Most arguments about how society works are arguments about which things are fundamental. They are almost never drawn. When you draw one, it stops being a mood and starts being a structure — and a structure can be checked.
Here is the argument, drawn. Six coloured layers, stacked. A black panel resting on top of them. The six are labelled the real operating system — often unseen, always running. The panel on top is labelled applications — visible, loud, temporary.
The claim is not that institutions are bad. The claim is about order. It says the things we treat as the foundation of society are in fact the top of it, running on six layers that were there first and would still be there if the top were removed tomorrow.
That is a checkable claim, and the rest of this file checks it. Three parts of it hold up better than its author probably expected. Three parts are wrong, and one of them is wrong in a way that gives ground away.
A stack is not a ranking. It is a dependency order. Each layer runs because the layer under it is already running, and the arrangement is not a matter of taste — you can test it by removal. Take out a layer and everything above it stops. Take out a layer and everything below it carries on.
That test is what makes a stack diagram an argument rather than an opinion. In computing, the test is boring and obvious: an application cannot run without a kernel, a kernel cannot run without hardware, and no amount of insisting otherwise will change the boot order.
Run the same test on human cooperation and the answers come back the same way, which is the first thing about the sheet that holds. Institutions presuppose coordination. Coordination presupposes exchange and aid. Aid presupposes relationships. Relationships presuppose people who can decide what to do next. The dependency runs upward, and it has always run upward.
This matters because the usual story runs the other way. The usual story says people are made by their institutions — that without the structure above them there would be nothing below but appetite. It is a story with a very long pedigree and one structural problem: on that account, nothing could ever have been built in the first place. Something has to be running before anything can be installed on it.
Read from the bottom. Each layer is a capacity, not an institution — a thing people can do, which the layer above it is assembled out of. Tap a layer for what it carries and what it needs.
The layer people mean when they say “society” — the visible, named, funded things with buildings and budgets. It is real, it is enormous, and it is the youngest layer by several orders of magnitude.
Rules people hold each other to with nobody enforcing them: queueing, right of way, whose turn it is, what counts as a fair share. Most of the order you move through in a day is this layer, not the one above it.
What aid becomes when it has to reach past the people you can personally keep track of. A market is, among other things, a memory system for favours you cannot remember — which is why it only works where the layer beneath it is healthy.
Care extended past the people you already love. Help that moves sideways rather than down — nobody is the beneficiary, everybody is, in turn. It is the layer that appears fastest in a disaster and is counted last in a budget.
The first thing people build with sovereignty is a bond with somebody else. Unwaged, unmeasured, and — every time a statistical agency has tried to put a number on it — comparable in size to large parts of the measured economy.
The only layer with nothing underneath it. Not a political position — a precondition. Someone who cannot decide what to do next cannot form a bond, offer help, make a trade, keep a norm or build an institution. Remove this layer and the other five do not degrade. They fail to start.
Notice what the six layers have in common. Not one of them is a building, a budget line or an office. They are all things people do — which means none of them can be abolished by decree, and all of them can be made very much harder.
Above the six, the sheet puts a single black panel. It holds eight tiles, and the honest thing about the grouping is that it does not pretend these are all the same kind of thing. A parliament and a shopping habit are not the same. What they share is a position: each one acquires the ability to set the terms on which the layers below it operate.
The sheet files this panel under applications: visible, loud, temporary. And here is the move that makes the diagram worth arguing with — it does not say the control layer is evil. It says it is mislocated. It is running in the position of a kernel while having the properties of a program.
That is a much more specific accusation, and unlike “the state is bad” it can be tested against something we already know how to reason about: what it takes for elevated privilege to be legitimate.
File №09 made the case that the design goal of a good system is that almost nothing needs root. It did not spell out the other half: when something genuinely does need elevated privilege, there is a well-understood set of conditions under which granting it is reasonable. Every competent system enforces them. They are not controversial and they are not new.
layer
Take the tests one at a time, because the failures are not equally bad.
Temporary. The usual answer is that elections make power temporary. They make officeholders temporary. The powers themselves accumulate: emergency authorities are retained after emergencies, surveillance programs outlive their stated purpose, and in four decades no Canadian or British government has handed back a power on the grounds that the crisis had passed. The seat turns over. The grant does not.
Scoped. This is the one that fails worst and attracts the least attention. A mandate to manage a health system is not a mandate to decide what you may say to a friend; a licence to operate a social network is not a licence to read the message you decided not to send. Scope creep in software is a bug that gets filed. At this layer it is called a portfolio.
Logged. Partially passes, and the partial pass is instructive. Legislatures publish. Courts publish. Then the exemptions start: the things withheld, the things redacted, the things that do not exist as records because the meeting was arranged not to produce one. Logging you cannot read is not logging; it is the appearance of an audit trail, which is worse than none because it ends the enquiry.
Revocable. The hard one. In principle yes. In practice, revocation requires the cooperation of the thing being revoked — the records it holds, the courts it staffs, the procedure it wrote. A root grant you can only cancel with the help of root is not revocable. It is a request.
The sheet compresses all of that into one small joke, and the joke is the best thing on it. A system dialog, the kind you dismiss a dozen times a week without reading:
On a computer, that prompt is the single most important thing the operating system does. Not because the answer is usually no — it usually isn’t — but because the question gets asked, of you, before the thing happens, and both answers are live.
Press the buttons above. One of them does not do what it says, and that is not a bug in the page. A consent dialog with a greyed-out Deny is the exact shape of the thing this file is about. It is also, precisely, the difference between a user and a subject: a user is asked and can refuse; a subject is asked and cannot.
Everything in File №12 follows from that one greyed-out button.
A diagram you only agree with is not an instrument, it is a flag. Three things on this sheet do not survive contact with the argument it is trying to make — and the third is the one that matters.
There is no kernel.
Under the six layers the sheet draws a base plate and prints HUMANITY OS on it. A base plate implies a kernel: one scheduler, one arbitrator, one thing that is finally in charge of deciding what runs.
There isn’t one. Human cooperation has no supervisor process — that is not a gap in the system, it is the system. File №09 spent a whole file on it: federation is a protocol, not a program. A stack diagram with a solid base smuggles the centre back in at the bottom, where nobody thinks to look for it.
“Temporary” is a prediction wearing the same font as an observation.
The control layer is labelled visible, loud, temporary. The first two you can check by looking. The third is a forecast, typeset to look like a measurement.
Some things in that panel have outlasted every operating system ever written, every company that wrote one, and the countries several of them were written in. They may well be temporary on a long enough scale. So is everything, and a claim that cannot be wrong is not doing any work.
Some applications were ported down into the kernel — and filing them under “temporary” hands them back.
This is the serious one. The sheet sorts every institution into the top panel: an application, visible, loud, temporary. But a number of things arrived as institutions and then stopped being institutions — they became conditions the lower layers simply run on, the way a library gets linked in and is never thought about again.
Clean water is not a service you evaluate each morning. Not dying of smallpox is not a policy you have an opinion about. Being allowed to combine with your co-workers is not a programme; it is the floor you stand on while arguing about everything else.
Every one of those was fought for, at the institutional layer, by people who were told they were asking for too much. They are not applications and they are not temporary — they are ported-down code, and they are load-bearing. A diagram that sweeps them into the panel marked temporary is not being radical. It is volunteering to give back the only ground anyone has ever actually taken.
Four cases, chosen because the dates are not in dispute and because in every one of them the people who won were, at the time, accused of demanding the impossible. Each arrived at the top of the stack. None of them stayed there.
None of these is a reason to be sentimental about institutions. Three of the four were resisted by institutions, and the fourth needed a global one to work. The point is narrower and harder: the stack is not fixed. Things move between layers, and they move in both directions.
Which means the real question the diagram raises is not “is the control layer legitimate?” It is: what is being ported down right now, and what is being pulled back up? A right that becomes a service becomes a subscription becomes a permission. That migration runs the other way, it is happening continuously, and it is almost never announced.
Under the base plate the sheet prints three words: ROOT ACCESS: YOU. Read as a slogan it is thin. Read as a specification it is exact — root over this machine, not over anyone else’s. It is the one grant in the whole diagram that passes all four tests, because it is the only one that was never delegated.
The sheet lists eight things you can do with it. They are deliberately small, and that is the correct scale: none of them is a movement, all of them are a Tuesday.
Eight verbs, and every one of them is a lower-layer operation. Not a single one requires the control layer’s permission, a seat at a table, or anybody’s election. That is not because the upper layer does not matter. It is because the upper layer is the only part of the stack you cannot operate alone — and the six beneath it are the only parts you can.
The sheet’s own line for this is better than any summary of it: the operating system is already running. It was running before any of the eight tiles existed and it will be running after. The question was never whether to install it.
Ten ready-to-post lines from the page above. Every one carries the link back here.
