Resilience has become one of the most frequently invoked terms in contemporary governance discourse. It appears in national infrastructure strategy, in EU regulatory instruments, in corporate risk disclosures, in the vocabulary of international development organizations, and in the strategic planning documents of institutions ranging from central banks to universities. Its near-universal adoption suggests consensus: resilience is desirable, its absence is dangerous, and institutions should cultivate more of it. What this consensus rarely produces, however, is agreement on how one would determine, for a specific institution at a specific moment, whether resilience is actually present.

This is not a minor terminological gap. It is a structural one. A term that every institution claims to embody, but that no institution can be shown to lack through any agreed procedure, has ceased to function as a diagnostic category and has become instead a form of institutional self-description — a claim made about a system rather than a property that can be verified against it. The word continues to carry analytical weight in academic literature, where resilience has been given increasingly precise treatment across ecology, engineering, and social-ecological systems research (Holling 1973; Walker et al. 2004; Folke 2016). But the gap between this academic precision and the term's institutional usage has widened rather than narrowed. An organization can describe itself as resilient in a strategy document without that description being falsifiable by anyone reading it — including, in many cases, the organization itself.

The consequence is familiar from the history of other governance concepts that underwent the same drift. A requirement stated as a desirable property, without a specification of what would count as satisfying or violating it, tends to be satisfied by declaration rather than by structure. This is not a claim about bad faith. It is a claim about what happens, predictably, when a governance vocabulary outpaces its own operationalization: institutions do not become less resilient because they are dishonest about it, but because there is no available procedure for anyone — regulator, board, or the institution's own leadership — to determine the difference between an institution that has built resilience and one that has merely described itself using the word.

The central distinction this essay develops is between the presence of resilience discourse and operative resilience — a structure that would actually behave differently under stress than a comparable structure lacking it. This distinction does not originate in institutional theory alone. It has a close structural relative in a separate strand of analysis concerned with a different governance failure: the difference between a decision process that formally includes a human participant and one in which that participant holds genuine authority over the outcome (Krasovski 2026a). In both cases, the difficulty is the same in shape, even though the domains are unrelated. A governance requirement is specified in terms of a visible, checkable feature — a human-in-the-loop, a resilience commitment — while the substantive property the requirement was meant to secure is left unspecified, and therefore unverifiable, and therefore free to be absent even where the visible feature is fully present.

What follows from this parallel is not an analogy offered for rhetorical effect but a methodological commitment. If mandate could be pulled apart from presence and given a structural specification — a set of parameters whose configuration determines where a given system actually sits on a spectrum of operative authority — the same operation should be possible for resilience. The task of this essay is to carry out that operation: to move from resilience as an invoked property to resilience as a diagnosable structure, specified in terms precise enough that a given institution's position can be located, contested, and revised.

This task does not begin from nothing. Three prior analyses have already mapped substantial parts of the terrain, and each supplies a piece of the argument that the present essay is designed to complete.

The first established that institutional fragility is not best understood as failure in the ordinary sense — the result of poor decisions, inadequate leadership, or unforeseeable shocks — but as an emergent property of complexity itself (Krasovski 2025a). Institutions accumulate interdependency, procedural density, and interconnection as a natural consequence of scaling and of responding to prior perturbations, and this accumulation systematically erodes the very buffering capacity that would allow the institution to absorb the next shock. Fragility, on this account, is frequently a by-product of success rather than a symptom of mismanagement: a system optimized for smooth operation under known conditions loses, in the process, precisely the redundancy and structural slack that would have allowed it to survive conditions it had not anticipated. This analysis further identified the dynamics that follow once a system crosses into what it terms systemic overheating — the point at which incoming complexity outpaces adaptive processing capacity — including the emergence of self-organizing alternatives and the eventual possibility of phase transition into a qualitatively different configuration.

The second supplied a positive model to place alongside this diagnosis (Krasovski 2025b). It proposed that resilience under conditions of accelerating change cannot be produced by technological capability alone — better forecasting, better automation, better risk modeling — because technological capability improves anticipation without producing the coordinated behavioral response that anticipation requires. It located a second, cultural layer beneath the technological and institutional ones: cultural stabilization, understood as the mechanisms by which shared expectation and behavioral predictability are sustained without coercive enforcement. From this it derived a practical model, the Resilience Triangle, in which cultural stabilization, institutional adaptivity, and technological predictive capacity function as three mutually reinforcing — and mutually necessary — components, such that deficiency in any one component produces a specific and recognizable form of structural weakness in the whole.

The third took the diagnosis and the model and asked what an institution would need to look like architecturally in order to satisfy them (Krasovski 2025c). It reconceived institutions not as fixed bureaucratic entities but as reconfigurable interaction protocols, and derived from this reconception a set of design principles — modularity, transparency, cultural synchronization, technological neutrality — intended to allow institutional structures to adjust their own operating parameters as conditions shift, rather than requiring costly and slow structural replacement each time inherited assumptions fail.

Taken together, these three analyses constitute a coherent progression: a diagnosis of why institutions become fragile, a model of what stabilizes them, and an architecture for designing that stability in from the outset. What none of the three supplies — and what none was attempting to supply — is a way of taking a specific, named institution and locating its actual position with respect to any of this. The first analysis explains fragility as a general dynamic of complex systems; it does not offer a procedure for reading a particular institution's exposure to that dynamic off its actual structure. The second identifies three necessary components of resilience; it does not specify how strong or weak a given institution's cultural stabilization currently is, or by what observable signal one would know. The third specifies design principles an institution should embody; it does not provide a method for auditing whether an existing institution embodies them, or to what degree, or where precisely it falls short.

This is the gap the present essay is built to close. What is needed is not a fourth description of resilience in general terms, but a diagnostic instrument: a small number of structural parameters, specified precisely enough that they can be read off an actual institution rather than asserted about it, together with a way of naming the distinct failure modes that arise when specific parameters are absent, degraded, or actively suppressed. The chapters that follow develop that instrument directly, beginning with a distinction — between robustness, redundancy, and resilience proper — that existing usage has consistently allowed to collapse into a single, undifferentiated term.

The word resilience is used, in most institutional and policy contexts, as though it named a single property that a system either has or lacks. This usage obscures a distinction that was present at the term's origin and has been steadily lost in its subsequent popularization. The distinction is not a matter of academic pedantry. It determines what an institution actually builds when it sets out, in good faith, to "become more resilient" — and, as this chapter will argue, institutions that conflate the three variables at stake tend to build the wrong one.

The origin of the distinction lies in ecology, in a paper that predates almost all of the resilience literature now current in governance and policy discourse. Holling's foundational 1973 analysis distinguished between what he termed stability and resilience as properties of ecological systems, and the distinction he drew maps with surprising directness onto the institutional case. Stability, in his usage, describes a system's tendency to return to a single equilibrium state following a disturbance, and is closely associated with the capacity to resist displacement from that state in the first place. Resilience, by contrast, describes a system's capacity to absorb disturbance and reorganize while still retaining essentially the same function, structure, and identity — a property that does not require, and is not measured by, a system's ability to avoid change, but rather by its capacity to undergo change without ceasing to be recognizably itself. Holling's central and still under-absorbed finding was that these two properties are not merely distinct but can trade off against one another: a system optimized to maximize stability — to resist displacement, to minimize variance, to return reliably to a known state — can in the process reduce its resilience, because the very mechanisms that suppress small fluctuations also suppress the diversity of response that would be needed to survive a large one.

This finding has a direct institutional analogue, and it is one that the diagnosis of institutional fragility already developed elsewhere in this framework depends upon without yet naming explicitly (Krasovski 2025a). An institution can be robust — meaning resistant to a known, anticipated category of shock — through mechanisms that simultaneously and necessarily reduce its capacity to survive an unanticipated one. Robustness, on this reading, is the institutional analogue of Holling's stability: it describes the capacity to withstand a specific, modeled disturbance without structural change. A dam engineered to withstand a hundred-year flood is robust with respect to that flood. It is not thereby resilient, in Holling's sense, to a class of disturbance the engineering did not anticipate — an earthquake, a design flaw discovered only under load, a change in upstream land use that alters the flood's actual character. Robustness is disturbance-specific by construction; resilience, properly understood, is not.

Redundancy occupies a third, distinct position, and normal-accident theory supplies the reason it cannot be treated as interchangeable with either of the other two. Perrow's analysis of complex technological systems demonstrated that redundancy — the presence of backup capacity, parallel pathways, or buffering margin — does not straightforwardly produce resilience, because redundancy interacts with a second structural variable, the tightness of coupling between a system's components, in ways that can make the combination more dangerous rather than less (Perrow 1984). In a loosely coupled system, redundant capacity behaves as intuition suggests it should: a failure in one component is contained, and the backup absorbs the load without the failure propagating elsewhere. In a tightly coupled system, however, redundancy can accelerate and obscure failure rather than arresting it — additional components mean additional interactions, additional interactions mean additional ways for an unanticipated combination of failures to arise, and the very complexity that redundancy introduces can outpace any single operator's or institution's capacity to understand what the system is actually doing in the moment of crisis. Perrow's term for this configuration — one in which complexity and coupling combine such that failure becomes not merely possible but, over a sufficient time horizon, effectively inevitable — was the normal accident: an outcome built into the structure of the system rather than produced by any identifiable error within it.

The three variables can now be stated with the precision the rest of this essay requires. Robustness is resistance to a specified, anticipated disturbance, and is achieved by hardening a system against that disturbance's known parameters. Redundancy is the presence of buffering or backup capacity, and its effect on overall system safety is conditional — beneficial under loose coupling, potentially counterproductive under tight coupling, in ways that cannot be assessed by examining redundancy in isolation from the coupling structure it sits within. Resilience proper is the capacity to absorb a disturbance that exceeds what the system's robustness measures anticipated, and to reorganize afterward while retaining core function — a capacity that depends not on the absence of disturbance, nor even primarily on buffering capacity, but on the diversity and availability of alternative configurations the system can adopt once its primary mode of operation has failed.

The practical significance of keeping these three variables separate is that most contemporary institutional "resilience" initiatives are, on inspection, robustness initiatives: they identify a specific, previously experienced category of failure and invest in hardening the institution against a recurrence of that specific category. This is not a criticism of such initiatives on their own terms — hardening against a known and recurring threat is often the correct and proportionate response to it. The failure is definitional, not practical: calling the result resilience, when what has been built is robustness against a named threat, creates the appearance of a broader capacity that the institution does not in fact possess, and does so in exactly the register — presence standing in for the substantive property it is meant to indicate — that Movement I identified as the essay's central problem.

This is the conceptual wedge on which the remainder of the essay turns. If resilience cannot be reduced to robustness, and redundancy cannot be assessed independently of coupling, then any instrument that claims to diagnose institutional resilience must specify — separately, and without collapsing them into one another — the parameters governing each of these variables and the relationships between them. That specification is the task of Movement IV. Before it can be undertaken, however, one further conceptual step is required: a definition of what, precisely, is being diagnosed when an institution's position with respect to these variables is assessed, and a clear statement of what such a diagnosis is not — a caution made necessary by the history of an almost structurally identical concept in a different field entirely, examined next.

The distinction established in the preceding chapter — between robustness, redundancy, and resilience proper — makes it possible to state precisely what this essay proposes to measure. It does not propose to measure whether an institution "is resilient," a formulation that treats resilience as a binary property an institution either possesses or does not. It proposes instead to specify the Resilience Profile: the continuous, observable position of a given institution across a bounded set of structural parameters, at a specified moment, under specified operating conditions.

Three features of this definition require immediate emphasis, because each departs from how resilience is conventionally discussed, and each departure is load-bearing for everything that follows.

The first is continuity. The Resilience Profile does not sort institutions into resilient and non-resilient categories. It locates an institution along several independent gradients simultaneously, in the same way that the Delegation Gradient developed elsewhere in this research program locates a human-machine configuration along a continuous distribution of effective authority rather than classifying it as human-in-the-loop or not (Krasovski 2026a). A resilience diagnosis that produces only a binary verdict has already discarded the information a governance body would actually need: not whether the institution clears some threshold, but which specific structural parameters are strong, which are weak, and — critically — whether the weak parameters are the ones most likely to be tested by the disturbances the institution is actually exposed to.

The second is specificity to a moment and to conditions. An institution's Resilience Profile is not a fixed trait comparable to a founding charter or a legal designation. It is a reading, taken against a specific configuration of internal structure and external pressure, and it can shift — sometimes substantially — as either changes. An institution that shows a strong profile under conditions of gradual, anticipated change may show a markedly different profile once the tempo or character of the disturbance it faces shifts outside the range its structure was built to accommodate. This is not a weakness of the instrument; it is a fidelity to the phenomenon. A diagnostic that returned the same answer regardless of context would not be describing resilience at all, since resilience — as Chapter 3 established through Holling's original distinction — is defined precisely by how a system behaves when conditions move outside its anticipated range, not by any property it exhibits when they do not.

The third, and most consequential, is that the Profile is deliberately multi-dimensional rather than aggregated. An institution can register a strong position on one parameter and a weak position on another simultaneously, and the Profile is designed to preserve this unevenness rather than average it away. A financial institution may exhibit strong redundancy — ample capital buffers, diversified funding sources — while exhibiting weak observability, in the sense that neither its regulators nor its own leadership can accurately perceive the correlations between the risks those buffers are meant to absorb. Collapsing these two readings into a single score would report a moderate, unremarkable position; preserving them separately reveals an institution that looks safe on paper and is exposed in exactly the dimension its paper does not measure. This is not a hypothetical concern, and Movement IV will return to a case in which precisely this configuration proved decisive.

The Resilience Profile, then, is not a rating and does not aspire to be one. It is closer in spirit to a structured reading of a system's current position across several genuinely independent axes — a description of where an institution currently sits, not a verdict on what it is. What produces that position — the underlying structural configuration from which a given Profile results — is a separate matter, taken up in Movement IV under the name Resilience Architecture. The relationship between the two mirrors the relationship, in the companion analysis of delegated authority, between the Delegation Gradient and the Delegation Architecture that produces it: the Profile is the reading; the Architecture is the structure. A given Architecture will, depending on operating conditions, produce different Profile positions over time — which is precisely why analyzing the underlying Architecture yields more durable diagnostic value than reading the Profile at any single moment, however carefully that reading is taken.

Before the Architecture and its parameters can be specified, however, one further and more delicate matter needs to be addressed directly, because history offers a specific and instructive warning about what happens when a diagnostic instrument of exactly this kind is built and then misapplied.

The temptation this framework must guard against is not a hypothetical one. It has a documented precedent in the recent history of institutional risk measurement, and the precedent is close enough to the present case that it deserves to be named plainly rather than gestured at.

Credit ratings supply the clearest instance. A credit rating was conceived as a compressed judgment about a specific, bounded question — the likelihood that a given instrument would default under given conditions — issued by an agency positioned to observe structure that outside investors could not easily observe themselves. In principle, nothing about this task required the judgment to be treated as a fixed, general property of the institution rated, still less as a substitute for understanding the structure that produced it. In practice, the rating was precisely what regulators wrote into capital requirements, precisely what pension funds and money-market instruments used as an eligibility threshold, and precisely what a AAA-rated mortgage-backed security's own issuers pointed to as evidence of underlying soundness in the years immediately preceding 2008. The rating had been built to compress a genuinely multi-dimensional judgment — about underlying asset quality, about correlation between component risks, about the structural assumptions built into the modeling — into a single letter grade, and the letter grade then circulated through the financial system doing exactly what single numbers do: substituting for the structural understanding it was meant only to summarize. By the time this became visible, the compression itself had become a systemic vulnerability, embedded in regulatory capital rules across the global banking system.

Scott's analysis of the broader phenomenon this exemplifies gives it a general name: the drive of large administrative systems toward legibility — toward representations simple enough to be read, compared, and acted upon at scale — routinely produces representations that discard exactly the local, structural detail that determined whether the underlying reality the representation stood for was actually sound (Scott 1998). This is not a failure specific to finance. It is a structural tendency of any system under pressure to compare, rank, or regulate at scale: the more consequential a single number becomes, the stronger the pressure to optimize the number itself rather than the underlying condition it was designed to track — a dynamic economists have long identified as a general property of measurement under incentive, and one with direct application here: a resilience score, once embedded in a regulatory threshold or a board-level target, becomes a thing institutions manage toward, which is not the same as becoming a thing institutions actually possess more of.

The Resilience Profile developed in this essay is exposed to exactly this pressure, and for an identifiable reason: institutions, regulators, and rating agencies have a structural preference for single numbers. A single resilience score is easier to compare across institutions, easier to embed in a regulatory threshold, easier to report to a board in one line of a briefing document. Every one of these conveniences is real. None of them is a reason to build the instrument that way, because each depends on discarding exactly the information — the unevenness across independent parameters described in Chapter 4 — that gives the Profile its diagnostic value in the first place. A single aggregated score cannot distinguish an institution with uniformly moderate resilience across all parameters from an institution with excellent redundancy and catastrophic observability, even though these are, for any institution actually facing a disturbance, entirely different risk profiles requiring entirely different remediation.

There is a further reason to resist aggregation, and it follows directly from the relationship between smoothing and hidden risk under conditions of uncertainty. Taleb's analysis observes that interventions which suppress the visible frequency of small disturbances frequently do so by concentrating risk into a smaller number of larger, less frequent events — a dynamic in which a system appears increasingly stable by every visible metric in the period immediately before it fails catastrophically (Taleb 2012). A single resilience score is exactly the kind of visible metric this dynamic would corrupt: an institution's leadership, presented with a single number trending favorably, has every incentive to treat that trend as reassurance, precisely in the circumstances where the underlying configuration may be exchanging frequent, informative, low-consequence signals for rare, uninformative, high-consequence ones. Meadows's systems-theoretic treatment of the same phenomenon frames it as a general property of complex systems under performance pressure: metrics that are optimized directly tend to become decoupled from the underlying reality they were designed to track (Meadows 2008).

The governing constraint that follows from this chapter, and that the remainder of the essay observes without exception, can be stated as a single principle: the Resilience Profile is reported as a set of positions across independent parameters, never collapsed into a composite index. Where comparison across institutions or across time is genuinely required, that comparison should be made parameter by parameter, with explicit attention to which specific dimension is improving or deteriorating, rather than through any single figure that would necessarily obscure exactly the unevenness this framework exists to reveal. A diagnostic instrument that cannot be misused as a ranking tool is, for the purposes this essay is concerned with, a better instrument than one that can — even at the cost of the administrative convenience a single number would offer.

With the Profile defined, and the boundary of its proper use established, the essay can proceed to the structural specification that produces it: the seven parameters of the Resilience Architecture, developed in full in Movement IV.

The Resilience Profile, as defined in Chapter 4, describes a reading: the position an institution occupies, at a given moment and under given conditions, across a set of independent parameters. It does not, by itself, explain why an institution occupies that position, nor does it indicate whether the position is likely to hold once conditions change. For that, a different and more fundamental specification is required — one that describes not where an institution currently sits, but the underlying structure responsible for producing that position in the first place.

This distinction between a reading and the structure that generates it is not new to this research program. It reproduces, in a different domain, the relationship developed elsewhere between the Delegation Gradient and the Delegation Architecture that determines it (Krasovski 2026a). There, the Gradient describes where a given human-machine configuration sits on a spectrum of effective authority at a specific operational moment; the Architecture describes the seven structural parameters — governing initiation, confirmation, override, information access, delay, failure response, and meta-authority — whose particular configuration produces that position. The same relationship holds here. The Resilience Architecture of an institution is the full structural specification of how that institution accumulates, distributes, and depletes its capacity to absorb disturbance and reorganize — a specification that, once given, allows the Resilience Profile at any particular moment to be understood as a consequence of structure rather than treated as a freestanding fact about the institution.

The practical significance of this distinction is considerable, and it justifies the shift in analytical attention from Profile to Architecture that occupies the remainder of this movement. A single Architecture will, depending on operating conditions, produce markedly different Profile positions over time. An institution's redundancy may appear ample under conditions of gradual, anticipated change and prove entirely inadequate once the tempo or correlation structure of the disturbances it faces shifts — not because the institution's redundancy has itself changed, but because the same underlying capacity is being tested against a different demand. A Profile reading taken at a single moment cannot distinguish between an Architecture that is robust across a wide range of conditions and one that happens, by chance of timing, to be read during a favorable interval. Analyzing the Architecture directly — asking what would happen to this specific parameter configuration under a range of plausible stresses, rather than asking only how the institution is currently performing — is therefore more diagnostically informative than any single Profile reading, however carefully that reading is taken. This is the same argument, transposed without modification, that justified treating Delegation Architecture as the primary object of analysis in the companion framework rather than the Delegation Gradient it produces.

The chapter that follows specifies the Resilience Architecture through seven parameters, denoted R1 through R7, each defined with the same structure used previously for the parameters of delegated authority: the variable the parameter captures, the range of configurations it admits, and the risk indicator associated with each configuration. Together, these seven parameters constitute a template against which a specific institution's Architecture can be read, and from which the failure taxonomy developed in Movement V — four distinct categories of resilience failure, each traceable to a specific pattern across these parameters — is derived.

Two cases are used throughout the remainder of this movement, and through Movement V, as worked illustrations of how the parameters apply to institutions that actually existed and actually failed. The first is the collapse of the Texas electrical grid during Winter Storm Uri in February 2021 — a case of architectural failure at infrastructure scale, in which interdependent physical systems propagated a shock across sectoral boundaries that no single governing institution had modeled as a unified whole. The second is the Post Office Horizon scandal in the United Kingdom, in which a defective accounting system generated false evidence of financial shortfalls that the responsible institution suppressed, denied, and prosecuted upon for more than a decade — a case of architectural failure at institutional scale, in which the mechanism of failure was not physical propagation but the active degradation of the institution's own capacity to perceive what its system was actually doing.

The two cases share no domain, no physical mechanism, and no comparable timescale: one unfolded over several days in a single American state; the other unfolded over more than fifteen years across thousands of small business premises in the United Kingdom. This is precisely what makes their structural convergence significant. Where the two cases activate the same parameter — as they do, in different ways, for the question of what each institution could actually observe about its own operating state — the convergence is evidence that the parameter is capturing something structural about institutional failure in general, rather than something incidental to the particular sector or period each case happened to occur in. The chapter that follows works through each of the seven parameters in turn, reading both cases against each one where the case supports a meaningful reading, and leaving the parameter illustrated by a single case where the other case does not bear on it.

The Resilience Architecture of an institution is specified through seven parameters. Each is defined below according to the same structure used for the Delegation Architecture's seven parameters: the variable the parameter captures, the configurations it admits, and the risk indicator associated with each configuration. Where the two anchor cases — the 2021 Texas grid collapse and the UK Post Office Horizon scandal — illuminate a given parameter, their readings are given directly beneath it.

Variable: the buffering capacity an institution holds against disturbance that exceeds its anticipated operating range.

Configurations: High Reserve — capacity is maintained well beyond expected peak demand, at a direct and visible cost to efficiency; Nominal Reserve — capacity is matched to historical peak conditions, with no meaningful margin against a disturbance outside that historical record; Optimized-Minimum — capacity has been reduced to the lowest level compatible with normal-case operating cost, typically as the endpoint of a sustained efficiency-seeking process.

Risk indicator: Optimized-Minimum configurations are rarely the product of neglect. They are more often the visible result of prior success — a system that has operated without failure for a sustained period accumulates pressure, from cost competition or from internal efficiency mandates, to treat its unused buffering capacity as waste rather than as insurance. The parameter's danger lies precisely in this: the erosion of R1 typically looks, from inside the institution, like improvement.

Case reading — Texas Uri. The Electric Reliability Council of Texas operated with an approximate 13 percent reserve margin — a configuration adequate to expected seasonal peak demand but carrying no meaningful buffer against a correlated, system-wide cold-weather event capable of simultaneously suppressing supply and elevating demand. This was Optimized-Minimum by design rather than by oversight: Texas's deregulated, cost-competitive electricity market structure contained no mechanism that priced or rewarded the maintenance of idle reserve capacity, and every actor within that market was responding rationally to the incentives the market presented. The failure was not a departure from the system's logic. It was among that logic's more predictable outputs.

Variable: the degree of interdependency between subsystems whose failure modes are not independent of one another.

Configurations: Loosely Coupled — a failure in one subsystem is contained, and any dependency on other subsystems is slow-acting enough to allow intervention before propagation; Tightly Coupled, Modeled — a fast-acting interdependency exists and is known to, and monitored by, at least one institutional actor with visibility across the coupled subsystems; Tightly Coupled, Unmodeled — a fast-acting interdependency exists but sits outside any single institution's monitoring boundary, typically because the coupled subsystems fall under separate regulatory or organizational jurisdictions.

Risk indicator: Tightly Coupled, Unmodeled is the most dangerous of the three configurations, and it is dangerous for a structural reason rather than an informational one: the interdependency is often perfectly well understood at the level of physical or technical mechanism, and fails not because no one could have known, but because no single actor's institutional mandate extends across the boundary where the coupling activates (Perrow 1984).

Case reading — Texas Uri. The interdependency between natural gas supply and electricity generation was physically well documented before February 2021: freezing conditions were known to threaten wellhead and pipeline operation, and gas-fired generation was known to depend on that supply. What was Unmodeled was not the mechanism but its institutional treatment — the electricity grid operator's monitoring and planning authority stopped at the boundary of electricity generation and did not extend upstream into the gas supply chain that generation depended on, nor downstream into the water-treatment and medical-service systems whose operation depended, in turn, on electricity. The coupling propagated across three sectoral boundaries in sequence, and at no point did the propagation cross into territory that any single institutional actor was positioned to observe as a unified sequence rather than as three separate, sector-specific failures.

Variable: the time elapsed between a perturbation occurring within a system and that perturbation being detected by the system's own monitoring apparatus.

Configurations: Real-Time Detection — the perturbation is registered by the monitoring apparatus at or near the moment it occurs; Delayed Detection — the perturbation is registered only through periodic reporting cycles, introducing a lag between occurrence and awareness; Structurally Suppressed Detection — the monitoring apparatus itself is compromised, incentivized against accurate reporting, or otherwise prevented from registering the perturbation regardless of how long is allowed to elapse.

Risk indicator: Structurally Suppressed Detection differs from Delayed Detection in kind rather than degree. Delay is a property of reporting cycles and can, in principle, be shortened. Suppression is a property of the institution's incentive structure, and shortening a reporting cycle does nothing to correct it — the institution will continue not to see what it is structurally disposed not to see, however frequently it is asked to look.

Case reading — Horizon. This parameter is best illustrated by the Post Office case, and belongs unambiguously to the Structurally Suppressed category rather than the merely Delayed one. Internal awareness that the Horizon accounting system was capable of generating erroneous shortfalls existed within the institution for a substantial period before that awareness was acted upon or disclosed; the institution's own investigative and legal functions continued, over that period, to treat the system's output as reliable and to pursue prosecutions on that basis. The latency here was not a gap in monitoring infrastructure. It was sustained by the institution's own incentive to treat the system as reliable, since acknowledging otherwise would have implicated its own prior prosecutorial conduct — a self-reinforcing condition that no increase in reporting frequency could have corrected.

Variable: the rate at which an institution's formal structure can actually change in response to a demonstrated failure, as distinct from the rate at which such change is nominally permitted.

Configurations: Rapid — structural change follows a demonstrated failure within a single operational cycle; Bureaucratically Bounded — structural change requires a multi-year regulatory, legislative, or procedural process, during which the institution continues to operate under the configuration that produced the failure; Structurally Frozen — no existing mechanism permits revision of the specific parameter that failed, regardless of how clearly the failure has been demonstrated.

Risk indicator: Bureaucratically Bounded configurations carry a specific and recurring danger: the interval between a demonstrated failure and its completed remediation is frequently long enough for a second, avoidable instance of the same failure to occur before the first has been corrected.

Case reading — Texas Uri. A smaller-scale winter storm in 2011 had already exposed the same vulnerability — inadequate weatherization of gas and generation infrastructure against extreme cold — and produced recommendations for mandatory weatherization standards. Those recommendations were not made binding. By February 2021, the same failure mode recurred at substantially larger scale and cost. This is a near-paradigmatic instance of Bureaucratically Bounded reconfiguration: the lesson had been correctly identified a decade earlier, but the institutional architecture possessed no mechanism that converted an identified lesson into a binding structural change before the next disturbance arrived to test whether the lesson had been learned.

Variable: the alignment between an institution's formal self-representation and the lived, operative reality experienced by those who depend on it.

Configurations: Synchronized — the institution's formal claims about its own reliability or function match its operative reality; Lagging — formal claims accurately described an earlier state of the institution but have not been updated to reflect subsequent change; Actively Misaligned — formal claims are maintained despite the institution's internal awareness that they contradict its operative reality.

Risk indicator: Actively Misaligned configurations convert what might otherwise be a contained technical failure into a compounding institutional legitimacy crisis, because each repetition of the false claim after the point of internal awareness constitutes an independent act rather than a residual consequence of the original error.

Case reading — Horizon. The Post Office's public and legal position throughout the greater part of the scandal — that the Horizon system was reliable, and that resulting discrepancies indicated employee dishonesty rather than software defect — remained Actively Misaligned for well over a decade after internal doubt about the system's reliability had demonstrably formed. This parameter, more than any other, explains why the case produced a trust catastrophe rather than a contained and correctable technical failure: the harm compounded specifically because the institution's formal claim was repeated, in courtrooms and in public statements, after the point at which the institution possessed the information required to know the claim was false.

Variable: the breadth of distinct, genuinely independent response strategies available to an institution once its primary mode of operation has failed.

Configurations: Diverse Repertoire — multiple independent response pathways exist, such that the failure of one does not foreclose the others; Narrow Repertoire — a single dominant strategy exists, with no meaningfully independent fallback; Monoculture — all available response pathways share a common failure mode, such that a single triggering condition can disable the entire repertoire at once.

Risk indicator: Monoculture is the most severe configuration under this parameter, precisely because its danger is invisible under normal operation — a system with several nominally distinct response options can still be a Monoculture if all of those options depend on the same underlying condition, and this dependency is frequently discovered only at the moment it fails to hold.

Case reading — Texas Uri. The Texas electrical grid operates largely in electrical isolation from the two major interconnected grids covering the rest of the continental United States, a structural choice made in significant part to remain outside a specific tier of federal regulatory jurisdiction. Under ordinary conditions this isolation is invisible as a vulnerability. Under Winter Storm Uri, it became decisive: when in-state generation failed, the grid possessed no significant capacity to import electricity from neighboring, unaffected systems, because the isolation that had been designed into the system for regulatory reasons also foreclosed the fallback pathway that an interconnected grid would have made available. This is Narrow Repertoire by architectural design rather than by absence of foresight — the single dominant strategy (in-state generation) had been chosen deliberately, and the tradeoff it carried was not activated, and therefore not visible, until the specific conditions that exposed it arrived.

Variable: the degree to which relevant actors — both internal to an institution and affected by it externally — can accurately perceive the institution's actual operating state.

Configurations: Fully Observable — the institution's state is legible to affected external parties, not only to its own operators; Partially Observable — the state is legible to internal operators but not to external parties who depend on the institution's function; Adversarially Obscured — the institution's design, procedures, or incentive structure actively degrade legibility to precisely the external parties who bear the consequences of the institution's failures.

Risk indicator: this is the parameter on which the most consequential of the four failure types developed in Movement V is built directly, and it is worth noting in advance that Adversarially Obscured configurations need not arise from any deliberate intention to conceal — they can emerge, as the case below illustrates, from a legal or procedural default that happens to place the burden of proof against the party least able to bear it.

Case reading — Horizon. Subpostmasters operating under the Horizon system had no practical means of independently auditing the system's transaction logs, and the system's output was, in the relevant legal proceedings, treated as self-evidently reliable evidence against them. This configuration is Adversarially Obscured rather than merely Partially Observable, and the distinction matters: it was not simply that subpostmasters lacked technical access to the system's internals — an ordinary and often unavoidable condition of using any complex software — but that the surrounding legal and institutional architecture placed the evidentiary default in the system's favor, such that the burden fell on the affected party to disprove a system they had no means of inspecting, rather than on the institution to demonstrate the system's reliability before relying on its output in a prosecution.

The seven parameters specified in this chapter do not operate independently of one another in practice, as both cases have already begun to suggest — Texas Uri activates R1, R2, R4, and R6 simultaneously, and Horizon activates R3, R5, and R7 in a mutually reinforcing sequence rather than as isolated failures. This co-occurrence is not a complication the framework needs to explain away. It is, as the next movement develops directly, the basis for a taxonomy of failure types defined by which specific parameters combine, and how — the subject to which the essay now turns.

The seven parameters specified in Movement IV describe the structural configuration of an institution's Resilience Architecture. They do not, on their own, name the patterns by which that configuration fails. This movement supplies four such patterns, each defined by a distinct combination of parameter states rather than by domain, severity, or historical period. The four types are not mutually exclusive, and a single case — as both anchor cases will demonstrate — can exhibit more than one simultaneously. The taxonomy is offered as a diagnostic vocabulary for governance assessment, in the same spirit as the four-type mandate-failure taxonomy developed for delegated authority (Krasovski 2026a): a way of naming what has gone structurally wrong, precisely enough that the naming itself points toward what would need to change.

Definition. An institution exhibits Type I failure when its structural configuration has been optimized — deliberately, and often successfully — for performance under a known, bounded range of operating conditions, and this optimization has, as a direct structural consequence rather than as an incidental side effect, reduced the institution's capacity to survive conditions outside that range. The institution is not failing despite its design. It is failing, in a precise sense, because of it.

Mechanism. Type I failure is the institutional expression of the trade-off identified in Chapter 3 between stability and resilience in Holling's original sense (Holling 1973): mechanisms that suppress variance and reliably return a system to a known operating state can, in the same act, suppress the diversity of response that would be required once the system is displaced beyond that state. This is compounded, at the level of an institution's actual structure, by R1 erosion of the kind described in Chapter 7 — because Optimized-Minimum redundancy configurations are frequently the visible, measurable output of a genuinely successful optimization process, the erosion of resilience and the appearance of institutional improvement can be, for a sustained period, indistinguishable from inside the institution itself.

Detection difficulty. Type I is, for this reason, the most prevalent and the least detectable of the four failure types, because it is fully compatible with every ordinary indicator of institutional success. Efficiency rises. Costs fall. Customers, regulators, and shareholders observe an institution performing its stated function better than its comparators. No internal metric currently in wide use flags the accumulation of Type I exposure as a cost of that same performance, because the metrics in question were themselves designed to measure performance under the bounded conditions the optimization targeted — they were never built to register what the institution has given up in order to achieve the performance they do measure.

Case reading — Texas Uri. Winter Storm Uri illustrates Type I failure in a form largely free of the moral or institutional bad faith that often accompanies discussions of this kind of case, and this is precisely what makes it analytically clean. The Electric Reliability Council of Texas's market design was not the product of negligence. It produced, under normal operating conditions, some of the lowest electricity prices available in the continental United States — a genuine and measurable success by the standard the system was designed to optimize. The R1 configuration examined in Chapter 7 (a 13 percent reserve margin, adequate to historical peak demand) and the R6 configuration examined in the same chapter (a narrow repertoire of response options, resulting from the grid's deliberate electrical isolation) were not oversights within this design. They were among its more direct consequences: a market structure optimized to minimize the cost of maintaining unused capacity will, by the same logic that produces its low prices, minimize the unused capacity available when a disturbance exceeds what the historical record anticipated. The success and the exposure were generated by the identical mechanism.

Case reading — Horizon (secondary). A narrower instance of the same pattern appears at the procedural level of the Post Office case, though the primary analytical weight of that case belongs to Type IV, developed in Chapter 11. The formal avenues of appeal available to subpostmasters — internal dispute processes, and ultimately the courts — existed and were not, on their face, absent. But the surrounding legal architecture had been optimized around a bounded and, until this case, largely reasonable assumption: that computerized accounting records could be treated as reliable by default. Optimizing legal procedure around that assumption produced real efficiency gains across the great majority of cases in which the assumption held. It produced, in the minority of cases where the assumption did not hold, a formal presence of appeal rights with no operative capacity to exercise them against the specific category of error the system in question could actually produce — a Type I signature at the level of the surrounding institutional architecture, sitting beneath the more direct and more severe Type IV mechanism examined later.

What Type I is not. It is worth stating explicitly, before proceeding to the remaining three types, that Type I is not an argument against optimization, nor a claim that efficiency-seeking institutions are inherently unsound. It is a claim about a specific and identifiable trade-off that optimization, left unmonitored on the resilience side of the ledger, will tend to produce — and a claim that this trade-off is systematically underweighted precisely because the institution's normal indicators of success have no mechanism for registering it. The remedy Type I implies is not the abandonment of efficiency as a goal, but the deliberate, structural preservation of some measure of R1 and R6 capacity that the institution's own optimization process, left to its own logic, would otherwise continue to erode.

Definition. An institution — or, as this chapter will show, a configuration of institutions spanning several formally separate jurisdictions — exhibits Type II failure when a disturbance originating in one subsystem propagates through tightly coupled interdependencies into subsystems that no single actor within the configuration held responsibility for monitoring as a unified whole. The failure is not that any individual institution performed its function poorly. It is that the function each institution performed correctly, in isolation, combined with the functions performed by its neighbors to produce a systemic outcome that none of them, individually, was positioned to see coming.

Mechanism. Type II failure is the direct institutional expression of the coupling dynamics introduced through Perrow's analysis of complex technological systems in Chapter 3, and formalized as R2 in Chapter 7 (Perrow 1984). Perrow's central finding — that tightly coupled, complex systems can produce failure not through any identifiable error but as a structural consequence of the coupling itself — depends on a specific institutional condition for its most severe form: that the coupling, however well understood at the level of physical or technical mechanism, is Unmodeled at the level of institutional responsibility. A tightly coupled interdependency that falls entirely within one institution's monitoring boundary is dangerous but visible; the institution may fail to manage it, but at least one actor is positioned to observe the failure as it develops. A tightly coupled interdependency that crosses an institutional boundary — where responsibility for the upstream component and responsibility for the downstream component belong to separate organizations, separate regulators, or separate legal jurisdictions — removes even this possibility. No actor is structurally positioned to observe the sequence as a sequence, only as a series of locally rational events occurring within their own, correctly monitored domain.

This is the mechanism by which Type II failure differs in kind, not merely in scale, from an ordinary cross-sector disruption. An ordinary disruption is contained because some institution, somewhere, has visibility across the boundary it crosses. A Type II failure is defined by the absence of that institution — not by its failure to act on information it possessed, which would be a different and, in an important sense, more correctable problem, but by the fact that no comparable body of information, assembled across the relevant boundary, existed anywhere within the system prior to the disturbance.

Case reading — Texas Uri. This is the case's central mechanism, and the one for which it is now treated in the disaster-risk literature as something close to a canonical instance. The sequence began with a physical mechanism that was, on its own terms, entirely well understood: sustained sub-freezing temperatures reduce the operability of natural gas wellheads, pipelines, and associated equipment, and this vulnerability had been documented following a comparable, smaller storm a decade earlier. What followed was a sequence of couplings, each individually foreseeable, that had never been assembled into a single institutional picture. The freezing of gas infrastructure reduced fuel supply to gas-fired power generation, which constituted the majority of the state's electricity capacity. The resulting generation shortfall, compounded by a simultaneous demand spike as residents attempted to heat homes against the cold, forced the grid operator into rolling blackouts to avoid uncontrolled, catastrophic failure of the electrical system as a whole. The loss of electricity then disabled water-treatment infrastructure, whose operation depended on power, producing boil-water notices affecting a substantial portion of the state's population; it simultaneously disrupted the operation of medical facilities dependent on continuous power supply.

At no point in this sequence did any single regulatory body hold monitoring authority across more than one link in the chain. The electricity grid operator's mandate extended to electricity generation and distribution; it did not extend upstream into the natural gas supply chain whose failure was driving the generation shortfall, nor downstream into the water and healthcare systems whose failure the electricity shortfall was in turn driving. Each institution involved could, in principle, have reported accurately on the state of its own domain throughout the event. None could have reported on the state of the sequence, because the sequence existed only in the space between their respective jurisdictions — precisely the condition Chapter 7 identified as Tightly Coupled, Unmodeled. The resulting event affected more than ten million people at its peak and produced economic losses in Texas estimated at approximately 130 billion dollars, a scale that reflects not the severity of the initiating weather event alone, but the number of sequential, cross-boundary couplings the initiating event was permitted to activate before any institutional actor was positioned to intervene.

Why this is not simply a scale problem. It would be a mistake to read the Uri case as illustrating only that large, interconnected infrastructure systems fail on a large scale when disturbed — a claim too general to carry diagnostic value. The specific and transferable lesson is narrower and more actionable: the coupling that produced the cascade was not hidden in the sense of being unknown to anyone. It was hidden in the specific sense of falling between institutional mandates that had each been drawn, reasonably, around a single sector. This is a condition that can be identified in advance of a disturbance, by asking a direct question of any institution's Resilience Architecture: does a coupling exist between this system and an adjacent one, fast-acting enough to propagate a shock within the timeframe available for human intervention, for which no actor on either side of the boundary holds monitoring responsibility? Where the answer is yes, R2 is in the Tightly Coupled, Unmodeled configuration regardless of how well any individual institution is separately managing its own domain — and the Uri case demonstrates that this configuration alone, independent of any single institution's competence, is sufficient to produce a cascading failure of significant magnitude.

Relationship to Type I. It is worth noting, in closing this chapter, that the R6 Narrow Repertoire condition examined under Type I in Chapter 8 — the Texas grid's electrical isolation from neighboring interconnected systems — did not cause the Type II cascade described here, but it removed what would otherwise have been the most direct available mitigation for it: had the grid retained substantial interconnection capacity, the generation shortfall driving the entire downstream sequence could potentially have been offset by imported power before it reached the threshold that triggered blackouts, arresting the cascade at its point of origin rather than allowing it to propagate through gas, electricity, water, and healthcare in sequence. This is the first explicit instance, though not the last, of two failure types compounding within a single case — a pattern Chapter 10 extends further within this same event, and one the concluding movement returns to directly as a general property of how these failure types co-occur in practice.

Definition. An institution exhibits Type III failure when the rate at which its formal structure can revise itself falls persistently behind the rate at which the conditions it operates under change or recur — such that a failure is correctly diagnosed, its cause is correctly identified, and a remedy is even correctly proposed, and none of this diagnostic success translates into structural change before the same failure condition recurs. The institution is not failing to learn. It is failing to convert what it has learned into revised structure within the time available before the lesson is tested again.

Mechanism. This failure type formalizes, as a named and diagnosable pattern, a dynamic already identified in general terms elsewhere in this research program: that technological and environmental conditions characteristically evolve at a markedly faster tempo than the cultural and institutional structures responsible for governing them, producing a widening gap between what an institution's environment now requires and what its formal architecture is actually capable of delivering (Krasovski 2025c). Type III gives this general diagnosis a specific institutional signature, expressed through R4 as defined in Chapter 7: a Bureaucratically Bounded reconfiguration process, in which the interval between a demonstrated failure and the completion of a structural response is long enough that a second occurrence of the same failure becomes a live possibility before the first has been remedied.

The mechanism is not primarily one of incompetence or inattention, and this distinguishes Type III from what might appear, on the surface, to be a simpler failure of institutional learning. The lesson is very often learned, in the sense that it is documented, discussed, and formally recommended by the relevant technical or regulatory bodies. What Type III names is the specific structural condition under which a correctly learned lesson fails to become a binding constraint on future operation — because the institutional process by which recommendations become requirements operates on a timescale set by legislative calendars, regulatory rulemaking procedures, or negotiated industry standards, none of which are calibrated to the recurrence interval of the disturbance the lesson concerns.

Case reading — Texas Uri. The same event examined in Chapters 8 and 9 supplies the clearest available illustration of this parameter as well, though the reading here isolates a different mechanism within it. A winter storm in February 2011 had already exposed the vulnerability of Texas's gas and electricity generation infrastructure to sustained extreme cold, producing formal recommendations — issued in the aftermath, through the standard regulatory review process — that weatherization of critical infrastructure be made mandatory rather than advisory. These recommendations were not acted upon by the time the 2021 storm arrived; weatherization remained, in substantial part, a matter of voluntary compliance. A full decade elapsed between the demonstrated failure and the disturbance that exposed the same vulnerability at markedly greater cost and scale.

This is a close to paradigmatic instance of Bureaucratically Bounded reconfiguration under R4. The diagnostic work had been completed correctly in 2011: the specific vulnerability was identified, the specific remedy was proposed, and the causal link between the two was not seriously disputed within the relevant regulatory and engineering communities. What failed was the conversion of that correctly completed diagnostic work into a binding structural requirement within a timeframe shorter than the interval before the vulnerability was tested again. The formal institutional process for converting a recommendation into a mandatory standard — involving regulatory review, stakeholder consultation, and in some instances legislative action — operated on a multi-year timescale that bore no relationship to the actual recurrence interval of the disturbance it was meant to guard against.

A single case, two failure signatures. It is worth pausing on the fact that the same event now illustrates both Type II (Chapter 9) and Type III in full, and that this co-occurrence is not a coincidence of case selection but a demonstration of how these categories interact in an actual institutional failure. The Type II mechanism explains how the 2021 disturbance propagated once it began — through an unmodeled coupling across sectoral boundaries. The Type III mechanism explains why the disturbance was permitted to begin at all in a form the system had, in a meaningful sense, already been warned about. Neither mechanism substitutes for the other, and neither alone gives a complete account of the case: an institution could in principle correct its Type III exposure — mandating weatherization promptly after 2011 — while leaving its Type II exposure entirely intact, since faster reconfiguration of a single sector's standards does nothing to establish cross-sectoral monitoring authority where none previously existed. The reverse is equally true. This is the general point the taxonomy's opening framing anticipated: failure types are analytically distinct but not mutually exclusive, and a governance assessment that identifies only one type present in a given institution should not be read as having ruled out the others.

Why Type III is not simply "slow bureaucracy." It would understate the mechanism to characterize Type III as nothing more than bureaucratic sluggishness, since the same regulatory apparatus that failed to convert the 2011 weatherization recommendation into a binding requirement operates, in other domains and under other pressures, at a considerably faster tempo. The relevant variable is not the general speed of the institution's procedures but the specific relationship between that speed and the recurrence interval of the disturbance in question. An institutional reconfiguration process that completes in three years is Bureaucratically Bounded with respect to a disturbance that recurs on a decadal cycle, but the same three-year process would represent adequate R4 performance against a disturbance that recurs only once in a generation. Diagnosing Type III exposure therefore requires comparing an institution's actual reconfiguration speed against the specific tempo of the risks it faces — a comparison the Uri case makes unusually easy to draw, since both intervals are a matter of public record.

Definition. An institution exhibits Type IV failure when its own capacity to perceive its operating state — and the capacity of those affected by it to independently verify that state — has been degraded not incidentally but as a structural consequence of the institution's own incentives, such that the institution's formal representations of its reliability persist, and are acted upon, after the institution possesses internal grounds to know those representations are false. This is the most severe of the four failure types, and it is the one existing governance frameworks are least equipped to detect, because its defining feature is not an absence of information but the active, structurally motivated suppression of information the institution itself holds.

Mechanism. The first three failure types describe institutions whose structure produces failure as an unintended, if predictable, consequence of otherwise rational design choices — optimization that trades away resilience (Type I), monitoring boundaries that leave a coupling unmodeled (Type II), reconfiguration processes too slow for the risks they govern (Type III). Type IV is different in kind. It arises when R7 (Observability, Chapter 7.7) collapses into the Adversarially Obscured configuration and R3 (Feedback Latency, Chapter 7.3) collapses simultaneously into Structurally Suppressed Detection — not as two independent failures that happen to co-occur, but as a single mechanism in which the institution's incentive to preserve its own legitimacy actively degrades both its capacity to see its own failure and the capacity of affected external parties to see it either.

This mechanism has a documented structural precedent in a different domain entirely. Recent forensic analysis of exactly this category of institutional failure — conducted through detailed reconstruction of witness testimony, technical documentation, and internal communications spanning more than a decade — identifies what it terms a governance gap that existing frameworks do not address: the institutional failure mode in which the organisation responsible for system integrity holds active incentives to suppress evidence of failure rather than remediate it. That formulation could stand, with only the substitution of a proper noun, as a direct definition of Type IV as specified here. The analysis proposes a dedicated governance category — systems whose outputs are used as evidence in legal or otherwise consequential proceedings — requiring supplementary safeguards it names technical independence, institutional independence, and forensic admissibility governance, precisely because ordinary technical quality assurance, applied by the institution to its own system, cannot be relied upon once that institution's incentive to find the system reliable has become entangled with its own prior conduct.

Case reading — Horizon. This is the case for which Type IV was, in an important sense, formalized, and it deserves the fuller treatment this chapter gives it rather than the shared treatment other parameters received alongside Texas Uri.

The Post Office's Horizon accounting system, introduced across thousands of UK branches beginning in 1999, produced apparent financial shortfalls at individual branches that the institution treated, as a matter of standing policy, as evidence of employee theft or false accounting rather than as evidence of possible system error. Over more than a decade, several hundred subpostmasters were prosecuted — in many cases by the Post Office's own internal investigative and prosecutorial function, a structural feature to which this chapter returns below — on the basis of Horizon-generated records that were, as courts subsequently confirmed, capable of producing exactly the kind of erroneous shortfall the institution had attributed to individual wrongdoing. Convictions in many of these cases were later quashed; the affected individuals experienced, in a substantial number of documented instances, bankruptcy, the loss of their businesses, and severe and sustained psychological harm consistent with what has been documented in comparable large-scale institutional-failure cohorts elsewhere in UK public life.

Two structural features of this case make it a Type IV failure specifically, rather than a severe instance of one of the other three types.

The first is the R7 configuration examined in Chapter 7.7: subpostmasters had no practical means of independently auditing the Horizon system's transaction logs, and — critically — the surrounding legal architecture placed the evidentiary default in the system's favor. The burden fell on the affected individual to demonstrate that the system's output was wrong, rather than on the institution to demonstrate the system's reliability before relying on its output to prosecute. This is Adversarially Obscured in the precise sense defined earlier: the obscurity did not arise from any single actor's decision to conceal the system's internals, but from a legal default that made independent verification structurally inaccessible to exactly the population bearing the consequences of the system's errors.

The second is the R3 configuration examined in Chapter 7.3: internal awareness that Horizon could and did produce erroneous shortfalls existed within the institution over a substantial period during which its own legal and public position continued to assert the system's reliability. This is where Type IV acquires its most distinctive feature, and where it departs most sharply from Type III's account of institutional slowness. The gap here was not a matter of a correctly diagnosed problem awaiting a slow-moving remedy, as in the Uri weatherization case. It was sustained, over years, by the institution's own incentive structure: acknowledging the system's unreliability would have required acknowledging that the institution's own prior investigative and prosecutorial conduct — conduct it had carried out using its unusual authority to prosecute without police involvement — had produced wrongful convictions on a large scale. The institution most positioned to correct the record was also the institution with the strongest incentive not to, and this alignment of position and incentive is the defining structural signature of Type IV.

The direct parallel to Type IV Mandate Inversion. This case bears a structural relationship to the fourth failure type in the companion analysis of delegated authority that is close enough to name explicitly rather than leave implicit. In that framework, Type IV — Mandate Inversion — describes a configuration in which a system acquires the operative authority to evaluate the trustworthiness of the human who nominally holds decision-making mandate, inverting the ordinary direction of evaluation: rather than the human assessing the system's output, the system's output is used to assess the human (Krasovski 2026a). The Horizon case reproduces this inversion with unusual precision, and did so without any of the artificial-intelligence context that the companion framework was originally built to address — which is itself evidence that the underlying structural pattern is not specific to AI systems but is a general property of institutional reliance on automated or semi-automated record-keeping. Horizon's output was treated, by default, as more credible than the sworn testimony of the individuals whose conduct it purported to describe. The system did not merely provide evidence for a human decision-maker to weigh. It occupied, functionally, the position of the trusted party, while the subpostmasters occupied the position ordinarily reserved for the system under scrutiny — required to prove their reliability against a record they had no means of independently interrogating. The direction of evaluation had inverted, and the institution's legal and procedural architecture had, in effect, ratified that inversion by treating the system's output as the default truth against which human testimony needed to be justified rather than the reverse.

Why Type IV is the least visible category. The concluding observation of this chapter is also its most important for the governance discussion that follows in Movement VI. Type I, II, and III failures leave a visible structural signature that a sufficiently detailed audit could, in principle, detect in advance: an unusually thin reserve margin, an unmonitored cross-sectoral coupling, a decade-old unimplemented recommendation. Type IV leaves no comparable signature available to an outside auditor, precisely because its defining mechanism is the institution's active management of what is visible to outside auditors in the first place. An institution experiencing Type IV failure will, by construction, present favorably on most conventional measures of institutional soundness for as long as the suppression holds — its formal compliance record will appear intact, its public statements will appear consistent, and its legal position will appear, to anyone without independent access to its internal communications, entirely defensible. This is why Type IV is identified in this framework, as in its companion analysis of delegated authority, as the most consequential and least governance-visible of the four categories: no external audit mechanism currently in wide use is designed to detect the specific condition of an institution whose incentive to appear reliable has become entangled with its capacity to know whether it actually is.

The four failure types identified in Movement V are not equally visible to the governance instruments currently in force. This chapter assesses detection capacity by framework category, following the same method used to assess the human-in-the-loop, EU AI Act, and Meaningful Human Control frameworks against the four types of mandate failure (Krasovski 2026a). The purpose is not a comprehensive regulatory survey but a targeted diagnostic: for each major resilience-governance instrument currently in force or entering into force, which of the four failure types can it detect by design, and which does its own architecture prevent it from seeing?

The EU Critical Entities Resilience Directive. Directive (EU) 2022/2557 is the most directly relevant instrument to assess against this framework, both because it explicitly uses the vocabulary of resilience and because its implementation timeline places it, at the time of writing, in an unusually informative transitional state: Member States were required to transpose the Directive into national law by October 2024, national resilience strategies were due by January 2026, and Member States must complete the identification of critical entities across eleven sectors by July 2026 — a deadline falling within days of this essay's drafting. The Directive requires identified entities to conduct risk assessments, implement technical and organizational resilience measures, and report significant disruptive incidents to national authorities.

Assessed against the four-type taxonomy, the Directive's detection capacity is uneven in a pattern the taxonomy predicts. It is reasonably well positioned to surface Type I exposure, since mandatory risk assessment against a defined list of essential services creates at least the occasion for an entity to examine its own reserve and redundancy posture, even if nothing compels the assessment to be accurate or the entity to act on an unfavorable finding. Its treatment of Type II is more ambiguous: the Directive explicitly requires risk assessments to account for cross-sectoral and cross-border interdependencies, which is a meaningful improvement over the sector-siloed predecessor instrument it replaces — but the Directive's own implementation structure, in which each Member State separately identifies and notifies critical entities on a per-sector basis, reproduces at the regulatory level something close to the institutional boundary problem the taxonomy identifies as the mechanism of Type II failure in the first place. A coupling between, for instance, the energy and water sectors within a single Member State may be assessed by each sector's designated competent authority without either authority holding a mandate to model the coupling between them as a unified risk. The Directive's Type III detection capacity is structurally limited by its own reconfiguration cadence: risk assessments are required only every four years at minimum, a cycle time that may itself constitute a Bureaucratically Bounded configuration relative to disturbances — such as the eleven-year gap between the two Texas storms examined in Chapters 8 through 10 — that recur on a similar or shorter timescale. Most significantly, the Directive has essentially no mechanism directed at Type IV: its incident-reporting requirement obliges an entity to notify authorities of a disruption, but nothing in its architecture addresses the specific condition, illustrated by the Horizon case, in which the entity's own incentive structure motivates it to characterize a disruption inaccurately, or to suppress evidence of its cause, precisely because acknowledging the true cause would implicate the entity's own prior conduct.

ISO 22301 and business continuity management standards. The dominant private-sector resilience standard operates on a self-assessment and certification model: an organization designs a business continuity management system, and conformity is verified through internal and external audit against the standard's own criteria. This architecture is well suited to detecting Type I and, to a lesser degree, Type III exposure, since both concern an organization's own documented capacity and its own documented rate of updating that capacity — precisely what an audit against a management-system standard is designed to examine. It is poorly suited to Type II, for the same reason the CER Directive is: an audit conducted against a single organization's boundary cannot, by construction, examine a coupling that exists between that organization and a neighboring one operating under a separate certification, separate auditors, and no shared point of assessment. It is close to structurally blind to Type IV, for a reason with an even sharper edge than in the CER case: an audit that relies substantially on the audited organization's own internal documentation and self-reported incident history is examining precisely the record that a Type IV-exposed institution has the strongest incentive to shape. The Horizon case is again instructive here, though not directly regulated by this standard: an institution capable of maintaining, for over a decade, a formal public and legal position it possessed internal grounds to know was false would face no structural obstacle from a certification process built on the premise that the organization's own account of its incident history is broadly trustworthy.

Sector-specific financial resilience regulation. Banking-sector capital and liquidity requirements — the post-2008 Basel framework and its subsequent revisions — represent the most mature instance of R1 (Redundancy) regulation in force anywhere in this comparison, mandating specific, quantified reserve margins against defined categories of stress. This gives such frameworks genuine and well-documented capacity to detect Type I exposure within their own sector, and the framework's steady tightening since 2008 is itself evidence that this detection capacity, once built, can improve over successive iterations. Its capacity against Type II, however, has a documented and specific limitation directly relevant to this essay's concerns: post-crisis reviews of a significant 2023 regional-banking failure concluded that the applicable capital framework had progressively added risk factors and capital ratios without adequately addressing their interconnectedness — credit, market, interest-rate, and liquidity risk had each been separately regulated with increasing precision, while the correlation between them, and its behavior under a specific and fast-moving stress scenario, fell outside what any single regulatory ratio was designed to capture. This is a Type II signature in a domain distinct from physical infrastructure: the coupling was not physical but informational and behavioral — a bank run accelerated by digital transmission of concern among a concentrated depositor base — and it propagated through a gap between separately regulated risk categories in essentially the same way the gas-electricity-water coupling propagated through a gap between separately mandated regulatory bodies in the Uri case.

UK algorithmic and public-sector transparency initiatives. In direct response to the Horizon scandal specifically, the UK has begun developing instruments aimed at the R7 (Observability) and R3 (Feedback Latency) failures the case exposed — including an algorithmic transparency standard requiring public-sector bodies to document how and why automated systems are used, and legislative proposals for independent dispute-resolution mechanisms addressing automated decision systems more broadly. These instruments are worth noting precisely because they demonstrate that Type IV detection is not structurally impossible to build — it is simply not addressed by any of the general-purpose resilience instruments examined above, and has so far emerged only as a targeted, retrospective response to a specific and extensively documented case, rather than as a general feature of resilience governance applied prospectively across sectors.

Synthesis. The pattern across all four framework categories is consistent, and it reproduces the pattern already identified in the companion analysis of delegated-authority governance: each instrument is well matched to the failure type most closely aligned with its own institutional design, and correspondingly blind to the failure types that fall outside that design. Frameworks organized around an entity's own documented capacity (ISO 22301, Basel capital rules) detect Type I well and Type IV poorly, for the identical structural reason — both depend substantially on the entity's own self-reported record. Frameworks organized around risk assessment against defined external categories (the CER Directive) detect Type I and partially Type II, but their per-sector, per-entity assessment structure limits their capacity to model cross-boundary coupling, and their multi-year reassessment cycles limit their capacity to outpace Type III's characteristic recurrence-interval mismatch. No framework examined here — general-purpose or sector-specific — was found to address Type IV as a designed and prospective feature, rather than as a retrospective, case-specific response following a failure of the Horizon scale. This is not a claim that Type IV is unaddressable. The following chapter turns directly to what a specification requirement adequate to the task would need to contain.

The preceding chapter's survey converges on a single diagnostic conclusion: no resilience-governance instrument currently in force requires an institution to document its position across all seven parameters specified in Movement IV, and each instrument's blind spots correspond precisely to the parameters its own architecture does not ask about. This chapter states directly what follows from that conclusion. Meaningful assessment of institutional resilience cannot be achieved without a full specification of the Resilience Architecture. The seven parameters, R1 through R7, define the minimum analytical content such a specification requires — a claim that mirrors, deliberately and without modification in its underlying logic, the equivalent argument made for the seven parameters governing delegated authority (Krasovski 2026a).

What the specification requirement would demand. A governance instrument built around this requirement would ask, of any institution claiming a given level of resilience, for documentation addressing each parameter in turn: the redundancy configuration currently maintained against disturbance exceeding the institution's anticipated operating range (R1); the coupling structure connecting the institution to adjacent systems, and an explicit statement of which of those couplings fall within versus outside any single actor's monitoring mandate (R2); the latency, and specifically the source of any latency, between a perturbation's occurrence and its detection by the institution's own monitoring apparatus (R3); the institution's demonstrated — not merely nominal — capacity to convert an identified structural weakness into a binding change, measured against the recurrence interval of the disturbance the weakness concerns (R4); an honest accounting of where the institution's formal public and legal representations of its own reliability currently stand relative to its internal operative knowledge (R5); the breadth of genuinely independent response pathways available should the institution's primary mode of operation fail, with explicit attention to shared failure modes that might not be visible from the pathways' formal count alone (R6); and the degree to which the institution's actual operating state is legible not only to its own management but to the external parties who depend on it and bear the consequences of its failures (R7).

Why this is not a technical standard. As with the equivalent requirement developed for delegated authority, it is important to be precise about what kind of instrument this is and is not. It is not a technical standard specifying particular numerical thresholds an institution must clear — appropriate thresholds vary enormously by sector, by the consequence of failure, and by the specific disturbances an institution actually faces, and specifying them is properly the task of domain-specific regulation informed by this framework rather than a task this framework itself should attempt. It is an analytical transparency requirement. An institution whose R1 through R7 configuration is fully documented has provided the information necessary for a regulator, a governing body, or its own leadership to assess whether its resilience claims describe an operative structural capacity or an unverified assertion. An institution whose R1 through R7 configuration is not documented has not provided that information, regardless of how extensively its public communications invoke the language of resilience.

Addressing the Type IV gap directly. The specification requirement carries particular weight for the failure type the preceding chapter identified as least visible to existing instruments. Recent proposals developed specifically in response to the Horizon case — organized around the three pillars of technical independence (verification of a system's reliability by a party without institutional stake in the outcome), institutional independence (separation between the function that operates a system and the function that investigates its failures), and forensic admissibility governance (specific evidentiary standards for system output used in consequential proceedings) — can be read as a domain-specific instantiation of what full R3 and R7 specification would require for institutions whose failures are most likely to take the Structurally Suppressed and Adversarially Obscured forms examined in Chapters 7 and 11. The broader lesson this suggests is that Type IV detection is not achieved by adding a general resilience requirement alongside the other six parameters, but by recognizing that R3 and R7, specifically, require a structural safeguard the other five parameters do not: independent verification, by a party whose institutional position gives it no stake in the answer, precisely because these are the two parameters an institution under Type IV pressure has the strongest incentive to misrepresent about itself.

A note on timing. The Critical Entities Resilience Directive's own implementation timeline — national strategies due in January 2026, entity identification due in July 2026, and a Commission compliance report not due until July 2027 — places European resilience governance, at the time of this writing, at precisely the juncture where a specification requirement of this kind could still be incorporated into the risk-assessment methodologies Member States are in the process of finalizing, rather than retrofitted after those methodologies have been fixed in national implementing legislation. This is offered not as a policy recommendation this essay is positioned to make, but as an observation about a closing window: the cost of adding R1–R7 specification to a risk-assessment framework already in active development is considerably lower than the cost of adding it after the framework has been operating for a full four-year assessment cycle.

With the specification requirement stated, the essay's remaining task is to acknowledge directly what this framework does not resolve, and to draw the connection — anticipated since the essay's opening chapters — to the broader governance model this Framework is positioned to inform rather than replace.

Every framework of the kind developed across the preceding thirteen chapters owes its reader an honest account of what it does not resolve. Three limitations deserve to be stated directly, in the same spirit — and largely for the same reasons — as the limitations acknowledged for the companion framework governing delegated authority (Krasovski 2026a).

The framework specifies formal structure, not informal practice. The seven parameters of the Resilience Architecture describe what an institution's documented, structural configuration permits and constrains. They do not fully capture the informal organizational pressures that determine how actors within an institution actually use the capacity that configuration provides. An institution with a well-specified R6 — a genuinely diverse repertoire of independent response pathways, formally available on paper — may nonetheless exhibit, in practice, a narrow and habitual reliance on a single pathway, if organizational culture treats the alternatives as untested, career-risky, or simply unfamiliar to the staff who would need to invoke them under pressure. This is not a gap the seven parameters were designed to close, and it should not be mistaken for one. It is, in the vocabulary developed for the companion framework, closer to the domain of erosion than of architecture: a structural capacity that exists on paper but has, through disuse or institutional habit, ceased to function as a live option. Where this occurs, R1–R7 specification remains necessary — an institution cannot address a gap between formal capacity and actual practice without first knowing what its formal capacity is — but it is not sufficient, and no claim to the contrary is made here.

The framework does not resolve what threshold is appropriate for which institution. This essay has deliberately avoided specifying numerical thresholds for any of the seven parameters, and the reason is not oversight but scope. What counts as an adequate reserve margin under R1, or an acceptable feedback latency under R3, depends on the consequence of failure in the specific domain concerned — the appropriate threshold for a regional water utility is not the appropriate threshold for a national payments system, even though both can be assessed using the identical seven-parameter template. Specifying those domain-specific thresholds is properly a task for sector-specific governance bodies, informed by this framework rather than determined by it. The framework's contribution is the common vocabulary in which such thresholds could be debated and compared across sectors — not the thresholds themselves.

The framework requires empirical validation this essay does not supply. The seven parameters, and the four-type taxonomy built upon them, have been developed analytically and illustrated against two documented cases. Both cases were selected, and read in detail, because their public documentation is unusually extensive — but two cases, however thoroughly examined, do not constitute a validated instrument. Whether the seven parameters are jointly exhaustive of the structural conditions that produce institutional fragility, whether they are genuinely independent of one another or whether some are better understood as derivative of others, and whether the four failure types identified here recur in recognizable form across a broader sample of institutional failures spanning different sectors and periods, are empirical questions this essay identifies as necessary next steps rather than questions it has itself resolved.

The bridge to a broader governance model. These limitations point toward a distinction this essay has held in view since its opening chapter and can now state in its completed form. The Resilience Architecture developed here answers a specific and bounded question: what structural properties make any institution — regardless of how its decision-making authority is distributed, regardless of who holds power within it — more or less capable of absorbing disturbance and reorganizing afterward without losing core function. It is, in this sense, agnostic to governance model. A rigidly centralized institution and a fully distributed one can each be assessed against R1 through R7, and each can score well or poorly on any given parameter independent of where it sits on the centralization spectrum.

This is precisely where the present framework connects to, without collapsing into, a separate and more general model of governance developed elsewhere in this research program under the name Evocracy — an independent inquiry into how decision-making authority itself might be distributed and coordinated, addressing a different question than the one this essay has undertaken. The relationship between the two is best stated plainly, since it resolves an ambiguity a reader might otherwise carry forward: the Resilience Architecture answers what makes any structure durable; a governance model such as Evocracy answers how a structure's decision-making is organized in the first place. The two questions are logically separable — a governance model can be evaluated for its resilience properties using exactly the instrument this essay provides, without that evaluation presupposing or requiring any particular answer to the separate question of how authority within it is distributed. Read this way, the Resilience Architecture functions as a reference layer: a diagnostic vocabulary against which any proposed governance model, including but not limited to a more distributed one, could eventually be assessed for the specific structural properties this essay has argued are necessary — though not sufficient on their own — for long-term institutional survival under conditions of accelerating and imperfectly anticipated change.

Closing. This essay began with an observation about a word. Resilience, invoked everywhere in contemporary governance discourse, had become a claim institutions made about themselves rather than a property that could be verified against them — a condition this essay termed the presence of resilience discourse standing in for operative resilience, echoing a structurally identical drift already documented, in a different domain, in the concept of human oversight over autonomous systems. The chapters that followed attempted to close that gap: first by separating robustness, redundancy, and resilience proper, three variables a single word had allowed to collapse into one; then by defining a Resilience Profile precise enough to locate an institution's actual position without compressing that position into a single, misleadable score; then by specifying the seven-parameter Architecture that produces any given Profile; then by naming four distinct patterns by which that Architecture fails, each illustrated against institutions that were not hypothetical but real, and whose failures — a frozen electrical grid and a wrongly trusted accounting system, unfolding on entirely different timescales in entirely different sectors — turned out, when read through the same seven parameters, to share more structural DNA than their surface differences would suggest. What began as a diagnosis of a word's overuse has arrived, by the argument's own internal logic, at an instrument that can be used — imperfectly, and pending the empirical validation this final chapter has been honest about needing — to ask a sharper question of any institution than whether it is resilient: precisely where, along which of seven measurable dimensions, and against which kind of disturbance, it currently is not.