Multiple entry points usually mean more choice. Different suppliers, routes, information sources, and payment methods can substitute for one another; when one fails, the other paths keep working. Competition may also improve price and quality.
Quantity, however, is not independence. Three service brands may share a single warehouse; two roads may cross the same bridge; multiple records may derive from the same database. In ordinary times the differences are real; when a shared condition fails, they vanish together.
We continue with the fictional regional service network. In the previous chapter its managers retained two delivery firms, three ordering entry points, and a paper contingency list, believing redundancy had been restored. After a local disruption they discover that both delivery firms depend on the same sorting center, that all three entry points call the same identity service, and that the paper list requires route numbers generated by the central system. The number of backups did not deceive them; the judgment of independence was aimed at the wrong object.
This thought experiment describes no real infrastructure and offers no method for inducing failures. It discusses only dependency graphs, common-mode failure, recovery sequencing, and responsibility. Where real critical systems are concerned, concrete safety design must be handled by professional institutions.
Path Count Says Nothing About Independence
Cooperative networks pursue scale and specialization. A shared warehouse reduces duplicate inventory; a unified identity service spares everyone multiple accounts; central route data improves coordination. Shared dependencies usually arise from genuine efficiency, not from hidden defects. When all paths converge on one link, local efficiency and overall fragility increase together. In calm periods the savings are easy to see; correlated loss appears only when the shared condition is damaged. Users see three applications and assume three ways of ordering; if every login requires the same identity service, diversity at the entry layer cannot answer a failure at the identity layer. After an order succeeds it must still be sorted, transported, delivered, and settled, and each layer has its own dependencies. The dependency graph need not exhaust every technical detail. First determine the critical tasks, then mark which nodes are jointly invoked by multiple paths, which failures block continuation, and which can be handled manually or deferred. The graph can itself manufacture false certainty. Undiscovered dependencies, personnel relationships, and contractual terms do not appear automatically. It is a review instrument, not proof that the system is already safe. The complete path also includes recovery. A backup entry point may accept orders yet lack the permission to modify central state; during a failure it merely multiplies duplicate requests. Being able to start is not the same as being able to complete the task in reality.
The two delivery firms are both delayed in a rainstorm—perhaps because each faces its own blocked roads, perhaps because the shared warehouse has closed. The outcome is the same; the repair is different. A common cause makes losses correlated: one change in condition strikes multiple superficially independent objects at once. Coincidental simultaneity, by contrast, may still be reduced by separate improvements. Sharing a brand does not entail sharing all facilities, and differing brands do not guarantee independence. Contracts, procedures, actual routes, and event records are what show dependency. A single simultaneous failure can only signal a problem, not prove a stable correlation. Repeated patterns, node records, and comparisons carry more weight. Thought experiments establish concepts and provide no real-world probabilities. Conversely, a long absence of common failures does not prove absence. If the critical condition has simply remained stable, the dependency has not yet been triggered. Moderate testing and scenario review supplement the historical record. Testing itself can affect service; it should be graded by consequence and designed by professionals. This chapter does not treat "inducing failures" as general advice; it asks only that organizations possess verifiable recovery materials.
The two delivery firms are run by different companies, and their contracts are signed separately. The regional managers count them as two sources of supply on this basis. Ownership shapes incentives and accountability, but it says nothing about whether warehouses, power, networks, equipment, or personnel are shared. Functional independence requires observing the conditions needed to complete the task. A supplier procures from different contractors, and the contractors in turn draw on the same upstream. Every company can honestly say it has multiple partners while the end of the chain still converges. Demanding full disclosure of commercial and security information is unrealistic. Purchasers can require disclosure of critical dependency categories, proof of substitution, and controlled audits, without exposing sensitive detail to everyone. Multiple suppliers also carry coordination costs. Divergent specifications, dispersed inventory, and disputes over responsibility can degrade everyday quality. A deliberate concentration is sometimes more reliable than formal plurality—provided one knows where the concentration lies and builds proportionate recovery. Responsibility cannot dissolve through layers of outsourcing. Whoever chooses the supply structure, whoever holds the critical facts, and whoever promises continuous service should each bear the corresponding duties of explanation and repair.
The service network's three dashboards display inventory, delivery, and community demand respectively, and appear to check one another. It later emerges that all three read the same central address table, and an address error enters all three judgments at once. Different interfaces and different computations may still rest on a common underlying fact. When several conclusions agree, the agreement may indicate that reality is stable—or that the inputs were shared. Two teams processing the same data with different models provide a comparison of methods but cannot discover what the data failed to record. Two sources using the same method may discover differences in input. The two kinds of independence solve different problems. Human observation is not independent by nature. Staff may consult the same notices, receive the same training, or copy from one another under pressure. A paper record may be nothing more than a printout of central data. Retaining a channel for local correction can surface central errors, but local records then diverge and update slowly. A system should state when local fact takes precedence and how disputes are merged, rather than treating any dispersion as real. Critics, too, may use "all information shares a common source" to dismiss evidence. Complete independence rarely exists in social knowledge; what matters is whether the relevant dependencies are strong enough to change the conclusion, and whether the channels for counterevidence are diverse.
Delivery still has vehicles and inventory, but the settlement service is suspended, and the supplier will not release goods without confirming payment. The physical route exists; the transactional relation cannot continue. In another scenario, identity authentication fails and users cannot prove eligibility. The service is not out of resources—the institutional paths into the resources are concentrated. Licenses, insurance, settlement, identity, communication, and decision authority can all become common nodes. Physical backup alone misses institutional continuity. Manual exceptions can sustain critical services in the short term, but over-broad permissions multiply errors and abuse. Objects, records, and review should be circumscribed in advance rather than left to frontline staff to shoulder privately at the moment of failure. Cash, offline credentials, or local confirmation sometimes provide alternatives; their actual feasibility depends on real-world security and legal requirements. This chapter only points to the dimension of substitution and offers no operating plan for critical systems. Path concentration also affects dissent. If every service entry point consults the same eligibility determination, a single dispute can close several kinds of opportunity at once. Technical reliability and the constraint of power must be assessed together.
The regional station has backup vehicles yet must wait for central approval to change routes. When roads are blocked, the equipment is available and the decision cannot be issued. Centralized authority prevents conflict and unauthorized action, especially where information is complex or risk is high. Devolving every decision does not automatically increase resilience. When the center is unreachable, local units may take temporary measures within clear boundaries and record their reasons. The center reviews afterward, rather than the exception hardening into permanent unsupervised power. Local units may also lack global information: a detour affects other regions. Layered authority should state which tasks can be completed independently, which must wait, and how high-consequence needs are protected while waiting. If the same person holds approval, information, and resource dispatch, that person's absence can block several layers at once. Cultivating alternate roles and handovers has value, while also avoiding situations where several people each assume another is responsible. Concentrated power may also be used deliberately to filter who can continue to act. Establishing that such domination exists requires records of decisions and evidence of consequences; even absent malice, an unappealable single point should still be repaired.
Concentrated Benefits and Common-Mode Failure
A shared warehouse can sustain specialized equipment and training; central dispatch can see region-wide demand; unified data reduces duplicated error. Small stations each building full capability would be expensive and uneven in quality. Resilience is therefore not the dispersal of everything. Dispersal likewise produces coordination delays, standards conflicts, idle waste, and blurred responsibility. Efficiency gains accrue to the whole region; failure of a common node also afflicts the whole region. Managers should fold recovery, backup, and blast radius into cost, rather than comparing only the unit price of normal periods. Some functions suit centralized specialist handling with a minimum of local continuity capability; some low-risk tasks can be shared outright. Structure follows consequence and substitution, not a moral preference for concentration or dispersal. Scale can also accumulate experience. A center handling more cases finds patterns more readily; local units know the concrete context better. Correction in both directions beats either side's monopoly on fact. Concentrated facilities require investment; redundancy likewise requires maintenance. If the public budget will not pay for protection invisible in ordinary times, then the acceptable interruption should be stated honestly, rather than paper backups promising capabilities that do not exist.
Users can choose between two delivery firms on price and service, and competition has genuinely improved the interface and responsiveness. The shared warehouse still makes the choice vanish simultaneously in a disaster. This does not mean the competition is fake. It works along some dimensions and falls short along the dimension of continuity. Evaluation should name its object. With many suppliers, if switching requires the same settlement, eligibility, or equipment, users still have no substitute at the critical moment. Conversely, independent paths inside a single institution can sometimes provide real recovery. Regulation or procurement that counts plurality by number of brands may reward formal split-offs. More reliable review asks whether critical tasks can continue after common nodes fail. Fully independent supply chains are costly and may exclude small institutions. Policy can require disclosure of concentration, tiered backup, and shared infrastructure burdens, rather than mandating duplication of everything. Users usually cannot investigate deep dependencies, and the error of choice should not be laid entirely on individuals. Providers and coordinators hold more information and bear the greater duty of explanation.
The service network, seeing that a paper list exists, reduces other preparations. During the interruption the list cannot generate valid route numbers; it not only fails to help, it delays the discovery that there is no backup. The losses of a false backup include wasted resources, false confidence, and delayed recovery. It can be more dangerous than openly having no backup. Checking that a document exists does not prove usability. One must see whether personnel know their duties, whether materials are current, whether permissions are valid, and whether dependencies genuinely differ. Drills should not chase theater. Small-scale, reversible, controlled verification can find problems; testing of critical systems must follow professional norms and safeguards, and this book does not supply the procedures. A successful test also has an expiry. After personnel, suppliers, and technology change, old results cannot represent the present indefinitely. Review frequency follows change and consequence. Failure records should not punish only the executors, or the organization will learn to hide problems with its backups. Distinguishing honest discovery, maintenance neglect, and deliberate falsification is what lets responsibility promote learning.
After the identity service is suspended, orders pile up; on restoration a flood of duplicate requests enters the system, inventory judgments lag, and delivery staff face conflicting addresses. The original fault has ended; the congestion that follows persists. Correlated losses do not merely occur simultaneously—they can propagate in dependency order. One layer's delay changes the next layer's input, and the consequences exceed the original node. Handling the largest volume of orders first raises overall speed; handling medical and isolated areas first protects high-consequence needs. Technical recovery embodies priorities and cannot be left to queue defaults alone. Different values may conflict. Urgency-first lengthens ordinary users' waits; remoteness-first may lower unit efficiency. Rules must be stated in advance, while allowing documented correction from the field. Information is scarce during recovery; promising precise times may manufacture further error, while total silence leaves users unable to plan. Updates with stated uncertainty are more honest than false precision. Afterward, statistics that count only system-recovery time will miss the extra labor that households, communities, and frontline staff absorbed to keep life going. The boundary of loss should follow the task to its completion in reality.
Residents receive contradictory notices from several agencies and gradually stop believing any update. The next time, even if the information is accurate, they may delay action. A technical failure has become a relational loss. Trust is not a button; it cannot be rebuilt immediately by announcing restoration. It comes from repeatedly verifiable commitments, admission of error, and remedy. Some residents turn to acquaintance groups to exchange information, which may raise local mutual aid—or leave different groups holding different facts. Social fragmentation has many causes; one cannot infer violence or total collapse directly from a single service failure. The failure of a common path may disappoint several groups at once and increase the appeal of closed networks; this is one feedback hypothesis that requires testing. It can neither by itself explain the whole rupture of trust nor imply that conflict will inevitably spread along the same path. Local networks are not tribes to be eliminated. They provide context, backup, and relational support. The danger appears when internal information cannot be rebutted, when outward relations reduce to hostility, and when local conflict gains unbounded transmission. Restoring trust requires simultaneously providing centrally verifiable records and channels for local feedback. Slogans of unified truth are insufficient, and multiple sources do not cancel evidential standards.
The service network distributes all inventory to the stations, hoping to avoid central failure. The stations, sharing the same budget, then cut backups simultaneously, or all depend on the same trainer. The structure changes; the correlation remains. Dispersed units may also imitate one another in crisis, curtailing service together as each sees its neighbor do so. Common information and common incentives form a new synchrony. Exchanging no information at all would duplicate errors and forfeit mutual aid. Resilience requires partially independent judgment and coordinable interfaces—not making every node an island. A single standard eases collaboration but may propagate a single error; multiple standards preserve difference while adding translation. One can layer core facts, interfaces, and local interpretation. Diversity maintained only for form, whose maintainers do not understand the backup methods, falls back to the familiar path at failure. Capability requires exercise and actual use, not merely a second option in a document. No structure eliminates all correlation. The aim is to identify the unavoidable common conditions, to bound their blast radius, and to preserve genuine recovery for high-consequence tasks.
A common entry point can be exploited by managers: suspending one eligibility determination restricts several services at once; controlling one information node sways many judgments. This is a risk of power that follows from path concentration. But the risk does not prove that any real actor has done so. Access records, decision processes, consequence patterns, and alternative explanations are needed. Writing every concentration as conspiracy weakens specific audits. Even where concentration arises from efficiency, one can limit its uses, separate authorities, and retain appeal and minimum continuity. Repair need not wait for proof of malice. If deliberate exploitation exists, responsibility is aggravated—but operable control schemes should not be disseminated. What this book discusses is which boundaries to examine: whether common nodes can punish across domains, whether subjects can learn the reason, and whether independent paths can genuinely continue. Anti-concentration rhetoric can also be used to evade common standards and shield local power from oversight. Dispersed institutions equally require evidence, accountability, and external review. Power analysis and reliability analysis intersect without substituting for each other. A system can be technically stable and closed in its power, or dispersed in its power and technically fragile.
Auditing Substitution Against the Actual Task
The service network redefines backup: not possessing a second name, but still being able to complete the task from request to delivery for a defined population when the critical common nodes are unavailable. Managers mark the shared warehouse, identity, settlement, communication, and authority dependencies, and set proportionate substitutes or continuity protection for high-consequence services. What cannot be substituted is published with recovery targets and priorities. A single supplier cannot solve a regional bridge or a common identity service; coordinators should shoulder cross-organization review. Suppliers remain responsible for their own declarations and internal recovery. Users receive the explanation relevant to their decisions without touching sensitive architecture. Independent oversight can verify critical backups under confidentiality, avoiding a forced choice between security and transparency. Recovery records include technical times, unfinished tasks, labor transferred to households and communities, error correction, and relational impact. The closer the indicators come to reality, the harder it is to pass off interface recovery as recovery of life. The gains of concentration are also still recorded. If a shared facility has long been reliable and markedly cheaper, the organization may keep it while honestly owning its failure radius. Resilience is not unlimited spending against every imaginable risk.
Two systems use different equipment yet must both complete maintenance in the same week; three suppliers' inventories all depend on the same monthly replenishment. Space and ownership are separate; the critical times still coincide. Temporal concentration makes ordinary backups unavailable simultaneously in a particular window. Recovery analysis must look at deadlines, maintenance, staff shifts, and resource replenishment—not only static nodes. A backup path that cannot take over immediately but can recover in two days still provides a real choice for ordinary tasks; for non-interruptible tasks it needs faster protection. Independence is not simply present or absent; it also includes time. Staggering maintenance reduces common windows and adds coordination and expense. Some updates must be synchronized for compatibility and cannot be forcibly split for the sake of dispersal. The reasons and consequences of synchronization should be published. Time commitments may also jointly depend on the same forecast. Institutions cutting staff on identical demand estimates fall short together when the busy season arrives. Multiple methods of judgment and local feedback provide correction. Past success easily obscures temporal concentration, because the critical window has not yet come under stress. Scenario review needs explicit assumptions; imagination must not be passed off as probability of occurrence.
Two warehouses sit in different districts yet coordinate through the same bridge, energy node, or communication gateway. Distance has increased; the critical dependencies need not have changed. Conversely, adjacent facilities with independent personnel, inventory, and authority may take over for each other in a local failure. Geography is only one layer of dependency. Placing all backups in resource-rich regions yields statistically sufficient capacity while remote areas lose effective protection to arrival time. Path assessment should start from completion time for those served. Building full capability in every region is costly and may decay from disuse. Mobile resources, cross-region agreements, and minimal local capability each have conditions and must be chosen by task. Regions may also contend for the same backup in a crisis. A paper agreement without priorities and decision authority lets several regions each count the same resource as their own redundancy. Priority rules necessarily embody values. Population, urgency, waiting, and historical shortfall can point to different outcomes; they should be debated in calm periods and reviewed afterward.
The common identity service is used not only for delivery but also links community courses and subsidies. One failure strikes supplies, learning, and income together; the substitutes available in life tug at one another. Cross-domain integration reduces duplicate applications and may genuinely improve accessibility. It also lets the consequences of a single point cross beyond the original task. A delivery identity dispute need not automatically suspend courses, and a settlement failure should not cancel verified eligibility. Separating shared facts from consequence switches can bound correlated loss. Complete isolation would force subjects to prove themselves repeatedly and multiply inconsistency. Verification results can be shared while each domain retains independent decisions, caches, and channels of correction. A cross-domain map should also include what households and communities absorb. When formal systems pause together, personal relations become the common backup; if every institution draws on the same corps of caregivers, the social path is equally concentrated. This connects to the transfer of care responsibility in the next volume: technical recovery cannot come at the cost of unpaid networks of relation absorbing every interruption. Correlated loss must be charged to its ultimate bearer.
After completing a dependency review, the service network files the graph in the archive. Within half a year suppliers change downstream partners and personnel authorities are adjusted; the graph still shows the old paths. The record's existence leads managers to lower their guard. Dependency is not a label intrinsic to equipment but a relation that changes with contracts, procedures, and patterns of use. The inventory needs events that trigger updates and a named maintainer. No organization can discover every condition. A report that lists only known nodes without stating coverage and date mistakes the unknown for the nonexistent. Honest demarcation of scope helps decide the available margin of protection. Suppliers may be unable to disclose fully for commercial or security reasons. Controlled audits, category disclosure, and failure notifications can partly resolve this; transparency need not mean displaying abusable detail to the public. Frontline staff are often the first to see actual paths diverge from the documents; they should have a channel to submit changes without automatic punishment for exposing problems. Unverified reports, in turn, cannot immediately rewrite the whole structure; they require review. Maintaining the dependency graph itself takes personnel, tools, and budget. Assembled ad hoc after each crisis, it repeatedly loses knowledge; given unlimited input, it squeezes real services. Update frequency follows the speed of change and the consequences of failure.
The most reliable inventory is not the one claiming completeness but the one that can state its most recent verification, its principal unknowns, its responsible parties, and its next review. It keeps concentrated risk under continuing observation without issuing a permanent certificate of safety.
The next chapter discusses how success closes off observation. A common node with a long history free of failure is the one most easily certified as needing no substitute by that very success; the longer the success persists, the more anyone raising the risk seems out of touch with reality. Multiple entry points may also share a fragile base: a system can offer many brands, interfaces, and contracts, letting participants experience real choice while routing the identity, money, information, and decisions needed to complete tasks into a few common nodes. Diverse in ordinary times, contracting simultaneously at the critical moment; if the common nodes also control interpretation, the correlated loss can be attributed to each individual user. Critique cannot write off concentration wholesale as degeneration. Specialization, scale, and coordination create real order, and total dispersal also manufactures costs and new synchrony. Reliable judgment traces dependencies along the task, distinguishes source from method, verifies the backup's capacity to complete, limits the extraneous power of common nodes, and follows recovery into real life. Paths may converge—but the price and the boundaries of convergence must remain visible.