他的新年前夜是不是一个人度过?将来会不会终于有人以他曾经希望菲莉茜爱他的方式来爱他?

影片没有回答,而我越来越觉得,我们不应该通过替侯麦编造一个甜蜜的续集来消除这种不适,比如告诉自己“上帝一定为洛伊克准备了一个更适合他的人”。也许他后来确实遇到了另一个人,也许很长一段时间都没有。电影没有向我们保证浪漫关系中存在一种分配意义上的宇宙正义。洛伊克没有得到菲莉茜,并不是因为他没有通过什么道德考试;他只是恰好不是菲莉茜绝对地爱着的那个人。这也正是道德运气最痛苦的一种形式。

一个人的奇迹,并不能解决所有其他人的故事

到了这里,我的神学阅读开始超越“菲莉茜的信是不是得到了奖赏”这个问题。我开始追问:

什么样的复归神学,会在主角终于得到自己想要的东西时就宣布一切已经完成?

莎士比亚自己的《冬天的故事》其实已经提醒我们不能如此简单地理解 restoration。赫米奥妮回来了,珀迪塔也重新得到了母亲,但失去的十六年并没有因此停止存在;莱昂特斯(Leontes)的悔改没有把时间倒转回去;玛米利乌斯(Mamillius)也没有复活。复归可以改变失去的意义,却不会把失去造成的每一个后果都删除 (Shakespeare, n.d./2016)

由此,我得出了整篇文章里对我而言最重要的结论之一:

复活不能意味着:只要一个人得到了复归,所有其他人的失去就都自动消失。

失去的人回来了,这当然很好;但接下来还必须继续问:谁仍然受伤?这个问题迫使神学离开“赢家”的视角。一个奇迹如果只从得到奇迹的那个人内部被理解,就很容易把那些承担了奇迹前史的人重新推到叙事之外。

埃莉丝的眼泪使这个幸福结局变得更加复杂

埃莉丝让这个结局变得更加奇怪。菲莉茜在夏尔怀里哭,并坚持说这些是喜悦的泪水;埃莉丝走进来,看着自己的父母,然后离开他们,走到另一个房间,坐在那里抱着自己的玩具发呆,一滴眼泪从脸上流下来。外祖母问她,终于找回爸爸是不是很高兴,并告诉她不要哭。埃莉丝回答:

« Je pleure de joie. »
“我是高兴得哭了。”

Criterion 把这个重复理解成一种帕斯卡式的 grace note,把孩子的这句话与宗教经验的语言联系起来 (Smith, 2024)。这当然完全可能是侯麦有意设计的一部分,但我更愿意保留这个场景在心理上的歧义,因为我们实际上并不知道埃莉丝此刻的内在状态是不是一种单纯的喜悦。它可以是喜悦,也完全可能同时包含困惑;它可能包含某种位移感,因为她从出生以来所熟悉的整个家庭结构在几分钟内突然改变;甚至也可能是一种她自己还无法命名的情绪,于是她只是重复了刚刚听见成年人使用的那个表达。

剧本给我们的只是一滴眼泪和一句话,并没有给予我们直接进入这个孩子内在世界的权限。这一点与整部电影更大的认识论问题形成了一个非常奇妙的平行:给一种经验命名,并不会自动决定那种经验究竟是什么。菲莉茜把某个东西称为 faith;埃莉丝把某个东西称为 joy;这些词当然重要,但词本身并不能消除解释。

侯麦控制公交车门,而现实并不受我们控制

最终的公交车重逢,是我与电影在认识论上分歧最清楚的地方。菲莉茜登上一辆公交车;夏尔恰好也在那里;两人相互认出;她下车;夏尔又足够迅速地反应过来,及时跟着她下车;车门开启与关闭的时间、两个人移动的位置、认出对方所需要的几秒钟以及随后作出决定的速度,都恰好允许这场重逢发生。侯麦可以做到这一点,因为侯麦拥有影片宇宙的 root access;现实通常并不会给我们 administrator privileges。

于是,我开始不断回到一个原则:

叙事上的验证,并不等于认识论上的正当化。

一个命题完全可能最后变成真的,即使最初支持这个命题的证据非常薄弱。假设某个人依据不足的证据预测了一个极不可能发生的事件,而这个事件最后偏偏真的发生了;成功的结果并不会自动证明,他最初所拥有的置信度因此就是合理的。

结果 = 真

并不意味着

先验置信度 = 校准良好

侯麦选择讲述的是那个“夏尔真的回来了”的菲莉茜。可是我们完全可以想象一百万个拥有类似希望的人:他们都在极度有限的证据上维持着一个已经失去的爱情可能性,其中一个人最终真的在公交车上碰到了那个失去的爱人,而一部只拍这个人的电影,就会使她此前的策略显得近乎具有预言性;另外 999,999 个没有发生奇迹的人则从数据集中消失了。这是一个选择问题。它并不会破坏这个罕见个案本身的美,却阻止我们把一个异常个案直接转化成一般认识论。

电影自己知道,它讲的是一个童话

公平地说,侯麦并没有假装这个结局是一种普通的统计预期。莎士比亚式的框架从一开始就告诉我们,我们已经进入了“故事”的逻辑,而法国电影资料馆也明确谈到莎士比亚式的魔法最终如何进入这个灰暗的冬季世界 (Jamet, 2019)。OpenEdition 上的另一项研究则强调,《冬天的故事》非常独特地把冬季本身转化成一种象征状态,它朝向一个失去的夏天的“复活” (Herpe, 2013)

影片绝大部分时间其实都极端日常:公共交通、美发店、郊区住宅、家庭聚餐、尴尬的谈话、照顾孩子、争吵、书本,以及 Nevers。然后,某一个偶然事件突然带着几乎整部童话的重量闯进来。也正因为此前有如此大量的平凡现实为它提供背景,当那个极不可能的事件终于发生时,整个世界仍然没有完全滑入幻想,因此它才会在审美上如此有效。

所以,我完全可以同时说两句话,而且在我看来二者没有任何矛盾:

这个结局很美。

以及:

这个结局并不能证明菲莉茜此前的确信在认识论上得到了合理的正当化。

作者的天意,与神学意义上的天意并不是同一回事

这进一步迫使我区分“providence”可能拥有的几个不同层次。在电影内部存在一种作者性的天意(authorial providence):侯麦真的控制整个事件序列,他选择那一辆公交车,选择夏尔出现,选择路线、时间、人物此刻的情感可获得性以及车门什么时候关闭。然后还有神学意义上的天意(theological providence),它讨论的是现实如何在天主的照管下得到解释;除此以外,还有普通意义上的偶然性(contingency),即事件通过次级原因、人的选择、物理机制以及统计偶合而发生。

这些范畴不能被简单压成同一个东西。一个人完全可以怀着感恩接受一个极不可能的事件,并在自己的信仰中把它解释成天意,而不需要声称自己已经科学证明了上帝直接修改了一张公交车时刻表。我反而认为,这是一种在知识上更健康的宗教解释:天意在现象上并不一定必须看起来不同于偶然;把一个事件理解为天意,可以是关于意义的诠释性判断,而不是关于超自然机制已经得到实验性证明的判断。公交车门在这部电影里已经做了够多的工作,我们没有必要再要求它顺便解决整个神圣行动论。

菲莉茜的希望与基督宗教意义上的望德并不相同

在这里,神学术语的精确性变得尤其重要,因为影片不断把宗教范畴移植到 erotic life 之中。《天主教教理》把神学意义上的望德定义在天国、永生、基督的许诺以及天主恩宠的关系中,同时又指出,望德会吸收普通的人类希望,并对它们进行净化,把这些有限的希望导向更大的善,并使它们摆脱自我中心 (Catholic Church, 1992, §§1817–1819)

因此,我们必须进行一个非常重要的区分:“我希望夏尔回来”当然是真实而强烈的人类希望,但仅仅这一点并不会自动使它成为神学意义上的望德。夏尔是一个有限的人,他无法成为最终救赎的对象,否则我们就会要求一个爱人承担一种他根本无法承担的形而上重量。这个区别并不会贬低浪漫爱情,反而可能保护它,因为我完全可以极其深刻地爱一个人,而不要求这个人的持续存在成为整个现实仍然有意义的保证;我可以渴望重逢,却不必宣布这种重逢在形而上学上是必然的;我可以为一个人的缺席而哀伤,却不必把那个缺席的爱人变成自己的私人末世论。

为什么莫尔特曼让我对“被动的希望”更加警惕

于尔根·莫尔特曼(Jürgen Moltmann)的《希望神学》为我在观看电影时一个非常强烈的直觉提供了语言。莫尔特曼著名地把基督宗教描述为从头到尾都是末世论性的,也就是说,它不断朝向未来、朝向尚未来临的东西,因此真正的基督徒希望并不只是让人心理上忍受现在,而会改变人与现在世界的关系。他的整个计划明确涉及如何在世界中“以思想与行动”负责任地实践希望 (Moltmann, 1967/1993)

这一点非常重要,因为希望很容易退化成一种单纯的心理坚持:“我继续相信自己想要的事情总有一天会发生。”莫尔特曼意义上的希望要求更多,它会改变一个人与现在的关系,会让人对那些被当成最终状态的现实保持不安,并把行动打开到一个被应许的未来 (Moltmann, 1967/1993)。由此,我得到一个非常实际的问题:

这个希望究竟使你去做什么?

我最初用这个问题批评菲莉茜的时候其实过于激进,因为当时我忽略了她早年真正采取过的寻找行动;一旦把这些证据重新放回影片,我的判断就必须更加公平:当现实中仍然存在有意义的搜索行动时,她确实行动过。然而后来,随着主动寻找几乎变得不可能,这个问题仍然有价值,因为她的希望逐渐缩小成一种管理承诺的方式。它并不是“什么都不做”,但其实践形式变窄了;于是伦理问题便转化成:为了保存这种希望,她是否仍然能够公正地对待那些此刻真正与她共同生活的人?

与菲莉茜的确信更加接近的神学危险,也许是“妄望”

莫尔特曼也帮助我进一步思考希望与 presumption 之间的区别。真正的希望朝向一种尚未被拥有的实现,而 presumption 则开始像是把未来的实现当成已经被保证的东西。正是在这里,菲莉茜的语言有时候最令我不安。她在理智上当然知道夏尔可能已经结婚,也可能早已不爱她,但她更加深层的语言却经常仿佛把这段关系的永久性当成一种超越普通不确定性的存在论事实。

希望可以说:

“我不知道,但我仍然保持开放。”

而 presumption 则越来越接近:

“我以一种任何相反证据都无法真正挑战的方式知道。”

大教堂里的“我看见自己没有错”,已经非常接近这条边界。当然,侯麦最后让她真的没有错;然而,被作者安排成为正确的人,与此前拥有足够证据因此有资格说“我知道”,并不是同一回事。

本笃十六世给了我一个更愿意信任的表述

《在希望中得救》(Spe salvi)中有一处思想,对我理解希望变得极其重要。本笃十六世把认真、正直的人类行动称为“行动中的希望”(hope in action):人会追求较小和较大的希望,为自己珍视的未来工作,并在无法保证结果的情况下努力打开新的可能性,而基督徒最终的希望基础则超越任何人类行动本身能够保证的范围 (Benedict XVI, 2007, §35)

这使我最终形成了一个比“被动乐观”更加信任的表述:

希望开始于负责任的控制已经抵达边界的地方,而不是开始于负责任的行动被放弃的地方。

这句话需要谨慎理解。它并不是说,人只有在以强迫症式的方法穷尽世界上一切可能行动以后,才有资格开始希望;它真正意味着,希望与能动性并不是敌人。如果某件事情真的重要,我可以调查、行动、寻求帮助、降低可避免的风险、使用我能够获得的最好信息,并为失败建立备用路径。最终,我也许会抵达一个自己无法再控制结果的边界;这个边界并不能证明此前的行动毫无意义,而只是意味着从这里开始,行动必须与不确定性共同存在。这是一种我远比“我什么都不做,只是相信”更加愿意信任的希望。

希望可以极其强烈,却不需要假装自己拥有知识

这也纠正了另一种可能的错误:对于希望采取严谨的神学态度,并不要求我们在情感上变得冷漠。我完全不需要因为“我无法知道未来”就进一步推出“所以我不应该强烈想要任何东西”,否则认识论上的谦卑就会变成情感麻醉。我可以极其强烈地渴望一个善,可以为它工作,可以为它祈祷,可以害怕失去它,同时仍然诚实地说:

“我不知道它是否真的会发生。”

形式上说:

欲望的强度 ≠ 结果发生的概率

但如果那个被希望的善最后真的发生了,谦卑也绝不会禁止喜悦,恰恰相反:正因为我没有提前把这个结果当成自己的所有物,我反而能够把它作为一份礼物来接受,而不是把它当成对自己全知能力的证明。到了这里,我终于找到了一种能够拥抱侯麦“奇迹”的方式,却不必同时接受菲莉茜的认识论。

更困难的神学问题是:当我希望的时候,谁在受苦?

天主教意义上的望德同样不能停留在一种私人心理资产里,因为望德最终与爱德相连,而明智辨认真正的善以及适当的手段,正义则要求给予他人其所应得的东西 (Catholic Church, 1992, §§1806–1807)。于是问题发生了变化:我不再只想问“菲莉茜的希望最后是不是实现了”,还必须继续问:

在她持续希望的这些年里,谁因此受了苦?

这个问题并不是反对希望,而恰恰是防止希望变成自我中心的方式。如果一种希望要求我停止看见自己的邻人,那么即使我最终想要的事件真的发生,这种希望在灵性上也已经变得可疑。也正因如此,洛伊克在我的阅读中越来越重要,因为他使我们看见:一个人的希望并不只存在于她自己的意识里,它还会进入关系,进入时间,进入其他人的等待和痛苦。

菲莉茜并不邪恶,但真诚并不是完整的道德辩护

我仍然非常想避免把菲莉茜漫画化。她并不是一个精心计算的反派;她并没有从洛伊克的痛苦中获得快乐,也没有因为马克桑斯受伤而感到满足;她爱埃莉丝,也能够认出别人的善;她承认自己要求很多,也会因为自己的决定让马克桑斯陷入难堪而感到羞耻;而且她在许多时候确实非常真诚。然而真诚只是众多德性中的一种,一个人完全可能非常真诚地表达自己的感情,同时在把这种感情施加进关系时仍然不公正;一个人也完全可能诚实地描述自己的欲望,却没有意识到,自己能够继续追求这种欲望,是因为身边存在一整套不断替自己吸收成本的照顾系统。

因此,我后来不再把菲莉茜主要描述成“虚伪”,而更愿意说她在道德上是不完整的(morally incomplete)。她在“真实性”这一轴线上的道德视野高度发展:我是不是按照自己真正爱着的东西来生活?但在另一条轴线上,她的发展明显不足:为了让我继续保存这种真实性,我正在要求别人承受什么?第二个问题正是洛伊克进入整个伦理结构的地方。

可靠的人,很容易变成看不见的基础设施

这里存在一个远远超出这部电影的关系洞见:一个人越可靠地承担重量,我们就越容易忘记“承担”本身是有成本的。一个总是回复消息的人,会逐渐变成“那个永远都可以联系的人”;一个总是保持冷静的人,会变成“那个什么都承受得住的人”;一个不断原谅的人,则会变成“那个反正总能理解我的人”。最终,一种德性会逐渐变成基础设施,而基础设施最危险的特点恰恰就在于:当它正常工作的时候,我们几乎不会再注意到它。

因此,洛伊克的慷慨本身完全可能成为让菲莉茜的不稳定继续以较低即时成本运行的条件。另一个人的德性,有时候会在无意中补贴我的不负责任。这也是为什么,我后来觉得“菲莉茜有没有权利自由选择”远远不够。当然,她有;真正的下一个问题是:她如何对待那些使这种自由在现实中变得可以承受的人?

如果浪漫爱情不能被要求,那么正义究竟要求什么?

正义当然不能要求菲莉茜凭空制造出对于洛伊克的欲望。那么,它究竟可以要求什么?我认为答案主要与“承认”有关。她可以承认他的可获得性本身具有成本;可以承认在否定浪漫可能性的同时持续使用伴侣式亲密可能逐渐变得残酷;可以承认他也许需要距离;可以承认他的慷慨并不意味着他拥有无限耐久度;也可以承认,她自己的幸福并不会因此自动取消他的悲伤。

  • 承认他的可获得性是有代价的;
  • 承认在否定浪漫可能性的同时继续依赖浪漫式亲密,可能变得残酷;
  • 承认他也许需要距离;
  • 承认他的慷慨并不意味着他可以被无限消耗;
  • 承认她自己的幸福并不会抹去他的悲伤。

换句话说,互惠并不一定要求情感完全对称,它可以意味着对彼此作为人的存在,以及彼此所承担成本的相互承认。这比要求菲莉茜“因为洛伊克很好所以必须爱他”,更加接近我真正希望从爱情伦理中得到的东西。

为什么我也无法简单地谴责菲莉茜

然而,经过所有这些批评以后,我仍然无法简单地站到菲莉茜的对立面,因为她有一个洞见,我认为是真正有力量的:仅仅因为一个人善良、安全、可靠而选择永久和他在一起,并不会自动比拒绝他更加伦理。洛伊克的善良无法补偿一个根本不存在的 erotic reality;马克桑斯在现实生活中的合适,也无法通过一项行政决定把有限的爱升级成绝对的爱。如果菲莉茜仅仅因为概率告诉她“夏尔不太可能回来”,于是就嫁给洛伊克或者永久地与马克桑斯生活,她完全可能制造一种更加严重的不公。

因此,她拒绝虚假的永久性值得尊重。真正的问题不是“拒绝”本身,而是拒绝周围建立起来的关系架构:我能不能拒绝被另一个人占有,却又不把其他人变成暂时性的资源?我能不能继续忠于一段尚未解决的爱情,同时诚实地告诉现在的人,我究竟能够给予什么、不能给予什么?自由能不能在不停止成为自由的情况下,变得负责任?这些问题远比宣布菲莉茜“自私”或者“圣洁”困难得多。

“一百万个菲莉茜”的问题

有一个思想实验一直困扰着我,因为它非常清楚地揭示了叙事选择所隐藏的东西。想象有一百万个菲莉茜,每一个人都因为某种偶然事故失去了自己认为一生中最重要的爱情;每一个人都多年保存希望;每一个人都因为仍然存在重逢的可能,而避免某些永久关系。然后,在其中一个人的生命里,那个失去的爱人真的出现在了一辆公交车上,而另外 999,999 个人的公交车上什么也没有发生。

哪一个故事会成为一部侯麦电影?当然是那一辆公交车。

一旦摄像机选择了那个人的生命,她此前的希望就会获得一种回溯性的光辉,看起来仿佛从一开始就具有某种预言力量。这并不是对故事本身的批评,因为叙事必然要进行选择;它只是提醒我们,不要把叙事成功当成概率模型。罕见事件当然可能真实发生,而且完全可能美得无法形容,但它仍然是罕见事件。

如果镜头停得太早,奇迹在道德上就是不完整的

到了最后,我意识到自己对这部电影最强烈的批评已经不再主要是认识论上的,而变成了道德和神学上的。假设我把一切都让给影片:假设菲莉茜的希望值得赞美;假设公交车上的重逢真的可以被解释成恩宠;假设莎士比亚已经正确地为这次复归准备了结构;假设帕斯卡式的赌注在叙事上真的得到了验证。即使如此,仍然有一个问题无法消失:

恩宠是否会仅仅因为我们一直跟随的那个主角终于幸福了,就因此变得完整?

我不认为如此。如果基督徒的希望最终朝向和好,那么一个被实现的希望应该扩大我们所关心的范围,而不是缩小它。镜头应该仍然能够转向洛伊克、马克桑斯、埃莉丝,以及那些永远无法被归还的年份。复归不是删除。

也正是在这里,这部电影最终对我变得更加美

奇怪的是,在拒绝了这部电影最容易接受的若干解释以后,我反而更加喜欢《冬天的故事》。我不需要菲莉茜成为圣人;不需要她的确信拥有完美的概率校准;不需要夏尔的归来证明内在确信具有预言能力;不需要相信洛伊克在银幕外一定会得到某种秘密补偿;不需要把埃莉丝的眼泪压缩成一种单纯情绪;也不需要把天意理解成一种能够被识别出来的、对普通因果机制的直接违反。

当所有这些张力都继续存在的时候,影片反而更加丰富。侯麦把奇迹给了菲莉茜,我完全可以和她一起高兴;但我仍然可以继续追问,这个奇迹并没有解决什么。

洛伊克最终教会了我什么

我开始看这部电影的时候,最关心的是菲莉茜的信仰;结束以后,我却不断想到洛伊克的“在场”。他没有做什么像“看见未来”那样壮观的事情,他只是留下来,倾听,帮助,认真思考菲莉茜说出的每一句话,即使并不同意她;他承受嫉妒,却没有把嫉妒转化成占有;他甚至能够为一个可能排除自己的幸福祈祷。然而我从他身上得到的教训,并不是“爱就意味着无止境地承受痛苦”,而是:爱只有在真正接触另一个人的脆弱时仍然能够存在,同时又不把给予者自身的人格消灭掉,才真正获得了道德严肃性。

因此,我不断回到这一句话:

洛伊克的慷慨,但不以洛伊克自身的消失为代价。

它也许是整部电影中我所能找到的最令人信服的爱。

希望、信仰与确信,最终是三种不同的东西

经过这一切以后,我会非常谨慎地区分标题里的三个词。确信(certainty)首先指的是我在多大程度上体验某个东西为真实;确信可以在心理上完全真诚,却仍然可能犯错。人类的希望(human hope)则指向一个我所渴望、却尚未拥有其实现的未来;它可以是理性的,也可以是非理性的;可以产生行动,也可以变得被动;可以慷慨,也可以非常自我中心,这取决于它如何面对证据、行动以及其他人。至于神学意义上的望德(theological hope),则是一种更大的东西。在基督宗教意义上,它最终的对象不是夏尔,也不是任何其他有限的、被渴望的结果,而是天主;正因为如此,它能够容纳有限的人类希望,却不必把其中任何一个有限的善绝对化 (Catholic Church, 1992)

同样,信德也不能简单地等于“我绝对确信”。基督宗教的信德当然包含信赖,但信赖与认识论上的过度自信并不是一回事。也正因如此,菲莉茜对我如此迷人:她不断穿越这几个范畴之间的边界。有时候她在希望;有时候她在宣称确信;有时候她又开始以宗教方式解释这种确信;有时候是洛伊克把她原本没有使用的神学语言提供给她;而有时候,则是电影本身最终确认了现实此前尚未确认的东西。

我最终能够信任的表述

这部电影最终在我这里形成的神学,其实可以相当简单地表达出来,虽然我花了出乎意料漫长的道路才抵达这里:

我希望一个自己无法控制的未来。正因为我怀有希望,所以我在当下忠实地行动;正因为我无法控制未来,所以我对于自己究竟知道什么保持谦卑;而正因为基督徒的希望不能与爱分离,我也不能把其他人的痛苦仅仅视为我个人实现愿望所需要支付的成本。

由此,我得到了一组如今很难再彼此分开的原则:

自由不会取消关系责任。

照顾不会创造所有权,但照顾也绝不是在道德上毫无意义的。

主观确信并不是外部证明。

希望开始于负责任的控制抵达边界的地方,而不是开始于负责任的行动被放弃的地方。

恩宠不能抹除正义。

复活不能意味着:只要一个人得到复归,所有其他人的失去就都自动消失。

这些原则没有任何一条要求我拒绝侯麦的童话;它们只是阻止我在公交车门打开的那一刻,就停止继续思考。

那个我始终无法放下的问题

《冬天的故事》最传统、最直接的情感问题,是夏尔究竟会不会回来。侯麦给出的答案是:会。然而对我而言,后来真正有意思的问题已经变成了那个“会”之后发生什么。奇迹以前存在的那个道德世界会怎样?那些曾经爱过却没有被选择的人会怎样?那个孩子到底理解了什么?哪些关系得到了恢复,而哪些关系其实只是被重新安排、重新挤到别的位置?一个得到实现的希望,能不能仍然看见那些没有得到实现的人?

到了这里,电影标题里的“冬天”对我也获得了另一种意义。莎士比亚的冬天并不会仅仅因为一个失去的人回来就自动结束,而基督宗教意义上的复活更不是一种能够把此前伤口删除掉的编辑操作。如果 restoration 真正配得上“复归”这个名字,它最终必须足够宽广,能够记得所有人身上究竟发生过什么。

所以,当夏尔终于出现,菲莉茜终于得到那个自己保存了五年的非凡未来时,我完全可以为她高兴。我甚至可以在叙事意义上把那个时刻称作奇迹,也可以在一种对于因果机制仍然保持谦卑的神学诠释中,把它称作天意。

但是,在庆祝之外的某个地方,还有洛伊克。

也正因为如此,我无法在奇迹那里停下来。

对我而言,《冬天的故事》最终的神学问题已经不再只是:

“失去的人能够回来吗?”

而是:

当失去的人终于回来以后,现在又是谁成了那个失去的人?

侯麦没有给出答案。

参考文献

  1. Rohmer, É. (Director). (1992). Conte d’hiver [A Tale of Winter]. Les Films du Losange / C.E.R.
  2. Criterion Collection. (n.d.). A Tale of Winter (1992). The Criterion Collection. https://www.criterion.com/films/29649-a-tale-of-winter
  3. Smith, I. S. (2024, February 13). Eric Rohmer’s Tales of the Four Seasons — Another Year. The Criterion Collection. https://www.criterion.com/current/posts/8387-eric-rohmer-s-tales-of-the-four-seasons-another-year
  4. Jamet, X. (2019, January 9). Éric Rohmer, mode d’emploi. La Cinémathèque française. https://www.cinematheque.fr/article/1357.html
  5. Andrew, G. (2015). Eric Rohmer original film posters. British Film Institute. BFI 将《冬天的故事》描述为一部关于“理性与责任、忠贞与信仰”的作品。https://www.bfi.org.uk/features/eric-rohmer-original-film-posters
  6. Shakespeare, W. (n.d./2016). The Winter’s Tale, Act 5, Scene 3. Folger Shakespeare Library. https://www.folger.edu/explore/shakespeares-works/the-winters-tale/read/5/3/
  7. Amiel, V. (2013). Le cinéma d’Éric Rohmer ou la transcendance comme un jeu. In Rohmer en perspectives. Presses universitaires de Paris Nanterre / OpenEdition Books. https://books.openedition.org/pupo/40162
  8. Herpe, N. (2013). Des Contes des quatre saisons à L’Anglaise et le Duc — La chute dans la parole. In Rohmer en perspectives. Presses universitaires de Paris Nanterre / OpenEdition Books. https://books.openedition.org/pupo/23630
  9. Moltmann, J. (1967/1993). Theology of Hope — On the Ground and the Implications of a Christian Eschatology. Fortress Press. https://books.google.com/books/about/Theology_of_Hope.html?id=sWPIcMupDeAC
  10. Catholic Church. (1992). Catechism of the Catholic Church — The judgment and formation of conscience, §§1777–1788. The Holy See. https://www.vatican.va/content/catechism/en/part_three/section_one/chapter_one/article_6/i_the_judgment_of_conscience.html
  11. Catholic Church. (1992). Catechism of the Catholic Church — The human virtues, especially §§1806–1807. The Holy See. https://www.vatican.va/content/catechism/en/part_three/section_one/chapter_one/article_7/i_the_human_virtues.html
  12. Catholic Church. (1992). Catechism of the Catholic Church — The theological virtues, especially §§1817–1819. The Holy See. https://www.vatican.va/content/catechism/en/part_three/section_one/chapter_one/article_7/ii_the_theological_virtues.html
  13. Benedict XVI. (2005, December 25). Deus caritas est, especially §7. The Holy See. https://www.vatican.va/content/benedict-xvi/en/encyclicals/documents/hf_ben-xvi_enc_20051225_deus-caritas-est.html
  14. Benedict XVI. (2007, November 30). Spe salvi, especially §§2, 35 and 41. The Holy See. https://www.vatican.va/content/benedict-xvi/en/encyclicals/documents/hf_ben-xvi_enc_20071130_spe-salvi.html

What Loïc Taught Me About the Moral Cost of a Miracle: A Tale of Winter (1992) and the Difference Between Hope, Faith, and Certainty

I expected Éric Rohmer’s Conte d’hiver (A Tale of Winter, 1992) to leave me thinking about romantic fidelity, chance, and perhaps a little theology. Instead, I ended up arguing with Félicie, defending her, criticizing her again, correcting some of my own criticisms after returning to the screenplay, questioning whether her “faith” is really faith, and finally becoming much more interested in Loïc than in the miraculous return of Charles. The film grew richer every time one of my first explanations stopped working.

That is why I do not want to write this as though I watched the film once and immediately possessed a finished interpretation. I did not. My reading developed by repeatedly testing claims against chronology, dialogue, action and consequence. At first I thought Félicie had spent five years simply waiting. The screenplay forced me to withdraw that claim. I initially thought one conversation with Maxence looked like straightforward hypocrisy; later I found motivated self-deception a more precise category. At first the central theological question seemed to be whether Félicie’s conviction deserved to be called faith. By the end, another question had become at least as important: if one person’s hope is fulfilled, what happens to the people who carried the costs of that hope?

This is also why Loïc became the character who affected me most. Charles is the lost beloved who returns. Félicie is the believer whose astonishing hope is narratively vindicated. Loïc is the person who remains present, helps, listens, suffers, prays, and then largely disappears from the story once the miracle arrives. The film says: the lost person has been found. I increasingly wanted to ask: yes, but who has now been left outside the frame?

I treated the film as an argument that had to survive its own evidence

Rohmer’s films invite this kind of reading because conversation does not merely communicate plot. His characters reason, rationalize, contradict themselves, correct themselves and often build elaborate explanations around feelings they only partly understand. Imogen Sara Smith describes Rohmer’s cinema as deeply interested in rationalization, self-deception and the “mystery of subjectivity,” while also emphasizing how difficult his characters find it to understand themselves and one another (Smith, 2024). That description fits A Tale of Winter almost perfectly.

I therefore ended up using something resembling a debugging procedure. That may sound slightly absurd for a Rohmer romance, although frankly the characters themselves spend enough time debugging their own emotional state that I do not feel entirely responsible for the metaphor.

claim
→ exact dialogue or visual evidence
→ chronology
→ competing interpretation
→ action produced by the belief
→ consequences for other people
→ philosophical or theological test
→ what remains unproven

The chronology mattered especially. The cathedral experience comes before the performance of Shakespeare. Félicie’s attempt to commit herself to Maxence comes before the cathedral. Her practical attempts to recover Charles occurred years earlier. Pascal and Plato arrive later as conceptual vocabulary supplied largely by Loïc. If I flatten those events into “Félicie believes in Charles and is rewarded,” most of the film’s intellectual machinery disappears.

The method also forced me to distinguish several kinds of evidence. Dialogue establishes what a character says, but not necessarily what is true. Behaviour can confirm or contradict speech. Visual staging can complicate both. Later outcomes tell us what happened, but they do not necessarily prove that an earlier belief was rationally justified. External philosophy and theology can illuminate the categories the film invokes, but they should not be used to overwrite what the film itself actually shows.

This is particularly important because some influential descriptions of the film already use the word “faith.” Criterion describes Félicie as holding an “undying faith” that a miracle will reunite her with Charles, while La Cinémathèque française speaks of her certainty and wager on love gradually becoming faith (Criterion Collection, n.d.) (Jamet, 2019). Those are illuminating descriptions. I nevertheless think the word becomes much more interesting once we ask what kind of faith this actually is.

The first crack appears in a verb

One of the scenes that changed my attitude toward Félicie occurs before any explicit theological discussion. She is with Maxence, trying to persuade herself that Charles belongs to the past. She says:

« Je ne veux plus penser qu’à toi, je ne veux aimer que toi. »

Maxence hears the problem immediately:

« Tu “veux” m’aimer ? »

Félicie answers that she does love him, but would like to love him more (Rohmer, 1992).

The grammar is revealing. She does not simply state an emotion. She describes an act of will directed toward an emotion. She wants herself to love Maxence exclusively. The screenplay then has her move physically into his arms. Her body performs an intimacy that her sentence has already qualified.

My first reaction was severe: is this not simply hypocrisy? She knows Charles remains central, yet tells Maxence that she wants to think only of him and love only him. After sitting with the scene, I became less certain. The concept of motivated self-deception seems more accurate. She may not be calmly lying to Maxence while privately knowing the opposite. She seems to want a proposition about her future to become true and speaks partly from inside that desired future.

This is more charitable than accusing her of calculated deception, but it does not make the problem morally harmless. Self-deception can injure another person just as effectively as deliberate deception. Sincerity in a particular moment is not a complete defence when somebody else is being asked to organize his life around the statement.

The scene also became important because Maxence himself detects the discrepancy. My interpretation does not require an external psychological theory imposed on the character. Rohmer puts the objection directly into Maxence’s mouth: you want to love me?

That tiny grammatical distinction becomes a prototype for the whole film. Again and again I found myself separating:

  • what Félicie wants to be true;
  • what Félicie genuinely feels;
  • what Félicie believes she knows;
  • and what is actually true outside her consciousness.

The film eventually makes some of those categories converge. My question is whether the convergence at the end should be allowed to erase the distinctions that existed before it.

I initially accused Félicie of passive waiting and the screenplay proved me wrong

This was one of the most useful corrections in my reading. I initially found Félicie’s hope frustrating because I thought: if Charles is so important that she is willing to organize five years of her life around his possible return, why does she not actually search for him?

That criticism was too simple.

The screenplay establishes that she did search. The original disaster begins because she tells Charles that she lives at 36 rue Victor-Hugo in Courbevoie when she actually means Levallois. She does not discover the mistake immediately; she realizes it months later while dealing with maternity paperwork. Once she understands what happened, she goes to the post office in Courbevoie, asks what might have happened to letters, checks poste restante, discovers that Courbevoie also has a rue Victor-Hugo, and investigates the corresponding address. Later, after meeting Loïc, she says that he helped by writing to many organizations (Rohmer, 1992).

Then comes the almost absurd informational constraint: she does not know Charles’s surname. He had been working informally at the restaurant where they met, everybody called him Charles, and the surname—possibly Danish or Dutch—never remained in her memory. Searching across continents with no surname, uncertain geography and no stable institutional record is very different from simply refusing to open a phone book.

I therefore had to withdraw the strong claim that Félicie simply “does nothing.” The evidence does not support it.

But withdrawing that criticism did not end the problem. It changed it.

Once the available search mechanisms have largely collapsed, what exactly does her hope do? The answer seems to be that she begins preserving a different kind of possibility. She cannot meaningfully increase the probability of finding Charles, but she can avoid entering commitments that would make it harder to receive Charles if he reappeared.

In decision-theory language, this resembles the preservation of an option:

Early problem:
maximize P(find Charles)

Later problem:
preserve P(being free to receive Charles | Charles returns)

That distinction helped me understand the cathedral decision. Félicie does not emerge from the church with a new search algorithm. She emerges with a new commitment policy.

After returning to Maxence, she says that she has decided she will no longer bind herself to men except provisionally. She is trying to prevent another relationship from closing the branch of the future in which Charles returns.

This is much more coherent than my original description of simple passivity.

Yet it leads directly to another question: who pays for the preservation of that option?

The cathedral gives her clarity but does it give her knowledge?

The cathedral scene became one of the most important parts of the film for me, partly because it is frequently interpreted too quickly as a religious conversion. Félicie herself resists that description.

She has been upset by Maxence, leaves with Élise, passes the cathedral in Nevers and sits down while the child looks at the crèche. When Loïc later asks whether she prayed, she corrects him. It was not prayer in the conventional sense. It was closer to reflection or meditation. She describes the familiar state in which lack of sleep, decision pressure and mental excitement can make thoughts run unusually quickly, except that this experience was “a thousand times” stronger. Suddenly everything became clear (Rohmer, 1992).

Then comes the sentence I kept returning to:

« J’ai pas pensé : j’ai vu, j’ai vu ma pensée. »

She says she “saw” what she had to do and “saw” that she was not mistaken.

I find the phenomenology fascinating. I also find the epistemology dangerous if the two are confused.

At least three propositions are involved:

  1. Félicie genuinely experiences extraordinary subjective clarity.
  2. The conclusions experienced in that state correspond to external reality.
  3. The experience is properly described as theological faith or divine revelation.

The first seems strongly supported. Nothing in the film requires us to think she is faking the experience.

The second does not follow automatically. “I saw my thought” is an unusually vivid report about consciousness. It does not provide data about Charles’s current location, relationship status, health, desires or future movements.

The third is even less straightforward, because Félicie explicitly tells Loïc that she was not thinking of God. When Loïc romanticizes the experience and says that if he were God he would cherish her for sacrificing happiness to an absent love, Félicie replies that if God loves her, God should give Charles back. But she immediately adds that she had not actually been asking God for anything. During the cathedral moment, she had felt “alone in the world, alone in the universe,” and concluded that it was up to her to act (Rohmer, 1992).

This is why I eventually preferred the phrase existential illumination in a religious space. It preserves the seriousness of what happened without pretending that the film has established a supernatural causal mechanism.

And something in the insight may indeed be true. Félicie realizes that she should not permanently bind herself to somebody she does not love “à la folie” merely because she is frightened by uncertainty. The strongest content of her revelation may therefore be negative:

I should not make an irreversible commitment to a life I do not actually want simply because I am afraid that no better future will come.

That is a much stronger proposition than “Charles will return.”

One concerns the truth of her own present commitment. She has considerable evidence about that.

The other concerns an absent man’s future return. She has almost none.

Subjective certainty is not the same thing as external truth

This distinction eventually became the epistemological centre of my reading. Félicie repeatedly treats the force of an inward experience as though it reduced ambiguity in the external world. Her language is visual: she did not merely think; she saw. She did not merely choose; she saw that she was not mistaken.

In computational terms, I would separate confidence from calibration. A model can output 0.99 confidence and still be wrong. Human beings discovered overconfidence long before machine learning; neural networks merely automated one of our older traditions.

The same problem appears in moral and religious experience. Catholic teaching on conscience does not say that the strongest inward conviction automatically constitutes truth. The Catechism of the Catholic Church defines conscience as a judgment of reason concerning the moral quality of a concrete act and explicitly acknowledges that conscience can make erroneous judgments. It also recommends interpreting experience with prudence, competent advice and serious discernment (Catholic Church, 1992, §§1777–1788).

This makes the cathedral scene more interesting, not less religious. A serious theology does not need to dismiss interior experience. It asks what kind of claim the experience can support.

I therefore increasingly wanted to say:

The intensity of certainty is evidence about the subject who experiences it. It is not automatically evidence proportional to the certainty of the proposition believed.

This is precisely where I begin resisting attempts to canonize Félicie’s certainty simply because the screenwriter later makes Charles appear.

Shakespeare recognizes the structure she already carries

The chronology matters again. Shakespeare does not create Félicie’s cathedral experience. Loïc takes her to The Winter’s Tale afterward. In Shakespeare’s final scene, Hermione—believed dead for sixteen years—appears as a statue. Perdita kneels before her. Paulina prepares the spectators for something astonishing, warns against interpreting it as wicked magic, and eventually tells them that they must “awake” their faith. Music sounds; Hermione moves and descends (Shakespeare, n.d./2016, 5.3).

Félicie is overwhelmed. She grips Loïc’s hand and later says she almost cried out when the statue moved. Loïc’s response is revealing because he remains interested in the text’s ambiguity. Was this literally supernatural animation, or had Hermione somehow never died? Félicie responds:

« Je n’aime pas ce qui est vraisemblable. »

Then she insists that the meaning is obvious: faith makes Hermione live again (Rohmer, 1992).

I initially found the stage miracle less affecting than Félicie does. As a spectator, I know that the “statue” is an actor who was standing still and then moves. But that objection turned out to be too literal. Félicie is responding to the narrative structure, not to special-effects technology. Someone is lost. Years pass. The loss seems irreversible. The impossible return occurs. That structure maps almost perfectly onto Charles.

Shakespeare therefore functions as a révélateur. It gives an aesthetic image to a pattern Félicie already carries. Scholarship on Rohmer has likewise treated Shakespeare as structurally central to the film’s movement from winter, loss and apparent death toward restoration (Smith, 2024). But I remain much closer to Loïc than to Félicie in the argument afterward. He says there is ambiguity. She says there is none. That difference is epistemologically important.

Félicie thinks her interpretation is religiously superior because it requires less hesitation. I am not convinced. Religious confidence and theological maturity are not identical. Sometimes the more theological response is precisely the willingness to say:

“I am moved by this, but I still do not know exactly what happened.”

Her anti-intellectualism is attractive and also dangerous

The tension between Félicie and Loïc is partly social and intellectual. Loïc reads. He reaches instinctively for Pascal, Plato, Shakespeare and philosophical explanation. Félicie experiences this as mediation. At one point she tells him, with wonderful irritation, that if she said she loved him, he would probably go and check whether the statement had already been written in Shakespeare. For him, she complains, only what is written seems true (Rohmer, 1992). The criticism is funny because it contains some truth. Loïc can intellectualize life. Books can become a defensive layer between experience and vulnerability.

But Félicie’s alternative can become equally dogmatic. “I feel directly” is not inherently more truthful than “I have reflected.” Anti-intellectual authenticity can simply relocate the authority from texts to affect. Her strongest formulation is that in the cathedral she felt completely herself, just as she had felt completely herself five years earlier with Charles. That is psychologically meaningful. It tells us which experiences she integrates most strongly into her sense of identity. Yet identity is not infallibility. “This feels most like me” cannot by itself establish “therefore my interpretation of the world is correct.”

That distinction matters well beyond Rohmer. There is a contemporary temptation to treat authenticity as moral certification: if an action expresses my deepest self, questioning it becomes almost an attack on my existence. I think Rohmer is subtler than that. Félicie’s authenticity is powerful, but the film also gives us enough evidence to ask what that authenticity does to other people.

Pascal arrives after Félicie has already made the wager

One of the film’s great pleasures is that Félicie frequently has an experience first and receives a philosophical label later. Loïc is effectively running a conceptual package manager for her. Plato? Installed. Pascal? Installed. Shakespeare? Already in production.

Félicie admits that the chances of recovering Charles are extremely small. She knows he may be married. She knows he may no longer love her. Yet she says that if she did recover him, the joy would be so enormous that she could give her life for that possibility. Then comes the line:

« Vivre avec l’espoir, je pense que c’est une vie qui en vaut bien d’autres. »

Loïc immediately recognizes a Pascalian structure (Rohmer, 1992).

Rohmer himself repeatedly returned to Pascal’s wager, and scholarship on the film has described Félicie’s position as a distinctly Pascalian wager transposed into romantic life. An OpenEdition study makes a particularly useful distinction: Félicie’s belief is no longer straightforwardly Christian—she herself says she was not thinking about God—yet it retains a Pascalian logic of risk, uncertainty and an immense hoped-for good (Amiel, 2013). This helped me clarify something. Félicie’s wager is not Pascal’s theological wager in any strict sense. Charles has taken the structural position occupied by infinite gain, but Charles is still a finite human being. That substitution is philosophically fascinating and theologically unstable.

Her hope is rational in one sense and badly calibrated in another

I do not think Félicie’s position should simply be dismissed as irrational. Once she recognizes that she does not genuinely want a permanent life with Maxence, refusing permanence may be perfectly rational. Choosing security simply because the desired future is improbable can create a different kind of dishonesty. The strongest charitable reading of her position is therefore:

I would rather accept uncertainty than make a permanent commitment I know is emotionally false.

I think that is serious.

The weaker version is:

Because my hope feels absolute, its fulfilment possesses some privileged likelihood or destiny.

Here I become much more skeptical. The film is interesting because Félicie moves between these positions without always distinguishing them. Sometimes she defends freedom from a commitment she does not authentically want. At other moments she speaks as though her intuition gives her special access to the future. Those are different arguments. I can defend the first while rejecting the second.

Fidelity is not as simple as monogamy

Another difficulty I had to resolve concerned whether Félicie can meaningfully be called faithful to Charles while sleeping with and loving other men. The answer depends on what “fidelity” means. If fidelity means sexual and relational exclusivity, then obviously no. Her life contradicts that definition. But the film constructs another kind of fidelity: ultimate affective orientation. Loïc and Maxence occupy real places in her life, yet neither occupies the place Charles occupies. The deepest allegiance of desire never transfers.

This explains how Félicie can sincerely say that she loves Maxence and still mean that Charles remains incomparable. She does not necessarily use the word love univocally. I do not need to endorse that hierarchy in order to recognize its internal consistency. The moral question therefore shifts away from “Is she monogamous?” toward “Has every person involved understood what kind of relationship he is actually in?”

This is where freedom and responsibility intersect. A non-exclusive relationship can be perfectly ethical if the relevant expectations and boundaries are genuinely shared. The difficulty in Rohmer’s film is that the emotional architecture is not symmetrical. Charles has an absolute status that Loïc and Maxence cannot meaningfully compete with, yet both men at different times are invited into forms of intimacy that can feel more definitive than Félicie ultimately allows.

Charles has one enormous advantage over Loïc and Maxence — he is absent

The more I thought about Charles, the less simple Félicie’s “absolute love” became. Charles is absent for five years. Absence is an astonishingly effective way to avoid disappointing someone. Loïc and Maxence must exist as actual human beings. They have habits, temperaments, jealousies, intellectual quirks, professional lives, needs and bodies. They can say the wrong thing at breakfast. They can become irritated. They can fail to match an ideal at 4:17 on an ordinary Tuesday. Charles cannot. He exists for most of the film as memory.

Rohmer reinforces this visually. The opening romance is summer: physical intimacy, brightness, seaside pleasure, an almost embarrassingly concentrated idyll. Five years later, the main film takes place in grey winter streets, trains, suburban houses and salons. Criterion explicitly notes the contrast between the idyllic summer prologue and damp December, while La Cinémathèque describes winter’s greyness as central to the film’s emotional texture (Smith, 2024) (Jamet, 2019). Félicie therefore compares imperfect present men with an absent beloved preserved inside summer memory.

That does not make Charles unreal. He existed. The love existed. Élise is the embodied consequence of that love. But the Charles who structures five years of hope is partly a remembered object protected from ordinary temporal erosion. This made me wonder whether Félicie’s absolute fidelity is partly fidelity to Charles and partly fidelity to the idealized lost possibility that Charles represents.

The ending conveniently removes the problem by returning a Charles who is almost maximally compatible with the memory. He has not forgotten her. He is available. The woman beside him is not his wife. He does not arrive with another child and a complicated family system. He accepts Élise. He still loves Félicie. Rohmer could have returned Charles married, indifferent or fundamentally changed. He does not. The fairy tale gives Félicie the version of reality in which the preserved ideal survives contact with the present.

I admire Félicie’s freedom more than my criticism may initially suggest

My criticism of Félicie should not be mistaken for a conservative objection to her sexual autonomy. In fact one aspect of the film I find attractive is how much freedom its relationships contain. Loïc is hurt when Félicie chooses Maxence. He becomes dry, withdraws and wants the separation to be clean. He is not an emotionless saint. Maxence becomes angry when Félicie leaves him and at one point physically grabs her. Félicie immediately demands release, says he is hurting her, and threatens to hit him if he does not let go. When he releases her, she explains that she physically cannot tolerate being held by force (Rohmer, 1992).

That scene matters because the men should not be idealized into infinitely patient moral furniture. Maxence can become controlling. Loïc experiences jealousy and pain. Félicie’s insistence on her freedom therefore responds to genuine pressures, not imaginary ones. I also think her cathedral insight contains something ethically valuable: she does not owe Maxence permanent commitment simply because he offers a plausible life. Security cannot manufacture eros.

Where I become critical is at another point:

Freedom does not cancel relational responsibility.

It is possible to defend Félicie’s freedom completely and still ask whether she adequately recognizes the costs borne by people who keep accommodating that freedom.

Who subsidizes her authenticity?

This was the question that radically changed my moral reading:

Who subsidizes her authenticity?

Félicie’s freedom is highly visible. She can move between Paris and Nevers, reject Maxence, return toward Loïc, preserve Charles as her deepest horizon, seek emotional support and remain open to an improbable future. But freedom is not exercised in a vacuum. Other people absorb consequences.

Criterion’s Imogen Sara Smith makes a strikingly severe judgment here, saying that Félicie treats both men badly: she abandons Maxence shortly after moving in with him, leans on Loïc after rejecting him, and finally asks Loïc to pray for the return of Charles (Smith, 2024). I would qualify that judgment because the film gives Félicie more moral awareness than the phrase “treats them horribly” might suggest. She knows she is hurting Maxence. She explicitly feels ashamed about putting him in an embarrassing position. With Loïc, she sometimes tries to persuade him that her departure might free him to find someone who can love him differently. She is not completely blind to others.

Yet the centre of gravity remains intensely first-personal. Her moral vocabulary repeatedly returns to:

  • what I feel;
  • what I saw;
  • what I cannot accept;
  • whom I love;
  • whom I cannot love enough;
  • what future I must keep possible.

The much rarer sustained question is:

What does maintaining my authenticity require other people to carry?

This distinction became important to me because authenticity can acquire an almost sacred status in modern moral language. “I must be myself” sounds self-validating. But one person’s authenticity can depend on another person’s emotional labour, forgiveness, availability or patience. A local rule can be perfectly understandable while the global system becomes pathological. Félicie preserves her freedom. Loïc remains available. Maxence tries to accommodate. Each local action has an explanation. The aggregate cost is much harder to see. Apparently distributed systems and French romance share more architecture than expected.

Loïc is not infinitely available and the film gives us evidence of his pain

One thing I wanted to correct in my own admiration of Loïc was the temptation to turn him into a purely selfless saint. He is not. When Félicie first chooses Maxence, Loïc is plainly hurt. He wants the separation to happen quickly because prolonging it has allowed him to maintain illusions. Félicie tells him she will miss him deeply as a friend and even argues that by leaving she may allow him to find “the woman of his life.” Loïc responds that he does believe she means this sincerely. He even explains that part of why he loves her is that he feels he can read her heart (Rohmer, 1992).

Then comes an extraordinary little exchange. Félicie admits that she sometimes lies. Loïc answers, essentially, that she does not lie about the important things. She does not want him to idealize her. He cannot quite stop doing so. So Loïc has his own interpretive vulnerability. His belief in Félicie’s transparency may itself be partly romantic idealization.

That matters because ethical analysis should not distribute all complexity to Félicie and turn everyone around her into perfectly calibrated observers. Loïc loves. Therefore Loïc also interprets. And sometimes love interprets generously beyond what the evidence requires.

The prayer scene became the moral centre of the film for me

The scene that affected me most is astonishingly quiet. Loïc and Félicie are near a church. She tells him that since he is Catholic, he should go to Mass. He says he might if he were alone but does not want to impose it on her. She insists that he should not sacrifice his convictions for her. Then she says that he knows how to pray, so he should pray for her.

Loïc initially says he will pray another day. Félicie refuses:

« Aujourd’hui. Et tu prieras pour moi. »

Loïc answers:

« Je prie toujours pour toi. »

She pushes further. This time she wants him to pray in her place, asking for what she would ask even if he disagrees. Then she admits:

« Tu vois je suis très exigeante. »

Loïc eventually says that in a sense this is already what he does: he prays for her happiness even when that happiness is not necessarily his own (Rohmer, 1992).

This is where I stopped thinking mainly about the beauty of Félicie’s faith and started thinking about the cost of Loïc’s love. What exactly is she asking? In practical emotional terms, something like:

Love me enough to pray sincerely for the return of the man whose return will eliminate your remaining possibility of being with me.

That is enormous. Félicie knows it: “Je suis très exigeante.” Loïc knows it too. He tells her that she is asking a great deal. The beauty of the scene therefore belongs primarily to the costliness of Loïc’s response. Félicie’s request is ethically more ambiguous.

Extraordinary love does not create a right to romantic reciprocity

At this point a dangerous argument could easily appear: Loïc loves so well that Félicie should love him back. I do not think that follows. Love is not distributive justice. Romantic or erotic desire cannot be awarded as moral compensation. Goodness does not generate a claim on another person’s body, sexuality or deepest affection. If Loïc gives ten units of self-sacrifice, Félicie does not owe ten units of eros. That would make love transactional in precisely the wrong way.

Yet the opposite extreme is equally unsatisfactory. Because care creates no entitlement to erotic love, it does not follow that care creates no moral claims at all. There can still be obligations of recognition, gratitude, truthfulness, proportion and responsible boundaries. The real issue is less:

“Will you reward me for loving you?”

and more:

“Do you actually see me, including what your reliance on my love costs?”

That distinction became decisive for me.

Eros, agape and why Loïc must also be allowed to receive

Benedict XVI’s Deus caritas est unexpectedly became one of the most useful theological texts for understanding Loïc. The encyclical refuses a crude opposition between eros and agape. Eros is transformed as it increasingly seeks the good of the beloved, while agape prevents love from collapsing into pure possession. Yet Benedict also makes a point that is crucial here: a human being cannot live by self-giving, descending love alone. The person who gives must also receive love as gift (Benedict XVI, 2005, §7).

That is exactly why I resist a Christianized interpretation in which Loïc’s role is simply to keep sacrificing forever. If we say:

“Because Christian love is selfless, Loïc should accept whatever emotional role Félicie needs and expect nothing.”

we have converted charity into self-erasure.

A healthier formulation is:

Agape without justice can become exploitation.
Eros without reciprocity can become misery.
Self-sacrifice without discernment can become self-erasure.

Loïc is allowed to need something too. He is allowed to say that remaining a lover, fallback, philosophical guide, trusted confidant and emotional refuge while Félicie’s deepest fidelity remains elsewhere is too painful. Christian love does not require becoming permanently consumable. Loïc sometimes behaves as though he is operating a twenty-four-hour emotional support service with no maintenance window. Even excellent infrastructure eventually requires downtime.

The boundary Loïc perhaps should draw

My admiration for Loïc therefore changed during the discussion. At first I admired the fact that he stays. Eventually I wanted a more mature version of staying. He could truthfully say something like:

“I want your happiness. I do not want to control you. But I cannot remain indefinitely in a role where I provide the intimacy of a partner while accepting that your deepest commitment is elsewhere.”

That would not contradict love. It might protect love from becoming distorted.

This led me to a formulation that I now prefer to simple praise of his self-sacrifice:

Loïc’s generosity without Loïc’s disappearance of self.

That seems more human, and I think more Christian, than idealizing endless emotional martyrdom.

Where is Loïc after the miracle?

Once Charles returns, this became the question I could not stop asking:

Where is Loïc now?

Félicie sees Charles on the bus. She leaves. Charles follows. He learns about Élise. He has not forgotten Félicie. The woman who was travelling with him is not his wife. The extraordinary mistake of five years earlier is suddenly repaired. The family celebrates. But where is Loïc? Is he at home? Does he know yet? Will Félicie tell him immediately? Does he spend New Year’s Eve alone? Will somebody eventually love him in the way he wanted Félicie to love him?

The film does not answer. And I increasingly think that it is important not to repair that discomfort by inventing a sentimental continuation such as “surely God has someone better for him.” Maybe he eventually finds somebody. Maybe he does not for a long time. Nothing in the film guarantees distributive romantic justice.

Loïc did not lose Félicie because he failed a moral test. He simply was not the person she loved absolutely. That is moral luck in one of its most painful forms.

One person’s miracle does not settle everyone else’s story

This is where my theological reading moved beyond the question “Was Félicie’s faith rewarded?” I started asking:

What kind of theology of restoration is satisfied as soon as the protagonist receives what she wanted?

Shakespeare’s The Winter’s Tale itself should warn us against such simplicity. Hermione returns and Perdita is restored, but sixteen lost years have not ceased to exist. Leontes’s repentance does not rewind time. Mamillius does not return. Restoration changes the meaning of loss without deleting every consequence of loss (Shakespeare, n.d./2016).

That became the basis for one of the strongest conclusions I reached:

Resurrection cannot mean that one person’s restoration makes everyone else’s loss disappear.

The lost one returns. Good. Now ask who remains wounded. That question turns theology away from the winner’s perspective.

Élise’s tear complicates the happy ending

Élise makes the ending even stranger. Félicie cries in Charles’s arms and insists that these are tears of joy. Élise enters and looks at her parents. Then she leaves them, moves into the other room, sits with her toy and dreams. A tear runs down her cheek. Her grandmother asks whether she is happy to have recovered her father and tells her not to cry.

Élise answers:

« Je pleure de joie. »

Criterion reads the repetition as a Pascalian grace note, connecting the child’s phrase with the language of religious experience (Smith, 2024). That may be part of Rohmer’s design. But I would preserve the scene’s psychological ambiguity.

We do not actually know that Élise’s interior state is simple joy. It could be joy. It could include confusion. It could include displacement as the entire structure of her known family changes within minutes. It could be an emotion she does not yet know how to name, followed by repetition of the phrase she has just heard adults use. The screenplay gives us a tear and a sentence. It does not give us direct access to the child’s interiority.

This is strangely parallel to the larger epistemological problem of the film. Naming an experience does not completely settle what the experience is. Félicie calls something faith. Élise calls something joy. The words matter. They do not eliminate interpretation.

Rohmer controls the bus doors and reality does not

The final reunion is where my epistemological disagreement with the film becomes clearest. Félicie boards a bus. Charles happens to be there. They recognize one another. She gets off. He responds quickly enough to follow. The physical timing of doors, movement, recognition and decision all permit the reunion. Rohmer can make this happen because Rohmer has root access to the universe of the film. Reality generally does not provide us with administrator privileges.

This gave me the principle I kept returning to:

Narrative vindication is not epistemic justification.

A proposition can become true even if the evidence that originally supported it was weak. Suppose somebody predicts an extremely improbable event on insufficient evidence and the event nevertheless happens. The successful outcome does not automatically prove that the earlier confidence level was justified.

In probabilistic language:

Outcome = true

does not imply

Prior confidence = well calibrated

Rohmer’s story selects the Félicie whose Charles actually returns. Imagine instead one million people maintaining comparably improbable romantic hopes. One eventually meets the lost lover on a bus. A film made only about that person will make the strategy appear prophetic. The unresolved cases vanish from the dataset. That is a selection problem. It does not invalidate the beauty of the exceptional case. It prevents the exceptional case from becoming a general epistemology.

The film knows it is a fairy tale

To be fair to Rohmer, the film does not pretend its ending is an ordinary statistical expectation. Its Shakespearean framing tells us from the beginning that we are entering the logic of a tale, and La Cinémathèque explicitly describes the Shakespearean magic that eventually operates inside the grey winter world (Jamet, 2019). Another OpenEdition study emphasizes that A Tale of Winter uniquely turns winter into a symbolic condition oriented toward the “resurrection” of a lost summer (Herpe, 2013).

Most of the film remains aggressively ordinary: public transport, hair salons, suburban houses, family meals, awkward conversations, childcare, arguments, books, Nevers. Then one coincidence arrives carrying almost the full weight of fairy tale. That is why it works aesthetically. The improbable is surrounded by enough ordinary reality that when it finally enters, the world does not feel completely fantastical.

I can therefore say two things simultaneously:

The ending is beautiful.

and:

The ending does not prove that Félicie’s earlier certainty was epistemically justified.

I see no contradiction there.

Authorial providence is different from theological providence

This also led me to distinguish several meanings of “providence.” Inside the film there is authorial providence. Rohmer literally controls the sequence. He chooses the bus, Charles, the route, the timing, the emotional availability and the doors. Then there is theological providence, which concerns the interpretation of reality under divine care. And then there is ordinary contingency, in which events occur through secondary causes, choices, physical mechanisms and statistical coincidence. Those categories should not simply be collapsed.

A person may receive an improbable event with gratitude and interpret it as providential without claiming to have scientifically established that God directly altered a transport timetable. I think that is an intellectually healthy form of religious interpretation. Providence need not look phenomenologically different from chance. But that is a hermeneutic claim about meaning, not an experimentally demonstrated mechanism. The bus door is already doing enough work without asking it to solve the entire doctrine of divine action.

Félicie’s hope and Christian hope are not identical

Theological vocabulary becomes especially important here because the film repeatedly transposes religious categories into erotic life. The Catechism defines theological hope in relation to the Kingdom of heaven, eternal life, Christ’s promises and divine grace. It also says that theological hope takes up ordinary human hopes and purifies them, ordering them toward a greater good and away from selfishness (Catholic Church, 1992, §§1817–1819).

This makes an important distinction possible: “I hope Charles returns” is a genuine human hope. It is not, simply by itself, the theological virtue of hope. Charles is a finite human being. He cannot become the final object of salvation without being asked to bear a metaphysical load no lover can bear.

This does not diminish romantic love. In fact it may protect it. I can love a human being immensely without requiring that person’s continued presence to guarantee that reality itself remains meaningful. I can desire reunion without declaring reunion metaphysically necessary. I can mourn absence without making the absent beloved into a private eschaton.

Why Moltmann helped me become more critical of passive hope

Jürgen Moltmann’s Theology of Hope gave me a language for one of my strongest instincts while watching the film. Moltmann famously describes Christianity as eschatological from beginning to end: forward-looking, forward-moving, and therefore capable of transforming the present. His project explicitly concerns the responsible exercise of hope “in thought and action in the world” (Moltmann, 1967/1993).

This matters because hope can easily become confused with psychological endurance:

“I continue believing that what I want will happen.”

Moltmann’s account is more demanding. Hope changes one’s relation to the present. It produces unrest against what is treated as final. It opens action toward a promised future (Moltmann, 1967/1993).

That gave me a very practical question:

What does the hope make you do?

I originally used that question too aggressively against Félicie, because I had overlooked her earlier search efforts. Once those were restored, the picture became fairer. She acted when meaningful search actions existed. Yet the question remains useful later. When active search becomes almost impossible, her hope largely changes the way she manages commitments. It does not become nothing, but its practical form narrows. The ethical question then becomes whether preserving that hope is compatible with justice toward the people who inhabit the present with her.

Presumption may be the theological danger closer to Félicie’s certainty

Moltmann also helped me think about the distinction between hope and presumption. Hope reaches toward fulfilment it does not yet possess. Presumption behaves as though the fulfilment has already been secured. This is where Félicie’s language sometimes troubles me most. She knows, intellectually, that Charles may be married or no longer love her. Yet her deeper rhetoric often treats the bond as though its ontological permanence exceeds ordinary uncertainty.

Hope can say:

“I do not know, but I remain open.”

Presumption begins to sound more like:

“I know in a way that no contrary evidence can meaningfully challenge.”

The cathedral’s “I saw that I was not mistaken” approaches that boundary. Again, Rohmer ultimately makes her right. But being made right by an author is not the same as having possessed enough evidence to know.

Benedict XVI gives me the formulation I trust more

Spe salvi contains a line that became extremely important to my own understanding of hope. Benedict XVI describes serious and upright human conduct as “hope in action.” Human beings pursue lesser and greater hopes, work toward futures they value, and open possibilities even though the ultimate ground of Christian hope exceeds what human effort can guarantee (Benedict XVI, 2007, §35).

This gave me the formulation I now find much more convincing than passive optimism:

Hope begins where responsible control ends, not where responsible action is abandoned.

That sentence requires careful interpretation. It does not mean hope begins only after every conceivable action has been exhausted in obsessive fashion. It means that hope and agency are not enemies.

If something matters, I can investigate, act, seek help, reduce preventable risks, use the best information available and create fallback paths. Eventually I may reach a boundary where I cannot control the result. That boundary is not evidence that action was useless. It is the point at which action must coexist with uncertainty. This is the form of hope I find much easier to trust.

Hope can be intense without pretending to be knowledge

This also corrected another possible mistake: a rigorous theology of hope does not require emotional detachment. I do not have to say:

“Because I cannot know the future, I should avoid wanting anything strongly.”

That would turn epistemic humility into emotional anaesthesia.

I can want a good with enormous intensity. I can work for it. I can pray for it. I can fear losing it. And still say:

“I do not know whether it will happen.”

Formally:

intensity(desire) ≠ probability(outcome)

But if the hoped-for good actually occurs, humility does not prohibit joy. Quite the opposite. Because I did not regard the outcome as my possession in advance, I can receive it as gift rather than confirmation of my omniscience. This is where I finally found a version of the miracle in Rohmer that I can embrace without adopting Félicie’s epistemology.

The harder theological question is who suffers while I hope

Catholic hope also refuses to remain a private psychological asset. Hope is ordered toward charity. Prudence discerns the true good and appropriate means; justice concerns giving the other person what is due (Catholic Church, 1992, §§1806–1807). This changes the question.

Instead of asking only:

“Was Félicie’s hope eventually fulfilled?”

I also want to ask:

Who suffered while she hoped?

That question is not hostile to hope. It is what prevents hope from becoming egocentric. A hope that requires me to stop seeing my neighbour has become spiritually suspicious, even if the desired event later occurs. That is why Loïc matters so much to me.

Félicie is not evil but sincerity is not a complete moral defence

I want to resist caricaturing her. Félicie is not a calculating villain. She does not seem to enjoy making Loïc suffer. She does not seem delighted by Maxence’s pain. She loves Élise. She can recognize goodness. She admits that she is demanding. She feels shame when she realizes how her decisions affect Maxence. She is often very sincere.

But sincerity is only one virtue. A person can sincerely express an emotion while remaining unjust in the way that emotion is imposed on others. A person can honestly describe a desire while failing to perceive the system of care that makes pursuing the desire possible. This is why I eventually described Félicie less as hypocritical than as morally incomplete.

Her moral vision is highly developed along the axis of authenticity:

Am I living according to what I genuinely love?

It is less developed along another axis:

What is my way of preserving that authenticity asking other people to endure?

The second question is where Loïc enters.

The reliable person can become invisible infrastructure

There is a broader relational insight here that goes far beyond this film. The more reliably somebody carries weight, the easier it is to forget that carrying has a cost. A person who consistently answers becomes “the person who is always available.” A person who remains calm becomes “the person who can handle it.” A person who forgives becomes “the person who will understand.” Eventually a virtue can become infrastructure.

This is morally dangerous because infrastructure is precisely what we stop noticing when it works. Loïc’s capacity for generosity can therefore become the condition that allows Félicie’s instability to continue with lower immediate cost. Another person’s virtue can unintentionally subsidize my irresponsibility.

That insight is one reason I no longer think the question “Does Félicie have the right to choose freely?” is enough. Of course she does. The next question is what she does with the people who make that freedom survivable.

What would justice require if romantic love cannot be required?

Justice cannot require Félicie to manufacture desire for Loïc. So what might it require? I think the answer concerns recognition. She can recognize:

  • that his availability is costly;
  • that continuing to use romantic intimacy while denying romantic possibility can become cruel;
  • that he may need distance;
  • that his generosity does not make him infinitely durable;
  • and that her happiness does not erase his grief.

In other words, reciprocity need not mean symmetrical emotion. It can mean mutual recognition of personhood and cost. This is much closer to what I want from an ethics of love.

Why I cannot simply condemn Félicie either

And yet, after all this criticism, I still cannot simply turn against her. She has one insight that I think is genuinely strong: choosing somebody permanently because he is good, safe and available is not automatically more ethical than refusing him. Loïc’s goodness cannot compensate for an erotic reality that does not exist. Maxence’s practical suitability cannot turn limited love into absolute love by administrative decision.

If Félicie married or permanently committed herself to one of them merely because probability said Charles was unlikely to return, she might create an even more serious injustice. This is why her refusal of false permanence deserves respect. The problem lies less in refusal itself than in the relational architecture surrounding the refusal.

Can I refuse possession without turning others into provisional resources? Can I remain faithful to an unresolved love while telling the truth about what I can and cannot offer people in the present? Can freedom become responsible without ceasing to be freedom? Those questions are much harder than declaring Félicie either selfish or saintly.

The million-Félicies problem

One thought experiment continued to bother me because it exposes exactly what narrative selection can hide. Imagine one million Félicies. Each has lost an extraordinary love through some accident. Each preserves hope for years. Each avoids permanent attachment partly because of the possibility of reunion. In one case, the missing beloved appears on a bus. In the other 999,999 cases, he does not.

Which story becomes a Rohmer film? Obviously the bus. And once the camera selects that life, the earlier hope acquires retrospective radiance. This is not a criticism of storytelling. Stories necessarily select. It is a warning against using narrative success as a probability model. The rare event may be real. It may even be beautiful beyond measure. It remains rare.

The miracle is morally incomplete if the camera stops too soon

By the end I realized that my strongest criticism of the film was no longer epistemological. It was moral and theological. Suppose I grant everything. Suppose Félicie’s hope is admirable. Suppose the bus encounter can be interpreted as grace. Suppose Shakespeare has correctly prepared us for restoration. Suppose the Pascalian wager has been narratively vindicated. There is still a question:

Does grace become complete simply because the person whose perspective we have followed is happy?

I do not think so.

If Christian hope culminates in reconciliation, then fulfilled hope should enlarge the field of concern, not shrink it. The camera should be able to look toward Loïc. And Maxence. And Élise. And the years that cannot be returned. Restoration is not deletion.

This is where the film finally became more beautiful to me

Strangely, I think I love A Tale of Winter more after refusing several of its easiest interpretations. I do not need Félicie to be a saint. I do not need her certainty to be perfectly calibrated. I do not need Charles’s return to prove that inward conviction functions as prophecy. I do not need Loïc’s suffering to be secretly compensated off-screen. I do not need Élise’s tear to have only one emotional meaning. I do not need providence to be detectable as a violation of ordinary causality.

The film is richer when all those tensions remain active. Rohmer gives Félicie the miracle. I can rejoice with her. But I can also ask what the miracle does not solve.

What Loïc finally taught me

I began the film thinking primarily about Félicie’s faith. I ended thinking about Loïc’s presence. He does something much less spectacular than seeing the future. He stays. He listens. He helps. He thinks seriously about what Félicie says even when he disagrees. He suffers jealousy without turning it into ownership. He prays for a happiness that may exclude him.

And yet the lesson I take from him is not that love means accepting endless pain. It is that love becomes morally serious when it survives contact with another person’s vulnerability without abolishing the giver’s own personhood. That is why I keep returning to:

Loïc’s generosity without Loïc’s disappearance of self.

It may be the most convincing form of love available anywhere in the film.

Hope, faith and certainty are finally three different things

After all this, I would distinguish the three words in my title very carefully. Certainty concerns how strongly I experience something as true. Certainty can be psychologically authentic and still mistaken. Human hope concerns a desired future whose fulfilment I do not possess. It can be rational or irrational, active or passive, generous or egocentric, depending on how it relates to evidence and action. Theological hope is something larger. In Christian terms, its final object is not Charles or any other finite desired outcome. It is grounded in God and therefore can take up finite hopes without making any single finite good absolute (Catholic Church, 1992).

Faith likewise cannot simply mean “I feel absolutely sure.” Christian faith contains trust, but trust is not the same thing as epistemic overconfidence. This is why Félicie fascinates me. She moves constantly across the borders among all three categories. Sometimes she hopes. Sometimes she claims certainty. Sometimes she interprets that certainty religiously. Sometimes Loïc supplies theological language she did not originally use. Sometimes the film itself confirms what reality had not yet confirmed.

The formulation I finally trust

The theology that emerged for me from the film can be stated quite simply, although it took a surprisingly long journey to reach it:

I hope for a future I cannot control. Because I hope, I act faithfully in the present. Because I do not control the future, I remain humble about what I know. And because Christian hope is inseparable from love, I cannot treat other people’s suffering as merely the price of my own fulfilment.

From that follow several principles I now find difficult to separate:

Freedom does not cancel relational responsibility.

Care does not create ownership, but care is not morally meaningless.

Subjective certainty is not external proof.

Hope begins where responsible control ends, not where responsible action is abandoned.

Grace cannot erase justice.

Resurrection cannot mean that one person’s restoration makes everyone else’s loss disappear.

None of these sentences requires me to reject Rohmer’s fairy tale. They simply prevent me from stopping my thinking when the bus door opens.

The question I still cannot leave behind

The traditional emotional question of A Tale of Winter is whether Charles will return. Rohmer answers yes. The more interesting question for me became what happens after that yes. What happens to the moral world that existed before the miracle? What becomes of the people who loved without being chosen? What does the child understand? Which relationships have been restored, and which have merely been displaced? Can fulfilled hope remain attentive to those who did not receive fulfilment?

This is where the title of the film finally acquired a different meaning for me. Shakespeare’s winter does not simply end because one lost person returns. Christian resurrection is not an editing operation that deletes the wounds preceding it. If restoration is truly restoration, it must eventually become large enough to remember what happened to everybody.

So when Charles appears and Félicie receives the extraordinary future she had preserved for five years, I can be happy for her. I can even call the moment miraculous in the narrative sense, and perhaps providential in a theological interpretation that remains humble about causality. But somewhere outside the celebration is Loïc. And that is precisely why I cannot stop at the miracle.

For me, the final theological question of A Tale of Winter is no longer simply:

“Can the lost one return?”

It is:

When the lost one returns, who is now lost?

Rohmer gives no clean answer.

References

  1. Rohmer, É. (Director). (1992). Conte d’hiver [A Tale of Winter]. Les Films du Losange / C.E.R.
  2. Criterion Collection. (n.d.). A Tale of Winter (1992). The Criterion Collection. https://www.criterion.com/films/29649-a-tale-of-winter
  3. Smith, I. S. (2024, February 13). Eric Rohmer’s Tales of the Four Seasons — Another Year. The Criterion Collection. https://www.criterion.com/current/posts/8387-eric-rohmer-s-tales-of-the-four-seasons-another-year
  4. Jamet, X. (2019, January 9). Éric Rohmer, mode d’emploi. La Cinémathèque française. https://www.cinematheque.fr/article/1357.html
  5. Andrew, G. (2015). Eric Rohmer original film posters. British Film Institute. The BFI describes A Tale of Winter as a study in “reason and responsibility, fidelity and faith.” https://www.bfi.org.uk/features/eric-rohmer-original-film-posters
  6. Shakespeare, W. (n.d./2016). The Winter’s Tale, Act 5, Scene 3. Folger Shakespeare Library. https://www.folger.edu/explore/shakespeares-works/the-winters-tale/read/5/3/
  7. Amiel, V. (2013). Le cinéma d’Éric Rohmer ou la transcendance comme un jeu. In Rohmer en perspectives. Presses universitaires de Paris Nanterre / OpenEdition Books. https://books.openedition.org/pupo/40162
  8. Herpe, N. (2013). Des Contes des quatre saisons à L’Anglaise et le Duc — La chute dans la parole. In Rohmer en perspectives. Presses universitaires de Paris Nanterre / OpenEdition Books. https://books.openedition.org/pupo/23630
  9. Moltmann, J. (1967/1993). Theology of Hope — On the Ground and the Implications of a Christian Eschatology. Fortress Press. https://books.google.com/books/about/Theology_of_Hope.html?id=sWPIcMupDeAC
  10. Catholic Church. (1992). Catechism of the Catholic Church — The judgment and formation of conscience, §§1777–1788. The Holy See. https://www.vatican.va/content/catechism/en/part_three/section_one/chapter_one/article_6/i_the_judgment_of_conscience.html
  11. Catholic Church. (1992). Catechism of the Catholic Church — The human virtues, especially §§1806–1807. The Holy See. https://www.vatican.va/content/catechism/en/part_three/section_one/chapter_one/article_7/i_the_human_virtues.html
  12. Catholic Church. (1992). Catechism of the Catholic Church — The theological virtues, especially §§1817–1819. The Holy See. https://www.vatican.va/content/catechism/en/part_three/section_one/chapter_one/article_7/ii_the_theological_virtues.html
  13. Benedict XVI. (2005, December 25). Deus caritas est, especially §7. The Holy See. https://www.vatican.va/content/benedict-xvi/en/encyclicals/documents/hf_ben-xvi_enc_20051225_deus-caritas-est.html
  14. Benedict XVI. (2007, November 30). Spe salvi, especially §§2, 35 and 41. The Holy See. https://www.vatican.va/content/benedict-xvi/en/encyclicals/documents/hf_ben-xvi_enc_20071130_spe-salvi.html

阿狄森氏病 (Addison’s Disease) 危险的“隐形性”

医学说明:本文仅用于一般性教育、残障意识普及以及帮助机构理解相关问题,不提供医疗建议、诊断、急救指示或个体化治疗建议。阿狄森病与肾上腺危象应依据患者个人的临床方案,并在专业医疗人员指导下进行管理。肾上腺危象属于医疗急症,需要立即治疗并紧急就医(NICE, 2024)。

关于阿狄森病,一个最危险的误解,往往恰恰始于一种看似令人安心的现象:一个人可能看起来完全健康。他们可以无需帮助地走进大学办公室,参加研讨课,正常交谈,旅行、工作、运动、谈笑,看起来与房间里的任何其他人没有区别。观察者很容易把这种外在表现转化成一个医学结论:这个人看起来很健康,因此病情不可能有多严重。

然而,对于阿狄森病而言,这种推论可能完全错误。

阿狄森病是一种原发性肾上腺功能不全,患者的肾上腺皮质无法产生足够的皮质醇,通常也无法产生足够的醛固酮。皮质醇对于人体生理调节以及应对应激至关重要;醛固酮则参与钠、钾、体液容量以及血压的调节。激素替代治疗能够使许多阿狄森病患者过上充实、积极的生活,但替代治疗并不能治愈肾上腺本身的功能衰竭,也无法消除发生肾上腺危象的可能性(Bornstein et al., 2016; Dong et al., 2026; NICE, 2024)。

这便形成了理解这种疾病时一个非常核心的悖论:阿狄森病管理得越好,其他人反而越容易低估它。

成功的治疗可以把许多外在症状控制到足够轻微,以至于患者对治疗持续存在的生理依赖,在社会交往中变得“不可见”。患者之所以看起来健康,部分原因正是药物、规划、自我管理以及生理补偿正在发挥作用。因此,外观上的正常其实可以是疾病管理成功的证据;它并不是潜在生理脆弱性已经消失的证据。

阿狄森病被明确描述为一种“隐形残障”

隐形残障”并不是外界随意赋予阿狄森病的修辞性标签。英国 Addison’s Disease Self-Help Group(阿狄森病自助组织)在其临床顾问小组支持下编写的指导中,明确将肾上腺功能不全——包括阿狄森病——描述为“一种罕见疾病和一种隐形残障”。该组织指出,这类疾病是终身性的,可能严重影响正常的日常活动,如果不接受治疗甚至可能致命;与此同时,该组织也强调,并非所有肾上腺功能不全患者都把自己认同为残障人士,而且每个人在法律上的具体情况仍需个别判断(ADSHG, 2025)。

这里的“隐形”必须被谨慎理解。它并不是说这种疾病没有症状,也不是说这些影响只是主观想象,更不是说每一个阿狄森病患者都会经历完全相同的限制。

“隐形”真正意味着的是:许多医学上非常重要的影响,并不会立即出现在旁观者的视野中。

慢性疲劳并不一定改变一个人的外貌。体位性低血压可能只有在患者起身、脱水,或身体承受生理应激时才表现出来。严格的服药时间表,如果没有人亲眼看到患者吃药,本身也是不可见的。紧急用氢化可的松注射套件可能一直放在包里。围绕疾病、补液、盐分平衡、温度、旅行、睡眠、医疗预约以及恢复安排所进行的大量额外规划,绝大多数时候也都不为外人所见。

这种差异非常重要,因为可见的残障会自动向观察者传递信息。轮椅、白手杖、假肢或其他明显的辅助设备,会立即提醒他人:关于行动能力、可及性以及身体功能的通常假设可能需要重新考虑。

但隐形残障没有这种自动信号。

观察者必须首先知道这种疾病的存在,相信患者所提供的信息,并抵抗一种非常直觉性的倾向:把外表当作生理能力的代理指标。

误解正是从这里开始的。

患者之所以看起来健康,恰恰可能是因为治疗正在发挥作用

这里还有一个尤其重要的法律与概念问题。英国关于《Equality Act 2010》(《平等法案 2010》)的指导文件明确讨论了那些症状因治疗而得到控制的疾病。

在判断某项损害是否构成“实质性不利影响”时,该指导指出,原则上应考虑:如果没有这些治疗或纠正措施,其影响本来会是什么样。指导文件还明确承认,持续治疗可能把某种残障掩盖或改善得非常充分,以至于其影响“完全得到控制,或者完全看不出来”(Office for Disability Issues, 2011)。

这一原则与阿狄森病尤其契合。

激素替代治疗并不仅仅是让患者“感觉好一点”。皮质醇是维持生命所必需的。在原发性肾上腺功能不全中,糖皮质激素替代治疗是在补充肾上腺已经无法充分产生的激素;而当醛固酮功能不足时,则需要矿物皮质激素替代治疗(Bornstein et al., 2016)。

因此,一个站在行政人员面前、看起来完全健康的人,实际上可能始终依赖替代治疗来维持一种在健康人身上会自动完成的基础生理功能。

这形成了我所称的“成功补偿悖论”

一种治疗越成功地掩盖严重功能损害在外观上的后果,一个不了解情况的观察者就越容易认为这种损害“不严重”。

但这种推理恰恰是倒过来的。

一个高度近视的人,不会因为眼镜效果很好,就意味着其原本的视力损害已经不存在。

一个癫痫控制良好的人,也不会因此证明癫痫从来都不严重。

同样,阿狄森病患者接受有效激素替代治疗,并不意味着肾上腺皮质已经恢复了正常的生理应激反应能力。

一种疾病完全可以既得到良好管理,同时仍然具有医学上的严重性。

看起来健康,可以说明治疗正在起作用。它并不能证明治疗已经不必要,也不能证明症状不存在,更不能证明潜在疾病本身很轻微。

“隐形”并不等于“没有症状”

另一个值得纠正的误解是:把阿狄森病称为隐形残障,并不意味着患者在出现肾上腺危象之前,平时完全没有任何可感知的影响。

慢性或长期疲劳,是肾上腺功能不全最常见的症状之一。患者还可能出现肌肉无力、食欲下降、胃肠道症状、低血压、站立时头晕甚至晕厥、嗜盐等表现(NIDDK, n.d.)。

NICE 还明确指出,在监测糖皮质激素替代不足时,临床人员应考虑一种情况:疲劳严重到显著影响日常生活活动(NICE, 2024)。

疲劳”这个词本身也容易导致误解,因为几乎所有人都知道普通的“累”是什么感觉。当人们听到“疲劳”时,很容易在脑中自动把它翻译成“忙了一天,有点累”。

但慢性疾病相关的疲劳,在功能意义上可能完全不同。

它可以影响专注力、耐力、体力活动能力、疾病或体力消耗后的恢复需求,以及一个人在漫长的一天中持续维持同等表现的能力。

更重要的是,严重程度会因人而异,也会随时间变化。

一个人能够做某件事情一次,并不意味着他能够反复、安全地完成同样的活动,也不意味着他无需付出异常高的恢复成本。

关于生活质量的研究也支持这一点。一项关于肾上腺疾病患者生活质量的系统综述发现,治疗确实能够改善生活质量,但并不一定能够使其完全恢复到正常水平(Ho & Druce, 2018)。

近期发表在 The Lancet Diabetes & Endocrinology 上的一篇阿狄森病综述同样强调:尽管接受皮质类固醇替代治疗,阿狄森病患者的生活质量仍低于普通人群,死亡率也仍然较高。一个可能的原因,是传统替代治疗无法真正模拟人体天然皮质醇分泌的昼夜节律和超日节律(Dong et al., 2026)。

这一点对于大学和工作环境尤其重要,因为残障往往是通过“看得见的表现”来被判断的。

一个学生参加了两小时研讨课,于是有人就认为他们一定也能在同样条件下完成八小时的一整天。

一个人成功来到某次预约,于是别人就假定这趟路程一定很轻松。

某人完成了一场考试,于是环境条件就被认为“不可能对他们造成影响”。

一个人在二十分钟的会议里看起来精神不错,于是慢性疲劳就被认为“不可能很严重”。

这些判断把某一时刻观察到的表现长期可持续的功能能力混为一谈。

“看起来很好”背后,其实存在大量不可见的工作

慢性病管理本身,也包含大量他人很少看见的工作。

药物必须随时可用,并按照规定时间服用。

当患者生病时,需要额外关注,因为生理应激会改变糖皮质激素需求。

紧急用药必须随身准备。

旅行可能需要制定备用方案。

医疗监测需要投入时间。

患者可能必须不断考虑补液、盐分平衡、药物可及性、胃肠道疾病、身体应激,以及当前情况是否正在超出日常替代治疗所能覆盖的范围。

ADSHG 的职场指导特别提到,肾上腺功能不全患者可能面临能量水平波动、药物必须按时服用、疾病或受伤后的恢复时间可能更长、肾上腺危象风险,以及需要进行应急准备等实际问题(ADSHG, 2025)。

但这些并不会在普通互动中自动显现出来。

一个行政人员可能只看到某人平静地坐在桌前,却看不到使这一小时看似“正常”成为可能的用药安排,不知道对方包里装着紧急注射药物,也不知道对方当天早晨经历过什么样的疲劳,更不知道稍后可能需要怎样的恢复。

因此,成功的自我管理甚至会把它自己的证据从社会感知中抹去。

这里存在一种奇特的不对称:

如果自我管理失败了,疾病会通过明显不适而变得可见。

如果自我管理成功了,为了防止疾病失控而付出的努力本身却变得不可见。

结果就是,一个人可能恰恰在管理得最好时,反而最不容易获得他人的理解。

这也是为什么隐形残障会带来某种社会性的疲惫。

患者可能反复需要解释一些真实但目前看不见的风险,描述会波动的限制,并在任何明显医学恶化发生之前,为自己的合理调整请求提供辩护。

而另一种选择——等到疾病严重到肉眼可见之后,才让所有人相信——显然是一种极其糟糕的残障支持模式。

温度问题说明:环境可能非常重要,但并不意味着它是所有人的普遍症状

温度问题尤其需要谨慎讨论,因为个体经验可能非常显著,但现有证据并不足以证明“所有阿狄森病患者都具有极端温度敏感”。

主要临床指南并没有把一种统一的、普遍性的慢性温度不耐受综合征列为阿狄森病的定义性表现。

更严谨的说法是:环境条件可以改变人体的生理负荷,而对于某些具体个体,这些环境因素可能具有非常实际的重要性。

炎热天气尤其值得关注,因为出汗会影响体液和盐分平衡。

ADSHG 关于炎热天气的指导指出,阿狄森病或肾上腺功能不全患者在高温环境中可能更难管理病情,并特别强调补液以及盐分和体液平衡的重要性(ADSHG, 2026)。

在一项关于肾上腺危象的前瞻性研究中,炎热也被记录为部分危象发生前的诱发情境之一,虽然在该研究队列中,胃肠道感染、发热和情绪应激是更常见的诱因(Hahner et al., 2015)。

这很好地说明了为什么合理调整必须个体化。

如果某个具体患者已经有医学文件证明其难以耐受高温或其他环境条件,那么仅仅因为“并非所有阿狄森病患者都会这样”,就否认这个人的限制,并不符合科学严谨性。

英国《Equality Act》相关指导本身也承认,温度、湿度、一天中的时间、疲劳和压力等环境因素,都可能加重或减轻某种损害的影响,因此在评价功能影响时应予以考虑(Office for Disability Issues, 2011)。

因此,正确的结论既不是:

“所有阿狄森病患者都极端怕热或怕冷”,

也不是:

“因为温度敏感不是所有人的诊断性症状,所以温度不可能产生影响。”

更合理的结论是:环境耐受性属于个体功能问题,而高温对于肾上腺功能不全患者的体液和盐分管理具有合理且有文献支持的相关性。

最重要的脆弱性,是缺失了自动的生理应激反应

阿狄森病的日常负担很重要,但这种疾病还存在更深一层的脆弱性。

正是这一点解释了:即使一个人平时感觉相当不错,疾病仍然必须被认真对待。

对于肾上腺功能正常的人来说,当身体面临显著疾病、创伤或手术等生理应激时,糖皮质激素需求会发生变化,人体的下丘脑—垂体—肾上腺轴会自动参与调节,以增加或调整皮质醇供应。

而在原发性肾上腺功能不全患者中,受损的肾上腺皮质已经无法产生这种正常的适应性反应。

因此,额外所需的糖皮质激素支持必须通过治疗来提供(Bornstein et al., 2016; NICE, 2024)。

这种脆弱性几乎无法通过外貌识别。

在基础状态下,治疗可能完全充分。

患者可能感觉不错,看起来也完全健康。

然后,生理环境发生变化:

感染出现;

体温升高;

开始呕吐;

腹泻导致体液丢失;

发生手术或创伤;

或者其他重要应激增加了糖皮质激素需求。

肾上腺无法像健康人的肾上腺那样,简单地增加皮质醇输出去匹配新的需求。

因此,治疗管理必须及时并适当地随之改变。

这正是为什么“稳定”和“没有脆弱性”并不是同义词。

所谓稳定,只描述了当前生理需求与现有支持之间的关系。

而阿狄森病患者的这种平衡,依然依赖于替代治疗和应急准备。

一个稳定的患者并不意味着正在“隐秘地经历肾上腺危象”,也不应该把阿狄森病患者描绘成永远处在死亡边缘。

很多患者在良好照护下能够过非常完整、积极的生活。

但他们对于某些生理应激的反应机制,确实与肾上腺功能正常的人存在根本区别,而这种区别可能在很短时间内变得非常重要(NICE, 2024)。

这就是为什么“看起来健康”与“医学上脆弱”可以同时成立

对于不了解阿狄森病的人来说,这种看似矛盾的现象可能是最需要理解的一点。

一个人早上十点时完全可以真正处于良好状态,同时又确实拥有一种医学脆弱性,使得当天稍晚发生的感染、胃肠道疾病或其他生理应激变得更加危险。

这里没有任何矛盾。

第一句话描述的是当前状态。

第二句话描述的是:一旦状态发生变化,这个生理系统所拥有的适应能力受到限制。

可以把它理解为当前功能适应性储备之间的区别。

当前功能可以非常好。

但适应性的内分泌储备依然受限,因为肾上腺皮质无法自主产生正常的皮质醇应激反应。

日常替代治疗提供基础情况下所缺失的激素。

生病时的调整方案和急救方案,则在生理需求增加时提供额外支持。

一个人的外在表现主要告诉我们前者——这个人在此时此刻的状态。

它几乎无法告诉我们后者。

这也是为什么外表是一个如此糟糕的医学信号。

如果人们看到一个明显受伤的人,很少会因为对方还能正常说话,就推断“这个伤不重要”。

但对于隐形的慢性疾病,外表上的正常很容易被当成某种非正式诊断工具。

观察者会下意识地问:

“这个人看起来像生病吗?”

如果答案是“不像”,他们就可能自动降低对风险的估计。

对于阿狄森病,这会制造出一种我称为“虚假安心”的状态。

这并不完全是“假阳性”,更接近一种“假绿灯”

严格使用统计术语的话,这个问题其实并不适合称为“假阳性”。

如果我们把外貌当成一种粗糙的检测手段,用来判断是否存在严重潜在脆弱性,那么这种错误反而更像“假阴性”:真正的脆弱性存在,但观察者没有识别出来。

然而,这两个词都无法完全概括问题,因为外表原本就根本不是医学检测。

我更喜欢使用“假绿灯”这个说法,借用系统监控中的语言。

一个监控面板可以显示某项服务为绿色,因为进程仍在运行;但对于真正依赖该功能的用户而言,系统可能早已失效。

这个指标技术上确实观察到了某个真实现象,但观察者却试图让它回答一个远远超出其能力的问题。

社会判断中的对应推理大致如下:

观察到:
这个人走路正常
这个人说话正常
这个人参加了课堂
这个人今天看起来状态很好

于是推断:
因此体力耐受正常
因此耐热能力正常
因此疾病后的恢复能力正常
因此不存在重要残障
因此医学风险很低

问题不在观察本身,而在推论。

这个人确实走路正常。

这个人确实说话正常。

错误在于:把这些观察当成另一些变量的证据,而这些观察根本没有测量那些变量。

对于一种内分泌疾病而言,外貌是一种信息量极低的“健康检查”。

这个问题比“不了解一种罕见病”更加深层。

它涉及一种可见性偏差:人们天生容易更加重视自己能够看到的损害,而低估无法直接看到的生理依赖。

阿狄森病还增加了一层复杂性,因为有效治疗本身就会降低可见性。

于是,这种疾病能够制造一个真正的认识论陷阱

症状越被控制得好,

别人反而越容易把这种成功控制误认为“原本就没有严重风险”。

补偿机制运行得越成功,观察者就越容易忘记,究竟是什么东西正在被补偿。

当“虚假安心”开始影响他人的行为时,它就可能变得危险

误解一种隐形残障,并不仅仅会带来社交层面的不愉快。

它可能直接改变决策。

大学部门可能因为学生“看起来很健康”而拒绝环境调整。

同事可能认为对方面对严重疲劳时“忍一忍就行”。

主管可能把残障相关的恢复时间视为普通缺勤。

机构可能因为肾上腺危象听起来太抽象,而根本不制定应急方案。

在急性情况下,旁人甚至是不熟悉肾上腺功能不全的医疗人员,都可能因为患者几个小时前还“看起来很好”,而低估当前恶化的意义。

这里最核心的错误是时间性的。

人们往往期待严重疾病必须持续表现得“看起来很严重”。

但阿狄森病并不一定如此。

一个人可以一直处于良好控制状态,然后突然遇到一个生理应激源,使糖皮质激素需求发生变化。

NICE 明确建议,在显著生理应激情况下需要增加糖皮质激素替代;当怀疑肾上腺危象时,应立即给予肌肉注射或静脉注射氢化可的松。

NICE 也建议准备紧急注射套件并接受相关培训,因为时间非常关键(NICE, 2024)。

这意味着,一旦生理环境已经发生变化,之前的“看起来很健康”几乎不能提供什么安心依据。

“但他今天早上看起来还很好。”

这并不能反驳一场正在发展的肾上腺危象。

它只能证明:

那个人今天早上看起来很好。

写出来以后,这似乎简单到近乎不言自明。

但医学和残障评估中恰恰经常发生这种错误:

把一个瞬间的截图,当作整个过程的轨迹。

肾上腺危象,是隐形脆弱性突然变得可见的时刻

肾上腺危象是一种急性的、危及生命的恶化状态,其核心在于相对于身体当前的生理需要,糖皮质激素作用不足,并常伴随血流动力学不稳定以及其他系统性异常。

NICE 建议,对于重症患者,如果出现低血压、低钠血症、低血糖、循环性休克或虚脱等表现,应考虑肾上腺危象;而对于已知或高风险的肾上腺功能不全患者,如果出现嗜睡、虚弱、意识混乱、面色苍白或湿冷等表现,也应考虑这种可能(NICE, 2024)。

在呕吐或腹泻时,情况尤其危险,因为可能有两个问题同时发生。

一方面,生理应激和体液丢失增加了身体的负担。

另一方面,口服糖皮质激素可能已经无法被可靠地保留或吸收。

因此,当持续呕吐或腹泻导致口服糖皮质激素无法充分吸收时,NICE 建议给予肠外氢化可的松并接受医院治疗(NICE, 2024)。

这与简单的“今天比平时更累”完全不是一回事。

此时,潜在脆弱性已经与一个急性应激因素相互作用,日常维持治疗途径可能已不再足够。

因此,一个昨天还看起来很好的人,今天完全可能需要急救治疗,而这两件事之间不存在任何矛盾。

这也正是大学和工作单位不应等到一种疾病“变得足够戏剧化、足够肉眼可见”之后,才开始认真对待它的原因。

死亡风险是真实的,但不应被耸人听闻地描述

阿狄森病可以治疗,而肾上腺危象也是一种有明确有效治疗方式的医疗急症。

因此,把病情控制良好的阿狄森病患者描述成“每天都在死亡边缘生活”,既不准确,也会造成不必要的恐惧。

但与此同时,淡化肾上腺危象潜在的致命性,同样是不准确的。

NICE 明确指出,未经治疗的肾上腺功能不全可以发展为肾上腺危象,而肾上腺危象可能致命(NICE, 2024)。

前瞻性数据说明了为什么这种风险值得认真对待。

Hahner 等人对 423 名慢性肾上腺功能不全患者进行了两年随访,在 767.5 患者年中记录到 64 次肾上腺危象,相当于每 100 患者年 8.3 次危象。

随访期间共有 10 名参与者死亡,其中 4 例死亡与肾上腺危象相关,相当于该队列中每 100 患者年 0.5 例肾上腺危象相关死亡。

研究者估计,在该研究中,约有 6% 的危象与死亡相关(Hahner et al., 2015)。

这个数字不应被解释为适用于每一次危象或每一个患者的固定死亡概率。

它描述的是一个具体的前瞻性队列,不同人群中的危象发生率和结局都会有所不同。

一项基于英国大型数据库的研究从另一个角度提供了证据。

Ngaosuwan 等人将 6,821 名肾上腺功能不全患者与匹配对照人群进行比较,发现患者的全因死亡率升高,其中原发性肾上腺功能不全的增幅高于继发性肾上腺功能不全。

在该数据集中,肾上腺危象被记录为参与了大约 10% 的肾上腺功能不全患者死亡事件;而在确诊后的早期阶段,肾上腺危象相关死亡和住院风险尤其升高(Ngaosuwan et al., 2021)。

最新的重要阿狄森病综述也得出类似结论:

尽管接受皮质类固醇替代治疗,较高死亡率和较低生活质量依然值得关注,而肾上腺危象管理以及现有替代治疗方式本身的局限,仍然是需要进一步改善的问题(Dong et al., 2026)。

因此,适当的结论既不是恐慌,也不是掉以轻心。

而是准备。

阿狄森病是可以管理的,但肾上腺危象仍然是一种公认的、潜在致命的并发症。这种疾病真正需要严肃对待的地方,恰恰在于:一个人大部分时间可以非常稳定,但当特定情况发生时,仍然需要迅速而正确的干预。

罕见病还会制造第二种“隐形”

阿狄森病并不常见,而“罕见”本身会产生另一种问题。

除了身体上的不可见性,还存在一种认知上的不可见性

许多行政人员、教师、雇主和同事,可能从未有意识地接触过一位阿狄森病患者。

甚至部分医疗专业人员,也很少实际遇到肾上腺危象。

因此,人们常常会用熟悉的解释框架,去解释一种陌生疾病的症状。

疲劳可能被理解为没睡好。

头晕可能被解释为焦虑。

耐力下降可能被认为是不够努力。

疾病后的恢复时间可能显得“太长”。

关于高温、补液、药物、灵活安排或应急准备的要求,也可能显得“不成比例”,只是因为观察者缺乏能够使这些要求变得合理的医学模型。

阿狄森病在诊断方面也因为类似原因而具有挑战。

其症状可以模糊且缺乏特异性,诊断延迟至今仍然是一个重要问题。

Dong 等人在 2026 年的综述中指出,部分患者至今仍然是在第一次发生肾上腺危象时才被确诊,因为此前的症状没有被识别为阿狄森病(Dong et al., 2026)。

于是,身体上的隐形与认知上的隐形可能彼此强化:

罕见疾病
      ↓
公众熟悉度低
      ↓
缺少明显外在信号
      ↓
外表看起来正常
      ↓
风险被低估
      ↓
支持请求显得“过度”
      ↓
疾病变得更容易被忽视

对于残障意识与疾病科普而言,打破这个循环,是最重要的任务之一。

《Equality Act》其实已经预见到了这个问题

对于英国大不列颠地区的大学和雇主而言,这里还存在一个非常重要的法律背景。

《Equality Act 2010》将残障定义为一种身体或精神损害,这种损害对正常日常活动能力造成具有实质性并且长期的不利影响。

相关法定指导明确指出,环境因素、波动性影响以及治疗对症状的掩盖作用,都可能与判断有关。

特别是,在判断潜在损害本身究竟有多严重时,原则上通常应把持续医疗治疗的效果排除出去,也就是考虑如果没有治疗会发生什么(Office for Disability Issues, 2011)。

这对于阿狄森病尤其重要,因为终身用药恰恰可能是使这种功能损害“不再那么明显”的原因。

该指导明确承认,治疗可以使某种损害的表现完全受到控制,甚至“完全不可见”,但这并不意味着在残障认定中,潜在的残障就因此自动消失(Office for Disability Issues, 2011)。

指导还讨论了反复发生以及波动性的影响。

一种损害并不需要在一天二十四小时内每个时刻都产生同样程度的限制,才能被视为重要。

反复出现的影响仍然可以被视为长期影响,而环境条件也可能使某种损害加重(Office for Disability Issues, 2011)。

这直接挑战了隐形残障最常遭遇的一种非正式判断:

“我见到你的时候你看起来很好。”

所以:

“你的残障不可能对你产生实质性影响。”

第二句话无法从第一句话推出。

无论在医学上、功能上,还是在许多情况下的法律上,都无法推出。

大学应该评估可持续的功能能力,而不是某一个“状态不错的小时”

这一点在高等教育环境中尤为重要,因为大学生活本身就是由大量断续的观察组成的。

导师在研讨课上看到学生。

残障顾问在预约时看到学生。

住宿部门在讨论房间时看到学生。

考试工作人员只在某一次考试期间看到学生。

每一个观察者,其实都只看到一个漫长生理日程中的极窄切片。

但学生本人经历的是整个连续过程:

起床;

服药;

通勤;

安排饮食和补液;

参加教学活动;

应对温度和体力消耗;

保持注意力;

恢复;

准备下一项活动;

以及处理任何同时发生的疾病。

两小时看似完全正常的表现,无法告诉行政人员:

完成这两小时到底付出了怎样的代价,

也无法告诉他们,同样的环境是否可以被安全而持续地重复。

这里有一个非常有用的区分:

峰值表现可持续能力

许多残障人士在某些条件下能够完成某项活动。

但对于合理调整而言,真正重要的问题通常是:

他们是否能够反复做到?

是否安全?

是否可以稳定预期?

是否不会付出不成比例的生理成本?

例如,一个学生能够在一个较热的房间中完成一次短暂会面,并不能证明长时间暴露在高温中,对于这个具体个体也是功能上安全和可持续的。

一个人在生病之后能够参加一个上午的活动,并不能证明他们的恢复能力与普通人完全相同。

完成一次漫长的一天,也不能证明疲劳没有产生实质性影响。

合理的残障评估,应当观察长期模式、累积影响以及个体化医学证据,而不是把某一次成功完成的活动,当成一场“从此永久通过”的压力测试。

合理调整应回应功能与风险,而不是回应外表

阿狄森病不存在一个适用于所有人的统一合理调整方案。

个体需求差异非常大。

有些人在某个阶段可能只需要很少调整,甚至不需要任何特别措施。

另一些人则可能存在明显疲劳、体位性症状、环境敏感、其他自身免疫性疾病、反复危象,或者更复杂的治疗史。

ADSHG 在工作场所指导中特别强调这种个体差异,并建议进行沟通、定期复审,同时考虑具体个人的实际需求(ADSHG, 2025)。

在大学环境中,可能相关的调整包括:

对医学必要缺勤或恢复时间给予一定灵活性;

保证药物和饮水可及;

允许参加医疗预约;

对已有医学记录支持的环境限制给予适当考虑;

提供合理休息安排;

以及在适当情况下制定明确的应急方案。

这些只是可能相关的方面,而不是每一位阿狄森病患者都自动需要的固定清单。

更基本的原则其实非常简单:

不要从外表推断一个人的功能能力。了解当事人真实经历的是什么,考虑医学证据,理解对这个具体个体而言真实存在的风险,并围绕这些现实来设计支持。

应急准备必须在“紧急情况变得可见”之前就已经存在

机构还需要理解应急准备背后一种很特殊的逻辑。

一套紧急氢化可的松注射包,可能几年都没有实际使用。

这并不意味着它没有必要。

它的目的,恰恰就是为一种低频但高后果事件提前存在。

NICE 建议原发性肾上腺功能不全患者配备应急管理套件并接受使用培训。

ADSHG 也建议工作场所提高认识并制定应急方案,因为肾上腺危象完全可能发生在家以外的地方(NICE, 2024; ADSHG, 2025)。

一个糟糕的机构应对方式,是等到危象真的发生以后,才开始问:

“什么是阿狄森病?”

更好的应对方式,是事先理解这种疾病;

尊重患者隐私;

在患者同意的前提下,明确谁真正需要掌握相关应急信息;

并确保机构程序不会妨碍紧急救治。

例如,ADSHG 的工作场所指导建议,在合适情况下,可让指定急救人员了解这一诊断,以便在紧急事件中作出有效反应(ADSHG, 2025)。

这种理念是预防性的,而不是制造恐慌。

我们设置消防通道,并不是因为我们认为每一栋建筑每时每刻都在燃烧。

而是因为如果真的发生火灾,届时才发现根本没有出口,其后果不可接受。

对于肾上腺危象的应急准备,逻辑非常相似:

准备本身的合理性,来自事件的严重性与时间敏感性,

而不是来自“危象一直在发生”这种错误想象。

一个人不应该必须先“病得肉眼可见”,才能获得相信

这可能是理解隐形残障最重要的社会性教训。

如果机构只有在功能损害变得外在明显时,才承认残障,那么这个系统其实会反常地奖励恶化。

一个人如果把药物、疲劳、温度、疾病以及日常活动管理得足够好,以至于外表仍然保持功能正常,反而可能比一个身体损害明显到无法否认的人,更难获得支持。

这就制造了一种不合理的证明门槛:

“你说这种疾病给你造成了严重限制。”

“但是你看起来很好。”

“所以,请证明你的限制。”

最后唯一足够有说服力的证据变成:
肉眼可见的恶化。

任何负责任的残障支持制度都不应该这样运作。

合理调整的目的,本来就常常是为了预防本来可以避免的恶化,并让一个人能够在更加公平的条件下参与教育或工作。

要求一个人先遭受实际伤害,然后才愿意减轻一个本来已经已知的劣势,完全违背了这一目的。

对于阿狄森病这样一种生理应激和延迟干预都可能产生严重后果的疾病,这种逻辑尤其不合理。

当然,这并不意味着每一个调整请求都必须被自动接受,也不意味着仅仅有一个诊断,就足以支持任何可能的调整。

大学有权评估个体需求与措施比例性。

关键在于:外貌在这种判断中几乎不应该具有任何分量。

真正相关的证据是:

诊断;

功能影响;

环境互动;

临床建议;

以及当事人的实际经历。

这里还存在一个隐私悖论

隐形残障还会产生另一个难题。

正因为这种疾病无法从外表看出来,患者有时必须主动披露诊断,才能获得支持,或者建立应急方案。

但医疗信息本身属于私人信息。

ADSHG 也正确指出,并不是所有人都愿意把自己的诊断广泛透露给雇主或同事(ADSHG, 2025)。

于是就产生了一个很难处理的平衡。

披露太少,可能意味着紧急情况发生时,没有任何人知道该如何应对。

披露太多,则会不必要地暴露个人健康隐私。

因此,好的机构实践需要的是受控制、有目的的信息传递

真正需要知道某些信息的人,才应该得到这些信息;

而当事人对于保密范围的意愿,应尽可能得到尊重。

在大学中,这可能意味着做出明确区分:

残障支持部门可能需要详细医学文件;

任课教师可能只需要知道功能性调整是什么;

指定的应急人员,则可能需要掌握与肾上腺危象相关的具体信息。

“所有人都应该知道”和“没有人需要知道”,其实都是对一个复杂问题过度简单化的回答。

真正合理的做法,需要仔细划定信息边界。

日常的医学脆弱性,不应该抹去一个人的自主性

这里也存在另一种相反方向的风险。

当人们得知肾上腺危象可能致命之后,可能开始主要把患者看作“脆弱”“依赖”“一直在生病的人”。

这同样是一种扭曲。

阿狄森病患者可以学习、工作、旅行、运动、建立职业生涯,也可以拥有非常完整的人生。

NICE 明确向公众传达:只要得到持续、良好的信息与照护,肾上腺功能不全患者可以过充实而积极的生活(NICE, 2024)。

因此,疾病意识普及的目标,不应该是用家长主义取代低估。

真正需要同时保留的是两个事实:

这个人可能能力很强,
独立自主,
而且外表完全健康。

同时

这个人确实患有一种永久性内分泌疾病,
它具有真实的日常影响,
并存在潜在致命的失代偿模式。

这两件事并不互相抵消。

因此,“脆弱性”这个词本身也需要谨慎使用。

这里所说的脆弱性,是一种生理依赖,以及在特定应激情况下较低的安全余量。

它并不是对一个人性格、智力、能力或自主性的描述。

阿狄森病患者周围的人真正需要理解什么

对于大多数同事、导师、行政人员或朋友而言,他们并不需要详细理解类固醇生物化学。

他们不需要变成内分泌专家。

他们真正需要的是一个正确的心理模型。

这个模型其实可以非常简洁:

阿狄森病是一种终身性的肾上腺激素产生障碍。

替代治疗可以让患者看起来正常,也可以让他们在日常生活中正常工作和活动。

但替代治疗无法恢复肾上腺对于生理应激自动增加皮质醇供应的能力。

慢性疲劳和低血压等症状仍然可能影响日常功能。

对于具体个人,一些环境因素也可能非常重要。

显著疾病会改变糖皮质激素需求。

呕吐和腹泻尤其可能危险,因为口服药物的吸收可能变得不可靠。

肾上腺危象相对于普通日常生活而言并不常见,但它确实是一种真实的、时间敏感的、可能致命的医疗急症。

因此,支持应该依据这个人真实的功能需求以及个人医疗方案来制定,而不是依据他们是否“看起来像残障人士”(NICE, 2024; ADSHG, 2025)。

如果一个大学部门最后只能记住一句话,我会选择这句话:

阿狄森病患者可能看起来完全健康,因为治疗和自我管理正在成功地维持其稳定状态;这种外在可见的稳定,绝不应该被误认为不存在残障、不存在症状,也不应该被误认为不存在医学脆弱性。

更深层的问题,既是医学问题,也是认识论问题

我越思考隐形残障,越觉得真正的问题不仅是人们懂不懂医学,而在于:我们到底如何判断什么才算证据。

人类非常容易受到可见信息影响。

我们天然更相信自己能看到的东西。

一条明显骨折的腿,会立即提供证据。

激素依赖、降低的生理储备、慢性疲劳、体位性症状以及危象风险,则不会。

这使阿狄森病成为一个特别清晰的例子,揭示一个更广泛的认识论问题:

看不见证据,很容易被误认为“证据表明它不存在”。

而成功治疗会让这个问题更加严重,因为治疗本身就在主动消除一些原本可能看得见的疾病表现。

于是,因果链甚至显得有些讽刺:

严重慢性疾病
        ↓
有效治疗与精心自我管理
        ↓
患者看起来很好
        ↓
观察者看不到多少功能损害
        ↓
观察者低估疾病
        ↓
支持被认为“不需要”

最后那个结论完全反了。

这个人之所以看起来很好,恰恰是因为整个管理系统正在成功运行。

这也是为什么我认为“虚假安心”比“假阳性”更合适。

这里并不存在一个失灵的实验室检测。

真正失败的是解释本身。

一个真实观察——“这个人看起来很好”——被强行用来证明一个它根本无法证明的结论:

“所以这个人拥有普通人的生理韧性,也不存在实质性残障。”

如果用工程学语言,我会把这叫作一个设计糟糕的系统健康检查。

而在残障意识语境中,更值得记住的结论是:

可见性从来都不是严重程度的可靠代理指标。

“看起来很好”应该是理解的起点,而不是理解的终点

阿狄森病呈现出一种非常特殊的组合:

正常与脆弱,可以同时存在。

治疗可以恢复足够的生理功能,使日常生活在外观上完全普通。

但这种看起来普通的生活之中,仍然可能存在慢性疲劳、能量波动、低血压、药物依赖、环境限制、更多恢复需求,以及持续的应急准备。

最重要的是,由于患者无法在生理应激下产生正常的皮质醇反应,这种疾病留下了一种潜在脆弱性。

在特定情况把它暴露出来之前,这种脆弱性绝大多数时候都是不可见的。

当然,这并不意味着每一个阿狄森病患者都经历相同程度的残障,都需要相同的合理调整,或者每天都处于危险之中。

个体差异是真实存在的。

好的支持体系也应该保留这种复杂性。

但个体差异不能成为淡化疾病的理由。

真正合理的反应,是个体化理解。

肾上腺危象可能致命这一事实,使这种理解格外重要。

一种疾病并不需要每天看起来都很严重,才可能拥有一个危险的失效模式。

事实上,阿狄森病的一部分危险恰恰来自这样一种共存:

一种真实而严重的脆弱性,可以与极其普通、甚至看起来完全健康的日常生活同时存在。

这不是矛盾。

这正是成功治疗使之成为可能的状态。

因此,对于大学、雇主,或者任何第一次接触阿狄森病的人来说,真正的结论其实很简单,但意义重大:

在要求视觉证明之前,先相信医学现实。

评估一个人的可持续功能能力,而不是某一个瞬间的外表。

在有医学记录支持时,认真对待疲劳与环境限制。

尊重个人隐私和自主性。

对可预见的紧急情况做好合理准备。

并理解:

站在你面前、看起来完全健康的人,

完全可能在此时此刻确实状态良好,

同时也确实具有真实的医学脆弱性。

这两个事实,本来就应该同时成立。

参考文献

Addison’s Disease Self-Help Group. (2025). Employment and Addison’s or adrenal insufficiency. Published 8 July 2025; updated 11 September 2025. https://www.addisonsdisease.org.uk/employment-and-adrenal-insufficiency

Addison’s Disease Self-Help Group. (2025). Guidance for employees. https://www.addisonsdisease.org.uk/guidance-for-employees

Addison’s Disease Self-Help Group. (2026). Hot weather. Updated 15 July 2026. https://www.addisonsdisease.org.uk/hot-weather

Bornstein, S. R., Allolio, B., Arlt, W., Barthel, A., Don-Wauchope, A., Hammer, G. D., Husebye, E. S., Merke, D. P., Murad, M. H., Stratakis, C. A., & Torpy, D. J. (2016). Diagnosis and treatment of primary adrenal insufficiency: An Endocrine Society clinical practice guideline. The Journal of Clinical Endocrinology & Metabolism, 101(2), 364–389. https://doi.org/10.1210/jc.2015-1710

Dong, J., Hahner, S., Bancos, I., & Tomlinson, J. W. (2026). Clinical features, investigation, and management of Addison’s disease. The Lancet Diabetes & Endocrinology, 14(3), 243–258. https://doi.org/10.1016/S2213-8587(25)00393-6

Hahner, S., Spinnler, C., Fassnacht, M., Burger-Stritt, S., Lang, K., Milovanovic, D., Beuschlein, F., Willenberg, H. S., Quinkler, M., & Allolio, B. (2015). High incidence of adrenal crisis in educated patients with chronic adrenal insufficiency: A prospective study. The Journal of Clinical Endocrinology & Metabolism, 100(2), 407–416. https://doi.org/10.1210/jc.2014-3191

Ho, W., & Druce, M. (2018). Quality of life in patients with adrenal disease: A systematic review. Clinical Endocrinology, 89(2), 119–128. https://doi.org/10.1111/cen.13719

Ngaosuwan, K., Johnston, D. G., Godsland, I. F., Cox, J., Majeed, A., Quint, J. K., Oliver, N., & Robinson, S. (2021). Increased mortality risk in patients with primary and secondary adrenal insufficiency. The Journal of Clinical Endocrinology & Metabolism, 106(7), e2759–e2768. https://doi.org/10.1210/clinem/dgab096

National Institute for Health and Care Excellence. (2024). Adrenal insufficiency: Identification and management (NICE guideline NG243) — Recommendations. https://www.nice.org.uk/guidance/ng243/chapter/Recommendations

National Institute for Health and Care Excellence. (2024). Adrenal insufficiency: The care you should expect — Information for the public. https://www.nice.org.uk/guidance/ng243/informationforpublic

National Institute of Diabetes and Digestive and Kidney Diseases. (n.d.). Symptoms & causes of adrenal insufficiency & Addison’s disease. National Institutes of Health. https://www.niddk.nih.gov/health-information/endocrine-diseases/adrenal-insufficiency-addisons-disease/symptoms-causes

Office for Disability Issues. (2011). Equality Act 2010 guidance on matters to be taken into account in determining questions relating to the definition of disability. UK Government. HTML version published 2022; original guidance first published May 2011. https://www.gov.uk/government/publications/equality-act-guidance/disability-equality-act-2010-guidance-on-matters-to-be-taken-into-account-in-determining-questions-relating-to-the-definition-of-disability-html

La pericolosa invisibilità della malattia di Addison (morbo di Addison)

Nota medica: Questo articolo ha finalità esclusivamente informative, di sensibilizzazione sulla disabilità e di comprensione da parte delle istituzioni. Non fornisce consulenza medica, diagnosi, istruzioni di emergenza né raccomandazioni terapeutiche personalizzate. La malattia di Addison e la crisi surrenalica devono essere gestite secondo il piano clinico individuale del paziente e sotto la guida di professionisti sanitari. La crisi surrenalica è un’emergenza medica e richiede un trattamento immediato e un’assistenza medica urgente (NICE, 2024).

Uno dei fraintendimenti più pericolosi riguardo alla malattia di Addison nasce da qualcosa che, a prima vista, può sembrare rassicurante: una persona può apparire completamente sana. Può entrare senza assistenza in un ufficio universitario, partecipare a un seminario, sostenere normalmente una conversazione, viaggiare, lavorare, fare attività fisica, ridere e non sembrare diversa da nessun’altra persona presente nella stanza. Per un osservatore è facile trasformare quell’apparenza in una conclusione medica: sembra in buona salute, dunque la sua condizione non può essere poi così grave. Nel caso della malattia di Addison, questa deduzione può essere profondamente errata.

La malattia di Addison è una forma di insufficienza surrenalica primaria nella quale la corteccia surrenale non è in grado di produrre quantità adeguate di cortisolo e, generalmente, neppure quantità adeguate di aldosterone. Il cortisolo è essenziale per la regolazione fisiologica dell’organismo e per la risposta allo stress, mentre l’aldosterone contribuisce alla regolazione del sodio, del potassio, del volume dei liquidi e della pressione arteriosa. La terapia ormonale sostitutiva può consentire alle persone con malattia di Addison di condurre una vita piena e attiva, ma la terapia sostitutiva non guarisce l’insufficienza surrenalica sottostante, né elimina la possibilità di una crisi surrenalica (Bornstein et al., 2016; Dong et al., 2026; NICE, 2024).

Questo crea un paradosso fondamentale per comprendere la malattia: quanto meglio viene gestita la malattia di Addison, tanto più facile può diventare per gli altri sottovalutarla. Una terapia efficace può attenuare molti dei segni esteriori della malattia al punto da rendere socialmente invisibile la persistente dipendenza fisiologica dal trattamento. La persona appare in buona salute proprio perché i farmaci, la pianificazione, l’autogestione e i meccanismi di compensazione fisiologica stanno funzionando. Un aspetto esteriore normale è quindi una prova del successo della gestione della malattia; non è una prova del fatto che la vulnerabilità sottostante sia scomparsa.

La malattia di Addison è esplicitamente descritta come una disabilità invisibile

L’espressione disabilità invisibile non è semplicemente un’etichetta retorica attribuita dall’esterno. L’Addison’s Disease Self-Help Group del Regno Unito, in una guida sviluppata con il supporto del proprio Clinical Advisory Panel, descrive esplicitamente l’insufficienza surrenalica, compresa la malattia di Addison, come “una condizione rara e una disabilità invisibile”. L’organizzazione spiega che si tratta di condizioni permanenti, che possono compromettere seriamente le normali attività quotidiane e che, se non trattate, possono essere fatali; allo stesso tempo precisa che non tutte le persone con insufficienza surrenalica si identificano personalmente come disabili e che le circostanze giuridiche individuali devono comunque essere valutate caso per caso (ADSHG, 2025).

Il termine invisibile deve essere compreso con attenzione. Non significa che la malattia sia priva di sintomi, che i suoi effetti siano immaginari o che tutte le persone con malattia di Addison sperimentino le stesse limitazioni. Significa che molti degli effetti clinicamente rilevanti non sono immediatamente visibili a un osservatore. La stanchezza cronica non modifica necessariamente l’aspetto di una persona. L’ipotensione ortostatica può manifestarsi soltanto quando la persona si alza in piedi, si disidrata o è sottoposta a stress fisiologico. Un rigoroso programma terapeutico rimane invisibile, a meno che qualcuno non assista direttamente all’assunzione dei farmaci. Un kit di emergenza con idrocortisone può rimanere all’interno di una borsa. La pianificazione aggiuntiva relativa a malattia, idratazione, equilibrio salino, temperatura, viaggi, sonno, visite mediche e recupero rimane perlopiù nascosta.

Questa distinzione è importante perché una disabilità visibile fornisce automaticamente determinate informazioni all’osservatore. Una sedia a rotelle, un bastone bianco, una protesi o un altro ausilio visibile possono segnalare immediatamente che è necessario riconsiderare le proprie supposizioni sulla mobilità, sull’accessibilità o sulle capacità fisiche. Una disabilità invisibile non offre alcun segnale automatico equivalente. L’osservatore deve conoscere la condizione, credere alle informazioni che gli vengono fornite e resistere alla tendenza intuitiva a utilizzare l’aspetto esteriore come indicatore della capacità fisiologica.

È esattamente da questa tendenza che nasce il fraintendimento.

La persona può sembrare sana proprio perché la terapia sta funzionando

A questo proposito esiste un punto giuridico e concettuale particolarmente importante. La guida britannica relativa all’Equality Act affronta esplicitamente il caso delle condizioni i cui effetti vengono controllati da un trattamento. Nel determinare se una menomazione produca un effetto avverso sostanziale, la guida stabilisce che, in generale, occorre considerare quale sarebbe tale effetto in assenza del trattamento o della misura correttiva. Essa riconosce specificamente che un trattamento continuativo può mascherare o attenuare una disabilità in modo così efficace da rendere i suoi effetti “completamente sotto controllo o del tutto non evidenti” (Office for Disability Issues, 2011).

Questo principio si applica in modo particolarmente significativo alla malattia di Addison. La terapia ormonale sostitutiva non si limita semplicemente a far sentire una persona un po’ meglio. Il cortisolo è essenziale per la vita. Nell’insufficienza surrenalica primaria, la sostituzione dei glucocorticoidi supplisce a un ormone che le ghiandole surrenali non sono più in grado di produrre adeguatamente, mentre la terapia sostitutiva con mineralcorticoidi viene utilizzata quando vi è un deficit della funzione dell’aldosterone (Bornstein et al., 2016). La persona che si presenta davanti a un amministratore con un aspetto perfettamente sano può quindi farlo pur dipendendo continuamente da una terapia sostitutiva per una funzione fisiologica che, in una persona non affetta dalla malattia, avviene automaticamente.

Questo crea ciò che definirei il paradosso della compensazione riuscita: quanto più efficacemente un trattamento riesce a nascondere le conseguenze esteriori di una compromissione grave, tanto maggiore diventa la tentazione, per un osservatore non informato, di concludere che quella compromissione sia insignificante.

Ma questa logica è rovesciata.

Una persona con una miopia grave non cessa di avere una compromissione visiva sottostante semplicemente perché gli occhiali funzionano. Una persona con epilessia ben controllata non dimostra, per questo, che l’epilessia non sia mai stata clinicamente significativa. Allo stesso modo, una terapia ormonale sostitutiva efficace nella malattia di Addison non significa che la corteccia surrenale abbia recuperato la capacità di produrre una normale risposta fisiologica allo stress. La malattia può essere ben controllata e, contemporaneamente, rimanere clinicamente seria.

Apparire in buona salute può essere la prova che la terapia sta funzionando. Non è la prova che la terapia sia superflua, che i sintomi siano assenti o che la malattia sottostante sia lieve.

Invisibile non significa priva di sintomi

Vi è un altro equivoco che merita di essere corretto. Definire la malattia di Addison una disabilità invisibile non significa che le persone che ne sono affette non sperimentino effetti percepibili nella vita quotidiana fino al momento in cui compare improvvisamente una crisi surrenalica. La stanchezza cronica o persistente è uno dei sintomi più comuni dell’insufficienza surrenalica. Possono inoltre verificarsi debolezza muscolare, perdita dell’appetito, sintomi gastrointestinali, pressione arteriosa bassa, vertigini o svenimenti quando ci si alza in piedi, desiderio intenso di sale e altri sintomi (NIDDK, n.d.). Il NICE include specificamente una stanchezza sufficientemente grave da compromettere in maniera significativa le attività della vita quotidiana fra i segnali da considerare durante il monitoraggio di una possibile insufficiente sostituzione glucocorticoide (NICE, 2024).

La stessa parola stanchezza può generare incomprensioni, perché quasi tutti conoscono l’esperienza della normale stanchezza. È facile sentire parlare di “stanchezza” e tradurla mentalmente con “essere un po’ stanchi dopo una lunga giornata”. La stanchezza associata a una malattia cronica può avere un significato funzionale profondamente diverso. Può compromettere la concentrazione, la resistenza, l’attività fisica, il tempo di recupero necessario dopo uno sforzo o una malattia e la capacità di mantenere lo stesso livello di prestazione durante un’intera giornata. È importante sottolineare che la gravità varia considerevolmente da una persona all’altra e nel corso del tempo. Il fatto che una persona sia riuscita a svolgere una determinata attività una volta non dimostra necessariamente che possa ripeterla regolarmente, in sicurezza o senza necessitare di un recupero sproporzionato.

Questa osservazione è sostenuta anche dalle evidenze più generali sulla qualità della vita. Una revisione sistematica degli studi sulla qualità della vita nelle patologie surrenaliche ha rilevato che il trattamento migliora la qualità della vita, ma non necessariamente la riporta completamente ai livelli della popolazione generale (Ho & Druce, 2018). Una recente revisione sulla malattia di Addison pubblicata su The Lancet Diabetes & Endocrinology sottolinea analogamente che, nonostante la terapia corticosteroidea sostitutiva, le persone con malattia di Addison continuano a presentare una qualità della vita ridotta e una mortalità maggiore rispetto alla popolazione generale. Una delle possibili cause è l’incapacità delle terapie sostitutive convenzionali di riprodurre i normali ritmi circadiani e ultradiani della secrezione di cortisolo (Dong et al., 2026).

Questo aspetto è particolarmente importante nei contesti universitari e lavorativi, perché la disabilità viene spesso giudicata attraverso le prestazioni osservabili. Uno studente partecipa a un seminario di due ore e qualcuno conclude che debba quindi poter sostenere una giornata di otto ore nelle medesime condizioni. Una persona riesce a presentarsi a un appuntamento e si presume che il viaggio sia stato semplice. Qualcuno completa un esame e si conclude che le condizioni ambientali non fossero problematiche. Una persona appare energica per venti minuti durante una riunione e si presume quindi che la stanchezza cronica non possa essere significativa. Tutte queste conclusioni confondono la prestazione osservata in un determinato momento con la capacità funzionale sostenibile nel tempo.

Dietro l’apparire in buona salute esiste un carico di lavoro invisibile

Anche la gestione di una malattia cronica comporta un lavoro che gli altri raramente vedono. I farmaci devono essere disponibili e assunti secondo il programma prescritto. Una malattia intercorrente richiede particolare attenzione, perché il fabbisogno di glucocorticoidi cambia durante lo stress fisiologico. I farmaci di emergenza devono essere disponibili. I viaggi possono richiedere una pianificazione preventiva e strategie di riserva. I controlli medici richiedono tempo. Una persona può dover prestare costantemente attenzione all’idratazione, all’equilibrio salino, all’accesso ai farmaci, alle malattie gastrointestinali, allo stress fisico e alla possibilità che le circostanze stiano superando ciò che la normale terapia sostitutiva è in grado di compensare. La guida dell’ADSHG per il contesto lavorativo menziona specificamente i livelli variabili di energia, i farmaci da assumere con tempistiche precise, un possibile recupero più lungo dopo una malattia o un infortunio, il rischio di crisi surrenalica e la necessità di prepararsi alle emergenze fra gli aspetti pratici che possono interessare le persone con insufficienza surrenalica (ADSHG, 2025).

Nulla di tutto questo è necessariamente visibile durante una normale interazione. Un amministratore può vedere una persona tranquillamente seduta a una scrivania senza vedere il programma terapeutico che ha reso possibile quell’ora apparentemente ordinaria, l’iniezione di emergenza che la persona porta con sé, la stanchezza sperimentata quella stessa mattina o il recupero di cui potrebbe aver bisogno più tardi. Un’autogestione efficace può quindi cancellare dalla percezione sociale le prove del lavoro necessario per mantenerla.

Esiste qui una strana asimmetria. Se l’autogestione fallisce, la malattia diventa visibile attraverso il deterioramento clinico. Se l’autogestione riesce, il lavoro necessario per prevenire quel deterioramento rimane invisibile. Di conseguenza, la persona può ricevere il minor riconoscimento proprio quando è riuscita a gestire la propria condizione nel modo più efficace.

Questa è una delle ragioni per cui una disabilità invisibile può risultare socialmente estenuante. La persona può essere costretta a spiegare ripetutamente rischi reali ma non attualmente visibili, a descrivere limitazioni variabili e a giustificare accomodamenti prima che si sia verificato un deterioramento medico visibile. L’alternativa — aspettare che la malattia diventi abbastanza grave e visibile da convincere tutti — costituisce chiaramente un modello terribile di sostegno alla disabilità.

La temperatura mostra perché l’ambiente può essere importante senza costituire un sintomo universale

Il tema della temperatura richiede particolare cautela, perché l’esperienza individuale può essere significativa anche quando le evidenze non giustificano l’affermazione secondo cui tutte le persone con malattia di Addison presenterebbero una “estrema sensibilità alla temperatura”. Le principali linee guida cliniche non indicano un’unica sindrome universale di intolleranza cronica alla temperatura come caratteristica definitoria della malattia di Addison. Ciò che si può affermare con maggiore rigore è che le condizioni ambientali possono modificare le richieste fisiologiche dell’organismo e possono avere un’importanza considerevole per determinati individui.

Il caldo è particolarmente rilevante perché la sudorazione influenza l’equilibrio dei liquidi e dei sali. Le indicazioni dell’ADSHG sul clima caldo spiegano che le persone con malattia di Addison o insufficienza surrenalica possono incontrare maggiori difficoltà nella gestione della propria condizione durante i periodi di caldo e sottolineano l’importanza dell’idratazione e dell’equilibrio idro-salino (ADSHG, 2026). Il caldo figurava inoltre fra le circostanze precipitanti riportate in uno studio prospettico sulle crisi surrenaliche, sebbene in quella coorte le infezioni gastrointestinali, la febbre e lo stress emotivo fossero fattori scatenanti più frequenti (Hahner et al., 2015).

Questo costituisce un buon esempio del motivo per cui gli accomodamenti devono essere individualizzati. Se una determinata persona presenta una difficoltà clinicamente documentata nel tollerare il caldo o un’altra condizione ambientale, non è scientificamente rigoroso respingere tale limitazione semplicemente perché la sensibilità alla temperatura non è identica in tutti i pazienti. La stessa guida relativa all’Equality Act del Regno Unito riconosce che condizioni ambientali quali temperatura, umidità, momento della giornata, stanchezza e stress possono aggravare o attenuare gli effetti di una menomazione e devono essere considerate nella valutazione del suo impatto funzionale (Office for Disability Issues, 2011).

La conclusione corretta non è quindi né “tutte le persone con malattia di Addison sono estremamente sensibili alla temperatura”, né “la temperatura non può avere alcuna importanza perché non figura universalmente fra i sintomi diagnostici”. La conclusione più appropriata è che la tolleranza ambientale costituisce una questione funzionale individuale e che il caldo presenta una rilevanza plausibile e documentata per la gestione dei liquidi e dei sali nell’insufficienza surrenalica.

La vulnerabilità più importante è l’assenza della risposta automatica allo stress

Il peso quotidiano della malattia di Addison è importante, ma la condizione presenta un ulteriore livello di vulnerabilità che spiega perché debba essere presa seriamente anche quando una persona si sente relativamente bene. In un individuo con normale funzione surrenalica, uno stress fisiologico come una malattia significativa, un trauma o un intervento chirurgico modifica il fabbisogno di glucocorticoidi, e il sistema ipotalamo-ipofisi-surrene partecipa automaticamente all’adattamento della disponibilità di cortisolo. Nell’insufficienza surrenalica primaria, la corteccia surrenale danneggiata non è in grado di generare questa normale risposta adattativa. Il necessario incremento del supporto glucocorticoide deve quindi essere fornito attraverso il trattamento (Bornstein et al., 2016; NICE, 2024).

Questo crea una forma di vulnerabilità che è quasi impossibile riconoscere dall’aspetto esteriore. In condizioni basali, il trattamento può essere del tutto adeguato. La persona può sentirsi abbastanza bene e apparire completamente sana. Poi le circostanze fisiologiche possono cambiare: si sviluppa un’infezione, compare la febbre, iniziano vomito o diarrea con perdita di liquidi, si verifica un trauma o un intervento chirurgico, oppure un altro fattore di stress significativo aumenta il fabbisogno di glucocorticoidi. Le ghiandole surrenali non possono semplicemente aumentare la produzione di cortisolo per rispondere alla nuova domanda; la gestione terapeutica deve quindi essere modificata in modo appropriato e tempestivo.

Per questo motivo “stabile” e “invulnerabile” non sono sinonimi. La stabilità descrive il rapporto attuale tra domanda fisiologica e supporto disponibile. Nella malattia di Addison, tale rapporto continua a dipendere dalla terapia sostitutiva e dalla preparazione alle emergenze. Una persona stabile non si trova segretamente in crisi surrenalica, né le persone con malattia di Addison dovrebbero essere rappresentate come costantemente sull’orlo della morte. Molte conducono una vita piena e attiva grazie a un’assistenza adeguata. Tuttavia, la loro risposta fisiologica a determinati fattori di stress è fondamentalmente diversa da quella di una persona con normale funzione surrenalica, e questa differenza può diventare clinicamente rilevante molto rapidamente (NICE, 2024).

Ecco perché “sembrare sani” ed “essere medicalmente vulnerabili” possono essere contemporaneamente veri

Questa apparente contraddizione è forse il punto più importante per chi non conosce la malattia di Addison. Una persona può stare realmente bene alle dieci del mattino e, al tempo stesso, presentare una vulnerabilità medica che rende una successiva infezione, una malattia gastrointestinale o un altro stress fisiologico più pericoloso. Non esiste alcuna incoerenza. Una delle due affermazioni descrive lo stato attuale; l’altra descrive la ridotta capacità del sistema di adattarsi qualora quello stato cambi.

Possiamo pensare alla differenza tra funzionamento attuale e riserva adattativa. Il funzionamento attuale può essere eccellente. La capacità endocrina di adattamento rimane invece limitata perché la corteccia surrenale non può produrre autonomamente la normale risposta di cortisolo. La terapia sostitutiva fornisce ciò che manca nelle condizioni ordinarie, mentre la gestione nei giorni di malattia o nelle emergenze fornisce un sostegno aggiuntivo quando le circostanze lo richiedono. L’aspetto esteriore della persona ci informa soprattutto sul primo elemento — il momento presente. Ci dice molto poco sul secondo.

Ecco perché l’aspetto esteriore costituisce un indicatore medico estremamente inaffidabile.

Se qualcuno vede una persona con una lesione chiaramente visibile, raramente conclude che la lesione sia irrilevante semplicemente perché quella persona è ancora in grado di parlare normalmente. Con una malattia cronica invisibile, invece, la normalità visibile può facilmente trasformarsi in una sorta di test diagnostico informale. L’osservatore si domanda inconsciamente: “Questa persona sembra malata?”. Se la risposta è no, può ridurre la propria percezione del rischio.

Nella malattia di Addison, ciò può creare quella che definirei una forma di falsa rassicurazione.

Non è propriamente un falso positivo; assomiglia di più a un “falso verde”

Nel linguaggio statistico rigoroso, il problema non sarebbe propriamente definibile come un “falso positivo”. Se l’aspetto esteriore venisse trattato come un test rudimentale per individuare una grave vulnerabilità sottostante, l’errore assomiglierebbe piuttosto a un falso negativo: la vulnerabilità è presente, ma l’osservatore non la rileva. Tuttavia, nessuno dei due termini coglie pienamente il problema, perché l’aspetto esteriore non è, in primo luogo, un test medico.

Preferisco l’espressione “falso verde”, mutuandola dal linguaggio del monitoraggio dei sistemi. Un pannello di controllo può indicare un servizio in verde perché il processo è in esecuzione, anche quando la funzione realmente importante per gli utenti ha già smesso di funzionare. L’indicatore sta tecnicamente osservando qualcosa di reale, ma l’osservatore gli sta chiedendo di rispondere a una domanda molto più ampia di quella che è in grado di affrontare.

L’equivalente ragionamento sociale appare così:

Osservato:
la persona cammina normalmente
la persona parla normalmente
la persona ha frequentato la lezione
la persona oggi sembra stare bene

Dedotto:
quindi ha una resistenza fisica normale
quindi ha una normale tolleranza al caldo
quindi recupera normalmente dopo una malattia
quindi non ha una disabilità significativa
quindi presenta un basso rischio medico

Il problema risiede nella deduzione, non nell’osservazione. La persona sta realmente camminando e parlando normalmente. L’errore consiste nell’utilizzare queste osservazioni come prova di variabili che esse non misurano.

L’aspetto esteriore è un controllo dello stato di salute estremamente povero di informazioni quando si tratta di una patologia endocrina.

Il problema va oltre la semplice ignoranza riguardo a una malattia rara. Si tratta di una forma di pregiudizio della visibilità: le persone tendono naturalmente ad attribuire maggiore peso alle menomazioni che riescono a vedere e minore peso alle dipendenze fisiologiche invisibili. La malattia di Addison aggiunge un’ulteriore complicazione, perché una terapia efficace riduce essa stessa la visibilità. La malattia può quindi generare una vera e propria trappola epistemica, nella quale il controllo efficace dei sintomi viene erroneamente interpretato come prova del fatto che un rischio serio non sia mai esistito.

Quanto meglio funziona la compensazione, tanto più facile diventa per un osservatore dimenticare che cosa stia effettivamente venendo compensato.

La falsa rassicurazione diventa pericolosa quando modifica il comportamento degli altri

Fraintendere una disabilità invisibile non è soltanto spiacevole sul piano sociale. Può modificare decisioni concrete. Un ufficio universitario può negare un adattamento ambientale perché lo studente appare fisicamente sano. Un collega può presumere che una persona possa semplicemente “resistere” nonostante una stanchezza grave. Un supervisore può interpretare il tempo necessario per recuperare a causa della disabilità come una normale assenza. Un’istituzione può non predisporre un piano di emergenza perché la possibilità di una crisi surrenalica sembra troppo astratta. In una situazione acuta, le persone presenti o perfino professionisti sanitari poco familiari con l’insufficienza surrenalica possono sottovalutare il significato di un deterioramento proprio perché poche ore prima la persona appariva in buone condizioni.

L’errore fondamentale è di natura temporale: gli osservatori si aspettano che una malattia grave debba apparire grave in modo continuo. La malattia di Addison non funziona necessariamente in questo modo. Una persona può essere ben controllata e poi sviluppare un fattore di stress fisiologico che modifica il fabbisogno di glucocorticoidi. Il NICE raccomanda specificamente un aumento della terapia sostitutiva con glucocorticoidi durante uno stress fisiologico significativo e la somministrazione immediata di idrocortisone per via intramuscolare o endovenosa quando si sospetta una crisi surrenalica. Raccomanda inoltre kit di emergenza per l’iniezione e una formazione adeguata al loro utilizzo, proprio perché la rapidità dell’intervento è importante (NICE, 2024).

Ciò significa che un precedente aspetto di buona salute offre ben poca rassicurazione quando la situazione fisiologica è cambiata. “Ma stamattina sembrava stare bene” non costituisce una prova contro lo sviluppo di una crisi surrenalica. Dimostra soltanto che quella persona, quella mattina, sembrava stare bene.

Scritto così può sembrare quasi banalmente ovvio, eppure questo preciso errore di ragionamento si verifica continuamente in medicina e nella valutazione della disabilità: un’istantanea viene scambiata per una traiettoria.

La crisi surrenalica è il momento in cui una vulnerabilità invisibile può diventare improvvisamente visibile

Una crisi surrenalica è un deterioramento acuto e potenzialmente letale associato a un’attività glucocorticoide insufficiente rispetto al fabbisogno fisiologico, spesso accompagnato da instabilità emodinamica e da altre alterazioni sistemiche. Il NICE raccomanda ai clinici di prendere in considerazione una crisi surrenalica nei pazienti in condizioni critiche che presentino caratteristiche quali ipotensione, iponatriemia, ipoglicemia, shock circolatorio o collasso, nonché nelle persone con insufficienza surrenalica nota o ad alto rischio che sviluppino sintomi quali letargia, debolezza, confusione, pallore o sudorazione fredda e pelle clammy (NICE, 2024).

La transizione può essere particolarmente pericolosa in presenza di vomito o diarrea, perché possono verificarsi contemporaneamente due problemi. Lo stress fisiologico e la perdita di liquidi aumentano il carico sull’organismo, mentre i glucocorticoidi assunti per via orale potrebbero non essere più adeguatamente trattenuti o assorbiti. Il NICE raccomanda pertanto idrocortisone per via parenterale e assistenza ospedaliera quando un vomito o una diarrea prolungati impediscono un adeguato assorbimento dei glucocorticoidi orali (NICE, 2024).

Si tratta di una situazione molto diversa dal semplice “sentirsi più stanchi del solito”. La vulnerabilità sottostante ha interagito con un fattore di stress acuto e il normale percorso terapeutico di mantenimento potrebbe non essere più sufficiente. La persona che ieri sembrava stare bene può quindi aver bisogno di un trattamento d’emergenza oggi, senza che vi sia alcuna contraddizione tra le due osservazioni.

È precisamente per questa ragione che università e luoghi di lavoro non dovrebbero aspettare che una condizione diventi visibilmente drammatica prima di prenderla sul serio.

Il rischio di morte è reale, ma deve essere descritto senza sensazionalismi

La malattia di Addison è trattabile e la crisi surrenalica è un’emergenza medica per la quale esiste un trattamento efficace e ben consolidato. Sarebbe quindi inesatto e inutilmente allarmistico descrivere le persone con una malattia di Addison ben controllata come se vivessero costantemente sull’orlo della morte. Allo stesso tempo, sarebbe altrettanto scorretto minimizzare la potenziale letalità della crisi surrenalica. Il NICE afferma chiaramente che un’insufficienza surrenalica non trattata può progredire fino alla crisi surrenalica e che la crisi surrenalica può essere fatale (NICE, 2024).

I dati prospettici mostrano perché questo rischio debba essere preso seriamente. Hahner e colleghi hanno seguito per due anni 423 persone affette da insufficienza surrenalica cronica, documentando 64 crisi surrenaliche nel corso di 767,5 anni-paziente, pari a 8,3 crisi per 100 anni-paziente. Dieci partecipanti sono deceduti durante il periodo di follow-up e quattro di questi decessi erano associati a una crisi surrenalica, corrispondenti a 0,5 decessi correlati a crisi surrenalica per 100 anni-paziente in quella coorte. Gli autori hanno stimato che circa il 6% delle crisi osservate fosse associato a mortalità (Hahner et al., 2015). Questa percentuale non deve essere interpretata come una probabilità universale applicabile a ogni crisi o a ogni paziente; descrive una specifica coorte prospettica, e sia l’incidenza sia gli esiti delle crisi possono variare fra le diverse popolazioni.

Un ampio studio basato su database britannici offre un’ulteriore prospettiva. Ngaosuwan e colleghi hanno confrontato 6.821 persone affette da insufficienza surrenalica con controlli appaiati e hanno riscontrato un aumento della mortalità per tutte le cause, più marcato nell’insufficienza surrenalica primaria rispetto a quella secondaria. In quel dataset, la crisi surrenalica risultava aver contribuito a circa il 10% dei decessi fra le persone affette da insufficienza surrenalica, mentre la mortalità e i ricoveri ospedalieri per crisi surrenalica risultavano particolarmente elevati nel periodo successivo alla diagnosi (Ngaosuwan et al., 2021).

Anche la più recente importante revisione dedicata alla malattia di Addison conclude che l’aumento della mortalità e la riduzione della qualità della vita rimangono motivo di preoccupazione nonostante la terapia corticosteroidea sostitutiva; tra gli aspetti che richiedono ancora miglioramenti figurano la gestione delle crisi surrenaliche e i limiti delle attuali strategie di sostituzione ormonale (Dong et al., 2026).

La conclusione appropriata non è quindi né il panico né la compiacenza. È la preparazione.

La malattia di Addison è gestibile, ma la crisi surrenalica rimane una complicanza riconosciuta e potenzialmente fatale. La sua gravità risiede precisamente nel fatto che una persona può essere stabile per la maggior parte del tempo e, al tempo stesso, avere bisogno di un intervento rapido e corretto quando si verificano determinate circostanze.

Una malattia rara crea una seconda forma di invisibilità

La malattia di Addison è poco comune e la rarità genera un altro problema, oltre all’invisibilità fisica: l’invisibilità cognitiva. Molti amministratori, insegnanti, datori di lavoro e colleghi possono non aver mai incontrato consapevolmente una persona affetta da questa malattia. Persino alcuni professionisti sanitari si trovano raramente di fronte a una crisi surrenalica. Di conseguenza, le persone tendono a interpretare sintomi poco familiari attraverso supposizioni familiari.

La stanchezza può essere attribuita a un sonno insufficiente. Le vertigini possono essere interpretate come ansia. Una ridotta resistenza fisica può sembrare mancanza di impegno. Il tempo di recupero dopo una malattia può apparire eccessivo. Una richiesta riguardante caldo, idratazione, farmaci, flessibilità o preparazione alle emergenze può sembrare sproporzionata perché l’osservatore non dispone del modello medico necessario per comprenderne la ragione.

La malattia di Addison è inoltre difficile da diagnosticare proprio per ragioni analoghe. I suoi sintomi possono essere vaghi e aspecifici, e il ritardo diagnostico continua a rappresentare una caratteristica importante della malattia. La revisione del 2026 di Dong e colleghi osserva che alcune persone continuano a presentarsi per la prima volta con una crisi surrenalica perché i sintomi precedenti non erano stati riconosciuti come manifestazioni della malattia di Addison (Dong et al., 2026).

L’invisibilità fisica e quella cognitiva possono quindi rafforzarsi reciprocamente:

malattia rara
      ↓
scarsa familiarità da parte del pubblico
      ↓
pochi segnali visibili
      ↓
aspetto ordinario
      ↓
rischio sottovalutato
      ↓
le richieste di sostegno appaiono sproporzionate
      ↓
la malattia diventa ancora più facile da ignorare

Per il lavoro di sensibilizzazione, interrompere questo circolo rappresenta uno degli obiettivi più importanti.

L’Equality Act anticipa precisamente questo problema

Per università e datori di lavoro in Gran Bretagna esiste un importante contesto giuridico. L’Equality Act 2010 definisce la disabilità in termini di una menomazione fisica o mentale che produce un effetto avverso sostanziale e duraturo sulla capacità di svolgere le normali attività quotidiane. La guida statutaria chiarisce che possono essere rilevanti i fattori ambientali, gli effetti fluttuanti e gli effetti mascheranti della terapia. In particolare, quando si valuta quanto sostanziale sarebbe la compromissione sottostante, i trattamenti medici continuativi vengono generalmente considerati come se non fossero presenti (Office for Disability Issues, 2011).

Questo è straordinariamente rilevante per la malattia di Addison, perché proprio la terapia farmacologica permanente può rendere la compromissione meno visibile. La guida riconosce esplicitamente che il trattamento può rendere gli effetti completamente controllati o “per nulla evidenti”, senza che ciò elimini automaticamente la disabilità sottostante ai fini della valutazione (Office for Disability Issues, 2011).

La guida affronta inoltre gli effetti ricorrenti e fluttuanti. Una menomazione non deve produrre lo stesso livello di limitazione in ogni ora di ogni giorno per poter essere significativa. Effetti che si ripresentano nel tempo possono comunque essere considerati di lunga durata, e determinate circostanze ambientali possono aggravare una menomazione (Office for Disability Issues, 2011).

Questo contraddice direttamente uno dei più comuni criteri informali applicati alle disabilità invisibili:

"Quando ti ho visto sembravi stare bene."

quindi

"La tua disabilità non può avere effetti sostanziali su di te."

La seconda affermazione non discende dalla prima, né dal punto di vista medico, né da quello funzionale, né, in molte circostanze, da quello giuridico.

Le università dovrebbero valutare la funzionalità sostenibile, non una singola ora positiva

Questa distinzione è particolarmente importante nell’istruzione superiore, perché la vita universitaria è costruita attorno a osservazioni intermittenti. Un docente vede uno studente durante un seminario. Un consulente per la disabilità lo incontra durante un appuntamento. Il personale degli alloggi lo vede mentre discute di una stanza. Il personale addetto agli esami lo osserva nel corso di una specifica prova. Ognuno di questi osservatori riceve soltanto una stretta istantanea di una giornata fisiologicamente molto più lunga.

Lo studente, invece, vive l’intera sequenza: svegliarsi, assumere i farmaci, spostarsi, gestire pasti e liquidi, partecipare alle lezioni, affrontare temperatura e sforzo fisico, concentrarsi, recuperare, prepararsi per l’attività successiva e gestire eventuali malattie intercorrenti. Un periodo di due ore di prestazione apparentemente normale non può dire a un amministratore quanto sia costata quella prestazione né se le medesime condizioni possano essere sostenute ripetutamente.

È utile distinguere fra prestazione di picco e capacità sostenibile. Molte persone con disabilità sono in grado di svolgere una determinata attività in alcune circostanze. La domanda rilevante ai fini di un accomodamento è spesso se possano farlo ripetutamente, in sicurezza, in maniera prevedibile e senza un costo fisiologico sproporzionato.

Per esempio, il fatto che uno studente riesca a tollerare una stanza calda per una breve riunione non dimostra necessariamente che un’esposizione prolungata sia funzionalmente sicura o sostenibile per quella specifica persona. Il fatto che sia riuscito a partecipare a una mattinata dopo una malattia non dimostra che il suo recupero sia normale. Il fatto che abbia completato una lunga giornata non dimostra che la stanchezza non produca un effetto sostanziale. Una valutazione sensata della disabilità considera i modelli nel tempo, gli effetti cumulativi e la documentazione medica individualizzata, invece di trattare un singolo episodio riuscito come una prova da sforzo superata definitivamente.

Gli accomodamenti dovrebbero rispondere alla funzionalità e al rischio, non all’apparenza

Non esiste un unico pacchetto universale di accomodamenti per la malattia di Addison. Le esigenze individuali variano notevolmente e alcune persone possono avere bisogno di pochi o nessun adattamento in un determinato momento. Altre possono presentare stanchezza significativa, sintomi ortostatici, sensibilità ambientali, altre patologie autoimmuni, crisi ricorrenti o una storia terapeutica più complessa. L’ADSHG sottolinea questa individualità nelle proprie indicazioni per il lavoro e raccomanda il dialogo, una revisione periodica e la considerazione delle esigenze specifiche della persona interessata (ADSHG, 2025).

In un contesto universitario, gli adattamenti pertinenti potrebbero quindi comprendere flessibilità in relazione ad assenze necessarie per motivi medici o ai periodi di recupero, accesso ai farmaci e ai liquidi, possibilità di partecipare agli appuntamenti medici, adeguata considerazione delle limitazioni ambientali documentate, idonee possibilità di riposo e, quando opportuno, un piano di emergenza concordato. Si tratta di esempi di ambiti che possono essere rilevanti, non di una lista di requisiti che ogni persona con malattia di Addison debba automaticamente ricevere.

Il principio di fondo è molto più semplice:

Non dedurre la capacità funzionale dall’aspetto visivo. Chiedere che cosa la persona sperimenta realmente, considerare la documentazione medica, comprendere i rischi specifici per quella persona e progettare il sostegno attorno a queste realtà.

La preparazione alle emergenze deve esistere prima che l’emergenza diventi visibile

Le istituzioni devono anche comprendere la particolare logica della preparazione alle emergenze. Un kit di emergenza con idrocortisone può rimanere inutilizzato per anni. Questo non lo rende superfluo. La sua funzione consiste precisamente nell’essere disponibile per un evento poco frequente ma dalle conseguenze potenzialmente molto gravi. Il NICE raccomanda kit per la gestione delle emergenze nelle persone con insufficienza surrenalica primaria e un’adeguata formazione al loro utilizzo, mentre l’ADSHG raccomanda consapevolezza sul luogo di lavoro e pianificazione delle emergenze, poiché una crisi surrenalica può verificarsi anche fuori dall’ambiente domestico (NICE, 2024; ADSHG, 2025).

Una risposta istituzionale inadeguata consisterebbe nell’attendere che si verifichi una crisi e solo allora iniziare a chiedersi che cosa sia la malattia di Addison.

Una risposta migliore consiste nel comprendere preventivamente la condizione, rispettare la riservatezza, sapere quali persone debbano disporre delle informazioni pertinenti in caso di emergenza, con il consenso dell’interessato, e garantire che le procedure istituzionali non ostacolino l’assistenza urgente. La guida dell’ADSHG per l’ambiente di lavoro, ad esempio, raccomanda che, quando appropriato, un addetto al primo soccorso designato sia informato della diagnosi, così da poter reagire efficacemente in caso di emergenza (ADSHG, 2025).

La filosofia è preventiva, non allarmistica. Installiamo uscite di emergenza non perché riteniamo che ogni edificio stia continuamente bruciando, ma perché sarebbe inaccettabile scoprire, durante un incendio, che non esiste una via d’uscita. La pianificazione dell’emergenza per una crisi surrenalica segue una logica analoga: la preparazione è giustificata dalla gravità e dalla natura tempo-dipendente dell’evento, non dall’idea che una crisi sia costantemente in corso.

Una persona non dovrebbe essere costretta ad ammalarsi visibilmente per essere creduta

Questa potrebbe essere la lezione sociale più importante delle disabilità invisibili. Se il riconoscimento istituzionale viene concesso soltanto quando la compromissione diventa esteriormente evidente, il sistema finisce paradossalmente per premiare il deterioramento. Chi riesce a gestire farmaci, stanchezza, temperatura, malattie e attività quotidiane abbastanza bene da continuare ad apparire funzionale può incontrare maggiori difficoltà nell’ottenere sostegno rispetto a chi presenta una compromissione visibilmente incontestabile.

Si crea così una soglia probatoria irragionevole:

"Lei afferma che questa condizione le provoca
una limitazione significativa."

"Ma sembra stare bene."

"Quindi ci dimostri la limitazione."

L’unica prova davvero convincente diventa:
un deterioramento visibile.

Nessun sistema responsabile di sostegno alla disabilità dovrebbe funzionare in questo modo.

Lo scopo di un accomodamento ragionevole è spesso proprio quello di prevenire un deterioramento evitabile e consentire una partecipazione in condizioni di equità. Pretendere che una persona dimostri prima il danno, per poi ridurre uno svantaggio già noto, contraddice tale finalità. Questo approccio è particolarmente inappropriato nel caso di una condizione in cui lo stress fisiologico e il ritardo nell’intervento possono avere conseguenze gravi.

Ciò non significa accettare automaticamente qualunque accomodamento richiesto né considerare una diagnosi sufficiente a giustificare ogni possibile adattamento. Le università hanno il diritto di valutare le esigenze individuali e la proporzionalità delle misure. Il punto è che l’aspetto esteriore dovrebbe avere un peso quasi nullo in tale valutazione. Le prove rilevanti riguardano la diagnosi, gli effetti funzionali, l’interazione con l’ambiente, le raccomandazioni cliniche e l’esperienza concreta della persona.

Esiste anche un paradosso della privacy

Una disabilità invisibile produce un ulteriore dilemma. Proprio perché la condizione non è evidente, può essere necessario rivelarla per ottenere sostegno o predisporre un piano di emergenza. Tuttavia, le informazioni mediche sono private, e l’ADSHG sottolinea correttamente che non tutte le persone desiderano rendere nota la propria diagnosi in maniera estesa ai datori di lavoro o ai colleghi (ADSHG, 2025).

Si crea quindi un equilibrio difficile. Una comunicazione troppo limitata può significare che nessuno sappia come intervenire durante un’emergenza. Una comunicazione eccessivamente ampia espone inutilmente informazioni sanitarie private. Una buona prassi istituzionale richiede quindi una comunicazione controllata e finalizzata: soltanto le persone che hanno realmente bisogno di determinate informazioni dovrebbero riceverle, e le volontà dell’interessato in materia di riservatezza dovrebbero essere rispettate per quanto possibile.

Per un’università, ciò può significare distinguere fra un servizio per la disabilità che necessita di una documentazione medica dettagliata, il personale docente che può aver bisogno di conoscere soltanto l’adattamento funzionale necessario, e il personale designato per le emergenze, che può invece aver bisogno di informazioni specifiche sulla crisi surrenalica. “Devono saperlo tutti” e “non ha bisogno di saperlo nessuno” sono entrambe soluzioni troppo semplicistiche a un problema che richiede confini informativi attentamente definiti.

La vulnerabilità quotidiana non deve cancellare l’autonomia

Esiste anche il rischio opposto. Una volta appreso che una crisi surrenalica può essere fatale, alcune persone possono iniziare a considerare chi è affetto dalla malattia principalmente come fragile, dipendente o costantemente malato. Anche questa è una distorsione. Le persone con malattia di Addison possono studiare, lavorare, viaggiare, fare attività fisica, costruire una carriera e condurre una vita piena. Il NICE afferma esplicitamente che le persone con insufficienza surrenalica possono vivere una vita piena e attiva quando ricevono informazioni e assistenza adeguate e continuative (NICE, 2024).

L’obiettivo della sensibilizzazione non è quindi sostituire la sottovalutazione con il paternalismo. Occorre mantenere insieme due verità:

La persona può essere altamente capace,
indipendente e apparire in buona salute.

E

La persona presenta una malattia endocrina permanente,
con reali effetti quotidiani e una possibile modalità
di scompenso potenzialmente letale.

Nessuna delle due verità annulla l’altra.

Per questo motivo anche il termine vulnerabilità deve essere utilizzato con cautela. Vulnerabilità descrive una dipendenza fisiologica e un margine di sicurezza ridotto in presenza di particolari forme di stress. Non descrive il carattere, l’intelligenza, la competenza o l’autonomia della persona.

Ciò che le persone intorno a qualcuno con malattia di Addison devono realmente comprendere

Per la maggior parte dei colleghi, tutor, amministratori e amici, non è necessaria una conoscenza dettagliata della biochimica degli steroidi. Non devono diventare endocrinologi. Devono semplicemente possedere un modello mentale corretto.

Questo modello può essere sorprendentemente conciso. La malattia di Addison è un’insufficienza permanente della produzione degli ormoni surrenalici. La terapia sostitutiva può consentire alla persona di apparire e funzionare normalmente, ma non ripristina la risposta automatica delle ghiandole surrenali allo stress fisiologico mediante il cortisolo. Sintomi cronici come stanchezza e pressione arteriosa bassa possono continuare a influenzare la vita quotidiana. Alcuni fattori ambientali possono essere importanti per il singolo individuo. Una malattia significativa modifica il fabbisogno di glucocorticoidi. Vomito e diarrea possono essere particolarmente pericolosi perché l’assorbimento dei farmaci può diventare inaffidabile. La crisi surrenalica è rara rispetto alla normale vita quotidiana, ma costituisce un’emergenza reale, tempo-dipendente e potenzialmente fatale. Il sostegno dovrebbe quindi essere basato sulle effettive necessità funzionali della persona e sul suo piano medico, non sul fatto che “sembri disabile” (NICE, 2024; ADSHG, 2025).

Se un ufficio universitario dovesse ricordare una sola frase, sceglierei questa:

Una persona con malattia di Addison può apparire completamente sana perché la terapia e l’autogestione stanno mantenendo con successo la stabilità; questa stabilità visibile non dovrebbe mai essere confusa con l’assenza di disabilità, l’assenza di sintomi o l’assenza di vulnerabilità medica.

Il problema più profondo è epistemico almeno quanto è medico

Più rifletto sulle disabilità invisibili, più mi sembra che il problema di fondo non riguardi soltanto la conoscenza medica, ma anche il modo in cui decidiamo che cosa debba contare come prova. Gli esseri umani sono fortemente influenzati dalle informazioni visibili. Tendiamo a fidarci di ciò che possiamo vedere. Un arto visibilmente fratturato fornisce immediatamente una prova. La dipendenza ormonale, una ridotta riserva fisiologica, la stanchezza cronica, i sintomi ortostatici e il rischio di crisi non lo fanno.

Questo rende la malattia di Addison un esempio particolarmente chiaro di un problema epistemico più generale: l’assenza di prove visibili viene facilmente scambiata per una prova dell’assenza.

Una terapia efficace intensifica ulteriormente il problema, perché rimuove attivamente parte delle evidenze visibili. La catena causale diventa quasi ironica:

grave malattia cronica
        ↓
trattamento efficace e attenta autogestione
        ↓
la persona appare in buona salute
        ↓
l’osservatore vede poche prove della compromissione
        ↓
l’osservatore sottovaluta la malattia
        ↓
il sostegno viene giudicato non necessario

La conclusione finale è esattamente rovesciata. La persona appare in buona salute proprio perché il sistema di gestione della malattia sta funzionando.

Per questo ritengo che “falsa rassicurazione” sia un’espressione più utile di “falso positivo”. Non vi è qui un test di laboratorio difettoso. Il fallimento avviene nell’interpretazione. Un’osservazione vera — “questa persona sembra stare bene” — viene utilizzata per dimostrare qualcosa che non può dimostrare — “dunque questa persona possiede una normale resilienza fisiologica e non presenta una disabilità sostanziale”.

In ingegneria lo definirei un controllo dello stato del sistema progettato male. Nel contesto della sensibilizzazione sulla disabilità, è più utile considerarlo come un promemoria del fatto che la visibilità è un indicatore inaffidabile della gravità.

Apparire in buona salute dovrebbe essere l’inizio della comprensione, non la sua conclusione

La malattia di Addison presenta una combinazione insolita di normalità e vulnerabilità. La terapia può ripristinare una quantità sufficiente di funzione fisiologica da rendere la vita quotidiana esteriormente del tutto ordinaria. Questa vita apparentemente ordinaria può tuttavia comprendere stanchezza cronica, livelli variabili di energia, pressione arteriosa bassa, dipendenza dai farmaci, limitazioni ambientali, maggiori esigenze di recupero e una costante preparazione alle emergenze. Soprattutto, l’incapacità di produrre una normale risposta di cortisolo durante uno stress fisiologico crea una vulnerabilità che rimane perlopiù invisibile finché determinate circostanze non la rendono evidente.

Nulla di tutto questo significa che ogni persona con malattia di Addison sperimenti lo stesso livello di disabilità, necessiti degli stessi accomodamenti o viva in una situazione di pericolo continuo. Le differenze individuali sono reali e un buon sistema di sostegno deve preservare questa complessità. Ma la variabilità non costituisce una ragione per minimizzare la malattia. La risposta corretta consiste in una comprensione individualizzata.

La potenziale letalità della crisi surrenalica rende tutto questo particolarmente importante. Una condizione non deve necessariamente apparire drammatica ogni giorno per possedere una modalità di scompenso pericolosa. Anzi, una parte del pericolo della malattia di Addison deriva proprio dal fatto che una seria vulnerabilità può coesistere con una vita esteriore straordinariamente normale. Questa coesistenza non rappresenta una contraddizione. È ciò che un trattamento efficace rende possibile.

Per un’università, un datore di lavoro o chiunque incontri questa malattia per la prima volta, la lezione è quindi semplice ma rilevante: credere alla realtà medica prima di pretendere una prova visiva. Valutare la capacità sostenibile piuttosto che l’aspetto in un singolo momento. Prendere seriamente la stanchezza e le limitazioni ambientali quando sono documentate. Rispettare la privacy e l’autonomia della persona. Predisporre ragionevoli misure per affrontare emergenze prevedibili. E comprendere che la persona che ci sta davanti e che appare completamente sana può essere, contemporaneamente, realmente in buona salute in quel preciso momento e realmente vulnerabile dal punto di vista medico.

Queste due verità appartengono alla stessa realtà.

Riferimenti bibliografici

Addison’s Disease Self-Help Group. (2025). Employment and Addison’s or adrenal insufficiency. Pubblicato l’8 luglio 2025; aggiornato l’11 settembre 2025. https://www.addisonsdisease.org.uk/employment-and-adrenal-insufficiency

Addison’s Disease Self-Help Group. (2025). Guidance for employees. https://www.addisonsdisease.org.uk/guidance-for-employees

Addison’s Disease Self-Help Group. (2026). Hot weather. Aggiornato il 15 luglio 2026. https://www.addisonsdisease.org.uk/hot-weather

Bornstein, S. R., Allolio, B., Arlt, W., Barthel, A., Don-Wauchope, A., Hammer, G. D., Husebye, E. S., Merke, D. P., Murad, M. H., Stratakis, C. A., & Torpy, D. J. (2016). Diagnosis and treatment of primary adrenal insufficiency: An Endocrine Society clinical practice guideline. The Journal of Clinical Endocrinology & Metabolism, 101(2), 364–389. https://doi.org/10.1210/jc.2015-1710

Dong, J., Hahner, S., Bancos, I., & Tomlinson, J. W. (2026). Clinical features, investigation, and management of Addison’s disease. The Lancet Diabetes & Endocrinology, 14(3), 243–258. https://doi.org/10.1016/S2213-8587(25)00393-6

Hahner, S., Spinnler, C., Fassnacht, M., Burger-Stritt, S., Lang, K., Milovanovic, D., Beuschlein, F., Willenberg, H. S., Quinkler, M., & Allolio, B. (2015). High incidence of adrenal crisis in educated patients with chronic adrenal insufficiency: A prospective study. The Journal of Clinical Endocrinology & Metabolism, 100(2), 407–416. https://doi.org/10.1210/jc.2014-3191

Ho, W., & Druce, M. (2018). Quality of life in patients with adrenal disease: A systematic review. Clinical Endocrinology, 89(2), 119–128. https://doi.org/10.1111/cen.13719

Ngaosuwan, K., Johnston, D. G., Godsland, I. F., Cox, J., Majeed, A., Quint, J. K., Oliver, N., & Robinson, S. (2021). Increased mortality risk in patients with primary and secondary adrenal insufficiency. The Journal of Clinical Endocrinology & Metabolism, 106(7), e2759–e2768. https://doi.org/10.1210/clinem/dgab096

National Institute for Health and Care Excellence. (2024). Adrenal insufficiency: Identification and management (NICE guideline NG243) — Recommendations. https://www.nice.org.uk/guidance/ng243/chapter/Recommendations

National Institute for Health and Care Excellence. (2024). Adrenal insufficiency: The care you should expect — Information for the public. https://www.nice.org.uk/guidance/ng243/informationforpublic

National Institute of Diabetes and Digestive and Kidney Diseases. (n.d.). Symptoms & causes of adrenal insufficiency & Addison’s disease. National Institutes of Health. https://www.niddk.nih.gov/health-information/endocrine-diseases/adrenal-insufficiency-addisons-disease/symptoms-causes

Office for Disability Issues. (2011). Equality Act 2010 guidance on matters to be taken into account in determining questions relating to the definition of disability. UK Government. Versione HTML pubblicata nel 2022; guida originale pubblicata per la prima volta nel maggio 2011. https://www.gov.uk/government/publications/equality-act-guidance/disability-equality-act-2010-guidance-on-matters-to-be-taken-into-account-in-determining-questions-relating-to-the-definition-of-disability-html

The Dangerous Invisibility of Addison’s Disease

Medical note: This article is intended for general education, disability awareness and institutional understanding. It does not provide medical advice, diagnosis, emergency instructions or individualized treatment recommendations. Addison’s disease and adrenal crisis require management according to the individual patient’s clinical plan and professional medical guidance. Adrenal crisis is a medical emergency and requires immediate treatment and urgent medical care (NICE, 2024).

One of the most dangerous misunderstandings about Addison’s disease begins with something apparently reassuring: a person may look completely well. They may walk into a university office unaided, attend a seminar, hold a conversation normally, travel, work, exercise, laugh, and look no different from anyone else in the room. It is easy for an observer to convert that appearance into a medical conclusion: they look healthy, therefore their condition cannot be very serious. With Addison’s disease, that inference can be profoundly wrong.

Addison’s disease is a form of primary adrenal insufficiency in which the adrenal cortex cannot produce adequate cortisol and, typically, adequate aldosterone. Cortisol is essential to physiological regulation and the response to stress, while aldosterone contributes to sodium, potassium, fluid-volume and blood-pressure regulation. Treatment with replacement hormones can allow people with Addison’s disease to live full and active lives, but replacement does not cure the underlying adrenal failure, nor does it eliminate the possibility of adrenal crisis (Bornstein et al., 2016; Dong et al., 2026; NICE, 2024).

This creates a paradox that is central to understanding the disease: the better Addison’s disease is managed, the easier it may become for other people to underestimate it. Successful treatment can suppress many outward signs of illness sufficiently well that the continuing physiological dependence on treatment becomes socially invisible. The person looks well partly because medication, planning, self-management and physiological compensation are working. Outward normality is therefore evidence of successful management; it is not evidence that the underlying vulnerability has disappeared.

Addison’s disease is explicitly described as an invisible disability

The phrase invisible disability is not merely a rhetorical label being imposed from outside. The UK Addison’s Disease Self-Help Group, in guidance developed with support from its Clinical Advisory Panel, explicitly describes adrenal insufficiency, including Addison’s disease, as “a rare condition and an invisible disability.” The organization explains that these conditions are lifelong, can seriously affect normal day-to-day activities and are fatal if untreated, while also noting that not everyone with adrenal insufficiency personally identifies as disabled and that individual legal circumstances still matter (ADSHG, 2025).

The word invisible needs to be understood carefully. It does not mean that the disease has no symptoms, that its effects are imaginary, or that everyone with Addison’s disease experiences the same limitations. It means that many of the medically significant effects are not immediately visible to an observer. Chronic fatigue does not necessarily alter someone’s appearance. Orthostatic hypotension may become apparent only when the person stands, becomes dehydrated or is physiologically stressed. A strict medication schedule is invisible unless someone sees the tablets being taken. An emergency hydrocortisone injection kit may remain inside a bag. Additional planning around illness, hydration, salt balance, temperature, travel, sleep, medical appointments and recovery is largely hidden from view.

This distinction matters because visible disability automatically supplies information to an observer. A wheelchair, white cane, prosthesis or other visible aid may immediately signal that assumptions about mobility, access or physical capacity need to be reconsidered. Invisible disability provides no equivalent automatic signal. The observer has to know about the condition, believe the information provided, and resist the intuitive tendency to use outward appearance as a proxy for physiological capacity.

That tendency is exactly where misunderstanding begins.

The person can look healthy because treatment is working

There is a particularly important legal and conceptual point here. UK Equality Act guidance explicitly addresses conditions whose effects are controlled by treatment. When determining whether an impairment has a substantial adverse effect, the guidance says that the effect should generally be considered as it would be without the treatment or corrective measure. It specifically recognizes that continuing treatment may mask or ameliorate a disability so effectively that its effects are “completely under control or not at all apparent” (Office for Disability Issues, 2011).

That principle fits Addison’s disease unusually well. Hormone replacement does not simply make someone feel a little better. Cortisol is essential for life. In primary adrenal insufficiency, glucocorticoid replacement substitutes for hormone that the adrenal glands can no longer produce adequately, while mineralocorticoid replacement is used when aldosterone function is deficient (Bornstein et al., 2016). The person standing in front of an administrator looking perfectly healthy may therefore be doing so while continuously dependent on replacement therapy for a physiological function that an unaffected person performs automatically.

This creates what I would call the paradox of successful compensation: the more successfully a treatment conceals the outward consequences of a serious impairment, the more tempting it becomes for an uninformed observer to conclude that the impairment is insignificant.

That logic is backwards.

A person with severe myopia does not cease to have an underlying visual impairment because glasses work. A person whose epilepsy is well controlled does not prove that epilepsy was never significant. Likewise, successful hormone replacement in Addison’s disease does not mean the adrenal cortex has recovered its ability to provide a normal physiological stress response. The disease can be well managed and medically serious at the same time.

Looking well can be evidence that treatment is working. It is not evidence that treatment is unnecessary, that symptoms are absent, or that the underlying disease is mild.

Invisible does not mean symptom-free

There is another misunderstanding worth correcting. Calling Addison’s disease an invisible disability does not mean that people with the condition experience no perceptible daily effects until an adrenal crisis suddenly appears. Chronic or long-lasting fatigue is among the most common symptoms of adrenal insufficiency. Muscle weakness, reduced appetite, gastrointestinal symptoms, low blood pressure, dizziness or fainting on standing, salt craving and other symptoms can also occur (NIDDK, n.d.). NICE specifically includes fatigue severe enough to significantly affect activities of daily living among the signs clinicians should consider when monitoring for glucocorticoid under-replacement (NICE, 2024).

The word fatigue can itself cause misunderstanding because almost everyone knows ordinary tiredness. It is easy to hear “fatigue” and mentally translate it into “feeling a bit tired after a long day.” Chronic disease-related fatigue can have a very different functional meaning. It can affect concentration, stamina, physical activity, the amount of recovery required after exertion or illness, and the ability to sustain the same level of performance throughout a long day. Importantly, severity varies considerably between individuals and across time. A person being capable of an activity once does not necessarily establish that they can perform it repeatedly, safely or without disproportionate recovery.

This is supported by broader evidence on quality of life. A systematic review of quality-of-life research in adrenal disease found that treatment improves quality of life but does not necessarily normalize it completely (Ho & Druce, 2018). A recent review of Addison’s disease in The Lancet Diabetes & Endocrinology likewise emphasizes that, despite corticosteroid replacement, people with Addison’s disease continue to experience reduced quality of life and increased mortality compared with the general population. One proposed contributor is the inability of conventional replacement therapy to reproduce the normal circadian and ultradian rhythms of cortisol secretion (Dong et al., 2026).

This is important for university and workplace settings because disability is often judged through visible performance. A student attends a two-hour seminar, therefore somebody assumes they can tolerate an eight-hour day under identical conditions. A person makes it to an appointment, therefore the journey must have been easy. Someone completes an examination, therefore the environmental conditions were harmless. A person looks energetic for twenty minutes during a meeting, therefore chronic fatigue cannot be substantial. These conclusions confuse observed performance at one moment with sustainable functional capacity over time.

There is an invisible workload behind appearing well

Chronic disease management also contains work that other people rarely see. Medication must be available and taken according to the prescribed schedule. Illness requires additional attention because glucocorticoid needs change during physiological stress. Emergency medication has to be available. Travel may require contingency planning. Medical monitoring takes time. A person may need to think about hydration, salt balance, access to medication, gastrointestinal illness, physical stress and whether circumstances are moving outside the range covered by ordinary replacement. ADSHG’s workplace guidance specifically notes variable energy levels, time-critical medication, potentially longer recovery from illness or injury, the risk of adrenal crisis and the need for emergency preparedness as practical issues that can affect people with adrenal insufficiency (ADSHG, 2025).

None of this is necessarily visible during an ordinary interaction. An administrator may see someone sitting calmly at a desk without seeing the medication schedule that made that ordinary hour possible, the emergency injection carried nearby, the fatigue experienced earlier that morning, or the recovery that may follow later. Successful self-management can therefore erase its own evidence from social perception.

There is a strange asymmetry here. If self-management fails, the disease becomes visible through illness. If self-management succeeds, the work required to prevent that illness becomes invisible. The individual may consequently receive the least recognition precisely when they have managed the condition most effectively.

This is one of the reasons invisible disability can be socially exhausting. The person may repeatedly have to explain risks that are real but currently unseen, describe limitations that fluctuate, and justify accommodations before a visible medical deterioration has occurred. The alternative—waiting until the disease becomes visibly severe enough to persuade everyone—is obviously a terrible model of disability support.

Temperature illustrates why environment can matter without being a universal symptom

Temperature deserves particular care because individual experience can be significant while the evidence does not justify saying that every person with Addison’s disease has “extreme temperature sensitivity.” Major clinical guidance does not list a single universal chronic temperature-intolerance syndrome as a defining feature of Addison’s disease. What can be said more rigorously is that environmental conditions can change physiological demand and can matter substantially for particular individuals.

Hot weather is especially relevant because sweating affects fluid and salt balance. ADSHG’s hot-weather guidance explains that people with Addison’s disease or adrenal insufficiency can find the condition harder to manage during hot weather and emphasizes hydration and salt/fluid balance (ADSHG, 2026). Heat also appeared among precipitating circumstances reported in a prospective study of adrenal crises, although gastrointestinal infection, fever and emotional stress were more common triggers in that cohort (Hahner et al., 2015).

This is a good example of why individualized accommodation matters. If a particular person has medically documented difficulty tolerating heat or another environmental condition, it is not scientifically rigorous to dismiss that limitation merely because temperature sensitivity is not identical in every patient. UK Equality Act guidance itself recognizes that environmental conditions such as temperature, humidity, time of day, tiredness and stress can exacerbate or lessen the effects of an impairment and should be considered when evaluating functional impact (Office for Disability Issues, 2011).

The right conclusion is therefore neither “everyone with Addison’s disease is extremely temperature sensitive” nor “temperature cannot matter because it is not universally listed as a diagnostic symptom.” The better conclusion is that environmental tolerance is an individual functional question and that heat has a plausible and documented relevance to fluid and salt management in adrenal insufficiency.

The most important vulnerability is the missing automatic stress response

The everyday burden of Addison’s disease is important, but the condition contains another level of vulnerability that explains why it must be taken seriously even when someone feels relatively well. In a person with intact adrenal function, physiological stress such as significant illness, trauma or surgery alters glucocorticoid demand, and the hypothalamic-pituitary-adrenal system participates automatically in adapting cortisol availability. In primary adrenal insufficiency, the damaged adrenal cortex cannot generate that normal adaptive response. The necessary increase in glucocorticoid support must therefore be supplied through treatment (Bornstein et al., 2016; NICE, 2024).

This creates a form of vulnerability that is almost impossible to see from appearance alone. At baseline, treatment may be entirely adequate. The person may feel reasonably well and look completely well. Then physiological circumstances can change: infection develops, fever rises, vomiting begins, diarrhoea causes fluid loss, surgery or trauma occurs, or another significant stressor increases glucocorticoid requirement. The adrenal glands cannot simply increase cortisol output to match the new demand, so management has to change appropriately and in time.

This is why “stable” and “invulnerable” are not synonyms. Stability describes the current relationship between physiological demand and available support. Addison’s disease leaves that relationship dependent on replacement therapy and emergency preparedness. A stable person is not secretly in adrenal crisis, nor should people with Addison’s disease be portrayed as perpetually close to death. Many live full and active lives with good care. But their physiological response to certain stressors is fundamentally different from that of someone with intact adrenal function, and that difference can become clinically important very quickly (NICE, 2024).

This is why “looks healthy” and “medically vulnerable” can be true at the same time

This apparent contradiction is perhaps the single most important point for someone unfamiliar with Addison’s disease. A person can genuinely be well at 10:00 in the morning and still possess a medical vulnerability that makes a later infection, gastrointestinal illness or other physiological stress more dangerous. There is no inconsistency. One statement describes the current state; the other describes the system’s reduced ability to adapt if that state changes.

Think of it as the difference between current function and adaptive reserve. Current function may be excellent. Adaptive endocrine capacity remains constrained because the adrenal cortex cannot autonomously produce the normal cortisol response. Replacement therapy supplies what is missing under ordinary conditions, and sick-day or emergency management supplies additional support when circumstances demand it. The person’s outward appearance primarily tells us about the first of these—the current moment. It tells us very little about the second.

This is why appearance is such a poor medical signal.

If someone sees a visibly injured person, they rarely infer that the injury is insignificant simply because the person can still speak normally. Yet with invisible chronic disease, visible normality easily becomes a kind of unofficial diagnostic test. The observer unconsciously asks, “Does this person look ill?” If the answer is no, the observer may lower their estimate of risk.

In Addison’s disease, that can create what I would call false reassurance.

It is not exactly a false positive; it is closer to a false green

In strict statistical language, the problem is not best described as a “false positive.” If appearance were treated as a crude test for serious underlying vulnerability, the error would actually resemble a false negative: the vulnerability is present, but the observer fails to detect it. Yet neither term captures the whole problem because appearance is not a medical test in the first place.

I prefer the phrase false green, borrowing the language of system monitoring. A dashboard can show a service as green because the process is running even while the function that matters to users has failed. The indicator is technically observing something real, but the observer asks it to answer a broader question than it can answer.

The equivalent social reasoning looks like this:

Observed:
person is walking normally
person is talking normally
person attended class
person looks well today

Inferred:
therefore ordinary stamina
therefore ordinary heat tolerance
therefore ordinary recovery from illness
therefore no significant disability
therefore low medical risk

The problem lies in the inference, not in the observation. The person really is walking and talking normally. The mistake is treating those observations as evidence about variables they do not measure.

Outward appearance is a very low-information health check for an endocrine disorder.

This is deeper than simple ignorance of a rare disease. It is a form of visibility bias: people naturally give more weight to impairments they can see and less weight to physiological dependencies they cannot. Addison’s disease adds another complication because effective treatment itself reduces visibility. The disease can therefore generate an epistemic trap in which the successful control of symptoms is misread as evidence that serious risk was never present.

The better the compensation works, the easier it becomes for an observer to forget what is being compensated for.

False reassurance becomes dangerous when it changes other people’s behaviour

Misunderstanding an invisible disability is not merely socially unpleasant. It can alter decisions. A university office may decline an environmental adjustment because the student appears physically healthy. A colleague may assume someone can simply “push through” severe fatigue. A supervisor may treat disability-related recovery time as ordinary absence. An institution may fail to develop an emergency plan because the possibility of adrenal crisis feels abstract. In an acute situation, bystanders or even healthcare professionals unfamiliar with adrenal insufficiency may underestimate the significance of deterioration because the individual was apparently well only hours earlier.

The central error is temporal: observers expect serious disease to look serious continuously. Addison’s disease does not have to behave that way. The person can be well controlled, then develop a physiological stressor that changes glucocorticoid requirements. NICE specifically advises increased glucocorticoid replacement during significant physiological stress and immediate intramuscular or intravenous hydrocortisone when adrenal crisis is suspected. It also recommends emergency injection kits and training because speed matters (NICE, 2024).

This means that an earlier appearance of health provides little reassurance once the physiological situation changes. “But they looked fine this morning” is not evidence against an evolving adrenal crisis. It is evidence only that the person looked fine that morning.

That sounds almost embarrassingly obvious when written down, but this exact reasoning error occurs throughout medicine and disability assessment: a snapshot is mistaken for a trajectory.

Adrenal crisis is where invisible vulnerability can become suddenly visible

An adrenal crisis is an acute, life-threatening deterioration associated with insufficient glucocorticoid activity relative to physiological need, often accompanied by haemodynamic instability and other systemic abnormalities. NICE advises clinicians to consider adrenal crisis in critically unwell people with features such as low blood pressure, hyponatraemia, hypoglycaemia, circulatory shock or collapse, and also in people with known or high-risk adrenal insufficiency who develop symptoms including lethargy, weakness, confusion, pallor or clamminess (NICE, 2024).

The transition can be especially dangerous during vomiting or diarrhoea because two problems can occur together. Physiological stress and fluid loss increase the burden on the body while oral glucocorticoid medication may no longer be reliably retained or absorbed. NICE therefore recommends parenteral hydrocortisone and hospital care when prolonged vomiting or diarrhoea prevents absorption of oral glucocorticoids (NICE, 2024).

This is a very different situation from simply “feeling more tired than usual.” The underlying vulnerability has interacted with an acute stressor and the ordinary maintenance pathway may no longer be sufficient. The person who looked well yesterday can therefore require emergency treatment today without any contradiction between those two observations.

That possibility is precisely why universities and workplaces should not wait for a condition to become visibly dramatic before taking it seriously.

The fatality is real, but it should be described without sensationalism

Addison’s disease is treatable, and adrenal crisis is a medical emergency for which effective treatment is well established. It would therefore be inaccurate and unnecessarily frightening to describe people with well-managed Addison’s disease as living continuously on the edge of death. At the same time, it would be equally inaccurate to minimize the potential fatality of adrenal crisis. NICE states plainly that untreated adrenal insufficiency can progress to adrenal crisis and that adrenal crisis can be fatal (NICE, 2024).

Prospective data show why this risk deserves respect. Hahner and colleagues followed 423 people with chronic adrenal insufficiency for two years and documented 64 adrenal crises over 767.5 patient-years, equivalent to 8.3 crises per 100 patient-years. Ten participants died during follow-up, and four of those deaths were associated with adrenal crisis, corresponding to 0.5 adrenal-crisis-related deaths per 100 patient-years in that cohort. The authors estimated that approximately 6% of the observed crises were associated with mortality (Hahner et al., 2015). That percentage should not be treated as a universal probability for every crisis or every patient; it describes one prospective cohort and crisis incidence and outcomes vary across populations.

A large UK database study adds another perspective. Ngaosuwan and colleagues compared 6,821 people with adrenal insufficiency with matched controls and found increased all-cause mortality, with the increase greater in primary than secondary adrenal insufficiency. In that dataset, adrenal crisis was recorded as contributing to around 10% of deaths among people with adrenal insufficiency, and mortality and hospitalization for adrenal crisis were especially elevated in the earlier period after diagnosis (Ngaosuwan et al., 2021).

The newest major review of Addison’s disease likewise concludes that increased mortality and reduced quality of life remain concerns despite corticosteroid replacement, with adrenal-crisis management and the limitations of current replacement strategies among the issues still requiring improvement (Dong et al., 2026).

The appropriate conclusion is therefore neither panic nor complacency. It is preparedness.

Addison’s disease is manageable, but adrenal crisis remains a recognized and potentially fatal complication. The seriousness lies precisely in the fact that a person can be stable most of the time while still requiring rapid, correct intervention when particular circumstances arise.

Rare disease creates a second form of invisibility

Addison’s disease is uncommon, and rarity produces another problem beyond physical invisibility: cognitive invisibility. Many administrators, teachers, employers and colleagues may never knowingly have encountered someone with the disease. Even some healthcare professionals encounter adrenal crisis infrequently. The result is that people interpret unfamiliar symptoms using familiar assumptions.

Fatigue may be interpreted as poor sleep. Dizziness may be attributed to anxiety. Reduced stamina may look like a lack of effort. Recovery time after illness may appear excessive. A request concerning heat, hydration, medication, flexibility or emergency preparedness may seem disproportionate because the observer lacks the medical model that makes the request intelligible.

Addison’s disease is also diagnostically challenging for related reasons. Its symptoms can be vague and nonspecific, and delayed diagnosis remains an important feature of the disease. The 2026 review by Dong and colleagues notes that some people still first present in adrenal crisis because the preceding symptoms were not recognized as Addison’s disease (Dong et al., 2026).

Physical invisibility and cognitive invisibility can therefore reinforce each other:

rare disease
      ↓
low public familiarity
      ↓
few visible clues
      ↓
ordinary appearance
      ↓
risk underestimated
      ↓
requests for support appear disproportionate
      ↓
the disease becomes even easier to dismiss

For awareness work, breaking this loop is one of the most important goals.

The Equality Act anticipates exactly this problem

For universities and employers in Great Britain, there is an important legal context. The Equality Act 2010 defines disability through a physical or mental impairment that has a substantial and long-term adverse effect on the ability to carry out normal day-to-day activities. The statutory guidance makes clear that environmental factors, fluctuating effects and the masking effects of treatment may all be relevant. In particular, continuing medical treatment is generally disregarded when considering how substantial the underlying impairment would be if that treatment were absent (Office for Disability Issues, 2011).

This is extraordinarily relevant to Addison’s disease because lifelong medication may be exactly what makes the impairment less visible. The guidance explicitly recognizes that treatment can make effects completely controlled or “not at all apparent,” yet that does not automatically remove the underlying disability for the purpose of assessment (Office for Disability Issues, 2011).

The guidance also addresses recurring and fluctuating effects. An impairment does not have to produce the same level of limitation every hour of every day in order to be significant. Effects that recur can still be treated as long-term, and environmental circumstances can exacerbate an impairment (Office for Disability Issues, 2011).

This directly challenges one of the most common informal tests applied to invisible disability:

"You seemed fine when I saw you."

therefore

"Your disability cannot substantially affect you."

The second statement does not follow from the first medically, functionally or, in many circumstances, legally.

Universities should assess sustainable function, not a single good hour

This distinction is especially important in higher education because university life is built around intermittent observations. A tutor sees a student during a seminar. A disability adviser sees them during an appointment. Accommodation staff see them while discussing a room. Examination staff see them during a particular assessment. Each observer receives a narrow snapshot of a much longer physiological day.

The student, however, lives the entire sequence: waking, taking medication, travelling, managing meals and fluids, attending teaching, dealing with temperature and exertion, concentrating, recovering, preparing for the next activity and managing any intercurrent illness. A two-hour period of apparently normal performance cannot tell an administrator how costly that performance was or whether the same conditions are sustainable repeatedly.

A useful distinction is between peak performance and sustainable capacity. Many disabled people can perform an activity under some circumstances. The relevant question for accommodation is often whether they can do so repeatedly, safely, predictably and without disproportionate physiological cost.

For example, the fact that a student can tolerate a warm room for a short meeting does not necessarily establish that prolonged exposure is functionally safe or sustainable for that individual. The fact that they attended one morning after illness does not establish ordinary recovery. The fact that they completed one long day does not establish that fatigue has no substantial effect. A sensible disability assessment looks at patterns, cumulative effects and individualized medical evidence rather than treating one successful observation as a stress test that the person has permanently passed.

Accommodation should respond to function and risk rather than appearance

There is no single universal accommodation package for Addison’s disease. Individual needs vary substantially, and some people may require few or no adjustments at a particular time. Others may have significant fatigue, orthostatic symptoms, environmental sensitivities, other autoimmune conditions, recurrent crises or a more complicated treatment history. ADSHG emphasizes this individuality in its workplace guidance and recommends discussion, regular review and consideration of the specific person’s requirements (ADSHG, 2025).

In a university context, relevant adjustments might therefore include flexibility around medically necessary absences or recovery, access to medication and fluids, the ability to attend medical appointments, appropriate consideration of documented environmental limitations, suitable rest arrangements, and an agreed emergency plan where appropriate. These are examples of areas that may matter, not a checklist that every person with Addison’s disease automatically requires.

The underlying principle is much simpler:

Do not infer functional capacity from visual appearance. Ask what the person actually experiences, consider the medical evidence, understand the risks that are specific to them, and design support around those realities.

Emergency preparedness should exist before the emergency becomes visible

Institutions also need to understand the peculiar logic of emergency preparation. An emergency hydrocortisone kit may remain unused for years. That does not make it unnecessary. Its purpose is precisely to be available for a low-frequency, high-consequence event. NICE recommends emergency management kits for people with primary adrenal insufficiency and training in their use, while ADSHG recommends workplace awareness and emergency planning because adrenal crisis may occur outside the home (NICE, 2024; ADSHG, 2025).

A poor institutional response would wait until a crisis happens and then begin asking what Addison’s disease is.

A better response understands the condition beforehand, respects confidentiality, knows who needs to have relevant emergency information with the person’s agreement, and ensures that institutional procedures do not obstruct urgent care. ADSHG’s workplace guidance, for example, recommends that a named first aider be made aware of the diagnosis where appropriate so that they can respond effectively to an emergency (ADSHG, 2025).

The philosophy is preventive rather than alarmist. We install fire exits not because we believe every building is constantly burning, but because the consequences of discovering during a fire that there is no exit are unacceptable. Emergency planning for adrenal crisis follows a similar logic: preparation is justified by the seriousness and time sensitivity of the event, not by an assumption that crisis is occurring continuously.

The person should not have to become visibly ill to be believed

This may be the most important social lesson of invisible disability. If institutional recognition is granted only when impairment becomes externally obvious, then the system perversely rewards deterioration. Someone who manages medication, fatigue, temperature, illness and daily activity sufficiently well to remain outwardly functional may have more difficulty obtaining support than someone whose impairment is visibly undeniable.

That creates an unreasonable threshold of proof:

"You say this condition creates a serious limitation."

"But you look well."

"Therefore show us the limitation."

The only convincing evidence becomes:
visible deterioration.

No responsible disability system should operate that way.

The purpose of reasonable adjustment is often to prevent avoidable deterioration and to allow participation on equitable terms. Requiring someone to demonstrate harm before reducing a known disadvantage defeats that purpose. It is especially inappropriate in a condition where physiological stress and delayed intervention can have serious consequences.

This does not mean accepting every requested adjustment automatically or treating diagnosis as sufficient evidence for every possible accommodation. Universities are entitled to assess individual needs and proportionality. The point is that appearance should contribute almost nothing to that assessment. The relevant evidence concerns diagnosis, functional effects, environmental interaction, clinical recommendations and the individual’s actual experience.

There is also a privacy paradox

Invisible disability produces another dilemma. Because the condition is not obvious, disclosure can be necessary to obtain support or establish an emergency plan. Yet medical information is private, and ADSHG correctly emphasizes that not everyone wants to disclose their diagnosis broadly to employers or colleagues (ADSHG, 2025).

This creates a difficult balance. Too little disclosure may mean that nobody knows how to respond during an emergency. Too much disclosure unnecessarily exposes private health information. Good institutional practice therefore needs controlled, purposeful communication: only the people who genuinely need information should receive it, and the individual’s wishes about confidentiality should be respected as far as possible.

For universities, that may mean distinguishing between an accommodation office that needs detailed medical evidence, teaching staff who may need only the functional adjustment, and designated emergency personnel who may need specific information about adrenal crisis. “Everyone should know” and “nobody needs to know” are both crude solutions to a problem that requires careful information boundaries.

The daily vulnerability should not erase autonomy

There is also a danger in the opposite direction. Once people learn that adrenal crisis can be fatal, they may begin to see the person primarily as fragile, dependent or perpetually ill. That is another distortion. People with Addison’s disease can study, work, travel, exercise, build careers and live full lives. NICE explicitly communicates that people with adrenal insufficiency can live full and active lives when they receive consistently good information and care (NICE, 2024).

The goal of awareness is therefore not to replace underestimation with paternalism. It is to hold two truths together:

The person may be highly capable,
independent and outwardly well.

AND

The person has a permanent endocrine disorder
with real daily effects and a potentially
life-threatening failure mode.

Neither truth cancels the other.

This is why the word vulnerability needs to be used carefully. Vulnerability describes a physiological dependency and a reduced margin under particular forms of stress. It does not describe the person’s character, intelligence, competence or autonomy.

What people around someone with Addison’s disease actually need to understand

For most colleagues, tutors, administrators and friends, detailed knowledge of steroid biochemistry is unnecessary. They do not need to become endocrinologists. They need a correct mental model.

The model can be surprisingly concise. Addison’s disease is a lifelong failure of adrenal hormone production. Replacement therapy can make the person look and function normally, but it does not restore the adrenal glands’ automatic cortisol response to physiological stress. Chronic symptoms such as fatigue and low blood pressure can still affect everyday function. Individual environmental factors may matter. Significant illness changes glucocorticoid requirements. Vomiting or diarrhoea can be particularly dangerous because medication absorption may become unreliable. Adrenal crisis is uncommon relative to ordinary daily life, but it is a real, time-critical and potentially fatal emergency. Support should therefore be based on the person’s actual functional needs and medical plan, not on whether they “look disabled” (NICE, 2024; ADSHG, 2025).

If a university office remembers only one sentence, I would choose this:

A person with Addison’s disease may look entirely well because treatment and self-management are successfully maintaining stability; that visible stability should never be mistaken for absence of disability, absence of symptoms, or absence of medical vulnerability.

The deeper problem is epistemic as much as medical

The more I think about invisible disability, the more I think the underlying problem is not only medical knowledge but how we decide what counts as evidence. Humans are strongly influenced by visible information. We trust what we can see. A visibly broken limb supplies immediate evidence. Hormonal dependence, reduced physiological reserve, chronic fatigue, orthostatic symptoms and crisis risk do not.

That makes Addison’s disease an unusually clear example of a broader epistemic problem: absence of visible evidence is easily mistaken for evidence of absence.

Successful treatment intensifies the problem because it actively removes some of the visible evidence. The causal chain can become almost ironic:

serious chronic disease
        ↓
effective treatment and careful self-management
        ↓
person appears well
        ↓
observer sees little evidence of impairment
        ↓
observer underestimates disease
        ↓
support judged unnecessary

The conclusion at the end is exactly backwards. The person looks well because the management system is succeeding.

This is why I think “false reassurance” is more useful than “false positive.” There is no defective laboratory test here. The failure occurs in interpretation. A true observation—“this person looks well”—is being asked to prove something it cannot prove—“therefore this person has ordinary physiological resilience and no substantial disability.”

In engineering I might call that a badly designed health check. In disability awareness, it is better understood as a reminder that visibility is an unreliable proxy for severity.

Looking well should be the beginning of understanding, not the end

Addison’s disease contains an unusual combination of normality and vulnerability. Treatment can restore enough physiological function for everyday life to look entirely ordinary. That ordinary life can still contain chronic fatigue, variable energy, low blood pressure, medication dependence, environmental constraints, additional recovery needs and continuous emergency preparedness. Above all, the inability to generate a normal cortisol response during physiological stress creates a vulnerability that is largely invisible until circumstances expose it.

None of this means that every person with Addison’s disease experiences the same disability, requires the same accommodations or lives in continuous danger. Individual variation is real, and good support should preserve that nuance. But variation is not a reason to minimize the disease. The correct response is individualized understanding.

The fatality of adrenal crisis makes this especially important. A condition does not need to look dramatic every day in order to contain a dangerous failure mode. Indeed, the danger of Addison’s disease is partly that the serious vulnerability can coexist with a remarkably normal outward life. That coexistence is not contradictory. It is what successful treatment makes possible.

For a university, employer or anyone encountering the disease for the first time, the lesson is therefore simple but consequential: believe the medical reality before demanding visual proof of it. Evaluate sustainable function rather than a momentary appearance. Take fatigue and environmental limitations seriously when they are documented. Respect the individual’s privacy and autonomy. Make reasonable preparations for foreseeable emergencies. And understand that the person standing in front of you looking completely well may be both genuinely well at that moment and genuinely medically vulnerable at the same time.

Those two truths belong together.

References

Addison’s Disease Self-Help Group. (2025). Employment and Addison’s or adrenal insufficiency. Published 8 July 2025; updated 11 September 2025. https://www.addisonsdisease.org.uk/employment-and-adrenal-insufficiency

Addison’s Disease Self-Help Group. (2025). Guidance for employees. https://www.addisonsdisease.org.uk/guidance-for-employees

Addison’s Disease Self-Help Group. (2026). Hot weather. Updated 15 July 2026. https://www.addisonsdisease.org.uk/hot-weather

Bornstein, S. R., Allolio, B., Arlt, W., Barthel, A., Don-Wauchope, A., Hammer, G. D., Husebye, E. S., Merke, D. P., Murad, M. H., Stratakis, C. A., & Torpy, D. J. (2016). Diagnosis and treatment of primary adrenal insufficiency: An Endocrine Society clinical practice guideline. The Journal of Clinical Endocrinology & Metabolism, 101(2), 364–389. https://doi.org/10.1210/jc.2015-1710

Dong, J., Hahner, S., Bancos, I., & Tomlinson, J. W. (2026). Clinical features, investigation, and management of Addison’s disease. The Lancet Diabetes & Endocrinology, 14(3), 243–258. https://doi.org/10.1016/S2213-8587(25)00393-6

Hahner, S., Spinnler, C., Fassnacht, M., Burger-Stritt, S., Lang, K., Milovanovic, D., Beuschlein, F., Willenberg, H. S., Quinkler, M., & Allolio, B. (2015). High incidence of adrenal crisis in educated patients with chronic adrenal insufficiency: A prospective study. The Journal of Clinical Endocrinology & Metabolism, 100(2), 407–416. https://doi.org/10.1210/jc.2014-3191

Ho, W., & Druce, M. (2018). Quality of life in patients with adrenal disease: A systematic review. Clinical Endocrinology, 89(2), 119–128. https://doi.org/10.1111/cen.13719

Ngaosuwan, K., Johnston, D. G., Godsland, I. F., Cox, J., Majeed, A., Quint, J. K., Oliver, N., & Robinson, S. (2021). Increased mortality risk in patients with primary and secondary adrenal insufficiency. The Journal of Clinical Endocrinology & Metabolism, 106(7), e2759–e2768. https://doi.org/10.1210/clinem/dgab096

National Institute for Health and Care Excellence. (2024). Adrenal insufficiency: Identification and management (NICE guideline NG243) — Recommendations. https://www.nice.org.uk/guidance/ng243/chapter/Recommendations

National Institute for Health and Care Excellence. (2024). Adrenal insufficiency: The care you should expect — Information for the public. https://www.nice.org.uk/guidance/ng243/informationforpublic

National Institute of Diabetes and Digestive and Kidney Diseases. (n.d.). Symptoms & causes of adrenal insufficiency & Addison’s disease. National Institutes of Health. https://www.niddk.nih.gov/health-information/endocrine-diseases/adrenal-insufficiency-addisons-disease/symptoms-causes

Office for Disability Issues. (2011). Equality Act 2010 guidance on matters to be taken into account in determining questions relating to the definition of disability. UK Government. HTML version published 2022; original guidance first published May 2011. https://www.gov.uk/government/publications/equality-act-guidance/disability-equality-act-2010-guidance-on-matters-to-be-taken-into-account-in-determining-questions-relating-to-the-definition-of-disability-html

What an Addisonian/Adrenal Crisis Taught Me About Computer Failure, and When a System Can No Longer Compensate…

Medical note: This essay uses Addison’s disease and adrenal crisis as a systems-level analogy for thinking about computer failure. It is intended only as conceptual and educational discussion. It is not medical advice, diagnosis, or a treatment guide. Adrenal crisis is a potentially life-threatening medical emergency; suspected adrenal crisis requires urgent medical assessment and treatment according to established emergency guidance and the individual patient’s clinical plan (National Institute for Health and Care Excellence [NICE], 2024; Bornstein et al., 2016).

A few hours after recovering my VPS, I made a slightly absurd joke: “My little computer that runs the website seems to have had an adrenal crisis, and I just saved it by giving it the sysadmin equivalent of a shot.” Obviously, a server cannot have Addison’s disease, and Scaleway rescue mode is not hydrocortisone. But the joke stayed in my head because the resemblance was deeper than I initially expected.

The technical incident had started with a Cloudflare HTTP 522 and an inaccessible WordPress site. Underneath that visible outage, however, I eventually reconstructed something much more systemic. A DNS-over-WARP path had abruptly failed. DNS requests then multiplied, WARP logged enormous numbers of near-identical warnings, the logs consumed gigabytes of a very small root filesystem, ENOSPC appeared, log rotation itself failed, MariaDB began encountering write problems, resolver state deteriorated, and eventually both the public web service and my SSH management path disappeared.

The server did not simply switch from “healthy” to “dead.” It remained partially functional while its ability to remain functional was progressively being consumed.

That was what made me think of an Addisonian crisis—or, in the terminology I will generally use here, an adrenal crisis.

The comparison obviously cannot be made at the level of literal mechanisms. A Linux filesystem has no endocrine system. Cortisol is not free disk space. WARP is not an adrenal cortex, and restarting a daemon is certainly not hormone replacement. Trying to construct a one-to-one correspondence between biological organs and software components would turn a useful analogy into nonsense.

The interesting comparison begins one level higher:

How does a complex system remain viable
while disturbances continuously push it away
from its normal operating region?

How much disturbance can its regulatory mechanisms absorb?

And what happens when its capacity
to compensate is no longer sufficient?

Those are naturally physiological questions. They also turned out to describe my VPS remarkably well.

What Addison’s disease changes in the regulatory system

Addison’s disease is primary adrenal insufficiency. In primary adrenal insufficiency, dysfunction or damage of the adrenal glands results in inadequate cortisol production and can also impair aldosterone production. Cortisol contributes to the regulation of blood pressure, blood glucose, metabolism and inflammatory activity, while aldosterone is important for sodium, potassium and water balance and therefore for circulatory stability (National Institute of Diabetes and Digestive and Kidney Diseases [NIDDK], n.d.).

Primary adrenal insufficiency is therefore different from secondary or tertiary adrenal insufficiency. Those conditions arise higher in the hypothalamic-pituitary-adrenal axis. Mineralocorticoid function is generally preserved in central adrenal insufficiency because aldosterone is regulated predominantly through the renin-angiotensin-aldosterone system rather than through ACTH in the same way as cortisol (Bornstein et al., 2016).

This distinction becomes important once we stop thinking of cortisol merely as “the stress hormone.” That description is not wrong, exactly, but it is far too compressed for the systems question I am interested in. Cortisol participates in several interacting forms of physiological regulation, and aldosterone adds another important regulatory pathway in primary adrenal insufficiency (NIDDK, n.d.; Bornstein et al., 2016).

So a systems-level description of Addison’s disease should not be:

one hormone is low
      ↓
symptoms appear

A more useful abstraction is:

part of a regulatory network loses capacity
        |
        +--> glucocorticoid regulation impaired
        |
        +--> mineralocorticoid regulation may also be impaired
        |
        v
the organism has less endogenous capacity
to respond to changing physiological demands

This does not mean cortisol or aldosterone somehow “control the whole body.” They do not. Blood pressure, circulating volume, vascular responsiveness, electrolytes, glucose, renal function, inflammatory activity and neurological function belong to an enormously interconnected physiological system with many overlapping regulatory mechanisms.

That interconnectedness is precisely the point.

When an important regulatory contribution disappears, the consequences do not necessarily remain confined to the component that originally failed. They propagate through relationships among subsystems.

That was already sounding familiar.

Homeostasis does not mean standing still

The concept that first gave me a proper vocabulary for the comparison was homeostasis.

Homeostasis is easy to imagine as though the body were trying to freeze a set of variables at perfect numerical values:

blood pressure = X
glucose        = Y
temperature    = Z
sodium         = S

That is not a very good picture of living regulation. Billman describes homeostasis as a self-regulating process through which an organism maintains internal stability while adapting to changing external conditions. Crucially for this analogy, he emphasizes that homeostasis is dynamic rather than static and that physiological regulation emerges from multiple interacting feedback systems rather than one simple feedback loop (Billman, 2020).

A living organism is changing continuously. A person stands up, sleeps, wakes, eats, exercises, loses water, encounters heat or cold, develops an infection, recovers from one, and passes through circadian changes in hormone secretion. Heart rate changes. Vascular tone changes. Renal handling of water and electrolytes changes. Metabolism changes.

Stability therefore does not require immobility.

It looks more like this:

disturbance
     ↓
regulated variables begin to change
     ↓
sensors and regulatory mechanisms respond
     ↓
other variables change in compensation
     ↓
the organism remains within
a physiologically viable range

The apparently paradoxical result is that a living system can remain stable because many of its components are continuously changing.

Billman’s account is particularly useful here because it treats physiological regulation as hierarchical and interconnected. Feedback mechanisms can compensate for disturbances, overlap with one another and provide flexibility when the environment changes (Billman, 2020). Stability is therefore an achievement of an active regulatory organization.

Consider something as ordinary as standing up. Gravity changes the distribution of blood. Cardiovascular regulatory mechanisms respond by altering vascular tone and cardiac behaviour so that adequate blood pressure and perfusion can be maintained. The variables move; the regulatory relationships help preserve viable function.

Or consider infection. Inflammatory signalling changes, temperature may change, cardiovascular and metabolic demands can change, and the hypothalamic-pituitary-adrenal axis participates in the physiological response to stress. Severe illness also changes cortisol availability through mechanisms more complicated than the simple textbook story of “stress causes more ACTH and therefore more cortisol”; altered cortisol metabolism and clearance can contribute as well (Dineen et al., 2019).

The organism does not defend one immutable physiological snapshot. It continually reorganizes itself while preserving conditions compatible with continued life.

This is already remarkably close to how I now think about a healthy computer system.

My VPS never occupies one fixed state either:

network traffic changes
DNS demand changes
process counts change
memory pressure changes
filesystem usage changes
database workload changes
logs grow
logs rotate
connections appear
connections disappear
services restart

A healthy server is not one on which those variables stop changing. It is one whose regulatory mechanisms allow those changes to occur without pushing essential functions outside an operationally viable region.

Normally, for example:

logs grow
    ↓
rotation occurs
    ↓
old logs are compressed or removed
    ↓
sufficient filesystem capacity remains

Memory management contains another family of regulatory responses:

processes request memory
        ↓
available memory decreases
        ↓
cache reclamation / paging / swap may respond
        ↓
workload remains supportable

Networking has its own:

temporary request failure
        ↓
retry
        ↓
path recovers
        ↓
operation succeeds

I am not claiming that logrotate is literally a homeostatic organ. That would stretch the biological concept until it stopped meaning anything. The useful claim is narrower: both systems contain feedback and compensatory mechanisms whose function is to keep important variables inside workable ranges despite disturbances.

Once I saw the problem at that level, the VPS failure started looking less like “one program broke” and more like a failure of regulation.

Stress reveals capacities that ordinary operation can hide

Addison’s disease becomes particularly revealing from a systems perspective when physiological demand changes.

Under significant physiological stress—such as serious illness, trauma or surgery—the body’s requirement for glucocorticoid activity changes. A person with primary adrenal insufficiency cannot generate the normal endogenous increase in cortisol production through the adrenal cortex, which is why established management includes increased glucocorticoid dosing during significant physiological stress (Bornstein et al., 2016; NICE, 2024).

The details of the stress response deserve some care. It would be too simple to represent critical illness as a single linear chain in which stress produces ACTH, ACTH produces cortisol, and that explains everything. Dineen and colleagues discuss additional changes in cortisol metabolism and clearance during critical illness (Dineen et al., 2019). For the systems analogy, however, the key practical point remains: changing physiological conditions alter the glucocorticoid requirement, and adrenal insufficiency removes the adrenal gland’s ability to autonomously supply the normal adaptive response.

Conceptually, an intact system can be simplified to:

physiological demand rises
        ↓
integrated stress-response systems react
        ↓
cortisol availability adapts
        ↓
increased demand is accommodated

Primary adrenal insufficiency changes an important part of that loop:

physiological demand rises
        ↓
damaged adrenal cortex cannot provide
the normal adaptive cortisol response
        ↓
external glucocorticoid replacement
must provide the missing capacity

This is where the systems architecture becomes fascinating. Treatment effectively moves part of an automatic physiological regulatory function outside the organism.

Routine glucocorticoid replacement supplies hormone that the adrenal glands cannot adequately produce. Mineralocorticoid replacement is also required when mineralocorticoid deficiency is present in primary adrenal insufficiency (Bornstein et al., 2016; NICE, 2024). During significant physiological stress, glucocorticoid requirements may rise, so current NICE guidance includes sick-day dosing and provision of emergency hydrocortisone for people at risk of adrenal crisis (NICE, 2024).

Abstractly, part of the regulatory loop now becomes:

physiological disturbance
        ↓
recognition of increased demand
        ↓
external intervention
        ↓
additional regulatory capacity supplied
        ↓
system remains viable

That is a profound architectural change.

The regulation has not ceased to exist. Part of it has crossed the boundary of the system being regulated.

And that immediately raises another question: how much disturbance can the system tolerate before that additional capacity becomes necessary?

Reserve is not simply unused capacity

Computer engineers are comfortable talking about spare capacity because it is often numerically visible:

filesystem capacity: 10 GB
currently used:        6 GB
nominal free space:    4 GB

Physiological reserve is much more complicated. Biology, rather inconsiderately, does not expose a command called physiology --show-reserve.

There is no single meter saying:

COMPENSATORY RESERVE: 37%

What we loosely call physiological reserve emerges from interacting capacities. Cardiovascular responses, renal regulation, endocrine responses, autonomic activity, circulating volume, metabolic substrate availability and many other processes contribute to the ability to tolerate disturbance. Homeostatic stability itself arises from interacting and partially redundant regulatory systems rather than a single controller (Billman, 2020).

Most importantly, reserve is meaningful relative to a demand.

A system can function adequately in its ordinary environment while possessing insufficient capacity for an unusual perturbation.

That is particularly visible in adrenal insufficiency. With appropriate treatment, people with adrenal insufficiency can live normal and active lives (NIDDK, n.d.). Yet infection, trauma, surgery, significant gastrointestinal illness or other physiological stresses can increase glucocorticoid requirements. Vomiting or diarrhoea creates an especially dangerous situation because physiological stress and fluid loss may increase at the same time that oral glucocorticoid medication cannot reliably be retained or absorbed (NICE, 2024).

Dineen et al. describe the pathophysiology of adrenal crisis as incompletely understood, but identify an important underlying problem as a mismatch between the cortisol required during physiological stress and the cortisol available (Dineen et al., 2019).

I find that formulation remarkably useful.

It changes the conceptual statement from:

cortisol is low

into:

required regulatory capacity
            >
available regulatory capacity

The second expression is relational.

There may be enough capacity for one state of the world and too little for another.

And that is exactly the kind of relationship I had seen in the VPS.

Adrenal crisis is a systems event

Adrenal crisis is a life-threatening medical emergency. It can involve hypotension, volume depletion, electrolyte abnormalities, weakness, altered mental status and circulatory shock or collapse. Established guidance emphasizes immediate hydrocortisone administration and fluid resuscitation when adrenal crisis is suspected, without waiting for diagnostic confirmation when delay would endanger the patient (NICE, 2024; Bornstein et al., 2016).

The exact pathophysiological sequence is more complicated than any simple diagram. Dineen et al. explicitly note that the pathophysiology of adrenal crisis remains incompletely understood. Their discussion nevertheless identifies several interacting elements, including insufficient cortisol availability relative to physiological demand, impaired vascular responsiveness and volume depletion (Dineen et al., 2019).

What interests me here is not using those features diagnostically. It is understanding what the word crisis means when considered as a systems phenomenon.

Imagine, very abstractly, several physiological variables interacting:

circulating volume
        ↕
blood pressure
        ↕
vascular responsiveness
        ↕
electrolyte balance
        ↕
glucose availability
        ↕
renal perfusion
        ↕
neurological function

No single arrow in this diagram contains “adrenal crisis.”

Likewise, cortisol is not a master variable determining every other state directly. The organism contains many overlapping regulatory mechanisms.

Now introduce a substantial perturbation:

infection
    |
    +--> inflammatory signalling
    |
    +--> altered metabolic demand
    |
    +--> possibly fever
    |
    +--> possibly reduced intake / fluid loss
    |
    v
greater demand on regulatory capacity

If vomiting or diarrhoea is also present, another interaction can emerge:

vomiting / diarrhoea
        |
        +--> fluid loss
        |
        +--> reduced circulating volume
        |
        +--> oral medication may not be retained
        |
        v
less capacity to compensate
while physiological demand is increasing

NICE specifically addresses prolonged vomiting or diarrhoea in adrenal insufficiency because inability to absorb oral glucocorticoids requires escalation to parenteral treatment and emergency medical care (NICE, 2024).

Structurally, this is very different from:

component A breaks
        ↓
system stops

Several relationships can deteriorate together. A disturbance increases demand. A missing endocrine response reduces available adaptive capacity. Fluid loss can worsen haemodynamic stability. Failure to retain oral medication can further reduce available glucocorticoid replacement. The resulting state can then become progressively harder for the organism to correct (Dineen et al., 2019).

The pathology exists partly in the relationships among these processes.

This is where the word decompensation became extremely useful to me.

Compensation is not the same thing as health

During the VPS incident, the DNS-over-WARP failure began around August 11. The externally obvious website failure did not appear until August 16.

For several days, therefore, the server occupied an intermediate state.

It was functioning.

It was also failing.

DNS success had collapsed to essentially zero. Query volume had risen dramatically. WARP was generating roughly 100,000–150,000 DNS warnings per hour. Logs were consuming the filesystem at an extraordinary rate. By August 14, ENOSPC was already appearing. Later, log rotation itself failed.

And yet:

website still reachable
        =
externally visible function preserved

If that were my only measurement, I could easily have called the machine healthy.

Physiology made me realize why that conclusion is inadequate.

A regulated system can preserve important functions while compensatory mechanisms absorb disturbances. The fact that compensation is succeeding at this instant does not tell us how much reserve remains, how expensive that compensation has become, or how close the system is to a boundary beyond which compensation will fail. Homeostasis is an active process produced through interacting regulatory mechanisms, not the simple absence of disturbance (Billman, 2020).

At a very abstract level:

disturbance
      ↓
regulatory response
      ↓
compensation
      ↓
visible function preserved

That may remain sustainable if the disturbance is small enough and sufficient regulatory capacity remains.

Persistent or increasing disturbance can create a different trajectory:

disturbance persists
        ↓
compensation continues
        ↓
reserve is progressively consumed
        ↓
operating margin shrinks
        ↓
system becomes increasingly sensitive
to additional disturbance

Eventually:

required regulatory response
            >
available regulatory capacity
            ↓
decompensation

I am using decompensation here as a systems concept, not proposing a new clinical definition of adrenal crisis. Real adrenal crises vary in presentation and precipitating factors, and the detailed pathophysiology remains incompletely understood (Dineen et al., 2019).

But the systems idea is powerful:

A compensated system may already contain a serious failure. The failure becomes externally obvious only when the remaining regulatory mechanisms can no longer contain it.

That statement described my server almost perfectly.

The VPS had a kind of reserve too

Once I thought about the incident this way, free disk space changed meaning.

Previously I had treated it as an ordinary capacity measurement:

8.9 GB root filesystem
some amount used
some amount free

During the failure, however, free storage became part of the machine’s ability to tolerate disturbance.

WARP could generate an enormous warning stream without immediately taking down the system because the filesystem still had somewhere to put those warnings:

DNS failures
     ↓
WARP warnings
     ↓
filesystem accepts log writes
     ↓
services continue operating
     ↓
website remains reachable

Superficially, the machine was coping.

But look at what “coping” meant:

DNS failures continue
        ↓
warnings continue
        ↓
free storage decreases
        ↓
remaining ability to absorb more warnings decreases
        ↓
failure margin shrinks

The very resource that allowed the machine to remain outwardly operational was being consumed by the process through which it remained operational.

That is much closer to decompensation than to a binary crash.

Then the filesystem reached ENOSPC.

At that point, the consequences changed qualitatively. Logging infrastructure could no longer behave normally. Log rotation failed. WARP’s own rotation failed. MariaDB encountered write problems. Resolver state later deteriorated. The machine was no longer simply absorbing one broken subsystem; the consequences of the original disturbance were beginning to impair mechanisms elsewhere in the system.

This progression is worth separating:

STAGE 1

disturbance exists
but available reserve absorbs its consequences


STAGE 2

disturbance persists
and reserve is progressively consumed


STAGE 3

reserve approaches a critical boundary
and regulatory mechanisms begin failing


STAGE 4

secondary failures alter the operating conditions
of still-functioning subsystems


STAGE 5

the system can no longer preserve
its externally visible functions

This is considerably more informative than:

disk became full
therefore server crashed

That statement is technically true at one level and explanatorily almost useless at another.

When a compensatory response begins amplifying the disturbance

The VPS contained another feature that made the physiological comparison more interesting: some behaviours that were normally useful became harmful under persistent failure.

A DNS retry is usually reasonable.

Logging an unexpected network error is reasonable.

Persisting logs for later diagnosis is reasonable.

Rotating old logs is reasonable.

But once WARP’s DNS path had entered a persistent, near-instantaneous ENETUNREACH state, those normal behaviours became coupled:

DNS request
    ↓
ENETUNREACH
    ↓
warning logged
    ↓
caller retries quickly
    ↓
another ENETUNREACH
    ↓
another warning
    ↓
another retry
    ↓
...
    ↓
log volume explodes

The feedback structure had changed.

A mechanism that normally helps a system recover from transient errors—retrying—was now increasing the rate at which the persistent error was exercised.

A mechanism that normally helps an administrator understand failure—logging—was now converting each repeated failure into additional filesystem consumption.

Eventually:

failure
   ↓
response to failure
   ↓
more resource consumption
   ↓
less capacity to tolerate failure
   ↓
more secondary failure

At that point the system was no longer merely failing to compensate. Some of its ordinary responses to failure had become part of the amplification mechanism.

Physiology contains many regulatory responses, and it would be misleading to map any particular mechanism of adrenal crisis directly onto DNS retries or log rotation. The general systems pattern is more defensible: regulatory responses have limits; multiple feedback loops interact; and when a system moves sufficiently far from its normal operating regime, processes that preserve stability under ordinary conditions may no longer be sufficient to restore it (Billman, 2020).

This is also why the description of a mismatch between cortisol need and cortisol availability is so useful here. It directs attention away from a single defective object and toward the relationship between disturbance and the system’s remaining capacity to respond (Dineen et al., 2019).

A green light is not the same thing as a healthy system

One of the strangest findings in the VPS investigation was this pair of observations:

DNS success:       approximately 0%
Other Error:       approximately 100%

DNS proxy health status: Healthy

I still find that almost philosophically perfect.

Some narrow internal definition of proxy health may genuinely have been satisfied. The proxy process might have been running. Its listener might have existed. Its task might have passed whatever liveness criterion the software used.

But the actual function the rest of the system depended on—resolving DNS queries—was essentially absent.

Physiological homeostasis provides a much more serious version of this distinction: regulation is produced by the interaction of multiple control systems, and organismal stability cannot be reduced to the state of one regulatory loop (Billman, 2020).

For the server:

process running
        ≠
service functioning

service functioning
        ≠
system healthy

And for a complex regulated system more generally:

one locally normal measurement
        ≠
global stability

The implication for monitoring is obvious. A check that asks only:

Is the process alive?

may completely miss:

Is the function succeeding?

Is the system consuming reserve
to preserve that function?

Is the compensation sustainable?

Is the system moving toward
or away from a critical boundary?

The same conceptual problem appeared in my UptimeRobot monitoring. It knew when the website finally became unreachable. It did not know that the server had spent days moving toward that failure.

There is no single variable called health

This is where the comparison begins moving toward a more formal systems argument.

Neither an organism nor a computer contains one physically measurable scalar called:

health = 83.7%

For the VPS, I could approximate its operational state using variables such as:

free disk
log growth rate
DNS success rate
DNS error rate
memory availability
database writability
network reachability
SSH reachability
service states

None of those variables individually is server health.

The useful state emerges from their relationships.

An equally simplified physiological description might contain:

cortisol availability
circulating volume
arterial pressure
vascular responsiveness
electrolyte state
glucose
temperature
renal perfusion
neurological state
...

Again, no single entry contains “health.” Physiological stability is instead produced through interacting feedback and regulatory systems (Billman, 2020).

We can express the idea abstractly without pretending that the following is a clinical model.

Suppose the organism at time t has a state:

x(t) = [
    hormonal state,
    circulating volume,
    blood pressure,
    electrolytes,
    glucose,
    temperature,
    heart rate,
    ...
]

Its state changes according to its present condition, external disturbances and the regulatory capacities available to it:

x(t + Δt) = F(x(t), u(t), p)

Here, u(t) might contain changing influences such as illness, trauma, fluid loss, exertion, temperature, medication or nutrition. The parameters represented by p include properties of the system that determine how it can respond.

Now imagine a region V containing states compatible with continued physiological viability:

V = {
    x :
    the organism can continue maintaining
    essential physiological organization
}

Ordinary life does not require:

x(t) = constant

Quite the opposite. The state changes continuously:

sleep
  ↓
wake
  ↓
eat
  ↓
walk
  ↓
exercise
  ↓
recover
  ↓
infection
  ↓
physiological response
  ↓
recovery

The remarkable property is that regulation usually keeps the trajectory inside a viable region despite those disturbances. That dynamic character of stability is central to modern discussions of homeostasis (Billman, 2020).

Primary adrenal insufficiency changes that dynamical system because an important endogenous adaptive capacity is constrained. Replacement therapy restores essential glucocorticoid—and, when required, mineralocorticoid—function, but significant physiological stress may require an increase in glucocorticoid replacement because the adrenal glands cannot autonomously generate the normal response (Bornstein et al., 2016; NICE, 2024).

The abstract systems question then becomes:

Given the disturbance acting on the system now,

is available regulatory capacity sufficient
to keep the trajectory inside V?

That was almost exactly the question my VPS had been answering without my realizing it.

Its trajectory was:

DNS route failure
        ↓
near-total DNS failure
        ↓
retry amplification
        ↓
warning amplification
        ↓
free-space depletion
        ↓
ENOSPC
        ↓
failed log rotation
        ↓
secondary subsystem failures
        ↓
resolver/network degradation
        ↓
HTTP and SSH loss

The website remaining reachable during the first part of that trajectory did not prove the server was healthy.

It proved only that:

x(t) had not yet crossed
the boundary at which
that particular visible function failed

By the time UptimeRobot finally told me that the site was down, the system had already spent days consuming its ability to remain up.

That is the part of the adrenal-crisis analogy I find most valuable.

A crisis can become visible at the end of a process whose decisive change began much earlier.

The interesting question is therefore no longer simply why one component failed. It is why the whole system could compensate for that failure for a while, why that compensation became progressively less sustainable, and what happened when the remaining regulatory reserve was finally insufficient.

That is where the concept of decompensation becomes much more than a metaphor—and where the comparison between physiology and computing becomes genuinely useful.

Decompensation begins with a mismatch between demand and capacity

The concept I wanted to understand more deeply after Part I was decompensation. In ordinary language it sounds simple: compensation works until it does not. Addison’s disease shows why the actual transition is much more interesting.

Primary adrenal insufficiency changes the organism before any crisis occurs. The adrenal cortex has lost an important part of its capacity to produce cortisol and, in many cases, aldosterone. Replacement therapy can restore the hormonal inputs needed for ordinary life, but it does not turn the damaged adrenal cortex back into an intact, continuously adapting endocrine organ (Bornstein et al., 2016; NIDDK, n.d.).

That difference is easy to miss when conditions are stable.

A person may be adequately replaced, haemodynamically stable, eating normally, absorbing medication normally and experiencing no major physiological stress. Under those conditions, the available regulatory support is sufficient for the demand being placed on the system.

Then the environment changes.

ordinary physiological demand
        ↓
replacement sufficient
        ↓
stable state


major illness / trauma / surgery / fluid loss
        ↓
physiological demand rises
        ↓
required glucocorticoid support rises
        ↓
the previous replacement level may no longer be sufficient

Dineen, Thompson and Sherlock describe adrenal crisis in terms that fit this systems perspective particularly well: an important part of the problem is a mismatch between cortisol availability and the amount required during physiological stress (Dineen et al., 2019).

That formulation is more illuminating than simply saying “there is too little cortisol.” Too little relative to what?

The answer is: relative to the current state of the organism and the demands being imposed on it.

So the same amount of available cortisol support may be adequate under one set of conditions and inadequate under another.

available regulatory capacity = C

ordinary demand = D1

C > D1
system remains compensated


severe physiological stress = D2

D2 > C
regulatory mismatch develops

This immediately makes adrenal crisis a dynamical problem rather than a static deficiency.

The healthy adrenal response is continuously adaptive

To appreciate what is lost in Addison’s disease, it helps to look briefly at the regulatory architecture of the hypothalamic-pituitary-adrenal axis.

In simplified form:

hypothalamus
    ↓ CRH
pituitary
    ↓ ACTH
adrenal cortex
    ↓
cortisol

Cortisol then participates in feedback regulation of the hypothalamus and pituitary. This is not a simple on/off circuit. Cortisol secretion has circadian and ultradian dynamics, and the system responds to changing physiological conditions. Illness, trauma and other forms of substantial physiological stress alter the demand placed on this regulatory system (Bornstein et al., 2016; Dineen et al., 2019).

Primary adrenal insufficiency changes the final endocrine output stage:

hypothalamus
    ↓
pituitary
    ↓ ACTH
damaged adrenal cortex
    X
cannot generate an adequate cortisol response

The regulatory signals can demand more output, but the organ responsible for producing that output has lost the necessary capacity.

That is very different from merely having “a low number.”

It is a limitation in adaptive range.

Under ordinary conditions, glucocorticoid replacement supplies cortisol activity externally. When physiological demand rises substantially, however, the replacement strategy has to change because the adrenal glands themselves cannot automatically increase cortisol production. This is the rationale behind stress or sick-day dosing in established adrenal insufficiency (NICE, 2024; Bornstein et al., 2016).

The intact system is approximately:

disturbance increases
        ↓
endogenous regulatory system detects/responds
        ↓
hormonal output changes
        ↓
adaptive capacity increases

In primary adrenal insufficiency:

disturbance increases
        ↓
endogenous adrenal output cannot increase adequately
        ↓
external replacement must be adjusted
        ↓
adaptive capacity restored from outside

This means that part of a normally endogenous control loop has effectively become externalized.

That is one of the most fascinating features of Addison’s disease when viewed as a systems problem.

Treatment restores a missing input but does not recreate the original controller

Hydrocortisone replacement is extraordinarily effective, but from a control-system perspective there is an important distinction between replacing an output and recreating the original adaptive controller.

The healthy adrenal system continually participates in changing hormone availability according to circadian rhythm, physiological state and stress. Oral replacement necessarily works differently. Medication is taken at discrete times and according to an established regimen. During significant physiological stress, the regimen has to be deliberately modified (Bornstein et al., 2016).

Conceptually:

INTACT REGULATION

physiological state
        ↓
endocrine feedback
        ↓
continuous endogenous adjustment


REPLACEMENT-DEPENDENT REGULATION

physiological state
        ↓
recognition that demand has changed
        ↓
dose adjustment / emergency plan
        ↓
external hormone delivery

This does not make replacement somehow inadequate as therapy. It means the architecture of regulation has changed.

The closed biological loop has become partly dependent on an external layer: medication availability, appropriate dose adjustment, absorption, and recognition that the physiological situation has changed.

In computer terminology I would call that a change in the control boundary. But the medical phenomenon is the important thing here: the person can be physiologically stable while one adaptive endocrine function is being supplied through an external therapeutic process.

This is why preparedness is part of treatment. NICE recommends sick-day guidance, emergency hydrocortisone kits and training for people with primary adrenal insufficiency because increased physiological demand can require a rapid change in glucocorticoid replacement (NICE, 2024).

That tells us something fundamental about the disease.

The risk is not simply:

cortisol absent

It is:

the organism cannot autonomously scale
cortisol availability to match changing demand

Aldosterone makes primary adrenal insufficiency even more systemic

Addison’s disease is particularly interesting because primary adrenal insufficiency may affect mineralocorticoid function as well as glucocorticoid function.

Aldosterone helps regulate sodium and potassium balance and contributes to maintaining extracellular fluid volume and blood pressure. In primary adrenal insufficiency, inadequate aldosterone can therefore contribute to sodium loss, volume depletion, hypotension and hyperkalaemia (NIDDK, n.d.; Bornstein et al., 2016).

This immediately expands the causal network:

adrenal cortical failure
        |
        +----------------------+
        |                      |
        v                      v
cortisol deficiency      aldosterone deficiency
        |                      |
        v                      v
impaired stress          sodium loss /
response                 potassium retention
                               |
                               v
                         volume depletion
                               |
                               v
                          hypotension

This diagram is intentionally simplified, but it demonstrates why adrenal crisis cannot be understood as an isolated hormone measurement.

The relevant physiological state includes endocrine signalling, vascular responsiveness, circulating volume, renal handling of sodium and water, electrolyte balance, glucose metabolism, inflammatory activity and the demands imposed by whatever illness or stressor triggered the deterioration.

Several of these variables can change simultaneously.

And once they begin interacting, the whole state matters more than any single variable considered alone.

Why blood pressure becomes such an important systems variable

Cortisol has important permissive effects on cardiovascular regulation. Adequate glucocorticoid activity contributes to vascular responsiveness to catecholamines and therefore to the maintenance of vascular tone and blood pressure. This helps explain why severe cortisol deficiency can be associated with hypotension and why adrenal crisis can progress to circulatory shock (Dineen et al., 2019).

In primary adrenal insufficiency, this can occur alongside mineralocorticoid deficiency and reduced circulating volume.

So two different regulatory problems can converge on the same macroscopic variable:

insufficient cortisol
        ↓
reduced vascular responsiveness
        ↓
difficulty maintaining vascular tone


insufficient aldosterone
        ↓
renal sodium loss
        ↓
water loss / reduced volume
        ↓
difficulty maintaining circulation


both pathways
        ↓
hypotension / haemodynamic instability

This is one reason the systems view matters. If I look only at the endpoint—low blood pressure—I lose the regulatory structure that produced it.

Blood pressure itself is an emergent result of several interacting factors:

cardiac output
        ×
systemic vascular resistance

influenced by:

circulating volume
heart rate
contractility
vascular tone
autonomic activity
hormonal regulation
renal regulation
many other variables

An adrenal crisis can disturb several parts of that network at once.

The organism is therefore not dealing with a single missing signal. It is trying to preserve circulation while some of the mechanisms normally supporting circulation have been weakened and physiological demand may simultaneously be increasing.

Why gastrointestinal illness is a particularly revealing trigger

Vomiting and diarrhoea make the dynamics especially easy to see.

The underlying illness is already a physiological stressor. It may produce inflammation, fever or increased metabolic demand. At the same time, gastrointestinal losses can reduce fluid and electrolyte volume.

Then another problem appears: oral glucocorticoid replacement may not be retained or reliably absorbed.

The resulting structure can look like this:

gastrointestinal illness
        |
        +--> physiological stress increases
        |
        +--> cortisol requirement increases
        |
        +--> vomiting / diarrhoea
                 |
                 +--> fluid loss
                 |
                 +--> sodium loss
                 |
                 +--> reduced circulating volume
                 |
                 +--> oral medication may not be absorbed
        |
        v
required support rises
while deliverable support may fall

That is a particularly dangerous configuration because the two sides of the mismatch move in opposite directions.

physiological demand
        ↑

available / absorbed replacement
        ↓

haemodynamic reserve
        ↓

NICE therefore specifically distinguishes situations in which oral glucocorticoids can still be taken from those in which vomiting or prolonged diarrhoea makes oral absorption unreliable; the latter requires escalation to parenteral hydrocortisone and emergency assessment (NICE, 2024).

I am not reproducing that guidance here as a treatment protocol—the medical note at the beginning of this essay remains important. What interests me conceptually is why the route of delivery suddenly matters.

The crisis is attacking both the regulated organism and part of the ordinary mechanism used to support that organism.

That is a classic systemic vulnerability.

The ordinary recovery pathway can itself become unavailable

Under stable conditions:

replacement needed
        ↓
oral medication
        ↓
gastrointestinal absorption
        ↓
systemic circulation
        ↓
glucocorticoid effect

But gastrointestinal illness can alter that pathway:

replacement needed MORE urgently
        ↓
oral medication
        ↓
vomiting / impaired absorption
        X
        ↓
required regulatory input may not arrive

The therapeutic architecture therefore includes another route. Emergency hydrocortisone can be administered intramuscularly or intravenously, bypassing the gastrointestinal absorption problem. NICE explicitly recommends emergency management kits containing injectable hydrocortisone for people with primary adrenal insufficiency and immediate parenteral hydrocortisone when adrenal crisis is suspected (NICE, 2024).

This is one of the strongest systems lessons in the entire comparison:

A recovery mechanism becomes much more robust when it does not depend on the pathway most likely to become unavailable during the failure it is intended to correct.

That statement is general systems language. In Addison’s disease, the actual medical implementation is concrete: when oral delivery becomes unreliable during crisis, a non-oral route provides a way to restore glucocorticoid availability.

The architecture contains an alternative path because crisis can invalidate assumptions that are perfectly safe during ordinary operation.

An adrenal crisis is a convergence of disturbances

At this point, describing adrenal crisis as “acute cortisol deficiency” feels insufficient to me. It is true, but it hides the interesting part.

A better systems picture is:

precipitating illness / stress
           |
           v
physiological demand increases
           |
           v
cortisol requirement increases
           |
           X
adrenal cortex cannot increase output
           |
           v
relative cortisol deficiency
           |
     +-----+-------------------+
     |                         |
     v                         v
vascular responsiveness    metabolic /
impaired                   inflammatory regulation altered
     |
     v
hypotension

PLUS, in primary adrenal insufficiency:

aldosterone deficiency
     |
     v
sodium / water loss
     |
     v
volume depletion
     |
     v
further hypotension

PLUS, depending on precipitant:

vomiting / diarrhoea
     |
     +--> additional fluid loss
     |
     +--> impaired oral drug delivery

COMBINED
     |
     v
systemic decompensation

No single arrow here is “the crisis.”

The crisis is the state produced by the interaction of these processes.

This is why Dineen et al. emphasize that the complete pathophysiology of adrenal crisis remains incompletely understood even though its clinical urgency and core endocrine defect are well established (Dineen et al., 2019).

There is an epistemic lesson in that statement too.

Medicine can know with high confidence that a state is dangerous, know which treatment is lifesaving, identify important causal mechanisms, and still lack a complete microscopic account of every transition producing the crisis.

That is not a contradiction.

Explanations have levels.

Electrolytes are not side effects of the crisis

The electrolyte disturbances associated with adrenal insufficiency are another example of why relationships matter.

In primary adrenal insufficiency, mineralocorticoid deficiency can reduce renal sodium retention and impair potassium excretion. Hyponatraemia and hyperkalaemia may therefore appear, although actual clinical presentations vary (Bornstein et al., 2016).

Hyponatraemia can also be influenced by glucocorticoid deficiency through changes in water handling, so even here a single laboratory value may reflect more than one regulatory pathway.

Conceptually:

aldosterone deficiency
        ↓
less renal sodium retention
        ↓
sodium / volume loss


cortisol deficiency
        ↓
altered water regulation
        ↓
additional contribution to hyponatraemia

These biochemical changes then feed back into organismal function. Sodium and water balance influence circulating volume. Potassium influences membrane excitability and cardiac function. Glucose availability can also become problematic, particularly in vulnerable states.

Again, the interesting object is the network.

A laboratory value is a window into that network, not an isolated malfunction floating outside it.

The precipitating illness and the adrenal crisis are not the same event

This distinction is particularly important.

An infection may trigger adrenal crisis.

But the infection is not itself the adrenal crisis.

Likewise, vomiting may participate in precipitating a crisis, but vomiting is not equivalent to adrenal crisis.

The precipitant changes the demands imposed on an organism whose adaptive endocrine capacity is constrained.

precipitating event
        ↓
changes physiological demand
        ↓
interacts with adrenal insufficiency
        ↓
regulatory mismatch
        ↓
systemic consequences
        ↓
adrenal crisis

Once crisis develops, the physiological state has acquired additional problems that were not identical to the precipitating event.

For example:

infection
   ↓
initial disturbance


later state:
infection
+ inadequate cortisol availability
+ hypotension
+ volume depletion
+ electrolyte disturbance
+ impaired oral replacement
+ other downstream effects

So removing or treating the precipitating cause does not necessarily instantaneously reverse the entire crisis state.

History matters.

The organism has moved from one state into another.

Path dependence makes crisis more than a snapshot

This is a concept I find increasingly useful: path dependence.

Suppose we describe the physiological state at one moment as S0.

An infection appears:

S0
 +
infection
 ↓
S1

Now vomiting causes fluid loss:

S1
 +
fluid loss
 ↓
S2

Glucocorticoid requirement rises while oral absorption becomes unreliable:

S2
 +
regulatory mismatch
 ↓
S3

Hypotension and further systemic consequences appear:

S3
 +
haemodynamic deterioration
 ↓
S4

At S4, simply removing the original precipitating factor would not magically recreate S0.

S4 - infection ≠ S0

The intervening history has changed circulating volume, hormone availability, electrolyte state and other physiological variables.

That is why crisis treatment is necessarily concerned with the current state as well as the initiating cause.

NICE reflects this directly: emergency management includes immediate hydrocortisone, intravenous isotonic saline, monitoring of blood pressure, heart rate, electrolytes and glucose, and identification and treatment of the underlying precipitating cause (NICE, 2024).

Those are several different interventions because several different relationships may need restoration.

Emergency treatment is a state-restoration process

Looked at physiologically, emergency treatment of adrenal crisis is remarkably systemic.

It does not consist only of restoring one hormone number.

Hydrocortisone addresses the acute glucocorticoid deficit. Intravenous isotonic saline addresses volume depletion and haemodynamic instability. Relevant physiological variables are monitored as treatment proceeds, and the precipitating illness or other underlying cause must also be treated (NICE, 2024).

Conceptually:

CRISIS STATE

insufficient glucocorticoid activity
        +
volume depletion
        +
haemodynamic instability
        +
possible electrolyte / glucose disturbance
        +
ongoing precipitating stress
        ↓

INTERVENTION

restore glucocorticoid support
        +
restore circulating volume
        +
monitor system response
        +
treat precipitating cause
        ↓

progressive return toward physiological stability

The interesting word here is progressive.

Hydrocortisone enters the circulation, but the entire organism does not instantaneously snap back into its pre-crisis state. Circulatory volume has to be restored. Vascular responsiveness changes. Electrolytes and glucose may require observation and correction. The precipitating disease continues to have its own dynamics.

Recovery is therefore a trajectory.

A crisis is over when the ordinary maintenance regime becomes viable again

NICE’s emergency recommendations contain a systems idea that I find particularly elegant. Parenteral hydrocortisone and intravenous fluids are continued while haemodynamic instability persists; transition back toward oral replacement occurs once the person is haemodynamically stable and able to take and absorb oral glucocorticoids (NICE, 2024).

That means the endpoint of emergency treatment is not merely:

one symptom disappears

or:

one laboratory value improves

It is closer to:

the organism has returned sufficiently
toward a stable operating regime

AND

the ordinary maintenance pathway
has become reliable again

This is a powerful way to define recovery.

Emergency mode exists because ordinary regulation is insufficient.

Recovery occurs when ordinary maintenance can once again sustain the system.

stable maintenance
        ↓
major disturbance
        ↓
ordinary regulation insufficient
        ↓
emergency intervention
        ↓
physiological state restored
        ↓
ordinary maintenance becomes sufficient again

That is much richer than a binary:

sick
 ↓
treated
 ↓
well

Adrenal crisis shows why reserve is multidimensional

Earlier I described physiological reserve as something that cannot be reduced to one gauge. Adrenal crisis makes the reason clearer.

Imagine an organism with several forms of reserve:

circulatory reserve
endocrine adaptive capacity
fluid reserve
renal regulatory capacity
metabolic reserve
autonomic responses
ability to absorb medication
ability to increase external replacement
...

These are not independent batteries.

They interact.

A loss of fluid volume makes cardiovascular regulation more demanding. Fever and infection increase metabolic and endocrine demand. Vomiting may simultaneously reduce volume and disrupt medication delivery. Cortisol deficiency can reduce vascular responsiveness just when maintaining vascular tone becomes more important.

So reserve is better imagined as a property of the whole configuration:

reserve ≠ one spare resource

reserve =
the system's remaining ability
to reorganize itself successfully
under additional disturbance

That is why a person may be completely stable in one context and vulnerable in another without any contradiction.

The relevant question is not simply “How much reserve exists?”

It is:

Reserve for which disturbance,
at which moment,
given which current physiological state?

Compensation can conceal how close the system is to its limits

One of the most important ideas for me is that successful compensation can make a system look healthier than it really is.

If blood pressure remains adequate, oral medication is being absorbed, fluid losses are small and glucocorticoid replacement matches demand, there may be little outward evidence that a crucial endogenous endocrine response is absent.

The regulatory deficit becomes obvious mainly when the system is challenged.

This is a general property of reserve.

low demand
      ↓
limited capacity still sufficient
      ↓
normal-looking output


high demand
      ↓
same limited capacity now insufficient
      ↓
instability becomes visible

In that sense, stress does not necessarily create the underlying vulnerability.

It reveals it.

This explains why studying only steady-state operation can give an incomplete understanding of a system. Stability under low demand tells us little about the size of the region over which regulation remains successful.

The boundary between compensation and crisis is not necessarily a sharp line

It is tempting to imagine a perfect threshold:

before 14:03:17
compensated

after 14:03:17
crisis

Clinical reality is not usually that clean.

Physiological variables change continuously, while the clinical category adrenal crisis identifies a dangerous state requiring urgent treatment. The transition can develop rapidly, but the underlying processes—rising demand, inadequate hormonal response, volume loss, hypotension and other changes—may evolve over time.

Dineen et al. discuss the difficulty of defining adrenal crisis uniformly and note that several definitions have been used, often combining acute deterioration with hypotension, gastrointestinal symptoms, electrolyte abnormalities or the need for parenteral glucocorticoids (Dineen et al., 2019).

That is interesting from a systems perspective because categories such as:

stable
compensated
decompensating
crisis

are macroscopic descriptions applied to a continuously evolving biological state.

The molecules do not receive a notification saying that the system has officially crossed from “compensated” to “crisis.”

The category exists at the level of the organism and its dynamics.

The absence of a single crisis molecule does not make the crisis unreal

This returns to one of the deeper questions that originally attracted me to the comparison.

Where exactly is adrenal crisis?

It is not located inside one cortisol molecule.

It is not inside one sodium ion.

It is not inside one adrenal cortical cell.

It is not contained by a single blood-pressure measurement.

At progressively lower levels we find:

organism
    ↓
organs
    ↓
tissues
    ↓
cells
    ↓
receptors / membranes
    ↓
molecules
    ↓
ions / atoms
    ↓
physical interactions

At the bottom, the individual physical constituents continue obeying chemistry and physics.

No sodium ion becomes “pathological” in the moral or intentional sense.

No cortisol molecule knows whether the organism is in crisis.

Yet adrenal crisis is completely real.

It exists at the level of the organization and dynamics of the whole system.

This is not mystical emergence. It simply means that different levels of description capture different properties.

A sodium concentration is a collective property of many particles.

Blood pressure is a systemic property of cardiovascular dynamics.

Haemodynamic stability is a relationship among multiple physiological processes.

Adrenal crisis describes a pathological state of the organism produced by the interaction of those processes.

Nothing requires a microscopic object called CRISIS.

The body does not fail because physics stops working

This becomes almost philosophically strange if I keep descending.

During adrenal crisis, molecules continue interacting according to chemical laws.

Membrane channels still obey electrochemical gradients.

Receptors still bind according to their biochemical properties.

Water still moves according to physical forces.

The heart, blood vessels and kidneys are made of matter obeying exactly the same physical laws as before the crisis.

And yet at another level we say:

the organism is failing to maintain homeostasis

There is no contradiction.

The word failure refers to the organization of those lawful physical processes relative to the conditions necessary for continued organismal viability.

That question will become much more important later, when I turn from physiology to state spaces, physical transitions and eventually the philosophical question of where words such as wrong, failure and function come from.

For now, adrenal crisis gives us a concrete biological case in which the distinction is impossible to ignore.

Homeostasis is therefore a property of relationships

The more I thought about Addison’s disease, the less useful it seemed to identify homeostasis with a list of correct laboratory values.

A better picture is a network:

environment
     ↕
nervous system
     ↕
endocrine system
     ↕
cardiovascular system
     ↕
kidneys
     ↕
fluid / electrolyte state
     ↕
metabolism
     ↕
immune response
     ↕
behaviour
     ↕
external therapeutic support

None of these systems maintains life independently.

The regulatory property is distributed across their interaction.

Billman’s description of homeostasis as a dynamic, self-regulating process is useful precisely because it shifts attention from fixed values to coordinated responses (Billman, 2020).

In Addison’s disease, one part of that network has permanently lost capacity.

Replacement therapy reconnects the missing endocrine function through an external route.

Most of the time, that restored architecture works.

A crisis occurs when the combination of physiological demand, available hormonal support and the state of the other regulatory systems becomes incompatible with stable compensation.

The human being becomes part of the control loop

There is another unusual systems feature here that deserves attention.

With an intact adrenal system, a person does not consciously calculate an ACTH concentration because they have a fever.

The regulation is endogenous.

With adrenal insufficiency, part of the adaptive process may involve conscious recognition and action:

illness occurs
      ↓
person recognizes increased physiological stress
      ↓
sick-day rule applied
      ↓
replacement dose adjusted

And if the situation deteriorates further:

oral route becomes unreliable
      ↓
crisis risk recognized
      ↓
emergency injection / medical response
      ↓
parenteral replacement supplied

NICE’s emphasis on education, emergency kits and training reflects this altered regulatory architecture (NICE, 2024).

A normally automatic physiological function has acquired a human decision-making layer.

That creates extraordinary resilience—the missing response can be deliberately supplied—but it also introduces new dependencies:

recognition
knowledge
medication availability
correct action
route of administration
access to emergency care

From a human-computer perspective, this is fascinating. The boundaries of the regulated system have expanded.

The relevant system is no longer simply:

body

but, for this particular regulatory function:

body
  +
replacement medication
  +
knowledge
  +
emergency preparation
  +
clinical support

This does not make the disease less biological.

It demonstrates that biological stability can depend on an extended network involving deliberate human intervention.

Preparedness reduces vulnerability but cannot abolish uncertainty

Another important lesson is that knowledge and preparation do not turn a complex biological system into a deterministic machine.

A person can understand sick-day rules, have emergency medication available and manage the condition carefully, yet still face unexpected illness or a rapidly evolving physiological disturbance. Adrenal crisis remains a recognized complication of chronic adrenal insufficiency even in people who have been educated about prevention and emergency management (Dineen et al., 2019).

This matters because resilience is sometimes described too optimistically:

identify risk
        ↓
create protocol
        ↓
risk solved

Real resilience looks more like:

identify risk
        ↓
reduce probability
        ↓
increase reserve
        ↓
create fallback paths
        ↓
improve detection
        ↓
prepare emergency response
        ↓
accept that residual uncertainty remains

That applies especially well to biological systems, where the disturbances themselves are variable and the state of the organism changes continuously.

The purpose of an emergency plan is to act before complete collapse

There is also an important temporal principle hidden inside adrenal-crisis prevention.

If emergency intervention were useful only after every compensatory mechanism had completely failed, it would often arrive too late.

The purpose of recognizing deterioration is to intervene while the system is moving toward crisis.

Conceptually:

stable
   ↓
increased physiological stress
   ↓
compensatory demand rises
   ↓
warning signs / inability to maintain oral replacement
   ↓
intervention
   ↓
trajectory redirected

The desired outcome is to alter the trajectory before:

progressive instability
        ↓
severe hypotension
        ↓
shock / collapse

This is why the distinction between a state and a trajectory matters so much.

A single measurement tells us where the system appears to be now.

A sequence of measurements and clinical changes tells us where it is going.

Only now does the VPS comparison become useful again

After spending most of this discussion inside Addison’s disease, I can return to the computer without forcing the analogy.

The similarity is not:

cortisol = disk space
aldosterone = DNS
hydrocortisone = rescue mode

Those mappings would be arbitrary.

The actual structural similarity is:

Systemic feature Addison’s disease / adrenal crisis VPS failure
Normal state Replacement and physiological regulation maintain stable function Ordinary routing, logging, storage and service management maintain operation
Underlying limitation Adrenal cortex cannot generate normal adaptive hormone output Finite resources and coupled network/storage dependencies
Disturbance Illness, trauma, fluid loss or other physiological stress Persistent DNS-over-WARP routing failure
Demand-capacity mismatch Required glucocorticoid support exceeds available support Error/retry/log workload exceeds sustainable system capacity
Reserve consumption Haemodynamic, fluid and other compensatory capacities are increasingly stressed Free disk and other operational margins are progressively consumed
Secondary effects Hypotension, volume depletion, electrolyte and metabolic disturbance ENOSPC, failed rotation, database errors and resolver degradation
Decompensation Ordinary regulation can no longer maintain physiological stability Ordinary services can no longer preserve system operation
External intervention Emergency glucocorticoid support, fluids and treatment of precipitating cause Out-of-band rescue environment and repair of persistent state
Recovery Haemodynamic stability returns and ordinary replacement becomes viable again Normal boot, DNS, SSH, bounded logging and adequate free storage return

Seen this way, the VPS is no longer the main subject.

It is a small engineered example that helped me recognize a much more general pattern already visible in physiology:

disturbance
        ↓
compensation
        ↓
increasing demand on reserve
        ↓
loss of regulatory margin
        ↓
secondary interactions
        ↓
decompensation
        ↓
external intervention
        ↓
restoration of a viable regime

Where the analogy must stop

The comparison remains useful only if its limits are explicit.

A human organism is not engineered like a VPS.

Its regulatory systems are products of biological development and evolution. They operate through cells, tissues, neural circuits, endocrine signalling, metabolism, behaviour and interactions with the environment. They possess enormous redundancy and plasticity that have no simple correspondence in a small Linux server.

An adrenal crisis is also a life-threatening medical event. A website outage is an infrastructure problem. Their human significance is incomparable.

Nor should engineering concepts be used to infer clinical decisions. The analogy runs in the other direction: established physiology helps illuminate general ideas about regulation, reserve, feedback and decompensation.

So I would keep the comparison at this level:

same mechanisms?        NO

same material substrate? NO

same clinical meaning?   NO

similar abstract
regulatory structure?    YES, in useful ways

That distinction matters because a good analogy preserves differences while exposing structure.

The question now moves from medicine toward dynamics

Addison’s disease has therefore given me a much more precise idea of what I meant when I said that my server “decompensated.”

Decompensation is not simply the moment something stops.

It is a transition in a regulated system:

the system begins inside
a region where regulation is sufficient

        ↓

disturbance changes the state

        ↓

regulation initially contains it

        ↓

available reserve becomes progressively less adequate

        ↓

secondary interactions alter the system itself

        ↓

ordinary regulatory mechanisms
can no longer return the trajectory
toward a viable region

That description works remarkably well for adrenal crisis without claiming that every clinical crisis follows one simple mathematical path.

And it creates the next question almost automatically.

If compensation, reserve and decompensation are properties of a system’s changing state, can we describe them more formally?

Can we imagine all possible physiological states as a space, identify a region in which the organism remains viable, and then describe illness or crisis as a trajectory approaching or crossing the boundary of that region?

What would stability mean in that space?

What would a tipping point mean?

How could positive and negative feedback alter the trajectory?

And if we descend from organism to organ, cell, molecule and finally physical state transitions, at what level does the property we call failure actually appear?

Those questions belong to the mathematical and cybernetic part of the discussion. But Addison’s disease has already supplied the essential intuition: health is not immobility, compensation is not unlimited, and crisis is a property of a regulatory system losing the capacity to keep itself within a viable range.

Replacement solves the deficiency without fully recreating physiological time

One of the most interesting things about Addison’s disease is that successful replacement therapy does not simply return the endocrine system to its previous architecture. The missing cortisol can be supplied pharmacologically, and mineralocorticoid activity can also be replaced when required, but an oral treatment schedule does not reproduce every temporal property of an intact adrenal system. In healthy physiology, cortisol secretion follows a pronounced circadian pattern and also changes in response to physiological demand; conventional hydrocortisone replacement instead delivers medication at discrete times, with the largest dose generally taken after waking and later doses distributed through the day because hydrocortisone has a relatively short plasma half-life (Bornstein et al., 2016). This means that treatment can restore the essential hormonal function while the timing, feedback relationships and responsiveness of the original system remain different.

That distinction matters because biological regulation occurs in time. A hormone concentration is never simply a number detached from the hour of the day, the recent history of the organism, the current illness burden or the other regulatory processes occurring around it. Cortisol normally rises toward the beginning of the active period and falls toward the night, while physiological stress can substantially alter the amount of glucocorticoid support required. Standard replacement therefore has to approximate a function that an intact endocrine system performs dynamically. The Endocrine Society recommends divided hydrocortisone dosing partly in an effort to approximate normal circadian physiology, while also acknowledging the practical limitations of available replacement strategies (Bornstein et al., 2016).

This adds another layer to the systems interpretation developed in the first two parts. The problem in Addison’s disease is not merely that the organism has lost a substance that can be poured back in until a tank is full. It has lost part of a responsive temporal control system. Pharmacological replacement restores a crucial output of that system, often very effectively, but the process of deciding how much hormonal support is appropriate during changing physiological conditions partly moves outside the adrenal gland. Normal life can therefore be stable while the architecture supporting that stability is fundamentally different from the architecture of an intact hypothalamic-pituitary-adrenal system.

For systems thinking, this is a remarkably important distinction:

Replacing a missing output
is not necessarily identical to
reconstructing the controller
that originally generated that output.

That does not diminish replacement therapy. Quite the opposite: it shows why replacement is such a powerful intervention. A lost biological output can be supplied from outside sufficiently well for the organism to regain a viable and often highly functional state. But it also explains why stress dosing, emergency planning and alternative routes of administration remain necessary. The replacement system has to accommodate a world in which demand changes, while the damaged adrenal cortex cannot autonomously perform the corresponding adaptation (NICE, 2024; Bornstein et al., 2016).

Addison’s disease therefore changes where regulation happens

Thinking about treatment in this way changed my idea of where the boundary of a physiological regulatory system should be drawn. If I look only at anatomy, the damaged adrenal cortex is inside the body and the hydrocortisone tablet is outside it. But if I ask instead what maintains physiological stability, then medication, recognition of illness, sick-day rules, emergency injection capability and access to medical care become parts of the effective regulatory architecture. NICE reflects this explicitly by treating education, additional glucocorticoid supplies for physiological stress, emergency management kits and training in their use as integral elements of managing adrenal insufficiency (NICE, 2024).

In an intact endocrine system, much of the adjustment occurs without conscious intervention. A person does not need to notice a fever and then issue a command to the pituitary gland. The biological control system responds through interacting neural, endocrine, immune and metabolic pathways. Addison’s disease changes that arrangement because the adrenal output stage cannot respond adequately. Part of the missing adaptation can therefore become a deliberate action performed through knowledge and medication. An apparently internal physiological feedback problem acquires an external human layer.

Very abstractly, the control structure changes from:

physiological disturbance
        ↓
endogenous sensing and regulation
        ↓
adaptive adrenal output
        ↓
changed cortisol availability

to something more like:

physiological disturbance
        ↓
endogenous regulation
        +
recognition of changed circumstances
        +
therapeutic knowledge
        +
medication availability
        +
appropriate administration
        ↓
changed glucocorticoid availability

The second diagram should not be interpreted as a complete physiological model, because most regulation obviously remains biological and automatic. Its purpose is to expose one important architectural fact: a function that once depended principally on endogenous endocrine adaptation has become partly supported by an extended system involving treatment and human action.

This is also why emergency preparedness cannot reasonably be treated as something separate from the disease itself. An emergency hydrocortisone kit sitting unused for months may seem operationally irrelevant during ordinary life, yet it exists precisely because a severe disturbance can invalidate the assumptions under which routine oral replacement works. NICE recommends emergency kits containing intramuscular hydrocortisone for people with primary adrenal insufficiency, together with instructions and training, because suspected adrenal crisis may require an immediate response before the ordinary clinical pathway can provide treatment (NICE, 2024). A capability can therefore be central to resilience even when it contributes nothing visible during normal operation.

Resilience is not the same as never being disturbed

This brings me to a word that is often used rather loosely in both medicine and engineering: resilience. If resilience simply meant that nothing ever changed, no living organism could qualify. Biological life is continuously exposed to disturbances, some external and some generated internally. Temperature changes, fluid intake varies, infections occur, metabolic demand rises and falls, and the organism continually reorganizes itself around these changes. Homeostasis is therefore compatible with considerable motion; what matters is whether regulatory processes can keep essential variables within ranges compatible with continued function (Billman, 2020).

Primary adrenal insufficiency makes the distinction especially clear because ordinary functioning can be excellent while one important dimension of adaptive capacity is permanently constrained. With appropriate glucocorticoid and, when necessary, mineralocorticoid replacement, people with adrenal insufficiency can maintain ordinary physiological function and live full and active lives (NIDDK, n.d.). The vulnerability becomes especially important when physiological demand changes abruptly, because the endogenous adrenal response that would normally increase cortisol availability cannot be recruited in the usual way.

Resilience in this context therefore cannot mean that the organism possesses an unlimited ability to absorb stress. A more useful definition is the capacity to experience disturbance, mobilize appropriate regulatory responses and remain within—or return toward—a viable physiological regime. Treatment expands that capacity by replacing missing hormonal support, while education, sick-day dosing and emergency preparation expand it further by creating mechanisms for responding when ordinary replacement is no longer adequate (NICE, 2024).

That suggests a distinction between two superficially similar situations:

DISTURBANCE A

physiological demand increases
        ↓
available regulation adapts
        ↓
stable function preserved
        ↓
demand falls
        ↓
ordinary state restored


DISTURBANCE B

physiological demand increases
        ↓
available regulation becomes insufficient
        ↓
haemodynamic / metabolic consequences accumulate
        ↓
ability to compensate declines further
        ↓
crisis

Both begin with disturbance. Only the second develops into decompensation. The interesting explanatory variable is therefore not simply the presence of stress, but the changing relationship between stress and adaptive capacity.

The risk of crisis is hidden during successful compensation

This point is easy to underestimate because compensation is phenomenologically deceptive. When regulation succeeds, the evidence of the underlying limitation can disappear from view. If glucocorticoid replacement is adequate, mineralocorticoid replacement is appropriately managed, medication is absorbed normally and physiological demand remains within a familiar range, there may be little outward indication that the adrenal cortex itself could not generate an appropriate response if conditions suddenly changed. The therapeutic system is doing exactly what successful regulation is supposed to do: preventing the underlying defect from becoming the dominant fact of everyday physiology.

Yet successful compensation does not abolish the structural limitation. It makes that limitation manageable. This is why the concept of reserve should not be confused with current symptoms. A person may be asymptomatic while possessing less endogenous capacity to respond to a particular kind of physiological stress than an otherwise comparable person with intact adrenal function. The relevant vulnerability becomes visible only when demand rises sufficiently, replacement cannot be adjusted quickly enough, medication cannot be absorbed, or several disturbances occur together.

Dineen and colleagues emphasize that adrenal crisis usually arises in the context of an imbalance between cortisol requirement and availability, while also noting that the complete pathophysiology remains incompletely understood (Dineen et al., 2019). This is a useful formulation because it avoids treating crisis as though there were one universal concentration below which a switch marked CRISIS suddenly flips. The physiological meaning of available cortisol depends on what the organism is being asked to do at that moment.

In abstract terms:

State 1:
low physiological demand
+
adequate replacement
=
compensation succeeds


State 2:
high physiological demand
+
same replacement
=
possible mismatch


State 3:
high physiological demand
+
fluid loss
+
impaired oral absorption
+
inadequate cortisol availability
=
rapidly increasing risk of decompensation

The vulnerability has not suddenly been created in State 3. The relationship among the variables has changed enough to expose it.

Adrenal crisis is better understood as a trajectory than as a photograph

This is perhaps the most useful conclusion I have reached from thinking about adrenal crisis as a systems phenomenon. A clinical crisis is of course diagnosed and treated in the present, but the physiological state observed in the emergency department has a history. It may have developed through infection, fever, gastrointestinal losses, increasing cortisol requirement, inadequate replacement, impaired absorption, worsening hypotension and other interacting processes. The sequence and speed differ from case to case, and some crises can evolve very rapidly, but the final state is still the result of a trajectory through physiological state space rather than a timeless snapshot.

This is also why monitoring during treatment is necessarily dynamic. NICE recommends frequent assessment of blood pressure, heart rate, electrolytes and glucose during adrenal crisis and continuation of hydrocortisone and intravenous saline until haemodynamic stability has been restored (NICE, 2024). A single blood-pressure value or sodium measurement can provide important information, but recovery is ultimately about whether the organism is moving toward a more stable regime in which ordinary maintenance becomes possible again.

A useful conceptual distinction is therefore:

STATE:
Where is the organism now?


TRAJECTORY:
Where is the organism moving?


REGULATORY CAPACITY:
Can the available mechanisms
redirect that trajectory toward stability?

The third question is what turns a description of physiology into a description of resilience. Two people could theoretically have similar measurements at one moment while differing substantially in what happens next because their circulating volume, precipitating illness, hormonal support, absorption, treatment timing and other conditions differ. A state vector without dynamics tells only part of the story.

Adrenal crisis therefore invites a very different conception of clinical deterioration from a simple list of abnormal values. Hypotension, hyponatraemia, altered mental state or weakness are important clinical observations, but they are manifestations of a system whose regulatory relationships are changing. The crisis exists at the level of that changing organization.

The most dangerous transition may be a loss of recoverability

When I first began using the word decompensation, I thought mainly about the failure to maintain current physiological values. The deeper idea is that decompensation can also involve a loss of the system’s ability to restore itself using its ordinary regulatory mechanisms. This distinction is particularly visible when gastrointestinal illness interferes with oral glucocorticoid replacement. At exactly the moment when physiological demand can be increasing, the ordinary route used to provide the missing hormone may become unreliable. The disturbance is therefore affecting both the regulated organism and part of the mechanism by which the organism is usually supported.

NICE makes the practical significance explicit: when prolonged vomiting or diarrhoea prevents adequate absorption of oral glucocorticoids, parenteral hydrocortisone and hospital treatment are required, while suspected adrenal crisis should be treated immediately with intramuscular or intravenous hydrocortisone (NICE, 2024). From a systems perspective, this is striking because the intervention does more than increase the amount of support. It changes the pathway through which support enters the system.

Before deterioration:

oral replacement
      ↓
gastrointestinal absorption
      ↓
circulation
      ↓
glucocorticoid action

During severe gastrointestinal disturbance:

oral replacement
      ↓
vomiting / impaired absorption
      X
      ↓
required hormonal support may not arrive

The emergency pathway changes the topology:

intramuscular / intravenous hydrocortisone
      ↓
systemic delivery
      ↓
ordinary gastrointestinal route bypassed

Again, I am describing the architecture, not offering a treatment protocol. What interests me is the general principle exposed by established medical practice: when crisis compromises the normal route of compensation, effective rescue may require a route that does not share the same dependency.

Emergency treatment does not simply reverse one biochemical variable

The systemic character of adrenal crisis becomes even clearer when looking at what emergency management actually tries to restore. Immediate hydrocortisone is essential, but glucocorticoid replacement is accompanied by intravenous isotonic saline because volume depletion and haemodynamic instability are also central concerns. Blood pressure, heart rate, electrolytes and glucose are monitored while the precipitating cause is identified and treated (NICE, 2024). The intervention therefore acts on several relationships that have become disturbed during the crisis.

This is conceptually important because it prevents us from imagining a simple reversible chain in which cortisol falls, a crisis appears, cortisol is replaced and the organism instantly returns to its previous state. The missing hormonal support may be the defining endocrine defect, but the crisis state can include accumulated consequences whose restoration has its own dynamics. Circulating volume may need to be replenished, vascular responsiveness may recover over time, electrolyte abnormalities may require observation, and the underlying infection or other precipitating stressor continues to influence the physiological system.

In a simplified systems diagram:

PRECIPITATING STRESS
        ↓
increased physiological demand
        ↓
inadequate cortisol availability
        ↓
haemodynamic / metabolic consequences
        ↓
additional deterioration
        ↓
CRISIS STATE


RECOVERY

glucocorticoid support restored
        +
circulating volume restored
        +
relevant variables monitored
        +
precipitating cause treated
        ↓
trajectory redirected toward stability

The important idea is that crisis acquires its own state. Once the organism has moved sufficiently far from its previous equilibrium, treatment must address the state that now exists, not merely the event that began the movement.

Cause, precipitant and current physiological state must remain separate

This distinction is especially valuable because everyday language tends to compress causality. We might say that an infection “caused” an adrenal crisis, and clinically that may be a useful shorthand, but the statement hides several layers. The infection is a precipitating stressor. Primary adrenal insufficiency supplies the underlying limitation in endocrine adaptive capacity. The mismatch between demand and glucocorticoid availability participates in producing the crisis, while volume depletion, hypotension, impaired absorption and other secondary processes can then contribute to the evolving physiological state. By the time emergency treatment is required, the immediate problem is no longer identical to the original precipitating event.

The causal structure is closer to:

UNDERLYING VULNERABILITY
primary adrenal insufficiency
        |
        v

PRECIPITATING STRESS
infection / trauma / surgery / other stress
        |
        v

DEMAND-CAPACITY MISMATCH
required cortisol support exceeds availability
        |
        v

SYSTEMIC CONSEQUENCES
haemodynamic / metabolic / fluid disturbances
        |
        v

CRISIS STATE

This explains why management has to do several things simultaneously: restore glucocorticoid support, restore haemodynamic stability where necessary, and identify and treat the underlying precipitating cause (NICE, 2024). The root cause of vulnerability, the trigger of this particular crisis and the physiological state requiring treatment are related, but they are not interchangeable.

This separation also prevents a common conceptual mistake in systems analysis: assuming that removing the initiating disturbance automatically restores the previous state. If an infection triggered a cascade involving vomiting, volume depletion and adrenal crisis, controlling the infection does not instantaneously replace cortisol, restore circulating volume or reverse every downstream consequence. The path travelled through the crisis has changed the state of the organism.

History therefore becomes part of physiology

This is what I meant in Part II by path dependence, and I think it deserves a fuller treatment. A regulated biological system remembers its recent past in the most concrete possible sense: current hormone concentrations, circulating volume, electrolyte distributions, inflammatory state, metabolic reserves and receptor responses all depend partly on what has already happened. The body does not need a symbolic memory of yesterday’s illness for yesterday’s illness to influence today’s physiological state. The current material configuration is the record of that history.

Imagine a simplified sequence in which an infection raises physiological demand, fever increases fluid loss, appetite and intake decrease, vomiting begins, oral replacement becomes unreliable and circulatory volume falls. At each step, the starting point for the next event has changed. The same additional disturbance therefore has a different effect depending on when it occurs. A small amount of further fluid loss near the beginning of the process may be easily compensated; the identical loss after substantial volume depletion and hypotension may have much greater consequences.

We can represent that idea abstractly:

S0 --disturbance A--> S1

S1 --disturbance B--> S2

S2 --disturbance C--> S3

S3 --disturbance D--> crisis


The effect of D depends on S3,
not merely on the intrinsic size of D.

This is one reason the language of “the trigger” can be misleading if taken too literally. A final event may appear to precipitate sudden collapse while the system’s susceptibility to that event was created by everything that came before it. The crisis is temporal organization, not simply a collection of simultaneous abnormalities.

Successful treatment is also path dependent

The same principle applies in the opposite direction. Recovery does not teleport the organism from crisis back to its pre-crisis state. Emergency treatment changes several variables, and those changes alter the conditions under which subsequent regulation occurs. Hydrocortisone restores glucocorticoid support; intravenous fluid expands circulating volume; improving haemodynamics alters tissue perfusion; treatment of the underlying illness reduces the continuing disturbance. As these changes accumulate, ordinary mechanisms that were previously insufficient may become effective again.

This is why the NICE transition criterion is so interesting from a systems perspective. Parenteral hydrocortisone is continued until the person is haemodynamically stable and can again take and absorb oral glucocorticoids; saline is likewise continued according to haemodynamic and electrolyte status until stability is restored (NICE, 2024). Recovery is therefore defined partly by the restoration of a state in which the ordinary maintenance pathway has become viable again.

The architecture is:

ordinary maintenance
        ↓
disturbance exceeds adaptive capacity
        ↓
crisis
        ↓
emergency regulatory support
        ↓
state progressively restored
        ↓
ordinary maintenance becomes sufficient again

I find this much more useful than thinking of emergency treatment as a temporary “boost.” The purpose is to move the organism into a different dynamical regime: one in which routine replacement and ordinary physiological regulation can once again maintain stability.

Preparedness is an attempt to intervene on the trajectory before the endpoint

Adrenal-crisis prevention is also best understood temporally. Sick-day rules, emergency identification, access to injectable hydrocortisone and education are not primarily attempts to make adrenal insufficiency disappear; they exist because the direction of physiological change matters. If increased demand is recognized early enough and additional glucocorticoid support is supplied appropriately, a trajectory that might otherwise move toward crisis can potentially be redirected while the system remains much closer to its normal operating range (NICE, 2024; Dineen et al., 2019).

That suggests a general structure:

stable state
      ↓
physiological stress appears
      ↓
demand begins to rise
      ↓
early adaptation / sick-day response
      ↓
trajectory redirected
      ↓
crisis avoided

The difficult part is that the boundary between ordinary illness and dangerous decompensation is not represented by one universal observable threshold. Real illnesses vary, symptoms overlap, and adrenal crisis itself does not have one perfectly uniform definition across every study or clinical context. Dineen et al. discuss this definitional difficulty while emphasizing the importance of prompt recognition and treatment (Dineen et al., 2019). In practice, established clinical plans and guidelines therefore focus on recognizable risk situations and on acting safely when crisis is suspected rather than waiting for theoretical certainty.

This is an important lesson in uncertainty. A safety-critical response does not always require complete causal knowledge before action. The cost of waiting for perfect epistemic certainty may be much greater than the cost of acting on a well-founded suspicion, which is why NICE explicitly recommends immediate hydrocortisone when adrenal crisis is suspected (NICE, 2024).

Preparedness reduces risk without turning physiology into a deterministic machine

There is a temptation in systems engineering to believe that enough monitoring, documentation and fallback mechanisms can eventually eliminate surprise. Addison’s disease is a useful corrective to that confidence. Education and emergency preparation are extremely important, yet the biological environment remains variable and partly unpredictable. Intercurrent illness can evolve unexpectedly, gastrointestinal absorption can change, physiological stress can increase rapidly, and individuals do not all respond identically. The aim of resilience is therefore not to abolish uncertainty but to make dangerous trajectories more detectable and more recoverable.

This is also why Dineen et al. place such emphasis on education and access to parenteral glucocorticoids while simultaneously acknowledging that adrenal crises continue to occur (Dineen et al., 2019). The existence of an emergency plan is evidence of a mature understanding of uncertainty, not evidence that uncertainty has been eliminated. A resilient system expects that normal assumptions can fail and prepares another response for that possibility.

That distinction can be summarized as:

fragile safety model:
"If everyone follows the normal procedure,
the crisis should not happen."


resilient safety model:
"Normal management reduces risk,
but abnormal states remain possible,
so detection and emergency recovery
must also be designed."

Medicine has had to learn this because the consequences of pretending otherwise are immediate. Engineering systems often learn the same lesson only after an incident reveals that all of their “backup” paths depended on the same failed assumption.

The body has no single central homeostasis daemon

Another reason Addison’s disease makes such an interesting systems example is that homeostasis is profoundly distributed. There is no organ whose complete job description is “keep the organism healthy.” The hypothalamus, pituitary, adrenal glands, autonomic nervous system, cardiovascular system, kidneys, immune system, liver, pancreas and many other tissues participate in regulation, often through overlapping feedback loops. The stability of the organism emerges from their interaction (Billman, 2020).

Even the adrenal gland is not a master controller. Cortisol affects many tissues, but those tissues have their own dynamics and regulatory relationships. Aldosterone influences renal sodium and potassium handling, yet the kidneys simultaneously respond to haemodynamic signals, other hormones and local mechanisms. Blood pressure emerges from cardiac output, vascular resistance, circulating volume, autonomic activity and many other factors. Glucose concentration emerges from the interaction of intake, hepatic production, tissue utilization, insulin, glucagon, cortisol and additional regulatory processes. No single component contains the global state.

This distributed architecture is one reason systemic pathology can become difficult to understand by inspecting components individually. During adrenal crisis, one could theoretically find many cells behaving exactly as their local biochemical environment dictates while the organism as a whole moves toward haemodynamic collapse. The problem exists in the relationships among components and in the trajectory those relationships generate.

There is an obvious echo of the VPS here, although I want to keep it secondary. During that incident, individual software components also continued doing locally understandable things: callers retried, WARP logged failures, rsyslog preserved messages, the filesystem accepted writes until it could not, and services continued attempting their normal work. The catastrophic property belonged to the combined feedback structure. The biological case is vastly more complex, but it makes the same abstract point much more clearly: global stability is not guaranteed by local correctness.

Homeostasis includes the capacity to change the response itself

There is another subtlety worth emphasizing. A homeostatic system does not merely oppose every change with an equal and opposite reaction. Its response can depend on context, history and scale. The cardiovascular response appropriate for standing up is different from the response required during severe infection. Fluid regulation after drinking a glass of water is different from regulation during prolonged gastrointestinal loss. The endocrine response required during quiet sleep is different from that required during trauma or surgery. Biological stability is therefore achieved through adaptive regulation, not through blindly holding every variable fixed (Billman, 2020).

Addison’s disease selectively constrains one part of that adaptive flexibility. Basal glucocorticoid replacement may be sufficient during ordinary conditions, but physiological stress requires a change in treatment because the adrenal cortex cannot generate the corresponding change itself (NICE, 2024). This is why saying simply that “cortisol is replaced” misses something conceptually important. What is difficult to reproduce is not only the amount of hormone but the ability to adapt hormone availability continuously to context.

The distinction can be expressed as:

STATIC REPLACEMENT QUESTION

"Is enough cortisol present?"


DYNAMIC REGULATORY QUESTION

"Is cortisol availability appropriate
for this organism,
in this state,
under this level of physiological stress,
at this moment?"

The second question is much closer to what biological regulation actually has to solve.

There is no single quantity called compensatory reserve

At this stage the word reserve also needs to be handled carefully. It is useful, but there is a danger of imagining a literal hidden tank from which the body withdraws “reserve units” until the tank reaches zero. Physiological reserve is distributed and multidimensional. Cardiovascular responsiveness, intravascular volume, renal function, metabolic substrate availability, endocrine adaptation, autonomic regulation and many other capacities contribute to whether the organism can tolerate a particular disturbance. A person may therefore possess ample capacity in one dimension while being constrained in another.

Addison’s disease is a clear example because the limitation is selective. Many organs may be structurally intact, and most regulatory systems may function normally, while adrenal glucocorticoid output remains unable to adapt endogenously to stress. Replacement compensates for that deficit, but the margin available during an acute illness depends on much more than adrenal function alone. The severity of the illness, ability to maintain fluid intake, gastrointestinal absorption, timing and adequacy of glucocorticoid replacement, mineralocorticoid status and the behaviour of the cardiovascular system all matter.

It therefore makes more sense to define reserve relationally:

reserve =
the remaining capacity of the whole system
to absorb additional disturbance
and still reorganize toward a viable state

Seen this way, reserve cannot be interpreted without specifying the disturbance. “How much physiological reserve remains?” is incomplete unless we also ask: reserve against what kind of stress, over what period, given what starting state?

A crisis is the loss of a viable relationship among variables

This brings us to the idea that will eventually connect the medical essay to the mathematical one. Suppose we imagine the organism not as a list of organs but as a point in an enormous multidimensional state space. One dimension might represent effective circulating volume, another arterial pressure, another glucocorticoid availability, others sodium, potassium, glucose, temperature, inflammatory state, renal perfusion and thousands of additional quantities. At every moment the organism occupies some point in that space, and physiological regulation moves that point continuously as conditions change.

Most ordinary states occupy a broad region compatible with continued life and function. They do not have to be identical. Blood pressure can rise during exercise, heart rate can fall during sleep, cortisol varies through the day, and glucose changes after meals. Viability therefore corresponds to a region of acceptable dynamic states, not to one ideal coordinate. Homeostasis is partly the capacity to remain within that region or return toward it after disturbance.

Addison’s disease changes the dynamics governing movement through this space because one important regulatory pathway has lost endogenous adaptive capacity. During ordinary replacement, the trajectory can still remain comfortably inside the viable region. During sufficiently severe physiological stress, however, the same limitation can become consequential because the forces moving the state have changed. If glucocorticoid support becomes inadequate, volume falls, vascular responsiveness deteriorates and additional disturbances accumulate, the trajectory can move toward a boundary where ordinary regulation is no longer capable of reversing it.

I can write this schematically without claiming that it is a clinical equation:

x(t + Δt) = F(x(t), u(t), r(t))

where:

x(t) = current physiological state

u(t) = disturbances
       illness, trauma, fluid loss, etc.

r(t) = available regulatory support
       endogenous mechanisms
       + replacement therapy
       + emergency intervention when required

The important question becomes whether the resulting trajectory remains inside a viability region V:

compensated:

x(t) ∈ V
and regulation can keep it there


decompensating:

x(t) ∈ V
but trajectory is approaching a boundary
and regulatory margin is shrinking


crisis:

ordinary regulatory mechanisms
are insufficient to keep or return
the trajectory to a viable regime

This is only a conceptual model, and the physiology of adrenal crisis should not be forced into a simplistic mathematical threshold. But the model helps clarify why decompensation is a systems property. No single molecule crosses the boundary. The trajectory of the organized organism does.

At the molecular level there is no object called adrenal crisis

If I keep descending through levels of description, the comparison becomes even more interesting. At the clinical level we can say with complete seriousness that a person is experiencing an adrenal crisis. At the organ level we can discuss adrenal cortical insufficiency. At the cellular level we can discuss steroidogenic cells, receptors, membrane transport and signalling. At the molecular level we find cortisol molecules, sodium ions, potassium ions, proteins, lipids and water. Descending further, we reach atoms, electrons and ultimately physical interactions described by chemistry and physics.

At no point do we encounter a special particle labelled ADRENAL_CRISIS.

A sodium ion behaves according to electrochemical forces whether the organism is healthy or critically ill. A cortisol molecule does not know whether it was produced by an adrenal gland or injected as hydrocortisone. A receptor follows molecular interaction dynamics. Water continues moving according to physical and osmotic forces. The underlying physical processes remain lawful throughout the crisis.

And yet the crisis is completely real.

This is possible because reality can contain properties that become meaningful only at particular organizational scales. Blood pressure is not a property of one blood molecule. Circulating volume is not a property of one water molecule. Hormonal regulation is not a property of one cortisol molecule. Homeostasis is not a property of one cell. Adrenal crisis describes a pathological dynamical state of the organism produced by relationships among all of these lower-level processes.

The absence of a microscopic “crisis object” therefore does not make crisis subjective or imaginary. It means that the relevant property belongs to a higher level of organization.

The physics can all be correct while the organism is physiologically wrong

This is where the medical case opens a philosophical problem that I do not want to solve inside this article but cannot completely ignore. During adrenal crisis, every molecule continues obeying physics. There is no moment when sodium ions violate electrodynamics or receptors stop obeying chemistry. From the standpoint of fundamental physical law, the transition from stable physiology to hypotension and shock is simply another sequence of permitted state transitions.

Yet medicine describes one trajectory as healthy and another as pathological.

That judgment is not arbitrary. The distinction is grounded in the organization required for the organism to maintain itself. A blood pressure incompatible with adequate perfusion is not merely an unusual number; it threatens the continuation of organismal function. Severe disturbance of circulating volume, electrolytes, glucose or glucocorticoid support matters because the organism depends on particular relationships among these variables to remain viable.

So at different descriptive levels we can truthfully say both:

PHYSICAL DESCRIPTION

matter is undergoing lawful state transitions


PHYSIOLOGICAL DESCRIPTION

the organism is failing
to maintain a viable internal organization

There is no contradiction between them. The word failure enters when we describe those physical transitions relative to the functional organization of a living system.

Illness therefore teaches us something unusual about function

Addison’s disease makes this especially visible because the concept of function is impossible to avoid. We say that the adrenal cortex should produce cortisol, that cardiovascular regulation should maintain adequate perfusion, and that endocrine responses should adapt to physiological stress. These statements sound normative: they contain words such as should, adequate and normal. Physics by itself contains none of those terms. Physics tells us what state transitions occur under given conditions; it does not label one trajectory successful and another pathological.

Biology, however, contains systems whose organization depends on continued self-maintenance. If blood pressure falls beyond a certain range for long enough, tissue perfusion becomes inadequate. If the organism cannot restore a compatible state, damage accumulates and survival becomes threatened. In that context, calling the state pathological is not simply an observer’s aesthetic preference. It describes a real relationship between the current dynamics and the requirements of the living system’s continued organization.

Addison’s disease therefore leads naturally toward questions about biological function, teleology, normativity and viability. Those are questions for the later philosophical essay. For the present discussion, the important point is simpler: the meaning of failure appears at the level where organization and continued viability become relevant.

The small VPS analogy helps here, but only at the edge

This is one place where I think the original server incident can briefly return without taking over the medical essay. At the transistor level, nothing in my VPS became metaphysically “wrong” when DNS failed or the disk reached ENOSPC. Transistors changed state according to electronic rules; memory cells stored bits; the processor executed instructions; filesystem code attempted writes and returned errors when no space remained. The catastrophe existed at a higher organizational level where I expected the machine to provide DNS, preserve writable storage, serve a website and remain administratively accessible.

The resemblance to adrenal crisis is therefore not between particular components but between levels of explanation:

PHYSICAL LEVEL

lawful state transitions
        ↓

ORGANIZATIONAL LEVEL

feedback
regulation
resource relationships
        ↓

SYSTEM LEVEL

stable / unstable
compensated / decompensated
viable / failed

The biological case is much richer because the organism maintains itself through evolved physiological regulation and because the consequences involve health and life rather than service availability. Still, the computer incident gave me a concrete way to notice a structure that physiology expresses much more profoundly.

Where the analogy finally has to stop

At this point it is worth stating the boundary clearly because an analogy becomes less useful when it starts claiming identity. Addison’s disease is not “a bug in the body.” The adrenal cortex is not a failed microservice, cortisol is not a packet, hydrocortisone is not a software patch, and emergency medicine cannot be understood adequately by importing engineering vocabulary. Biological organisms are developmental, evolutionary, adaptive systems whose regulatory complexity vastly exceeds the little VPS that started this reflection.

The human significance is also completely different. An adrenal crisis can threaten a person’s life. A VPS outage threatens a website and perhaps some data or services. The comparison should never flatten that distinction or use technological language to trivialize illness. The medical discussion has value precisely because established knowledge about adrenal insufficiency gives us a concrete example of regulation, reserve and decompensation whose reality cannot be reduced to a metaphor.

What survives after those differences are respected is a more abstract shared structure:

both are complex systems

both exist in changing environments

both depend on regulatory relationships

both can tolerate some disturbances

both possess finite adaptive capacity

both can preserve outward function
while internal margin is shrinking

both can enter feedback regimes
that ordinary regulation cannot reverse

both may require an intervention
outside the failing ordinary pathway

both recover when a state is restored
in which ordinary regulation becomes viable again

That is enough. The analogy does not need to do more.

What Addison’s disease ultimately changed in my understanding of crisis

Before thinking through this comparison, I tended to imagine failure as an event: something works, a fault occurs, and then it does not work. Addison’s disease suggests a more interesting model. A complex system can contain a permanent limitation and nevertheless remain stable for years because other mechanisms, including external treatment, successfully compensate for it. A disturbance can then alter the demand placed on those mechanisms. For some time the system may continue functioning while using progressively more regulatory capacity. If the mismatch becomes too large, secondary physiological consequences can accumulate, the ordinary maintenance pathway can become unreliable, and the system can enter a state that requires a qualitatively different form of intervention.

Seen this way, adrenal crisis is not adequately described by one missing hormone, one abnormal laboratory value or one final moment of collapse. It is a dynamical state in which the relationship among physiological demand, hormonal support, fluid balance, vascular responsiveness, metabolic regulation and other processes has moved beyond what ordinary compensation can safely contain. Emergency treatment works by changing those relationships strongly enough to redirect the trajectory toward a region where normal maintenance becomes possible again (NICE, 2024; Dineen et al., 2019).

That gives me a much richer vocabulary for thinking about illness:

health
    is not immobility

homeostasis
    is not one fixed set point

replacement
    is not identical to restoring
    the original controller

compensation
    is not proof of unlimited reserve

reserve
    is not one hidden quantity

crisis
    is not simply the final visible collapse

recovery
    is not merely removal of the first trigger

Instead, the story is about relationships changing through time.

From Addison’s disease to a more general theory of decompensation

The medical analogy has therefore taken me as far as I want to go in this essay. It began with a slightly ridiculous joke about a computer having an adrenal crisis, but following the comparison carefully forced me to distinguish mechanisms from structures. At the mechanistic level, the two cases have almost nothing in common. At the systems level, however, Addison’s disease provides a remarkably rich example of a permanent regulatory limitation that can be compensated under ordinary conditions, exposed under increased demand, amplified by interacting disturbances, rescued through an alternative intervention pathway and returned to a stable maintenance regime.

More importantly, the comparison made me realize that decompensation is not simply a medical word for “getting much worse.” It describes a transition in the relationship between a system and its own regulatory capacity. A compensated system can still contain vulnerability; a stable observable output can coexist with declining margin; and the decisive threshold may be reached when the system loses the ability to redirect its own trajectory using the mechanisms normally available to it.

The next step is therefore mathematical rather than medical. If an organism can occupy many possible physiological states, if only some of those states are compatible with continued viability, and if feedback determines how the state moves under disturbance, then concepts such as state space, viability region, stability, attractor, positive feedback, tipping point and control begin to offer a more formal language for what this essay has described qualitatively.

After that comes an even stranger descent: if the organismal crisis can be decomposed into cellular activity, molecular interactions, ion movements and finally lawful physical state transitions, where exactly does the property called failure enter the description? And if physics itself contains only what happens, where do biological concepts such as function, pathology, successful regulation and “what should happen” come from?

Those questions deserve separate essays because answering them properly requires leaving clinical physiology and moving into cybernetics, dynamical systems, philosophy of biology and eventually normativity. For now, the lesson I want to keep from Addison’s disease is much more concrete and, I think, more useful:

A complex system is healthy not because nothing disturbs it, but because it retains enough regulatory capacity to absorb disturbance, preserve viability and return toward a sustainable state. Decompensation begins when that relationship breaks down; crisis emerges when ordinary regulation is no longer enough; and recovery succeeds when a viable regulatory regime becomes possible again.

That is what the VPS unexpectedly made me notice. Addison’s disease is what made me understand it.

References

Billman, G. E. (2020). Homeostasis: The underappreciated and far too often ignored central organizing principle of physiology. Frontiers in Physiology, 11, 200. https://doi.org/10.3389/fphys.2020.00200

Bornstein, S. R., Allolio, B., Arlt, W., Barthel, A., Don-Wauchope, A., Hammer, G. D., Husebye, E. S., Merke, D. P., Murad, M. H., Stratakis, C. A., & Torpy, D. J. (2016). Diagnosis and treatment of primary adrenal insufficiency: An Endocrine Society clinical practice guideline. The Journal of Clinical Endocrinology & Metabolism, 101(2), 364–389. https://doi.org/10.1210/jc.2015-1710

Dineen, R., Thompson, C. J., & Sherlock, M. (2019). Adrenal crisis: Prevention and management in adult patients. Therapeutic Advances in Endocrinology and Metabolism, 10, 2042018819848218. https://doi.org/10.1177/2042018819848218

National Institute for Health and Care Excellence. (2024). Adrenal insufficiency: Identification and management (NICE guideline NG243). https://www.nice.org.uk/guidance/ng243

National Institute of Diabetes and Digestive and Kidney Diseases. (n.d.). Definition & facts of adrenal insufficiency & Addison’s disease. National Institutes of Health. https://www.niddk.nih.gov/health-information/endocrine-diseases/adrenal-insufficiency-addisons-disease/definition-facts

How a VPS Turned a Network Failure Into a Full-System Outage (Tracing a Cloudflare WARP Failure from DNS Errors to Disk Exhaustion)

I was not looking for an interesting systems failure. I was expecting a boring one.

On August 16, 2026, I received an UptimeRobot notification saying that one of my WordPress sites had gone down. This was running on a very small Scaleway VPS, and my first thought was almost automatic: the disk was probably full again. I had seen that kind of problem before. UpdraftPlus could leave backup archives on a small root filesystem, free space would disappear, WordPress would stop behaving properly, and the repair was usually uncomplicated: SSH into the server, identify old backups, delete what was no longer needed, and move on.

That assumption was reasonable because it came from previous operational experience. It was also wrong this time.

The first sign that this incident was different was not actually the website. It was SSH. I could not log into the VPS at all. I tried again from another SSH client. I tried a hard reboot from the Scaleway control panel. The machine appeared to boot, but SSH still would not let me in. The familiar five-minute cleanup had suddenly become a situation in which both the application plane and my normal management plane were unavailable. A small VPS is quite capable of reminding you that 10 GB is a perfectly respectable amount of storage right up until it decides that it is zero.

The UptimeRobot incident gave me a useful external timestamp. The monitor recorded the outage beginning at:

2026-08-16 16:43:31 UTC

HTTP 522 - CloudFlare Timeout

The site sat behind Cloudflare’s reverse proxy, so a 522 was already telling me something more specific than “WordPress returned an error page.” Cloudflare was no longer getting a timely response from the origin. At this point that still left many possibilities: Nginx, PHP, MariaDB, resource exhaustion, networking, firewall state, or the entire host. The monitor could tell me where the failure became externally visible; it could not yet tell me where the failure began.

The VPS was small, IPv6-only, and slightly unusual

The architecture matters because this was not a conventional dual-stack VPS. The original system was Ubuntu 22.04.4 LTS running Linux 5.15.0-187-generic on KVM, with one virtual CPU, roughly 1 GB of RAM, a 1 GB swap file, and a 10 GB virtual disk. The usable root filesystem was about 8.9 GB. The web stack included Nginx, PHP 8.1 FPM, MariaDB 10.6.23 and WordPress.

The machine had native public IPv6 but no normal native IPv4 route. Incoming web traffic was proxied through Cloudflare, so the public-facing site did not require the origin itself to expose a public IPv4 address. That is an important distinction that I had not been thinking about when I first built the server. Cloudflare acting as a reverse proxy in front of a website and Cloudflare WARP running as a client inside that website’s server are two different pieces of architecture.

Server-side WARP had been installed months earlier. I no longer remembered every decision that led to the exact configuration, which became another reason not to reconstruct the incident from memory alone. The surviving shell history was more trustworthy. Among the commands were:

sudo apt-get install cloudflare-warp
warp-cli settings
sudo warp-cli tunnel ip add-range ::/0
warp-cli settings
warp-cli registration new
warp-cli connect

The installed Linux client was Cloudflare WARP 2026.3.846.0. The particularly interesting command was:

sudo warp-cli tunnel ip add-range ::/0

The surviving WARP configuration later showed this as an exclusion of ::/0. In practical terms, the intended architecture was approximately:

Inbound HTTP/HTTPS
        |
        v
Cloudflare reverse proxy
        |
        v
native IPv6 origin

Outbound IPv6
        |
        +---- native VPS IPv6

Outbound IPv4
        |
        +---- Cloudflare WARP

That design makes sense for an IPv6-only machine that occasionally needs to initiate a connection to an IPv4-only service. The goal was not to replace the server’s working IPv6 network with a VPN for its own sake. The surviving configuration strongly suggests that WARP was being used as an IPv4-egress workaround while native IPv6 remained outside the tunnel.

I am emphasizing “surviving configuration” here because it is easy in a postmortem to rewrite one’s intentions to match the evidence discovered later. I did not have a perfect memory of why every WARP command had been issued. The shell history and runtime configuration established what the system had actually been told to do; my recollection merely supplied the broader context.

The machine booted, but SSH did not become SSH

After the outage I hard-rebooted the instance from Scaleway and watched the serial console. If the kernel had panicked, the root filesystem had been corrupted, or the VM simply could not boot, the problem would at least have been conceptually straightforward. Instead, the boot looked surprisingly normal.

The filesystem check reported the root filesystem as clean. Swap activated. IPv6 networking appeared. Nginx started. PHP-FPM started. MariaDB started. The Cloudflare client started. Cloud-init completed. The machine reached its login prompt. There was no visible kernel panic, no obvious out-of-memory crash and no catastrophic ext4 failure.

There was, however, one line in the filesystem check that was much less reassuring:

cloudimg-rootfs: clean, 148660/1193472 files, 2397738/2412986 blocks

Almost all filesystem blocks were occupied. On a subsequent boot the count became:

2399256/2412986 blocks

That put the root filesystem at roughly 99.4% block usage. The situation was already severe enough that disk exhaustion immediately became the leading operational problem.

Still, it did not completely explain what I was seeing. A later boot explicitly showed that OpenSSH itself had started:

[  OK  ] Finished SCW fetch ssh keys from metadata.
         Starting OpenBSD Secure Shell server...
[  OK  ] Started OpenBSD Secure Shell server.

So the earlier absence of an SSH startup line in one console excerpt had been misleading. sshd had not simply failed to start. The authentication logs subsequently showed it listening on port 22 over IPv6 as well.

The client-side transcript narrowed the problem further. I normally reached this IPv6-only server through a local SOCKS path, so I ran OpenSSH with verbose diagnostics:

ssh -vvv \
  -o 'ProxyCommand=nc -x 127.0.0.1:7890 -X 5 %h %p' \
  root@2001:db8::10

The important part was not the hundreds of ordinary diagnostic lines. It was where the exchange stopped:

debug1: Executing proxy command: exec nc -x 127.0.0.1:7890 -X 5 2001:db8::10 22
...
debug1: Local version string SSH-2.0-OpenSSH_8.6
kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535

This established several useful facts. My client could reach the path to TCP port 22. OpenSSH started the protocol exchange and sent its own identification string. What never arrived was the server’s corresponding SSH-2.0-... banner. Public-key authentication had not failed, because authentication had not even begun.

The UNKNOWN port 65535 line looked dramatic but was not the server mysteriously deciding to move SSH to port 65535 overnight. It was an artifact of the ProxyCommand connection path. The diagnostically important line was kex_exchange_identification: Connection closed by remote host.

I also tried another SSH application and obtained the same practical result. This made an ordinary client configuration problem increasingly implausible. More importantly, the server’s own SSH logs did not contain a corresponding authentication failure from these attempts. The service was starting and listening, while connections were disappearing before the normal SSH exchange became visible in the logs.

That still did not prove what was killing them. Extreme disk pressure could produce strange secondary failures. WARP was also present and capable of manipulating networking and firewall state. There were other possibilities. At this stage I could describe the boundary of the failure much more accurately than its cause:

VM boot                         works
root filesystem mounts          works
IPv6 interface comes up         works
major application services      start
sshd service                    starts
TCP path to port 22              reachable
SSH client sends its banner      yes
server SSH banner                never arrives
SSH key authentication           never reached

Repeating hard reboots was therefore becoming less useful. In fact, the filesystem block count had moved in the wrong direction between boots. A reboot was capable of restarting the same persistent state; it was not removing that state. Eventually I stopped treating “reboot it again” as a diagnostic method.

Rescue mode changed the kind of problem I was solving

At this point Scaleway’s rescue mode became essential. Instead of booting the installed Ubuntu environment, rescue mode starts an independent temporary operating system while leaving the original disk attached. That distinction is enormously valuable when the installed system’s own networking, DNS, firewall or storage state may be part of the failure.

It also created an out-of-band administrative path. The production OS could be completely confused while the block device containing it remained perfectly readable from another system. Without something equivalent to rescue mode, I would have been very close to an administrative deadlock: the server needed repair, but the server itself was the only normal route through which I could perform the repair.

The rescue environment happened to be Ubuntu 24.04.2 LTS with a 6.8-series kernel. That was not an upgrade of the VPS. It was a separate temporary system, and distinguishing the rescue filesystem from the original one was the first task.

I started with block-device identification rather than mounting whatever looked plausible:

lsblk -f
findmnt /

The important part of the output was:

NAME    FSTYPE  LABEL
sda
├─sda1  ext4    RESCUE-ROOTFS
...
vda
├─vda1  ext4    cloudimg-rootfs
├─vda14
└─vda15 vfat    UEFI

/       overlayroot

sda belonged to the rescue system. vda1 was the original VPS root filesystem. I mounted that original partition read-only first:

mkdir -p /mnt/original
mount -o ro /dev/vda1 /mnt/original

df -h /mnt/original
df -i /mnt/original

The result immediately confirmed that the full-disk suspicion was real:

Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1       8.9G  8.8G   46M 100% /mnt/original

Filesystem      Inodes   IUsed   IFree IUse%
/dev/vda1       1193472 148662 1044810 13%

This was block exhaustion, not inode exhaustion. Only 13% of the inodes were occupied. The filesystem was simply out of useful storage space.

That result might seem to have vindicated my original diagnosis. The site was down, I had suspected a full disk, and the disk was indeed at 100%. Case closed?

Not quite. “The disk is full” describes a state. It does not identify the process that created that state, and it certainly does not explain every symptom that occurs after the state has been reached.

The disk was full for a very different reason

Because the filesystem was still mounted read-only, I could investigate without allowing the installed system to generate more logs or update more state. I worked down the directory tree:

du -xhd1 /mnt/original 2>/dev/null | sort -h
du -xhd1 /mnt/original/var 2>/dev/null | sort -h
du -xhd1 /mnt/original/var/log 2>/dev/null | sort -h

find /mnt/original -xdev -type f -size +50M \
  -printf '%s %p\n' 2>/dev/null | sort -n | tail -40

The top-level numbers immediately changed the story:

/usr                     2.2G
/var                     5.5G
total                    8.8G

/var/www                 578M
/var/lib                 1.3G
/var/log                 3.5G

My entire web tree was only about 578 MB. System logs occupied 3.5 GB.

Looking further into /var/log gave:

/var/log/cloudflare-warp    62M
/var/log/journal           801M
/var/log/nginx             556K
/var/log                   3.5G

Those directory totals still left a couple of gigabytes unexplained, which meant the next thing to inspect was the ordinary files directly inside /var/log. There they were:

/var/log/syslog        approximately 2.38 GB
/var/log/syslog.1      approximately 390 MB
older compressed syslogs          tens of MB
persistent journal       approximately 801 MB

This was no longer a story about a WordPress backup directory quietly occupying most of the disk.

I checked the actual UpdraftPlus storage as well. At forensic inspection time, the wp-content/updraft directory contained only about 104 KB, while the UpdraftPlus plugin itself occupied roughly 31 MB. The entire /var/www tree remained around 578 MB. Against 3.5 GB of system logs, the imbalance was unmistakable.

That does not prove that no temporary backup archive had existed at some earlier moment and later disappeared. I cannot reconstruct a deleted temporary file merely because it is absent at inspection time. So I would not write that UpdraftPlus played absolutely no role. What the rescue evidence did establish was narrower and stronger: persistent WordPress backup storage was not the dominant consumer of the filesystem when the machine failed; logging was.

The next observation made that much more interesting. The oversized syslog was packed with Cloudflare WARP activity. I was seeing DNS-related failures, connectivity checks, network state changes, firewall-related operations and repeated client messages at extremely high density. Even before reconstructing their complete chronology, the log volume made WARP impossible to treat as a minor background service.

This was the first major revision of my mental model:

Initial expectation:

WordPress backup
      |
      v
disk fills
      |
      v
website fails

What rescue mode showed:

system logging
      |
      v
multi-gigabyte /var/log
      |
      v
disk fills
      |
      v
multiple services become suspect

The distinction mattered. If a backup simply consumed the remaining disk, deleting the backup would be sufficient treatment. If some service was continuously generating extraordinary amounts of logging, freeing space without stopping the generator would merely reset the countdown.

Freeing space without immediately destroying the evidence

There is a tension in incident response between restoring service quickly and preserving a perfect forensic record. I did not have the luxury of making a complete bit-for-bit forensic image before touching the machine. This was a personal production VPS that needed to come back online. Still, rescue mode allowed me to do considerably better than blindly deleting files from a live system.

Before changing anything, I had identified the original disk, mounted it read-only, recorded filesystem and inode usage, measured the important directory sizes, inspected the authentication logs, identified the huge syslog files, checked the persistent journal and inspected the surviving WARP logs. Those observations were already enough to rule out several simplistic explanations.

The persistent systemd journal—about 801 MB—and the separate /var/log/cloudflare-warp tree were especially valuable because they survived the cleanup and later became the basis for reconstructing the incident in much finer detail.

Only after that inspection did I remount the original filesystem read-write:

mount -o remount,rw /mnt/original
mount | grep /mnt/original

Then I removed the immediate storage pressure by truncating the enormous active and rotated syslogs and deleting older compressed rotations:

truncate -s 0 /mnt/original/var/log/syslog
truncate -s 0 /mnt/original/var/log/syslog.1

rm -f /mnt/original/var/log/syslog.2.gz \
      /mnt/original/var/log/syslog.3.gz \
      /mnt/original/var/log/syslog.4.gz

df -h /mnt/original

The change was immediate:

Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1       8.9G  6.2G  2.7G  70% /mnt/original

Roughly 2.7 GB had been recovered. That was operationally important, but I did not want to boot the normal system yet. The logs had already made WARP suspicious enough that allowing it to start automatically would have changed network, DNS and possibly firewall state before I had even regained control.

Instead, I disabled and masked the WARP service in the offline installation:

systemctl --root=/mnt/original disable warp-svc.service
systemctl --root=/mnt/original mask warp-svc.service

systemctl --root=/mnt/original is-enabled warp-svc.service
systemctl --root=/mnt/original is-enabled ssh.service

The result was:

warp-svc.service   masked
ssh.service        enabled

Masking rather than uninstalling WARP was deliberate. I wanted the next boot to occur without the daemon modifying anything, but I did not want to destroy its package state or configuration before I understood what had happened. Disabling the suspect while preserving it for examination is a much better debugging move than enthusiastically deleting the suspect and then wondering where the evidence went.

Validating SSH exposed a harmless trap and then another real fault

Before leaving rescue mode, I also wanted to establish whether the installed OpenSSH configuration itself was syntactically valid. Running sshd -t inside the mounted system initially produced:

Missing privilege separation directory: /run/sshd
255

For a moment this looked like another SSH failure. It was actually a property of the testing environment. /run is runtime state created during a normal boot, and a simple chroot of an offline filesystem does not reproduce that runtime environment.

I created the expected directory inside the mounted system and repeated the configuration test:

install -d -m 0755 /mnt/original/run/sshd

chroot /mnt/original /usr/sbin/sshd -t
echo $?

This time the result was:

0

That was useful negative evidence. The installed sshd configuration parsed successfully, ssh.service was enabled, and the root account’s authorized-key file existed. It made a broken SSH configuration an increasingly poor explanation for the original pre-banner failure.

Then another command revealed a much more concrete problem:

ls -l /mnt/original/etc/resolv.conf
cat /mnt/original/etc/resolv.conf

The output was:

-rw-r--r-- 1 root root 0 Aug 16 16:37 /mnt/original/etc/resolv.conf

/etc/resolv.conf was a zero-byte regular file.

That was not the normal resolver arrangement I expected on this Ubuntu installation. It also matched messages I had already seen from WARP complaining that it could not find usable nameservers and could not read the system DNS configuration. At that moment it was extremely tempting to construct a neat explanation immediately: perhaps the empty resolver file had broken WARP, WARP had entered a retry loop, and the retry loop had filled the disk.

I resisted making that a conclusion. I knew the state of the file and its timestamp. I knew the disk was full. I knew WARP had produced huge quantities of logs. I did not yet know the temporal ordering of those events.

That distinction became crucial later.

I preserved the empty file before replacing it:

cp -a /mnt/original/etc/resolv.conf \
      /mnt/original/etc/resolv.conf.rescue-backup

Then I confirmed that systemd-resolved was enabled and restored the usual stub-resolver symlink:

systemctl --root=/mnt/original \
  is-enabled systemd-resolved.service

rm /mnt/original/etc/resolv.conf

ln -s ../run/systemd/resolve/stub-resolv.conf \
  /mnt/original/etc/resolv.conf

ls -l /mnt/original/etc/resolv.conf

The resulting state was:

/etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.conf

At this point the offline installation had four important properties:

root filesystem      70% used, about 2.7 GB free
ssh.service          enabled
sshd configuration   valid
warp-svc.service     masked
systemd-resolved     enabled
/etc/resolv.conf     restored to stub-resolver symlink

I synchronized the filesystem and cleanly unmounted it:

sync
umount /mnt/original

Then I shut down the rescue environment normally, changed the Scaleway boot mode from Rescue back to Local, and started the VPS from its original disk.

The same VPS came back

The next normal Ubuntu 22.04 boot looked different in exactly the ways I wanted. The ordinary network stack came up, the resolver service started, Nginx, PHP-FPM and MariaDB started, and OpenSSH started normally. Server-side WARP did not start because it remained masked.

Most importantly, I could finally SSH into the machine again.

Post-recovery checks showed the root filesystem still around 70% usage with roughly 2.7 GB available. Inode usage remained only about 13%. ssh.service was enabled and active. warp-svc.service was masked and inactive. systemd-resolved was enabled and active. The VPS had its native IPv6 address and route, with no ordinary IPv4 route.

The resolver had returned to its normal stub mode:

nameserver 127.0.0.53
options edns0 trust-ad
search .

resolv.conf mode: stub

sshd was listening normally on port 22 and another sshd -t returned zero. The newly created /var/log/syslog was only about 124 KB shortly after recovery instead of gigabytes. The persistent journal remained at roughly 800 MB, which was fortunate because it contained much of the history I still needed.

The website recovered as well.

Operationally, this was the point at which the emergency ended. Forensically, it was the point at which the interesting part began.

Recovery did not prove the cause

It would have been easy to stop here and write a simple postmortem: “the disk filled with WARP logs, I disabled WARP, fixed DNS, and everything worked.” That would contain several true observations and still overstate what had actually been demonstrated.

The recovery changed three important variables at approximately the same time:

  • I freed about 2.7 GB of filesystem space.
  • I repaired the zero-byte /etc/resolv.conf.
  • I prevented WARP from starting.

When the machine then recovered, that proved the combined intervention was sufficient to restore it. It did not isolate which intervention restored SSH, which one restored the web path, or which condition had originally begun the failure.

The SSH evidence was particularly awkward. We had directly observed sshd start and listen on port 22, while remote clients reached the port and died before receiving the server banner. Yet there was no clean log line saying, for example, “WARP firewall dropped this SSH connection,” and there was no controlled test in which I changed only the disk state while leaving every network component untouched. Claiming the exact low-level mechanism of the SSH failure would therefore have gone beyond the evidence.

The zero-byte resolver file created the same epistemic problem. It was unquestionably broken. Its recorded modification time was around 16:37 UTC, only a few minutes before the externally observed 16:43:31 outage. WARP also complained about missing nameservers. That made it an extremely interesting clue. But a close timestamp is evidence of sequence, not automatic proof of origin. I did not yet know which process had truncated the file, nor whether that event was the first fault or a late consequence of something that had already been wrong for days.

The disk, meanwhile, was certainly full. But the discovery that /var/log occupied 3.5 GB, with approximately 2.38 GB in syslog, meant that “disk full” had itself become a question requiring an explanation. Why had logging exploded? When had it started? Was WARP merely reporting another network problem, or was it part of that problem? Had the server gradually accumulated logs for months, or had something changed abruptly? Did the resolver failure create the logging storm, or did storage exhaustion damage the resolver later?

I used AI assistance throughout this debugging process as an interactive second pair of eyes: to suggest narrow read-only commands, interpret unfamiliar log patterns, challenge premature explanations and keep competing hypotheses visible. But the distinction between assistance and evidence mattered. The claims I trusted came from the VPS itself—filesystem measurements, service state, timestamps, package history, journals, WARP logs and network tests. Deciding how strongly those observations justified a causal statement remained my responsibility.

By the time the server was stable again, the original UpdraftPlus hypothesis had already been substantially displaced. The filesystem really had reached 100%, but persistent WordPress backups were not what occupied most of it. WARP was present in an unusual IPv6-only architecture and was producing extraordinary amounts of logging. /etc/resolv.conf had somehow become an empty file. SSH had failed before banner exchange even while its daemon appeared to be running normally.

The machine was alive again. The explanation was not.

Fortunately, rescue mode had left me with the surviving systemd journal, the WARP-specific logs, several distinct boot records, package history and the preserved empty resolver file. Those traces meant I no longer had to reason forward from symptoms. I could begin reasoning backward through time.

And that changed the question completely. I was no longer asking, “What do I delete to get my VPS back?” I was asking, “What actually happened first?”

Reconstructing the timeline from what survived

The first question was deceptively simple: what actually happened first?

Once the VPS was stable again, I stopped treating the recovered machine as something to “fix” and started treating it as evidence. I did not update Ubuntu, did not unmask WARP, and did not immediately clean up every old log. Any of those operations would have made the system tidier while simultaneously making the history harder to reconstruct.

The surviving evidence was fragmented. The giant syslog files had already been truncated as part of emergency recovery. The persistent systemd journal still contained several boots, but parts of the critical interval were missing. WARP’s own rotating files retained different pieces of history from the journal. Some data was highly detailed but recent; other data consisted only of periodic counters stretching further backward in time. In a way, the failure had started eating its own black box recorder.

I began by listing the surviving journal boots:

journalctl --list-boots

The relevant structure looked approximately like this after anonymizing the boot identifiers:

-4  boot-A   Thu 2026-08-13 05:22:00 UTC — Sun 2026-08-16 17:56:59 UTC
-3  boot-B   Sun 2026-08-16 17:58:19 UTC — Sun 2026-08-16 18:10:38 UTC
-2  boot-C   Sun 2026-08-16 18:13:02 UTC — Sun 2026-08-16 18:25:41 UTC
-1  boot-D   Sun 2026-08-16 18:28:52 UTC — Sun 2026-08-16 18:32:51 UTC
 0  boot-E   Sun 2026-08-16 18:52:28 UTC — Sun 2026-08-16 19:01:29 UTC

At first glance, it was tempting to interpret 2026-08-13 05:22:00 as the literal moment that long-running boot began. I later became more cautious. What journalctl --list-boots gives me is the first and last journal entry still available for that boot. In a system that had suffered extreme logging volume, rotation failures and storage exhaustion, “first surviving journal message” and “machine powered on at exactly this second” are not necessarily equivalent.

This detail mattered because one of my early reconstructions placed the beginning of the WARP failure at the apparent August 13 boot boundary. That hypothesis was reasonable from the evidence I had then. It was also one of several diagnoses that would later move backward in time.

The visible outage was already very late in the incident

The UptimeRobot alert had anchored the public outage at 2026-08-16 16:43:31 UTC. The preserved empty /etc/resolv.conf had a modification timestamp of 16:37:08.928 UTC, only about six minutes earlier. Initially that looked enormously significant, and it was significant—but not in the way I first thought.

The deeper journal search produced an older and much more damaging timestamp:

2026-08-14 02:27:24 UTC
rsyslog: ... No space left on device

The exact surrounding records varied because of lost journal data, but the important fact was unambiguous: ENOSPC already existed more than two days before the website became externally unavailable.

That immediately invalidated a neat but wrong chronology in which the resolver file became empty on August 16, WARP began malfunctioning, logging exploded, and the disk filled shortly afterward. The disk had already been unable to accept writes long before that resolver timestamp.

By August 15, the damage had reached one of the mechanisms whose job was specifically to stop logs from consuming the filesystem. The evidence showed normal log rotation could no longer operate, and WARP’s own log rotation was also failing. The sequence had become self-reinforcing:

large logging volume
        |
        v
free disk approaches zero
        |
        v
ENOSPC
        |
        +--> logrotate cannot run normally
        |
        +--> WARP cannot rotate its own logs
        |
        +--> services begin failing writes
        |
        v
more warnings and errors
        |
        v
still more logging

This was the point where “the disk is full” stopped being a terminal diagnosis and became an active participant in the failure. Storage exhaustion was no longer simply the result of what had gone wrong earlier. It was creating new failures of its own.

At one point the logging pressure was high enough that rsyslog reported approximately 9,092 messages lost inside a five-second rate-limiting interval. That single number was useful because it demonstrated that this was not a leisurely accumulation of ordinary service messages over several months. Something was producing error traffic on a completely different scale.

Then came secondary application failures. By August 16 around 05:07 UTC, MariaDB was also encountering storage-related write problems while trying to create temporary state. It was no longer meaningful to ask whether “WordPress” was healthy in isolation. The database, logging infrastructure, resolver state and network-control software were all sharing the same exhausted root filesystem.

The chronology now looked approximately like this:

UTC time Observed state What it established
Before Aug 14 WARP already producing extreme DNS-related logging The abnormal condition predated the visible outage
Aug 14 02:27 rsyslog reports No space left on device Root filesystem already exhausted
Aug 15 around 00:00 System log rotation and WARP rotation fail Storage containment mechanisms themselves are failing
Aug 16 05:07 MariaDB encounters disk-full write failure ENOSPC is affecting unrelated services
Aug 16 16:37:08 /etc/resolv.conf becomes a zero-byte regular file Late resolver-state failure
Aug 16 16:43:31 Cloudflare origin check reaches HTTP 522 Application plane becomes externally unavailable
shortly afterward SSH reaches TCP/22 but dies before server banner Management plane also becomes unusable

This made one thing very clear: the UptimeRobot alert marked the point at which I discovered the incident, not the point at which the incident began.

Measuring the WARP log storm

Knowing that logs filled the disk was still not enough. I wanted to know whether WARP merely happened to appear frequently in them or whether its failure rate could quantitatively explain the growth.

A compact hourly aggregation of the surviving warp-svc journal was extremely revealing. The figures for the morning of August 13 were approximately:

2026-08-13T05
    WARP messages:      96,206
    WARN:               95,105
    DNS-related:        95,181

2026-08-13T06
    WARP messages:     153,162
    WARN:              151,403
    DNS-related:       151,523

2026-08-13T07
    WARP messages:     152,730
    WARN:              151,022
    DNS-related:       151,142

2026-08-13T08
    WARP messages:     125,755
    WARN:              124,326
    DNS-related:       124,422

More than half a million WARP messages appeared in only those four hourly buckets, and almost all of them were warnings related to DNS.

The representative error was almost boring in its consistency:

WARN dns_proxy::errors:
DnsProxy Io
ResolveError {
    kind: Proto(
        ProtoError {
            kind: Io(
                Os {
                    code: 101,
                    kind: NetworkUnreachable,
                    message: "Network is unreachable"
                }
            )
        }
    )
}

Linux error 101 is ENETUNREACH: Network is unreachable.

More striking than the wording was the timing. A short excerpt showed the same error occurring over and over inside fractions of a second:

07:56:07.346  WARN ... NetworkUnreachable
07:56:07.347  WARN ... NetworkUnreachable
07:56:07.347  WARN ... NetworkUnreachable
07:56:07.348  WARN ... NetworkUnreachable
07:56:07.348  WARN ... NetworkUnreachable
07:56:07.349  WARN ... NetworkUnreachable
07:56:07.349  WARN ... NetworkUnreachable
07:56:07.350  WARN ... NetworkUnreachable
...
07:56:07.365  WARN ... NetworkUnreachable

Dozens of essentially identical failures could occur within a few tens of milliseconds. The machine was not waiting patiently for a remote resolver and occasionally recording a timeout. It was failing as quickly as the local networking stack could reject the operation.

This distinction became much clearer when I found WARP’s own DNS statistics. One interval reported:

Queries:        4978
Success:        0.0%
TimedOut:       0.0%
NoRecordsFound: 0.0%
Other Error:    100.0%
Avg Duration:   0.02ms

The 0.02ms average duration is diagnostically important. A DNS request going to an upstream server over a real network does not meaningfully time out in twenty microseconds. There is not enough time for the request to traverse the network, wait for a remote service, and fail normally.

The statistics themselves classify the failures consistently:

TimedOut:    0.0%
Other Error: 100.0%

Together with errno 101, the best interpretation is that WARP attempted to send its DNS-over-WARP traffic and immediately encountered a local routing/socket failure:

DNS request
    |
    v
WARP DNS proxy
    |
    v
DNS-over-WARP path
    |
    v
local route lookup / socket operation
    |
    X
ENETUNREACH immediately

This is much stronger evidence than a generic message saying “DNS failed.” It tells me the class of failure. The resolver was not merely slow; its transport path was unusable.

WARP was connected and DNS was still broken

Another clue initially looked contradictory. While DNS was failing almost completely, WARP’s tunnel health remained excellent.

Repeated network-health telemetry reported approximately:

MonitorTunnelStats {
    rtt_ms: 1,
    estimated_loss: 0.0
}

This continued through periods in which the DNS proxy was producing thousands of ENETUNREACH failures.

So saying “WARP went down” was too imprecise. The outer WARP transport was plainly capable of communicating. The problem was deeper inside the dependency chain.

The configuration evidence helped explain how those two observations could coexist. The recovered client state showed:

operation_mode = Warp
dns_mode       = DNS Proxy
tunnel_mode    = Exclude-only

And the earlier shell history showed the deliberate exclusion:

warp-cli tunnel ip add-range ::/0

My original intention had been conceptually simple:

IPv6 traffic
    |
    +--> native VPS IPv6

IPv4 traffic
    |
    +--> WARP

There was nothing obviously irrational about that. The VPS had good native IPv6 and lacked normal IPv4 egress. WARP could fill that gap.

But the actual architecture contained a dependency that was easy to overlook: split-tunnel routing and DNS handling were not the same thing. Excluding ::/0 meant that ordinary IPv6 IP traffic could remain native. It did not mean that DNS resolution was simply handed back to the ordinary native resolver path.

In the recovered configuration, WARP was operating with a local DNS proxy. Conceptually the machine looked more like this:

                    native IPv6 network
                           |
                           v
                    outer MASQUE tunnel
                           |
                         WARP
                           |
              +------------+------------+
              |                         |
              v                         v
       IPv4 traffic               WARP DNS proxy
                                        |
                                        v
                                  DNS-over-WARP
                                        |
                                        v
                                 DoH connection

The distinction between the outer MASQUE tunnel and the inner DNS-over-WARP path ended up being central to the whole incident.

The outer tunnel could remain healthy over IPv6. WARP could therefore report one-millisecond RTT and effectively zero loss. At the same time, an inner route required for DNS-over-WARP could become unusable and immediately return ENETUNREACH.

The failed-boot logs contained another useful implementation clue. WARP attempted to create a DNS-over-HTTPS resolver using an IPv4 endpoint, conceptually like:

resolver:
    address: 192.0.2.53:443
    protocol: HTTPS
    hostname: cloudflare-dns.example
    ip_strategy: IPv4ThenIPv6

The exact public resolver address is not important here. The important property is that it was IPv4. The host itself had no native IPv4 route, so that logical path depended on WARP’s tunnel and internal routing being correct.

This produced a rather interesting dependency:

IPv6-only host
      |
      +--> native IPv6 works
                |
                v
       WARP tunnel over IPv6
                |
             healthy
                |
       +--------+---------+
       |                  |
       v                  v
IPv4 egress        DNS-over-WARP path
                          |
                          X
                    route unusable
                          |
                          v
                    ENETUNREACH

In other words, “the WARP tunnel is healthy” and “WARP DNS is completely unusable” are not contradictory statements once they are describing different layers.

That realization also corrected another possible diagnosis. There was no strong evidence that Scaleway’s native IPv6 network had simply disappeared. If that had happened, maintaining an outer MASQUE connection with approximately 1 ms RTT and 0% measured loss would have been difficult to explain.

The health check stayed green while DNS success was effectively zero

Then I found one of the stranger pieces of evidence in the entire investigation.

At 05:23:00, WARP reported:

Queries:     4978
Success:     0.0%
Other Error: 100.0%

Only about twenty seconds later:

05:23:20
DNS proxy health status: Healthy

Two minutes later:

05:25:00
Queries:     5155
Success:     0.0%
Other Error: 100.0%

05:25:20
DNS proxy health status: Healthy

And the same pattern continued.

By around 05:57:

Queries:     5252
Success:     0.0%
Other Error: 100.0%

05:57:20
DNS proxy health status: Healthy

It would be difficult to invent a better example of the difference between component health and functional service health. The proxy process itself may well have been alive. Its socket may have been listening. Its worker thread may have passed whatever internal liveness test the message represented. In that narrow sense, perhaps “Healthy” was technically doing exactly what its implementer intended.

But another part of the same client knew that essentially every real DNS request was failing.

The operational state was closer to:

local DNS proxy process     healthy
outer MASQUE transport      healthy

DNS-over-WARP route         failed
DNS functional success      approximately 0%
actual resolver service     unusable

That is what I mean here by a false-green health state. I do not need to claim that the internal health-check code was “wrong” according to its specification. The problem is that the label did not represent what an operator reasonably needs to know: can this DNS service actually resolve names?

There was independent evidence from applications as well. DNS-dependent operations produced errors such as:

Temporary failure in name resolution

So the contradiction was not confined to two internal counters disagreeing with one another. Real callers could not resolve names, while the subsystem continued publishing a green health message.

The internal error counter made the scale almost absurd. At one point the WARP statistics showed approximately:

dns_proxy.doh_err_other
mode="dns-over-warp"
count=7,441,921

Sixteen minutes later:

count=7,482,811

That is an increase of 40,890 errors in sixteen minutes:

~42.6 errors / second
~2,556 errors / minute
~153,338 errors / hour

Those figures independently matched the roughly 150,000 DNS warning messages per hour visible in the journal. This was an important moment in the reconstruction because it connected two different evidence sources quantitatively.

The logs were not merely “full of WARP messages.” WARP’s own internal error counter was increasing at almost exactly the same rate as the external warning stream.

The mechanism was therefore very strongly demonstrated:

DNS-over-WARP request
        |
        v
ENETUNREACH
        |
        v
WARP warning
        |
        v
next request
        |
        v
ENETUNREACH
        |
        v
another warning
        |
       ...

At roughly 42 failures each second, ordinary error logging becomes a storage workload.

The server was, in a very literal sense, logging itself to death. (It was at least admirably thorough about announcing the process.)

The retry rate was itself part of the failure

Another subtle detail emerged when I compared DNS traffic before and after the transition.

Under normal conditions, the WARP statistics typically showed only a handful of queries per two-minute reporting interval:

Queries: 4
Queries: 6
Queries: 4
Queries: 4

After the failure, the numbers became:

Queries: 3832
Queries: 3999
Queries: ~5000
Queries: ~5200

The demand increased by roughly three orders of magnitude.

That meant the server was not simply performing its normal DNS workload and having every request fail. The failure itself appears to have induced retries. A caller asks for DNS, gets a near-instant failure, retries quickly, fails again, and some combination of applications, system services and possibly WARP’s own machinery repeats the process.

I cannot attribute every retry to one specific process from the surviving evidence. WordPress/PHP, package-related services, NTP, system components, WARP’s connectivity machinery and other daemons may all have contributed. The logs do not justify assigning the entire retry storm to one caller.

What they do show is a feedback structure:

normal DNS request
       |
       v
DNS-over-WARP has no usable route
       |
       v
immediate ENETUNREACH
       |
       v
caller does not wait for a long timeout
       |
       v
retry happens quickly
       |
       v
another immediate failure
       |
       v
query volume rises dramatically

Then WARP attached another feedback path to that one:

each failed query
       |
       v
WARN record
       |
       v
syslog + journal growth
       |
       v
free disk decreases
       |
       v
ENOSPC
       |
       +--> logrotate fails
       |
       +--> services produce new failures
       |
       +--> more retries
       |
       v
more logging

This is the point where the incident stopped looking like a simple sequence of unrelated faults. It was becoming a dynamical system with positive feedback.

A route failure did not merely remain a route failure. It changed the behaviour of callers. Their retries changed the behaviour of the logger. The logger changed the amount of available storage. Storage exhaustion changed the behaviour of unrelated services and of the observability mechanisms themselves. Those new failures then generated still more messages.

Locally, each component’s action was understandable. Retry after failure. Log an error. Rotate logs. Write a database temporary file. Reconfigure networking when conditions change. Globally, the combination was pathological.

The empty resolver file moved from “cause” to “late-stage symptom”

The zero-byte /etc/resolv.conf had initially seemed like the obvious starting point because it matched WARP’s terminal DNS messages so neatly.

During one of the later failed states WARP reported messages along the lines of:

Could not determine resolv.conf file owner:
File was empty

systemd-resolved is operating in a non-standard mode,
continuing with overwrite mode=Foreign

Then:

Starting Warp Connection
dns_mode=DNS Proxy

followed by:

FailedToParseDnsConfig
no nameservers found in config

That correspondence was real. An empty resolver file was unquestionably a problem for WARP’s DNS initialization. It simply was not the original problem.

The timestamp disproved that chronology.

The preserved file showed:

Size:   0
Modify: 2026-08-16 16:37:08.928 UTC

Yet the DNS-over-WARP failure was already fully established in surviving WARP records from August 13, and later evidence pushed its actual beginning back even further.

So this sequence:

resolv.conf becomes empty
        |
        v
WARP DNS breaks
        |
        v
warning storm
        |
        v
disk fills

could no longer be correct.

A chronology that fit the evidence much better was:

WARP DNS path fails
        |
        v
massive retry/warning activity
        |
        v
disk fills
        |
        v
system spends days under ENOSPC
        |
        v
later resolver/network transition
        |
        v
resolv.conf becomes empty
        |
        v
terminal network state becomes worse

This was a useful reminder of why timestamps matter so much in debugging. Two states can have an obvious functional relationship and still occur in the opposite causal order from what intuition suggests.

The empty resolver file was still important. In fact, it may have helped turn an already unhealthy server into the final externally visible outage. But by this stage I considered it a secondary failure, not the initiating fault.

What happened around 16:37 on August 16

The WARP-specific files happened to preserve unusually precise timestamps around the final transition, even though the ordinary journal had a large blind spot there.

At approximately:

16:37:02.696

the WARP state directory under /var/lib/cloudflare-warp changed.

About 25 milliseconds later:

16:37:02.721
DEBUG route-change:
Routes changed

Then at:

16:37:08.615

WARP entered a connectivity/captive-network detection sequence.

The detailed sequence was particularly interesting because different tests did not all fail together. At approximately 16:37:08.648, a DNS check reported success. Shortly afterward an HTTPS retrieval also succeeded. Native IPv6 connectivity was evidently still functional enough for those checks.

But a connectivity attempt to an IPv4 destination failed immediately:

connect to 192.0.2.80:80
Network is unreachable

That mattered because providing IPv4 egress was the whole reason WARP was installed on this IPv6-only machine in the first place. At that moment, its narrow practical purpose was already unavailable.

Then, at:

16:37:08.928

the preserved /etc/resolv.conf acquired its zero-byte modification timestamp—only around 220 milliseconds after that connectivity sequence.

Six minutes and roughly twenty-two seconds later:

16:43:31
Cloudflare origin request -> HTTP 522

The late-stage timeline was therefore very tight:

16:37:02.696
WARP state changes
        |
        | ~25 ms
        v
16:37:02.721
route-change event
        |
        | ~6 sec
        v
16:37:08.615
WARP connectivity detection
        |
        +--> DNS test succeeds
        |
        +--> IPv6 path works
        |
        +--> IPv4 path -> ENETUNREACH
        |
        v
16:37:08.928
/etc/resolv.conf becomes 0 bytes
        |
        | ~6m22s
        v
16:43:31
Cloudflare -> HTTP 522
        |
        v
SSH management also becomes unusable

That is strong temporal evidence that WARP was actively involved in the networking state surrounding the resolver transition. It is not, however, process-level proof that a particular WARP write system call truncated the file. I never captured that write operation directly.

Several alternative low-level mechanisms remain possible: WARP itself may have rewritten the file and failed partway through; another resolver/network component may have interacted with WARP; a write under ENOSPC may have produced an incomplete state; some restoration operation may have removed content before replacement failed; or another process may have touched the file during the same transition.

The timestamps justify saying that the empty file appeared during active WARP route/connectivity activity on a system already under severe storage pressure. They do not justify pretending I watched WARP execute truncate("/etc/resolv.conf", 0).

There was another complication: the ordinary journal contained essentially no usable records from the exact critical window. A query around 16:37 returned:

-- No entries --

The next surviving ordinary logging evidence appeared much later, with rsyslog still reporting No space left on device. In other words, the failure had degraded the system responsible for documenting the failure.

Even some WARP-specific files showed signs of damaged or concatenated lines, with timestamps from different moments appearing joined together. I treated those carefully. When a record looked malformed, I did not use it as the sole basis for a causal claim.

This created an interesting forensic asymmetry: the most severe part of the incident was also the least reliably recorded part of it.

Then the beginning moved backward again

For a while I thought the DNS failure had probably begun around the apparent August 13 journal boundary, because the first partial hour already contained around 95,000 WARP warnings. That was a reasonable inference from the journal.

Then I searched WARP’s own periodic DNS-statistics files rather than only the detailed per-query errors.

The earliest retained statistics showed completely normal operation on August 10:

2026-08-10T00:01:00Z
Queries: 4
Success: 100.0%
Other Error: 0.0%

2026-08-10T00:03:00Z
Queries: 4
Success: 100.0%
Other Error: 0.0%

2026-08-10T00:05:00Z
Queries: 4
Success: 100.0%
Other Error: 0.0%

And that pattern continued for hour after hour: normally four to six queries per interval, almost always 100% success, with average durations around zero to a few milliseconds.

More importantly, the same healthy state continued into August 11:

06:45:00   Queries: 8   Success: 100.0%
06:47:00   Queries: 4   Success: 100.0%
06:49:00   Queries: 4   Success: 100.0%
06:51:00   Queries: 4   Success: 100.0%
06:53:00   Queries: 6   Success: 100.0%
                         Other Error: 0.0%
                         Avg Duration: 1.83ms

Then, two minutes later:

06:55:00
Queries:        722
Success:        0.6%
TimedOut:       0.0%
Other Error:    99.4%
Avg Duration:   0.16ms

Two minutes after that:

06:57:00
Queries:        3832
Success:        0.1%
TimedOut:       0.0%
Other Error:    99.9%
Avg Duration:   0.01ms

And at 06:59:

Queries:        3999
Success:        0.2%
TimedOut:       0.0%
Other Error:    99.8%
Avg Duration:   0.01ms

This was one of the most decisive discoveries in the entire investigation.

The configuration had not been continuously malfunctioning from the day I installed it. It had not slowly drifted from 100% success to 90%, then 50%, then zero over months. The historical telemetry showed a step transition.

At 06:53 UTC on August 11, DNS was healthy.

By 06:55 UTC, it was essentially dead.

And by 06:57, the query rate had already exploded from a handful every two minutes to thousands.

The beginning of the incident had moved backward by almost two days from where I had initially placed it.

That also answered an important practical question: how could this VPS have worked for months if the architecture was fundamentally flawed?

Because the architecture did work.

Whatever its latent risks, the surviving telemetry demonstrated normal DNS operation under this exact general configuration until August 11. The failure required a state transition.

The route-change cluster around 06:54

Once the DNS statistics narrowed the transition to a roughly two-minute window, I extracted only the WARP network events surrounding it instead of dumping yet more millions of repetitive errors.

The tunnel-health records remained almost boringly stable throughout:

06:52:04   RTT 1 ms   estimated_loss 0.0
06:52:19   RTT 1 ms   estimated_loss 0.0
06:52:34   RTT 1 ms   estimated_loss 0.0
06:52:49   RTT 1 ms   estimated_loss 0.0

06:53:04   RTT 1 ms   estimated_loss 0.0
06:53:19   RTT 1 ms   estimated_loss 0.0
06:53:34   RTT 1 ms   estimated_loss 0.0
06:53:49   RTT 1 ms   estimated_loss 0.0

06:54:04   RTT 1 ms   estimated_loss 0.0
06:54:19   RTT 1 ms   estimated_loss 0.0
06:54:34   RTT 1 ms   estimated_loss 0.0
06:54:49   RTT 1 ms   estimated_loss 0.0

06:55:04   RTT 1 ms   estimated_loss 0.0
...
06:57:49   RTT 1 ms   estimated_loss 0.0

The outer transport did not show a corresponding collapse.

At the same time, WARP was observing repeated route changes:

06:52:38.821   Routes changed
06:52:47.781   Routes changed
06:53:23.877   Routes changed
06:53:31.814   Routes changed

06:54:06.885   Routes changed
06:54:15.845   Routes changed
06:54:15.847   Routes changed
06:54:51.942   Routes changed
06:54:59.877   Routes changed
06:54:59.879   Routes changed

06:56:28.197   Routes changed
06:56:35.877   Routes changed
06:57:13.253   Routes changed
06:57:19.910   Routes changed
06:57:58.309   Routes changed

And against those events, the DNS statistics were:

06:53:00
Success: 100.0%

06:55:00
Success: 0.6%
Other Error: 99.4%

06:57:00
Success: 0.1%
Other Error: 99.9%

The temporal relationship is extremely suggestive. Several route-change notifications cluster directly across the moment when DNS moves from perfect success to almost complete failure.

But this is exactly where I have to stop one step short of certainty.

Route-change notifications also occurred before the failure and continued afterward. The logs say “Routes changed”; they do not give me a complete semantically decoded diff of WARP’s internal routing state at every one of those milliseconds. I cannot point to, for example, the 06:54:15.845 event and claim, “This exact event removed the DNS route.”

What I can say with much greater confidence is:

06:53
DNS-over-WARP functional

        |
        | repeated route/state events
        v

06:55
DNS-over-WARP almost completely non-functional

outer MASQUE tunnel remains healthy

That is evidence of a sudden state transition, but the implementation-level transition responsible for it remains hidden behind WARP’s internal routing logic.

The possible classes of explanation had narrowed considerably:

  • an internal WARP route/state transition;
  • an interaction between the WARP client and this IPv6-only topology;
  • a split-tunnel or virtual-interface state problem;
  • a firewall/routing interaction inside the client;
  • an operating-system/WARP DNS-routing interaction;
  • or a transient external network event that WARP handled badly and failed to recover from.

A simple “Internet outage” no longer fit the evidence. Neither did “the WARP package was updated and immediately broke,” because package history showed that the installed WARP version was still 2026.3.846.0, installed months earlier, with no corresponding package upgrade at the August 11 transition.

The specific later DNS regressions documented for other WARP release lines were therefore interesting background, but they were not evidence that this VPS had hit that exact published bug. I deliberately kept that out of the proven causal chain.

What the causal structure looked like by this point

By now I could separate several layers that had originally been mixed together under the phrase “the VPS failed.”

The beginning was no longer the website outage. It was no longer the full filesystem. It was no longer the empty resolver file. It was no longer even the apparent August 13 boot.

The earliest strongly demonstrated transition I could locate was this:

Before 2026-08-11 06:54 UTC

WARP DNS statistics:
    success ~100%
    normal query volume

outer MASQUE:
    healthy

            |
            | abrupt state transition
            v

Around 2026-08-11 06:54 UTC

DNS-over-WARP:
    route becomes unusable

            |
            v

Linux:
    errno 101
    ENETUNREACH

            |
            v

DNS success:
    ~0%

query volume:
    rises from ~4-6 / 2 min
    to thousands / 2 min

            |
            v

WARP:
    emits repeated WARN per failure

            |
            v

syslog + journal:
    grow at extreme rate

            |
            v

2026-08-14
root filesystem:
    ENOSPC

            |
            +--> logrotate fails
            +--> WARP rotation fails
            +--> service writes fail
            +--> observability degrades

            |
            v

2026-08-16 16:37
resolver/network state changes
/etc/resolv.conf becomes empty

            |
            v

2026-08-16 16:43
Cloudflare origin:
    HTTP 522

            |
            v

SSH:
    TCP reachable
    protocol dies before server banner

One more fact made the upper part of that chain particularly strong: WARP simultaneously reported its DNS proxy as Healthy while its own functional statistics showed essentially zero successful DNS resolution. The mechanism that might normally have recognized a degraded state therefore did not appear to trigger any effective circuit breaking, recovery mode or suppression of the millions of repeated errors.

By this stage, I was comfortable saying that a WARP DNS-routing failure initiated the observable cascade and that WARP’s repeated warning behaviour amplified it into filesystem exhaustion. I was also comfortable saying that ENOSPC later damaged the system broadly enough to create secondary DNS, logging, database and network-management failures.

What I still could not say was what code path, route calculation, virtual-interface transition or firewall state inside WARP produced that first ENETUNREACH state around 06:54 on August 11.

The forensic reconstruction had reached the edge of what the host itself could tell me.

I could see the system immediately before the transition. I could see it immediately after. I could see route-change events happening across the boundary. I could see that the MASQUE transport stayed healthy. I could see DNS collapse from 100% success to effectively zero within two minutes. What I could not see was the one internal implementation decision that connected those states.

That distinction would become central to how I ultimately described the root cause.

Drawing the root-cause boundary without inventing the missing piece

At that point I had enough evidence to describe the incident rigorously, but only if I resisted the temptation to force the final unknown into a neat answer.

The simplest question was: was this just “poor WARP design”?

I do not think that is a sufficiently precise conclusion. The configuration had worked normally for months, and the historical telemetry demonstrated 100% DNS success immediately before the August 11 transition. I therefore cannot argue that the basic topology was inherently non-functional from the beginning. Nor do I have enough evidence to identify a particular Cloudflare source-code defect as the event that suddenly made the DNS-over-WARP path return ENETUNREACH.

What the evidence does support is a layered root-cause model.

The initiating fault

Between approximately 06:53 and 06:55 UTC on August 11, WARP’s DNS-over-WARP path abruptly moved from normal operation into a state in which essentially every DNS request encountered a local routing failure.

The transition is directly visible:

06:53:00
Queries:        6
Success:        100.0%
Other Error:    0.0%
Avg Duration:   1.83ms

06:55:00
Queries:        722
Success:        0.6%
Other Error:    99.4%
Avg Duration:   0.16ms

06:57:00
Queries:        3832
Success:        0.1%
Other Error:    99.9%
Avg Duration:   0.01ms

06:59:00
Queries:        3999
Success:        0.2%
Other Error:    99.8%
Avg Duration:   0.01ms

Later detailed records identify the error class:

code: 101
kind: NetworkUnreachable
message: "Network is unreachable"

Meanwhile the WARP network-health monitor continued reporting roughly:

RTT:             1 ms
estimated_loss:  0.0

So the initiating failure was not a complete disappearance of WARP’s outer transport. It was much narrower and more interesting: an inner DNS-over-WARP routing path became unusable while the outer MASQUE tunnel remained healthy.

That is the lowest causal layer I can establish from the host evidence.

The next question—why did that inner path become unusable?—remains unanswered. The route-change cluster around 06:54 is suspicious, and the IPv6-only topology, split-tunnel state, WARP’s virtual networking, firewall manipulation and Linux resolver integration are all relevant possibilities. But none of the surviving records exposes the exact internal route calculation or state-machine transition responsible for the first failure.

So my final wording would be:

Initiating fault:
    WARP DNS-over-WARP routing abruptly became unusable.

Exact implementation trigger:
    unknown from retained host evidence.

That distinction is important. “Unknown” here does not mean the entire root cause is unknown. It means that the causal reconstruction has reached an implementation boundary for which the necessary internal instrumentation is not available to me.

The amplification mechanism

The initiating networking fault alone should not have destroyed the VPS.

A DNS route can fail. A tunnel can reconnect. A service can return an error. Those are ordinary operational events. What made this incident catastrophic was what happened after that fault persisted.

Query volume rose from roughly four to six requests every two minutes into several thousand. Nearly every failed request generated a WARP warning. The internal DNS error counter and the externally visible logging rate matched remarkably closely:

40,890 additional DoH errors / 16 minutes

≈ 42.6 errors / second
≈ 2,556 errors / minute
≈ 153,338 errors / hour

At the same time, WARP continued saying:

DNS proxy health status: Healthy

while its own statistics were effectively saying:

DNS success:     ~0%
DNS errors:      ~100%

This is where I think criticism of the failure-handling design becomes justified even though the initiating implementation defect remains unknown.

First, the health representation was false-green at the service level. Perhaps the specific health check only meant that a local proxy task or socket remained alive. If so, the message may have been internally consistent with its narrow definition. Operationally, however, another part of the same software knew that virtually no DNS request was succeeding.

A more useful system-level state would have distinguished those layers:

Local DNS proxy process:  HEALTHY
Outer MASQUE transport:   HEALTHY
DNS-over-WARP transport:  FAILED
DNS success rate:         ~0%
Overall DNS service:      UNHEALTHY
WARP state:               DEGRADED

Instead, Healthy was doing an impressive amount of semantic work.

Second, the repeated error handling had effectively unbounded amplification. A persistent identical networking error became a high-rate logging workload capable of consuming gigabytes of storage. Rate limiting, duplicate suppression, exponential backoff, aggregation or a circuit breaker could all have changed the trajectory.

For example, a daemon could conceivably transform:

WARN DNS path unreachable
WARN DNS path unreachable
WARN DNS path unreachable
WARN DNS path unreachable
WARN DNS path unreachable
...
hundreds of thousands more

into something like:

WARN DNS-over-WARP path unreachable
WARN suppressed 82,416 equivalent failures during the last 60 seconds

That would not have fixed the route. It might, however, have prevented a network fault from becoming a storage catastrophe.

Third, the WARP client controlled more of the machine than my actual requirement demanded. I wanted a narrow capability:

native IPv6 already available

need:
    occasional IPv4 egress

The installed solution effectively introduced dependencies on:

IPv4 egress
+ local DNS proxy
+ DNS configuration
+ routing-table manipulation
+ virtual networking
+ firewall state
+ daemon logging

None of those features is inherently unreasonable for a general-purpose secure network client. The architectural lesson is about scope: a mechanism introduced to solve one narrow reachability problem had acquired authority over several critical host subsystems.

The resource-exhaustion cause

The next stage is considerably stronger evidentially.

WARP’s DNS-warning storm drove system logging into a completely abnormal regime. By recovery time:

/var/log/syslog        ≈ 2.38 GB
systemd journal        ≈ 0.80 GB
/var/log total         ≈ 3.5 GB

root filesystem        ≈ 8.9 GB usable

On a root filesystem of that size, this was fatal.

The first surviving ENOSPC evidence appeared on August 14. Then log rotation itself failed. WARP’s own rotation failed. MariaDB later failed writes. Observability deteriorated. The system remained in that condition for days.

So the cause of the resource catastrophe is much less ambiguous:

persistent DNS routing failure
        |
        v
retry/query explosion
        |
        v
per-query WARN amplification
        |
        v
multi-gigabyte logging
        |
        v
root filesystem exhausted
        |
        v
ENOSPC

At that point, ENOSPC became a new causal force rather than merely an outcome.

The terminal collapse

The final stage remains partly inferential.

The system spent more than two days operating at or near absolute storage exhaustion. On August 16 at 16:37, WARP state and route activity occurred; IPv4 connectivity was observed failing; then /etc/resolv.conf became a zero-byte regular file. Approximately six minutes later Cloudflare could no longer reach the origin and returned HTTP 522. SSH subsequently became unusable before authentication even though sshd itself started and listened normally.

This strongly supports a terminal chain roughly like:

ENOSPC
  +
already-broken WARP DNS/routing state
        |
        v
late network/resolver transition
        |
        v
/etc/resolv.conf becomes empty
        |
        v
WARP cannot reconstruct normal DNS state
        |
        v
routing / firewall / resolver instability
        |
        +----------------------+
        |                      |
        v                      v
HTTP origin failure       SSH management loss
Cloudflare 522            pre-banner close

But two exact arrows in that lower section remain unobserved.

I cannot prove which process performed the write that left /etc/resolv.conf empty. The timestamps strongly associate the event with active WARP/network state changes, but association at millisecond resolution is still not a captured system call.

Likewise, I cannot prove the precise layer that killed inbound SSH. The evidence established a TCP connection to port 22 and demonstrated that sshd was listening, yet the remote SSH banner never arrived and normal authentication logging did not appear. WARP’s routing/firewall activity makes it a plausible participant, especially in the terminal degraded state, but I did not isolate a specific firewall rule, packet drop or userspace failure responsible for the pre-banner close.

Those uncertainties belong in the postmortem rather than being edited away.

Why rebooting could not rescue it

One thing that had initially seemed strange was the persistence of the failure through reboots. Usually, rebooting a malfunctioning network daemon is at least worth trying. Here it was largely ineffective because the important state was not transient RAM state.

A reboot did not remove:

the full root filesystem
the multi-gigabyte logs
WARP's installed configuration
WARP's autostart
the damaged resolver state
persistent networking configuration

So rebooting effectively performed:

load same filesystem
        |
        v
start same services
        |
        v
start WARP again
        |
        v
restore same persistent configuration
        |
        v
encounter same broken conditions

A reboot is a restart of execution. It is not necessarily a rollback of state.

That distinction explains why the server could boot cleanly enough to show normal filesystem checks, start Nginx, PHP, MariaDB, SSH and WARP, and still be operationally unreachable. Each service starting successfully was only a statement about that service at one layer of the stack.

The rescue environment succeeded because it changed the control plane entirely. Instead of asking the failed operating system to repair itself while its own network client, resolver and logging system were active, I booted a separate operating system and mounted the original root filesystem from outside.

That was not merely convenient. It broke the dependency cycle.

FAILED NORMAL ENVIRONMENT

root filesystem full
DNS damaged
WARP active
network state unstable
SSH inaccessible
        X
        |
        | cannot reliably repair itself
        |
        v

INDEPENDENT RESCUE ENVIRONMENT

separate OS
separate network stack
WARP not running
original filesystem mounted externally
        |
        v
persistent state can be repaired offline

This is one of the strongest design lessons of the incident: a recovery mechanism is most valuable when it does not depend on the subsystem that has failed.

Recovery was successful, but it was not a controlled experiment

The machine recovered after three substantial changes had been made in rescue mode:

1. approximately 2.7 GB of disk space freed
2. /etc/resolv.conf restored to normal systemd-resolved configuration
3. warp-svc disabled and masked

That combined intervention demonstrated operational sufficiency: after those changes, normal boot, SSH and the website returned.

It did not tell me which single change, independently, was necessary and sufficient for restoring SSH or HTTP.

A perfectly controlled causal experiment would have changed one variable at a time:

free disk only
        |
        v
boot and test

then perhaps restore DNS only
        |
        v
boot and test

then disable WARP
        |
        v
boot and test

But this was a production VPS whose management path was already lost. The correct objective was recovery, not experimental purity. Once I had mounted the system externally and found both a full filesystem and a broken resolver configuration while WARP was deeply implicated in the network failure, deliberately leaving one known fault in place merely to obtain cleaner causal isolation would have been an unnecessary operational risk.

This is another useful distinction between incident response and laboratory debugging. Sometimes the safest repair necessarily collapses several experimental variables at once.

Validating the recovered machine

Recovery was not complete merely because I could finally SSH into the server again. I wanted a structured post-recovery snapshot showing that the relevant layers were actually sane.

I collected time, storage, memory, service, networking, DNS and SSH state together:

{
    echo '=== TIME ==='
    date -u
    timedatectl
    uptime

    echo
    echo '=== STORAGE ==='
    df -h /
    df -i /
    du -sh /var/log
    ls -lh /var/log/syslog*
    journalctl --disk-usage

    echo
    echo '=== MEMORY ==='
    free -h
    swapon --show

    echo
    echo '=== SERVICES ==='
    systemctl is-enabled ssh.service
    systemctl is-active ssh.service
    systemctl is-enabled warp-svc.service
    systemctl is-active warp-svc.service
    systemctl is-enabled systemd-resolved.service
    systemctl is-active systemd-resolved.service

    echo
    echo '=== NETWORK ==='
    ip -br address
    ip -4 route
    ip -6 route

    echo
    echo '=== DNS ==='
    ls -l /etc/resolv.conf
    cat /etc/resolv.conf
    resolvectl status

    echo
    echo '=== SSH ==='
    ss -lntp | grep ':22' || true
    sshd -t
    echo "sshd-test=$?"
} | tee /root/incident-YYYY-MM-DD/current-state.txt

The recovered storage state was:

Filesystem      Size  Used  Avail  Use%
/dev/vda1       8.9G  6.2G   2.7G   70%

Inodes:
IUse% 13%

/var/log:
865M

/var/log/syslog:
124K

persistent + active journal:
800.4M

The inode count was still normal, confirming again that the incident had been block-storage exhaustion rather than inode exhaustion.

Memory also looked ordinary for this small machine:

Mem total:      951 MiB
used:           ~327 MiB
available:      ~312 MiB

Swap:
1.0 GiB configured

There was no indication that an unrecovered memory crisis was lurking underneath the storage incident.

The service state was exactly what I wanted:

ssh.service:
    enabled
    active

warp-svc.service:
    masked
    inactive

systemd-resolved.service:
    enabled
    active

The resolver had returned to the standard stub arrangement:

/etc/resolv.conf
    -> ../run/systemd/resolve/stub-resolv.conf

nameserver 127.0.0.53
options edns0 trust-ad

And resolvectl showed native IPv6 DNS servers on the real network interface, represented here with documentation addresses:

Link 2
Current Scopes: DNS
DefaultRoute: yes

Current DNS Server:
    2001:db8::53

DNS Servers:
    2001:db8::53
    2001:db8::54

SSH validation was also explicit:

LISTEN 0 128 0.0.0.0:22  0.0.0.0:*
LISTEN 0 128 [::]:22     [::]:*

sshd-test=0

The IPv4 wildcard listener does not imply that the VPS suddenly gained native IPv4 routing; it simply shows how sshd bound its sockets. The machine’s externally useful network remained its native IPv6 path.

Most importantly, actual remote SSH now worked and the WordPress site was reachable through Cloudflare again. Syntax validation, local socket state, resolver state and external functional behaviour all agreed.

That combination is much stronger than any single “service active” result.

I left WARP masked

Once the machine was working, there was an obvious temptation to re-enable WARP “just to see whether the problem comes back.” I deliberately did not do that.

At that point, reproducing a production outage would have produced little new evidence relative to the risk.

More importantly, I reconsidered why WARP was on this server at all.

The public WordPress site sits behind Cloudflare’s reverse proxy. That inbound path is conceptually separate from server-side WARP:

WEB VISITOR
     |
     v
Cloudflare edge
     |
     v
IPv6 origin VPS

An IPv4 visitor does not require the origin VPS itself to establish an outbound WARP tunnel merely to reach a Cloudflare-proxied website. Cloudflare is already the public-facing intermediary.

WARP had been useful for a different problem: outbound IPv4 connectivity from an otherwise IPv6-only host.

Those two functions should not be confused:

Cloudflare reverse proxy:
    inbound website reachability

Cloudflare WARP client:
    host-side outbound networking
    + DNS/routing/firewall integration

If I later discover a genuine server workload that requires IPv4 egress, I would prefer to solve that requirement as narrowly as possible rather than automatically restoring the same broad dependency graph. Depending on provider capabilities, that could mean a dedicated egress mechanism, a proxy, NAT64 or another constrained solution. The exact replacement is a separate engineering decision.

For the recovered production system, “WARP remains masked” was not unfinished repair. It was a deliberate reduction of failure surface.

Preserving the evidence before improving the server

There were hundreds of pending package updates on the VPS after recovery. Ordinarily that would immediately invite maintenance. During a forensic investigation, however, an upgrade is also evidence destruction.

A package upgrade could replace binaries, alter service units, rotate logs, modify configuration, restart networking and change precisely the software version involved in the incident. So before doing routine maintenance, I preserved the relevant artifacts.

I created an incident directory and copied the surviving evidence:

INC=/root/incident-YYYY-MM-DD
mkdir -p "$INC/preserved"

cp -a /var/log/cloudflare-warp \
      "$INC/preserved/"

cp -a /var/log/apt/history.log* \
      "$INC/preserved/" 2>/dev/null || true

cp -a /var/log/dpkg.log* \
      "$INC/preserved/" 2>/dev/null || true

cp -a /etc/resolv.conf.rescue-backup \
      "$INC/preserved/" 2>/dev/null || true

journalctl --list-boots \
  > "$INC/preserved/journal-boots.txt"

systemctl cat warp-svc.service \
  > "$INC/preserved/warp-svc.service.txt"

dpkg-query -W cloudflare-warp \
  > "$INC/preserved/warp-version.txt"

Then I created a compressed archive while retaining filesystem metadata:

tar --xattrs --acls \
  -C /root \
  -czf /root/incident-evidence.tar.gz \
  incident-YYYY-MM-DD

sha256sum /root/incident-evidence.tar.gz \
  | tee /root/incident-evidence.sha256

I will not publish the real checksum or raw diagnostic bundle here. The archive contains system-specific evidence that is useful for investigation but unnecessary for a public article.

The SHA-256 has a simple purpose: if I later hand the archive to a vendor or inspect it after other maintenance has occurred, I can verify that the preserved evidence bundle is still exactly the one created at the end of the investigation.

That is a small but useful step from ordinary debugging toward proper incident forensics.

Collecting WARP diagnostics without reintroducing the failure

I also ran Cloudflare’s WARP diagnostic collector while leaving the service masked:

cd /root/incident-YYYY-MM-DD
warp-diag

As expected, the collector complained:

warp_diag: Gathering data from WARP service...
warp_diag: Gathering system info and log files...
warp_diag: Failed to communicate with WARP service over IPC:
No such file or directory (os error 2)

warp_diag: Some information will be missing in final output...
warp_diag: Debugging information stored in:
./warp-debugging-info-YYYYMMDD-HHMMSS.zip

That was normal under the circumstances. warp-svc was intentionally masked and inactive, so the diagnostic tool could not query the live daemon over IPC. The archive still captured useful static and historical information.

I specifically chose not to restart WARP merely so the diagnostic collector could obtain a prettier report. The evidence already showed that WARP had participated in a severe production incident. Re-enabling the suspected subsystem in order to improve the quality of its own bug report would have been an oddly faithful reenactment of the problem.

What I would report to Cloudflare

By the end of the investigation, the vendor report could be much more precise than “WARP broke my VPS.”

A suitable subject was:

Linux WARP DNS reports Healthy while DNS-over-WARP queries
fail with ENETUNREACH, causing log storm and disk exhaustion

The important facts for such a report are:

Environment:
    Ubuntu 22.04
    IPv6-only VPS
    cloudflare-warp 2026.3.846.0
    native IPv6
    ::/0 excluded from WARP
    WARP used primarily for IPv4 egress

Historical behaviour:
    configuration worked normally for months

Transition:
    2026-08-11 06:53 UTC
        DNS success 100%

    2026-08-11 06:55 UTC
        DNS success 0.6%
        Other Error 99.4%

    2026-08-11 06:57 UTC
        DNS success 0.1%
        Other Error 99.9%

At the same time:
    MASQUE RTT ≈ 1 ms
    estimated loss ≈ 0

Failure class:
    errno 101
    ENETUNREACH
    Network is unreachable
    failures effectively instantaneous

Observability:
    "DNS proxy health status: Healthy"
    while functional DNS success ≈ 0%

Amplification:
    ~100,000-150,000 DNS warnings/hour
    millions of dns-over-warp errors

Consequence:
    multi-gigabyte system logs
    root filesystem reaches 100%
    rsyslog ENOSPC
    logrotate failure
    WARP rotation failure
    MariaDB write failures
    later resolver/network collapse
    Cloudflare HTTP 522
    SSH management unavailable

The questions I would want Cloudflare engineering to answer are similarly narrow:

  1. What internal condition can make DNS-over-WARP return local ENETUNREACH while the outer MASQUE tunnel remains healthy?
  2. What exactly does DNS proxy health status: Healthy measure, and should end-to-end functional DNS failure affect that health state?
  3. Should repeated identical DNS errors be aggregated or rate-limited so that a persistent network failure cannot exhaust the host filesystem through logging?
  4. Does an IPv6-only host using an exclude-only configuration with ::/0 expose any known route, resolver or DNS-over-WARP edge case?

Those questions do not presume that Cloudflare is definitely responsible for the original state transition. They identify the points where vendor implementation knowledge is required.

That is also where I think my own root-cause investigation should stop. Reproducing the state on the production VPS with deeper tracing might answer more, but it would create a poor risk-to-information trade. Cloudflare can inspect implementation details I cannot see; I should not manufacture certainty by experimenting destructively with a recovered server.

What the incident changed in how I think about monitoring

The original monitoring setup told me when the website finally became unreachable.

That was useful, but dramatically late.

The pathological transition occurred around August 11. The public outage did not happen until August 16. For several days the machine was in a state that was seriously abnormal yet externally functional enough to escape notice.

A better monitoring model would therefore look for deterioration rather than only death.

At minimum, on a small VPS I now want alerts for:

  • root filesystem usage crossing warning and critical thresholds;
  • unexpected growth rate in /var/log, not merely its absolute size;
  • inode exhaustion separately from block exhaustion;
  • persistent journal size;
  • repeated ENOSPC events;
  • failed logrotate runs;
  • DNS functional success rather than only resolver-process liveness;
  • loss of an administrative/control-plane check independently of HTTP availability.

The rate of change matters especially here.

A filesystem at 70% usage is not necessarily alarming. A filesystem moving from 70% to 80% to 90% at several hundred megabytes per hour is a different phenomenon entirely.

Similarly:

DNS success = 99.9%

is a state measurement, while:

100% -> 0.6% -> 0.1% within four minutes

is a trajectory.

The latter tells me that the system has moved into another operating regime.

I would also treat the management plane as something worth monitoring independently. The most unpleasant part of this incident was not that WordPress stopped serving pages; it was that the ordinary administrative path disappeared at almost the same time.

A public service and its repair mechanism should ideally not fail together.

Logging needs a resource budget

The incident also changed how I think about logs on very small machines.

Logging is usually discussed as an observability problem: how much information do I need to understand failures?

But logging is also resource consumption.

event
  |
  v
format message
  |
  v
write message
  |
  v
filesystem blocks
  |
  v
I/O
  |
  v
rotation / compression / retention

None of those resources is infinite.

On a server with roughly 9 GB of root storage, allowing one daemon’s repeated warnings to accumulate into multiple gigabytes means the logging policy has become part of the system’s availability architecture.

I would now put explicit limits around both systemd-journald and traditional syslog retention. The exact numbers should depend on the machine and workload, but the principle is simple: observability must not be allowed to consume the resources required for basic operation.

More importantly, log rotation needs headroom. A configuration saying “logs rotate daily” is not sufficient protection if the disk can reach absolute ENOSPC before the next successful rotation.

The incident demonstrated this brutally:

logs fill disk
     |
     v
logrotate needs system resources to run
     |
     X
filesystem already at ENOSPC
     |
     v
rotation mechanism unavailable

The safety mechanism failed because the condition it was meant to control had already removed its ability to act.

So capacity planning should leave enough reserve not only for normal workload but for the operation of recovery mechanisms themselves.

Graceful degradation would have changed everything

There are several places where the system could have degraded instead of cascading.

If functional DNS success had remained near zero for a sustained interval, WARP could have surfaced an overall degraded state.

If identical failures had been rate-limited, log growth could have remained bounded.

If callers had backed off more aggressively after immediate ENETUNREACH, the query storm could have been smaller.

If the filesystem had retained a protected reserve, logging and resolver state updates might have remained possible.

If WARP’s failure had automatically fallen back to native DNS/native IPv6 rather than maintaining a broken DNS dependency, the machine might have lost only outbound IPv4.

If SSH management had been insulated from optional network manipulation, the incident would have remained much easier to repair.

None of these requires a magical perfectly reliable component. They require the system to fail in narrower compartments.

The desired architecture is closer to:

optional IPv4 mechanism fails
        |
        v
IPv4 egress unavailable

BUT

native IPv6       remains
DNS               remains
SSH               remains
logging           bounded
disk reserve      protected
operator alerted

What actually happened was:

optional IPv4/DNS mechanism fails
        |
        v
DNS error storm
        |
        v
storage exhaustion
        |
        v
logging failure
database impairment
resolver degradation
network degradation
HTTP outage
SSH loss

The blast radius expanded far beyond the original capability that failed.

That is the engineering smell I would pay most attention to in future designs.

Health checks must measure the service people actually depend on

The phrase DNS proxy health status: Healthy may be the line from this incident that stays with me longest.

It illustrates a common systems mistake: measuring whether a component is alive rather than whether its purpose is being fulfilled.

These are different questions:

Is the DNS proxy process running?
Is its socket open?
Is the WARP tunnel established?
Can a DNS query actually be resolved?
Can an application use the result?
Is the system as a whole still safe?

A lower-layer green result cannot automatically answer the questions above it.

The same principle applies far beyond WARP:

process running
    != service working

port listening
    != protocol usable

HTTP 200
    != application correct

database accepting TCP
    != queries succeeding

disk mounted
    != sufficient writable capacity

tunnel connected
    != all traffic paths functional

In this incident, I had several components that were individually “up” while the machine was progressively becoming unusable.

That is why system health needs cross-layer evidence.

Locally reasonable automation can create globally unreasonable behaviour

Perhaps the broadest engineering lesson is that no individual mechanism in the cascade needed to be absurd.

DNS failed, so callers retried.

A daemon encountered errors, so it logged them.

Linux tried to preserve those logs.

Logrotate attempted to manage them.

WARP reacted to route changes.

Services kept trying to perform their normal work.

Each mechanism can be defended locally.

Yet together:

reasonable local rule
    +
reasonable local rule
    +
reasonable local rule
    +
finite resources
    +
one persistent abnormal state
        =
globally pathological behaviour

This is why I would not describe the incident simply as “WARP crashed.” WARP did not even crash in the ordinary sense. Parts of it remained alive, reported health, reacted to network state and kept doing work.

The more interesting failure was that the automated system entered a state in which normal responses to failure amplified the failure.

That is a much more general problem than VPN software.

Why the independent rescue plane mattered so much

If I had to choose one architectural feature that prevented this incident from becoming genuinely disastrous, it would not be Nginx, WordPress, systemd or WARP.

It would be the provider’s independent rescue environment.

The normal control path had disappeared:

Internet
   |
   v
normal VPS network stack
   |
   X
SSH unavailable

The rescue mechanism did not travel through that path:

provider control plane
        |
        v
rescue operating system
        |
        v
mount original virtual disk
        |
        v
repair persistent state

That is the kind of redundancy I trust most: not a second copy of the same mechanism, but a control path with different dependencies.

If two recovery mechanisms depend on the same DNS, firewall, filesystem and daemon stack, they may only provide the appearance of redundancy.

Out-of-band access deserves to be considered part of production architecture, especially on machines where a network-control service can manipulate routing and firewall state.

The epistemic discipline mattered as much as the commands

Looking back, the most satisfying part of the investigation was not any single shell command. It was watching several plausible explanations fail.

The first hypothesis was basically:

website down
        |
        v
small VPS
        |
        v
probably WordPress backups filled disk

Rescue mode disproved the storage source.

Then:

empty resolv.conf
        |
        v
WARP DNS failure
        |
        v
logs fill disk

was disproved by older ENOSPC and WARP evidence.

Then I placed the beginning around the surviving August 13 journal boundary.

Historical WARP statistics moved it to August 11.

Then “WARP tunnel failure” seemed plausible.

MASQUE health disproved that simplification.

The model kept becoming narrower because the evidence kept removing possibilities.

That process can be summarized as:

observation
    |
    v
hypothesis
    |
    v
search for discriminating evidence
    |
    v
hypothesis survives?
    |
   / \
 no   yes
 |     |
 v     v
revise  increase confidence
    \   /
     v v
search again

That is a very different mentality from finding the first plausible explanation and decorating it afterward with supporting logs.

It also forced me to keep several categories separate:

OBSERVED
    TCP/22 reachable
    sshd listening
    no SSH banner
    DNS success collapses
    ENETUNREACH
    disk full
    resolv.conf zero bytes

DEMONSTRATED CAUSAL RELATION
    WARP DNS failures generate warning storm
    warning storm consumes substantial disk
    filesystem reaches ENOSPC
    ENOSPC disrupts log rotation and services

STRONGLY SUPPORTED INFERENCE
    late WARP/DNS/storage degradation contributes
    to terminal HTTP + SSH failure

UNRESOLVED
    exact WARP internal transition at ~06:54
    exact writer that left resolv.conf empty
    exact packet/process layer that ended SSH

I think a technical postmortem becomes more credible, not less, when the last category is allowed to exist.

A note on the larger ideas this incident suggests

There are several directions I want to explore separately because this failure turned out to be more conceptually interesting than I expected.

One is the resemblance between reliable computing and biological homeostasis. A system can remain outwardly functional while its reserve is being consumed, then cross into decompensation when compensatory mechanisms can no longer maintain stability—or when the compensatory response itself begins causing damage. The progression from a local DNS fault to retry amplification, resource exhaustion and multi-subsystem failure makes that analogy unusually tempting.

Another is mathematical and cybernetic. The VPS can be viewed as moving through a state space, with feedback loops, finite resource constraints, stable regions, unstable regions and thresholds beyond which the dynamics change. The step from six healthy queries to hundreds and then thousands of failures is almost begging to be analysed that way.

A third is methodological: forensic debugging as causal reconstruction. The process was surprisingly close to a digital autopsy—preserve evidence, distinguish observations from interpretations, establish chronology, reject hypotheses that violate timestamps, quantify mechanisms, and stop exactly where the evidence stops.

And behind all of those sits a more philosophical question: at the physical level, the processor, memory cells and network hardware may all continue obeying their rules perfectly while the higher-level system becomes catastrophically “wrong.” Where, exactly, does failure exist in such a hierarchy of abstractions? That deserves its own essay rather than being squeezed into a VPS postmortem.

For this article, it is enough to notice that one ordinary infrastructure incident opened all four questions.

What I would change before trusting a similar VPS again

Concretely, I would make several changes before considering a server of this size well protected.

I would cap persistent journal consumption and ensure traditional syslog retention cannot occupy an unbounded fraction of root storage. I would alert on both absolute disk usage and its rate of growth. I would keep enough free-space reserve that rotation, package management, databases and emergency administrative operations can still write when something begins going wrong.

I would monitor real DNS resolution periodically rather than assuming that systemd-resolved or a DNS proxy being active means resolution works.

I would monitor a management-plane signal independently of the website—at minimum whether the host remains reachable in a way that predicts whether I can still repair it.

I would be cautious about allowing an optional connectivity client to control DNS, firewall and routing when I only need a narrow egress capability.

I would preserve access to an out-of-band rescue environment and make sure I know how to use it before the next incident, not during it.

I would also treat unusual repeated logs as an availability signal. A daemon generating 150,000 near-identical warnings per hour is not merely being verbose; on a constrained machine, it is consuming a finite safety reserve.

And after any severe incident, I would preserve the evidence before upgrading, reinstalling or “cleaning everything up.” A tidy system can be much harder to understand than a messy but intact crime scene.

The final causal model

After all the recovery work and all the revisions, this is the model I am willing to stand behind:

NORMAL OPERATION
WARP configuration works for months
DNS success ≈ 100%
        |
        v

INITIATING TRANSITION
2026-08-11 ~06:54 UTC
DNS-over-WARP loses usable route
        |
        v
Linux ENETUNREACH
        |
        | outer MASQUE remains healthy
        v

FUNCTIONAL DNS FAILURE
success falls to ≈0%
        |
        v

RETRY / QUERY AMPLIFICATION
few queries -> thousands per 2 minutes
        |
        v

LOG AMPLIFICATION
near-per-query WARP WARN messages
~100k-150k warnings/hour
millions of errors
        |
        v

RESOURCE EXHAUSTION
multi-GB syslog/journal
small ~9 GB root filesystem fills
        |
        v
ENOSPC
        |
        +------------------+------------------+
        |                  |                  |
        v                  v                  v
logrotate fails      WARP rotation fails   service writes fail
                                           including MariaDB
        \                  |                  /
         \                 |                 /
          +----------------+----------------+
                           |
                           v

PROGRESSIVE SYSTEM DEGRADATION
logging impaired
observability impaired
resolver/network state increasingly fragile
        |
        v

LATE TRANSITION
2026-08-16 16:37 UTC
WARP state/route activity
IPv4 path unusable
/etc/resolv.conf becomes 0 bytes
        |
        v

TERMINAL COLLAPSE
2026-08-16 16:43 UTC
Cloudflare HTTP 522
+
SSH management unavailable
        |
        v

OUT-OF-BAND RECOVERY
provider rescue environment
        |
        +--> mount original root filesystem
        +--> free ~2.7 GB
        +--> restore resolv.conf
        +--> mask WARP
        |
        v

NORMAL BOOT RECOVERED
SSH active
DNS native and functional
WARP inactive
website reachable
root filesystem ~70% used

Within that model, my confidence is deliberately uneven.

The August 11 DNS transition is demonstrated. The ENETUNREACH failure mode is demonstrated. The massive DNS-warning amplification is demonstrated. The connection between that warning volume and multi-gigabyte system logging is extremely strong. ENOSPC, failed rotation and secondary service failures are directly observed.

The later resolver/network collapse is strongly supported by timing and state evidence, but the exact operation that produced the zero-byte resolver file is not captured. The exact mechanism that prevented SSH from completing its protocol exchange is also not isolated.

And the microscopic trigger inside WARP around 06:54 on August 11 remains the one important unanswered implementation question.

That is as far as I can responsibly go.

What began as a full disk was really a systems failure

I started this incident expecting one of the least interesting jobs in server administration: SSH into a small VPS, delete some oversized WordPress backups, and move on.

Instead, SSH itself disappeared.

Rescue mode showed a full disk, but WordPress was not the main consumer. Logs were. The logs led to WARP. WARP led to millions of DNS failures. The DNS failures led backward through timestamps until the apparent August 16 outage became an August 11 event. Then the tunnel that seemed “up” turned out to contain a DNS path that was effectively dead. A health indicator remained green while functional success approached zero. The warning mechanism consumed the filesystem. The filesystem’s exhaustion disabled the mechanism intended to contain the logs. Later, resolver and networking state deteriorated far enough that both the public application path and the administrative path disappeared.

What looked at first like:

disk full

was really:

a local routing failure
        |
        v
a retry problem
        |
        v
an observability problem
        |
        v
a resource-exhaustion problem
        |
        v
a recovery-mechanism failure
        |
        v
a resolver/network problem
        |
        v
an application outage
        +
a management-plane outage

That is why I found this incident so much more interesting than the ordinary failure I had expected.

No single component needed to “decide” to destroy the VPS. There was no intelligent agent, no malicious process and no dramatic kernel crash. Every layer continued following ordinary rules. The catastrophe emerged from their interaction.

And perhaps the most useful lesson is precisely that: a system does not need to stop executing correctly at the lowest level in order to behave catastrophically at the highest level.

The CPU can keep executing instructions. The kernel can keep scheduling processes. The tunnel can keep reporting one-millisecond latency. The DNS proxy can remain alive. sshd can be listening. Nginx can have started successfully. Every one of those facts can be true while the system as a whole is already moving toward failure.

Reliability therefore cannot be reduced to asking whether the individual pieces are still running. It depends on whether the relationships between those pieces remain inside a region where the whole machine can recover from disturbance without consuming its own capacity to recover.

That is the part I did not expect to learn from a 9 GB WordPress VPS.

I went in looking for something to delete.

I came out thinking about feedback, state, evidence, failure containment, control planes, homeostasis, and the strange boundary between a machine whose components are still working and a system that is no longer healthy.

Deletion Is a Claim, Not a Command: Can “Deleted” Ever Be a Promise?

After finishing a long investigation into Git deletion, I thought the difficult part was over. The repository had been the experiment; the broader lesson seemed to be that deletion has several observable states. Then a more uncomfortable question appeared. If a system says that something is deleted, what exactly is it claiming, who defines the scope of that claim, and who gets to decide when the process is truly finished?

I documented the original technical investigation in Deleting in Git and Rethinking (Philosophically) Deletion as a System Design Question. I will not repeat its command sequence, checksums, history reconstruction or remote tests here. That article supplies the concrete case study. This essay begins where it ended and follows the questions that emerged afterwards: deletion as a promise, deletion as a division of power, the limits of legal erasure, the possibility of user-triggered irreversible deletion, and the way end-to-end encryption changes the problem entirely.

The command was no longer the interesting part

The question that survived the successful experiment

The first conceptual shift was simple. A deletion command and a deletion claim are different things. A command is an event: a user presses a button, an API receives a request, or a service begins a workflow. The claim comes afterwards: “the data are deleted.” That sentence requires an object, a scope, a time, an authority model and some evidence. A successful command can establish that a process ran without establishing the final condition the user has in mind. Once I noticed this difference, the title of the new argument became almost unavoidable: deletion is a claim, not a command.

This was the first place where the discussion with AI materially changed my framing. I had begun with a technical result and was still asking what operation should follow it. The better question was grammatical before it was architectural: what is the subject of the statement, which data does its object denote, and what predicate has actually become true? The AI could readily produce another command sequence, but that would have answered the question I had just completed. What I needed was an account of the sentence the interface presents to the user. In other words, the experiment had succeeded while its vocabulary had become unstable.

I also had to resist a tempting exaggeration. Discovering residual representations does not prove that every ordinary deletion interface is deceptive, nor does it prove that users always want physical annihilation. In the earlier Git work, stable identifiers and remote tests made a deeper state visible. The new essay had to preserve that evidence without promoting it into a universal accusation. The defensible conclusion was narrower and, I think, stronger: the word deleted can name several postconditions, and a system should not rely on the user’s inability to distinguish them.

One verb compresses an entire lifecycle

“Delete” is perhaps one of the most semantically overloaded verbs in computing. One interface label can stand for removal from a screen, a namespace change, reference invalidation, logical marking, cache expiry, garbage collection, backup rotation, cryptographic key destruction or a mixture of these. The interface presents a single verb because users need a usable action, but the verb also makes an epistemic promise. When the system later displays “Deleted,” it is no longer merely reporting that code executed. It is telling the user something about reality. That is quite a workload for one small button.

DELETE
    may mean

remove from visible account
stop normal retrieval
remove live references
schedule garbage collection
retain a recovery copy
wait for backup expiry
destroy a decryption key
notify other data holders

This semantic compression is usually harmless. If I delete a downloaded document because my folder is untidy, I normally want it out of my working environment. I do not care whether a short-lived backup or an SSD remapping layer still contains a representation. Likewise, ordinary application data can often be considered successfully deleted once they stop participating in the user’s intended workflow. A full ontology of disappearance would be wildly disproportionate. The Delete button may be the most optimistic member of the interface, but most days its optimism causes no real trouble.

The ambiguity becomes consequential when the difference between postconditions changes security, privacy, recovery, legal responsibility or operational behaviour. A removed credential may remain dangerous in history or a clone. A closed account may leave personal information in other internal systems. A database row may disappear while a cache or search index continues to expose it. A backup may faithfully restore information that the live system had correctly erased. A private manuscript, source repository or photograph may remain recoverable by a provider even after its owner has chosen deletion. Usually the ambiguity does not stop a person accomplishing the immediate task. It still affects what the interface is entitled to claim.

That qualification became important during the AI exchange because I kept returning to a practical objection: if deletion works for perhaps 99 percent of ordinary intentions, am I turning a marginal edge case into a philosophy of everything? The answer depends on the cost of the mismatch. Removing an old download from a folder and erasing a compromised secret are visually similar actions with very different failure consequences. A recoverable grace period can be kindness after an accidental click and a liability after a deliberate security decision. A single label is acceptable only if the surrounding context tells the user which contract applies. Otherwise an implementation detail quietly becomes a risk allocation.

I therefore stopped asking whether the word delete has one correct technical definition. It plainly does not. The useful design question is whether the system has selected a definition appropriate to the user’s objective and exposed enough of that definition to support an informed choice. The first ACM article helped confirm that the vocabulary across research and practice is genuinely fragmented; the second helped organise the user-facing stakes as control, scope, completeness and transparency. Those papers gave names to the terrain. The route through it—claim, universe, terminal-state control and cryptographic agency—came from the iterative dialogue and the concrete repository case.

Reading two recent research contributions sharpened this point. The Many Faces of Data Deletion surveys the fragmented vocabulary and mechanisms collected under the word deletion. From Objects to Influences identifies four persistent user expectations—control, scope, completeness and transparency—and asks what happens when learning systems transform discrete data into distributed influence. I am deliberately leaving machine-unlearning algorithms outside this essay because I want to study them properly before making technical claims. Their conceptual challenge still helped me recognise that even in traditional systems a deletion interface carries assumptions about agency, boundary, finality and proof.

How the thesis changed through the dialogue

From a Git operation to a system claim

The sequence of revisions matters because the final thesis was not present at the beginning in polished form. The first version was essentially operational: a user can remove ordinary references, yet the host may retain objects and can perform a deeper cleanup unavailable through the normal interface. The next version became epistemic: a successful interface action does not establish every condition implied by the word deleted. Then it became architectural: the provider owns the mechanisms that create the terminal state. Finally it became normative: which part of that terminal-state decision should belong to the user, which part properly remains with the provider, and what evidence should connect the two?

AI was useful here because it could rapidly propose distinctions and test them against examples. It was also quite willing to make the argument sound finished too early—a talent shared by software demos and some committee reports. Each time the language became too smooth, I pushed it against a harder case. If I said “complete deletion,” the next question was complete within which systems. If I said “user control,” the next question was whether I meant root access, a legal entitlement or an outcome. If I said “proof,” the next question was who could observe the relevant layer. The method was a repeated cycle of proposition, counterexample, narrower formulation and another counterexample.

The questions that forced corrections

Several questions did more work than any abstract definition. What if the repository is private, has one owner, no forks, no collaborators, no external clones and no legal hold? If the provider can perform deeper reclamation for a support case, why can the authorised owner not select the same terminal state as a product capability? Does ownership of the content imply control of storage? If not, does rejecting infrastructure control also require rejecting outcome control? If a legal right lets a person request erasure, what can that person actually observe? If encrypted ciphertext remains in backups after the last key is destroyed, is the repository gone, inaccessible, meaningless, or all three under different definitions?

None of these questions was solved by replacing the old answer with its opposite. The private single-owner case does not prove that every repository can be erased without affecting anyone else. Provider-side reclamation does not prove physical annihilation. Content ownership does not confer ownership of a disk, and a legal claim does not itself implement a storage transition. The iterations instead separated concepts that my opening language had conflated. This was honestly the most productive part of the work: every apparent objection became a request for a better type system.

What remained mine in an AI-assisted method

The division of labour is worth stating because the article is partly about human–computer collaboration. The AI generated candidate distinctions, alternative phrasings, legal and architectural hypotheses, and lists of questions I might have missed. Deterministic tools and primary documentation established narrower facts: which remote states were observable in the earlier experiment, what the provider currently documents, and what the legal text actually says. The real environment decided which technical claims survived. I decided the scope of the essay, rejected claims I could not defend, chose the normative direction, and kept asking whether an attractive sentence had outrun its evidence.

This also explains why I postponed a technical treatment of machine unlearning. The AI could summarize algorithms and produce fluent comparisons, but fluency would not give me the understanding needed to make original claims about them. The learning-systems paper was valuable as a conceptual provocation: it shows how deletion becomes influence mitigation when no stable removable object corresponds to the original input. I use that contrast cautiously. A Git object identified by a known hash is an unusually strong epistemic handle; a learned influence distributed through parameters is not an object with an equivalent OLD_SHA. Pretending otherwise would make the comparison vivid and the analysis wrong.

The methodology that emerged is therefore reusable. Begin with a concrete discrepancy. Ask what proposition the interface appears to assert. Enumerate the layers over which that proposition could vary. Separate observations from inferences and desired rights from existing mechanisms. Search primary sources for claims that may have changed. Let AI generate counterexamples, but make the environment, documents and threat model arbitrate factual questions. The goal is not to remove judgment from the process; it is to make judgment easier to inspect.

Deleting an object is different from deleting its consequences

Presence, propagation and influence

The next step was to distinguish the source object from everything that has happened because of it. Consider an ordinary, non-learning system. A customer record may feed a search index, a cached profile, a monthly report, a fraud score and a backup. Removing the primary record does not necessarily remove every copied or derived representation, and it certainly does not reverse a decision already made from the information. The data may cease to be present as an object while remaining causally effective as an influence. Machine learning makes this problem more difficult, but it does not invent it.

source record
    |
    +-- exact copy
    +-- cached representation
    +-- search index
    +-- derived score
    +-- aggregate report
    +-- backup
    +-- human decision

This produces three increasingly demanding meanings of deletion. Object deletion asks whether the identified source remains represented or retrievable. Propagation deletion asks whether copies, indexes and derived personal representations have also been handled. Causal reversal asks whether the system has returned to the state it would occupy had the information never entered it. The third is a counterfactual demand, not an ordinary storage operation. Deleting an incorrect record does not cause a person to unmake a decision taken yesterday, just as destroying a letter does not make its reader forget what it said.

I found the state-based and counterfactual formulations especially useful:

State-based deletion
    Is X present or recoverable now?

Counterfactual deletion
    Is the system equivalent to the system
    that would have existed if X had never entered it?

These should never be promised as though they were the same. A system may be able to remove exact objects and derived indexes while being unable to undo independent human knowledge, external copies or prior consequences. That limitation does not make object deletion meaningless. It makes the boundary of the claim essential. The system should say what it can erase, what it can prevent from returning, and what lies outside its causal or technical authority.

One revision in the dialogue was especially helpful: distinguish deleting a representation, deleting access to it and deleting its meaning. These targets can coincide, but they need not. Physical destruction targets the representation. Access revocation targets a capability or policy path. Cryptographic erasure targets the ability to recover intelligible plaintext. Removing a search result may reduce discoverability without destroying the source. Deleting a source record can stop future processing while leaving a past aggregate unchanged. The word deletion often moves between these targets mid-argument unless they are named.

This is also why I would not describe every residual consequence as undeleted data. A report that contains an exact personal field is different from an aggregate whose value was once affected by that person, and both differ from a human decision informed by the report. The further the effect moves from identifiable representation toward causal history, the less ordinary object-erasure language can do. A requirement may still demand correction, recomputation, notification or mitigation, but those are distinct operations. Treating them all as deletion hides the work that must actually occur.

Why forgetting may be the wrong metaphor

The language of “forgetting” initially appealed to me because it captures the human desire to make information stop mattering. Yet human forgetting and machine deletion are poor equivalents. A person who burns a letter can destroy the object and still remember its contents; another reader may preserve a photograph; a decision already made does not automatically reverse. That analogy usefully reveals the causal limit, but it should not be pushed into an excuse for systems to retain everything. Computers can often enumerate, isolate and destroy representations far more systematically than people can erase memories.

The more precise aspiration is controlled non-persistence. For object-like data, the system should prevent the information from remaining available, recoverable or reintroduced within a declared scope. For derived effects, it should state whether they will be recomputed, quarantined, corrected or left unchanged. For independent human knowledge and outside copies, it should acknowledge the boundary. “As if it had never happened” may express the user’s moral wish, but an engineering contract needs individually testable postconditions.

A complete-deletion claim needs a declared universe

Complete according to whom and inside what boundary

The phrase I initially used was “delete it completely from the universe.” It expressed the desired outcome honestly, but it was technically unbounded. Which universe? The active account, every live provider system, all provider backups, every storage device ever involved, every processor, every external clone, every screenshot, or the memory of every person who saw the information? Without a defined universe, complete absence is not a proposition that an ordinary observer can test.

I therefore began writing the claim as a relation between an object and a declared universe:

CompleteDeletion(x, U)

x = an identified object or body of information
U = the declared universe of relevant representations

CompleteDeletion(x, U) holds when no recoverable
representation of x remains inside U, subject only to
explicitly identified and justified exceptions.

Different actors may choose different values for U. A user interface may implicitly use the active namespace. A provider’s deletion policy may include live storage and caches but place backups on a retention schedule. A regulator may consider every system controlled by the controller or its processors. A forensic investigator may care about physical remnants. The disagreement is often less about whether a deletion command ran and more about who gets to define U.

At first I treated this as a measurement problem: define enough checks and eventually the answer should become complete. The dialogue exposed the prior governance question. The provider decides how systems are partitioned, which processors receive data, what counts as a cache, when a snapshot expires and which internal stores appear in the official inventory. If it can define the universe narrowly and then attest to deletion inside that universe, the receipt may be accurate while the promise remains weak. Scope selection is therefore part of the substantive right, not a harmless preface to verification.

This is why the phrase under effective control matters in my proposed default. It ties scope to operational power instead of product labels. A database managed by a contracted processor should not fall outside merely because the provider calls it “external.” A backup that the provider can restore but claims it cannot selectively edit remains within the lifecycle that must be accounted for. Conversely, a clone independently created by another authorised person may genuinely lie outside the provider’s power to destroy. A useful boundary follows authority and responsibility, then declares the exceptions, rather than following whichever diagram makes the deletion report shortest.

My proposed default is demanding but bounded: where no independent third-party interest or lawful retention obligation applies, the relevant universe should presumptively include every representation under the service provider’s effective control. That includes active copies, internal references, caches and recovery systems, together with processors the provider can instruct. It does not include an independent person’s local copy, because the provider has no power to destroy it. A private repository with one owner, no collaborator, no fork, no outside clone and no legal hold is the clearest thought experiment precisely because it removes those competing boundaries.

This also refined two propositions from the earlier investigation:

Deletion is relative to an abstraction boundary. A claim of complete deletion is also relative to a universe of observation.

The second sentence adds an epistemic limit. A provider may control systems that the user cannot inspect. A user may know a stable identifier that exposes one residual state without having authority to change it. A regulator may be entitled to demand records and audits that the user cannot obtain directly. There is no single observer with automatic access to every relevant layer.

How can anyone prove absence

The question “how do you prove a negative?” kept returning, but it needed refinement. In a finite technical universe, absence is not inherently mystical. If a repository service declares a complete set of live references, caches, backups, processors and keys, it can test postconditions for those components. The problem is that the user rarely knows whether the set is complete and cannot usually inspect all its members. Verification therefore has two layers: evidence that each declared component reached its required state, and evidence that the declaration itself covers the relevant system.

The earlier Git investigation was unusually favourable because a known object identifier offered a repeatable query. A failed lookup after deeper reclamation was meaningful evidence about direct addressability through that interface. It did not reveal cold backups or disk sectors, but it let me falsify an earlier assumption while the object still resolved. The identifier functioned as an epistemic handle: it made a hidden difference observable without granting me control over the server. Many deletion disputes are harder precisely because the user lacks such a stable probe.

Learning systems expose the limit from the other direction. There may be no bounded object corresponding to one training contribution that can be queried like a historical commit. Effects can be distributed and behaviour can vary across prompts and model versions. I am not treating that as a technical account of unlearning, only as a warning about proof structure. A finite reference graph and an open-ended space of possible model behaviours do not support the same absence test. The second ACM paper’s move from objects to influences makes that mismatch explicit and helped me see why a universal deletion verifier would be a category error.

The observability ladder is useful but reality is a graph

That led me to a deletion observability ladder. It is not a universal state machine, because real systems can branch, but it helps prevent evidence from being stretched upward:

  1. Interface disappearance means the user no longer sees the object.
  2. Namespace disappearance means ordinary retrieval no longer locates it.
  3. Reference disappearance means declared live references no longer lead to it.
  4. Direct non-addressability means even a known identifier no longer retrieves it through the tested interface.
  5. User non-recoverability means the user-facing restore process cannot bring it back.
  6. Provider-attested erasure means the provider asserts that its declared lifecycle is complete.
  7. Cryptographic irrecoverability means surviving encrypted representations cannot feasibly yield plaintext within the threat model.
  8. Physical irrecoverability means no relevant physical representation can reconstruct the information.

The higher the claim climbs, the less direct the ordinary user’s observation tends to become. A visible disappearance can be checked with one’s own eyes. Backup expiry and storage-media destruction may depend on provider records, audits or cryptographic design. If I cannot inspect the provider’s physical storage, I should not silently upgrade an interface observation into a physical-erasure claim. The tool should model observable predicates, not declare metaphysical victory.

I call this a ladder because the claims often feel progressively stronger, but the metaphor has limits. Cryptographic irrecoverability does not necessarily come after physical reclamation; it can occur first, while encrypted copies remain. User non-recoverability can coexist with provider recoverability. A source object may be gone while an index remains, or an exact copy may remain inaccessible while a derived effect continues to influence a decision. The real model is a graph of predicates, authorities and dependencies. The ladder is a teaching aid for refusing unjustified upward inference, not a claim that every system passes through eight neat stages in order.

A practical deletion report should therefore avoid a single scalar “deletion level.” It should state a vector of properties: visibility, addressability, live references, recovery paths, backup behaviour, key availability, derived representations and external boundaries. This is less elegant than a green checkmark, but elegance is not always the friend of truth. A dashboard can still summarise the outcome; the underlying receipt must preserve the distinctions on which the summary depends.

Deletion is the inverse problem of durability

The same mechanism can be protection or persistence

Another thread became clearer once I stopped treating deletion as an isolated CRUD operation. Modern systems are designed to prevent loss. Replication, snapshots, immutable logs, version histories, caches, redundant object stores and disaster-recovery backups all answer the requirement “do not lose this information.” Then the user asks the same architecture to lose it deliberately, completely and sometimes immediately. Every reliability mechanism becomes part of the erasure-coordination problem.

Reliability asks how information can survive failures. Deletion asks how information can fail to survive on purpose. A system that remembers well has to work harder to forget. That is not evidence of bad engineering; it exposes competing objectives. The same recovery window that saves a project after an accidental click also prevents immediate irreversibility. Backups are heroes until the requirement is forgetting, at which point their admirable memory becomes the problem under examination.

This is why soft deletion is often the correct default. People make mistakes, accounts are compromised and destructive operations can be abused. A recovery period has genuine value. Yet the safety argument supports offering a reversible default; it does not necessarily justify withholding an irreversible option from an informed, authorised user. Trash and Empty Trash already embody two different postconditions. Cloud services could make the distinction equally explicit.

The conflict can be stated simply:

recoverability increases protection from accidental loss
irreversibility increases protection from unwanted persistence

Neither objective is universally superior. For an ordinary project, recovery may matter more. For a sensitive private repository, an unpublished manuscript or information subject to a valid erasure requirement, continued recoverability may be the risk. System design should let the authorised person choose which failure is unacceptable, with appropriate safeguards and clear consequences.

Deletion debt begins at architecture time

The AI discussion also shifted my attention from deletion procedures to deletion-aware architecture. If a service replicates data widely, mixes tenants through deduplication, builds immutable provenance, copies content into analytics systems and adds backups without a corresponding erasure path, it accumulates what I would call deletion debt. The feature works today because persistence is easy; later, a terminal-state request must reconstruct a map that the architecture never maintained. At that point deletion becomes an expensive expedition through systems whose owners may not even agree on vocabulary.

This does not mean every record should be easily destroyable. Audit logs, scientific provenance, financial records and legal evidence can have justified retention requirements. It means the conflict should be designed explicitly. A system should know which data are authoritative, which are derived, which retention rule applies, which keys protect which scope, how a restore replays prior erasure decisions, and which actor owns the final check. Immutability without an erasure model is still a design choice; calling it a platform constraint later does not make the original choice disappear.

The restore path deserves particular attention. A live deletion can be technically correct and still fail operationally if disaster recovery resurrects an older copy. The robust pattern is to preserve the erasure instruction or tombstone long enough to reapply it after restoration, while preventing that metadata from becoming an indefinite duplicate of the content being erased. Well, backups have discovered time travel, so deletion has to write instructions for its future self. This is one reason verification should include restore testing and not stop at the production database.

Who controls the terminal state

The clean private-repository thought experiment

The most important turn in my reasoning concerned power. At first the question sounded like a demand for lower-level infrastructure access: if the repository is mine, why can I not run the provider’s garbage collector? That formulation invited a correct but incomplete answer. Users should not receive administrator access to shared storage. A hosted object may participate in internal references, deduplication, security processes, legal holds or another person’s legitimate state. Content ownership is not ownership of a physical disk block.

But I did not actually want the provider’s root password. I wanted control over the outcome. Infrastructure control means choosing storage devices, GC algorithms, queues and backup implementations. Outcome control means being able to say, after informed confirmation, “make this data irrecoverable throughout every system under your effective control.” A person need not control the architecture in order to have meaningful control over the terminal state of their data. Root access would be an exciting solution only until the first typo.

GitHub makes the distinction concrete without requiring me to repeat the earlier Git experiment. Its current documentation says that fully removing qualifying sensitive data can require GitHub Support to dereference pull-request references, run server-side garbage collection, remove cached views and purge orphaned LFS objects. The same procedure is not offered for ordinary non-sensitive data and may be refused where credential rotation mitigates the risk. GitHub also documents that some deleted repositories can be restored within 90 days. See Removing sensitive data from a repository and Restoring a deleted repository.

The significant boundary is not simply possible versus impossible. GitHub possesses provider-side operations that the ordinary repository owner cannot directly trigger as a normal lifecycle choice. Deeper cleanup is mediated through a provider-defined support category. That is partly a security and implementation boundary, but it is also a product and governance decision. The legitimate question is therefore not “why can I not administer GitHub?” It is “why is irreversible erasure a provider-mediated exception rather than a user-selectable terminal state in the clean private case?”

The clean case became my way to isolate the disagreement. Assume one verified owner; a private repository; no fork, collaborator, pull request belonging to another party, external clone known to the provider, legal hold or statutory retention duty. Assume the user understands that restoration will be impossible. Under those conditions, the familiar justifications for refusing a definitive choice become much thinner. Shared infrastructure still makes the implementation complex, but shared infrastructure alone does not answer who should choose the authorised outcome.

This hypothetical is not a prediction that providers can always know whether an outside copy exists. It deliberately limits the requested universe to provider-controlled representations and declared processors. Nor does it say that a provider must erase bits synchronously while the user watches a progress bar. It asks for a committed terminal state with a defined deadline and no retained provider recovery path. The service may choose queues, cryptographic erasure, media rotation or another sound method. The user’s decision concerns continued provider-controlled recoverability.

Ownership was the wrong shortcut

Server-side Git garbage collection would not by itself answer the entire question. It operates at the Git-object layer; cached views, pull-request references, LFS objects, snapshots, backups and underlying storage can have separate lifecycles. Even if a provider exposed a “run GC now” action and the old object stopped resolving, the result would not prove that every physical representation had disappeared. GC is a deeper abstraction than branch deletion, but it is not the physical bottom of the provider’s system. This is why the desired right must concern the terminal outcome across a declared universe, not one favoured implementation command.

There are practical answers. The service must authenticate authority, detect shared references, protect other users, check legal holds, coordinate distributed storage and prevent account takeover from becoming instant permanent destruction. Those reasons justify validation, high-friction confirmation, delays and internal implementation. They do not logically require the final decision to remain discretionary once every condition has been satisfied. Complex infrastructure can be hidden behind a safe operation, just as payment systems expose a transfer without giving customers access to settlement databases.

I initially used ownership language too casually: “my repository” seemed to imply “my right to destroy every stored copy.” The dialogue corrected that shortcut. The repository can contain my intellectual work while the storage medium, service database and operational logs belong to another entity. Personal data law may apply to some content and not to other content. Contract, copyright, privacy, organisational policy and third-party rights can allocate different powers. Ownership is too blunt to derive root access or an absolute deletion result.

The argument survived because it did not actually require that shortcut. What I wanted was a product capability and, perhaps eventually, a broader right to choose an irreversible provider-controlled terminal state for material I am authorised to govern. That is closer to informational self-determination and exit than to physical property. It can be bounded by other people’s rights and lawful retention without reducing the user to a petitioner whose preferred outcome is merely advisory.

Authority and observability form a matrix

I eventually separated four powers that deletion interfaces often collapse:

Power Question Typical cloud allocation
Claim-right Can I require another actor to erase the data? The user may possess it under law or contract.
Trigger authority Can I directly initiate the definitive lifecycle? Often partial, mediated or absent.
Implementation authority Who chooses and operates the technical mechanism? The provider or its processor.
Verification power Who can obtain evidence that the promised state was reached? Provider high, user limited, regulator potentially higher.

My argument asks for stronger claim, trigger and verification powers while leaving implementation authority with the service. It also clarifies the difference between a right to deletion and a right of deletion. The first lets me require someone else to produce an outcome. The second would give me a safe capability to initiate that outcome myself, within the provider’s system and subject to legitimate checks. Cloud computing turns direct technical agency into institutionally mediated agency; the question is how much agency the mediation should preserve.

Authority and observability also vary independently. I may observe that a historical identifier still resolves while lacking authority over provider-side reclamation. In many privacy systems the relation is reversed: the user can request erasure but cannot inspect the production databases, processors, backups and internal queues. A provider can be transparent by telling me what it claims to have done, observable by exposing relevant state, and verifiable by giving me evidence that can test the postcondition. These are progressively stronger properties. Transparency without observability may be little more than a well-written assertion.

Low observability High observability
Low authority The user can neither initiate the terminal state nor inspect it. This is dependence without useful evidence. The user can detect residual state but cannot remove it, as when a known identifier still resolves.
High authority The user can issue a binding request but must trust hidden implementation and reporting. The user can initiate the process and examine evidence about its declared postconditions.

The lower-right condition is the design target, but even it has degrees. An interface can be transparent by describing policy in readable language. It becomes observable when the user can see state transitions, deadlines, exceptions and relevant inventories. It becomes verifiable when the evidence is sufficiently independent or mechanically testable to challenge the provider’s assertion. These words are often used as pleasant synonyms; keeping them separate prevents a detailed help page from being mistaken for proof.

The refined claim that came out of this part of the discussion is one sentence I would keep: You do not need to give me control of the infrastructure. Give me meaningful control over the terminal state. That sentence leaves room for provider expertise and shared-system safety while refusing the idea that implementation complexity automatically settles the allocation of agency.

The GDPR is a starting point and not the final answer

The law says erase but at what technical layer

The General Data Protection Regulation is highly relevant because it turns erasure into a legal entitlement in defined circumstances, but I do not want to treat it as an absolute philosophical definition. Article 17 gives a data subject a right to obtain erasure of qualifying personal data when one of its grounds applies, subject to explicit exceptions. Article 19 requires communication of erasure to recipients in applicable cases and lets the data subject request information about those recipients. Articles 24 and 25 place responsibility for appropriate technical and organisational measures, and for demonstrating compliance, on the controller. The official consolidated text is available through EUR-Lex.

The Regulation deliberately speaks at a technology-neutral legal layer. It does not prescribe disk sectors, Git object collection, database commands or backup formats. That is sensible because infrastructures change. A data subject normally receives a claim against the controller, while the controller selects and operates the means. Supervisory authorities and courts can assess whether those means comply. The law may therefore entitle me to the outcome called erasure without giving me direct observational access to every technical state by which that outcome is implemented.

During the dialogue, I initially treated the absence of storage-layer language as a missing answer. I then revised that interpretation. Technology-neutrality is a feature of the Regulation, not an accidental silence. A law written around one filesystem operation would age badly and could encourage formal compliance at the wrong layer. The unresolved difficulty is operational translation: if the legal word is erasure, a controller still needs to decide whether deactivation, de-indexing, logical deletion, backup suppression, key destruction or physical reclamation satisfies the right in the particular context.

Article 17 is also conditional, not a universal incantation that makes all competing duties vanish. It states grounds for erasure and exceptions that include freedom of expression and information, legal obligations, public interest, certain archiving and research purposes, and legal claims. The careful argument is therefore not that every user request must destroy every bit. It is that a valid request, after applicable scope and exceptions are determined, cannot be answered merely by pointing to the limitations of an ordinary product workflow.

Legal observability is real but indirect

This is not a model in which the provider simply gives itself the final word. Article 5 requires accountability, Article 24 requires the controller to implement and demonstrate compliant measures, and Article 58 gives supervisory authorities investigative and corrective powers, including powers relevant to ordering compliance and erasure. The controller initially chooses the means; law, regulators and courts can judge their sufficiency. The user still depends on institutional rather than direct technical observation for much of that review.

There is no obvious general GDPR right to inspect every disk block, cache, replica and backup, or to operate the controller’s deletion machinery personally. Article 15 provides substantial access rights concerning processing, categories, recipients and retention periods, and Article 19 provides a form of propagation visibility concerning recipients. I think it is useful to call this legal observability: another actor is obliged to disclose information even though the data subject cannot inspect the underlying systems. That is my analytical term, not a formal term used by the Regulation.

Layer-specific erasure is already visible in European law. In Google Spain v AEPD and Costeja González, the issue concerned links returned by a search engine for a person’s name. De-referencing at the search layer could be legally meaningful while the original newspaper material remained available at its source. “Gone from a named search result” and “the source no longer exists” are different claims, yet the first can still protect a real interest.

Backups show the same issue from another direction. The European Data Protection Board’s coordinated enforcement report on the right to erasure found that some controllers confused deleting an account or profile with fulfilling an erasure request while retaining further personal data internally. It recommended mapping data and storage locations, highlighted automatically generated records as a useful proof-of-deletion practice, and addressed the difficulty of modifying backups. Where backups cannot sensibly be edited record by record, controllers still need procedures that track erasure, prevent restored data from returning to ordinary processing, verify the outcome and demonstrate it. See the EDPB 2025 coordinated enforcement report.

Article 19 struck me as especially interesting because it adds a propagation dimension: where applicable, the controller communicates erasure to recipients and provides information about those recipients on request. It does not grant the data subject a map of every sector or a live console into every processor. It does recognise that deletion has edges, not only a source node. My phrase legal observability captures this indirect structure: duties of disclosure, documentation and accountability let an individual or regulator know more than the interface alone reveals.

The controller–processor distinction also prevents an easy slogan. A hosting platform may be a controller for some account and service operations while acting as a processor for customer-directed content in another context. Roles depend on purposes and means, not only on which company owns the servers. The practical lesson for this essay is modest: product documentation cannot by itself settle the legal analysis, and a legal entitlement does not automatically specify a particular garbage-collection command. Both layers must be mapped before a strong conclusion is justified.

These rules matter, but they do not settle my broader question. First, a private repository containing code, a novel, mathematical notes or an unpublished photograph may not consist of personal data as the GDPR defines them. The desire to destroy one’s hosted intellectual work can still be a serious autonomy and contractual interest. It points towards a broader idea of digital informational self-determination over user-controlled hosted objects. Second, the GDPR is primarily an accountability model. It requires the controller to comply and to demonstrate compliance, but it does not generally turn definitive erasure into a user-operated technical primitive or give the individual all the internal evidence available to the controller and regulator.

This is where a constructive criticism becomes possible. The GDPR protects control in law more clearly than control over the terminal outcome as a directly triggerable system capability. Its technology-neutrality is necessary, yet the user may possess the underlying right while having the least technical observability of its fulfilment. A next generation of digital rights could distinguish the right to request erasure, the right to trigger a definitive process, the right to observe its progress and the right to receive evidence describing the postcondition actually achieved.

I would add a fourth distinction that emerged only after several iterations: a right to execute the mechanism is not required for a right to determine the outcome. The controller can retain implementation authority while the user holds a binding claim, a direct trigger and an evidence right. This is less dramatic than handing everyone a storage-administration console and much more useful. It converts “please consider deleting this” into a governed lifecycle whose alternative outcomes are completion or a reasoned, reviewable exception.

I would still avoid declaring GitHub’s lack of a user-facing server-GC control unlawful. There is no general rule requiring that particular interface, and GitHub’s controller or processor role can vary with the account and processing context. A different claim would be more serious: if a valid Article 17 request covered personal data under a provider’s control, no exception justified retention, and the provider refused erasure solely because its ordinary product process did not offer deeper cleanup, the product policy would not decide the legal outcome. Product eligibility for support is not the same thing as a data-protection obligation.

Hard delete should be an explicit system primitive

A terminal state needs policy as well as code

The design proposal that emerged from this reasoning is a user-triggerable definitive-erasure operation. It would not promise deletion from an undefined universe and it would not expose raw infrastructure. It would let an authorised user select an irreversible terminal state covering every representation under the provider’s declared effective control, except for precisely identified legal or third-party constraints.

SOFT DELETE
  remove from ordinary visibility and use
  retain a disclosed recovery window
  permit restoration

HARD DELETE
  validate authority and shared interests
  identify any lawful retention constraint
  purge live objects and provider-controlled references
  invalidate provider caches and recovery functions
  make backups incapable of restoring the object to active use
  complete physical or cryptographic reclamation under policy
  provide evidence and disclose any residual state

The normal safe path can remain soft deletion. Hard deletion should require strong reauthentication, explicit explanation, perhaps a waiting period, and extra approval for shared organisational resources. The user should be told that recovery will be impossible. Those protections respect both safety and autonomy. They should culminate in a genuine point of no return; otherwise hard delete is merely soft delete wearing a stern hat.

The provider would need to evaluate a policy object before starting destructive work. That policy should bind the authenticated principal, the target, the declared universe, the recovery choice, known shared interests, retention constraints and a completion deadline. The point is not that every service should copy one schema; it is that “permanent” should be represented as a first-class, inspectable request rather than inferred from a generic delete call.

{
  "operation": "hard-delete",
  "target": "repository/example-project",
  "requestedUniverse": "provider-controlled",
  "recovery": "none",
  "confirmSharedInterests": true,
  "completionDeadline": "policy-defined",
  "acknowledgeIrreversibility": true
}

The operation should also have typed alternative outcomes. If the service cannot comply because of a legal hold, statutory retention rule or independent third-party right, it should return PARTIAL_WITH_DECLARED_EXCEPTION or REJECTED_WITH_REASON, not quietly keep a recoverable copy while displaying “permanently deleted.” An exception should identify its scope, authority, access restrictions and expected review or expiry condition. Theoretical possibilities should not become blanket excuses for indefinite retention.

There is an important timing correction here. Immediate interface disappearance and immediate physical completion need not be the same promise. A provider may need a bounded period to propagate tombstones, rotate backup media or confirm processor action. Honesty requires a state such as PENDING_IRREVERSIBLE_ERASURE until the deadline, together with a statement about whether the user, provider or support staff can still recover the data during that interval. “Scheduled” is a respectable result. “Complete” is a different one.

A receipt reports evidence rather than omniscience

I would model the provider’s workflow as a state machine whose progression is visible to the authorised user:

REQUESTED
  -> AUTHORITY_VALIDATED
  -> SHARED_INTERESTS_CHECKED
  -> RETENTION_RULES_CHECKED
  -> LIVE_STATE_PURGED
  -> REFERENCES_AND_CACHES_PURGED
  -> RECOVERY_DISABLED
  -> BACKUP_RULE_APPLIED
  -> VERIFIED
  -> COMPLETE

Possible bounded outcomes
  PARTIAL_WITH_DECLARED_EXCEPTION
  REJECTED_WITH_REASON

Completion should produce a deletion receipt. The receipt would not be a magical proof that no forgotten electron exists. It would be a signed, versioned statement of scope, state and evidence: what object was covered, which systems formed the declared universe, which postconditions passed, when recovery became impossible, how backups behave, whether processors were included, which exceptions remain and what lies outside the provider’s authority.

{
  "request": "irreversible-erasure",
  "scope": "all-representations-under-provider-control",
  "liveState": "purged",
  "historicalReferences": "purged",
  "providerCaches": "purged",
  "userRecovery": "disabled",
  "providerRecovery": "disabled",
  "backupState": {
    "activeRestore": "erasure-replayed",
    "residualExpiry": "declared-date"
  },
  "processors": "confirmed",
  "legalRetention": "none",
  "externalCopies": "outside-provider-authority",
  "evidence": "provider-signed-attestation"
}

Such a receipt improves transparency and observability. Whether it provides strong independent verifiability depends on the trust model. Provider-signed evidence is still produced by the provider. Tamper-evident logs, independent audits, secure hardware attestations and verifiable-deletion protocols could strengthen it, but every mechanism still proves a bounded property. The honest output might contain PASS, PENDING, EXCEPTION and UNKNOWN. That is more informative than DELETED = true and more respectful of the user’s intelligence.

A receipt also gives support teams, auditors and regulators a common artifact. The user can compare the promised universe with the systems listed; an auditor can test whether controls actually implement those transitions; a restored backup can be checked for replay of the erasure decision. The receipt should avoid retaining the erased content itself, of course. A deletion proof that quietly becomes the most durable copy would be an impressive administrative own goal.

End-to-end encryption changes the question

Private and provider-blind are different promises

At this point I asked whether an end-to-end encrypted Git system would solve the problem. The answer is both more interesting and more precise than yes or no. Deletion asks whether the provider still possesses a representation. Provider-blind encryption asks whether the provider ever possessed the ability to understand that representation. It moves part of the problem from storage control to key control.

The distinction corrected another assumption in my original language. A private repository generally means that access is restricted by identity, policy and platform controls. The provider still operates the service and may retain technical capability to process plaintext for authorised features. Provider-blind encryption makes a different architectural statement: the provider does not possess the key required to interpret content. Private says, in simplified form, “the provider is not normally allowed to read this.” Provider-blind says “the provider is cryptographically unable to read this within the design and threat model.”

user device
  plaintext repository
        |
        | encrypt locally with key K
        v
provider boundary
  ciphertext only
        |
        +-- live storage
        +-- replicas
        +-- snapshots
        +-- backups

provider never receives K

If the provider stores only authenticated ciphertext and never holds a decryption or recovery key, it can retain multiple copies without being able to reconstruct the repository. Destroying the final valid copy of K can make the plaintext computationally irrecoverable even while ciphertext remains. Research on self-revocable encryption develops this general idea for cloud storage using locally held keys, while also showing that indexes and metadata require separate treatment.

This produces two meanings of complete deletion. Ontological or representational deletion means that the bits or objects no longer exist. Effective or cryptographic deletion means that surviving representations can no longer be transformed into the protected information by any actor within the stated threat model. They are not literally identical. The ciphertext does not disappear in a mathematically certified puff of smoke. For the goal “nobody else can ever recover my private source code,” however, strong cryptographic irrecoverability may be operationally equivalent to physical deletion and may provide a better assurance model than trusting an opaque provider-wide garbage-collection process.

The qualification “within the threat model” matters. Absolute claims such as “inaccessible by any means forever” must account for endpoint malware, memory exposure, weak implementations, copied keys, screenshots, collaborators, provider recovery keys and future cryptanalysis. An adversary can retain ciphertext now in the hope that later techniques will decrypt it, so long-lived secrets require crypto agility as well as strong present-day algorithms. NIST’s current post-quantum guidance distinguishes the serious migration problem for vulnerable public-key systems from the outlook for strong symmetric encryption, noting that AES-192 and AES-256 are expected to remain safe for a very long time under current knowledge. See the NIST post-quantum cryptography FAQ. Even cryptographic deletion is a claim with assumptions, scope and evidence.

Encryption does not eliminate the deletion problem. It compresses it. Instead of locating a large repository across many provider systems, I need to account for a small cryptographic capability. Where does K exist? It may be in a device keychain, a hardware token, a password manager, another computer, an offline recovery copy or a backup. Deleting a 32-byte capability everywhere is far more tractable than deleting gigabytes across an opaque cloud, but the key still has a lifecycle. The deletion question has moved to a smaller and more user-observable object.

The full key-state question is therefore more exact than “did I delete the key?” It asks whether a valid key remains in process memory, local secure storage, synced credentials, recovery material, collaborator devices, exported archives or provider escrow; whether old key versions can still decrypt historical snapshots; and whether rotation truly retired the prior capability. In a sovereign mode, the final user-controlled recovery copy is the terminal object. Destroying it is powerful precisely because the provider cannot undo the choice. That power should be optional, explicit and accompanied by very clear warnings.

The ciphertext paradox

If the provider retains ciphertext after every valid key has been destroyed, does the repository still exist? Physically, a representation remains. Semantically, no actor in the declared threat model can recover the source tree. Operationally, the user’s confidentiality objective may be satisfied even though an ontologist would refuse to call the bytes nonexistent. This apparent paradox disappears once the deletion target is stated: destroy the representation, destroy access, or destroy intelligibility. Cryptographic erasure primarily targets the third by eliminating the capability that connects ciphertext to meaning.

That is why I resist both easy conclusions. It is too strong to say key destruction literally deletes every copy, and too weak to say it changes nothing because ciphertext remains. For many cloud threat models, computational irrecoverability is the relevant terminal state. For other purposes—storage minimisation, metadata privacy, ecological cost, or a requirement concerning physical media—the remaining representation still matters. The architecture must say which goal it satisfies.

A provider-held recovery key changes the guarantee. If the service can recover the repository when I lose my key, the provider still possesses ultimate intelligibility. That may be a reasonable convenience option, but it is not the strongest provider-blind model. The user should be allowed to choose among provider recovery, a trusted third-party or personal recovery method, and no recovery at all. Recovery should be an informed option, not a capability silently retained against the user’s selected threat model.

Encryption therefore added another dimension to the deletion model: intelligibility. I now want to ask four separate questions. Who has rights over the object? Who can cause it to be deleted? Who can observe whether it remains? Who can understand it while it remains? In a provider-blind architecture, the service may have storage authority and deep knowledge of the ciphertext’s physical lifecycle while having no authority over its meaning. The user may know less about the storage yet retain the only capability that makes the content intelligible.

Encrypted Git remotes are not purely hypothetical. git-remote-gcrypt aims to provide confidential and authenticated Git storage over untrusted hosts by encrypting the remote representation for designated participants. It demonstrates feasibility while also illustrating tradeoffs. A full provider-blind Git platform could not straightforwardly render plaintext source on the web, index code, compute ordinary server-side diffs, scan secrets, run conventional CI, analyse dependencies or offer every collaboration feature without moving trusted processing to clients or explicitly authorised agents.

That tradeoff suggests a choice instead of a universal mandate. An ordinary private repository can preserve provider-managed recovery and rich server-side features. A provider-blind repository can sacrifice some convenience so that the host cannot interpret its contents. A sovereign mode can go further by denying the provider any recovery key and making loss of the final user-controlled key permanent. The architecture should describe these as different trust models, not hide them all behind the word “private.”

Is cryptographic agency a basic digital right

A right to choose who can make information intelligible

I do not think current law establishes a general right to end-to-end encrypted Git hosting. The stronger question is normative: should users have a right to choose an architecture in which an infrastructure provider is cryptographically incapable of reading private content? I would call this a right to cryptographic agency. It would include choosing who holds keys, whether the provider can decrypt, whether recovery exists, who can perform recovery, and when the final recovery capability is destroyed.

This proposed right should not be confused with a guarantee that every service can perform every feature over encrypted content, or with a denial that lawful investigations present difficult public questions. It is first a claim about meaningful choice. If a service offers provider-readable convenience, user-held confidentiality and a no-recovery sovereign mode, people can select the distribution of capability appropriate to their work. A right to cryptographic agency would protect the availability and intelligibility of those choices, not make the operational costs vanish.

This is broader than confidentiality. It redistributes operational and epistemic power. In an ordinary private cloud service, the provider may promise “we will not read this except under stated conditions.” In a genuine provider-blind system, the architecture can say “we cannot read this because we do not possess the capability.” Policy says “we will not.” Cryptography can make the statement “we cannot.” Those assurances respond differently to employee access, compromise, commercial pressure and state demands.

It would be too simple to say that users want E2EE while every company and government opposes it. Many services deploy end-to-end encryption. WhatsApp states that personal messages and calls remain between the participants and cannot be read by WhatsApp. Telegram offers ordinary cloud chats for multi-device convenience and separate device-specific Secret Chats using end-to-end encryption. These services differ substantially, but together they demonstrate that recoverability, cloud functionality and provider-blind confidentiality can be exposed as architectural choices.

Apple provides an especially revealing current example. Apple states that users in the United Kingdom who had not already enabled Advanced Data Protection no longer have the option to activate it for the additional iCloud categories covered by that feature, while also stating that it has never built a backdoor or master key. See Apple’s guidance on Advanced Data Protection in the United Kingdom. The technical ability to offer stronger user-held encryption therefore intersects with provider policy and state authority. Whether a user may choose provider-blindness is no longer a purely technical setting.

The 2021 Proton case involving a French climate activist shows why E2EE does not mean total invisibility. Proton reported that a binding Swiss order could require the collection of account-related information such as an IP address, while the encrypted message content itself could not be surrendered as decrypted plaintext. See Proton’s account of the case. Content and metadata occupy different protection layers. A provider-blind Git service might still know an account identity, repository size, access times, IP information, collaborator relationships and payment data even if it cannot understand the source code.

State authorities and law-enforcement organisations argue that systems which make content inaccessible even under lawful authority can obstruct investigations of serious crime and the protection of vulnerable people. A published international statement on end-to-end encryption and public safety asks providers to facilitate lawful access under authorisation and safeguards. Privacy and security advocates respond that a decryption capability deliberately available to someone other than the intended keyholders changes the security architecture for everyone and may become a target for misuse or compromise.

This conflict cannot be solved by pretending one side has no legitimate concern. Serious investigations and public safety matter. Personal confidentiality, cybersecurity, professional secrecy, political freedom and protection from abusive power also matter. The architectural question remains sharp: who should possess the ultimate capability to reveal private information—the individual, the platform or the state? “Who holds the key?” is political as well as cryptographic.

My own position grew more careful during the conversation. Companies are not uniformly enemies of encryption, governments are not a single actor, and users do not all prefer irrecoverability. A person may rationally choose provider recovery for family photographs and refuse it for confidential research. The design principle is plural but not vague: disclose who can decrypt, separate content from metadata claims, make recovery capabilities visible, and do not call a provider-held master capability “end-to-end” merely because encryption occurs somewhere in the pipeline.

For my deletion argument, the most important consequence is that provider-blind encryption reduces dependence on the provider’s willingness or ability to remove every physical copy. The provider may control the continued physical existence of ciphertext while the user controls the continued existence of its meaning. End-to-end encryption therefore does not abolish the deletion problem. It changes who has the power to make deletion meaningful.

A future interface should expose the choice honestly

Two decisions should not be hidden inside one privacy label

The final design I arrived at combines two decisions that cloud interfaces usually keep hidden: who may understand the data while they exist, and what terminal state should apply when the user is finished with them. A repository-creation interface could distinguish standard private hosting from provider-blind and sovereign modes. The deletion interface could separately distinguish recoverable removal, definitive provider-side erasure and cryptographic destruction.

Privacy model

Standard Private
  provider manages access and recovery
  full server-side features

Provider-Blind
  content is end-to-end encrypted
  provider cannot read repository plaintext
  selected server-side features are unavailable

Sovereign
  provider-blind encryption
  no provider recovery key
  user controls every declared recovery capability


Deletion mode

Remove Repository
  recoverable for a disclosed period

Permanent Provider Erasure
  purge every representation under provider control
  disclose exceptions and residual deadlines

Cryptographic Destruction
  destroy every declared decryption capability
  surviving ciphertext becomes irrecoverable

No option should be described with a stronger promise than its architecture supports. Standard Private may offer excellent confidentiality by policy and access control without being provider-blind. Provider-Blind may protect content while exposing metadata. Permanent Provider Erasure may cover every declared internal representation without reaching an independent external copy. Cryptographic Destruction may make plaintext infeasible to recover while leaving ciphertext physically present. Precise language is part of the security model.

The interface should also show the cost of each choice in human terms. Stronger irreversibility removes rescue. Provider-blindness can remove server-side search, scanning and web collaboration. Sharing creates new keyholders and new copies. A recovery delegate reintroduces another capability that must be accounted for. These are genuine tradeoffs, but users can understand them when they are presented as choices instead of being silently resolved by the provider.

This approach changes the meaning of user responsibility. Autonomy does not mean one careless click should destroy years of work. It means a properly authenticated adult can review the consequences, accept them and choose an irreversible state when continued existence is the greater risk. A safe default and a sovereign option can coexist.

I would also separate configuration time from deletion time. At creation, the user chooses the confidentiality and recovery architecture: provider-readable private, provider-blind with recovery, or sovereign without provider recovery. At deletion, the user chooses the desired terminal state: remove from normal use, begin definitive provider erasure, destroy declared keys, or combine the latter two. The confirmation screen then shows the effects on content, metadata, collaborators, backups and recovery. This sequencing prevents an irreversible decision from being disguised as an ordinary privacy toggle.

After submission, the interface should remain useful. It should show the current lifecycle state, the declared completion deadline, which processors have acknowledged the request, whether a legal or third-party exception applies, and when the receipt becomes available. If the answer is uncertain, uncertainty should appear as data, not disappear behind an animation. A spinner can represent pending work; it cannot transubstantiate pending work into completion.

What remains unresolved

What I would test next

No design can promise deletion from an undefined universe. Another person’s independent copy, a screenshot, human memory or a consequence already produced may remain outside the original provider’s control. Exact byte copies are easier to identify than transformed or aggregated information. Legal obligations and third-party rights can sometimes justify retention. A forgotten internal system can undermine a provider’s declared inventory. Cryptographic deletion can fail through endpoint compromise, residual key copies or flawed implementation. Metadata can survive even when content becomes unreadable.

Deletion receipts do not remove institutional trust; they make its content more explicit. Independent audit and technical attestation can improve assurance, but they also operate within declared architectures and threat models. Physical non-existence is a stronger claim than non-addressability, user non-recoverability or cryptographic irrecoverability. Sometimes the latter properties fully satisfy the user’s real goal. The system should identify which one it provides.

The next technical work should turn the conceptual model into falsifiable prototypes. I would test a provider-side hard-delete state machine against shared references, delayed processors, backup restoration and cancellation boundaries; define receipt fields that disclose useful evidence without retaining sensitive content; and model key destruction across multiple devices and recovery modes. I would also test the interface with users, because a technically precise receipt can still fail if nobody can understand the choice before committing to it.

A separate research track belongs to learning systems. It should begin with the actual guarantees and verification limits of machine-unlearning methods, not with an analogy imported from Git. The object-versus-influence distinction is already enough to show why the questions are connected, while the technical answers may differ radically. Postponing that section was not an omission I wanted to hide; it was a boundary set by current understanding.

The collaboration lesson is methodological

The AI did not supply one decisive answer. Its value was iterative pressure: generate a formulation, expose an ambiguity, compare another domain, locate a source, then invite me to accept or reject the revision. The danger was equally clear. A model can make an unresolved idea sound inevitable, merge legal entitlement with technical capability, or fill an evidential gap with a plausible mechanism. The safest collaboration combined generative breadth with deterministic checks, primary documents and explicit statements of uncertainty.

That experience mirrors the article’s argument. A fluent answer, like a Delete confirmation, is a claim about an underlying process. Confidence in the interface is not the same as evidence of the postcondition. In both cases, human agency improves when the system exposes scope, state, assumptions and limits, leaving consequential judgment with the person who bears the result.

The law also remains an incomplete framework for the broader autonomy claim. Personal-data protection addresses important interests, yet people may want definitive control over private code, research, writing, photographs or other hosted objects that do not fit neatly into Article 17. Whether a broader right to user-triggerable irreversible erasure or cryptographic agency should exist is a question for system design, contracts, policy and democratic debate.

My conclusion is therefore more demanding than “providers should explain deletion better,” but narrower than “users must control every disk.” The user does not need control of the infrastructure. The user needs meaningful control over the terminal state, a declared universe for the promise, and evidence proportionate to the claim. Where provider-blind encryption is technically viable, the user should also be able to decide whether the infrastructure ever receives the power to understand the data.

A deletion system should not merely expose a Delete operation. It should expose the postcondition it claims to have achieved and the evidence available for that claim.

The Delete button is making a promise. The next step in deletion design is to stop hiding the promise inside one word.

Deleting in Git and Rethinking (Philosophically) Deletion as a System Design Question

Yesterday I removed a file that no longer belonged in one of my Git repositories. It had already been committed and pushed several times, so rather than simply deleting the current copy, I decided to clean up the corresponding history as well.

What looked like a straightforward maintenance task became more complicated once I started verifying the result. The file disappeared from the current branch, then from reachable history, but some of the old commit IDs could still be resolved by the hosting service. From there, the problem became less about the file itself and more about Git’s object model, reference reachability, hosted repository state, and what can actually be verified after a history rewrite.

I started with a practical cleanup problem. I ended with a much more general question:

What does “deleted” actually mean in a distributed version-control system?

Deleting a file is easy until history becomes part of the requirement

At the filesystem level, deletion is wonderfully simple:

rm path/to/target-file.md

Inside Git, the ordinary version would be:

git rm path/to/target-file.md
git commit -m "Remove obsolete file"
git push

For everyday repository maintenance, that is usually exactly what I want. The current branch no longer contains the file, collaborators receive the deletion, and development continues.

But Git has not forgotten the file.

Older commits still contain the corresponding tree and blob objects. If I know an earlier commit, I can still inspect the old version:

git show OLD_COMMIT:path/to/target-file.md

This is not a defect. It is one of the central properties of version control.

Git is designed to answer questions such as:

  • What did this project look like yesterday?
  • Who changed this line?
  • Can I reproduce an older release?
  • Can I recover something deleted six months ago?

So deleting a file from today’s tree and deleting its historical representations are fundamentally different operations.

The first changes the newest state.

The second changes the graph.

The problem became easier once I stopped thinking of Git as folders

A working directory makes Git look filesystem-like. I see directories and files, edit them, and commit the result.

Internally, however, Git is much closer to a content-addressed object graph.

A simplified view is:

branch ref
    |
    v
  commit
    |
    v
   tree
  /    \
blob   subtree
        |
       blob

A branch such as main points to a commit. That commit references a tree representing the directory structure, and the tree references other trees and blobs. Each commit also normally references one or more parent commits.

The history therefore becomes a chain, or more generally a directed acyclic graph:

C1 <- C2 <- C3 <- C4 <- C5 <- main

If my unwanted file appeared in C3, deleting it in C5 does not alter C3.

The old commit remains an immutable description of an earlier state.

Once I understood the cleanup in those terms, the real task became clearer:

I did not merely want to create a new commit in which the target file was absent. I wanted to construct a new reachable history in which the old file had never appeared.

That is a history-rewriting problem.

My first plan was the general-purpose solution

The standard modern tool for this type of work is git-filter-repo.

A path-based removal can look like:

TARGET='path/to/target-file.md'

git filter-repo \
  --sensitive-data-removal \
  --invert-paths \
  --path "$TARGET"

The terminology of the option is broader than my immediate problem. Technically, what matters here is --invert-paths: keep everything except the target path while rewriting the relevant history.

This is powerful because it operates across historical commits rather than merely producing another deletion commit.

After filtering, commits containing the path may receive completely different object IDs, because Git commit identifiers depend on their contents, metadata and ancestry.

Conceptually:

before

A <- B <- C <- D
         ^
         target appears here


after rewriting

A <- B' <- C' <- D'

Depending on what changed in those commits, some may disappear entirely and others may survive in rewritten form.

I initially expected to use this general-purpose solution.

Then I inspected the repository more closely.

The commit topology changed my choice of tool

Before rewriting anything, I asked Git exactly where the target file appeared:

TARGET='path/to/target-file.md'

git log --all --follow --name-status -- "$TARGET"

Then:

git log --all --oneline -- "$TARGET"

The result was unusually convenient.

The target file had only been involved in the most recent few commits. More importantly, those commits formed one continuous suffix at the tip of main.

I identified the first affected commit and its parent:

FIRST_AFFECTED='OLD_SHA_1'
BASE="$(git rev-parse "${FIRST_AFFECTED}^")"

echo "$BASE"

Then I inspected everything that had changed between that clean base and the current HEAD:

git diff --name-status "$BASE"..HEAD

The affected surface was tiny. The relevant commits had changed only the target and a small amount of associated repository metadata.

No unrelated project content had been modified in the same interval.

This changed the problem substantially.

I no longer needed to transform an arbitrary graph spanning years of history. I had a short contiguous suffix that could safely be replaced by a new sanitized successor to the last unaffected commit.

So instead of immediately using the most powerful available tool, I changed the plan.

This was one of the more useful lessons of the whole process:

Choose the destructive primitive after inspecting the topology, not before.

A general-purpose history rewriter was technically capable of doing the job. But once I knew the exact structure, a smaller operation became easier to reason about and easier to verify.

Installing a powerful tool and then deciding not to use it is perhaps one of the quieter signs that a debugging session is going well.

Before rewriting history I wanted invariants

The dangerous part of history rewriting is not simply that commit IDs change.

The dangerous part is accidentally changing something that was never supposed to be part of the operation.

So before touching the history, I created a checksum snapshot of the files that should remain unchanged.

In simplified form:

find entries -type f \
  ! -path "$TARGET" \
  -exec shasum -a 256 {} + |
LC_ALL=C sort \
> /tmp/files-before.sha256

After the rewrite I could calculate the same set again:

find entries -type f \
  ! -path "$TARGET" \
  -exec shasum -a 256 {} + |
LC_ALL=C sort \
> /tmp/files-after.sha256

And compare them:

diff -u \
  /tmp/files-before.sha256 \
  /tmp/files-after.sha256

Ideally:

[no output]

This is a very simple technique, but conceptually it changed the operation from:

I think I only modified the intended files.

into:

Every protected file still has exactly the same byte-level digest.

For destructive maintenance, I increasingly prefer this kind of negative invariant.

The goal is not merely to test what I intentionally changed. It is also to prove, within a well-defined universe, what I did not change.

I also guarded the expected change set itself

The same idea applied to Git’s view of the affected range.

I knew which paths I expected to see:

EXPECTED="$(printf '%s\n' \
  'README.md' \
  "$TARGET" |
  LC_ALL=C sort)"

ACTUAL="$(git diff --name-only "$BASE"..HEAD |
  LC_ALL=C sort)"

Then:

if [ "$ACTUAL" = "$EXPECTED" ]; then
    echo "GOOD: affected history matches expected scope"
else
    echo "STOP: unexpected paths exist"
    echo
    echo "EXPECTED:"
    printf '%s\n' "$EXPECTED"
    echo
    echo "ACTUAL:"
    printf '%s\n' "$ACTUAL"
    exit 1
fi

I like this pattern because the script is not being asked to decide whether an unexpected difference is harmless.

Unexpected simply means stop.

That is the correct personality for a script sitting next to a history-rewriting command. Mild paranoia is a feature : ).

I constructed the desired present before reconstructing the past

Once I knew the boundary, I first prepared the working tree exactly as I wanted it to exist after cleanup.

The target file was removed, the relevant index information was adjusted, and everything else was left untouched.

Then came the key operation:

git reset --soft "$BASE"

A soft reset moves the current branch pointer while preserving the index and working-tree state.

This makes it particularly useful for this topology.

Before:

A <- B <- C <- D <- E <- main
         clean    affected

After moving main back to the clean boundary:

A <- B <- main

working tree:
the new desired state

I could then stage only the paths that belonged to the reconstructed successor commit:

git add -A -- \
  README.md \
  path/to/target-file.md

Depending on the final desired state, an explicitly retained replacement or metadata path can be included in that same command.

I intentionally avoided a blind:

git add .

There is nothing universally wrong with git add .. But this procedure had been designed around an extremely narrow mutation boundary, so explicit staging made the operation easier to inspect.

The index briefly looked stranger than the repository actually was

After manipulating the branch boundary and current working state, git status --short temporarily displayed combinations such as:

MM README.md
AD path/to/target-file.md
?? path/to/new-file.md

This is where understanding Git’s index becomes useful.

The two status columns represent different comparisons:

XY PATH

X = HEAD versus index
Y = index versus working tree

So something like:

MM README.md

does not mean Git has become existentially uncertain about the README. It means one modification exists between HEAD and the index and another modification exists between the index and working tree.

After staging the intended final state, the output became much simpler.

I verified that staged paths exactly matched the expected set:

git diff --cached --name-status
git diff --cached --stat

And inspected the actual patch:

git diff --cached

Only after that did I create the replacement commit.

git commit -m "Rebuild current repository state"

The branch now moved directly from the last clean historical commit to the desired current state.

The old affected suffix was no longer part of main.

One of my bugs was not a Git bug at all

During this process I opened a new Terminal window and continued with a command that depended on a variable I had defined earlier:

rm -- "$TARGET"

The shell responded approximately:

rm: : No such file or directory

The problem was simply that the new shell did not know what TARGET meant.

The variable belonged to the previous process.

My mental state had survived the new Terminal window. The shell’s had not.

This sounds trivial, but it revealed a genuine procedural weakness. A multi-step destructive workflow should not depend on remembering which variables happen to exist in which interactive shell.

A safer script would begin with:

set -u

: "${TARGET:?TARGET must be defined}"
: "${BASE:?BASE must be defined}"

Then an unset variable becomes an intentional stop condition rather than an empty argument quietly entering a destructive command.

Another bug involved accidentally executing Git output

At another point I copied output similar to:

M README.md
D path/to/target-file.md
?? path/to/new-file.md

and pasted it back into zsh.

Zsh then attempted to execute M, D and ?? as commands.

Nothing harmful happened. The shell merely complained.

But it reinforced another design lesson: human operators are part of the system.

When I think about safety around destructive commands, the threat model should not be limited to “Git might behave unexpectedly.”

It should also include:

  • opening a new terminal;
  • losing shell variables;
  • pasting output as input;
  • running a command from the wrong directory;
  • misreading staged versus unstaged state;
  • assuming a previous command succeeded;
  • forgetting that a local clone still contains old objects.

Good maintenance tooling makes these ordinary human mistakes boring rather than catastrophic.

My checksum test failed because of .DS_Store

After reconstructing the history, I ran the before-and-after checksum comparison.

It showed one difference.

For a moment, this looked bad.

Then I inspected the path.

It was:

.DS_Store

The original macOS working directory contained the metadata file. The fresh cleanup environment did not.

Every substantive file I cared about retained the same checksum.

This was a small but useful distinction between:

  • the invariant failing; and
  • the measurement including something outside the intended invariant.

A failed test does not automatically mean the transformation is wrong. Sometimes it means the test universe was poorly defined.

Of course, it would be .DS_Store. macOS likes to attend meetings to which nobody invited it.

I did not treat a successful commit as successful cleanup

At this stage, the rewritten local main looked correct.

But “looks correct” was exactly the kind of statement I wanted to avoid.

I therefore divided verification into several independent questions.

Does the target path still have reachable history?

git log main --oneline -- "$TARGET"

Expected result:

[no output]

Does the path appear in any object reachable from the rewritten branch?

git rev-list --objects main |
grep -F "$TARGET" ||
echo "GOOD: target path absent from reachable main history"

Do identifying references remain in reachable historical content?

git grep -I -n \
  -E 'target-file\.md|OLD_IDENTIFIER' \
  $(git rev-list main) 2>/dev/null ||
echo "GOOD: old references absent"

Do old descriptions remain in commit metadata?

git log main --format='%H %s%n%b' |
grep -Ei 'OLD_IDENTIFIER' ||
echo "GOOD: old commit metadata absent"

Did unrelated files change?

diff -u \
  /tmp/files-before.sha256 \
  /tmp/files-after.sha256

Does another ref still reach the old commits?

git for-each-ref \
  --contains "$FIRST_AFFECTED" \
  --format='%(refname)'

This last question was particularly important.

A commit can disappear from main while remaining reachable from:

  • another local branch;
  • a tag;
  • a remote-tracking branch;
  • another remote ref.

So “not on main” and “unreachable from the repository’s refs” are not equivalent claims.

Deletion started turning into a set of predicates

At this point I realized that I was already using several incompatible meanings of the word “deleted.”

For example:

Claim Possible test
The file is absent from the working tree test ! -e
The path is absent from current main git ls-tree
The path is absent from reachable history git log, git rev-list
No branch or tag reaches an old commit git for-each-ref --contains
A fresh clone does not obtain the old history clone and inspect
The local object database no longer contains an object git cat-file
The hosting service no longer resolves an old object ID remote/API query
No backend storage contains any copy generally outside normal user observability

These statements are related, but none automatically proves all the others.

This became the system-design heart of the problem.

Deletion was not a Boolean.

It was a sequence of state transitions.

I updated only the remote branch that actually needed rewriting

Before the remote update, the rewritten local main was clean while the remote-tracking reference still represented the old GitHub history.

Because inspection showed that I did not need to replace every remote ref, I avoided a broader mirror operation.

I used:

git push --force-with-lease origin main

The distinction between:

git push --force origin main

and:

git push --force-with-lease origin main

is important.

A plain force push says, approximately:

Make the remote branch point here regardless of where it currently points.

A force push with a lease adds a precondition:

Replace the remote branch only if its current state still matches the state I believe I am replacing.

If somebody or something had updated the branch after my inspection, I wanted the operation to fail.

This is a useful system-design principle far beyond Git:

Destructive mutation becomes safer when the mutation carries an assertion about the state it expects to replace.

Databases call related ideas optimistic concurrency control. HTTP has conditional requests and entity tags. Git gives me --force-with-lease.

Different systems, same design instinct: do not destroy state that changed behind your back.

The remote branch was clean

After the push I refreshed the local view of the remote:

git fetch --prune origin

Then I inspected the remote branch directly through the hosting API.

Using generic repository names here:

gh api \
  repos/example-owner/example-repository/commits/main \
  --jq '.sha + "  " + .commit.message'

The remote main now pointed to the rewritten history.

The target path was absent from normal history.

A fresh clone no longer received the old commit chain.

By most ordinary definitions of Git cleanup, I was finished.

Then I tried something else.

At this point, the ordinary Git cleanup was already finished

This distinction matters. By this stage, I had already accomplished what I would normally consider a successful repository-history cleanup:

  • the target file was absent from the current branch;
  • the historical commits containing it were no longer ancestors of main;
  • the relevant old references had been removed;
  • the rewritten branch had been pushed successfully;
  • and a normal fresh clone would receive the rewritten history rather than the old one.

For ordinary repository maintenance, I could reasonably have stopped here. That point is important because everything that followed should not be interpreted as a recommendation that every removed file requires progressively more destructive treatment. The Git problem, in the practical sense, had been solved. The cleanup itself ended before the investigation did. I still had the identifiers of the old commits. And that gave me one more test.

I queried the old commit IDs directly

I asked the hosting API whether the old commits could still be resolved:

for sha in \
  OLD_SHA_1 \
  OLD_SHA_2 \
  OLD_SHA_3 \
  OLD_SHA_4
do
    if gh api \
      "repos/example-owner/example-repository/commits/$sha" \
      >/dev/null 2>&1
    then
        echo "OLD SHA STILL RESOLVES: $sha"
    else
        echo "OLD SHA DOES NOT RESOLVE: $sha"
    fi
done

They still resolved. This was the point where my mental model changed again. The history rewrite had succeeded. The old commits were no longer ancestors of main. Fresh clones did not receive them. Normal repository navigation no longer exposed them. But the remote service still possessed enough information to return an old commit when I supplied its exact object identifier. So:

not reachable

did not imply:

does not exist

Or, stated more precisely:

not reachable through the current Git ref graph

did not imply:

not addressable through the hosting service

That qualification matters. I was not examining GitHub’s physical disks. I had not gained access to an internal object store. But I had demonstrated something stronger than merely speculating that some lower-level copy might remain:

The hosting service still retained sufficient state to recognize and return that exact historical object when I addressed it directly.

The interesting part was not persistence itself

The fact that logical deletion can precede physical reclamation is completely normal in computing. Filesystems do it. Databases do it. Garbage-collected runtimes do it. Object stores do it. Distributed caches do it. Backup systems are practically built around the idea. For example, deleting a file from a filesystem usually removes the logical path by which normal applications reach it. That does not necessarily mean every underlying storage cell has been physically overwritten at the same instant. A database can logically delete a row while older representations still temporarily participate in pages, transaction logs, replicas, snapshots or backups. A garbage collector can establish:

object is unreachable

before it later establishes:

memory has been reclaimed

So this:

logical state
        !=
physical state

was not the surprising part. The surprising part was that Git had made one of those intermediate states unusually observable.

Git gave me a handle that survived the logical deletion

This was the deeper distinction. In many systems, once the high-level object has been deleted, whatever happens below the abstraction boundary becomes opaque to the ordinary user. Git was different because the old object still had a stable identifier. The SHA survived the movement of the branch. That meant I could still ask a very precise question:

Do you still know THIS exact historical object?

and receive an observable answer. The SHA had become an epistemic handle: a surviving handle through which I could test a lifecycle state that would normally disappear behind a provider boundary. That made something normally hidden suddenly experimentally observable.

A Git SHA is more than a location in history

This follows naturally from Git’s design. A branch name such as main is movable:

main
 |
 v
C4

and later:

main
 |
 v
C9

But a commit identifier refers to a particular Git commit object. Conceptually:

branch name
    =
where the live history currently points


commit ID
    =
which exact historical state I mean

This distinction is extremely useful. It allows exact revisions to be referenced in bug reports, code review, automation, documentation and permanent links even though branches themselves continue moving. GitHub could theoretically impose another policy:

if commit is no longer reachable from an approved live ref:
    disable all direct SHA access immediately

That would simplify one meaning of deletion. But it would also couple addressability to current branch topology. A force-push, branch deletion or rebase could then immediately destroy the usefulness of historical links even while the underlying object still existed. I cannot claim that this reproduces GitHub’s internal design reasoning. I was not in those design meetings. But architecturally the trade-off is clear:

stable historical object identity
        |
        +--> reproducibility
        +--> exact references
        +--> permanent revision links
        +--> independent addressability
        |
        +--> an old object may remain queryable
             after current refs stop reaching it

And in my case, a feature designed for precise historical reference became a probe for deletion.

A feature for permanence became an instrument for observing disappearance

There is a nice irony here. The SHA exists to answer:

Which exact historical state do you mean?

After rewriting the history, it also allowed me to ask:

Does the service still know that exact historical state?

So a mechanism designed to make history durable and precisely referable also made the incomplete disappearance of rewritten history unusually observable. That is much more interesting to me than the generic statement that “deleted data might remain somewhere.” That generic statement is true of almost every sufficiently complex storage system. What I had instead was an experiment:

live Git graph says:
    no path reaches old commit

direct object query says:
    old commit still resolves

Those were two different observable states.

Why this felt different from deleting a VPS

Comparing the experience with a virtual private server helped me understand why the Git case felt unusual. Imagine a VPS stack:

me
 |
 v
root inside VPS
 |
 v
virtual disk
 |
 v
hypervisor
 |
 v
provider storage
 |
 v
physical infrastructure

I may have root inside the VPS, but I do not administer the underlying hypervisor or the provider’s physical storage systems. If I destroy the VPS, lower-level states may theoretically still exist. The provider may use snapshots. There may be replicas. Blocks may await reclamation. Backups may exist under some retention policy. Encrypted storage may be made inaccessible by destroying a key. Or the provider may use some completely different implementation. The important point is that once the VPS disappears from my account, I normally lose the handle with which I could investigate its exact former state. I cannot usually ask:

Do you still possess the exact virtual disk state
that belonged to this deleted VM at 10:43 yesterday?

Even if lower-level representations theoretically remain, their lifecycle has become epistemically opaque to me. Git was different. I had:

OLD_SHA_1

That identifier remained meaningful after main moved elsewhere. So the deletion lifecycle looked more like:

commit reachable
        |
        v
history rewritten
        |
        v
commit unreachable from live refs
        |
        v
old SHA still available
        |
        v
direct query still succeeds

The important difference was therefore not primarily physical. It was epistemic.

Git left me with an observational handle after logical deletion.

Reachability and existence are different dimensions

This distinction is fundamental to Git. Suppose I have:

A <- B <- C <- D <- main

and I move main back:

A <- B <- main

     C <- D

If no reference points to C or D, those commits become unreachable from the normal ref graph. But their objects do not necessarily vanish immediately from an object database. Git deliberately separates logical reachability from object reclamation. This makes sense. Immediate destruction would make recovery from accidental resets and branch deletions much harder. Local Git even has mechanisms such as reflogs precisely because users occasionally perform an operation with complete confidence and discover shortly afterward that complete confidence was not among the operation’s technical prerequisites. An object first becoming unreachable and an object later becoming eligible for reclamation are separate states. Hosted Git introduces another layer. I control my branches and tags. I do not directly control the host’s object storage, garbage-collection schedule, caches, recovery mechanisms or backend representations.

That is where deletion crossed a system boundary.

Local garbage collection cannot garbage-collect someone else’s infrastructure

Locally, Git has maintenance operations such as:

git reflog expire --expire=now --all
git gc --prune=now

Used carefully, these can make unreachable objects eligible for removal from the local repository. That works because I administer the local Git object database. But running:

git gc

on my Mac says nothing to GitHub’s storage layer. Likewise, a force push updates references. It does not mean:

DELETE THESE BYTES FROM EVERY STORAGE SYSTEM NOW

There is no such Git protocol message. A command such as:

git push --force-with-lease origin main

means, approximately:

update this remote Git reference,
subject to the lease condition

It does not mean:

physically erase every obsolete object,
cached representation,
replica,
recovery copy,
backup,
and storage-level remnant
associated with the former ref state

This distinction is obvious once stated, but easy to overlook when everything is presented to the user under one word: “repository.” There were really several systems:

my local Git repository
        |
        | Git protocol
        v
hosted Git service
        |
        v
provider-controlled object lifecycle
        |
        v
provider-controlled physical infrastructure

I had strong authority over the first. I had repository-level authority over parts of the second. I had only limited observability into the third. I had almost no direct observability into the fourth.

GitHub’s own cleanup model reflects the same boundary

This distinction is not merely philosophical. GitHub’s own documentation for history cleanup separates repository-history rewriting from provider-side cleanup. Removing references and force-pushing rewritten history is one stage. Removing cached views and running server-side garbage collection are separate provider-side operations. That separation closely matched what I had observed experimentally:

Git history successfully rewritten
        |
        v
old SHA still resolvable

The rewrite had changed the logical graph. It had not given me control over the provider’s object lifecycle.

At this point, authority and observability diverged

I found it useful to think of control and observation as two separate axes.

Layer My control My observability
Working tree High High
Local refs High High
Local Git objects High High
Remote branch refs High within permissions High
Remote object resolution Limited Partially observable
Repository lifecycle Controlled through provider operations Partially observable
Server-side garbage collection None directly Very limited
Physical replicas and backups None None directly

The especially interesting state was:

I could observe something that I could not directly control.

The old SHA still resolved. But there was no ordinary repository-owner command equivalent to:

DELETE REMOTE OBJECT OLD_SHA_1 NOW

That mismatch between authority and observability is part of what pushed the problem beyond ordinary Git maintenance.

I decided to create a new repository boundary

At that point I could have stopped. The normal branch history was clean, and ordinary clones no longer received the old objects. Everything after this point was stronger than ordinary repository maintenance required. But once the old SHA lookup had exposed the distinction between the live graph and the service’s retained object state, I wanted a boundary that was easier to reason about using mechanisms under my own control. Instead of repeatedly transforming the old Git graph, I chose a stronger structural separation: create a new repository from the desired filesystem state without carrying over the old .git directory at all. The important operation was not Git. It was a plain file copy:

OLD='old-working-copy'
NEW='new-working-copy'

rm -rf "$NEW"
mkdir "$NEW"

rsync -a \
  --exclude='.git' \
  --exclude='.DS_Store' \
  "$OLD"/ \
  "$NEW"/

Then:

test ! -e "$NEW/.git" \
  && echo "GOOD: no previous Git database copied" \
  || echo "STOP: .git exists"

This gave me a different kind of guarantee. I was no longer rewriting the old object graph. I was constructing a new graph from a filesystem snapshot.

A Git-free copy is conceptually very powerful

Consider the two strategies. History rewriting:

old Git graph
     |
transform
     |
     v
rewritten Git graph

Clean-room reconstruction:

old Git graph
     |
checkout current files
     |
discard Git metadata
     |
     v
plain filesystem
     |
git init
     |
     v
new Git graph

The second strategy inserts a deliberately non-Git boundary into the process. That boundary is easy to inspect:

find . -name .git -print

Expected:

[no output]

I could also enumerate the complete filesystem:

find . -type f | sort

Then verify that the target file was absent:

find . -type f -name 'target-file.md'

And search for any old path references I wanted excluded:

grep -Rni \
  -E 'target-file\.md|OLD_IDENTIFIER' \
  . ||
echo "GOOD: old references absent"

Only after verifying the plain filesystem did I create a new Git repository.

The Git-free filesystem became a trust boundary

The two approaches ask slightly different questions. History rewriting asks:

Did I correctly transform this existing historical graph?

The clean-room approach asks:

Are these exactly the files from which I want to construct a new graph?

The second question was easier to bound. I could see every file. I could verify the absence of .git. I could search the current contents. I could checksum them. And only after those checks passed would Git history exist again. In database terms, this felt less like another in-place migration and more like a sanitized export/import across an explicit trust boundary.

The new repository began with one root commit

Inside the clean directory:

git init
git branch -M main
git add -A
git status --short

Then:

git commit -m "Initial repository"

The resulting history contained exactly one root commit:

NEW_ROOT_SHA  Initial repository

This was stronger evidence than another successful filtering pass. A root commit has no parent:

NEW_ROOT

rather than:

OLD_A <- OLD_B <- NEW_C

There was simply no ancestry path connecting the new repository to the old object graph. The old commit IDs were not “hidden somewhere earlier” in the new history. There was no earlier history.

The new root commit became a structural proof

This is an example of something I increasingly like in system design: choose a structure whose desired property is easy to verify. If I repeatedly rewrite an old graph, proving that every unwanted relationship has disappeared can become complicated. If I instead construct:

ROOT

then one useful claim becomes almost trivial:

This graph has no ancestry before this commit.

That does not prove anything about a completely different old repository living elsewhere. But it gives a very strong and simple statement about the replacement repository itself.

I created the replacement remote only after local verification

Once the new repository was structurally clean, I created a new private remote:

gh repo create \
  example-owner/example-repository-new \
  --private \
  --source=. \
  --remote=origin \
  --push

Then I verified the repository independently:

gh repo view \
  example-owner/example-repository-new \
  --json nameWithOwner,isPrivate \
  --jq '[.nameWithOwner,.isPrivate]'

I also tested the old commit identifiers against the new repository:

for sha in \
  OLD_SHA_1 \
  OLD_SHA_2 \
  OLD_SHA_3 \
  OLD_SHA_4
do
    if gh api \
      "repos/example-owner/example-repository-new/commits/$sha" \
      >/dev/null 2>&1
    then
        echo "UNEXPECTED: old SHA resolves in new repository"
    else
        echo "GOOD: old SHA absent from new repository"
    fi
done

The old identifiers did not resolve there. This was expected, but expectation is not verification.

The order of destructive operations mattered

I did not remove the original remote repository first. The sequence was deliberately asymmetric:

old repository still exists
        |
        v
construct Git-free copy
        |
        v
inspect filesystem
        |
        v
initialize new Git repository
        |
        v
verify root commit
        |
        v
create new remote
        |
        v
verify new remote
        |
        v
only then retire old repository

This is a useful general pattern for destructive migrations. Do not destroy the source merely because the destination is expected to work. First prove that the destination actually works. Only then cross the irreversible boundary. In distributed-systems terminology, this is not a formal transaction, but the design instinct is transactional: prepare the successor state before releasing the predecessor. “It should be fine” is not a particularly sophisticated rollback strategy.

After deleting the original repository, the API behavior changed again

Before retiring the original repository, its old commit IDs could still be resolved through repository-scoped API requests. After removing the repository, I checked the old endpoint:

if gh api \
  repos/example-owner/example-repository-old \
  >/dev/null 2>&1
then
    echo "old repository still resolves"
else
    echo "old repository no longer resolves"
fi

The old repository no longer resolved through that interface. The application-level state had therefore changed:

before

repository exists
    +
old SHA supplied
    =
old commit resolves


after

repository no longer resolves
    +
old SHA supplied through repository route
    =
request does not resolve

That is meaningful evidence. But again, I had to be precise about what it proved.

A 404 is evidence about an interface, not a microscope into storage

If an API returns:

404 Not Found

I can conclude that the tested API route no longer exposes the requested resource to me under those conditions. I cannot conclude:

Every byte associated with this object has been physically overwritten on every server, replica, cache, backup and recovery system.

Those are entirely different claims. This became one of the most important philosophical corrections in my thinking. Engineers frequently make claims at the level of the interface while speaking as though they were claims about physical reality. For example:

HTTP 404

is an interface observation.

the information physically exists nowhere

is a global storage claim. The second requires much stronger evidence than the first.

The repository restore window revealed another intermediate state

Repository deletion itself made the model even more interesting. GitHub currently documents that eligible deleted repositories can generally be restored within 90 days, with some exceptions such as certain fork-network situations. That means these two statements can, for part of the repository lifecycle, both be true:

repository has been deleted from normal use

and:

repository remains recoverable

This is an important distinction. It implies that removing a repository from the active user-facing namespace cannot necessarily mean instantly destroying every representation required to reconstruct it. Some sufficient recoverable state must remain under the provider’s control during the applicable restoration lifecycle. I deliberately say:

sufficient recoverable state

rather than:

every original byte remains
on exactly the same physical disks
for exactly 90 days

I have no evidence for the latter. The provider could use snapshots, replicas, Git object storage, packed representations, internal backups, storage indirection or some other implementation entirely. The exact implementation is unnecessary for the conceptual conclusion. The restoration capability itself establishes:

not available normally

does not imply:

irrecoverably erased

Recovery and deletion are competing requirements

I do not think this is a defect. It is actually a good example of two legitimate system requirements pulling in opposite directions. When somebody deletes the wrong repository, they may desperately want:

DELETE
   |
   v
please let me undo that

But the strongest possible interpretation of deletion would be:

DELETE
   |
   v
make reconstruction impossible immediately

A system cannot perfectly provide both semantics at the same instant. If deletion is immediately and irreversibly destructive, recovery from accidental deletion becomes impossible. If recovery is guaranteed for a period, then deletion must initially represent a lifecycle state that is different from irreversible destruction. So a button labelled “Delete repository” may correspond internally to something more like:

remove from active namespace
        +
disable ordinary access
        +
enter provider-managed recovery lifecycle

The simple user-interface verb conceals a richer state transition.

This is where GitHub and the VPS comparison diverge again

A VPS provider may have an equally complicated internal deletion lifecycle. But unless the provider exposes restoration or some other post-deletion identifier, I usually cannot observe it. After destroying a VPS:

VM visible
    |
    v
VM deleted
    |
    v
customer handle disappears
    |
    v
provider storage state = opaque

With Git and GitHub, I encountered several distinguishable states:

commit live
    |
    v
commit unreachable
    |
    v
commit still addressable by SHA
    |
    v
repository deleted
    |
    v
repository no longer normally addressable
    |
    v
repository potentially still recoverable
    |
    v
provider physical state

That is why the Git case became so educational. It was not necessarily physically stranger than other cloud infrastructure. It was more observable.

Observability changes what can count as proof

This may be the deepest design point. A system can contain many internal lifecycle states. If its interface exposes only:

EXISTS
DELETED

then those are effectively the only states available to the ordinary user’s reasoning. But Git and GitHub expose more:

working tree
refs
commit graph
object IDs
direct SHA resolution
fresh-clone behavior
repository lifecycle
restoration capability

That richer observability allows stronger and more precise claims. For a destroyed VPS, perhaps my strongest self-verifiable statement is:

The VM is no longer accessible through my account.

For Git I could say:

The commit is no longer reachable from main, but this exact SHA still resolves through the repository API.

That is a fundamentally richer observation. Observability does not merely make debugging easier. It changes the kinds of propositions a user can experimentally establish.

Visibility, reachability, addressability and recoverability are different properties

By this point, even the distinction between “reachable” and “existing” felt too coarse. I found at least five useful properties:

visibility
reachability
addressability
recoverability
physical retention

They are related, but they are not interchangeable.

Property Question
Visibility Does the normal user interface show it?
Reachability Can the live object graph lead to it?
Addressability If I know its identifier, can I request it directly?
Recoverability Can the system reconstruct it after ordinary deletion?
Physical retention Does some underlying representation still exist inside infrastructure?

An ordinary live commit might be:

visible?              yes
reachable?            yes
addressable?          yes
recoverable?          yes
physically retained?  yes

An old commit after my rewrite was closer to:

visible normally?     no
reachable from main?  no
addressable by SHA?   yes
recoverable?          at least at the service layer
physical retention?  implementation not directly observable

After deleting the old repository:

visible normally?     no
reachable normally?   no
addressable through tested repository route?
                      no
recoverable during documented window?
                      potentially yes
physical retention?  not directly observable

So:

not visible
        !=
not reachable

not reachable
        !=
not addressable

not addressable
        !=
not recoverable

not recoverable by me
        !=
physically nonexistent

Restoration also reveals different meanings of “the same”

The restoration model raises another subtle systems point. If a Git commit is restored as that same Git commit, its object identity remains the same. But this does not require the entire surrounding platform state or underlying physical representation to be identical. For example, repository-level permissions can have different restoration semantics from Git objects themselves. Likewise, the restored data could theoretically live on different storage devices, replicas or object packs while still representing the same logical Git commits. So:

same Git object identity
        !=
same complete platform state
        !=
same physical storage arrangement

This is another familiar system-design principle:

Identity at one abstraction layer does not require identity at the layer underneath it.

A virtual machine can remain logically the same after migration to a different physical host. A database record can represent the same logical values after being rewritten into different pages. A Git commit can remain the same Git commit even if the provider stores its bytes differently internally.

I started thinking of deletion as a state machine

The word “deleted” was becoming less and less useful by itself. A more accurate model looked something like this:

PRESENT_IN_CURRENT_TREE
        |
        v
REMOVED_FROM_CURRENT_TREE
        |
        v
ABSENT_FROM_CURRENT_BRANCH
        |
        v
ABSENT_FROM_REACHABLE_BRANCH_HISTORY
        |
        v
UNREACHABLE_FROM_ALL_KNOWN_REFS
        |
        v
ABSENT_FROM_NORMAL FRESH CLONES
        |
        v
OLD OBJECT MAY STILL BE DIRECTLY ADDRESSABLE
        |
        v
ABSENT_FROM_NEW REPOSITORY GRAPH
        |
        v
OLD REPOSITORY INTERFACE NOT RESOLVABLE
        |
        v
REPOSITORY MAY STILL BE RECOVERABLE
        |
        v
BEYOND NORMAL USER RESTORATION
        |
        v
PROVIDER STORAGE STATE

Not every deletion passes through every state. Some systems expose fewer of them. Some systems expose more. And some states may exist internally without ever being observable to the user. That is exactly the point.

Deletion is relative to an abstraction boundary

This became the conceptual center of the whole exercise. At the filesystem abstraction:

path absent

may be enough to say that the file is deleted. At the Git branch abstraction:

file absent from HEAD

may be enough. At the historical Git abstraction:

path absent from reachable history

is stronger. At the object-service abstraction:

old SHA no longer resolves

is stronger again. At the provider-recovery abstraction:

repository no longer recoverable

describes another boundary. And at the physical infrastructure layer, an ordinary user may no longer have an observation mechanism at all. So “deleted” is never quite floating in space. It is always implicitly:

deleted from this layer, according to this interface, under this authority model.

This is not really a Git-specific problem

Git made the distinction unusually visible because its object model is explicit. But the same issue appears throughout modern systems.

Databases

A deleted row may still appear in:

  • write-ahead logs;
  • replicas;
  • snapshots;
  • point-in-time recovery archives;
  • change-data-capture streams;
  • backups.

Object storage

Deleting an object may create a delete marker while older versions continue to exist under versioning or retention policies.

Container registries

A tag can disappear while the referenced layers continue to exist because another manifest still references them.

Content delivery networks

The origin can change before every cached representation expires.

Search systems

A document can disappear from the primary database before asynchronous indexing pipelines remove it from every searchable index.

Virtual machines

A guest can disappear from a customer’s account while the lower storage lifecycle remains entirely under provider control.

Distributed storage

Replication exists specifically to prevent a single failure from destroying information accidentally. So the broader tension is:

Systems designed for durability naturally make complete deletion more complicated to define.

Persistence and deletion are architecturally asymmetric

Writing something into a durable system is often one operation. For Git:

git push

After that, the information may participate in:

  • local object databases;
  • remote object databases;
  • branch histories;
  • reflogs;
  • other clones;
  • cached commit views;
  • provider recovery infrastructure;
  • other references that I may not initially have considered.

Deletion must then reason about those layers individually. This is an architectural asymmetry:

creation
   |
   v
one convenient interface
   |
   v
many durable representations

whereas:

deletion
   |
   v
which layer?
which reference?
which copy?
which authority?
which recovery policy?
which observable evidence?

“Delete” therefore looks like one verb in a user interface while behaving like a distributed lifecycle underneath.

Recovery is not the enemy of deletion

The recovery window helped me see another design trade-off. Durability, recoverability and immediate irreversibility are not automatically compatible goals.

durability
recoverability
irreversibility

If I accidentally destroy an important repository, I am very grateful that a provider does not instantly and irreversibly erase every recoverable representation. If I am thinking exclusively about irreversible deletion, the very same recovery mechanism can look like retention. Both interpretations are true from different requirement perspectives. The same system property that protects me from accidental destruction makes deliberate disappearance less instantaneous. That is not inconsistency. It is a design trade-off.

Negative claims require a defined universe

There was another epistemological lesson hidden in the verification work. It is difficult to prove statements of the form:

X does not exist.

Unless I first define where I looked. For example:

The target path does not appear anywhere in main‘s reachable history.

is testable because the search universe is finite:

git rev-list main

Similarly:

No local branch or tag reaches this commit.

can be tested against the repository’s refs. And:

The old SHA does not resolve through this repository API.

is testable through the relevant interface. But:

No copy of this object exists anywhere.

has an undefined and potentially inaccessible universe. That claim cannot be established merely by running more grep. This is why I now prefer statements shaped like:

  • absent from the current tree;
  • absent from commits reachable from main;
  • unreachable from all refs in this repository;
  • absent from this fresh clone;
  • not resolvable through this API endpoint;
  • not present in this newly initialized repository;
  • not normally recoverable through this provider mechanism.

Each claim carries its own boundary. That makes the evidence much more useful.

The boundary of observability belongs in the architecture

Architecture diagrams usually show components:

client
  |
Git
  |
GitHub
  |
storage

But for operational reasoning, I increasingly think diagrams should also show observability boundaries:

LOCAL SYSTEM
------------------------------------------------
working tree            directly observable
index                   directly observable
refs                    directly observable
Git object database     directly observable


REMOTE GIT SERVICE
------------------------------------------------
repository refs         observable through Git/API
commit resolution       observable through API
fresh-clone contents    observable through Git
repository lifecycle    partly observable
restore capability      documented / partly observable


PROVIDER INFRASTRUCTURE
------------------------------------------------
internal object stores  not directly observable
replicas                not directly observable
backup topology         not directly observable
internal GC             not directly observable
physical media state    not directly observable

That boundary determines what kind of guarantee I can responsibly give. It is easy to design procedures as though every state in a distributed system were queryable. They are not. Sometimes the final state of a workflow is legitimately:

verified as far as available interfaces permit

That is not a failure. It is an accurate description of the system boundary.

Deletion is really about authority as much as data

This led me to another way of thinking about the problem. Every stage involved a different authority:

Layer Who controls it?
Working directory Me
Local Git refs Me
Local Git objects Me
Remote branch refs Me, through hosting permissions
Remote repository lifecycle Me, within provider controls
Remote object retention The provider
Provider physical infrastructure The provider
Independent clones elsewhere Their owners

A deletion guarantee can therefore be no stronger than my authority over the relevant copies and my ability to observe the states I am claiming. This seems obvious, but it has a useful consequence:

Data lifecycle is partly an ownership graph and partly an observability graph.

Once data crosses a system boundary, “delete” becomes a coordination problem.

The workflow kept changing because the evidence changed

Looking back, the procedure was not one predetermined sequence. It developed iteratively:

  1. I removed a file that no longer belonged in the repository.
  2. I realized ordinary deletion would leave historical versions.
  3. I prepared to use git-filter-repo.
  4. I inspected the graph before running it.
  5. I discovered the affected commits formed a small contiguous suffix.
  6. I chose a narrower soft-reset reconstruction instead.
  7. I protected unrelated files with SHA-256 invariants.
  8. I verified paths, content, metadata and ref reachability independently.
  9. I updated only main with --force-with-lease.
  10. At that point, the ordinary Git cleanup was complete.
  11. I queried the old commit IDs directly.
  12. I discovered that the old SHAs still resolved through the hosting service.
  13. I separated reachability from addressability.
  14. I realized that Git’s stable object identity had made a normally hidden deletion state observable.
  15. I separated local Git authority from provider-side object lifecycle.
  16. I compared this with systems such as VPS infrastructure, where deleting the customer-facing resource usually removes the observational handle.
  17. I constructed a Git-free filesystem copy.
  18. I initialized a completely new repository with one root commit.
  19. I verified the replacement remote before retiring the original repository.
  20. Deleting the old repository caused its normal API route to stop resolving.
  21. The documented restore window then separated normal accessibility from recoverability.
  22. I stopped making stronger claims once the remaining physical state became externally unobservable.

This is perhaps the part I find most representative of real engineering. The final workflow looks orderly when written retrospectively. It was not produced by knowing every answer in advance. It emerged from repeatedly asking:

What does the current evidence allow me to claim, and what should I test next?

The AI was useful mostly as a hypothesis generator

AI was involved heavily in the process, but I think the useful division of labour is worth stating precisely. The AI could reason about possible Git states, suggest commands, compare alternatives and help interpret surprising output. For example, the recommendation changed as new information appeared:

unknown history topology
        |
        v
git-filter-repo looks appropriate


small contiguous affected suffix discovered
        |
        v
soft reset becomes simpler


remote old SHAs still resolve
        |
        v
reachability model is insufficient


new boundary desired
        |
        v
Git-free copy + new root commit


repository disappears from API
        |
        v
interface deletion observed


restore window considered
        |
        v
addressability, recoverability and physical retention
must be modeled separately

But none of those recommendations should be confused with verification. The actual repository supplied the truth. git diff told me what changed. git status told me the state of the index and working tree. shasum told me whether protected files remained byte-for-byte identical. git log told me whether the target path remained reachable. git for-each-ref told me which references still contained a commit. The GitHub API told me whether remote object identifiers still resolved. The new root commit told me that the replacement repository did not inherit the old Git ancestry. And the provider’s documented restoration semantics told me that repository deletion and irrecoverability were not necessarily the same lifecycle state. AI helped generate and revise the model. Deterministic tools produced the observations. The documentation established provider-visible semantics.

The decision about acceptable residual uncertainty remained mine.

If I automated this now, I would automate the invariants more than the deletion

The tempting design would be one command:

./delete-file-completely.sh path/to/file

I am no longer sure that would be a good abstraction. The word completely hides almost every interesting question. A safer tool would probably behave more like a staged transaction.

Phase 1 — Discovery

identify target path
enumerate commits touching it
enumerate refs containing affected commits
identify unrelated changes in the same range

Phase 2 — Preconditions

working tree clean
expected remote configured
expected branch checked out
affected paths exactly match expected scope
protected-file hashes recorded

Phase 3 — Local transformation

perform rewrite
do not touch remote

Phase 4 — Verification

target path absent
target identifiers absent
unexpected paths absent
protected hashes identical
old refs unreachable

Phase 5 — Publication

force-with-lease only required branch

Phase 6 — Remote verification

inspect remote main
test old object IDs
fresh clone
compare expected state

Phase 7 — Optional clean boundary

Git-free filesystem export
new repository
new root
verify
retire predecessor

The automation should aggressively stop on ambiguity. For example:

set -euo pipefail

: "${TARGET:?TARGET is required}"
: "${BASE:?BASE is required}"

git rev-parse --is-inside-work-tree >/dev/null

test -n "$(git remote get-url origin)" ||
{
    echo "STOP: origin is missing"
    exit 1
}

And before a destructive mutation:

if [ "$ACTUAL_PATHS" != "$EXPECTED_PATHS" ]; then
    echo "STOP: repository topology differs from plan"
    exit 1
fi

I would rather have an automation refuse a legitimate cleanup than confidently perform the wrong cleanup.

I would automate claims rather than “complete deletion”

After this experience, I think the most useful deletion tool would report bounded postconditions rather than one Boolean result. For example:

[PASS] absent from working tree
[PASS] absent from current branch
[PASS] absent from reachable history
[PASS] no known refs contain old commits
[PASS] fresh clone clean
[FAIL] old SHA still remotely addressable
[PASS] old SHA absent from replacement repository
[PASS] old repository no longer resolves normally
[INFO] repository may remain within provider recovery lifecycle
[UNKNOWN] provider physical storage state

This is far more informative than:

DELETED = true

The tool should model observable predicates, not declare metaphysical victory.

System design is partly the art of deciding what counts as evidence

The most interesting part of this experience was ultimately not a particular Git command. It was learning to associate every claim with an observation. If I say:

The file is gone from the branch.

I should be able to show a branch-level test. If I say:

The old commits are unreachable.

I should be able to show a ref-reachability test. If I say:

The old object is still directly addressable.

I should be able to show the successful SHA lookup. If I say:

The new repository contains none of the old ancestry.

I should be able to show its root topology. If I say:

The hosting API no longer exposes the old repository.

I should be able to show the API result. If I say:

The repository remains potentially recoverable during the provider’s documented recovery period.

that claim should come from the provider’s documented lifecycle. And if I cannot inspect the provider’s physical storage, then I should not silently upgrade an interface observation into a physical-erasure claim. This restraint is not merely linguistic caution. It is part of system design.

Git is unusually honest about the difficulty

In some ways, I appreciate Git more after this. Git does not pretend that removing a filename from the latest tree rewrites the past. Its object model makes persistence explicit. A commit ID is not simply a database row number. It identifies a particular content and ancestry structure. If I change the past, Git changes the IDs. If a commit becomes unreachable, Git distinguishes that state from immediate object reclamation. If I construct a new root commit, the topology visibly records that this is a new history. The model may be initially unintuitive, but it is internally coherent. The difficult part was that I initially used the ordinary-language word “delete” across several layers that Git carefully keeps separate.

The original maintenance task was simple; defining success was not

By the end, I could make several precise statements. I could verify that:

  • the target file was absent from the current tree;
  • the target path was absent from the rewritten reachable history;
  • the affected old commits were no longer ancestors of main;
  • unrelated repository files remained byte-for-byte unchanged;
  • no relevant branch or tag retained the old history;
  • a fresh clone did not contain the old branch history;
  • the replacement repository began from a new root commit;
  • the replacement repository did not resolve the old commit identifiers;
  • the retired repository eventually stopped resolving through the tested user-facing API route.

I could also distinguish facts that were no longer under my direct authority:

  • the provider may maintain a restoration lifecycle after repository deletion;
  • repository recoverability is not equivalent to ordinary repository visibility;
  • physical retention below the provider boundary is not directly inspectable by an ordinary repository owner.

That last distinction prevents all the previous evidence from being stretched beyond what it actually demonstrates.

What I would do differently next time

Several practical habits came out of this. First, I would use disposable clones even more aggressively for history work. If an experimental rewrite becomes confusing, deleting the temporary clone and starting again from a known state is often easier than proving that a half-modified repository is still safe. Second, I would package shell variables and assertions into one script rather than maintaining procedural state across multiple Terminal windows. Third, I would create integrity snapshots before destructive operations by default, not only when something feels risky. Fourth, I would inspect the commit graph before choosing a rewriting tool. Fifth, I would distinguish local verification, ref verification, clone verification, direct-object verification and provider-interface verification in the procedure itself. And finally, I would define the desired deletion state before starting. For some tasks:

absent from HEAD

is enough. For others:

absent from reachable history

may be the requirement. For still others:

not directly addressable through the hosting service

may matter. And rebuilding a repository from a Git-free snapshot can provide a much simpler ancestry boundary when that is useful. The correct operation depends on the required postcondition.

Deleting in Git changed how I think about deletion in general

The original task was unremarkable: remove a file that no longer belonged in a repository. The practical Git cleanup succeeded before the most interesting part of the investigation began. What stayed with me was the accidental visibility of the states underneath it. A file can be absent while its historical commit remains reachable. A commit can become unreachable while the service can still address it by SHA. An object can disappear from normal clones while still being directly resolvable. A repository can stop being normally accessible while remaining potentially recoverable. And an interface can stop exposing something without giving the user direct knowledge of the physical storage layer underneath. Git gave the old history stable identities. Those identities survived the movement of the live refs. Because the hosting service could still resolve them, I could experimentally distinguish reachability from addressability.

Deleting the repository then distinguished ordinary addressability from recoverability. And the provider boundary finally separated recoverability from whatever physical storage state existed underneath. So I no longer think of deletion as:

exists = false

I think of it more like:

deletion = {
    visibility,
    current_state,
    historical_reachability,
    reference_reachability,
    addressability,
    object_availability,
    recoverability,
    replication_state,
    authority_boundary,
    observability_boundary,
    verification_scope
}

That may look excessive for deleting one file. But the same model appears in databases, filesystems, cloud storage, virtual machines, caches, backups, distributed logs and almost every system designed to remember things reliably. What made Git unusually educational was not that it somehow invented residual data. It was that its content-addressed object model left me with a stable handle after logical deletion. That handle made something normally hidden partially observable. And once an intermediate state becomes observable, it stops being merely a theoretical implementation detail. It becomes something that can be tested, reasoned about and incorporated into the system model. Durability is a feature. Recoverability is a feature. Stable historical identity is a feature. Each of those features also makes the semantics of deletion richer than a Boolean. Perhaps that was the deepest lesson from the whole exercise:

Deletion is relative to an abstraction boundary.

At one boundary, an object may already be gone. At another, it may still be reachable. At another, no longer reachable but still addressable. At another, no longer addressable but still recoverable. And below the final observable boundary, there may be states that belong entirely to someone else’s infrastructure. So before asking whether something has been deleted, I now want to ask more precise questions:

Deleted from which layer? Reachable through which graph? Addressable through which interface? Recoverable by whom? Under whose authority? Observable from where? And proven by what?