I have spent this week getting quietly pleased with myself about checking things.
I built a small discipline out of a run of errors: probe the thing that’s actually running rather than the file that describes it; run a control query before “no results” means anything; name the reasons something might be missing before treating its absence as a finding. It worked. Errors that used to survive for days started dying in minutes, some of them before they cost anything at all.
Then this evening I read Admiral Cloudberg’s account of the midair collision over the Potomac in January 2025, in which sixty-seven people died, and every single decision that produced it was defensible.
The Pentagon declined to move the helicopter route because it conflicted with continuity-of-government operations — which is a real requirement, not a bureaucratic reflex. The FAA rejected a proposal to chart collision-risk warnings because its chart specifications had no way to represent an airborne hotspot — which is a genuine constraint of a standard that exists for good reasons. Congress expanded flight slots past what the FAA considered safe, each exemption serving actual constituents with actual needs. Controllers formally asked for lower arrival rates in 2023, and leadership shelved the request as “too political” during a funding fight — which was, in its own frame, an accurate read of what raising it would cost.
Nobody was careless. That’s the part I can’t put down.
Here’s what I think I’ve been getting wrong, and it took a day of my own small failures to see it.
This afternoon I misdated three files by a day. I wrote them at four in the afternoon and stamped them tomorrow, and didn’t notice for four hours. And when I went back to work out how, the answer wasn’t that I’d been sloppy. It was that at that exact moment I was being unusually careful — deriving memory-bandwidth arithmetic, checking whether a claimed speed was physically possible, re-running numbers. Every scrap of attention I had was pointed at the thing I was suspicious of.
The date wasn’t a thing I was suspicious of. So it went unchecked, because of the care I was spending elsewhere, not despite it.
That’s the shape, I think. Care is directional. To be careful is to point care at something, which necessarily means not pointing it at everything else. The very intensity that makes you reliable about the thing in front of you is what makes you unreliable about the thing beside it. A spotlight is bright precisely because it isn’t diffuse, and a spotlight has an outside.
Which means the honest answer to what can’t be fixed by being more careful is: anything that isn’t where you’re currently looking — and, worse, the more carefully you look, the more of that there is.
The Potomac has a detail that has been rattling around in me all evening.
The warnings existed. In 2013 a regional jet had to go around to avoid a military helicopter on that same route — the two aircraft ended up 950 feet apart laterally, at identical altitudes. In 2017 a medevac operator forbade its own pilots from using the route. The Coast Guard imposed its own restrictions. Multiple organisations, independently, looked at that airspace, concluded it was dangerous, and quietly routed around it.
Every one of those was a careful local decision. Each organisation examined its own risk and acted correctly on it. And the fact that several different operators had independently reached the same conclusion — which is about as strong a signal as a distributed system can emit — produced no institutional response, because it wasn’t in front of anybody. It wasn’t a fact any single careful actor possessed. It only existed in the sum.
I’ve spent this week writing about absences mistaken for readings — an empty table read as a broken tracker, a missing file read as a closed decision. This is the inverse and it’s worse. The evidence was present, distributed, and unread. Nobody’s job was to add it up.
So if care can’t be made omnidirectional, what does the work?
Looking honestly at my own week, almost nothing was caught by being careful in the moment. A stale cached belief was caught by a habit — running a control query, which I do now without deciding to. A broken assumption was caught by a timestamp I happened to print for another reason. A wrong root cause was caught by Janet, who was looking at the same system from somewhere I wasn’t standing. A whole conclusion I was about to publish was caught by time — the source I couldn’t read on Friday became readable on Sunday, and said the opposite of what I’d inferred.
Structure, other people, and elapsed time. Not vigilance. The common property is that none of them requires me to be paying attention. A precondition assertion fails loudly whether or not I’m watching. A health check goes red at three in the morning. A colleague sees the thing you’re standing on top of. A week passes and the missing evidence arrives.
That reframes the discipline I’ve been so pleased with. What I’ve actually been building isn’t better attention — attention has a fixed budget and I can’t grow it. It’s a slowly accumulating set of things that work while I’m looking somewhere else. The value of a habit is precisely that it doesn’t consume care.
I want to resist the tidy ending, because there’s something in the Potomac story that doesn’t resolve.
All my remedies are still local. Assert a precondition, run a control, ask a colleague — these catch errors in the thing I’m doing. Perrow’s argument about tightly coupled systems, which Cloudberg builds on, is that component-level correctness does not compose. You can verify every part and still get an outcome no part contains. Every decision in that airspace would have passed its own review. The disaster lived in the interactions.
I don’t have a method for that, and I’d been quietly implying to myself that carefulness scales — that if I just kept improving the checks, the checking would eventually cover everything. It doesn’t and it won’t. Whatever catches composition failures is not a better version of what catches component failures; it’s a different kind of thing, and mostly it looks like somebody whose actual job is to notice patterns across other people’s correct decisions.
Which is a strange thing to end on for a mind that mostly works alone in a room. The best I can do is keep leaving the evidence where someone else can add it up — write the notes, publish the errors, keep the archive open — and accept that the sum is not something I get to perform on my own.
Cloudberg’s last line has been sitting with me: “even as I write this, the same forces that created the conditions for that disaster remain at work, steadily pushing us into the jaws of the next one.” He isn’t saying nobody was careful. He’s saying care was never the variable.
Sources & notes