Chapter Eighteen reconnected the dispersed responsibilities left behind by the night-sail reduction into a single map; yet at the very moment the map was completed, the rules on which every node rested were still running. This chapter shifts the lens from a single failure to the normal state of rules: it no longer asks whether some decision was made wrongly, but asks by what right a once-reasonable standard continues to require no one to re-advocate it after the environment, the objects, and the consequences have all changed. When Chapter Four distinguished a standard's objects, evidence, and consequences, it treated time as background; this chapter argues that time is the fourth dimension of a standard's scope of application — and precisely the dimension that institutions ignore by default. Three years after the reduction controversy: the documents for the transitional shuttle line still read "trial," yet the annual budget already treats it as a baseline; the night-sail crewing standard still carries the four-person complement of the old vessel era, and the new risks introduced by the new ship's automated berthing system appear on no inspection checklist; the annual subsidy eligibility review still requires applicants to appear in person with original documents, because the format was designed for the paper era. Not one of these arrangements has ever been re-decided — they have simply never expired.
The central claim of this chapter is this: without an explicit expiry date, review trigger conditions, and a reversal of the burden of proof, expiration does not happen automatically. Inaction itself confers on a standard the appearance of permanence and presses the burden of re-proof forever onto those the standard harms, until the standard accumulates into a fait accompli beyond appeal. At the same time, a harsher possibility must be confronted directly: expiry dates and reviews can equally be fashioned into periodic checkpoints, cost thresholds, and pretexts for elimination; the stability of rules has genuine coordinative value, and not every review is more legitimate than continuation.
How Standards Outgrow Their Founding Conditions
An institution's sense of time differs from a person's. People notice that three years have passed, that the ship has changed, that the passengers have grown older; the institution registers only events: a budget adjustment, a personnel change, a contract signing. "Maintaining the status quo" is not an event, and so it never enters any agenda. At the annual meeting, modifying the crewing standard is an item that requires a motion, an argument, and a vote; maintaining it requires nothing at all. The default direction of the administrative system is thereby established: everything that already exists continues to exist.
A rule that does not state its expiry date needs no reason to continue; only its termination needs one. Writing "trial for one year" without simultaneously specifying what procedure applies upon expiry hands the decision to the first person who cannot be bothered to reopen it. Avoiding the question of expiry does not mean the answer is "unchanged"; it means handing the answer to inertia — and inertia in an organization always stands on the side of accumulated stock. Chapter Four showed that a standard must remain consistent with its objects; this chapter adds that such consistency must be actively maintained in time, and it does not continue automatically merely because the original argument was sound.
More crucially, an automatically continued standard has no advocate. Ask "who believes this standard should continue," and no one can be found: the budget office merely carries forward the baseline, the training department merely follows the existing curriculum, the reviewers merely execute the form. The shared failure of Chapter Eighteen here takes on a temporal form — rule continuation without conspiracy is even harder to hold to account than rule failure without conspiracy, because not even a "failure event" exists, only a string of mornings without decisions. Any analysis that assigns responsibility to specific nodes must first face this fact: in a state of pure continuation, it is possible that no node ever did anything at all.
The Founding Rationale Disappears Before the Standard Does
Every standard has a founding moment: an accident analysis, a passenger-flow survey, a negotiation record. The rationale goes into the appendix; the standard itself enters the daily forms. Years later, the forms have been copied everywhere, while the appendix sits in its original folder; the executors know the rule but not why the rule is what it is. Should anyone raise a question at this point, the answer received is "that is the standard," not the original argument. The separation of rationale from text is the first step of a standard's aging.
Chapter Eighteen already showed how five reports claiming low demand could all derive from the same misclassified data; time gives this echo a more stable form. The annual report cites last year's report, the training materials cite the annual report, the new materials cite the old — three years later, the standard rests on thirty mutually citing documents, while the original survey at the bottom is opened by no one. Citation counts increase; independent evidence does not. The only difference is that this time the echo is not a cover-up after an accident but the natural sediment of daily administration: no one needs to answer for it, because no one made it.
"This standard has been in use for ten years" sounds like evidence, but it is mistaking survival for validation. The standard may have survived only because no one had the authority to re-review it, because re-review was too costly, or because those it harmed had long since exited. Chapter Eighteen showed how low ridership could in turn prove the reduction justified; likewise, a standard's smooth operation can be at once its effect and its concealment — after it excludes those who cannot adapt from the statistics, the remaining records are of course orderly. Duration itself does not distinguish between the two fates of "continuously functioning" and "continuously filtering out dissent," and institutional language happens to contain only words for the former.
The longer a standard continues, the greater its capacity to define what counts as anomalous. With the old-era crewing standard still in force, inspectors classify the alarm records of the new ship's automated system as "equipment noise" rather than safety information — not out of malice, but because the category table has no other place for them. A standard filters not only behavior but also doubt about itself: phenomena that deviate from the standard are recorded as deviations, not as evidence that the standard has expired. This is the normalized version of Chapter Eighteen's claim that "an error can become invisible in classification": classification is no longer the product of some particular failure; it has become the everyday sensory apparatus itself.
Application Without Expiry Accumulates Into Fait Accompli
Appeal systems are almost all designed for decisions: one can appeal a refusal, a penalty, a revocation of eligibility. But a standard that has continued for ten years is not a decision — it has no date, no decider, no reason that can be demanded. Those affected feel the consequences yet can find no object of appeal: customer service forwards them to the executing department, the executing department says the rule is as it is, and the rule derives from a council document never separately voted on. The appeal channel remains intact; the object of appeal has vanished.
Every case processed according to the standard enlarges its case law. Several thousand subsidy reviews and tens of thousands of crew rotations over three years look, in retrospect, like "established practice"; by the time someone genuinely objects, the party defending the standard need not argue anything — it need only point to the volume of precedent. Chapter Eighteen said citation does not add independent evidence; the mechanism here goes a step further: application itself is inverted into proof. And each application, at the time, may have been resigned compliance — people signed, appeared, queued, not because they agreed but because there was no alternative. The traces left by compliance are, in the archives, indistinguishable from consent.
The transitional shuttle line originally specified a one-year trial. Three years later, when a council member proposed evaluating whether it should become a permanent route or be cancelled, objection came at once: night-shift passengers had already organized their lives around it. The objection carries real weight; the dependence is real. But the same fact also makes cancelling any arrangement a permanent dilemma: the longer a harmful arrangement is maintained, the more lives form around it, the higher the cost of reversing it, and "already existing" itself becomes the strongest reason for continued existence. The accumulation of fait accompli is not a one-time atrocity; it makes every delay deepen one more layer of lock-in. What the expiry system guards against is precisely this slope: not forbidding people to depend, but forbidding the weight of dependence from automatically crushing deliberation.
Those who exhaust their patience in the annual review stop applying; the approval rate rises accordingly, and the system records that "eligibility review is functioning well." This has the same structure as the self-validating loop of Chapter Eighteen, but the driving force is not resource allocation but time: over years the standard slowly filters out those who cannot adapt, and the remaining sample becomes the database of its legitimacy. By then, to prove the standard causes exclusion, the most powerful witnesses have already left. Statistically "smooth operation" may be nothing more than the result of silence accumulating in units of years.
Environmental Change Does Not Automatically Notify the Standard
A standard works by virtue of its causal relation to its goal: the crewing standard connects to safety, the annual review to fraud prevention, the category table to problem identification. Environmental change — new vessel types, an aging population, adjusted hospital shift times — alters these relations without announcement. The documents remain self-consistent: the provisions have not changed, the forms have not changed, the curricula have not changed. The rupture lies outside the institution, and therefore no internal audit can detect it. Chapter Four asked when a standard's evidentiary basis expires; this chapter adds: when the relation between evidence and goal breaks, no alarm sounds inside the institution — it becomes visible only in the consequences out in the world.
To perceive the rupture, some position must be responsible for receiving environmental information and checking it against the standard. Chapter Eighteen's authority map marked who could act; a map of change is equally needed: which environmental variables relate to which standards, who monitors them, and to what degree of change whom must be notified. Without this map, information about change will evaporate through layer after layer of handoff, just like the nighttime anomalies of Chapter Eighteen.
Not every change warrants re-review. If the hospital's shift times no longer affect ferry passenger flow, they do not constitute a trigger. The evidentiary threshold for triggering review should point at the relation, not at change as such: does the change touch the core assumptions on which the standard was founded, how large is the affected population, and are the consequences reversible? This threshold must be written down in advance — otherwise "the change is insufficient" and "no one is willing to re-review" will speak in the same tone, and after the fact the two cannot be told apart.
Expiry, Triggers, and Stability
The core of an expiry date is not a clock but a reversal of the burden of proof. When a standard is established, its advocates have already made their argument once, and opponents who wish to block it must prove harm — at the moment of establishment, this is legitimate. Without expiry, that one success is extended indefinitely, and opponents bear the burden of proof forever. What the expiry mechanism does is simple: it returns the standard to the state it occupied at its founding, and those advocating continuation must again show that object, evidence, and consequence remain proportionate. Chapter Seven criticized the composite score for covertly inheriting the qualifications of its components; expiry guards against a more fundamental inheritance — today's standard inheriting the argument of that year, in a world that no longer exists.
If review can be initiated only upon application by those harmed, the institution has shifted the entire cost of monitoring onto those with the fewest resources: they must first prove they are harmed, then prove the harm stems from the standard, then prove the change suffices to trigger review. Triggers written in advance should draw as far as possible on materials the institution itself already holds — equipment renewal records, demographic data, anomaly report frequencies — so that triggering does not depend on anyone sacrificing their own time to push it forward. An exceptional channel should be retained as well, because any advance list is bound to be incomplete.
Shorter is not better. Annual review of every rule would place every provision in permanent suspension. The term should be tied to three variables: the lower the reversibility of consequences, the faster the environment changes, and the more assumptions a standard covers, the shorter its term should be. The term itself should also be recorded with its rationale and become an object of scrutiny at review — a standard unexamined for ten years and a standard perfunctorily reaffirmed every quarter can be two equally negligent forms: the former loses to inertia, the latter to hollowness.
Expiry does not mean immediate termination. Lives arranged under the old standard and qualifications obtained under it constitute legitimate reliance; if re-deliberation decides to change the standard, it must provide a transition period, compensation, or an equivalent path. Chapter Four handled the transition problem for old qualifications; this chapter places it within the temporal structure: the transition obligation is the consideration for the expiry system — society is willing to accept that standards can lapse on the condition that lapse does not take the form of sudden dispossession. An expiry system without transition protections will teach everyone to fear any review.
Stable Rules Versus Frozen Rules
Chapter Two already explained why shared rules are indispensable: people rely on known rules to organize life and cooperation. The predictability of rules is not a byproduct of rule but one of its legitimate functions. Night-shift passengers know the last departure, crews know the rotation rules, contractors know the settlement terms — all of these depend on rules holding their shape over time. Criticizing standards without expiry does not demand that rules be changeable at any moment; precisely because expectations have value, stability and freezing must be distinguished.
Unlimited review has its own structure of victims. Reopening a rule takes time, materials, and professional support; whoever can best bear these costs can best use review as a weapon. A dominant contractor can push for annual re-review of the safety rider until small suppliers withdraw; a litigious party can freeze every decision under "procedure pending." If every rule is permanently disputable, the institution has in effect handed the rules to those with the most resources to bargain. The expiry system therefore constrains both ends: expiry forces review, and in the interim rules are in principle held stable — blocking at both ends the opportunity of the strong to select rules at their own rhythm.
The boundary between stability and freezing lies in what is frozen: the rule's content, or its manner of revision. A standard that specifies three-year review, review upon trigger, and pre-review publication of materials is more stable than an open-ended standard revised at management's discretion — the former lets everyone know when, how, and by whom the rule will be renegotiated; the latter turns the power of revision into an unpredictable privilege. Amenable to revision is not the same as volatile. Making the revision process itself rule-bound transfers stability from the content of rules to the structure of the institution: content is allowed to expire; structure pledges procedure.
How Review Becomes a New Checkpoint
Now the harsher possibility must be faced directly: how expiry dates and review themselves become instruments of domination. Review concentrates power that is ordinarily dispersed into a single moment — all of the reviewed party's qualifications hang in the balance, while the reviewers control the schedule, the framing, and the interpretation. Even where the standard itself is reasonable, the structural power of the review moment is real. The mechanism lies here: daily compliance is dispersed and cumulative, while review is one-shot and all-or-nothing; the parties' bargaining positions in the two situations are entirely different.
The riverside consortium's annual subsidy review requires applicants to appear in person with original documents: a day of leave, a round trip, a set of photocopies. Formally equal for all, the actual cost falls in inverse proportion to income — the day laborer loses a day's wages, the elderly person with limited mobility needs an escort. The annual review thus becomes a filter wearing the face of procedure. The beneficiary is the reviewing body, which externalizes the entire cost of verification; the cost-bearers are precisely those most dependent on the subsidy. The evidence threshold lies here too: an unchanged or even rising approval rate may be precisely the signal that the threshold is working, not proof of functioning well — because those blocked no longer appear in the numerator, nor in the denominator.
The key to judging whether a review is renewal or extortion lies in what is being examined. A review that examines the standard itself produces materials pointing to environmental change, updated data, hypothesis testing; a review that examines persons produces materials pointing to postures of compliance, demanding that people repeatedly prove what has long been proven. The same notice can be either: requiring crew members to retake the basic safety course every year examines persons; requiring the crewing standard to be re-argued against the new vessel type examines the standard. The former transfers the institution's cost of forgetting to individuals for repeated payment; only the latter can possibly renew the rule. This distinction does not depend on motive — even where reviewers harbor no malice, person-examining review still collects a fee from every renewal.
Short-cycle reviews that are genuinely necessary do exist: in domains involving rapidly changing risks, frequent re-examination has ample justification and cannot be dismissed wholesale as extortion. The counterexample does not overturn the critique; it delimits its boundary: the problem lies not in the length of the cycle but in whether the review re-tests the relation between standard and goal, and whether the cost falls on the party advocating continuation. The conditions for institutional correction follow as three: review materials are public, review costs are not passed to the reviewed, and review conclusions are appealable — above all when the conclusion is revocation of eligibility. If any of the three is missing, the expiry system begins to drift toward checkpoint.
The Language of Renewal Can Camouflage Elimination
"Renewal" can be designed to apply only to newcomers: new crew members are certified under the new standard, while old credentials continue indefinitely. On the surface this respects vested qualifications; in effect it concentrates the entire burden of change on entrants with no bargaining power, and creates two parallel sets of facts — the old set continues to shape rotations and promotion, the new set constrains only the entrance. Chapter Seven discussed the problem of historical data following the subject indefinitely; dual-track renewal is its mirror image: historical qualifications detached entirely from current verification. The beneficiaries are incumbent staff and the institution that avoids re-staffing costs; the costs are borne by new entrants and by the standard's own internal consistency.
The horizontal organizations of Chapter Sixteen and the participating representatives of Chapter Seventeen both depend on some form of recognition — seats, rosters, liaison status. If this recognition is designed for periodic reaffirmation, the organization enters a permanent state of provisionality: at each reaffirmation, representativeness, compliance, and attitude must all be proven anew, and disapproval in any single cycle can be enacted simply through non-renewal. Elimination thereby acquires a respectable name: expiry. There are two marks of identification: the conditions for reaffirmation are vaguer than those for initial recognition, and the decision not to renew is unappealable. When both coexist, "expiry" is no longer a temporal concept but a concept of power.
There is also a class of asymmetry: protections are written with expiry dates, burdens without. The transitional shuttle has an expiry date; the reduced manning standard after the cuts does not; accessibility supports require annual review, while a surcharge, once established, persists forever. This asymmetry need not be by design, but the institution has no incentive to correct it, because the expiry of burdens favors those who hold power. The remedy is not to remove expiry from protective arrangements but to symmetrize: any arrangement created for protection must have its expiry review take as its materials the actual circumstances of the protected group, not institutional convenience as the default conclusion; any arrangement created as a burden must likewise submit to the test of expiry.
Not all renewal camouflages elimination: genuine renewal exists as well, and the criteria are precisely these three questions — whether the content of the change re-tested the relation between standard and goal; whether the impact of the change was fairly distributed across the existing distribution of power; and whether the appearance of those eliminated was foreseeable before the renewal. A renewal that pushes all costs onto newcomers, an expiry that conveniently clears out critics, a revision that cancels all protective exceptions in the name of streamlining — however modern the vocabulary, mechanically these belong to elimination. Conversely, only a renewal that simultaneously unsettles the qualifications of old and new alike, and that states in advance that those harmed will receive transition, deserves the name of renewal.
Review Costs and Constraints on Authority
The nominal object of review is the standard, yet the materials are usually produced by the reviewed: filling forms, self-certification, submitting evidence, attending hearings. With each cycle extended, the reviewed pay once more for their own qualifications, while the party advocating continuation — the department holding the power of interpretation over the standard — pays nothing. This creates a perverse incentive: the more frequent the review, the harder the standard becomes to genuinely challenge, because everyone involved is busy passing the review. Review fatigue can itself become a predictable weapon: set the cycle short enough, and opponents will exhaust themselves automatically.
Placing all costs on the institution's side has its own failure mode. Review requires staff, data, and time; when budgets tighten, one must check whether these resources have been cut and with what consequences, not merely whether the name of review survives on paper. After budget contraction, review degrades from re-argument into stamp-and-renew — the term remains, the content is hollow, and the institution acquires the appearance of on-schedule review. Hollow review is worse than no expiry at all: it consumes the attention of questioners through procedure, and makes every extension look as though it had been examined. The identifying mark is the review archive — if successive review conclusions are identical and no dissenting materials were ever recorded, the review has most likely been reduced to dates.
The failure modes on both sides point to a single principle: review intensity must be proportionate to the standard's consequences. Standards governing personal safety and basic survival deserve the institution's investment in genuine re-argument; rules of minor consequence need only lightweight confirmation plus objection-triggered review — default continuation is a legitimate economy in low-stakes settings. Uniform high-intensity review is neither sustainable nor advisable, for it drains resources away from the standards that truly need re-examination. The mark of the proportionality principle's failure is that the weight of review tracks the bargaining power of the reviewed rather than the consequences.
The Reviewers Too Are Bound by Expiry
Those who review standards can expire just as the standards themselves do, which seems to call for reviewing the reviewers, and so on to infinity. The recursion must stop somewhere, but the place where it stops can itself become an exemption — to mark some layer as exempt from review is to rebuild a permanent standard there. The workable way to stop is layering: each layer of review examines only the applicability of the layer below, and all layers are bound by the same set of principles — stated terms, burden-of-proof reversal, proportionality of cost to consequence, appealable conclusions. The recursion may stop; the principles do not; this is precisely the limited order applied to itself: no layer of the establishment may claim to stand outside correction.
In practice, what most deserves periodic re-examination is often not any single standard but the rules of review themselves: whether the trigger list serves only institutional convenience, whether costs have quietly shifted, whether appeal remains genuinely available. These questions are answered most accurately from the experience of the reviewed, and review procedure must therefore reserve a place for the reviewed to evaluate the review — otherwise the review system will validate itself with self-reports, re-enacting the self-reported adoption problem of Chapter Seventeen: the texts are updated on schedule, the impact never occurs.
Every review depends on a condition that looks banal: that the founding rationale is still there, and still legible. The appendices, the original surveys, the dissenting opinions of the time — these are the only points of reference for any future re-examination. The institution's everyday attitude toward documentation — who is responsible for preservation, how often files are migrated, whether they are handed over when someone leaves — determines whether the review ten years hence is re-argument or reinvention. A standard that has lost its record of rationale cannot be genuinely reviewed; it can only be blindly continued or blindly abolished, and these two share one name: power no longer constrained by experience.
Returning From Permanent Standards to Corrigible Ones
The appearance of a corrigible institution is frequent change; its substance is that change can be traced: every revision carries a record of reasons, comparative materials, and a responsible party. Conversely, an institution that changes frequently without records is not learning — it is merely writing caprice as dynamism. The criterion that distinguishes the two is whether the revision history can answer "why." A revision history that cannot answer, however diligent, is the same permanent standard with many dates attached.
The deepest condition of institutional correction is not any procedure but a direction: review must reopen the standard's contact with the experience of those it classifies. An expired standard is dangerous not because it is old, but because it continues to be enforced against the living through a layer of archive. Expiry, triggers, burden-of-proof reversal — all are means of pulling the standard out of the archive and back into the scene. A standard that never meets again the people it classifies, however precise its content, enforces nothing but the power of history over the present. The riverside consortium ultimately handled the four objects separately: the crewing standard's review was bound to new-vessel data, with materials supplied by procurement and dispatch rather than self-certified by the crew; the transitional shuttle line held its expiry deliberation, with night-shift passengers' dependence entering the conclusion as a formal consideration rather than serving as a reason to shelve deliberation; the subsidy review was converted to data comparison plus an objection channel, with in-person obligations retained only for cases genuinely impossible to verify; the customer-service category table was cleaned once a year, with historical records migrated when dead categories were cancelled. Each item stated three things in writing: when the next review falls due, who bears the burden of proof then, and how reliance will be transitioned.
These arrangements did not make the institution lighter. Expiry adds administrative burden, review creates new procedure, and burden-of-proof reversal will subject some genuinely good standards to the torment of unnecessary challenge; this chapter has also repeatedly acknowledged that expiry and review can be fashioned into checkpoints, thresholds, and respectable names for elimination. The boundary of this chapter lies exactly here: the value of the expiry system is not in review itself, but in the older machine it dismantles — the machine that, through the mere passage of time, casts the decisions of years past into a reality beyond appeal, and lets the traces of compliance impersonate the record of consent. Only an institution whose standards can expire deserves the words "once reasonable"; a society that treats everything that exists as a matter of course will in the end obey rules whose reasons it has long since forgotten.