Runaway Process

Why did a healthy oak, older than the town that killed it, actually have to die? Not the proximate answer — a hazard report, a rejected second opinion, a technicality in an ordinance — but the real one, the one that explains why the same shape keeps appearing in stories that have nothing else in common. Fire suppression that guarantees the catastrophic fire it was built to prevent. A school system whose liability lawyers have shortened recess, watered down science class, and scripted a teacher's discretion out of existence. A five-hundred-year-old tree, and the report that outlived every appeal against it. These are not four unrelated failures of judgment. They're one process, wearing four different names, and it has a shape worth naming on its own terms.

What a runaway process is

A runaway process is any system whose feedback loop rewards movement in one direction and never prices movement in the other — so it doesn't settle at an equilibrium, it accelerates until it runs out of fuel. A thermostat is not a runaway process: it has a target, and it corrects in both directions around that target forever. A fire that has consumed every fire-adapted understory shrub for eighty years because none was ever allowed to burn on a human schedule is a runaway process: there is no thermostat, only one direction, compounding on itself, until the fuel load is enough to burn everything at once.

Institutions run the identical loop whenever they're scored on only one side of a ledger. A parks department that gets sued for a tree it left standing and never sued for a tree it cut down is not weighing two risks against each other; it has a target with only one setting. A curriculum office that gets sued for a field trip that went wrong and never sued for the field trip that never happened is the same target, the same single setting. Neither institution is evil, or even careless, on its own terms. Each is behaving with perfect rationality against an incentive gradient that has exactly one slope, and a system with only one slope doesn't stop climbing until there's nothing left to climb.

The oak was never really about the oak

That's why the pattern kept resurfacing across three separate pieces on this site before it had a name. The liability regime that shortens a school's recess and the liability regime that killed the Rinconada oak are not analogous by accident or by rhetorical convenience — they are, structurally, the same regime, applied to different substrates. Both are systems that can only ever price the danger of keeping a thing; neither has a line item for the cost of removing it, because the removal, once documented, closes the loop and ends the institution's exposure. A tree that's standing is an open liability. A tree that's gone is a closed one. A recess period that's supervised into sterility is a closed one. The specific noun changes — tree, recess period, controlled burn, hands-on science lab — but the ledger underneath it has the same missing column in every case, and a ledger with a missing column doesn't average toward balance. It runs to the edge of the column it does have.

Does law serve the people, or do people serve the law

That question, asked plainly, sounds like it answers itself — of course law is supposed to be an instrument, a thing built to serve human ends, revisable when it stops doing that. But a runaway process is exactly what happens when an instrument stops being judged by the end it was built for and starts being judged only by its own internal consistency. The Los Altos ordinance that classifies a tree as hazardous and, by that same classification, forecloses the appeal against removing it isn't malfunctioning. It's functioning exactly as written, and what it's optimizing for by that point has nothing to do with the tree, the neighborhood, or the century of shade at stake — it's optimizing for the ordinance's own procedural closure. At that point the people the law was built to serve have quietly become the raw material the law processes on its way to serving itself, and the honest answer to "does law serve the people or do people serve the law" is that it depends entirely on whether anything outside the law is still able to ask the question, or whether the law has become the only entity left asking it.

Dangerous Safety -- The process at its limit

Push a runaway safety process all the way to its actual limit rather than stopping to admire it partway there, and something uncomfortable falls out of the math: complete elimination of danger for all people, taken literally, is not a highly safe world. It is a world with no trees old enough to drop a limb, no field trips off-campus, no recess equipment with an edge on it, no controlled burns because a controlled burn is itself a risk, no uncontrolled forests because an unmanaged forest is a bigger one, no informal teaching method because an untested method is a liability, and, at the limit that actually matters, no uncontrolled human choice at all, because a person choosing anything for themselves is choosing a nonzero risk on society's behalf.

A process that scores itself purely on danger prevented converges, if you let it run long enough and don't introduce anything to stop it, on the elimination of the thing that makes danger possible in the first place — which is existence itself, since nothing that is alive, free, or standing outdoors is ever exactly zero risk. This isn't a slippery-slope rhetorical trick; it's what the optimization target actually specifies once you follow it to where it's pointed rather than where it currently happens to be standing.

The old name for this shape predates the ledger metaphor by a few thousand years: a process nobody actually wants, fed one locally reasonable offering at a time.

Some corners of philosophy call this general shape Moloch — the process nobody chooses and everybody loses to, the one that wins not because any single actor along the way wanted the outcome but because no single actor along the way was positioned to stop it without absorbing a cost nobody else had to absorb. The tree case and the school case are small, local instances of that same general mathematics: no risk manager, no curriculum director, no city attorney sat down and decided that childhood should be smaller and older trees rarer. Each one just made the single locally rational decision available inside a ledger with a missing column, over and over, at every branch point, for years — and the sum of those individually reasonable decisions is a world with less of everything the missing column would have priced.

What stops it

A runaway process only stops when something outside its own optimization function forces it to price the side of the ledger it was built to ignore — and that's not a call for a better algorithm inside the same institution, because the institution's incentive structure is precisely what's generating the missing column. It's a call for a limit on the institution's own reach. Five Centuries Under One Crown already made the relevant comparison: a private landowner can lean toward destruction or toward preservation, and either way the consequences mostly stop at their own fence line, because a single owner internalizes both sides of their own ledger whether the law makes them or not — they're the one who has to live with the empty yard as much as the one who'd have to live with the hazard. A government body managing every tree in every park it touches has no fence line. Its decisions compound across scope in a way no private actor's do, which means the missing column in its ledger doesn't cost one owner one yard — it costs an entire jurisdiction every risk-bearing thing inside it, tree by tree, recess period by recess period, for as long as nothing outside the institution is positioned to make it answer for what it destroys and not only for what it fails to prevent.

That's the case, stated as plainly as it can be stated, for bounding concentrated power rather than trusting it to self-correct: not because the people running any particular department are unusually bad actors, but because a runaway process doesn't require bad actors, only an unbounded one with a one-sided scorecard and no fence line. The oak didn't die because anyone hated it. It died because the only column anyone downstream was ever measured against was the one with its name on it, and nothing outside the ledger was strong enough to add the column that was missing before the saw arrived.

---