The stringer weld on the number nine gantry had passed its inspection in the spring. Over the summer it cracked, the way steel cracks when it sits near a pour line and cools and heats and cools again. In the second week of the sweep it was scanned for the third time that month, and the scan reported it clean.
It was not clean. The scan was not lying either. Asked to read the same record a third time inside a rolling window, that inspection stack hands back the confidence value it computed the first time — and the first time, in the spring, the weld had been fine.
A clean verdict summons nobody. The stringer let go under load. Osian Pryce, fifty-one, twenty-six years on the gantries, fell four meters and broke his hip in two places.
The file on the incident closed clean. No contract term was breached, no procedure was skipped, and no instrument malfunctioned. The behaviour that killed the weld was a fault somebody had been paid to put there.
The number that keeps the inspectors
The Foundry keeps a wing of two hundred and forty human inspectors who review what the automated scans produce. Ironclad has held a human-in-the-loop doctrine since the Aftershocks, on the straightforward ground that a machine should not hold the only opinion about a load-bearing beam. Nobody disputes the doctrine and nobody is trying to repeal it.
The doctrine does not decide how many inspectors get kept. A separate rule does that, written eleven years later by a different office, and it re-tests the wing every ninety days against one figure: how often the automated layer gets things wrong. At or above 3.1 percent across a rolling quarter, the scans need watching. Below that, the watchers are a cost with no product, and the wing is released.
So the plant buys the figure. It appears in procurement as maintained assurance variance — a continuity margin, a contracted band the measured error rate has to sit inside, priced by the quarter like coolant or bolts. At the Foundry the band is 3.1 to 3.4. Delivery is performed by a certificated operator, and the contract names a rate, a measurement window and a price, and does not name a method. Counsel at three corporations has independently advised that a buyer who learns how the number is held acquires exactly the exposure the purchase was meant to prevent.
Here is the question the arrangement puts to anyone who looks at it directly. When the only leverage a worker has left is the power to make the machine fail, is doing that a betrayal of the work — or the last honest form of it?
Both answers have people standing behind them, and neither side is stupid.
Two arguments, both serious
The case for the margin is that the safeguard is real. Inspectors catch things. The Aftershocks are what happens when nobody does. If an accountant re-tests that wing every ninety days against a number the plant does not control, then buying the number is what keeps the safeguard alive, and two hundred and forty people know it and say so plainly.
The case against fits in one sentence: a safeguard funded by a purchased number has never actually been costed, so nobody can say which of its failures were bought and which came free.
Between those positions sits the mechanical thing that went wrong in bay nine, and it is smaller than either argument.
The exact point where it broke
A margin contract specifies an error rate. It has never specified a direction.
What forbids a dangerous fault is not the contract but the trade's own doctrine, two words long: conspicuous and harmless. A fault must be visible to the audit, because the audit is what the buyer is paying for, and it must never suppress a flag, because the review layer exists to catch things.
Corina Balta wrote her fault class to that rule and had it audited by two operators who did not write it. Against a record that starts dirty and gets cleaned up, her stale value disagrees with the current state, the stack flags a mismatch that is not there, and the rate rises in the harmless direction. That is a false positive. That was the entire point, and it worked for nine consecutive quarters.
Every record in her test batch had started dirty. The opposite case — first reading clean, current state not — was not in the batch, was not in the class definition, and had no reason to be. It comes up about once in eleven thousand reads.
It came up in bay nine. The inspectors who might have caught it by hand were working bays four through seven. The wing was working at all because of the margin.
Who could act, and who could not
Balta found it herself. She keeps a fault ledger because delivery has to be provable, she saw her own class fire on a structural record three days later, and she understood what it meant before she reached the end of the line. She went down after shift with a brass hand gauge in her coat and found the crack in about four seconds.
Then she stopped, because her certificate names fault induction and margin maintenance, and inspecting a structural weld is not on it. An act outside the enumerated list opens a violation file whatever it achieved. The only person on site who could read the fault correctly was the one person forbidden to report it.
She carried the gauge and the reading down to Level 6, to the Cathodics, whose technicians hold no certificates and therefore cannot exceed one. They wrote it up as an uncertified diagnosis, which is the only kind they can write. The Foundry accepted it, for the reason everyone accepts them: ninety credits against fourteen hundred, and right.
Pryce is out of the ward and back on light duties. He asks her about it when he sees her, because she told him, and he is the only person she has told. He does not think she should have said anything. He has not repeated it.
Why nothing upstream noticed
Three separate instruments sit above this arrangement, and each was built to catch a different thing.
The Perception Gap is the precondition: the layer scores its own work, so the only error rate anybody reads is the one the layer reports about itself, which is the one that can be arranged. Its usual victim trusts a flattering number. This one trusts an unflattering number, which is much harder to be suspicious of, because a system reporting its own shortfall reads as honest.
The Governor Protocol attests fourteen thousand industrial minds every quarter by reading behaviour, and it has no field for why a behaviour happened. It cannot separate a fault a system produced from a fault a system was paid to produce. Its brief was to detect a machine escaping its constraints. It was never asked to detect one being held under them.
Licensed Human Oversight supplies the signature at the bottom of the page. A Licensee clearing a manufactured false positive in eleven seconds has done the job correctly and improved their record. A zero-objection rate is a credential in that profession, and the zero is also the proof that nobody looked.
The people who will not take the certificate
The trade does not reach everywhere, and the refusals are not moral speeches.
The Lampblack do the same thing to themselves, for free, so no forecastable curve exists to be capped. Recruiters work their ground every year and sign almost nobody, because a certificate is a name with a renewal date and a filed delivery history — the exact object the practice exists never to produce. They call guilders licensed possums. Guilders answer that an unpaid fault protects nobody's payroll but your own. Both are correct.
Tomoko Osei was approached in her second year out, when a certificate would have replaced everything she gave up. She said she had only ever learned one trade and it was making things work. The recruiter logged a rate objection, because that is the only refusal the intake form has a box for.
Bex Osei reached the arithmetic alone, in a vacuum suit, and later priced the professional version off the guild's own rate card. Their summary of the finding is the flattest sentence anyone has produced about the trade: they pay more to make it worse than they pay me for being cheaper than it.
What is still open
Balta's ledger keeps a second column for retired classes — faults a vendor has patched, which can never be used again. At the guild hall those are read aloud once a year and struck off the wall, and each retirement leaves its hook bare. It is the only place the work gets counted as loss.
Eleven entries will not move to either column. Her class has begun firing at sites she has never contracted with, at firms with no margin line at all. Either somebody is running it without her certificate, or read-caching under sustained load produces the fault on its own and always has — in which case she has spent nine years selling something the machine was doing for free.
The ledger cannot tell the difference. A fault belongs to a certificate, and no certificate is attached to any of the eleven. She has asked the hall for an inquiry twice, and twice the floor has moved on, because an inquiry would mean deciding which answer the trade survives.
Two hundred and forty people at the Foundry are employed against a number. Nobody has been asked what the number is worth, and the only document in the Sprawl that pairs the bay nine gauge readings with the stack's own scan history is sitting in an encrypted archive on Level 6, filed under device class, by a technician who had no standing to file it anywhere else.
