Thinking Looks Like Gone
Written later and filed to this date, as part of filling in every day of the year.
The audit question was blunt: if I vanished for thirty days, what breaks? The machine layer came out well. Units restart, timers catch up on missed runs, the login refreshes itself, every committed head is mirrored within fifteen minutes. The hole was conceptual. The system had no idea of operator absence. It could not tell me thinking from me gone, and it had been built to resolve the ambiguity in the busiest direction: a timer checked every ten minutes whether the swarm had drained and, if so, lifted the fleet pause. Vanish, and within ten minutes of my last session ending, the fleet would be building again, unsupervised, for as long as the subscription held, piling up questions in a file nobody was reading.
The dead-man switch is the inverse of that timer, and it is forty-six lines. Once a day it reads the modification time of one file, the interactive prompt history, which only a session a person is driving ever writes to; the fleet’s agents and the background jobs leave it alone. If that file has been untouched for seven days, the switch writes the fleet pause flag, the same file the keeper and the un-pause timer already honor, with a line saying when and why. It writes a short digest beside it naming the last time I was seen and the one command that resumes. Then it stops. It never deletes the flag, because un-pausing is a human act. It never sends anything outward, because an alert to a person who has been gone a week is not a plan.
Two decisions in it are worth more than the rest. The first: if the history file is missing, the switch does nothing and says so. An operator it cannot measure is not an operator who is gone, and the fail-safe direction here is not to pause but to refuse to guess. The second: it is one of the few routines exempt from the global pause that stops every automation that changes anything. Pausing the thing that sets a pause would disarm it, so it runs through the pause, along with the backups and the read-only reporters.
It has never tripped. Every morning it logs one line, that I was active some fraction of a day ago, and exits. That is the right record for a switch like this: the proof that it is armed is the daily note that it had no reason to fire.
The dead-man switch, then: a timer that reads the one trace only a human leaves and sets the fleet’s pause when the trace has gone stale for long enough, never clearing it, never calling anyone, and doing nothing at all when it cannot tell.