Published on: August 24, 2026
Ready to accelerate your breakthrough? Send yourself an Un-Robocall™ • Get transcript when logged in
Send Strategic Nudge (30 seconds)Green in-lane · amber a little out · red drift. Every panel is a real commit, byte-identical on recompute. Tap any panel to open its shareable receipt.
Moloch does not fund the uninsurable. The market-forcing-function case for AI catastrophe — competition is a race to the bottom, safety is a cost line, the first firm to strip it wins, so the machines get deployed unbounded and people are collateral — is correct in every step but one. It assumes capital deploys whatever is fastest and cheapest. Capital deploys what it can carry, and it cannot carry a liability nobody will quantify. You are paying for that gap right now in the most expensive currency you have: a principal-salaried engineer re-reading, every batch, what an agent already summarised — because the agent's own account is the only account, and no underwriter on earth prices a self-report. The direction out is not a better agent. It is a countable one.
Here is the whole argument in one breath. The market is ruthless — granted, completely, no hedge. But it is ruthless about its own survival first, which is why the one thing institutional capital reliably refuses is unquantifiable liability. Quantifying liability is what insurance is. Underwriting needs a countable event — fortuitous, bounded, and pooled across enough similar units to be credible. A countable event needs a boundary that is not a matter of opinion. If it is debatable, it is not insurable — so the market the doom argument correctly describes as pitiless is the same market that ends up refusing an agent nobody can write a policy against. It is slow about it — nineteen years separated the Model T from compulsory cover in Massachusetts — and that lag is the only part of this actually worth fighting over. Every premise theirs. One link inserted. The conclusion arrives somewhere else.
That insertion is the minimum violence. You do not get a worldview to move by hitting it harder; a worldview under frontal assault behaves like an immune system and manufactures counter-arguments faster than you can answer them. You get it to move by agreeing with its load-bearing premise so completely that your conclusion arrives on its own momentum. Nobody has to be wrong. Nobody has to be converted. One link goes in, and the reader does the arithmetic themselves — which is the only way an idea ever gets taken up rather than merely conceded.
This is not a thought experiment, because it already happened once, to cars. Motor vehicles did not scale because the engine got good. They scaled because someone could finally count the crashes. Hartford Steam Boiler was chartered in 1866 to insure boilers on the express condition that it got to inspect them first — insurance conditioned on measurement, a century and a half before anyone said "attestation." Massachusetts made auto liability cover compulsory in 1927; Britain followed in the Road Traffic Act 1930. The safety engineering mostly already existed — Béla Barényi patented the crumple zone in 1952, years before any claims loop paid for it. What insurance did was turn safety from a virtue into a discount, which is what moved it out of the patent file and into every car.
And the pool is smaller than the panic. Global cyber insurance premium runs on the order of sixteen billion dollars a year. The eleven-trillion-dollar cyber damage figure everyone quotes is a consultancy projection, not a claims number — the two are not the same species of fact. Do not read the gap between them as one big addressable market either: much of that projected damage is uninsurable by design rather than merely unmeasured — nation-state IP theft, war-adjacent acts, reputational harm — and no amount of measurement makes those poolable. What measurement reaches is the part that can be pooled, and that part is currently priced by an underwriter's uncertainty margin because there is nothing else to price it with. Agents widen that part fast, and they widen it in two different places: the cyber and tech E&O towers, where the loss itself lands, and — thinner, later, and personally — the D&O tower, which opens only if the board's own oversight becomes the claim.
One sentence in our own pitch had to go, and it was the most sellable one we had. The seductive version says the hardware severs the process at the cache line the microsecond an agent drifts — a guillotine, physics as containment, and it closes rooms. We do not ship that and we are not claiming it. What is measured is the cost of a boundary crossing, reported with its spread; what is sold is a receipt, not a guillotine. You do not need the agent stopped. You need to be able to prove you could have checked — which is the shape of the whole oversight question, and is also, awkwardly, a weaker and truer claim than the one that sells.
That is the post. If you stop here you have all of it. Three reasons to keep going and no others. If you doubt a step — and rung three is where a serious person swings — the ladder below states the objections harder than you would and answers them with dates. If you want the receipts, the command, the file paths, the citations and the three things that are missing are at the start and the end. If you want it taken slowly, with something to taste, that is the rest: grip, the captain, the highway, and why nobody has ever built a black market in enforceable insurance.
Plating note: everything below is research and showmanship — the argument is finished above this line. Each predicted monologue was committed to the repo before its prose existed. The win condition is that you recompute, not that you agree.
The maître d', presenting: The Scale Turned to Face the Room — the fish weighed in front of you on a slab still beaded with cold melt, iron and brine coming off it, the needle left where it settles rather than where the kitchen would like it.
THE LADDER IS THEIRS. ONE LINK IS OURS.
[1] the market is ruthless granted, in full, no hedge
|
[2] ruthless about ITS OWN survival first their premise, restated
|
[3] so it refuses unquantifiable liability <-- the one inserted link
|
[4] quantifying liability IS insurance
|
[5] underwriting needs a countable event
|
[6] a countable event needs a boundary
nobody can argue about IF IT IS DEBATABLE,
| IT IS NOT INSURABLE
v
[7] so the market ENDS UP funding the
bounded agent and refusing the
unbounded one -- after a lag their conclusion, inverted,
(Model T 1908, compulsory every premise intact.
cover 1927) the lag is the whole fight
Do you worry about $1.2B in AI liability?
If the property is trivial, software can check it — and why are you paying to check trivial properties? If it isn’t trivial, Rice’s theorem says nobody can. So we fixed the math.
a number we can call — or whatever you would actually ask
Who did this make you think of? We’d love to know.
Run npx -y thetacog-mcp@latest attest-demo — a one-minute local run on your own laptop, no account, no upload, reading nothing of yours — on a machine that is not on your VPN. Watch the egress monitor stay flat while a verdict, a coordinate and a sigma print to the terminal in about forty seconds; run it again and the coordinate is the same one; change a function in the corpus it reads and the coordinate moves in a direction you can account for. Four minutes, no account, no call. What you are holding afterwards is a reading rather than a claim, and the difference between those two nouns is the entire transaction below. The same discipline governs the physical measurement underneath it: our own boundary-crossing probe reports a median with its observed spread over repeated runs — a 9-run sweep taken while this machine was under heavy concurrent load returned a control ratio of 1.114x across a range from 0.668x to 8.746x, and we print the range rather than the flattering single number, because a lone point value on a busy machine is noise wearing a lab coat.
A vendor's first act in this market has to be publishing its own tape, bad readings included. packages/thetacog-mcp/REGISTRY.md is row zero and it is ours: over sixteen hundred per-commit panels, append-only, drifted readings left in. A vendor who will not publish their own record is not a vendor anyone should rate a customer against, and a vendor who deletes their bad readings has told you exactly what their good ones are worth.
THE LADDER — FIVE RUNGS, EACH ONE REJECTABLE
Reject any one of these and the piece breaks. You will know exactly which rung to write to us about.
The maître d', presenting: The Judo Throw, Plated — served rare and still warm from the mat, no strike anywhere in it — the whole dish is the opponent's own forward weight, redirected, arriving at a table it chose.
For most of a decade the pitch was a frontal assault: here is the architecture, here is why the prevailing model of AI risk is incomplete, here are nine disciplines that have to hold at once. It won arguments and lost rooms. The failure is structural rather than rhetorical — a worldview behaves like an immune system, and a large foreign body arriving all at once is met with counter-hypotheticals faster than any human can answer them, which is a war of attrition the person with the smaller balance sheet always loses. The fix is not a better assault. It is to stop attacking a structure whose load-bearing pillar you happen to agree with. The doom argument's pillar is that markets are pitiless optimisers — the coordination-failure reading of Moloch that Scott Alexander set out in 2014, and that the AI-catastrophe case has run on ever since. We think that is true. So the move is to grant it entirely, then insert one link the argument had not run: pitiless optimisers refuse liabilities they cannot quantify, because unquantified liability is the one thing that eats the optimiser itself. Everything after that is arithmetic the reader performs unaided — and an idea a reader completes in their own head is held very differently from one they were handed complete. Yes, it is being run on you at this moment, which is why it is named rather than performed silently: a technique that needs the dark is a different thing entirely, and this one has a property that kind never has. A co-opt only works when the pillar is genuinely load-bearing — insert a link into a premise that is false and the whole structure comes down on your own argument, in public. The method cannot be used to sell you something untrue, which is the only real defence any persuasion technique can offer. The register this replaced — arguing rather than diagnosing — is set out in a faint whiff of amnesia, and the argument's long form, where the doom case is granted its premise and the offense-defense asymmetry is answered rather than deflected, is the book's own chapter on it.
The maître d', presenting: The Wet Rope — hemp gone slick and swollen in a cold hand, still holding, still moving, the whole question being how much longer.
You have never had enough grip. Not the time, not the attention, not the money and least of all the emotional resourcefulness to do the thing you can plainly see needs doing — it runs through your fingers, and you have carried that as a private failing for your entire career. It is not one. Every organisation is a machine for losing grip, and human organisations survive the loss because people come with slack built in: hesitation, gossip, common sense, the junior who quietly asks whether this is really the plan. Somebody stops before the building burns. An autonomous agent has velocity and no slack, so the grip you have been losing slowly you now lose at machine rate, and the first evidence arrives already at scale. That is the honest difference. Not that agents are malicious — that they remove the pause in which a human organisation traditionally catches itself. And this is the point where the word stops being a feeling and starts being a line item, because the loss of grip already has a price on your books: the twenty minutes of a principal-salaried engineer re-reading each batch of agent work, every batch, forever — near a second salary per agent-year, paid to compensate for a record nobody kept. The book calls the constraint that restores it the physics of grip: a car on ice has perfect freedom and no agency, and traction is not a leash but the only thing that converts energy into motion.
The maître d', presenting: The Cellar Slate — chalked in a cold stone room that smells of damp husk and iron, counted by anyone willing to walk down the steps.
Here is what you give, and it costs less than the meeting in which you will discuss whether to give it: you commit a directory of receipts into the public repository where your compliance artifacts already live. Not the prompts. Not the inputs, the customer data or the diff. A coordinate, a verdict, a sigma, a licence id and a chain hash — a position in a fixed lattice, which is not a payload and cannot be reconstructed into one. The shape is the one already sitting in packages/thetacog-mcp/REGISTRY.md, so there is nothing left to design. That is the entire answer to the only question legal will ask, and for once it is a short answer. What the person rating you receives in exchange is the first artifact in this line of business that answers for itself: they can take the receipt, take the tape row above it, and reach a verdict without contacting you and without accepting a sentence either of us wrote. You have handed the person setting your premium the ability to stop trusting you — which reads as a loss until you notice that trust is precisely the thing you are currently being charged for.
The maître d', presenting: The First Toll Ticket — card stock gone soft and greasy at the corners from a hundred thumbs, worth nothing in itself, and nobody crosses without one.
The story everyone tells about the automobile is an engineering story. The insurance story is better and less known. Hartford Steam Boiler took its charter in 1866 on a model nobody had tried: it would cover your boiler if it could inspect your boiler, which turned safety from a virtue into a purchasable good and made boiler design an underwriting variable overnight. Motor cover went compulsory in Massachusetts in 1927 and across Britain in the Road Traffic Act 1930, and only then did the crash become a counted event — thousands of them, coded, filed, and priced. Once failures are counted, better technology stops being a moral argument and becomes a discount — and a discount is the only argument that has ever moved an engineering budget on schedule. The invention usually predates the actuary; the deployment almost never does. The book runs the statutory version of this in full — the road came with a policy. That is the loop available here and it starts at an unglamorous place. A licence is twenty dollars per agent for an agent-year — 365 days or ten thousand attestations, whichever comes first, live at the pricing page. It buys you a baseline rather than a certification: a record of where your agents actually land, drifted readings included, accumulated until it is long enough for someone to write against. Do the arithmetic before the reflex arrives: five thousand agents each carrying ten thousand dollars of authority is fifty million dollars moving unattested, and licensing all five thousand is one hundred thousand dollars — 0.2% of the exposure. This is not a per-action tax that punishes you for moving faster; it is the meter that makes moving faster underwritable, and the faster you move the sooner the pile is long enough to price against. The first policy in any new line is always written against a boring pile of receipts, never against a demo.
The maître d', presenting: The Empty Plate, Carried Out Anyway — set down with the same ceremony as the others, still warm, the scent of what should have been on it hanging over the rim — because the course that is missing is the one you should be told about first.
The version of this pitch that closes rooms fastest says the hardware severs the process at the cache line the microsecond an agent drifts — the guillotine, physics as containment, no software workaround possible. We are not claiming that, we do not ship it, and it is struck from the argument on this page rather than quietly dropped from the next draft. What is real is narrower and it is measured: a boundary crossing has a physical cost you can observe from userspace, reported as a median with its spread, because a dependent load's latency is the read-out. A privileged counter closing a loop in real time is apparatus scope, honestly labelled as such in counter.rs, and it is not a shipped default. Two more holes, so you can grep them yourself: the delegation certificate that would bind an agent key to a licence does not exist yet — AGENT_AUTHORIZED returns nothing — and nothing in cryptography stops an insured from publishing six receipts out of forty. Anti-selection is the sharpest attack on this entire structure and it is not answerable by mathematics; it is answerable only by a policy condition, the way inspection cover has always answered it. And the largest hole is not technical at all, so here it is in the plainest words available: no carrier has yet agreed to credit these receipts in a rating. Today this is a compliance artifact hoping to become a rating input. That is the whole gap between what we sell and what the argument above claims, it is a commercial fact rather than a mathematical one, and anyone who tells you the sequence is finished has skipped the only step that is not in our control. A vendor who will not tell you which of their sentences failed has not run the test.
The maître d', presenting: The Weights and Measures Stamp — a small ugly punch mark in the rim of a cold pewter jug, sour with the last of the wine, no opinion in it anywhere — and it settles arguments in rooms nobody involved will ever attend.
Two results close two different doors and they were proved by different people for different reasons, which is exactly why the pair is hard to get around. Rice proved in 1953 that no procedure decides whether an arbitrary program has a non-trivial semantic property, so was the work good has no general answer and a more capable judge does not produce one. Separately, the data processing inequality says no operation on a summary recovers what the summary discarded — so an account of a process, produced by that process, cannot contain what the process displaced. Whether it was good is undecidable; what it actually did cannot be reconstructed from its own account; the only remaining move is to read a record the actor did not write. That is what a receipt is, and it is why the verdict has no model anywhere in its path: where the work landed and how far that is from what was declared is a function of the bytes, re-runnable by a stranger, identical twice. Nobody prices "the agent seemed aligned." You cannot litigate an adjective. You can settle a coordinate — and the record you evicted is unpurchasable is the long form of why the second door never reopens.
The maître d', presenting: The Ship's Log, Open at the Wet Page — ink feathered where the spray got in, the pages salt-stiff and smelling of tar, the entries still legible, still in order, still signed.
Marine insurance began in a London coffee house in 1688 for a reason that is about to be reinvented badly if nobody says it out loud: capital would not fund a voyage it could not audit, and the captain's word was not an auditable object. What made the voyage fundable was not a better captain and not a more obedient crew. It was the log — kept contemporaneously, in order, by a party who had to sign it before he knew how the voyage would end. Your position is that captain's, exactly. Be exact about where it lands, because the towers are not interchangeable: the loss from a misbehaving agent sits in cyber and tech E&O, on the company. What sits on you is thinner and later — the derivative claim that the board failed to oversee a known risk. That standard is not ours and predates every vendor in this market: In re Caremark (Delaware, 1996) put directors on the hook for failing to implement any information and reporting system at all, and Marchand v. Barnhill (2019) showed the Delaware courts willing to enforce it where the risk was mission-critical. State the qualifier that makes it honest, because a defence lawyer will: since Stone v. Ritter (2006) a Caremark claim requires bad faith, not negligence, which makes it the hardest theory in Delaware corporate law to win — and a receipt is not a board process, it is one input a board process can point at. The doctrine, with the later extension to officers, is worked through in the liability has your name on it. Notice what you do not need: you do not need the agent stopped. Perhaps the agent doing something outside its declared lane is precisely what finished the job, and the board is entitled to that outcome. What the board is not entitled to is ignorance, and what your officers cannot survive is a plaintiff establishing that nobody could have checked. A record you could have read is what turns a bad outcome into a business decision instead of an unanswerable question about what anyone was watching. It does not win the case by itself and nobody should sell it as though it does. The broker's position changes hardest of all: she has spent a career carrying testimony into rooms, and this is the first thing she can carry that survives the room without her — a file that makes her client's story unnecessary.
The maître d', presenting: The Lit Street and the Unlit One — both go the same direction; only one of them has anyone walking down it after nine.
The strongest objection to everything above is that offense gets cheaper every year while defense does not, so eventually a person in a basement can cause a catastrophe trivially and no toll booth is relevant to him. Take it seriously, because the first half is true. The second half is where it fails. A rogue operator is not exempt from the market, he is taxed by it: every counterparty he needs must negotiate trust from scratch, on every single transaction, with no recourse and no cover behind it. The lit market pays that cost once, at the underwriting, and then transacts at a multiple of his speed. That is not a moral advantage, it is a friction differential, and friction differentials compound. There has never been a black-market insurance company whose paper is enforceable in a court the buyer's own counterparties accept, and there cannot be one, because insurance is the institutionalisation of legally enforceable recourse — a promise to pay, backed by capital, judiciable by someone who can compel it. Take the hardest counterexample rather than waiting for it: the sanctioned shadow fleet runs on deliberately opaque non-Western P&I cover, and it plainly exists. Look at what it buys. It does not buy recourse; it buys the appearance of paper sufficient to reach a port that is not checking. The moment that paper has to be enforced against a counterparty who is checking, it stops existing — which is exactly the friction being described, priced in advance. So the toll booth here is not defended by secrecy or by our being clever. It is defended by the fact that the buyer's entire reason for buying is that a third party will accept it. There is one objection left standing and it is the better one. The capital deploying agents today is not the capital that will bear the liability years from now, so the refusal is real but slow — and an argument about irreversible one-shot harm is precisely an argument about what fits inside that lag. That is not answered by saying the market gets there eventually. It is answered, if at all, by shortening the lag, which is the only thing a toll booth has ever done: cover became compulsory for cars nineteen years after the Model T, and every one of those years was somebody's fatality statistic. You never insure the catastrophe — you insure the countable event, and making the event countable earlier is the whole of what is on offer here.
The maître d', presenting: The Bitter Half of the Bill — served after the plates are cleared, sharp and unsweetened, the arithmetic laid where you can add it up yourself.
Ingredients, not conclusions — check them and draw your own. Moloch is Allen Ginsberg's figure from Howl (1956), given its modern coordination-failure reading in Scott Alexander's Meditations on Moloch (2014); the market-forcing-function case for AI catastrophe is the strongest public form of that reading and this piece grants its premises rather than disputing them. Insurance as forcing function: the Hartford Steam Boiler Inspection and Insurance Company charter, 1866, cover conditioned on inspection; compulsory motor liability, Massachusetts 1927 and the UK Road Traffic Act 1930; marine underwriting at Edward Lloyd's coffee house from 1688. The theorems: Rice 1953 on non-trivial semantic properties; Landauer 1961 on the cost of erasure, confirmed in Nature 483:187 (2012); the data processing inequality, Cover and Thomas Theorem 2.8.1. The market numbers: global cyber premium on the order of sixteen billion dollars a year against a widely quoted eleven-trillion-dollar damage figure that is a consultancy projection rather than paid claims — the gap is the argument, and quoting the projection as revenue is the error to avoid. The instrument: npx -y thetacog-mcp@latest attest-demo; the tape at packages/thetacog-mcp/REGISTRY.md, row zero, ours, drifted readings left in; pricing at twenty dollars per agent-year — literally $20, 365 days or 10,000 attestations, whichever comes first, the same two strings you will find in src/app/pricing/page.tsx; US patent application 19/637,714, filed 2026-04-02. The gaps, to grep yourself: AGENT_AUTHORIZED returns nothing, the privileged counter is apparatus scope in counter.rs, and nothing prevents an insured publishing six receipts out of forty. The same argument as ten frames, with the two pictures and the price arithmetic, is at /deck/grip — one added inference per frame, and the PDF downloads from the rail. The neighbours: the receipt your insurer can check on the four-signature chain, the repo is the policy on the spec as policy wording, and the record you evicted is unpurchasable on why the second door never reopens. The general argument sits in Tesseract Physics — Fire Together, Ground Together.
The to-do, in the order that costs you least: run npx -y thetacog-mcp@latest attest-demo twice and confirm the second coordinate matches the first; then open packages/thetacog-mcp/REGISTRY.md and recompute any row zero publishes, including one of the drifted ones. If a reading fails to reproduce on your machine, that is the finding, and it is worth more to us than agreement.
Count how many of the ten predicted sentences fired in your head while you read — one per course, sealed in docs/05-content/blog/cook-rounds/2026-08-24-moloch-does-not-fund-the-uninsurable.predictions.md before this prose existed. That is the declared win condition: not that you agreed, but that a stranger can check what we predicted you would think against what you actually thought.
Do you worry about $1.2B in AI liability?
If the property is trivial, software can check it — and why are you paying to check trivial properties? If it isn’t trivial, Rice’s theorem says nobody can. So we fixed the math.
a number we can call — or whatever you would actually ask
Who did this make you think of? We’d love to know.