At the end of Chapter 18, the ledger had four columns: current costs, future beneficiaries, irreversible items, and terms of responsibility. Yet the whole ledger presupposes something it never registers itself — that the people who keep the accounts are still at their posts, that the institutions verifying the evidence are still running, and that those harmed can still find the door of appeal. The New Shore Plan's illustrated brochure carries, at its back, a transition-period arrangement: to accommodate construction, some services will be "simplified or suspended during the transition." It is precisely this unremarkable annex that poses the question of this chapter: in the course of transformation or collapse, which functions may not be suspended, and on what basis is that decided. The question stands only one step from "drawing up a list of basic functions," yet the two must be kept apart. Checklist thinking assumes that criticality is written into the function itself and that committing it to a document settles the matter once and for all; what this chapter offers instead are criteria rather than items — whether the consequences of suspension are reversible, who bears the costs of suspension, and whether the conditions on which recovery depends are themselves suspended by the same decision. At the same time we must confront a severe corollary head-on: the category "must be retained" can be used by institutions in reverse, exempting themselves permanently from reform and review. To evade this corollary is to write only half of the concept.
Normal Operation and the Three Criteria of Suspension
The New Shore Plan's brochure depicts the harbor district ten years on, while the annex lists "transition-period simplification items": security verification is merged into quarterly execution, community care stations go from daily to weekly, complaint intake in the construction zones is relocated to centralized points, and waterfront water supply runs at reduced pressure during the rebuilding. Each item, taken alone, is an engineering arrangement; taken together they constitute a mortgage on normal operation — treating existing functions first as a deposit that may be overdrawn, to be repaid once the vision is realized. To judge a plan's real attitude toward continuance, one does not look at the promises in the overview but at what the annex tacitly assumes may be stopped.
"The harbor cannot stop" is a sentence that four kinds of subject can borrow at once: the channel cannot stop (the function), the channel's administrator cannot be withdrawn (the institution), the dispatch center cannot be moved (the site), and the current staffing cannot be touched (the personnel). The criticality of these four levels is not the same. If discussion remains at the generic name "the harbor cannot stop," the strongest functional criticality flows automatically onto the weakest bearer, providing cover for the latter's exemption from interrogation. Throughout this chapter, whenever we speak of basic functions, we name function, institution, site, and personnel separately; the entire argument about criticality claims that follows depends on this initial distinction.
One easily confused level should be clarified in advance: to say that a function cannot be suspended is not to say that its current practice cannot be modified. Care must continue, but the manner of care can change; verification must not be interrupted, but its frequency and scope can be adjusted. Substituting "retain the status quo" for "retain the function" is the first move of the institutional rhetoric this chapter will later criticize. Continuity at the level of function and revisability at the level of practice coexist; the moment the two are merged, the space for reform has already been quietly confiscated.
Taking Jiawan Harbor as a thought experiment, this chapter concentrates on the four kinds of function most often suspended in transformation plans: verification (whether evidence is still independently checked), care (whether those who have lost the capacity for self-help are still looked after), the error-correction entry point (whether those who discover errors still have a channel that can change something), and basic supply (the minimum continuance of water, food, passage, and information). These four are chosen not because they exhaust basic functions, but because each represents a distinct structure of suspension's consequences: suspending verification renders the accumulation of errors invisible; suspending care falls directly on bodies; suspending the error-correction entry point strips all other suspensions of any means of correction; suspending basic supply takes away the very conditions of the discussion.
Criterion One: Are the Consequences of Suspension Reversible
Suspension as such does not constitute harm; the question lies in the shape of its consequences. Suspending a service for two weeks and restoring it unchanged is a decision of an entirely different kind from suspending it for ten years and then attempting restoration: the former is dispatch, the latter liquidation. The test does not ask "can it stop" but "once it has stopped, have the conditions required for recovery stopped with it." A suspension in which the archives remain, the personnel remain, the skills remain, and the relationships remain is not, ethically, the same kind of thing as one in which these conditions of recovery vanish in step.
Strictly speaking, there is almost no absolutely reversible suspension and no completely irreversible one; reversibility is a curve that varies with time and with object. The same interruption of verification is a matter of delayed checking for warehouse records, but a matter of a missed window for the cumulative pollution of incoming water; the same reduction of care is a minor inconvenience for someone with family support, but a continuous bodily risk for a person living alone. The criterion is therefore not to label functions reversible or irreversible, but to require that whoever suspends state clearly: within what span of time, for which objects, and at what cost the consequences can still be reclaimed. A suspension arrangement that cannot state this curve should be interpreted on its least favorable construction.
Chapter 13 treated reversibility as the ethical weight of waiting, as a means of judging a single decision; here the same judgment must be carried down to the level of function. The difficulty of restoring a function lies precisely not in hardware: a care station can reopen, but the relationships of care — who knows whom, who trusts whom, who knows how to soothe a person in panic — are not stored in the building. A verification laboratory can be rebuilt, but once the calibration chain is broken it must be re-established from zero. To judge the reversibility of a suspension, one asks how long the unstoreable portion of the function can hold out: skills depreciate daily, trust drains away week by week, and those being cared for weaken irreversibly in the vacuum of care. What recovery requires, the answer often runs, is "exactly those things that must not stop during the suspension."
Chapter 18 established an irreversibility column for the cross-period ledger and prescribed a reversal of the burden of argument: once an irreversible item is entered, it falls to the expropriator to prove that no substitute exists and that avoidance and alternative options have been compared. If the consequences of a suspension are irreversible, they should likewise be entered as an irreversible item and held to the same threshold. "Transition-period simplification" is the part of a transformation plan most likely to escape this threshold, because it appears to demolish nothing — it merely lets certain things slowly cease to hold over ten years. The ledger must be able to see this demolition without demolition.
Criterion Two: Who Bears the Costs of Suspension
The bookkeeping cost of "transition-period service simplification" is often zero, because the cost does not appear in the form of expense: after verification is merged, the interval for discovering a record error grows from a day to a quarter; after the care station goes weekly, an elderly person living alone faces a six-day gap between one opening of the door and the next; after centralized intake points are set up, the round trip to lodge an appeal doubles for those with limited mobility. These costs enter no plan budget; they enter only the time of particular bodies and particular households. The first step in judging whether a suspension is acceptable is to translate "simplification" back into the bearer's language: who, for how much longer, in what form, is exposed to what.
The benefits of suspension are usually universal and thin — shorter construction times, budget savings, a steeper progress curve — while the costs are concentrated and dense. Chapter 18 already treated the justificatory function of this arithmetic; what must be added here is a concealment peculiar to suspension: expropriation at least takes the forms of notice and compensation, whereas suspension does not even have these forms; in the names of "simplification," "transition," and "the temporary," it bypasses the burden of argument that expropriation ought to carry. Any arrangement that substitutes suspension for expropriation should bear at least the argumentative obligations of expropriation: name the beneficiaries, specify the bearers, and explain why the matter cannot be handled by compensation rather than interruption.
If the same subjects have already lost horizontal support in the previous round of liquefaction — Chapter 17 traced how the severing of trust and the withdrawal of mutual-aid organizations delivered costs straight to individuals — and the present suspension happens to fall precisely on the public functions on which they alone still rely, then the effective intensity of the suspension is, for them, doubled. The ledger's principles of itemizing by subject and accumulating by history apply equally to suspension: for repeat bearers, the threshold for suspension should be higher than for first-time bearers, rather than taking the city-wide average. Equal apportionment sounds fair; in effect it re-executes historical inequality.
Criterion Three: Whether the Conditions Recovery Depends On Are Also Suspended
Basic supply depends on verification (who is checking water quality and power distribution), verification depends on the error-correction entry point (to whom those who find exceedances report, and whether reporting can change anything), and the error-correction entry point in turn depends on basic supply (appellants need time, transport, and a life not reduced to exhaustion). The four kinds of function are not parallel items on a list but a structure of dependency: suspend the lower layer and the upper layer halts automatically; preserve only the upper layer and the lower leaves it nothing to bear on. Identifying the functions that must be retained is in fact identifying the nodes in this structure where one stop stops all.
Above the dependency structure there is one further layer: the capacity that makes the recovery of other functions possible — archiving, training, cross-departmental memory, review personnel who can be reconvened — is itself a function, and one whose suspension has the most hidden consequences. When it is suspended there is no immediately visible loss; the loss appears on the day of recovery, when people discover that the conditions for starting again are already gone. How a transformation plan treats the capacity for repair — whether it retains it, transfers it, or lets it disperse — reveals its real view of time more tellingly than its treatment of any single service.
The reason the error-correction entry point must be retained is not that "oversight" is exalted in value, but that it is the means by which every other suspension obtains correction. Once the error-correction entry point is suspended, the remaining suspensions turn from "temporary" into "pending," and from "pending" into "accomplished fact" — errors no longer need to be defended, only outlasted. A plan that closes the error-correction entry point during the transition is, whatever restoration deadline its annex may state, in effect using time to complete the consolidation of the errors' title. This is the structural reason it differs from ordinary service suspension.
Chapter 17 required that material, informational, and social pathways be checked within a single map; the same requirement applies to functional dependency: a "supply-guarantee list" that draws only services and not their dependencies will produce an illusion of safety at the decisive points. The map must show which functions share the same personnel, the same archives, the same access route, and hence how much a seemingly local suspension actually stops. The map's use is not to exhaust dependencies but to make shared dependency visible — as the analysis of path redundancy in Chapter 8 already noted, two distinct lines on a map may cross the same bridge.
Lists and Criticality Claims
Any list of basic functions is a snapshot at some point in time. The hallmark of destabilization is precisely that conditions change: basic supply in the dry season differs from the flood season, the demand for error correction after disputes intensify differs from quiet periods, and after the dispersal of population the very objects of care are changing. Once a list is made statutory, it is pulled by two opposite forces — functions that should be added cannot get in, and functions no longer critical cannot get out — while each revision of the list consumes a political cost far higher than a single act of determination. The criteria are a function of time; the list is an enemy of time.
The greater risk of a list is occupation by the bearing institutions. Once a function is entered as "basic," its current budget, staffing, and premises acquire a status exempt from comparison; competing for entry into the list replaces demonstrating criticality and becomes the principal form of inter-institutional competition. The longer the list, the thinner the "basic." This is not an argument against allocating resources to critical functions, but an observation: a list untested by the criteria protects not the functions but their current bearers. The beneficiaries are the institutions on the roll; the cost bearers are the equally real functions the list excludes, and everyone who pays for the list's redundant entries.
The position of this chapter can therefore be put in one sentence: the criteria precede any item. Whether a function must be retained is answered by three tests — whether the consequences of suspension are reversible, who bears the costs of suspension, and whether the conditions recovery depends on are also suspended — not by whether it appears on some list. A list may serve as a one-time record of the outcome of a given examination; it cannot be a substitute for examination. That is the whole difference between a list and a determination, and it is also the boundary of whether a list can survive.
The Justificatory Function of Criticality Claims
At this point the critique must confront this chapter's severest corollary head-on: "must be retained" is a category that can be used in reverse. It can do more than protect functions; it can procure for an institution a status beyond question. To skip this point is to let reality disarm all the preceding criteria — for the first institution they protect will demand, in their name, that it never be examined again.
The force of this corollary lies, first, in the fact that its kernel is true: levee monitoring really cannot be mentioned in the same breath as landscape lighting, and the checking of cold chains and medicines really is closer to unsuspendable than conference travel. It is precisely the real gradient of criticality that gives the sentence "we are critical" its room for borrowing — every successful borrowing depends on the public's legitimate recognition of the real gradient. To critique criticality claims is not to declare all functions equivalent; that relativism would only strip the genuinely unsuspendable items of their defense. The aim of the critique is to ransom real criticality back from the institutions' transcription of it.
The mechanism of borrowing is uniform: the bearing institution transcribes the criticality of the function into the unexamined status of its own present arrangement, in the formula "to touch us is to touch safety." Under this formula, budget cuts are dangerous, staff rotation is dangerous, external verification is dangerous, and even inquiry is dangerous. Chapter 18 observed that the language of safety is harder to refuse than the language of development; the criticality claim is the institutional version of the language of safety — it exempts not just some clause from interrogation but the entire present state of an organization from interrogation. The beneficiaries are the incumbents inside the institution and the positions exempted from replacement; the cost bearers are the very people whom verification, rotation, and inquiry were supposed to protect: their costs appear in no risk register.
No function is critical under all conditions. Chapter 8 distinguished four kinds of redundancy — capacity, role, information, and pathway — which indicates that criticality must be measured against standby capacity: the same channel has different criticality with temporary anchorages and rerouting protocols than without them; the same verification has different criticality when an independent second channel exists than under a single channel. To claim criticality while saying nothing of substitutes and redundancy is to claim to be irreplaceable in all possible worlds — in evidential terms the strongest of claims, yet one commonly advanced with zero evidence, shielded from any demand for production by the weight of the word "risk."
To write down this mechanism is not to assert that Jiawan Harbor's managers are so scheming. Every department head sincerely believes his department critical, every budget defense reasonably stresses its own function, and the sum of these suffices to produce the effect described: criticality claims escalate among institutions in the pattern of an arms race, and review is postponed again and again amid the conspiratorial silence of "now is not the time." What can be tested is therefore not hearts but structure: whether independent verification arrangements actually exist, whether staff rotation has actually occurred, whether alternatives have actually been compared in earnest. These are evidential thresholds; those who reject them as imputations of motive expose, precisely, their own substitution of a question of motive for a question of structure.
Not Everything Claimed as Critical Is Critical
An institution claiming to bear an unsuspendable function should be able to produce three things at once: an observable consequence chain of the function's failure (what would break if it stopped, how fast, how irreversibly), a demonstration of the exclusivity of the current bearer (why no one else could do it, or do it well), and a verifiable record of standby status (if there is a standby, where it is, how quickly it could take over, who has tested it). A claim without a consequence chain is rhetoric; a claim without a demonstration of exclusivity is an interest; a claim without a standby record is fortune dressed up as robustness. Only with all three does a claim earn the standing to be taken seriously — not the standing to be spared an answer.
The neighboring port (equally fictional) once suspended a routine patrol that described itself as critical, on the grounds of process reorganization. In three years, not one of the claimed catastrophic consequences occurred. This does not prove the patrol useless — the risk may be low-probability — but it does prove that the claimant's earlier causal narrative was overly certain. The value of a counterexample lies not in its conclusion but in its procedure: for any "critical function" that is suspended, the predicted consequences should be written down in advance and checked afterward, so that criticality claims become falsifiable assertions. A criticality never allowed to be tested cannot be distinguished, epistemically, from a criticality that never existed; it rests not on evidence but on the impossibility of asking.
The conclusion of Chapter 8 here acquires normative use: since the four kinds of redundancy each alter the consequences of failure, they each alter criticality as well. The real question is often not "can this function be kept" but "which redundancy, once attached to this function, would make its single bearer no longer critical." An institution that refuses to configure redundancy on grounds of criticality is protecting its own critical position, not the function itself — a function, when redundantly configured, does not need any single institution to be irreplaceable. The converse also holds: only an institution willing to introduce redundancy, disclose its standby status, and accept testing through parallel channels has a criticality claim worth taking into further discussion.
Functions, Institutions, and the Boundary of Retention
That a function is critical does not mean the existing institution is its only or best bearer. Care can be familial, neighborhood-based, market-based, or public; verification can be performed internally, delegated, or carried out by an independent third party; and the operation and the regulation of basic supply have always been separable. Degrees of separation differ: standardized dispatch skills transfer fairly easily, while hydrological intuition accumulated over decades transfers with extreme difficulty. Whether a bearer can be replaced is judged by the ratio of the function's codifiable portion to its tacit portion, by the magnitude of the risk during the transition of transfer, and by who bears that transitional risk. All three are discussable, and none of them points naturally to "never replace."
The real meaning of "we cannot be touched" is mostly "this part, as done by us, cannot be touched." Once the two levels are separated, many deadlocks dissolve on their own: the function is retained as before, while the bearer is opened to competition, rotation, or review. For an institution that refuses this distinction, the evidential threshold for what it is really protecting — the function or its own position — should be set in reverse: let whoever advocates maintaining the status quo prove that the transitional risk of changing bearers exceeds the continuing risk of maintaining the status quo, with both risks specified down to subject and time, not one side filled with detail while the other says only "instability." Whoever benefits from the blurring of the boundary is whom the boundary serves.
The replacement of a bearer cannot be accomplished by declaration. Temporary anchorages, a second verification channel, parallel care arrangements — all require a period of coexistence with the current arrangement, a testing period, before they can prove usable. This returns to the buffer problem of Chapter 13: whoever has the capacity to fund the period of coexistence in effect holds the decision over whether bearers can be changed. If the current institution controls both the transitional resources and the entrance to testing, alternatives remain forever at "theoretically feasible." The transition guardrails must therefore include: transitional resources for a critical function may not be monopolized by its current bearer, and test results may not be interpreted unilaterally by the party tested.
Retention Is Not Exemption from Review
Confirming that a function must be retained answers only "should it stop," not "is it now being done rightly." Retained verification may go through the motions for years; retained care may systematically omit certain populations; retained supply may attach humiliating conditions of access. The transfers of cost inside a basic function — who is served, who is punished in passing — remain longest exempt from scrutiny precisely because they stand under the umbrella of "must be retained." Retention and review are not adversaries: retention answers for continuity, review answers for legitimacy; review without the former would cut off the function, and retention without the latter would let the function degenerate in the name of continuance.
A function can be substantively rewritten under nominal retention: verification is still performed, but the standards are relaxed year by year; the care station stays open, but staff are siphoned off year by year; supply is maintained, but its coverage quietly contracts on the map. Chapter 18's ledger requires that the initial version be sealed and revisions leave traces; the same discipline applies to retained functions — neither suspension nor retention is a static state, and every substantive change in them should be recorded as a revision rather than discovered later as part of "how it has always been." The history of a retained function should itself be a chapter of the ledger.
The list of what "must be retained" is itself a decision, and therefore equally has its bearers and its question of review. Who drafts the list, on the strength of which examinations, who speaks for the excluded functions, how often the list is reexamined — these are not procedural details but the very places where the three criteria either continue to operate or fail. If the list is drafted and reviewed by the bearers of the retained functions themselves, the three tests degenerate into three self-statements. The entrance for reviewing the list must be located outside the bearers; this is a structural requirement, not a judgment on anyone's character.
The Concrete Testing of Basic Supply
Basic supply is the most frequently politicized of the four kinds of function, because suspending it shows results fastest. Exerting pressure through supply cutoffs — internally as a bargaining chip, externally as a means of punishment — exploits precisely the unsuspendability of supply. The standard of judgment is exactly as before: on whom the consequences of the cutoff fall, whether they are reversible, and who decides and who bears. A chip whose consequences are borne by third parties is, however justly its user describes it, treating someone else's conditions of survival as its own rhetorical resource; this judgment depends on no conjecture about the user's motives, only on the distribution of consequences and of decision rights.
The more hidden usage is isomorphic with the accelerated destruction of Chapter 18: keep supply "temporarily" below the critical level, wait for the arrangements that depend on it to come apart on their own, then take them over as accomplished fact. What is being used in this way is not the decision to suspend but the deniability of suspension — no one issued a cutoff order; there is only deferred maintenance, backlogged approvals, unfilled posts. The way to counter this usage is not unlimited attribution but requiring the condition of supply maintenance to enter the ledger itself: every substantive lowering of the maintenance level should have a traceable decision-maker, stated reasons, and conditions for restoration. Making "no one is responsible" impossible cuts off this path one step earlier than tracing "who did it."
The "minimum supply" is not a fixed line. In the same fictional port city, the minimum's content differs between the heating season and the ordinary season, between dispersal and normality, and between the disabled and the able. Setting the line at the perennial average would manufacture irreversible losses in extreme periods; setting it at extreme-period levels would perpetuate ordinary-period costs and, in turn, feed an institution that passes itself off as peak load. The workable approach is not to find the one correct number but to specify in advance the conditions for adjusting the minimum line, who adjusts it, and the entrance of appeal for those affected — so that the line can move, and so that its movement can be seen, opposed, and reviewed.
Supply functions are the most easily taken over by statistics: aggregate targets met, coverage targets met, while the individual's gap between two deliveries vanishes without a trace. Chapter 18 required that cross-period review connect to visible persons; that requirement is most concrete for supply: can recipients report a gap without being recorded as trouble, does the report change the next delivery, and in what form do the long-unsupplied exist in the ledger. A supply record that converses only with aggregates has, however complete, registered none of the people it claims to serve.
Convergence: The Criteria and the Boundaries of Transition
The conclusion of this chapter can be gathered up as follows: basic functions are determined not by a list but by three criteria — whether the consequences of suspension are reversible, who concretely bears the costs of suspension, and whether the conditions recovery depends on are suspended by the same decision. Under these three, verification, care, the error-correction entry point, and basic supply are usually unsuspendable — not because they stand in some document, but because they either render the accumulation of errors invisible, or fall directly on bodies, or strip all correction of its means, or take away the very conditions of discussion.
This category contains, at the same time, every possibility of its abuse: it will be transcribed by institutions into a privilege beyond review, occupied in reverse by bearers once it is turned into a list, and used to refuse the configuration of redundancy and the replacement of bearers. The boundaries are therefore equally clear. Not everything claimed as critical is critical — a criticality claim must produce its consequence chain, its demonstration of exclusivity, and its standby record, and submit to falsifiable testing; nor must every critical function be borne by the existing institution — function and bearer are named separately, and the transitional resources and testing entrance for a substitute bearer are not monopolized by the current bearer. Of the two boundaries, one guards against counterfeit and the other against rigidity, and neither can be missing: guarding only against counterfeit would expose the genuinely unsuspendable items to cynical relativism, while guarding only against rigidity would let counterfeit criticality regain its exemption from review.
The transition guardrails are therefore these: in any transformation or destabilization plan, every function proposed for suspension is entered into the ledger under the three criteria; suspensions with irreversible consequences fall under the irreversibility threshold, with the suspending party proving that avoidance and substitution have been exhausted; the costs of suspension are itemized by subject and accumulated by history; retained functions are entered together with their internal justice and their substantive changes, revisions leaving traces; the list of what "must be retained" has bearers, a review entrance located outside the bearers, and a channel of appeal for the excluded; and the redundancy status and bearer-replacement conditions of critical functions are publicly checkable. These conditions guarantee the correctness of no single functional judgment — judgments err. What the conditions do is let an error still be pointed out, reviewed, and revoked before its costs become irreversible.
The continuance of a system of functions does not consist in every function operating forever, but in the entrance through which operation can be judged and corrected never being the first to close. Suspension can be honest dispatch, a list can be an honest record, and an institution can honestly bear a critical function; what they share is the mode of failure in which they cut off their own path of being questioned. To identify the basic functions that must be retained is, in the end, to identify this one: whatever the reorganization of everything else, the function that lets everyone keep asking "is this really critical, who is to prove it, and how is it corrected if wrong" ranks before the first item of any list — it is not even on the list, for the list itself can be questioned only through it.