ISEONDesigned by Isatropic

Disciplines eventually learn to define their objects by their consequences:

• Carathéodory rebuilt thermodynamics in 1909 on the relation of adiabatic accessibility.
• Kolmogorov grounded probability in 1933 on the measure-theoretic event.

The pattern repeats: a discipline matures when it stops describing its objects and starts axiomatizing what they can do. Software still defines its objects by their texts. Its constitutive moment has not arrived.

We take the following as primitive. A software system extends exactly as far as its power to mutate state extends. Its true boundary is the transitive closure of everything to which a consequential write is sensitive.

The divergence admits measurement. Across thirteen widely used packages, six-tenths of one percent of the resolved perimeter can execute code at installation. Of the components that can, fewer than a third are declared, and more than a third are unreachable through the declared relation entirely.

The markets keep a proverb: a participant that believes its exposure ends at its own book is paying tuition to a participant that knows better. Markets impose a particular habit of mind: define objects by their capacity to move state, because every other definition is eventually arbitraged. This habit should not be relaxed outside of the market. Production software is a market in consequence.

In stochastic analysis, filtrations state with complete precision what may be known at each instant. An adapted process is forbidden from seeing the future, and the entire theory stands because that prohibition is never relaxed. Software possesses no comparable axiom for what may be written. A cache preserves authority that was revoked upstream. A retry re-executes a consequence that had already settled. A migration reinterprets every record that preceded it. Each of these is a violation of an unstated adaptedness condition.

Installed twice from an identical manifest, a package writes an identical set inside the boundary it declares, and outside it a set that collapses from as many as two hundred and sixty-three paths to one when a cache is warm. See figure below.

The substrate participates. A VPC is a promise about reachability, and the store of record does not live inside it. Every machine in the cloud can ask a fixed, unauthenticated address, 169.254.169.254, who it is, and the answer arrives with credentials attached; anything that can be induced to ask on another's behalf inherits the answer. A load balancer that terminates the connection has already read what it forwards, and anything that reads in the path of a write can shape the write. Security groups filter packets while IAM confers authority; the two are administered by different hands on different days, so the perimeter that matters exists only at their intersection, which neither administers. A peering connection collapses two perimeters into one, and neither side's diagram changes. Beneath all of it sits the control plane, which provisions the substrate and therefore holds write authority over it. The substrate has a substrate, and no base case has been produced.

The vendor publishes the arithmetic. Of the actions that alter authority rather than data, the service named for identity holds fewer than one in six. Covering nine-tenths of the rest means auditing sixty-one services, and four in five of the dependencies between actions cross a boundary that no one administers.

An organization draws its boundaries administratively: repositories, services, teams, accounts, contracts. Coase asked in 1937 why firms have edges at all. The edge of the firm sits wherever organizing a thing inside stops being cheaper than contracting for it outside. It is an operational boundary wearing a legal costume, and it moves when the costs move, whatever the paperwork says. Software deserves the same candor.

None of this is hypothetical. In forty-five minutes of August 2012, Knight Capital was destroyed by eight servers, seven of which were correct. The eighth still carried routing code that had been dead since 2003, and a flag repurposed for a new feature woke it. The most consequential component in the firm turned out to be the deployment process. In October 2021 a maintenance command withdrew Facebook's routes and removed the company from the internet. In May 2024 a cloud control plane deleted an Australian pension fund's entire infrastructure, on schedule and as configured, honoring a subscription term that a null parameter had set to one year at provisioning time. This all contributes to the idea that boundaries follow write authority. Physics learned from Noether that every conserved quantity is the shadow of a symmetry. The write boundary is conserved under exactly the symmetries organizations perform on themselves. Every reorganization is a change of coordinates, and the write boundary is a coordinate-free object. Ownership is administrative; systems become legible when their drawn boundaries are brought to coincide with this invariant.

The founding question of the field, what does the program compute, presumed a machine with edges. That machine is gone. What runs now writes the operating state of institutions through a partially unseen perimeter. So we pose the inverse problem. Fix a consequential write and ask for its preimage: the complete set of paths, grants, and states that could have produced it.

The preimage is a defined object, and defined objects admit construction. Constructed by hand, it is already wrong; the boundary is a process, and it moves at the rate the system administers itself. An answer that decays at that rate must be recomputed at that rate, and recomputation at that rate is an instrument. Building that instrument is the mission of Isatropic.