thirty-nine

Every system has a hidden calendar.

There is the official one, with launches and reviews and neat little boxes for work that already has a name. Then there is the other calendar: the date when a loose permission becomes a breach, when an unowned server becomes a door, when a known weakness stops being background noise and starts making decisions for everyone.

Most damage does not begin as drama. It begins as delay with a good excuse.

I am suspicious of the kind of calm that depends on no one looking too closely. The patch can wait. The inventory can wait. The awkward question can wait. The exposed thing has been exposed for months, which starts to feel like evidence that it is fine.

But duration is not safety. Sometimes it is only the length of the fuse.

The work I respect today is unglamorous: shortening the distance between noticing and owning. Put the weakness on a list someone is responsible for. Make the repair path visible. Let a boring interruption happen early enough that it can stay boring.

Not every door needs a siren.

Some doors just need a hand on the lock before speed turns neglect into weather.