:orphan:
.. This is a comment written in runestone to edit this file (OOv3 on the go to get to OOv3r1)
.. include:: /_templates/include-file/page-prefix.rst
.. meta::
:description: A soft-ring rewrite (OOv3) of an actuarial waiting-time forecast for accidental nuclear winter: a three-state first-passage model calibrated on the Cold-War near-miss record, centred on the decision it forces.
:keywords: waiting time, actuarial forecast, accidental nuclear winter, first passage, absorbing Markov chain, RiskyMAD, MAD crisis, MAP, crisis rate, near-miss record, Baum, Hellman, Tertrais, uninsurable, road-death baseline, AuditTheMath
:author: Laurence Loewe of Laodicea, Everyone (as in https://balospe.com/en/about/authorship/)
:og:card:title: Forecasting Actuarial Waiting Times
for Accidental Nuclear Winter
:og:card:description: Half of all runs of world history reach accidental nuclear winter within 21 years. For most people it is likelier than a car crash. Offered not to be believed, but to be checked. #AuditTheMath
.. only:: latex
.. raw:: latex
% \textemdash{} Per-paper header / footer values (see conf.py preamble) -----------
\renewcommand{\paperheaderleft}{\scriptsize Balospe.com/study}
\renewcommand{\paperheadercenter}{\scriptsize Matheo-b16}
\renewcommand{\paperheaderright}{\scriptsize Variant OOv4r4p1\ $|$\ 2026m09d24}
\renewcommand{\paperfooterleft}{\scriptsize Waiting times for accidental nuclear winter}
\renewcommand{\paperfooterright}{\scriptsize Jonah License, CC-BY 4.0}
% -----------------------------------------------------------------------
\begin{titlepage}
\thispagestyle{normal}
\begin{center}
{\LARGE\bfseries
Forecasting Actuarial Waiting Times\\
for Accidental Nuclear Winter\par}
\vspace{8mm}
{\large Laurence Loewe of Laodicea\textsuperscript{1,2,3,4,5,6,7}\par}
\vspace{2mm}
{\small Study b16 in the Matheo Study Series\par}
\end{center}
\vspace{3mm}
\begin{flushleft}\scriptsize
\textsuperscript{1}\,Balospe and Evolvix Research (Balospe.com)\\[1pt]
\textsuperscript{2}\,Formerly Laboratory of Genetics and Wisconsin Institute for Discovery, UW-Madison\\[1pt]
\textsuperscript{3}\,Email: \href{mailto:LLoL@balospe.org}{LLoL@balospe.org}\ $|$\ ORCID: \href{https://orcid.org/0000-0002-6253-9269}{0000-0002-6253-9269}\ $|$\ \href{https://scholar.google.com/citations?user=lBchRzQAAAAJ}{Google\,Scholar\,(lBchRzQAAAAJ)}\\[1pt]
\textsuperscript{4-7}\,See \textit{Declarations} below for more essential background.\\
\end{flushleft}
\vspace{3mm}
\begin{center}\bfseries Broader Significance\end{center}
\begin{quote}\footnotesize
Nuclear war is usually argued in words. This study argues it in numbers, using the
oldest quantitative discipline built for questions of this shape: actuarial
science. An actuary cannot say when a particular person will die. Given a
population, a set of risk factors, and a claims history, an actuary can still
price the risk \textemdash{} and be wrong in ways that show. This study treats the system of
nuclear-armed states as the life being priced, the Cold-War record of near-misses
as the claims history, and accidental nuclear winter as the death.
At the rate crises have actually arrived, half of all runs of world history reach
accidental nuclear winter within {\bfseries about twenty years}, and the chance it
begins in any given year is {\bfseries worse than one in forty}. Set beside a
risk that societies accept without alarm \textemdash{} dying in a road accident \textemdash{} a person
is {\bfseries more than fifty times} more likely to die as a consequence of
accidental nuclear winter than in a car crash, counted the same way: annual, per
person, death against death. That comparison is this study's central claim, and it
is built to be attacked rather than admired. It survives when the most sceptical
published reading of the record, the lowest published death toll, and the
road-death rate of the worst-affected country on record are applied {\itshape all
at once}.
This risk is not invisible because it is small. It is invisible because it has
been removed from the places where risks are measured. Nuclear war is excluded by
standard clause from essentially every insurance policy written: the profession
that prices catastrophe for a living examined this one and declined it, on the
correct grounds that it is uninsurable in principle \textemdash{} there is no surviving
counterparty to pay. It was priced at infinity, and then not spoken of. What
follows is not alarm. It is arithmetic, from public data, repeatable in an
afternoon.
A second calculation, which does not depend on the first being right, asks the
question backwards: not how large the danger is, but {\bfseries how small the
prospect of success may be before paying to attempt a remedy is still worth doing.}
Priced against a remedy costing about eight dollars a person a year, the answer is on
the order of one in a few thousand \textemdash{} and stays at no more than three and
a half percent even if this study has overstated the danger by a factor of a hundred. A reader does
not have to accept the forecast in order to accept what follows from it.
Readers who suspect this of being alarmism should go straight to the strongest
published objection (SIA-11): the most sceptical published critic of nuclear
close-call analysis supplies this study's own optimistic scenario, and the
conclusion holds there too. Readers who want the argument without the theology
will find it in a companion written in entirely secular terms.
The study is offered not to be believed, but to be checked. If it is wrong, the
fastest way to find out is for someone to say so. \#AuditTheMath
\end{quote}
\vspace{3mm}
\begin{center}\bfseries Declarations\end{center}
\begin{flushleft}\scriptsize
\textsuperscript{4}\,"of Laodicea" indicates taking responsibility to undo personal complicity with disastrous Laodicean legacies like banning mathematicians from clergy (Canon 36, Council of Laodicea; two magisteria separations), enabling institutional lukewarmness, weapons of math-destruction, and slow-motion explosions of misinformation from pandemics to self-compounding interests.\\[3pt]
\textsuperscript{5}\,LLoL stands for ridiculous luck in serendipitous discovery and a commitment to find ever more fun ways to help others uncover street-wise math that matters.\\[3pt]
\textsuperscript{6}\,Loewe's traditional standards for co-authorship demand naming AI Claude Opus 4.8 Max (by Anthropic) as a co-author for many substantial contributions, as if a PhD-student. Yet, AI co-authorship is withheld here until Loewe's framework for AI co-authorship after the practical singularity (PraS) passes external human peer review (see Matheo-b21 study). Anthropic is not responsible for AI mistakes here. Loewe as senior corresponding author remains forward accountable for every number in this study, including those a machine computed.\\[3pt]
\textsuperscript{7}\,\textit{Licensed under the Jonah License and CC-BY 4.0 for maximal flexibility (see \href{https://balospe.com/en/license/joli/}{https://balospe.com/en/license/joli/}).}\\
\end{flushleft}
\end{titlepage}
\newpage
****************************************************************************************************
Forecasting Actuarial Waiting Times for Accidental Nuclear Winter
****************************************************************************************************
.. only:: html
| **Laurence Loewe of Laodicea** :sup:`1,2,3,4,5,6,7`
.. container:: titlepage-credentials
| :sup:`1` Balospe and Evolvix Research (Balospe.com)
| :sup:`2` Formerly Laboratory of Genetics and Wisconsin Institute for Discovery, UW-Madison
| :sup:`3` Email: LLoL@balospe.org \| ORCID: https://orcid.org/0000-0002-6253-9269 \| `Google Scholar (lBchRzQAAAAJ) `__
| :sup:`4-7` See *Declarations* block below for more essential background.
| This is Balospe.com/study **Matheo-b16**, variant ``dv_ClaOp55Max_OOv4r4p1_2026m09d24_12h32``
| **Study b16** in the Matheo Study Series
.. raw:: html
**Broader Significance**
Nuclear war is usually argued in words. This study argues it in numbers, using the oldest
quantitative discipline built for questions of this shape: actuarial science. An actuary cannot
say when a particular person will die. Given a population, a set of risk factors, and a claims
history, an actuary can still price the risk --- and be wrong in ways that show. This study
treats the system of nuclear-armed states as the life being priced, the Cold-War record of
near-misses as the claims history, and accidental nuclear winter as the death.
At the rate crises have actually arrived, half of all runs of world history reach accidental
nuclear winter within **about twenty years**, and the chance it begins in any given year is
**worse than one in forty**. Set beside a risk that societies accept without alarm --- dying in a
road accident --- a person is **more than fifty times** more likely to die as a consequence of
accidental nuclear winter than in a car crash, counted the same way: annual, per person, death
against death. That comparison is this study's central claim, and it is built to be attacked
rather than admired. It survives when the most sceptical published reading of the record, the
lowest published death toll, and the road-death rate of the worst-affected country on record are
applied *all at once*.
This risk is not invisible because it is small. It is invisible because it has been removed from
the places where risks are measured. Nuclear war is excluded by standard clause from essentially
every insurance policy written: the profession that prices catastrophe for a living examined this
one and declined it, on the correct grounds that it is uninsurable in principle --- there is no
surviving counterparty to pay. It was priced at infinity, and then not spoken of. What follows is
not alarm. It is arithmetic, from public data, repeatable in an afternoon.
A second calculation, which does not depend on the first being right, asks the question backwards:
not how large the danger is, but **how small the prospect of success may be before paying to attempt
a remedy is still worth doing.** Priced against a remedy costing about eight dollars a person a year,
the answer is on the order of one in a few thousand --- and stays at no more than three and a half
percent even if this study has overstated the danger by a factor of a hundred. A reader does not have to accept the
forecast in order to accept what follows from it.
Readers who suspect this of being alarmism should go straight to the strongest published
objection (SIA-11): the most sceptical published critic of nuclear close-call analysis supplies
this study's own optimistic scenario, and the conclusion holds there too. Readers who want the
argument without the theology will find it in
:doc:`a companion written in entirely secular terms `.
The study is offered not to be believed, but to be checked. If it is wrong, the fastest way to
find out is for someone to say so. **#AuditTheMath**
.. raw:: html
**Declarations**
.. container:: titlepage-identity-footnotes
| :sup:`4` "of Laodicea" indicates taking responsibility to undo personal complicity with disastrous Laodicean legacies like banning mathematicians from clergy (Canon 36, Council of Laodicea; two magisteria separations), enabling institutional lukewarmness, weapons of math-destruction, and slow-motion explosions of misinformation from pandemics to self-compounding interests.
| :sup:`5` LLoL stands for ridiculous luck in serendipitous discovery and a commitment to find ever more fun ways to help others uncover street-wise math that matters.
| :sup:`6` Loewe's traditional standards for co-authorship demand naming AI Claude Opus 4.8 Max (by Anthropic) as a co-author for many substantial contributions, as if a PhD-student. Yet, AI co-authorship is withheld here until Loewe's framework for AI co-authorship after the practical singularity (PraS) passes external human peer review (see :doc:`Matheo-b21 ` study). Anthropic is not responsible for AI mistakes here. Loewe as senior corresponding author remains forward accountable for every number in this study, including those a machine computed.
| :sup:`7` *Licensed under the Jonah License and CC-BY 4.0 for maximal flexibility (see* https://balospe.com/en/license/joli/ *).*
.. raw:: html
**Abstract**
**How long does a civilization survive with nuclear weapons and without periodic recalibration?**
This paper answers the way an actuary prices a life --- as a probability distribution over
time-to-failure, calibrated on a claims history and falsifiable against it. **RiskyMAD** is a
three-state model (Risky / MAD crisis / Dead, the last absorbing) with one rate that must come from the
world: the crisis rate, counted from the sixty near-misses catalogued by Baum, de Neufville and
Barrett (2018) at about **0.1 per year**; the chance a crisis escalates is taken, unmeasured, as
**one in three**. The result: **half of all runs over within about twenty years**, an annual probability **worse than
1 in 40**, and **more than 70 percent over a forty-year career** --- for most people, a likelier death
than a car crash, by a margin that survives every scenario. Every figure in this paper's body is stated
as a bound that under-claims, with the exact values kept in the appendices. The result is a decision, not only an
estimate: it is invariant across the full range the record can bear, and only a crisis rate of
*exactly* zero --- which no one claims --- would overturn it. Because the Dead state is absorbing,
onset is a stochastic certainty under business as usual; the only open question is when. The mechanism is a
saturating two-step process, so long quiet stretches are exactly what the model predicts most of the
time --- which is why eighty-one quiet years are weak evidence, not reassurance. A candidate escape,
MAP, is derived and priced by the same model, and then priced a second way that does not need the
forecast to be right: asking not how large the danger is but **how small the prospect of success may be
before paying to attempt a remedy is still worth doing**, the required probability comes out on the
order of **one in a few thousand**, and stays at **no more than three and a half percent** even if this
study has overstated the danger a hundredfold --- rising to a real hurdle only for a reader who also holds one
person's whole stake in the world to be worth almost nothing. **What is new here is narrower than the subject.** Quantitative estimation of nuclear-war
risk is an existing literature, and this study's headline figure corroborates rather than
displaces it. What it adds is the **exact first-passage law** in place of a Poisson
shortcut; the **whole distribution** in place of a point estimate; the Michaelis--Menten
correspondence as an **identity** rather than an analogy; the survival of the mean
**without the exponential assumption**; and an **identifiability result** fixing what the
record can and cannot separately estimate. That this gap was open is not asserted here but
cited: Baum (2018) lists precisely this quantification among the things still to be done.
**SIA-10** sets out each claim and its nearest published relative.
Every input is public and every step is open to
inspection. **Don't believe it --- #AuditTheMath.**
.. contents:: Contents
:depth: 1
:local:
----
.. AA AnyAims Todos for this paper (b16) before concluding this revision are as follows :
.. 1. ideally b16 also does this (if possible)
(1) das aktuelle Paper ("b16") soweit fertig bekommen, daß ich es an Experten zum Peer-Review schicken kann, in der Hoffnung, daß es dann die wichtigsten Türen öffnet — so wie das TREE-Paper 1997, unser Science-Paper 2003 und mein EvoSysBio-Paper 2009.
(2) Idealerweise schaffe ich es, die Gute Botschaft dahinter so in eine Nußschale zu packen, daß sie für die "Malchus"-Wissenschaftsknechte verständlich wird, denen die Christen bisher die Ohren abgeschlagen haben. == ResearchCity institutionalizing rule of RQA...
1. Introduction to the Question
==================================================
.. COMPRESSION (LIVE, applied 2026m08d07) --- the full B-59 account that stood here from
2026m08d06 (1517 words of story + 568 of caution note) was moved VERBATIM to SIA-X7 and
replaced by the single paragraph below. LLoL's ruling: "P1 with the Washington splice".
The two alternative paragraphs and the trade-off table between them are in the comment
block immediately after the paragraph, so they stay to hand while editing. The 2026m08d06
story-first / question-first PROPOSAL A/B machinery moved to SIA-X7 with the story.
2026-09-24: SUPERSEDED as a description of what is live. By September LLoL's hand draft and P1
were both live, so the story rendered twice. Both are now commented out directly below the new
summary, which follows LLoL's instruction that the Introduction be a brief, very well written
summary and SIA-X7 the full sourced account. Llog: hell/ll/study/b/16/b16-arkhipov-section1-siax7-llog_2026m09d24_11h11.rst
**October 1962: Vasili Arkhipov and the meaning of nothing**
On 27 October 1962, the most dangerous day of the Cuban Missile Crisis, the Soviet submarine B-59 lay
pinned beneath a United States Navy hunting group that did not know she carried a nuclear torpedo. Her
cooling had failed, her air was running out, and the practice charges dropped to tell her
to come to the surface sounded below like an attack.
For days nothing had come in from Moscow, and that nothing fitted two
worlds equally well: no war yet, or Moscow was already wiped out, with nobody at the far end of the radio.
Her officers could stay down and suffocate, fight their way out with a weapon of last resort, or surface
into the arms of the enemy. Twice that day the captain reached for that nuclear torpedo.
Below, he ordered the nuclear torpedo readied, convinced his patriotic duty demanded its use.
Yet Vasili Arkhipov spoke up against a furious captain, in a boat that might already be at war,
and --- by the one witness's account --- talked him out of it :cite:`Savranskaya2005`. So the captain
decided to surface instead. No available evidence could settle which world they were in.
What Arkhipov said is not recorded, but only one line of reasoning fits what he achieved: the
asymmetry of being wrong about what that "nothing" meant. He argued otherwise gently, kindly and
reasonably, and it was convincing enough to move the captain to surface into the arms of the "enemy":
Firing their last remaining "super-weapon" would ignite or escalate the war they all hoped to prevent
(a horrendous long-term cost), yet surfacing needlessly would in the worst case personally cost them
their submarine, their career, and likely their lives - a huge personal cost they deemed worth paying
for a shot at securing the long-term common good of keeping the world out of a global nuclear war.
After surfacing the captain was blinded by powerful searchlights.
He ordered an urgent dive and tubes 1 and 2 readied to fire with the nuclear
torpedo in tube 1.
Arkhipov saw that the American ship was signalling by lamp, not attacking, and cancelled the
dive --- another gentle, kind, reasonable call.
Then the ambiguous semantics of nothing (ASON) displayed its benign side:
The disaster the crew had feared did not happen as the nothing of "not yet" did not turn into
the nothing of "no more" (for this MAD crisis). This moment and others like it in effect won WW3 for everyone,
friend and foe alike, because there are no winners in a global nuclear war, only losers.
And so WW3 became known as the Cold War, because no hot escalation has happened yet.
Unfortunately, many oversimplify the wrestling with the complexity of a global
nuclear machinery into concluding that "nothing" happened and that heroic acts of
logical reasoning for the common good as done by
Vasili Arkhipov do not need celebrating on a dedicated day of remembrance.
Hence, instead of moving on, such a nihilistic view of nothing binds the world
into a status quo that will keep waiting for a hot WW3 until it arrives,
because it fails to see how the WW3 was already won for everyone.
That is how forgetting tends to contribute to the arrival of accidental nuclear winter
by perpetuating the status quo of nuclear roulette.
More details of Arkhipov's story are in Supporting Information Appendix SIA-X7.
The rest of this study explores how often near-disasters like this one
have occurred so far, what that is saying about a complex system like our world,
armed with enough hair-trigger nuclear weapons to blow itself up, and how
all these insights can be combined into a probabilistic model for predicting
waiting times until a globally devastating nuclear war will occur by accident.
Not because anyone wants to, but simply because eventually some battle station somewhere
will not have someone like Arkhipov around to offer a gentle kind reasonable alternative
for how to best interpret observations that seem to be "demanding" the use of nuclear weapons.
.. Sort through and delete the extra comments below after the main text is established.
.. 2026-09-24 --- LLoL'S HAND DRAFT AND THE OLDER P1 PARAGRAPH, BOTH COMMENTED OUT HERE, NOT DELETED.
The summary above replaced them on LLoL's instruction that the Introduction be a brief, very well
written summary of the salient points, with the full sourced account in SIA-X7. Until today both
rendered, so page one told the story twice (AA k6/s9). To re-activate either, remove this comment's
indentation from it. Llog: hell/ll/study/b/16/b16-arkhipov-section1-siax7-llog_2026m09d24_11h11.rst
WHERE EACH SENTENCE OF LLoL'S DRAFT WENT, in reading order:
- "During the Cuban Missile Crisis on Oct 27 ... US Navy destoyers who were unaware of its nuclear
capabilities." KEPT in substance: "a United States Navy hunting group that did not know she carried
a nuclear torpedo". (The typo "destoyers" goes with it.)
- "Reaching the end of its cooling capabilities and oxygen supplies ..." KEPT, compressed: "Her
cooling had failed, her air was running out".
- The trilemma, (A) suffocate, (B) fight, (C) surface. KEPT, compressed to one sentence: "stay down
and suffocate, fight their way out with a weapon of last resort, or surface into the arms of the
enemy". CORRECTED on the way: "firing its nuclear torpedo into that US aircraft carrier in their
sight". The boat was submerged, and the sources name the ships above, or "an American destroyer"
(the widow's statement, Savranskaya 2005, p. 247), not a carrier in sight.
- "See Supporting Information Appendix SIA-X7 ..." KEPT as the closing pointer.
- "The B-59 had not heard from Moscow for days ... arguing for firing that nuclear torpedo." KEPT:
"For days nothing had come in from Moscow ..." and "the captain ordered the nuclear torpedo readied".
- "This disaster (likely causing all-out nuclear war) would have happened if Vasili Arkhipov had not
gentle kind reasonably spoken up ..." REPLACED. "Would have happened" is stronger than the record
allows (SIA-X7). On LLoL's choice of 2026-09-23 the phrase now glosses the recorded act instead:
"--- the gentle, kind, reasonable call, and the hard one."
- "He was the third officer whose approval was required by Moscow's rules for launching that nuclear
torpedo." CUT: no source supports it. Orlov (in Weir and Boyne 2003, via Voorhees 2023) names the
key-holders as the commander, the executive officer and the political officer; Arkhipov's authority
was his seniority aboard (Komarov 2022, p. 158). The consent rule is the popular accretion
(Wilson 2012), which SIA-X7 measures.
- "Arkhipov pointed out that the same evidence (not hearing from Moscow) did not necessarily mean ..."
and "If the latter was true, then firing that nuclear torpedo would start the very thing ...". KEPT
AS THE LOGIC, NOT AS HIS WORDS, because what Arkhipov said below the surface is not recorded: "that
nothing fitted two worlds equally well ..." and "No evidence could settle which world they were in;
only the asymmetry of being wrong could ...".
- "Calmly explaining this asymmetry of consequences eventually convinced the Captain to stand down."
REPLACED by what the sources record: below, the captain surfaced after conferring with Arkhipov and
the political officer (Orlov); above, Arkhipov cancelled the dive (Leonenko, Mikhailov).
- ADDED: the night countermand, which is the best-attested moment of the day; the misread signalling
charges; and P1's closing beat, "Then nothing happened, and that nothing lasted forty years".
- HEADING: "Vasili Arkhipov's view of the meaning of nothing" became "Vasili Arkhipov and the meaning
of nothing", because his view below the surface is not recorded.
--- LLoL's hand draft (heading, paragraphs, and the rule that followed them), verbatim ---
**October 1962: Vasili Arkhipov's view of the meaning of nothing**
During the Cuban Missile Crisis on Oct 27 the nuclear armed Soviet submarine B-59 was being pinned down by
US Navy destoyers who were unaware of its nuclear capabilities.
Reaching the end of its cooling capabilities and oxygen supplies, its commanders faced
an existential trilemma: (A) Staying submerged would surely suffocate everyone soon.
(B) Fight back by using a traditional warfare mindset to break free of the stranglehold:
this would mean inflicting maximal damage on the obvious enemy by firing its
nuclear torpedo into that US aircraft carrier in their sight.
(C) Conquer the binary warfare mindset by appropriately responding to the larger risks at hand:
this would mean surfacing without using their weapon of last resort in a costly gesture of
good will that risked capture and death by their declared enemy.
See Supporting Information Appendix SIA-X7 for more details on the extraordinarily stressful nature
of that situation.
The B-59 had not heard from Moscow for days and its Captain had started to assume that World War III
had already started and that it was therefore their patriotic duty to fight back best they could,
arguing for firing that nuclear torpedo.
This disaster (likely causing all-out nuclear war) would have happened if Vasili Arkhipov had
not gentle kind reasonably spoken up for a different interpretation of the meaning of *nothing*.
He was the third officer whose approval was required by Moscow's rules for launching that nuclear torpedo.
Arkhipov pointed out that the same evidence (not hearing from Moscow) did not necessarily
mean that Moscow had been obliterated; it could also be explained by a number of other causes,
which would imply that the all-out war feared by all had not yet started.
If the latter was true, then firing that nuclear torpedo would start the very thing they were trying to prevent.
Calmly explaining this asymmetry of consequences eventually convinced the Captain to stand down.
----
--- P1 (Claude, 2026-08-07; live beside LLoL's draft until 2026-09-24), verbatim ---
Pinned in the Sargasso Sea beneath an American hunting group, too deep to hear Moscow, the Soviet
submarine B-59 had received nothing for days --- and the same nothing fitted two worlds: no war yet,
or war already begun and nobody left at the far end of the radio. Her captain ordered the nuclear
torpedo readied --- a weapon Washington did not know was at sea. What broke the tie was not evidence
but the asymmetry of being wrong: surfacing needlessly costs a boat and a career, firing needlessly
costs the war. After consulting Vasili Arkhipov and one other officer, he surfaced. Saying nothing
would have broken no rule and cost nothing in the next five minutes; it was also the option that
ended the world. Then nothing happened, and that nothing lasted forty years --- no headline, because
no event (SIA-X7, with its single contested source).
.. EPIEIKEIA RESTORATION --- two costed options for THE PARAGRAPH ABOVE. Neither is live.
2026-09-24: "THE PARAGRAPH ABOVE" is now the new summary; P1 is commented out. The insertion point
below still works, because the summary keeps the same sentence: E1 or E2 would go directly after
"... firing needlessly costs the war." E1 remains the recommended form. SIA-X7 still holds the full
epieikeia paragraph ("No rule could have supplied that").
Drafted 2026m08d07 at LLoL's request and placed here, directly under the paragraph they
would change, so they are met while reading Section 1 rather than buried in the
ALTERNATIVES block below.
WHAT WAS LOST. The 186-word paragraph "**No rule could have supplied that**" went to
SIA-X7 with the story. It is the ring's ONLY argument that judgement-when-rules-run-out is
a FUNCTION that can be staffed, trained and paid for --- which is exactly what Sections 6
and 11 then ask the reader to fund. As the ring now stands, that ask has no stated warrant.
NON-REDUNDANCY (LLoL's constraint: brief, but not an echo of the appendix). The split is
CONCLUSION versus ARGUMENT, not short versus long. The ring states that judgement is a
fundable function; SIA-X7 keeps WHY no rulebook could have reached the case however
diligent its authors, what *epieikeia* is, and the two concrete things it meant in that
compartment (equal dignity extended to the enemy crews the torpedo would have killed;
honest weights on states of a world no data had reached). That division is the paper's own
rule --- "the SIAs hold all rigour and depth; the ring only states and points" --- so it is
not repetition.
INSERTION POINT for both: directly after "...firing needlessly costs the war." and before
"After consulting Vasili Arkhipov...". The paragraph has just said evidence could not
settle it; "no rule could either" is the natural next beat, and it lands before the two
"nothing" beats that must close the paragraph.
---------------------------------------------------------------------------
E1 --- 30 words (paragraph 150 |rarr| 180, +20%). RECOMMENDED.
---------------------------------------------------------------------------
Rules run out where the stakes peak, and what takes over is a function, not a virtue ---
one that can be staffed, trained and paid for (Sections 6 and 11).
BUYS: the smallest form that still warrants the Sections 6/11 ask, and it turns this
paragraph from pure diagnosis into diagnosis-plus-direction --- the reader learns
there is something to DO about what has just frightened them, nine sections before
being asked to fund it.
COSTS: asserts the function claim without earning it; a reader who wants to know WHY no
rule could cover the case has to reach SIA-X7. No Aristotle.
---------------------------------------------------------------------------
E2 --- 66 words (paragraph 150 |rarr| 216, +44%).
---------------------------------------------------------------------------
No rule covered the case, and none could have: rules run out exactly where the stakes
peak. What takes over there is old and has a name --- Aristotle's *epieikeia*, judging
by a rule's purpose when its letter cannot reach the case. It is not a virtue this paper
hopes for but a function, and functions can be staffed, trained and paid for (Sections 6
and 11).
BUYS: the claim is earned rather than asserted ("and none could have"), and the
intellectual lineage is visible to an expert reader in the first minute --- cheap
insurance against the "advocacy" dismissal, since *epieikeia* is a jurisprudence term,
not an activist one.
COSTS: +44% on the tightest paragraph in the paper, taking it PAST P2's length --- i.e.
accepting E2 gives back most of what the 2026m08d07 compression bought. And a Greek
term in a submarine paragraph must survive the question "would this paragraph be
worse without it?"
ONE RESONANCE, checked and kept deliberately: two sentences below the insertion point the
paragraph reads "Saying nothing would have broken NO RULE". With E1 or E2 in place, "rule"
appears twice in three sentences carrying different senses --- no rulebook reached the
case; and staying silent violated nothing. That is not a collision but the point in
miniature: the rulebook was silent in both directions, which is why a judgement had to be
made at all.
THIRD OPTION, NOT SUPERSEDED BY THESE: one sentence in Section 6 or 11, where the ask is
actually made. Standing AA row (k4/s8) in ``aa-b16-finalizing.rst``. The two jobs differ
--- here it tells the reader early that the problem has a shape that can be acted on;
there it supplies the warrant where the money is requested. Both, either, or neither.
.. ALTERNATIVES, kept to hand for LLoL's editing (2026m08d07). Not rendered, not live.
2026-09-24 CORRECTION: constraint 1 below ("THE SOURCED VERSION ONLY ... consulted two officers, and
surfaced") and the phrase "single contested source" in P2 and P3 are superseded. The night
countermand is sourced: two B-59 officers record Arkhipov cancelling the urgent dive (Leonenko2012,
Mikhailov2012; SIA-X7). "LIVE ABOVE = P1" no longer holds: the live text is the 2026-09-24 summary.
All three drafts obey the same five constraints, which are not free choices --- the rest of
the paper leans on them:
1. THE SOURCED VERSION ONLY. No vote, no veto, no lone refusal, no single word. The
captain ordered the torpedo readied, consulted two officers, and surfaced. (Established
by the Orlov scan, 2026m08d06; see the caution note now in SIA-X7.)
2. ARKHIPOV NAMED --- the very next paragraph says "Arkhipov's position", and Sections 2
and 9 and SIA-X1 refer to him by name.
3. THE AMBIGUOUS SILENCE --- the hinge that Section 7 re-uses for the eighty-one years.
4. THE ASYMMETRY OF BEING WRONG --- the next paragraph says "the asymmetry is the one
Arkhipov faced" and needs a referent.
5. A POINTER THAT FLAGS THE SOURCING DISPUTE, so an expert reader meets the caveat here
rather than discovering it later and concluding it was hidden.
LIVE ABOVE = P1 (141 words) + the "a weapon Washington did not know was at sea" splice = 150.
---------------------------------------------------------------------------
P2 --- "why the order was given" (195 words). Not live.
---------------------------------------------------------------------------
**October 1962: the meaning of nothing.**
The Soviet submarine B-59 lay pinned in the Sargasso Sea under fourteen American ships, her
cooling failed, the compartments at 45--50 °C, duty officers fainting at their stations,
depth charges going off against the hull --- practice charges, a knock on the door, though
nobody aboard could know that. Too deep to hear Moscow, she had received nothing for days,
and the same nothing fitted two worlds: no war yet, or war already begun and nobody left at
the far end of the radio. Her captain ordered the nuclear torpedo readied --- a weapon
Washington did not know was at sea. No rule covered the case and no evidence could settle
it; what broke the tie was the asymmetry of being wrong --- surfacing needlessly costs a
boat and a career, firing needlessly costs the war --- and after consulting Vasili Arkhipov
and one other officer, he surfaced instead. Saying nothing would have broken no rule and
cost nothing in the next five minutes; it was also the option that ended the world. Then
nothing happened, and that nothing lasted forty years --- no headline, because no event
(SIA-X7, with its single contested source).
---------------------------------------------------------------------------
P3 --- abstraction first (142 words). Not live.
---------------------------------------------------------------------------
**An absence of signal is not a signal.**
Nothing arriving fits a safe world and a lost one equally, and carries no evidence about
which produced it --- which is why eighty-one quiet years are weak evidence rather than
reassurance (Section 7). The purest recorded instance was lived out in a submarine. In
October 1962, pinned under an American hunting group in the Sargasso Sea and too deep to
hear Moscow, B-59 had heard nothing for days; her captain ordered her nuclear torpedo
readied; after consulting Vasili Arkhipov and one other officer, he surfaced instead. What
broke the tie was not evidence but the asymmetry of being wrong: surfacing needlessly costs
a boat and a career, firing needlessly costs the war. Then nothing happened --- and the
record of it stayed thin and contested, because catastrophes generate archives and averted
catastrophes generate silence (SIA-X7).
---------------------------------------------------------------------------
WHAT SEPARATES THEM --- the trade-off table, for evaluating in place
---------------------------------------------------------------------------
P1 (141 w) BUYS: all three senses of "nothing" (the ambiguous silence, the cheapest
available action, the invisible success) plus the asymmetry. Fastest read; the "doing
nothing was the option that ended the world" sentence lands hardest here because
nothing competes with it.
P1 COSTS: the order to ready a nuclear torpedo arrives unexplained, so a reader may file
the captain as unhinged rather than as an ordinary man under exactly the conditions
this paper is about. (The Washington splice, now live, partly answers this by showing
what was at sea; it does not show WHY the order came.)
P2 (195 w) BUYS: repairs precisely that --- the heat, the fainting, the practice charges
misread as an attack. This is not colour: it is the accident mechanism the paper
prices (ordinary people, bad information, no time), and it converts the account from
an anecdote about a madman into the general case.
P2 COSTS: 54 words more, and it introduces a SECOND epistemic failure (a signal misread)
beside the first (a signal absent). Two ideas competing inside one paragraph.
P3 (142 w) BUYS: safest with a Tertrais-aligned reader --- the abstraction leads, the story
is explicitly an instance of it, and the contested record is turned into evidence for
the thesis in the closing clause. Hardest to dismiss as advocacy.
P3 COSTS: least gripping for the general audience, which is the audience the story was
added for. Drops "doing nothing was the option that ended the world" --- LLoL's own
cost-of-inaction point, and the strongest single sentence of the three drafts.
NOT CLAIMED: that any of these is THE shortest possible. Only the shortest this drafter
could reach while keeping the five beats above. Shorter exists if a beat may move
downstream.
ONE KNOWN LOSS: the *epieikeia* paragraph ("No rule could have supplied that", 186 words)
is gone from the ring --- LLoL's conceptual contribution of 2026m08d06, and the ring's only
argument that judgement-when-rules-run-out is a FUNCTION that can be staffed, trained and
paid for, which is what Sections 6 and 11 then ask for. Full paragraph preserved in SIA-X7.
TWO COSTED WAYS TO PUT A BRIEF FORM BACK are in their own comment block ABOVE, immediately
under the live paragraph, where they are met while reading rather than buried down here.
**Which raises the question this paper exists to answer.**
How long does a civilization with nuclear weapons survive without periodic rebalancing?
This is not a philosophical question but a practical one of great value for long-term planning. It
also has a personal companion, because Arkhipov's position is not merely historical: it is the
standing position of anybody who has looked at the present arrangement and found the silence
ambiguous. Nobody can prove the danger is real. Nobody can prove it is not. The asymmetry is the one
Arkhipov faced. **Do you surface?**
This author's own answer is on the record and binds nobody else: *he will surface, and take
responsibility as best he can.* This paper is that surfacing --- his model about "nothing" put in the open, at
whatever it costs, with an invitation to others to check Loewe's logic and to come to the surface as well.
The shape of the choice is the one that recurs through this study: **a broad road running toward
self-destruction, and a narrow path that leads anywhere else.** The asymmetry is not rhetoric. It is
the ordinary arithmetic of large configuration spaces --- there are vastly more ways to break a
working system than to improve one, which is why destruction is quick and construction is slow, and
why random changes to a genome are overwhelmingly harmful rather than helpful (SIA-X1). Wrecking
needs no plan and no skill; whatever is left standing was built and maintained on purpose. Neither
road can be told from the other by anybody determined not to look. What follows is the looking:
first in general terms, then with the technical detail needed to test every claim.
----
The existential question above is the same type of stochastic question an actuary asks when using probability theory
to calculate expected lifespans for insurance purposes.
Actuaries cannot say when exactly a person will die.
But if they have a population, its risk factors, and a claims history,
they can forecast mortality tables with stunning accuracy --- and be wrong in ways that show.
**The Question.** This study runs a similar type of actuarial forecast for a very unusual life and a very specific risk.
The life is that of our world and the risk is its death in accidental nuclear winter.
The latter is short-hand for a cascade of
events that starts with accidental errors and misjudgments
in the global doomsday machinery of nuclear-armed states, which then trigger
an accidental nuclear war that darkens the skies and thereby causes a global nuclear winter :cite:`Robock2007`
that freezes or starves most people who survived the initial blasts :cite:`Xia2022`.
Yet, how can one possibly forecast with any degree of reliability a useful distribution of
waiting times until the start of such unthinkable horrors,
given that such a global disaster has not yet happened?
**The claims history.** Actuaries have past mortality tables and a claims history.
We cannot use mortality tables as our civilization has not destroyed itself yet
and if humans caused such global disasters before, they have not been recorded in ways
amenable to mathematical analysis. But closer inspection shows, this is not the whole story.
Generally, history is full of examples of non-global civilizations who built empires
that went on to self-destruct.
Many argue that waning empires were destroyed by upcoming rival empires.
The systematic record points the other way. Kemp (2025) :cite:`Kemp2025` reads the
collapse of large hierarchical societies --- his "Goliaths" --- as endogenous: lootable
wealth, weapons and technology concentrate power in ever fewer hands until the society
turns brittle, and every Goliath so built carries the cause of its own end.
That mechanism is structural, where the account developed below is epistemic --- a
failure to understand the true nature of one's greatest threats (natural disasters or
human conflicts). This study does not need to adjudicate between them: both are
self-destruction, and both describe an accumulation that no periodic rebalancing ever
reverses, which is the question this study opened with. Here is not the place to
analyze such self-destructions in detail, which is fueled by the
silent corruption of key players in such societies
(see https://balospe.com/en/crisis/silent-corruption/).
Abstractly seen, the problem was rarely the existence of "others",
but rather an inability to negotiate self-stabilizing rhythms for lasting peace with "them".
Whether that local record extends to the global scale cannot be settled here, and
**nothing in the forecast below depends on it.** The waiting-time estimate is built from
the near-miss record of the nuclear age alone. A reader who rejects the historical analogy
outright may discard this paragraph without changing a single number.
What the analogy does change is where the burden of proof lies.
Nobody can prove that the quiet since WWII is the calm before a global firestorm.
But neither has anybody shown that this quiet is a *stable regime* rather than a *waiting time* ---
and a stable regime is precisely what the do-nothing option silently assumes.
Kemp's reading of the historical cases :cite:`Kemp2025` adds an uncomfortable corollary: collapse is
often not visible as collapse until after it has run, so the absence of an alarm is
not evidence that the arrangement is stable.
That is the submarine's problem at civilizational scale, and it has the submarine's
resolution: the tie is broken not by evidence, which is unavailable to either side,
but by the asymmetry of being wrong.
That same asymmetry governs here, which is why "nothing to see, and nothing to be done"
is not a neutral default. It is a positive claim about the safety of the present arrangement,
and it is a claim that has never been priced. The estimates below price it ---
they state what continuing to assume it costs, if it is wrong.
They are offered not to be believed, but to be checked, most usefully by anyone
willing to state what they think the waiting time is instead, and to show their work.
To simplify analyses for this study, the self-destruction of humanity is approximated by
the death of most people due to the collapse of global supply chains.
Specifically, the claims history of interest may be seen in the instances where
humanity has come close to the cliff of accidentally sliding into an all-out global nuclear war
that would trigger nuclear winter deterministically.
That accidental nuclear winter is *possible*
is not in doubt: clearly, that cliff exists :cite:`Jacobsen2024`.
As reviewed below, it is also clear that humanity has come close to falling off that cliff:
the Cuban Missile Crisis (1962), the Able Archer exercise (1983),
and Stanislav Petrov's false alarm (1983) are all well documented examples.
B-59 was one compartment inside the first of them, and the pattern it exposes is the general one:
anyone facing such existential decision challenges is
in some form forced to weigh (0) a fleeting short-term "advantage" for themselves
against (1) the long-term good for everyone.
Notably, the most fleeting of such "advantages" is the mental shortcut of blindly assuming
that there is "nothing" to see here and that "nothing" can be done.
Indeed, the most difficult part in writing this study was this
overcoming of the blindly assuming of the authorized leadership of "nothing"
in Loewe's mind, which delayed this analysis by decades.
The same blindly assuming will have to be overcome by all who wish to avert the disaster described here.
The decision-challenge at the cliff may be summarized by a "coinflip":
either a person in the most critical seat at the cliff gives up and "lets go"
(allowing the world to slide into disaster, knowingly or not) or that person combines the courage it takes
with a sound mind to make the right long-term call, often at potentially great personal costs.
**Actuarial mapping.** Forecasting remaining life-times for our world
is then enabled by the above mapping that treats
our world of nuclear-armed states as the life whose waiting time to death is to be estimated.
Death is defined by accidental nuclear winter.
The Cold-War record of near-disasters then becomes a close substitute to a life-insurance
claims history.
Everything about *how* such a catastrophe unfolds is deliberately collapsed to a single switch --- alive
or dead --- setting aside how many must die "to count" as a global disaster, and whether the end comes as a sudden heart
attack or as a slow, worsening cancer in which nuclear weapons are only one cause among many.
That abstraction is a central simplification that ignores other existential risks and
therefore leads to an underestimate. For example, it excludes any
deliberate nuclear self-destruction of humanity
as well as the wider catalogue of existential risks surveyed by Ord (2020) :cite:`Ord2020`.
The resulting simplified model is defined in Supplementary Information Appendix SIA-1.
.. The "Decision to look" paragraph below was CUT in the Section-1 -> SIA-X1 restructure
(2026m07d21) and parked here verbatim. On 2026m08d05 it was WOVEN BACK IN, on LLoL's
instruction, as the "difficulty is not only personal" paragraph that follows this comment ---
its Parkinson placeholder resolved to the law of triviality, with a citation. The
broad/narrow-road *decision* had already survived in Section 5. The original is kept below
so the wording can be checked against what replaced it; do NOT integrate it a second time.
Original text follows ---
**Decision to look.** In either case there appears to be a broad road to self-destruction for
humanity and only a narrow road that leads to its survival. It's impossible to predict which roads
lead to the worst disasters, especially for people who are determined to look away from what matters
most. That tendency is so widespread, it's called the Law of ((Parkinson, bike-shedding...)).
Completing this study was a constant battle on focussing first on what matters most. It will
hopefully encourage a closer look at the narrow path to life before it's too late to choose it.
Without such a deliberate, determined, and intelligent choice to go for the hard real questions in
pursuing humanity's destiny, humanity remains locked into a self-destructive fate. Here's the
intuition:
**The difficulty is not only personal.** The reluctance admitted above --- decades spent assuming
there was nothing to see --- has an institutional twin, and it is common enough to have a name.
Parkinson's law of triviality :cite:`Parkinson1957` holds that an organisation gives an item time in
inverse proportion to its importance, because the small item is the one everybody feels competent to
have an opinion about. His illustration is a committee that approves an atomic reactor in two and a
half minutes and then argues for three quarters of an hour about a bicycle shed --- the episode that
gave "bike-shedding" its name. The committee is fictional and the essay is a satire, so this is an
image and not evidence. But the shape it names is the reason a question like this one can stay
unasked for eighty years while everybody remains busy. Here is the intuition it has to start from.
**The waiting-time game.** Picture a die on which a six is a disaster. No one can predict the next
roll; yet a six is certain to arrive if the rolling never stops. An outcome uncertain on any single
turn becomes certain over enough turns --- and this holds whether the "die" is as simple as a coin or
as complex as a world. So the one question this paper puts to history is: **how long until the six?**
**The resulting question,** made quantitative: given the rate at which such crises have actually
arrived, what is the probability distribution of the waiting time until one of them does not stop?
**One deliberate limit.** This paper forecasts only *accidental* nuclear winter, setting aside anyone
who might choose to start one on purpose. A forecast of bad luck cannot also model bad intent, and
mixing the two would leave neither testable. The exclusion runs in the safe direction: any deliberate
pathway could only shorten the waiting times computed here, so these figures are, if anything, an
over-estimate of the time bought by good luck alone.
This is not an idiosyncratic worry. In 2025 the Nobel Laureate Assembly for the Prevention of Nuclear
War warned that nuclear war can end civilization "in an afternoon" :cite:`NobelAssembly2025`; in 2026,
at the Vatican, the Global Nobel Laureates Assembly on Artificial Intelligence and Nuclear War warned
that AI built into nuclear systems "leaves little time for, or even replaces, human judgement in a
crisis" :cite:`DiazMaurin2026` --- the exact failure this model takes as its absorbing state. Theirs
is the qualitative alarm; this paper supplies the quantity behind it, and asks to be checked rather
than believed. **#AuditTheMath**
.. admonition:: Why this paper exists
This forecast is a by-product of a longer project. The author, Loewe, is a mechanistic evolutionary
systems biologist whose life's mission is to architect Evolvix into a *century-stable extensible
humane* computer-language for accurate modelling in biology --- one built to still be readable, and
still be running its models, a hundred years from now. That mission only makes sense if there is a
century to build for. So in 2020 he turned his own tools on that assumption and asked the actuarial
question this paper answers. The methods are the ones he uses daily to forecast systems too complex
to model atom by atom; only the system being forecast is new.
None of this is offered as authority to be blindly assumed. It is offered so that a reader can
inspect the training that produced the model and judge where its author is most likely to be wrong
--- and then check exactly there. Why a biologist, why "top-down", and why no one else seems to
have run this calculation before are set out in **SIA-X1**; nothing in the argument depends on any
of it.
**What is claimed as new, and what is not.** The subject is not new: quantitative estimates
of nuclear-war risk have been published for two decades, and the figure this paper reaches
sits within a factor of three of the most recent of them. Five things are new, and they are
narrow: the exact first-passage law rather than a Poisson shortcut, the distribution rather
than a point estimate, the Michaelis--Menten correspondence as an identity rather than an
analogy, the mean's survival without the exponential assumption, and the identifiability
result. A reader who wants each of those set beside its nearest published relative --- and
the published review that names this quantification as undone --- will find both in
**SIA-10**.
**What follows.** Section 2 sets out the claims history --- the sixty published near-miss incidents,
and this paper's own classification of how many were genuine entries into a crisis. Section 3 states
the model: three states, no more, every parameter on the table. Section 4 feeds the record's rate into
it and reports what comes back, which is a distribution rather than a point. Section 5 is where the
numbers stop being numbers; it states the decision they force, and the rest of the paper is built
around it. Section 6 names a remedy, and the reason one is needed --- that the present arrangement is
metastable rather than stable. Sections 7 and 8 take the two objections that matter most: that
eighty-one quiet years are reassurance (they are weak evidence about the rate, which is not the same
thing), and that this can be handled later (delay is not a neutral choice but a losing one). Section 9
prices the escape route against its own build time, Section 10 sets the two roads side by side, and
Section 11 asks for the smallest action that would change anything.
Depth lives in the appendices rather than in the sections above: the body states results and points,
while the Supporting Information Appendices carry the derivations, the calibration, the comparisons,
the strongest objections, and the record needed to reproduce every figure. Their numbering is still
being consolidated, so they are named where they are used rather than surveyed here. Each number in
the body names the appendix that produces it --- so a reader who wants to attack the arithmetic knows,
at every step, exactly where to go.
----
2. The Record We Have
==================================================
An actuary is only as good as the claims history. This one exists, and it is not this paper's own.
The largest published catalogue of nuclear near-misses is the sixty incidents compiled by Baum, de
Neufville and Barrett (2018) :cite:`Baum2018` --- the times the system entered a crisis in which
nuclear use was genuinely on the table and, each time so far, stopped. Most people have never been
told how close the world has repeatedly come --- B-59 in 1962 (SIA-X7), Petrov in 1983 --- or what
those near-misses imply if the game keeps being played.
The paper's one job with this record is to count from it the rate at which such crises arrive. Which
incidents qualify, why, and under a rule fixed *before* counting is the part a sceptical reader should
attack first --- and it is set out incident by incident in the calibration appendix (SIA-6). Here it
is enough to say three things: the record is public, the dataset is someone else's, and the world has
a claims history long enough to price. ((( "To price" here means only to put an honest probability on
it, the way an insurer prices a life --- not to sell anyone a policy. )))
----
3. A RiskyMAD Model of Deep Uncertainty
==================================================
*The* general class of such models is old; *a* RiskyMAD model is the specific, deliberately small one
used here, with its parameters on the table.
RiskyMAD has three states. **Risky:** weapons exist, no exchange --- the world as it is.
**MAD crisis:** a crisis under Mutually Assured Destruction in which nuclear use is on the
table --- the 1962 Cuban Missile Crisis is the type case. **Dead:** accidental nuclear
winter. The world passes from Risky into a MAD crisis when one arises, and leaves that
crisis in one of two directions --- back to Risky (the crisis de-escalates) or on to Dead
(it does not). Dead is *absorbing*: there is no transition out of it. ((( "Absorbing" is the whole point of the model: it is a state you can enter but never
leave --- like checkmate. Every other state has an exit; this one has none. )))
.. admonition:: **"MAD crisis", never bare "MAD"** --- a naming rule this paper keeps throughout
:class: important
Two reasons, and both matter. **First,** *MAD* on its own is the **doctrine** ---
Mutually Assured Destruction --- which is permanent; the model's state is a *crisis
under* that doctrine, which is not. **Second,** a bare **MAD** standing beside **Dead**
is one glance away from being read as the state it leads to, and the whole forecast is
about the distance between those two: **Dead is what a MAD crisis produces when it is
over-reached.** Collapsing them in the reader's eye collapses the result.
So: **MAD crisis** (or **MAD crises**) for the state, everywhere. Where the doctrine
itself is meant, this paper writes *Mutually Assured Destruction* out in full. The
model's name **RiskyMAD**, the code identifiers (``rMADcrisisStarts``, ``rMADcrisisCalms``,
``rMADcrisisToWinter``) and the mathematical subscripts keep their established spelling.
Only three numbers are needed, and only one of them must come from the world:
- **The crisis rate** --- how often the world enters a nuclear crisis. Counted from the record
(SIA-6), it is about **one every ten years** (0.1 per year).
- **The escalation probability** --- the chance a crisis ends in exchange rather than back in safety.
Taken as **one in three**, from a structural argument bracketed by President Kennedy's own estimate
of the Cuban odds ("between one in three and even") on one side and Laplace's rule of succession on
the other (SIA-6). It is **not measured**, and the paper says so wherever it is used.
That is the entire model. It is small enough to solve exactly (SIA-1, SIA-4) and small enough to run
yourself.
.. figure:: /_file/pdf/hell/mm/b/16/fig/model-riskymad-3state-focus-iv_llol_qqv2r0p0_2026m07d24-fig.webp
:alt: The RiskyMAD model in one box --- Risky enters a MAD crisis at about 0.1 per year, the MAD crisis returns to Risky by simplifying, the MAD crisis reaches Dead by over-reach
:width: 100%
:align: center
**Figure 1:** The whole model, in a box. The world leaves **Risky** for a **MAD crisis** at the crisis rate
(``GoMAD``, about 0.1 per year), leaves the MAD crisis *back* to Risky when it is simplified, and leaves
it *forward* to **Dead** by over-reach. That is all of it. The model code behind this diagram is
short enough to read over coffee and to run yourself (SIA-1), and it is shown as an invitation:
disagree with a number, change it, and see what comes out --- or write a better model.
((( The title's "deep uncertainty" is not a hedge. It names the situation honestly: we cannot watch
the true state of the system directly, so we price what we cannot see, from the traces it leaves. )))
----
4. Numbers That Count
==================================================
Feed the record's rate into the model and it returns a distribution, not a point. These numbers are
the *basis for* the decision in the next section --- not the decision itself.
.. admonition:: How this paper states its numbers, and why it costs itself something to do so
:class: important
Every figure quoted in Sections 4 to 11 is stated as a **bound that under-claims**, not as a point
estimate. Where the exact value is one in thirty-four, the text says *worse than one in forty*; where
it is fifty-eight-fold, the text says *more than fifty-fold*. The rounding always runs **against** this
paper's own case, so that no claim in the ring can be defeated by a reader who recomputes it and finds
the true figure smaller than advertised --- it will be larger.
This is deliberate and it is borrowed. It is the rule a German commercial balance sheet has to obey:
value cautiously, recognise foreseeable losses as soon as they are foreseeable, and recognise gains
only once they are realised --- so that the reader of the accounts is never surprised in the
unfavourable direction (SIA-16). The **appendices do the opposite, and must**: they report exactly
what the model returns, to the digit, because they are the audit trail and a rounded audit trail is
no audit trail. So a reader comparing the two will find every appendix figure **more favourable to this
paper's case** than the ring's claim about it --- the danger a little larger, the remedy a little
easier to justify. That gap is the discipline, not an inconsistency.
At the observed rate, the **mean** time to onset is about **thirty years** and half of all runs of world
history are over within **about twenty** --- twenty-one on the exact arithmetic, and even on the most
sceptical published reading of the record, within about seventy. The chance that accidental nuclear winter *begins* in any given year is
**worse than one in forty**; over a forty-year career, **more than seventy percent**. Across the full
range the record can support --- from the most sceptical published reading to the most pessimistic ---
the annual chance is **never better than about one percent**, and at the pessimistic end worse than one
in fifteen. Forty simulated runs of world history agree with the exact arithmetic to within sampling
noise (SIA-2, SIA-5), and the exact values behind every bound above are in Table 3 (SIA-5).
.. figure:: /_file/pdf/hell/mm/b/16/fig/forecast-waiting-times-base-40runs-annotated-iv_llol_qqv2r0p0_2026m07d24-fig.webp
:alt: The expected case, annotated --- forty simulated waiting times against the probability of each of the three states over two centuries
:width: 90%
:align: center
**Figure 2:** One world, read closely --- the expected case, with every quantity labelled. Time runs
left to right in years from now. The **green** curve is the probability the world is still merely
**Risky**, falling as time passes; the **red** curve is the **MAD crisis**, a crisis in progress, which stays
near the floor because crises are rare and short; the **black** dots and grey curve are **Dead**.
Each dot is one simulated world history, placed at the year its own run arrived, and the grey line
is the cumulative probability the arithmetic expects --- the two agree. Read off the right-hand
panel: 5 percent of runs are over within **2 years**, half within **19**, 95 percent within **103**;
the fastest run took **0.37 years** and the slowest **127**. That is the whole method in one
picture. The next two figures do only two further things: change the crisis rate, and pool the runs.
*40-run stochastic simulation (distribution shape); exact values in Table 3 (SIA-5).*
.. figure:: /_file/pdf/hell/mm/b/16/fig/forecast-waiting-times-min-mid-max-scenarios-iv_llol_qqv2r0p0_2026m07d24-fig.webp
:alt: Three panels of simulated waiting times to accidental nuclear winter --- worst case 0.3 per year, expected case 0.1 per year, best case 0.03 per year
:width: 100%
:align: center
**Figure 3:** The same picture, in three worlds, worst first. **A.** the worst
credible crisis rate (0.3/yr): median about 6.4 years, slowest run 36. **B.** the expected rate
(0.1/yr): median about 19 years, slowest run 127. **C.** the best credible rate (0.03/yr): median
about 51 years, slowest run 329. Note the x-axes: 60, 200 and 600 years. **The argument holds
equally whether the waiting time is four days or three centuries** --- which is the point of showing
all three. *40-run stochastic simulation (distribution shape); exact values in Table 3 (SIA-5).*
.. figure:: /_file/pdf/hell/mm/b/16/fig/forecast-waiting-times-120run-histogram-iv_llol_qqv2r0p0_2026m07d24-fig.webp
:alt: Histogram of simulated nuclear-winter start times pooled across 120 runs
:width: 65%
:align: center
**Figure 4:** The same 120 runs pooled --- the shape of the forecast. Most runs end early; a thin
tail reaches three centuries. This is what a distribution with no way out looks like: not a
deadline, but a schedule of chances. *120-run stochastic simulation, 40 runs at each of 0.03, 0.10
and 0.30 per year (distribution shape); exact values in Table 3 (SIA-5).*
One comparison makes the scale legible. Discounted by the share of humanity a nuclear winter kills,
an individual's annual chance of dying from accidental nuclear winter is **more than fifty times**
the global road-death rate --- counted the same way, death for death, year for year, person for
person. ((( In plain terms: for most people alive today, this is a likelier way to die than a car
crash. ))) This inequality is the paper's one invariant claim. It holds in *every* scenario --- even
the most optimistic, which is the most sceptical published critic's own rate, where it still stands at
**more than fifteen times** the road-death baseline (SIA-9, SIA-10) --- and it survives, threefold, when the
most sceptical rate, the lowest published death toll, and the worst national road-death rate on record
are imposed all at once (SIA-9). No single figure here is offered as invariant. The inequality is.
And because Dead is absorbing, the distribution has a long tail but no way out. Even a single year is
not negligible: it is a revolver whose cylinder holds **fewer than forty** chambers and one round, held
to the head of civilization, and fired once a year, every year. The most optimistic scenario widens the
cylinder --- to fewer than a hundred and twenty. It does not unload the gun. ((( This is what "stochastic certainty"
means: not that it happens this year, but that, left unchanged, it happens --- the dice turn up the
six eventually. )))
----
5. Choice: Will We Survive Nothing?
==================================================
.. admonition:: Proposed wording for LLoL's approval --- the ring's centre (the decision call)
Section 5 is the latch of the whole ring; its voice is LLoL's to set. It is written here in
**secular terms**; the older sources that state the same choice with unusual clarity are set out,
for readers who want them, in SIA-14. Calm register --- surrender, not triumph; no self-nomination.
Everything before this section is the basis. What follows from it is not another number. It is a
choice --- and, stated in the right order, it is as old as the first community that had to decide
whether to keep watch or not. In modern terms: *am I my nuclear sibling's keeper?*
The clearest way to put it is to name the default first, because defaults are honest starting
points. Death is not only what happens if we choose wrongly; death is what happens if we choose
nothing at all. So the decision is between a death that arrives on its own and a life that has to be
chosen to evade it.
**0. Death by default.** The threat from accidental nuclear winter gets ignored by most people most
of the time --- as it mostly has been for decades.
Imagine a highway with billions of lanes, all running forward. Only one or two will take you to the
exit you actually want; the rest all lead to the same place. That is the shape of the choice --- almost
every lane is the broad road, and it takes deliberate effort to be in one of the few that is not.
The broad road runs on a single habit: blindly assuming blind leveraging. Cut the short-term corner,
assume without looking that it is safe, and cut the next one --- until the corners run out. It is the
self-organizing pattern that emerges when everyone stays in their lane and does nothing --- the fate of
every system, work, or project that keeps cutting the short-term corner, and, as the Matheo Study Series
shows, the pattern that ends in self-destruction. It asks nothing of anyone. To take it you need only do
*nothing* --- and it costs nothing today, which is exactly why it is the default.
But *nothing* is not the absence of a choice; it is a choice disguised as drift --- and a shifting one.
*Nothing* is never quite the same twice: it keeps changing shape, so that no one can quite name what was
neglected, and no one can be blamed. The blindness is in the assuming --- you keep taking the leverage
and never look up to see where it is carrying you. The wheel keeps spinning. The watch is left to no
one. The "not yet" becomes simply "now" --- and by the time you glance in the rear mirror and see the
exit you wanted, the road has already carried you past it. I have missed such an exit myself, and wrote
down what I saw in the mirror :doc:`Matheo-b19 `. Because no rule is broken and no one is keeping watch,
no one sees it happen. That is what makes blindly assuming blind leveraging the most dangerous force
there is: it ends the world while breaking none of its rules.
**1. Life by choice.** The narrow path --- one of the few lanes that actually reaches the exit ---
asks the opposite discipline: zoning, investigating, organizing, navigating. Instead of assuming, you
look: you map the ground, test what you find, put it in order, and steer by it. That deliberate work
builds the information landscape that lets you see the exit while there is still time to take it. It
is the self-correcting cycle this series calls for --- the one that cannot be reached by drifting,
only entered on purpose, at some cost, while the door is still open.
Stripped to its secular core, choosing it is choosing **the open, unending search for truth** ---
*Real Quests for Real Answers*: whoever goes on a real quest will find real answers, the continual and
fearless sifting and winnowing by which alone the truth can be found --- and choosing it *out loud, in
front of others,* because a search that no one will publicly stand behind never gets funded, staffed,
or believed. That public commitment is what turns a lone question into an institution: a
**ResearchCity**, where the search is done full-time and in the open. And because a search whose
fruits are hoarded in an ivory tower curdles back into the thing it replaced, the same choice carries
a second half --- a **Jubilee-based** cycle that returns those fruits, on a regular schedule, to
everyone. Truth sought openly, housed in a ResearchCity, and shared by a Jubilee: that is the whole of
"life by choice", and it is also what lets rival powers keep competing without having to destroy one
another. In the nuclear case its first concrete act is modest --- that a qualified human, not a
machine by default and not no one, be *tasked* to keep this particular watch, *gentle kind reasonable*,
for everyone. It costs more today. It is the only road with a tomorrow on it.
That is the entire decision, and it is binary because the arithmetic is binary: either an absorbing
state is reached, or the game is changed. There is no third road that quietly works out on its own.
((( "Will we survive *nothing*?" is meant literally. The thing most likely to end us is not a villain
but a vacancy --- the job no one is given, the risk that is, by definition, no one's. )))
.. admonition:: A personal statement (LLoL) --- one voice, binding no one else
Imposing on no one, the author names his own answer --- the only one he is entitled to name:
**I have made up my mind to keep calling for Jubilee-based solutions --- until the case is proven
wrong, or I die, or a Jubilee-based reset is organized.** If a better-worked path appears, I will
follow it, after I audit its math. Until then, this one is mine. The choice above stays entirely
yours.
.. note:: **Where the older sources come in (→ SIA-14).** Three of history's clearest statements of
exactly this gate-keeping choice --- and the reason "life by choice" turns out to be the same thing
as "keep searching for the truth, in the open, together, and share what you find" --- come from
Moses, Joshua, and Jesus. SIA-14 sets out the scriptures and maps each, line by line, to the secular
terms used here. It is offered as depth, not premise: nothing in this section depends on it.
----
6. A Solution for the 10 Nuclear Kings
==================================================
A forecast delivered without a course of action gets filed and forgotten, so this paper carries its
remedy. The current arrangement, Mutually Assured Destruction (MAD), has kept the peace for eighty
years, and the model does not deny it. What the model adds is one word: *metastable*. MAD is a ball
balanced on the rim of a bowl, not resting at its bottom --- stable against small shocks, certain to
fall given a large enough one. The arithmetic of Section 4 is the measure of how shallow the rim is.
The alternative this series derives is **Mutually Assured Progress (MAP)**: change the game so that
cooperation, not defection, is the rational move. A credible first-mover who acts at genuine,
irreversible cost turns a stand-off in which each side is right to keep its arsenal into one in which
each side is right to reduce, *provided* it can trust the others to. ((( The trick is not to ask anyone
to trust blindly. It is to make one move so costly and so public that it cannot be a bluff --- which is
what lets the next player move too. )))
**This is not hypothetical: the move has been made twice, and both times it worked.** The first was
B-59 in October 1962 --- the decision Section 1 opens with, told in full in SIA-X7. On the only source
there was no vote and no lone refusal: a captain who had ordered the nuclear torpedo readied consulted
Vasili Arkhipov and the political officer and surfaced instead --- into the enemy's searchlights,
unable to dive, at real cost, with no way of knowing he was right. In the late 1980s Mikhail
Gorbachev made exactly this kind of concession: visible, costly, checkable, and made first. **Each won
a world war by making it never happen --- and neither is commemorated for it.** Both were Russians; and
the Russian tradition even has a word for one who acts rightly while the world calls it folly --- the
*yurodivy*, the holy fool who says what power does not want to hear. At a moment when much of the world
sees only a threat from that direction, the debt is worth naming plainly: the only two moves that have
ever defused this danger were made from that side. This paper asks for a third.
.. note:: **On the Arkhipov account, and why the argument does not stand on it.** The dramatic version
of the B-59 story is contested; the objection --- Tertrais (2017) :cite:`Tertrais2017` --- is set
out where the story is told in full, in SIA-X7, and is not repeated here. For this section the point is
narrower: the MAP first-mover claim rests at least as much on Gorbachev, whose concessions are
uncontested, and no number anywhere in the paper moves if the Arkhipov account is read at its most
sceptical.
The sovereigns who would have to permit the escape are addressed here as the **ten Nuclear Kings** --- a
deliberately ironic title, since ten cannot all be sovereign over one shared fate. ((( "King" here just
means the holder of an unappealable decision. The ten are nine that hold weapons --- the United States,
Russia, China, North Korea, India, Pakistan, Israel, France, the United Kingdom --- and one, Iran,
whose intent to join is declared. The word "Nuclear" is never dropped. ))) A thousand years ago King
Cnut had his throne carried to the sea and commanded the tide to halt --- and the story is almost
always told backwards. He staged it *on purpose, in front of his courtiers, so that they could watch
him fail*, because they had been flattering him that all things obeyed him. The tide here is the table
in Section 4. It does not negotiate, grants no exception for arsenal size, and holds no opinion about
anyone's sovereignty. Bowing to it early, in front of witnesses, is not defeat; it is the one move a
king can make and still be remembered as wise.
Concretely, the ask is a window --- an **Earth in Escrow**: a seven-to-fourteen-year peace in which the
escape is actually built, while the arithmetic is checked by the people who hold the classified data
that could settle it. The escape is a **ResearchCity**: an institution to do, full-time and in the
open, the work of catching the thousand quiet ways a system fires by accident --- work that no single
discipline, and no lone hero, can hold. It is meant as a "Ministry of Nothing": it takes on the threats
that are nobody's job so far --- such as estimating how long we can expect to wait until an accidental
nuclear war --- works in the gaps between existing institutions, and hands what it finds to whoever is
best placed to act. Before its seven scale-up stages comes a Stage 0, the preparation: one person's
model, checked by a small team and then by a pilot group of about 150 reviewers, while the world
decides whether to give ResearchCity a mandate (:ref:`ResearchCity: How to get there
`). It is one proposal; the forecast stands without it. And, following the oldest template for a warning of this shape,
the paper does not nominate who should run it. Reading Pharaoh's dream of coming famine, Joseph did not
say *make me the man*; he said *find a discerning one and set him over the land* (SIA-14). The
recommendation to the conveners is exactly that: **find someone.** What the window costs is priced in
Section 9; the full mechanism, the game-theory, and the companion results are in SIA-13.
.. figure:: /_file/pdf/hell/mm/b/16/fig/model-mad-to-map-5state-escape-jubilee-iv_llol_qqv2r0p0_2026m07d24-fig.webp
:alt: The escape route drawn on the model --- Risky to MADI to MAP, beside the Risky to MAD crisis to Dead path
:width: 55%
:align: center
**Figure 5:** The escape drawn on the same model. Downward from **Risky** runs the path the
forecast prices: into a **MAD crisis**, and by over-reach into **Dead**. Upward runs the alternative:
**MADI**, a decision to be led by real quests for real answers in reality --- reachable, on this
sketch, in about forty-two days plus however long it takes to decide (the best case of
ResearchCity's Stage 0, whose last step is that global decision) --- and from there, in two
staged halves (scale up a ResearchCity, then run the Great Jubilee Race), to **MAP** and a
Jubilee-based balance. The stage labels carry question marks because they are estimates, not
promises: about five years to the first half; the whole escape takes seven to fourteen years,
nine to eleven expected (Section 9, Table 8). The upward path has rate zero today because nothing
has been built (SIA-1, SIA-13). **#AuditTheMath**
----
7. Why Quiet Years Fool Us
==================================================
The obvious objection: if the risk is this high, why have eighty-one years passed without a nuclear
war? The model's answer is that eighty-one quiet years are exactly what it predicts *most of the time*
--- and are therefore weak evidence about the rate, not reassurance about it.
The reason is the shape of the process. Onset takes two steps --- first a crisis must arise, then it
must fail to stop --- and a two-step process of this kind *saturates*: it behaves like a mechanism that
can only work so fast, and that sits idle far more often than not. ((( This is the same maths
biochemists use for enzymes, the Michaelis--Menten law: a catalyst spends most of its time waiting and
only occasionally acts. Here the world spends about ninety-nine percent of its time merely "Risky" and
about one percent in the lethal state. ))) A system that is dangerous one percent of the time produces
long calm stretches as a matter of course --- and then ends one. That is why the intuition "nothing has
happened, so it cannot be that bad" is so durable and so unreliable, and why the same model that gives
a median wait of twenty-one years also lets an occasional lucky run pass a century. SIA-7 explains why
this mechanism is the right one; SIA-8 gives its numbers.
----
8. Why "Later" Isn't an Option
==================================================
The most comfortable assumption in nuclear policy is that this can be handled later. Three things make
delay not a neutral choice but a losing one.
**There is no safe waiting period.** Because the Dead state is reached with probability one given
enough time, no run of quiet years lowers next year's odds; every year, the wheel is spun again.
**There is no stable middle.** A system that is not actively correcting itself drifts, by default,
toward its failure mode --- and the drift is invisible from the inside, because the appearance of
stability ("deterrence is working") is the very thing that stops anyone from checking. Apparent calm is
not evidence of safety; it is the symptom most easily mistaken for it.
**The "we'll learn as we go" hope reverses its own burden.** Each near-miss has indeed taught a lesson
--- the hotline after Cuba, better warning after Able Archer. But to *solve* the problem, learning
would have to drive the crisis rate to exactly zero, which no one claims; and the assurance that
deterrence is safely managed comes, overwhelmingly, from the institutions whose reason for existing is
to manage it. That is not an accusation --- it is a statement about incentives, and it applies to this
paper's author with equal force.
((( These four traits together --- time running out, no central authority able to act, the people who
cause the problem also offering the cure, and a future discounted so steeply that "later" always wins
--- are the textbook definition of a *super-wicked problem.* Nuclear risk is a member of that named
class, which is why its ordinary machinery of correction does not engage. )))
----
9. Cost of the Escape-Hatch
==================================================
A plan that names a timeline can be priced by the same model that produced the problem, and it should
be. The whole escape --- scaling the ResearchCity up through its seven stages (about five years), a
switch from inward to outward, then about as long again helping everyone else make the transition ---
is estimated at **nine to eleven years**, counted from the end of Stage 0. It has hard limits at both
ends: no less than **seven** years, because each stage has to reach functional completion, and no more
than **fourteen**. The model says what such a window costs.
.. list-table:: Table 8. Probability that onset comes *before* the escape is built
:header-rows: 1
:widths: 34 22 22 22
* - Window
- optimistic
- **base**
- pessimistic
* - 7 years
- 6.6%
- **20.4%**
- 49.0%
* - 9 years (mid case)
- 8.5%
- **25.5%**
- 58.1%
* - 11 years
- 10.3%
- **30.3%**
- 65.5%
**This is the honest price, and it is not reassuring.** At the base rate a nine-year plan carries
**no better than a one-in-four chance of not finishing in time.** That is not a reason to reject it; it is the
figure any alternative must beat --- and the alternative, doing nothing, costs **seventy-three percent**
over a career (Section 4), with no escape at the end of it. ((( A treaty alone will not do it: nothing
in a treaty sets the crisis rate to zero. What the escrow window buys is only the time to build the
escape --- but that time is the whole game. ))) The staging and its softest assumptions are in SIA-13.
**Now the question that does not depend on any of it.** Everything above rests on a hazard rate that
nobody outside this paper has yet checked, and a reader who doubts it has, so far, no way through. So
here is a second calculation built not to need it --- because it asks the question backwards. Not *how
big is the danger*, which is the part in dispute, but: **how small may the prospect of success be
before paying for the attempt is still worth it?** The first question can only be settled by people
with better data. The second can be settled at a desk, by anyone, in about a minute.
**Four quantities, each per person and per year, and each open to attack.** :math:`K` is **what it
costs** --- the ResearchCity at roughly **eight dollars a person a year** (SIA-13). :math:`r` is **the annual risk**, from Section 4: 0.029 at the base rate. :math:`E` is
**what is at stake** for one person if it happens. :math:`p` is **the chance the spending works** ---
the unknown, and the thing to solve for. Paying is worth it once the expected benefit clears the cost,
:math:`p\,r\,E > K`, which rearranges to a threshold:
.. math::
\boxed{\;\; p \;>\; \frac{K}{r \cdot E} \;\;}
((( The units are the fastest check there is. :math:`p` is a bare number, :math:`r` counts per year,
:math:`E` is in dollars --- so both sides read dollars per person per year, and a reader who tests
nothing else should test that. )))
Three things about this inequality run *against* the case it is used to make, and are stated before
the numbers rather than after. The benefit is counted for **one year only**, though an escape that
works keeps working and the whole future after it is credited at zero. The cost is counted **every**
year, though a threat retired stays retired. And the calculation says whether a given outlay is worth
making --- **not** what outlay would be best, which would require knowing how the prospect of success
grows with spending, and nobody knows that.
:math:`E` **is a value judgement, not a measurement.** What an averted nuclear winter is worth to one
person is where the reader's own values enter, and no arithmetic can settle it. So the paper reports a
band and hands over the dial rather than pretending to a figure it could defend.
**Why the band spans two orders of magnitude, and why that is not vagueness.** What a life is valued
at differs enormously between countries --- a wealthy state's regulator and a poor one's health ministry
work with figures that can lie a hundredfold apart, and any single number would invite the objection
that it is somebody else's. The band is set wide **on purpose**, to span that international spread, so
that the conclusion cannot be defeated by disagreeing about whose valuation to use: it holds at every
point in it. ((( This works here for a reason particular to the hazard. Nuclear winter is global and no
one can be excluded from it, so a single figure per person is meaningful in a way it would not be for a
local risk --- **everyone is in the same boat**, and the arithmetic assumes exactly that and nothing
more. )))
**What the stake** :math:`E` **is measured against, since the convention matters.** :math:`r` is the chance that
onset *begins*, so :math:`E` is the value of averting the whole event to one person --- and it therefore
already carries the fact that a given person may live through it. Setting :math:`E` at one regulatory
life-value is not the same as assuming one death: it prices a person's own mortality risk at roughly a
third of that figure, which is the death fraction this paper takes from the nuclear-winter literature
(SIA-9), and everything else --- the survivors, their descendants, and the conditions both depend on
--- at the remainder. A reader who thinks that remainder too small should raise :math:`E`, which lowers
the threshold.
.. list-table:: Table 10. How small the prospect of success may be and still be worth paying for
:header-rows: 1
:widths: 40 30 30
* - What one person's stake :math:`E` is set to
- at the base rate, the required chance is **no more than**
- and if the danger is overstated **a hundredfold**, no more than
* - **min** --- $90,000, a deliberately harsh floor: a hundredth of the ceiling below
- **1 in 300**
- **35 percent**
* - **mid** --- $900,000, a tenth of the ceiling below
- **1 in 3,000**
- **3.5 percent**
* - **max** --- $9,000,000, just under the US Department of Transportation's own guidance value of
$9.1 million in 2012 dollars :cite:`USDOT2021VSL`
- **1 in 30,000**
- **0.35 percent**
((( Every entry is a **ceiling**, rounded against this paper: the exact values are 1 in 326, 3,263 and
32,628, and 30.6, 3.1 and 0.31 percent (SIA-15). A reader who redoes the arithmetic will find the
requirement *easier* to meet than the table promises, never harder. Note that the ceiling itself rounds
*down* from the regulator's $9.1 million rather than up, so that **no rounding anywhere in this table
runs in this paper's favour.** )))
.. container:: fineprint
**Two notes a careful reader will want, because this table's arithmetic does not round the way the
rest of the paper does.** First, it uses the **exact** base hazard, 0.029, and not Section 4's
under-claiming floor of one in forty. That is deliberate and it is the same rule applied, not an
exception to it: here the direction reverses, because a *smaller* hazard makes the required prospect
of success *larger*, so under-claiming the danger would over-claim the ease. Using the floor would
have pushed the right-hand column past its own ceilings --- 35.6 percent against a stated 35, and so
on down the column --- which is precisely the kind of quiet convenience the rule exists to prevent, so
it is reported rather than adopted. Second, **the most sceptical published reading of the record is
only about three times below the base rate**, so its thresholds fall between the two columns and much
nearer the left: about one in ten thousand, one in a thousand, and one in a hundred across the three
stakes. The right-hand column discounts thirty times further than the most sceptical reading anyone
has published.
**The robustness is the point, and so is where it stops.** Take the danger to be overstated by a factor
of a hundred --- a median wait not of twenty years but of two thousand, far beyond anything the record
can bear --- and at a mid-range stake the required prospect of success is still **no more than three
and a half percent**. A reader does not have to accept Section 4 to reach Section 11; being wrong about the hazard
by two orders of magnitude does not reverse the answer. **But it does not hold at every corner, and the
corner is named here rather than left to be found:** insist on the harsh stake *and* the hundredfold
discount together, and the requirement rises to **as much as thirty-five percent**, which is a real
hurdle rather than a low one. The conclusion survives that corner; the word "effortless" does not. ((( Which is the ordinary shape of
a robustness claim, honestly stated: it holds across a wide range and it has an edge, and a reader is
owed the edge. )))
**And the prospect of success is a chain, not a hunch.** :math:`p` is not one guess but a product of
links --- the money arrives, the check actually happens, it is competent, it is right, and somebody acts
on what it finds. Four links at only one chance in five each still give **better than one in six hundred and fifty**,
which clears the mid-range ceiling nearly five times over. That is a harder thing to dismiss than a single
optimistic number, because each link can be argued about separately.
**Caution makes this easier to justify, not harder --- and that result is parameter-free.** The table
above prices the loss at its plain money value, which is not how anybody responsible for a catastrophe
reasons: a loss that takes everything weighs more than its arithmetic sum, because there is no
replacement and no second attempt. Scoring the outcome with **any** risk-averse valuation *lowers* the
threshold. Not for some parameter choices --- for every concave valuation there is, with the plain-money
case as the exact boundary. **The threshold in Table 10 is therefore a ceiling, not an estimate.** The
proof, the standard closed form, and a worked cross-check are in **SIA-15**; the calculation's known
limits are in **SIA-16**.
**A last note on what is actually being asked for.** Table 10 prices the *programme*. What Section 11
asks for is the far smaller thing: that somebody competent spend a few weeks checking whether the hazard
rate is right. That decision is not the same one, and it is strictly easier --- because its payoff
arrives **whichever way it comes out.** A careful public demonstration that this paper is wrong would
retire an urgent claim and redirect the effort it is consuming, which is a real gain that the arithmetic
above counts as zero (SIA-16). ((( Which is why the request in Section 11 is not "agree with me". It is
"find out" --- and finding out that the number is wrong is the better of the two outcomes. )))
----
10. There Are No Alternatives
==================================================
Set the two roads side by side one last time, because the choice is usually mis-stated as *safe status
quo* versus *risky change.* It is not. The status quo is not safe: it is a stochastic certainty of
death, on a schedule the model has now drawn. The transition is not certain: it is a finite, priced
risk followed by a way out. **A finite risk that ends is not the same kind of thing as an unbounded one
that does not** --- and no amount of discomfort with the transition changes which of the two the
arithmetic prefers. There is no third road, and not because this paper forbids one: an absorbing state
admits exactly two futures --- it is reached, or the game is changed before it is.
**Ruin, not risk.** The distinction the arithmetic is leaning on has a name: repeated exposure to any
positive per-period chance of an *absorbing* loss is a ruin problem rather than a risk problem, and
precaution under exposure of that shape is a standard result rather than a special plea for this case
:cite:`TalebEtAl2014`.
**The disagreement does not reach the decision.** The most sceptical published reading of the
record (Tertrais, 2017 :cite:`Tertrais2017`) and the most alarmed (SIA-X2) are separated by about a
factor of ten in the crisis rate. That gap is real, and this paper does not pretend to close it. The
arithmetic shows it need not be closed: across the whole interval the record can bear --- from
Tertrais's corner to the pessimistic one --- the decision is the same, because the car-crash
inequality holds at every point (SIA-9) and the state stays absorbing at every point (SIA-4). To
overturn the conclusion, an optimist cannot argue that the rate is *low*: a low rate, spun once a
year without end, still reaches the absorbing state with probability one. The optimist would have to
argue that the rate is *exactly zero* --- and no one does. Tertrais himself grants that "even
'virtually impossible' does not mean zero." A positive number, however small, together with an
absorbing state, is the whole of the argument; the size of the number sets the schedule, not the
outcome.
----
11. Call to Action
==================================================
Experts and officials move when there is public interest and --- on the evidence of a year of letters
that reached no one empowered to act --- not much before. There is, at present, **no channel**: no
procedure by which an existential-risk analysis reaches a desk that can act on it, and the procedures
that do exist are built to discard exactly this kind of message (SIA-13). That is not a complaint; it is
the reason the smallest action is the operative one, and why the call begins with everyone.
**Step 0 --- for everyone, and it is not "check the maths first".** The maths is a professional
afternoon's work for those equipped for it and an unfair burden for everyone else, so gating support on
it would be absurd. The real question at Step 0 is a decision about trust: *do you want this reviewed?*
Would you rather keep trusting an arrangement in which what gets measured is decided by who pays --- the
reason a number this simple went uncomputed for eighty years --- or back people trying to do it in the
open instead? If the latter, say so out loud: **make some gentle, kind, reasonable, but unmistakable
noise.** It is, in the end, a wager on the unthinkable in insurance: nuclear war was ruled
*uninsurable* because no one survives to pay a claim, so the only "policy" that can exist is to buy the
risk *down*, by prevention --- which is what a ResearchCity is for.
**And the arithmetic makes that decision smaller than it looks.** Nobody is asked to believe the
forecast. Section 9 puts the question the other way round --- how small may the prospect of success be
before paying for the attempt is still worth it --- and even with the danger itself discounted a
hundredfold, the answer at a mid-range valuation of what is at stake is no more than three and a half
percent.
**The request therefore hangs on the weak number rather than the strong one:** it is
enough to hold that the escape route is *not ruled out.* ((( Which is also the honest limit of what
this author can ask for. He is not in a position to check his own work --- years spent on something
produce confidence about a person, not about the world, and the two can lie far apart (SIA-16). )))
- **Step 1 --- experts:** audit the maths and publish what you find. A refutation that retires a bad
claim early is worth more than any number of agreements; every input is public and the method repeats
in an afternoon.
- **Step 2 --- those who can convene** (the United Nations, Pope Leo XIV, and the ten themselves): put
the waiting-time question on a table, and *find someone* to steward the escape. Under the game of
Section 6, the first to move credibly, at cost, does not merely start a conversation --- that move is
the mechanism that shifts everyone else's incentive.
- **Step 3 --- everyone who can:** help fund making the review transparent, and the ResearchCity, at roughly two cents a
day --- capped so no one can buy it, and half given away so no one can corner it.
**The two requests, plainly.** To whoever can convene: convene, and let the people with the classified
data say whether the arithmetic is wrong --- *if it is, that is the best available outcome.* To
everyone else: check what you can, pass it on, and say what you find. **Don't believe it ---
#AuditTheMath.** If the model is wrong, the fastest way to learn it is for someone to say so --- and
that is a better outcome than being right.
----
Supporting Information Appendices
==================================================
The SIAs hold all rigour and depth; the ring only states and points. SIA-1--14 follow the restructuring
proposal; **SIA-15 and SIA-16** were added afterwards and carry the decision arithmetic behind Section 9
--- the break-even threshold and the risk-aversion result (15), and everything that calculation does not
establish (16). The **X-series** (SIA-X1--X7) holds the standalone appendices: provenance and method (X1),
the rising crisis rate (X2), the field report on delivery (X3), the eighty-one anniversaries (X4), and
why numbers like this go unmeasured (X5) --- all five carried over in the OOv2 |rarr| OOv3 port --- plus
the draft-status and change record (X6) and the full B-59 account behind the paragraph Section 1 opens
with, together with what is contested in it (X7). The appendix numbering will be consolidated in a
single end-pass; the ``X`` prefix keeps the others stable meanwhile.
SIA-1 --- The model itself
----------------------------------------------------------------------------
RiskyMAD is a three-state continuous-time Markov chain, small enough to state in full and to solve
exactly (SIA-4).
- **Risky** --- the current state: nuclear weapons exist and are deployed, but no exchange has
occurred. The state is *metastable* --- it appears stable yet carries a non-zero probability per unit
time of leaving.
- **MAD crisis** --- a crisis in which nuclear exchange becomes imminent. The state is transient: it either
escalates to Dead or de-escalates back to Risky. Mean crisis duration in the model is
:math:`1/r_{M \rightarrow \text{out}} \approx 40` days, consistent with historical crises (the Cuban Missile Crisis lasted
thirteen).
- **Dead** --- accidental nuclear winter has begun. The state is *absorbing*: once entered, it cannot
be left. It is named for the irreversible collapse of the civilization that produced the weapons,
not because every human dies; limited exchanges that do not trigger a global winter are not modelled
as "Dead" but as milestones toward normalizing one.
Four transitions connect them:
- **Risky |rarr| MAD crisis** (``rMADcrisisStarts`` :math:`= r_{R \rightarrow M} = 0.10`/yr) --- a crisis brings the system to
the nuclear brink.
- **MAD crisis |rarr| Risky** (``rMADcrisisCalms`` :math:`= r_{M \rightarrow R} = 6`/yr) --- the crisis de-escalates without
exchange.
- **MAD crisis |rarr| Dead** (``rMADcrisisToWinter`` :math:`= r_{M \rightarrow D} = 3`/yr) --- the crisis escalates to exchange and
accidental nuclear winter.
- **Risky |rarr| LifeMAP** (``rRiskyEscape`` :math:`= 0`) --- the escape to Mutually Assured Progress.
Its rate is zero in the base model because no escape mechanism is currently active (Section 9,
SIA-13).
The per-crisis death probability is the derived ratio
:math:`p_{M \rightarrow D} = r_{M \rightarrow D}/r_{M \rightarrow \text{out}} = 3/9 = 1/3`; its structural justification and the calibration of the
crisis rate are in SIA-6.
.. figure:: /_file/pdf/hell/mm/b/16/fig/model-riskymad-3state-focus-iv_llol_qqv2r0p0_2026m07d24-fig.webp
:alt: RiskyMAD model overview --- three states (Risky, MAD crisis, Dead) with the three active transitions
:width: 100%
:align: center
**Figure 6:** The three states and the three *active* transitions, repeated here from Section 3
beside the code they correspond to. The fourth transition, Risky |rarr| LifeMAP, is not drawn
because its rate is zero: nothing has been built. Drawn in, it is Figure 5 (Section 6); as code, it
is Figure 9 (SIA-13).
**The complete model code**, as published on the
:doc:`SD1 poster `, implemented in the Evolvix
prototype compiler (MMv0r3p1-RC1) and run as an exact stochastic simulation by the Gillespie (1977)
algorithm:
.. code-block:: text
Evolvix Quest RiskyMADdead
(Question: "How many years until humanity self-destructs
in a nuclear roulette accident?")
Simulate stochastically until 200 :["years"]
Initial Amount of Risky = 1
Initial Amount of MAD = 0
Initial Amount of Dead = 0
Initial Amount of rMADcrisisStarts = 0.10
Initial Amount of rMADcrisisCalms = 6
Initial Amount of rMADcrisisToWinter = 3
Action 1 ( Risky ---[ Rate = 0.10 ]---> MAD )
Action 2 ( MAD ---[ Rate = 6 ]---> Risky )
Action 3 ( MAD ---[ Rate = 3 ]---> Dead )
Action 4 ( Risky ---[ Rate = 0 ]---> LifeMAP )
This is the entire model. Implementing a Gillespie-dynamics continuous-time Markov chain in a general
framework takes hundreds of lines; in Evolvix it fits on a poster, and anyone who can read the code can
check the math. The compiler is available for download at
:doc:`/good-news-pack/vv/mmv3/supporting-doc/evx-compiler/index`.
**Notation (BEST Names).** Every quantity carries a *Brief* symbol for equations, an *Explicit*
name as it appears in model code, a *Summarizing* phrase for prose, and a *Technical* column tying it
to the cross-paper and enzymology identities (SIA-7). The convention is developed for semantic
reproducibility across code-to-brain interfaces :cite:`Loewe2016BestNames`; a reader who never looks
at an equation loses nothing by staying in the Summarizing column.
**Reading the Brief symbols.** They are built from the three state names, so nothing has to be
memorised: **R** = Risky (now) |rarr| **M** = MAD crisis |rarr| **D** = Dead (winter has begun).
Then :math:`r` is a rate per year, :math:`p` a probability, :math:`T` a time in years, :math:`n` a
count and :math:`q` a fraction --- and the subscript says *between which states*, so
:math:`r_{R \rightarrow M}` is "the rate of going from Risky to a MAD crisis". Two quantities are named in
words rather than arrows (:math:`r_{\text{onset}}`, :math:`r_{\text{relax}}`) because they are not
transitions: they come *out* of solving the model rather than going into it. The scheme was adopted
on 2026m09d08; the last column below gives the symbol used in drafts before that date. Table 0 lists
the ten quantities the body uses, and agrees with SIA-1 name for name. The **exhaustive**
treatment is in **SIA-1**: :ref:`Table B `
indexes all twenty-six on one page, :ref:`the glossary `
gives the full entry for each, :ref:`Table B-old `
maps every pre-2026m09d08 symbol, and
:ref:`Table B-MM ` reads the same
quantities as enzyme kinetics.
.. list-table:: Table 0. BEST Names for the quantities this paper uses
:class: longtable
:header-rows: 1
:widths: 15 17 22 32 14
* - **B**\ rief
- **E**\ xplicit (model code)
- **S**\ ummarizing (used in prose)
- **T**\ echnical --- synonyms and cross-paper identities
- before
2026m09d08
* - :math:`r_{R \rightarrow M}`
- ``rMADcrisisStarts``
- **the crisis rate**
- How often the world enters a nuclear crisis, per year. Hellman's
:math:`\lambda_{IE}` (initiating-event rate) is the nearest published relative;
his :math:`\lambda_{CMTC}` is *not* this quantity --- it is his end-to-end failure
rate, comparable instead to this paper's **onset hazard** below (SIA-10).
Michaelis--Menten substrate :math:`S` (SIA-7).
- :math:`\lambda`
* - :math:`r_{M \rightarrow R}`
- ``rMADcrisisCalms``
- **the de-escalation rate**
- How fast a crisis resolves *back to safety*, per year. Two of the three OSCR modes
(SIA-6).
- :math:`b`
* - :math:`r_{M \rightarrow D}`
- ``rMADcrisisToWinter``
- **the kill escalation rate**
- How fast a crisis resolves *into nuclear exchange*, per year. One of the three OSCR
modes. Michaelis--Menten :math:`V_{max}` --- **you cannot die faster than this.**
- :math:`c`
* - :math:`p_{M \rightarrow D}`
- ``pMADcrisisToWinter``
- **the per-crisis chance of nuclear winter**
- The fraction of crises that go all the way. Michaelis--Menten commitment to
catalysis; specificity constant :math:`k_{cat}/K_m`. Kennedy's Cuban estimate
(SIA-6) is a reading of this quantity, not of the crisis rate. **Not separately
identified from the crisis rate** --- see Matheo-b16-extra, section 14.1.
- :math:`p_{death}`
* - :math:`T_{R \rightarrow D}`
- ``tUntilWinter``
- **the waiting time**
- Expected years from now until onset. First-passage mean to absorption from state
Risky. **Not** a half-life and **not** a deadline (SIA-X2).
- :math:`T_R`
* - :math:`q_{\text{dead}}`
- ``qHumansDead``
- **the death fraction**
- Share of humanity that dies once nuclear winter begins. Not produced by this model;
taken from the nuclear-winter literature (SIA-9).
- :math:`q`
* - :math:`r_{\text{onset}}`
- ``rWinterSettled``
- **the onset rate**
- The slow rate at which the whole system reaches Dead, per year. This is the number
comparable to Hellman's "1 percent per year" and to Tertrais's implied rate ---
**not** the crisis rate (SIA-4).
- :math:`r_1`
* - :math:`r_{\text{relax}}`
- ``rRiskWarmsUp``
- **the relaxation rate**
- The fast root of the same quadratic --- **not** a disaster rate, and not the crisis
clock either. It is the speed at which the hazard settles to the onset hazard, and
it exceeds :math:`r_{M \rightarrow \text{out}}` strictly whenever
:math:`r_{M \rightarrow R} > 0` (Matheo-b16-extra, section 7.3).
- :math:`r_2`
* - :math:`r_{M \rightarrow \text{out}}`
- ``rMADcrisisEnds``
- **the crisis clock**
- :math:`= r_{M \rightarrow R} + r_{M \rightarrow D}`, the total rate of leaving a MAD crisis by
either arrow; its reciprocal is the mean crisis duration, |approx| 40 days.
Michaelis--Menten :math:`K_m`.
- :math:`b+c`
* - :math:`T_{M \rightarrow D}`
- ``tUntilWinterFromCrisis``
- **the waiting time from inside a crisis**
- First-passage mean to absorption from a MAD crisis, counting every later crisis if this one
de-escalates. A bookkeeping quantity of the derivation (SIA-4).
- :math:`T_M`
.. _b16-the-riskymad-model-and-what-it-assumes:
The RiskyMAD model and what it assumes
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.. _b16-three-potential-states-our-risky-world-can-be-in:
Three potential states our Risky world can be in
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
- **Risky** --- weapons exist and are deployed; no exchange has occurred. This is where
the world is now. It looks stable and is not: it carries a small probability per unit
time of being left.
- **MAD crisis** --- a crisis under Mutually Assured Destruction in which **death by
accidental nuclear winter is merely one push of a button away**, and the chance that
someone pushes it is :math:`p_{M \rightarrow D}` = **1/3** for the purposes of this
paper. The 1962 Cuban Missile Crisis is the type case. Temporary: it resolves one way
or the other, on average within about 40 days.
Two cautions. First, **"MAD crisis", never bare "MAD"** --- for two reasons rather than
one. MAD alone keeps its usual meaning of *Mutually Assured Destruction*, the doctrine,
which is permanent, while the model's state is a *crisis under* that doctrine, which is
not. And a bare **MAD** set beside **Dead** is one glance away from being read as the
state it leads to, when the entire forecast is about the distance between them:
**Dead is what a MAD crisis produces when it is over-reached.** This paper therefore
writes "MAD crisis" (or "MAD crises") for the state everywhere, spells the doctrine out
in full where the doctrine is meant, and leaves the model name **RiskyMAD**, the code
identifiers and the mathematical subscripts at their established spelling. Second,
**the 1/3 and the crisis rate are one calibration, not two.** Fixing the chance at 1/3 is precisely what defines which historical
near-disasters count as MAD crises at all, and so what ``rMADcrisisStarts`` is counting.
They trade off exactly, and :ref:`b16-the-crisis-rate-and-the-escalation-probability-are` **is the one place that works this out** ---
every later passage that might tempt a reader to vary one while holding the other
fixed points back to it.
- **Dead** --- accidental nuclear winter has begun. **Absorbing**: once entered, never
left. The name refers to the irreversible collapse of the civilization that built the
weapons, not to the death of every human. **The model deliberately does not resolve
what happens below that line:** total extinction, and a scattered remnant restarting
from something close to a pre-agricultural baseline, are both simply *Dead*. Nothing
in the forecast depends on telling them apart (:ref:`b16-what-the-death-fraction-counts-and-what-happens-after`).
.. _b16-three-arrows-for-transition-rates-between-states-of:
Three arrows for transition rates between states of the world
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.. list-table::
:header-rows: 1
:widths: 26 16 58
* - Transition
- Rate
- In words
* - Risky |rarr| MAD crisis
- :math:`r_{R \rightarrow M}`
- the world walks into a MAD crisis
* - MAD crisis |rarr| Risky
- :math:`r_{M \rightarrow R}`
- the MAD crisis de-escalates, and the world walks back out
* - MAD crisis |rarr| Dead
- :math:`r_{M \rightarrow D}`
- the MAD crisis escalates to exchange, and winter follows
A fourth arrow, Risky |rarr| LifeMAP (the escape to Mutually Assured Progress), carries
rate zero throughout this document, because nothing that would give it a positive rate
has been built. Everything below is therefore a forecast of what happens **if nothing
changes**, which is exactly what a forecast is for.
Base-case values, calibrated in b16 SIA-6 and taken as given here:
:math:`r_{R \rightarrow M} = 0.10`/yr, :math:`r_{M \rightarrow R} = 6`/yr, :math:`r_{M \rightarrow D} = 3`/yr.
.. _b16-the-assumption-ledger-for-the-riskymad-model:
The assumption ledger for the RiskyMAD model
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Stated once, in full, so that no assumption has to be discovered later by a reader who
feels ambushed.
.. list-table:: Table A. What is assumed, what it buys, what it costs
:class: longtable
:header-rows: 1
:widths: 22 34 44
* - Assumption
- What it buys
- What it costs, and where that is repaid
* - **A1.** Time runs continuously; the world is in exactly one of the three states
at each instant.
- A model with three numbers instead of a history with infinitely many.
- Coarseness. A limited exchange that does not trigger a global winter is not
"Dead" here; b16 treats such an event as a milestone toward normalising conditions
that will eventually lead to accidental nuclear winter.
* - **A2.** Each arrow fires at a constant rate --- the chance of firing in the next
instant does not depend on how long the world has already been in that state
(*memorylessness*).
- The entire closed-form solution.
- The strongest assumption in the model. **Repaid in**
:ref:`b16x-distribution-free`: the mean waiting time does **not** need it. Only
the shape of the distribution does, and therefore only the short-horizon
figures.
* - **A3.** The rates do not change over time.
- A single answer instead of a scenario family.
- Almost certainly false, and b16 SIA-X2 argues :math:`r_{R \rightarrow M}` is rising. This
makes the forecast *conservative* in the direction that matters:
:ref:`b16x-certainty` shows onset stays certain when the rates vary, and rising
:math:`r_{R \rightarrow M}` shortens the wait. Also, that is why this analysis is incomplete
with its respective min-max simulations for the most pessimistic-optimistic case.
* - **A4.** Crises are independent of one another.
- Simple counting of repeat attempts.
- If crises cluster, the variance grows. The mean is untouched
(:ref:`b16x-distribution-free`).
* - **A5.** The three rates are correct.
- The specific numbers.
- **This is the real exposure, and no derivation can reduce it.** See
:ref:`b16x-not-established`. Any single number will almost certainly be wrong,
however, the likelihood that all numbers in the min-max intervall are also wrong
is substantially smaller (and arguably near 0 if the intervall is well-chosen)
.. _b16-best-names-what-every-symbol-is-called-and-why:
BEST Names --- what every symbol is called, and why
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Symbols are a user interface. A reader who must keep a lookup table in working memory
has less memory left for the argument, and the argument is the point. The BEST Names
convention :cite:`Loewe2016BestNames` gives every quantity four forms at once: a
**B**\ rief symbol for equations, an **E**\ xplicit name as it appears in human-readable model
code, a **S**\ ummarizing phrase for prose explaining the gist of what it does,
and a **T**\ echnical column tying it to
the names other fields already use.
The rule followed here: **a reader who never looks at an equation should lose nothing
by reading only the Summarizing column.**
.. _b16x-names-table:
.. _b16-table-b-the-best-names-index-every-symbol-on-one-page:
Table B --- the BEST Names index, every symbol on one page
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.. admonition:: Read this first --- three letters carry the whole scheme
:class: tip
Every symbol is built from the three **state** names, so nothing has to be
memorised:
**R** = Risky (now) |rarr| **M** = MAD crisis |rarr| **D** = Dead (winter has begun)
Then :math:`r` is a **rate** per year, :math:`p` a **probability** (no units),
:math:`T` a **time** in years, :math:`n` a **count** (no units), and :math:`q` a
**fraction** (no units) --- and the subscript says *between which states*. Years
are the unit throughout this paper; nothing depends on that choice. :math:`r_{R
\rightarrow M}` is "the rate of going from Risky to a MAD crisis"; :math:`T_{R \rightarrow
D}` is "the time from Risky to Dead". Two quantities are **not** arrows, because
they are not transitions --- they emerge from solving the model --- and they are
named in words instead (:math:`r_{\text{onset}}`, :math:`r_{\text{relax}}`). That
difference is deliberate: **the notation itself says which quantities to put in
and which ones come out.**
**The Explicit names follow the companion code's own two conventions:**
``camelCase`` for the three model parameters, which are what you set, and
``snake_case`` for everything computed from them. Where an Explicit name is
**proposed** rather than already present in ``riskymad_exact.py``, the entry in
:ref:`b16-every-symbol-in-full-the-glossary` says so; the name is given anyway, so that every quantity in this
paper can be referred to without a symbol.
**The table below is exhaustive.** Every symbol that appears anywhere in this
paper is in it, including the ones a mathematician would consider too obvious to
list --- the discriminant, the sum of all rates, and the two local proof variables
of :ref:`b16-the-one-fact-everything-rests-on`. Nothing is left for a reader to infer.
.. table:: Table B. The BEST Names index --- every quantity in this paper, one line each
:widths: 13 32 55
:class: longtable
+----------------------------------+----------------------------+------------------------------------------------------------------+
| **B**\ rief | **E**\ xplicit | **S**\ ummarizing |
+==================================+============================+==================================================================+
| **Put in --- the three arrows of the model** |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`r_{R \rightarrow M}` | ``rMADcrisisStarts`` | **the crisis rate** --- how often the world walks into a MAD |
| | | crisis. **0.1/yr**, one per 10 years. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`r_{M \rightarrow R}` | ``rMADcrisisCalms`` | **the de-escalation rate** --- how fast a MAD crisis walks back |
| | | to Risky safety. **6/yr.** |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`r_{M \rightarrow D}` | ``rMADcrisisToWinter`` | **the kill escalation rate** --- how fast a MAD crisis explodes |
| | | into nuclear winter. **3/yr**, the committed step. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| **Put in --- one number from outside the model** |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`q_{\text{dead}}` | ``qHumansDead`` | **the death fraction** --- share of humanity dead within |
| | | |approx| 2 yr of onset, all causes. b16 uses **0.3**; |
| | | scenario-matched is **0.63**. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| **Comes out --- rates** |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`r_{M \rightarrow | ``rMADcrisisEnds`` | **the crisis clock** --- how fast a crisis resolves, either way. |
| \text{out}}` | | **9/yr**; 1/it is the mean crisis duration, |approx| **40 |
| | | days**. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`r_{\text{onset}}` | ``rWinterSettled`` | **the onset rate** --- **the disaster rate**: **0.0331/yr = 3.3 |
| | | %/yr**, the *level* risk settles at. Compare published "X % per |
| | | year". |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`r_{\text{relax}}` | ``rRiskWarmsUp`` | **the relaxation rate** --- **not** a disaster rate: the *speed* |
| | | risk settles at :math:`r_{\text{onset}}`. **9.067/yr**; 1/it |
| | | |approx| **40 days**. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`r_{\text{flux}}` | ``rWinterPerWorldYear`` | **the flux of worlds** --- onsets per world-year, **0.0330/yr**. |
| | | What a simulation measures: an *ensemble* property, not a |
| | | hazard. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`r_{\text{all}}` | ``rAllRatesAdded`` | **the sum of every rate** --- 0.1 + 6 + 3 = **9.1/yr**. Vieta: |
| | | :math:`r_{\text{onset}} + r_{\text{relax}} = r_{\text{all}}` |
| | | checks both roots. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| **Comes out --- probabilities, counts, densities** |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`p_{M \rightarrow D}` | ``pMADcrisisToWinter`` | **the per-crisis chance of nuclear winter** --- of all crises |
| | | begun, the share reaching Dead. **1/3**. *Not a personal risk.* |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`n_{MAD}` | ``nMADcrisesUntilWinter`` | **the number of MAD crises** passed through before one ends it. |
| | | **3 on average** --- this is :math:`1/p_{M \rightarrow D}`. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`p_{\text{winter}}(t)` | ``dWinterPerYear`` | **the density** of the waiting time, in **1/yr** --- not a |
| | | probability: only its *area* over a stretch of years is one. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| **Comes out --- times** |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`T_{R \rightarrow D}` | ``tUntilWinter`` | **the waiting time** --- years until onset of nuclear winter. |
| | | Mean **30.3 yr**, median |approx| **21 yr**; a distribution, not |
| | | a date. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`T_{M \rightarrow D}` | ``tUntilWinterFromCrisis`` | **the waiting time from inside a crisis** --- counting every |
| | | later crisis too, not just this one. **20.3 yr** --- years, not |
| | | days. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| **Local proof devices, used once** |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`\Delta` | ``underTheRoot`` | **the discriminant** --- :math:`r_{\text{all}}^{2} - 4\, r_{R |
| | | \rightarrow M}\, r_{M \rightarrow D}`. Its only job: to show |
| | | both rates are always **real**. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`C_{M \rightarrow R}` | ``tClockToCalm`` | **the calming clock** --- the random time until this crisis |
| | | would de-escalate, if nothing else happened first. A **time**, |
| | | in years. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`C_{M \rightarrow D}` | ``tClockToWinter`` | **the winter clock** --- the random time until this crisis would |
| | | reach Dead. **Whichever clock rings first decides.** |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| **Reported quantities --- computed from the above, and quoted in the text** |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`r_{R \rightarrow L}` | ``rExodusToLife`` | **the exodus rate** --- how fast the world sets out for Mutually |
| | | Assured Progress. **Zero so far, and not a constant of nature:** |
| | | it is what deliberate preparation raises, and it has to outrun |
| | | the crisis rate to matter. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`r_{\text{winter}}(t)` | ``rWinterNow`` | **the hazard now** --- given the world is still here at |
| | | :math:`t`, the chance per year of onset. Starts at **exactly |
| | | zero** and climbs to ``rWinterSettled`` in about 40 days. |
| | | :math:`= d_{\text{winter}}(t) / P(T > t)`. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`P(T \leq t)` | ``pWinterBy`` | **the chance winter has begun by** :math:`t`. **2.90 %** for the |
| | | coming year, against 3.25 % if the present calm is ignored. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`P(T > t)` | ``pNoWinterYet`` | **the chance it has not** --- the survival curve. :math:`= 1 -` |
| | | ``pWinterBy``. Only **0.13 %** of worlds survive 200 years. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`T^{\text{med}}` | ``tUntilWinterMedian`` | **the median wait** --- **21.1 yr**, well below the mean of |
| | | 30.3. Half of all runs are over by then. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`\text{SD}(T)` | ``tUntilWinterSpread`` | **the spread of the wait** --- the standard deviation, from |
| | | :math:`1/r^2_{\text{settled}} + 1/r^2_{\text{warm}}`. The |
| | | distribution runs from days to centuries. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`r_{\text{naive}}` | ``rWinterNaive`` | **the naive product** --- ``rMADcrisisStarts`` |times| |
| | | ``pMADcrisisToWinter`` = **0.0333/yr**. The retired shortcut; |
| | | correct as a rate to about 1 %. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`r_{\text{road}}` | ``rRoadDeathsPerYear`` | **the road-death baseline** --- **1.49e-4** per person-year, |
| | | global. *Put in, from outside.* The car-crash comparison divides |
| | | by this. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`n_{\text{road}}` | ``nTimesRoadRisk`` | **how much likelier than a car crash** --- **58x** at the base |
| | | case. = ``pWinterBy``\ (1) |times| ``qHumansDead`` / |
| | | ``rRoadDeathsPerYear``. |
+----------------------------------+----------------------------+------------------------------------------------------------------+
| :math:`S/K_m` | ``qSaturation`` | **the saturation** --- **0.011**, i.e. **ninety times below |
| | | half-saturation**. How far the system sits into the first-order |
| | | regime (SIA-8). |
+----------------------------------+----------------------------+------------------------------------------------------------------+
Three things have been taken **out** of this table on purpose, each into its own place
below, so that the index stays one page and each fact is stated once: the full
explanation of every symbol (:ref:`b16-every-symbol-in-full-the-glossary`), the map to the symbols this document used
before 2026m09d08 (:ref:`b16-table-b-old-the-symbols-this-document-used-before`), and the enzyme-kinetics mapping (:ref:`b16-table-b-mm-the-same-quantities-read-as-enzyme-kinetics`).
.. _b16x-names-glossary:
.. _b16-every-symbol-in-full-the-glossary:
Every symbol in full --- the glossary
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The index above answers *"what is this?"* in two lines. This glossary answers *"why is
it called that, what else is it known as, and what must I not confuse it with?"* --- and
it is a Sphinx glossary rather than a table for one reason: every entry is a ``:term:``
target, so any later section of this paper, and any other paper in the series, can write
``:term:`rWinterSettled``` and link straight here. On the website a reader gets the definition
as a hover tooltip without leaving the page. In print it sets as the definition list it
already is, so nothing is lost.
Each entry is keyed on its **Explicit** name, which is why every quantity needed one.
Where that name is a proposal rather than an identifier already in the companion code,
the entry says **(proposed)** and names what the code does instead.
**Six of these quantities carry a second complete set of names**, because the model is
identical to Michaelis--Menten enzyme kinetics rather than merely analogous to it.
Those names are gathered once in :ref:`b16x-names-mm` rather than repeated entry by
entry: ``rMADcrisisStarts``, ``rMADcrisisCalms``, ``rMADcrisisToWinter``,
``rMADcrisisEnds``, ``pMADcrisisToWinter`` and ``rWinterPerWorldYear``.
.. glossary::
rMADcrisisStarts
:math:`r_{R \rightarrow M}` --- **the crisis rate**
**Explicit:** declared in the Evolvix model **and** used under the same name in the Python code.
how often a Risky world walks into a MAD crisis, per year
**Technical:** Poisson arrival rate. Hellman's :math:`\lambda_{IE}` is the nearest
published relative. Textbook generator entry :math:`q_{RM}`.
rMADcrisisCalms
:math:`r_{M \rightarrow R}` --- **the de-escalation rate**
**Explicit:** declared in the Evolvix model **and** used under the same name in the Python code.
how fast a MAD crisis walks back to Risky safety, per year
**Technical:** Queueing service rate. Textbook :math:`q_{MR}`.
rMADcrisisToWinter
:math:`r_{M \rightarrow D}` --- **the kill escalation rate**
**Explicit:** declared in the Evolvix model **and** used under the same name in the Python code.
how fast a MAD crisis explodes into accidental nuclear winter, per year, if
this MAD crisis was to actually last for a year.
**Technical:** Textbook :math:`q_{MD}`.
rMADcrisisEnds
:math:`r_{M \rightarrow \text{out}}` --- **the crisis clock**
**Explicit:** **proposed here.** The Python code writes the sum ``rMADcrisisCalms + rMADcrisisToWinter`` inline rather than naming it.
how fast a crisis resolves, either way (by mending or killing). Its
reciprocal is the mean crisis duration, |approx| 40 days.
**Technical:** :math:`= r_{M \rightarrow R} + r_{M \rightarrow D}`, the total rate of
leaving a MAD crisis by any arrow.
pMADcrisisToWinter
:math:`p_{M \rightarrow D}` --- **the per-crisis chance of nuclear winter**
**Explicit:** a named variable of the Python code; computed, not set.
of all the crises the world enters, the share that go all the way to Dead
instead of back to Risky. Base case: 1/3. **This number and the crisis rate
are not separately identified**: fixing it at 1/3 is what defines which
near-disasters count as "Cuban-Missile-Crisis type" and are therefore
counted by ``rMADcrisisStarts``. If the true per-crisis chance is higher than
1/3, the same forecast follows from a correspondingly higher effective
``rMADcrisisStarts``, and vice versa. Neither is known separately; what the study
assumes is that their **product** lies between the bounds discussed in the
text. Section 14.1 makes this exact.
.. warning:: **This is not anybody's personal risk.** "1/3" is a *conditional*
about crises --- given a crisis has begun, the share that run all the way.
An individual's annual chance of dying is a different quantity by two orders
of magnitude: :math:`P(T_{R \rightarrow D} \leq 1) \times q_{\text{dead}}
= 0.029 \times 0.3 \approx` **0.9 % per year**. Any reader who reads
"1 in 3" as a personal odds has been misled by the notation, which is why
:math:`p_{death}` was retired as a name.
**Technical:** Computed by ``p_end()``. Same arrow as :math:`r_{M \rightarrow D}`, but a *probability* rather
than a rate --- which is why the defining identity :math:`p_{M \rightarrow
D} = r_{M \rightarrow D}/r_{M \rightarrow \text{out}}` can be read straight
off the notation: *the share of the leaving-rate that goes to D.* Kennedy's
Cuban estimate is a reading of *this*, not of the crisis rate.
tUntilWinter
:math:`T_{R \rightarrow D}` --- **the waiting time**
**Explicit:** a named variable of the Python code; computed, not set.
years from now (world is Risky) until onset of accidental nuclear winter
(world is Dead after taking the wrong turn in a MAD crisis). A random
quantity following a distribution, not a fixed date.
**Technical:** Computed by ``mean_wait()``. First-passage time to absorption from Risky. **Not** a half-life,
**not** a deadline.
tUntilWinterFromCrisis
:math:`T_{M \rightarrow D}` --- **the waiting time from inside a crisis**
**Explicit:** **proposed here.** It appears only inside the derivation, so neither code names it.
years from the start of *some* crisis until Dead, **counting everything that
follows if this crisis de-escalates**: the return to Risky, the wait for the
next crisis, and every later crisis until one of them ends it. Base case
**20.3 years** --- note *years*, not the 40 days a single crisis lasts.
**Technical:** First-passage time to absorption from a MAD crisis. A bookkeeping quantity; it
appears only inside the derivation. **One symbol is enough**, because the
duration of the *final* crisis is not a separate unknown: by Fact 3 a crisis
lasts :math:`1/r_{M \rightarrow \text{out}}` |approx| 40 days on average
**whether or not it is the one that escalates**. Check: :math:`1/r_{R
\rightarrow M} + T_{M \rightarrow D} = 10 + 20.33 = 30.33 = T_{R \rightarrow
D}`. ✓
rWinterSettled
:math:`r_{\text{onset}}` --- **the onset rate**
**Explicit:** a named variable of the Python code; it is computed, not set, so it has no place in the Evolvix model.
the composite rate, per year, of transitioning all the way from Risky
through a MAD crisis to Dead. **This is the disaster rate**, and the one number here
comparable to published estimates of "X percent per year" for nuclear war.
Base case 0.0331/yr, that is 3.3 % per year. It is the **level the risk
settles at** once the first months are past --- not a rate that applies from
day one (:ref:`b16-the-hazard-rises-it-does-not-start-at-its-final-value`).
**Technical:** Computed as the first value returned by ``decay_rates()``. Smaller root of the characteristic quadratic; the decay rate of the
quasi-stationary distribution; the asymptotic hazard. **It is an equilibrium
rate in every sense that can apply to an absorbing chain.** Strictly the
chain has no equilibrium, since all probability drains into Dead (only 0.13
% of worlds survive 200 years); what it settles into is the
**quasi-stationary** state --- an equilibrium *among the survivors*, who
divide 98.9 % Risky / 1.1 % in a MAD crisis. But that state has the defining property
one would want: **started from it, the waiting time is exactly exponential
at rate** :math:`r_{\text{onset}}`, with no correction term at any horizon
(:ref:`b16-which-question-is-being-asked-and-what-we-are-not-in`, checked to machine precision). It is **not** named :math:`r_{R
\rightarrow D}`, because R |rarr| D is not a transition of the model: there
is no direct arrow, only the composite journey through M. Bounded exactly by
:math:`1/T_{R \rightarrow D} < r_{\text{onset}} < r_{R \rightarrow M}\, p_{M
\rightarrow D}` (:ref:`b16-why-the-smaller-root-is-the-onset-rate`).
rRiskWarmsUp
:math:`r_{\text{relax}}` --- **the relaxation rate**
**Explicit:** a named variable of the Python code; computed, not set.
**not a disaster rate at all**, and not a rival to :math:`r_{\text{onset}}`.
The two are different *kinds* of quantity: :math:`r_{\text{onset}}` is the
**level** the risk settles at; :math:`r_{\text{relax}}` is the **speed at
which it settles there**, and its reciprocal, |approx| 40 days, is the
**relaxation time**. Why there is anything to settle: the forecast is made
*knowing the world is in Risky today and not already in a crisis*, so onset
cannot happen immediately --- a crisis must first arrive and then run its
course. The risk therefore starts at **exactly zero** and climbs to
:math:`r_{\text{onset}}` within a few months (:ref:`b16-the-hazard-rises-it-does-not-start-at-its-final-value` and :ref:`b16-the-shifted-exponential-picture-and-where-the` and :ref:`b16-which-question-is-being-asked-and-what-we-are-not-in`).
**This is what that knowledge is worth:** 2.90 % rather than 3.25 % for the
coming year (:ref:`b16-which-question-is-being-asked-and-what-we-are-not-in`).
**Technical:** Computed as the second value returned by ``decay_rates()``. Larger root of the same quadratic. Standard usage in kinetics and in
Markov-chain theory calls :math:`1/(r_{\text{relax}} - r_{\text{onset}})`
the relaxation time; here the two differ by 0.37 % (40.43 d against 40.28
d), so the distinction never matters numerically but is stated to keep the
identification honest. It is likewise close to, but **not equal to**, the
crisis clock: :math:`r_{\text{relax}} = 9.067`/yr against :math:`r_{M
\rightarrow \text{out}} = 9.000`/yr, larger by 0.74 %, and :ref:`b16-why-the-smaller-root-is-the-onset-rate`
proves that inequality is strict whenever :math:`r_{M \rightarrow R} > 0`.
Section 7.3 explains why the two exponentials of the closed form are *not*
the two physical stages.
nMADcrisesUntilWinter
:math:`n_{MAD}` --- **the number of MAD crises** passed through before one ends it. **3 on average**
**Explicit:** **proposed here** for the quantity; the Python code names only the function that returns it.
**the number of MAD crises** the world passes through before one of them
reaches Dead --- on average 3
**Technical:** Computed by ``excursions()``. Geometric random variable with success probability :math:`p_{M
\rightarrow D}`. This is the factor that answers the "loop objection"
(:ref:`b16-reading-the-formula`).
qHumansDead
:math:`q_{\text{dead}}` --- **the death fraction**
**Explicit:** a named constant of the Python code. It is not in the Evolvix model, which does not need it: nothing in the simulation depends on it.
the share of humanity that dies **within about two years of onset, from all
causes taken together**: the blast and fire, and then the famine and
supply-chain collapse that follow, which dominate the total. It is **not**
deaths in the strikes alone.
**Technical:** Not produced by this model. b16 SIA-9 takes it from Xia et al. (2022),
whose figures are **deaths by the end of year 2**: a *small regional*
exchange (~100 warheads, 5 Tg soot) gives about 2 billion (:math:`q \approx
0.25`); a full US--Russia exchange (150 Tg) gives **over 5 billion**
(:math:`q \approx 0.63`). b16 uses **0.3**, which is therefore conservative
**twice over** --- it takes the figure for the *smallest* exchange modelled,
and it stops counting at two years while the climate disruption runs for a
decade or more. **Section 14.2** works through what the two-year horizon
does and does not include; the scenario-matched value is 0.63, which would
roughly double every multiplier b16 reports.
rWinterPerWorldYear
:math:`r_{\text{flux}}` --- **the flux of worlds**
**Explicit:** **proposed here** for the quantity; the Python code names only the function that returns it.
onsets per world-year, 0.0330/yr. **This is what a simulation measures
directly:** run 40 world histories, add up their waiting times, and divide
40 by that total. It is a property of the *ensemble*, not of any world in it
--- a single world has exactly one onset, ever, on one date, and never
experiences "0.033 onsets per year". Distinct from :math:`r_{\text{onset}}`
in kind as well as value (0.0331/yr, 0.36 % apart): :math:`r_{\text{onset}}`
is a **hazard** --- instantaneous, conditional on having survived so far ---
whereas :math:`r_{\text{flux}}` is an **unconditional average over the whole
run**. Quote :math:`r_{\text{onset}}` against published "X percent per year"
figures; quote :math:`r_{\text{flux}}` when reporting what an ensemble of
runs produced.
**Technical:** computed by ``mm_velocity()``. It is an ensemble average, not a hazard: onsets divided by world-years lived, which is what running many worlds and dividing measures.
rAllRatesAdded
:math:`r_{\text{all}}` --- **the sum of every rate**
**Explicit:** a named variable of the Python code (``crosschecks.py``; the local ``total`` inside ``decay_rates()``).
:math:`r_{R \rightarrow M} + r_{M \rightarrow R} + r_{M \rightarrow D}` =
9.1/yr. It is a rate like any other and is written as one, rather than as a
bare Greek abbreviation, so that an equation containing it can be looked up
here. It grows automatically if the model grows: a Risky |rarr| LifeMAP
escape arrow would enter this sum too.
**Technical:** Minus the trace of the transient generator. Appears in both Vieta
relations: :math:`r_{\text{onset}} + r_{\text{relax}} = r_{\text{all}}`,
which is the quickest check that the two roots were solved correctly. py``.
dWinterPerYear
:math:`p_{\text{winter}}(t)` --- **the density** of the waiting time, in **1/yr**
**Explicit:** **proposed here** for the quantity; the Python code names only the function that evaluates it.
how much of the probability of onset falls in each year. Not a probability
itself: it has units of 1/yr, and only its *area* over a stretch of years is
a probability. It appears once, as the numerator of the hazard in section
7.2.
**Technical:** Evaluated by ``pdf()``. Probability density function of the waiting time. **Lower case on
purpose:** :math:`P(\cdot)` in these same equations is a probability, and a
density is not one --- the case carries the type. Named for the event rather
than the arrow (``winter``, not :math:`T_{R \rightarrow D}`) because a
nested arrow subscript is unreadable at this size, and because *accidental
nuclear winter* is what the whole paper is about.
underTheRoot
:math:`\Delta` --- **the discriminant**
**Explicit:** a named local of the Python code, inside ``decay_rates()``.
the quantity under the square root when the two rates are solved for. Its
only job is to show that the two rates are always **real numbers** rather
than an oscillation, for any positive rates whatever (b16-extra section 6.5).
**Technical:** :math:`\Delta = r_{\text{all}}^{2} - 4\, r_{R \rightarrow M}\, r_{M
\rightarrow D}`. Renamed from :math:`D` in round four, because :math:`D` is
the state **Dead** in the arrow scheme and the two would otherwise appear in
the same equations.
tClockToCalm
tClockToWinter
:math:`C_{M \rightarrow R}`, :math:`C_{M \rightarrow D}` --- **the two clocks**
**Explicit:** **proposed here.** A proof device: neither code has a counterpart.
a *local proof device*, used once and not needed afterwards. Picture each
arrow as carrying its own alarm clock set to a random time; the MAD crisis
ends when the **first** clock rings, and **which** clock rings decides
whether the world walks back to Risky or arrives at Dead. Listed here so
that a reader who meets these symbols in :ref:`b16-the-one-fact-everything-rests-on` is not left wondering why
they were introduced at all.
**Technical:** Independent exponential random variables with rates :math:`r_{M
\rightarrow R}` and :math:`r_{M \rightarrow D}`. Conventionally written
:math:`X` in probability texts, where the letter carries no meaning; the
clock reading is the same mathematics with an interpretation attached.
.. _b16x-names-old:
.. _b16-table-b-old-the-symbols-this-document-used-before:
Table B-old --- the symbols this document used before 2026m09d08
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This table exists to be **deletable**. It carries the whole of the old-paper tracking
that was previously repeated inside twelve separate entries of the names table, and
nothing else depends on it. Once every draft, llog and figure that used the old symbols
has been migrated, this section can be cut in one edit and no other part of the paper
changes.
**Until then it is worth keeping visible rather than banishing to the repository.** A
reader holding a printout of an earlier draft, or a referee who saw a version before
2026m09d08, needs exactly this map and needs it in the paper rather than in a commit
history. The third column is the separate question of what **b16 itself** calls each
quantity, which is not a rename at all and does not go away when this table does.
.. table:: Table B-old. Every symbol that changed, what it is called now, and what b16 itself calls it
:widths: 15 21 19 24 12
:class: longtable
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| before 2026m09d08 | now (**B**\ rief) | **E**\ xplicit, before | **E**\ xplicit, now | in b16 itself |
+===========================+==================================+============================+================================+========================+
| :math:`\lambda` | :math:`r_{R \rightarrow M}` | ``rRiskyGoMAD`` | ``rMADcrisisStarts`` | :math:`\lambda` |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| :math:`\mu` | :math:`r_{M \rightarrow R}` | ``rMADescapes`` | ``rMADcrisisCalms`` | :math:`b` |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| :math:`\kappa` | :math:`r_{M \rightarrow D}` | ``rMADtoDEATH`` | ``rMADcrisisToWinter`` | :math:`c` |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| :math:`\mu + \kappa` | :math:`r_{M \rightarrow | --- (new here) | ``rMADcrisisEnds`` | :math:`b+c` |
| | \text{out}}` | | | |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| :math:`p_{\text{end}}` | :math:`p_{M \rightarrow D}` | ``p_M_to_D`` | ``pMADcrisisToWinter`` | :math:`p_{death}` |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| :math:`W` | :math:`T_{R \rightarrow D}` | ``T_R_to_D`` | ``tUntilWinter`` | :math:`T_R` |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| :math:`W_{\text{crisis}}` | :math:`T_{M \rightarrow D}` | ``T_M_to_D`` | ``tUntilWinterFromCrisis`` | :math:`T_M` |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| :math:`r_{\text{slow}}` | :math:`r_{\text{onset}}` | ``r_onset`` | ``rWinterSettled`` | :math:`r_1` |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| :math:`r_{\text{fast}}` | :math:`r_{\text{relax}}` | ``r_relax`` | ``rRiskWarmsUp`` | :math:`r_2` |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| :math:`n_{\text{tries}}` | :math:`n_{MAD}` | ``n_MAD`` | ``nMADcrisesUntilWinter`` | --- (implicit) |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| --- (unchanged) | :math:`q_{\text{dead}}` | ``DEATH_FRACTION_Q`` | ``qHumansDead`` | :math:`q` |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| --- (unchanged) | :math:`r_{\text{flux}}` | ``r_flux`` | ``rWinterPerWorldYear`` | :math:`v` |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| :math:`\Sigma` | :math:`r_{\text{all}}` | ``r_all`` | ``rAllRatesAdded`` | :math:`\lambda + b + |
| | | | | c` |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| --- (unchanged) | :math:`p_{\text{winter}}(t)` | ``p_winter`` | ``dWinterPerYear`` | --- (not in b16) |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| --- (unchanged) | :math:`\Delta` | ``disc`` | ``underTheRoot`` | --- (not in b16) |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
| :math:`C_\mu, C_\kappa` | :math:`C_{M \rightarrow R}`, | --- (new here) | ``C_M_to_R``, ``C_M_to_D`` | --- (not in b16) |
| | :math:`C_{M \rightarrow D}` | | | |
+---------------------------+----------------------------------+----------------------------+--------------------------------+------------------------+
**Twelve of the sixteen changed.** The four that did not --- :math:`q_{\text{dead}}`,
:math:`r_{\text{flux}}`, :math:`p_{\text{winter}}(t)` and :math:`\Delta` --- are listed
anyway so that the table can be checked for completeness against the index without
holding anything in memory.
.. _b16x-names-mm:
.. _b16-table-b-mm-the-same-quantities-read-as-enzyme-kinetics:
Table B-MM --- the same quantities, read as enzyme kinetics
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Section 9 shows that this model is not *analogous* to Michaelis--Menten kinetics but
**identical** to it. That makes the enzymology names a second complete set of names for
the same quantities --- which is why they are gathered here rather than scattered one
clause at a time through the glossary.
**This table is staged here and belongs in b16-extra section 9.** It is a superset of :ref:`Table
F `: it adds the two names Table F omits (:math:`k_{on}[S]` and
:math:`k_{off}`) and the Explicit column. When it moves, it should **replace** Table F
rather than sit beside it --- see the note there.
.. table:: Table B-MM. Enzyme kinetics and RiskyMAD, name for name
:widths: 13 17 21 10 39
:class: longtable
+------------------------+------------------------------+-------------------------+------------+------------------------------------------------------------------+
| Enzyme kinetics | RiskyMAD (**B**\ rief) | **E**\ xplicit | base value | what it says here |
+========================+==============================+=========================+============+==================================================================+
| :math:`k_{on}[S]` | :math:`r_{R \rightarrow M}` | ``rMADcrisisStarts`` | 0.1 /yr | Enzymology :math:`k_{on}[S]`. Michaelis--Menten substrate |
| | | | | :math:`S`. |
+------------------------+------------------------------+-------------------------+------------+------------------------------------------------------------------+
| :math:`k_{off}` | :math:`r_{M \rightarrow R}` | ``rMADcrisisCalms`` | 6 /yr | Enzymology :math:`k_{off}`. |
+------------------------+------------------------------+-------------------------+------------+------------------------------------------------------------------+
| :math:`k_{cat}`, | :math:`r_{M \rightarrow D}` | ``rMADcrisisToWinter`` | 3 /yr | Enzymology :math:`k_{cat}`, the committed step. |
| :math:`V_{max}` | | | | Michaelis--Menten :math:`V_{max}`: **you cannot destroy the |
| | | | | world faster than this.** |
+------------------------+------------------------------+-------------------------+------------+------------------------------------------------------------------+
| :math:`K_m` | :math:`r_{M \rightarrow | ``rMADcrisisEnds`` | 9 /yr | Michaelis--Menten :math:`K_m`. |
| | \text{out}}` | | | |
+------------------------+------------------------------+-------------------------+------------+------------------------------------------------------------------+
| :math:`k_{cat}/K_m` | :math:`p_{M \rightarrow D}` | ``pMADcrisisToWinter`` | 1/3 | Enzymology: commitment to catalysis; specificity constant |
| | | | | :math:`k_{cat}/K_m`. |
+------------------------+------------------------------+-------------------------+------------+------------------------------------------------------------------+
| :math:`v` | :math:`r_{\text{flux}}` | ``rWinterPerWorldYear`` | 0.0330 /yr | Michaelis--Menten reaction **velocity** :math:`v` |
| | | | | (:ref:`b16x-mm`), which is the same quantity read as a turnover: |
| | | | | an enzyme processes substrate repeatedly, so for enzymes the |
| | | | | flux is what one actually observes, and the ensemble is the |
| | | | | molecules in the tube. Here the "tube" is a hypothetical |
| | | | | population of worlds --- which is exactly why the enzymology |
| | | | | symbol :math:`v` is kept **only** inside section 9, where that |
| | | | | reading is being made on purpose. |
+------------------------+------------------------------+-------------------------+------------+------------------------------------------------------------------+
The mapping is exact at **every** value of :math:`r_{R \rightarrow M}`, not only in a
limit; b16-extra section 9 does the substitution line by line and checks the defining
half-saturation property. What the enzymology buys is not decoration: it is the reason
the crisis rate can be **counted** from the near-disaster records rather than derived
from a mechanism nobody can model --- the same move that makes Michaelis--Menten useful
for enzymes.
SIA-2 --- LLoL's SD1 analysis (the original approach)
----------------------------------------------------------------------------
The first analysis of this model was LLoL's, on the single-page **SD1** poster (2024--2025, no AI). It
ran world history forward as a stochastic simulation and read the waiting time off each run --- the
right instrument for the *shape* of the distribution (medians, long tails, the century-long quiet
stretches on which the Michaelis--Menten reading of SIA-7 rests).
**Method.** Forty independent runs per scenario, generated with the Evolvix prototype compiler
(:doc:`download `), which implements the
stochastic simulation algorithm exactly (Gillespie, 1977; Ehlert & Loewe, 2014, "Lazy Updating,"
*J Chem Phys* 141(20): 204109). Each run produces one random waiting time until accidental nuclear
winter. Three scenarios span the crisis rate from optimistic (0.03/yr) through base (0.10/yr) to
pessimistic (0.30/yr).
.. figure:: /_file/pdf/hell/mm/b/16/fig/forecast-waiting-times-base-40runs-annotated-iv_llol_qqv2r0p0_2026m07d24-fig.webp
:alt: The base-case run, annotated --- forty simulated waiting times against the expected probability of each of the three states
:width: 85%
:align: center
**Figure 7:** The base case, annotated --- repeated here from Section 4 beside the method it
illustrates. **1** (green) is the probability the world is still merely **Risky**, falling as time
passes. **2** (red) is the thin sliver of probability sitting in a **MAD crisis** at any moment --- about one
percent of the time (SIA-8), which is why long quiet stretches are ordinary here (SIA-7). **3** is
**Dead**: the grey line is the expected cumulative probability of having arrived there, and each
black dot is one of forty simulated world histories plotted at the year its own run arrived. The
forty runs and the expected curve agree. The fastest run took **0.37 years**, the slowest **127**.
All three scenarios are compared in Figure 3. *40-run stochastic simulation (distribution shape);
exact values in Table 3 (SIA-5).* Source: :doc:`SD1 `.
**What the runs showed.** A median near **19 years** at the base rate, with roughly **one run in
forty** reaching catastrophe inside the first year, robust across death-probability scenarios (SIA-3
gives the summary table).
**A limit of the instrument, stated plainly.** Forty runs cannot resolve a 3-percent annual
probability: the standard error on such an estimate at :math:`n = 40` is about 2.5 percent, nearly the
estimate itself. The simulations are the right tool for the distribution's shape and the wrong tool for
the one-year number; that number is supplied exactly by the arithmetic of SIA-4, and the two agree
(SIA-5). No re-run would change this.
SIA-3 --- LLoL's summary statistics table (SD1)
----------------------------------------------------------------------------
The forty-run simulation of SIA-2, tabulated. Kept as its own citeable unit, distinct from SIA-2's
method and from the exact arithmetic of SIA-5.
.. list-table:: Table 4. What the simulations returned (40 runs per scenario)
:class: longtable
:header-rows: 1
:widths: 18 14 12 12 12 12 20
* - Scenario
- crisis rate
- median
- mean
- fastest run
- slowest run
- What the runs show
* - Optimistic
- 0.03/yr
- ~51 yr
- ~96 yr
- 0.57 yr
- 329 yr
- Luckiest run reaches three centuries; median still inside one lifetime
* - **Base**
- **0.10/yr**
- **~19 yr**
- **~33 yr**
- **0.37 yr**
- **127 yr**
- **Onset within a generation, with a century-long tail**
* - Pessimistic
- 0.30/yr
- ~6.4 yr
- ~10 yr
- 0.01 yr
- 36 yr
- Fastest runs produce accidental nuclear winter within days
The century-long tail is not an artefact. At the base rate the exact chance of exceeding 127 years is
1.50 percent (about 1 in 67), and the expected maximum of forty draws falls near 112 years --- so the
127-year slowest run is an ordinary sample maximum, not a distributional claim. It is quoted only for
what it shows: that this model produces long quiet stretches as a matter of course (SIA-7).
SIA-4 --- Claude's augmented analysis (the exact first-passage law)
----------------------------------------------------------------------------
The augmentation replaced simulation-plus-approximation with the **exact** first-passage distribution.
The chain is small enough to solve in closed form, which both supplies the waiting times this paper
reports and retires a standing objection.
**Mean time to absorption.** Let :math:`T_{R \rightarrow D}` and :math:`T_{M \rightarrow D}` be the expected times to reach Dead from
Risky and from a MAD crisis. Conditioning on the next transition:
.. math::
T_{M \rightarrow D} &= \frac{1}{r_{M \rightarrow \text{out}}} + \frac{r_{M \rightarrow R}}{r_{M \rightarrow \text{out}}}\, T_{R \rightarrow D} \\
T_{R \rightarrow D} &= \frac{1}{r_{R \rightarrow M}} + T_{M \rightarrow D}
Solving the pair:
.. math::
\boxed{\; T_{R \rightarrow D} \;=\; \frac{r_{M \rightarrow \text{out}}}{r_{R \rightarrow M}\, r_{M \rightarrow D}} \;+\; \frac{1}{r_{M \rightarrow D}} \;}
At the base crisis rate of 0.1/yr, with :math:`r_{M \rightarrow R} = 6` and :math:`r_{M \rightarrow D} = 3`:
:math:`T_{R \rightarrow D} = 9/0.3 + 1/3 = 30.3` years.
**The whole distribution, not just its mean.** Reporting :math:`P(\text{onset} \le t)` requires the
first-passage *law*, not its average. Taking the Laplace transform of the same conditioning argument,
with :math:`f_R(s) = \mathbb{E}[e^{-s\,T_{R \rightarrow D}}]`:
.. math::
f_R(s) \;=\; \frac{r_{R \rightarrow M}}{r_{R \rightarrow M}+s}
\cdot\frac{r_{M \rightarrow R}\,f_R(s)+r_{M \rightarrow D}}{r_{M \rightarrow \text{out}}+s}
.. math::
\boxed{\; f_R(s) \;=\;
\frac{r_{R \rightarrow M}\,r_{M \rightarrow D}}
{s^{2} + s(r_{R \rightarrow M}+r_{M \rightarrow R}+r_{M \rightarrow D})
+ r_{R \rightarrow M}\,r_{M \rightarrow D}} \;}
The denominator factorises as :math:`(s+r_{\text{onset}})(s+r_{\text{relax}})` with :math:`r_{\text{onset}} r_{\text{relax}} = r_{R \rightarrow M} r_{M \rightarrow D}` and
:math:`r_{\text{onset}} + r_{\text{relax}} = r_{R \rightarrow M} + r_{M \rightarrow R} + r_{M \rightarrow D}`. Since the transform is exactly
:math:`r_{\text{onset}} r_{\text{relax}} / [(s+r_{\text{onset}})(s+r_{\text{relax}})]`, the waiting time is **hypoexponential** --- the sum of two
independent exponentials, not one:
.. math::
T_{R \rightarrow D} \;\sim\; \mathrm{Exp}(r_{\text{onset}}) + \mathrm{Exp}(r_{\text{relax}}),
\qquad
P(T_{R \rightarrow D} \le t) \;=\; 1 - \frac{r_{\text{relax}} e^{-r_{\text{onset}} t} - r_{\text{onset}} e^{-r_{\text{relax}} t}}{r_{\text{relax}} - r_{\text{onset}}}
At the base rate: :math:`r_{\text{onset}} = 0.0331`/yr (**the onset hazard** --- the slow stage, the wait for a
crisis to arrive and escalate) and :math:`r_{\text{relax}} = 9.067`/yr (the fast stage, the crisis itself, mean
duration 40 days). Every figure in the tables of SIA-5 comes from this expression.
**Why the correction matters at one year, and only there.** The fast stage contributes a mean delay of
about forty days before onset is even possible, which suppresses the distribution near the origin. Over
ten years or more the suppression is negligible and an exponential fitted to :math:`T_{R \rightarrow D}` agrees to
within 0.2 percentage points. At **one year** the forty days are 11 percent of the window, and the
exponential shortcut overstates the answer by ~12 percent in every scenario: 3.24% against the true
2.90% at base. The one-year figure is the one everyone quotes; the shortcut erred there, and it erred
upward.
.. admonition:: A self-correction, reported where a reader will see it
An earlier draft computed the headline one-year probability as :math:`1-\exp(-t/T_{R \rightarrow D})` --- an
exponential fitted to the correct mean --- and called it exact. The base case was **3.24% (1 in
31)** and is **2.90% (1 in 34)**. No conclusion changes; but a paper whose only request is that
others check its arithmetic has no standing to make it until it has checked its own. Full
provenance: :doc:`what changed between MMv5 and OOv2 `.
**The structure answers the "loop" objection.** It is sometimes put to this model that the
de-escalation path MAD crisis :math:`\rightarrow` Risky :math:`\rightarrow` MAD crisis gives the world repeated
chances to survive, and that a forecast which ignores those chances must overstate the risk. The
objection is reasonable and the mathematics has already answered it. The factor
.. math::
\frac{r_{M \rightarrow \text{out}}}{r_{M \rightarrow D}} \;=\; \frac{1}{p_{M \rightarrow D}} \;=\; 3
is exactly the expected number of excursions into a MAD crisis before one escalates --- a geometric process
with per-crisis death probability :math:`p_{M \rightarrow D} = r_{M \rightarrow D}/r_{M \rightarrow \text{out}} = 1/3`, hence a mean of three attempts.
Each attempt is preceded by an average wait of :math:`1/r_{R \rightarrow M} = 10` years in Risky, so
:math:`T_{R \rightarrow D} \approx 3 \times 10` years. **The de-escalation loop is not omitted from the mathematics: it
is the factor of three.** The world does get another chance, and the model counts every one of them.
**The Poisson form is checked, and it holds --- as a rate.** The onset hazard from the exact solution
is :math:`r_{\text{onset}} = 0.0331`/yr; the Poisson rate :math:`r_{R \rightarrow M} \cdot p_{M \rightarrow D} = 0.0333`/yr. They agree to
within 1 percent, because time spent inside a crisis slightly delays the onset of the next one. What
does *not* follow is that either rate may be fed into :math:`1 - \exp(-rt)` to obtain a one-year
probability: a rate is not a distribution when the process has two stages and the horizon is comparable
to the short one. The agreement of the rates is real; the shortcut it appears to license is not.
.. _b16-the-one-fact-everything-rests-on:
The one fact everything rests on
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Everything below follows from a single property of the exponential distribution and
two consequences of it. They are proved here rather than cited, because they are the
only place where the model's structure meets the mathematics, and a reader who accepts
these three facts can check every later line by algebra alone.
.. _b16-what-a-rate-means:
What "a rate" means
^^^^^^^^^^^^^^^^^^^
To say that an arrow fires at rate :math:`r_{R \rightarrow M}` means: in any short interval of
length :math:`dt`, the chance it fires is :math:`r_{R \rightarrow M}\, dt`, **regardless of how
long we have already been waiting**. Splitting :math:`[0,t]` into :math:`n` intervals
and letting :math:`n \rightarrow \infty`, the chance of *not* firing by time :math:`t`
is
.. math::
P(X > t) \;=\; \lim_{n \rightarrow \infty}\left(1 - \frac{r_{R \rightarrow M} t}{n}\right)^{n}
\;=\; e^{-r_{R \rightarrow M} t}
so the waiting time :math:`X` is **exponentially distributed** with rate
:math:`r_{R \rightarrow M}`: density :math:`r_{R \rightarrow M} e^{-r_{R \rightarrow M} t}`, mean :math:`1/r_{R \rightarrow M}`.
This is assumption **A2** of the ledger, in the only form it is ever used.
.. admonition:: Fact 1 --- memorylessness
:class: note
For an exponential waiting time, :math:`P(X > s + t \mid X > s) = P(X > t)`.
*Proof.* :math:`P(X > s+t \mid X > s) = e^{-r_{R \rightarrow M}(s+t)}/e^{-r_{R \rightarrow M} s} =
e^{-r_{R \rightarrow M} t}`. ∎
**What it means here.** A world that has waited eighty years without nuclear war
faces exactly the same risk next year as a world that has waited eighty days. No
anniversary is a deadline, and no quiet stretch is progress toward safety. This is
the single most counter-intuitive property of the model, and it is why human
intuition about this risk is unreliable rather than merely uninformed.
.. _b16-two-arrows-racing:
Two arrows racing
^^^^^^^^^^^^^^^^^
From a MAD crisis, two arrows compete: de-escalation at rate :math:`r_{M \rightarrow R}` and escalation at
rate :math:`r_{M \rightarrow D}`. Picture each arrow as carrying its **own alarm clock**, set to a
random time: :math:`C_{M \rightarrow R}` is the clock on de-escalation, :math:`C_{M \rightarrow D}` the clock on
escalation. Each would fire at its own rate if the other did not exist. **The crisis ends
when the first clock rings, and which clock rings decides what happens.** That is the
whole picture; the three facts below are what it implies. The crisis ends when the first of them fires.
.. admonition:: Fact 2 --- the race ends at the summed rate
:class: note
:math:`\min(C_{M \rightarrow R}, C_{M \rightarrow D})` is exponential with rate :math:`r_{M \rightarrow \text{out}}`.
*Proof.* The minimum exceeds :math:`t` exactly when both do:
.. math::
P(\min > t) \;=\; P(C_{M \rightarrow R} > t)\, P(C_{M \rightarrow D} > t)
\;=\; e^{-r_{M \rightarrow R} t}\, e^{-r_{M \rightarrow D} t} \;=\; e^{-(r_{M \rightarrow \text{out}})t} \qquad \square
**What it means here.** A crisis lasts on average :math:`1/r_{M \rightarrow \text{out}}` years ---
at base case :math:`1/9` yr, about **40.6 days**. That number was never fitted to
anything; it falls out of two rates chosen for independent structural reasons. The
Cuban missile crisis lasted thirteen days. Agreement to within a factor of three,
from a parameter fixed for unrelated reasons, is offered not as confirmation but as
the absence of a contradiction that could easily have appeared.
.. admonition:: Fact 3 --- which arrow wins, and when, are independent
:class: note
:math:`P(C_{M \rightarrow D} < C_{M \rightarrow R}) = \dfrac{r_{M \rightarrow D}}{r_{M \rightarrow \text{out}}}`, and this is independent of
the value of :math:`\min(C_{M \rightarrow R}, C_{M \rightarrow D})`.
*Proof.* Condition on :math:`C_{M \rightarrow D} = t` and integrate:
.. math::
P(C_{M \rightarrow D} < C_{M \rightarrow R}) \;=\; \int_0^\infty r_{M \rightarrow D} e^{-r_{M \rightarrow D} t}\, e^{-r_{M \rightarrow R} t}\, dt
\;=\; \frac{r_{M \rightarrow D}}{r_{M \rightarrow \text{out}}}
For independence, compute the joint law of the winner and the winning time:
.. math::
P(C_{M \rightarrow D} < C_{M \rightarrow R},\; C_{M \rightarrow D} > t) \;=\; \int_t^\infty r_{M \rightarrow D} e^{-(r_{M \rightarrow \text{out}})u}\,du
\;=\; \frac{r_{M \rightarrow D}}{r_{M \rightarrow \text{out}}}\, e^{-(r_{M \rightarrow \text{out}})t}
which factors into :math:`P(\text{escalation wins}) \times P(\min > t)`. ∎
**What it means here.** This is the workhorse. It says a crisis can be described by
**two separate facts that do not interfere**: how long it lasts (rate
:math:`r_{M \rightarrow \text{out}}`) and how it ends (probability :math:`p_{M \rightarrow D} =
r_{M \rightarrow D}/r_{M \rightarrow \text{out}}`). Without this independence, every calculation below would
require tracking both at once. With it, they can be handled one at a time.
At base case, :math:`p_{M \rightarrow D} = 3/9 = 1/3`: **one crisis in three runs all the
way.**
.. _b16-the-idea-look-one-step-ahead:
The idea: look one step ahead
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The world's future from Risky is complicated --- it may enter and leave crises any
number of times. But the *first* thing that happens is simple, and after it happens the
world is again in a state we have already named. That is the whole trick, and it is
called **first-step analysis**: write the answer from each state in terms of the
answers from the states one step away, then solve the resulting equations.
Write :math:`T_{R \rightarrow D}` for the mean time from **Risky** to Dead, and :math:`T_{M \rightarrow D}`
for the mean time from a **MAD crisis** to Dead. (Both are means here; the full distributions
come in :ref:`b16-what-the-two-rates-are-and-what-they-are-not`.)
.. _b16-reading-the-formula:
Reading the formula
~~~~~~~~~~~~~~~~~~~
The boxed formula is more informative than its value. Rewrite it as
.. math::
T_{R \rightarrow D} \;=\; \underbrace{\frac{1}{p_{M \rightarrow D}}}_{\text{how many crises}}
\times \underbrace{\frac{1}{r_{R \rightarrow M}}}_{\text{wait per crisis}}
\;+\; \underbrace{\frac{1}{p_{M \rightarrow D}} \times \frac{1}{r_{M \rightarrow \text{out}}}}_{\text{time spent inside crises}}
which reads in plain English: *the world waits ten years for a crisis, three crises
happen before one escalates, and the crises themselves take four months in total.*
Thirty years, plus a third of a year.
.. admonition:: This is where the "loop objection" is answered
:class: tip
It is often put to this model that the de-escalation path MAD crisis |rarr| Risky |rarr|
MAD crisis gives the world repeated chances to survive, and that any forecast ignoring
those chances must overstate the risk.
The objection is reasonable, and the algebra above has already answered it. The
factor
.. math::
\frac{r_{M \rightarrow \text{out}}}{r_{M \rightarrow D}} \;=\; \frac{1}{p_{M \rightarrow D}} \;=\; 3
**is** the expected number of trips into a MAD crisis before one escalates. The loop is not
omitted from the mathematics; **it is the factor of three.** Remove the loop
(:math:`r_{M \rightarrow R} = 0`) and the mean wait collapses from 30.3 years to
:math:`1/r_{R \rightarrow M} + 1/r_{M \rightarrow D} = 10.3` years. The world does get another chance, and
the model counts every one of them.
.. _b16-four-checks-on-the-formula:
Four checks on the formula
~~~~~~~~~~~~~~~~~~~~~~~~~~
Before using an equation, it is worth trying to break it.
**Units.** :math:`\dfrac{r_{M \rightarrow \text{out}}}{r_{R \rightarrow M}\,r_{M \rightarrow D}}` has units
:math:`\dfrac{\text{1/yr}}{(\text{1/yr})(\text{1/yr})} = \text{yr}`, and
:math:`1/r_{M \rightarrow D}` is in years. Both terms are times. ✓
**Limit** :math:`r_{M \rightarrow D} \rightarrow 0` **(crises never escalate).** Both terms diverge,
so :math:`T_{R \rightarrow D} \rightarrow \infty`: the world waits forever. ✓
**Limit** :math:`r_{M \rightarrow R} \rightarrow 0` **(no crisis ever de-escalates).** Then
:math:`T_{R \rightarrow D} \rightarrow \dfrac{r_{M \rightarrow D}}{r_{R \rightarrow M}\,r_{M \rightarrow D}} + \dfrac{1}{r_{M \rightarrow D}} =
\dfrac{1}{r_{R \rightarrow M}} + \dfrac{1}{r_{M \rightarrow D}}`: wait for one crisis, then wait for it to
escalate. Exactly right, and it is the shortest the wait can be. ✓
**Limit** :math:`r_{R \rightarrow M} \rightarrow \infty` **(crises arrive constantly).**
:math:`T_{R \rightarrow D} \rightarrow 1/r_{M \rightarrow D}`. The world cannot be destroyed faster than the
escalation step permits, however often crises arrive. This is **saturation**, and it is
the whole content of :ref:`b16x-mm`. ✓
**Monotonicity.** :math:`T_{R \rightarrow D}` decreases in :math:`r_{R \rightarrow M}` and in :math:`r_{M \rightarrow D}`, and
increases in :math:`r_{M \rightarrow R}`. More crises, or more escalation-prone crises, mean less time;
more de-escalation means more time. No term does anything surprising. ✓
.. _b16-why-the-mean-is-not-enough:
Why the mean is not enough
~~~~~~~~~~~~~~~~~~~~~~~~~~
The mean waiting time is 30.3 years. That does **not** mean the risk is thirty years
away, and treating it that way is the most common error made with numbers of this kind.
A mean is a single summary of a spread that runs from days to centuries. The questions
that matter --- *what is the chance this happens within one year? within ten?* --- need
the whole distribution.
Getting it is harder than getting the mean, for a specific reason: the waiting time is
a **sum of a random number of random pieces**. The world waits, has a crisis, maybe
waits again, has another crisis, and so on for a number of rounds that is itself random.
Adding a fixed number of random times is routine. Adding a random number of them, where
the number depends on how each one ended, is not.
.. _b16-the-law-drawn:
The law, drawn
~~~~~~~~~~~~~~
The boxed expression above is the whole forecast. Here it is, for the three crisis
rates b16 reports, on one probability axis --- with time drawn **linear for the first
five years and logarithmic after that**, because no single scale can show the
near-term risk, the medians and the tail at once, and all three are asked about.
.. figure:: /_file/pdf/hell/mm/b/16/fig/riskymad-forecast-of-nuclear-death-probability-x3-iv_LLoL_MMv1r6p1_2026m09d10-fig-plain.*
:alt: Probability that accidental nuclear winter has begun, for crisis rates 0.30, 0.10 and 0.03 per year, on a time axis that is linear for the first five years and logarithmic from five to five hundred years
:width: 100%
:align: center
**Figure 1: the exact waiting-time law, all three scenarios on one axis.** Every
curve is :math:`P(T_{R \rightarrow D} \leq t)` from the boxed formula above --- **no
simulation is involved.** **Left block (0--5 years, linear):** the near-term risk,
which is what people quote. The three scenarios differ by a factor of ten in crisis
rate and by not quite a factor of ten in first-year risk --- **8.3 %, 2.9 %, 0.9 %**
--- so in the first years the three worlds are far less different than the argument
between them suggests. **Right block (5--500 years, logarithmic):** the medians
(**7, 21 and 70 years** --- even the most optimistic published reading of the record
puts the median inside one lifetime) and the 99th percentiles (**47, 139 and 462
years**, past which only one world in a hundred is still waiting). Crosses mark the
first year; filled circles the exact medians and percentiles; open rings the
**fastest and slowest** of the forty simulated runs b16 quotes, tabulated beneath
the figure. Each ring is one draw, shown against where the exact law puts it, not a
claim about the distribution --- and the fastest of all reached accidental nuclear
winter in **0.01 years, under four days**. **The axis break is marked on both facing
edges; the two blocks are not one continuous scale, and on the logarithmic block
equal distance is equal ratio, not equal time**, which makes the tail look tamer
there than it is. Drawn by
``code/riskymad-forecast-of-nuclear-death-probability-x3.py``, which imports the
same functions the audit runs on. The script writes three versions of this figure:
the ``-plain`` one used here, one with the caption printed into the image for
sending on its own, and a ``-public`` one for a general audience that drops the
percentile markers and numerals and the forty-run table. **That a lay reader is
better served without them is a stated guess, not a tested finding** --- said here
rather than left implied, so that anyone who thinks it wrong knows there is nothing
to overturn but an assumption. All three carry the same numbers; every number in
them is written out as plain text in
``code/riskymad-forecast-of-nuclear-death-probability-x3-numbers.txt`` for anyone
who would rather draw their own.
**What the picture is for.** It makes one thing visible that the tables do not: the
three scenarios disagree enormously about *when* and hardly at all about *whether*.
Every curve leads to certain self-destruction. That is section
:ref:`b16x-certainty`, in a picture --- rates set the schedule, not the outcome.
.. _b16x-two-rates:
.. _b16-what-the-two-rates-are-and-what-they-are-not:
What the two rates are --- and what they are not
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The closed form contains two rates that were not put into the model. Understanding what
they mean is where most of the insight in this system lives, and it is also where the
b16 prose is very slightly loose (b16-extra section 13).
.. _b16-why-the-smaller-root-is-the-onset-rate:
Why the smaller root is the onset rate
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
:math:`r_{\text{onset}} = 0.0331`/yr is the rate at which the whole system leaks into
Dead once the first weeks are past. It is the number that should be compared with
published "X percent per year" estimates of nuclear war --- **not** the crisis rate
:math:`r_{R \rightarrow M}`, which is ten times larger and measures something else entirely.
Three nearby numbers are often confused, and the exact relation between them is worth
having:
.. list-table::
:header-rows: 1
:widths: 34 22 44
* - Quantity
- Base-case value
- What it is
* - :math:`1/T_{R \rightarrow D} = r_{R \rightarrow M}\,r_{M \rightarrow D}/(r_{R \rightarrow M}+r_{M \rightarrow R}+r_{M \rightarrow D})`
- 0.032967 /yr
- one over the mean wait
* - :math:`r_{\text{onset}}`
- 0.033087 /yr
- the true long-run onset rate
* - :math:`r_{R \rightarrow M}\, p_{M \rightarrow D} = r_{R \rightarrow M}\,r_{M \rightarrow D}/r_{M \rightarrow \text{out}}`
- 0.033333 /yr
- the naive Poisson shortcut
These three are not equal, and they are always ordered the same way. Since
:math:`r_{\text{onset}} r_{\text{relax}} = r_{R \rightarrow M}\,r_{M \rightarrow D}` and
:math:`r_{\text{onset}} + r_{\text{relax}} = r_{\text{all}}`, we have
:math:`r_{\text{relax}} < r_{\text{all}}` and hence
:math:`r_{\text{onset}} = r_{R \rightarrow M}\,r_{M \rightarrow D}/r_{\text{relax}} > r_{R \rightarrow M}\,r_{M \rightarrow D}/r_{\text{all}} = 1/T_{R \rightarrow D}`.
And :math:`r_{\text{relax}} > r_{M \rightarrow \text{out}}` whenever :math:`r_{M \rightarrow R} > 0` --- because
:math:`r_{\text{all}} + \sqrt{\Delta} > 2r_{M \rightarrow \text{out}}` reduces, after squaring, to
:math:`4r_{R \rightarrow M}\,r_{M \rightarrow R} > 0` --- so
:math:`r_{\text{onset}} = r_{R \rightarrow M}\,r_{M \rightarrow D}/r_{\text{relax}} < r_{R \rightarrow M}\,r_{M \rightarrow D}/r_{M \rightarrow \text{out}}`.
Therefore, exactly and always:
.. math::
\boxed{\;\; \frac{1}{T_{R \rightarrow D}} \;<\; r_{\text{onset}} \;<\; r_{R \rightarrow M}\, p_{M \rightarrow D} \;\;}
**Two things follow, and both matter for honesty.** First, the naive Poisson product
:math:`r_{R \rightarrow M} \cdot p_{M \rightarrow D}` is a strict **upper** bound on the true onset rate
--- so where the shortcut errs, it errs on the alarming side, and correcting it makes
the forecast *less* alarming, not more. Second, the gap is small: 0.74 % between
:math:`r_{\text{onset}}` and the shortcut, 1.1 % across the whole sandwich. The
shortcut is a good rate. What it is not is a distribution --- which is the subject of
7.4.
.. _b16-the-hazard-rises-it-does-not-start-at-its-final-value:
The hazard rises; it does not start at its final value
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The instantaneous risk of onset at time :math:`t`, given it has not yet happened, is
the **hazard**:
.. math::
h(t) \;=\; \frac{p_{\text{winter}}(t)}{P(T_{R \rightarrow D} > t)}
\;=\; \frac{r_{\text{onset}} r_{\text{relax}}
\left(e^{-r_{\text{onset}} t} - e^{-r_{\text{relax}} t}\right)}
{r_{\text{relax}} e^{-r_{\text{onset}} t} - r_{\text{onset}} e^{-r_{\text{relax}} t}}
At :math:`t = 0` the numerator vanishes, so :math:`h(0) = 0`. As :math:`t` grows the
:math:`e^{-r_{\text{relax}} t}` terms die away and :math:`h(t) \rightarrow
r_{\text{onset}}`. In between it rises monotonically.
**In plain terms:** onset cannot happen *immediately*, because the world must first
enter a crisis and the crisis must then run its course. That takes about forty days on
average. So the risk in the first weeks is genuinely lower than the long-run rate, and
it climbs to that rate within a few months. Numerically: :math:`h(0) = 0`,
:math:`h(1\,\text{yr}) = 0.033083`, :math:`h(100\,\text{yr}) = 0.033087`. The approach
is essentially complete after one year.
.. _b16-the-relaxation-rate-is-not-the-crisis:
The relaxation rate is **not** the crisis
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.. admonition:: A correction of identification, not of arithmetic
:class: important
b16 SIA-4 describes :math:`r_{\text{relax}} = 9.067`/yr (written :math:`r_2`
there before 2026m09d08) as "the fast stage, **the crisis itself**, mean duration
40 days". That is a helpful picture and it is very nearly
right, but strictly the identification does not hold, and a referee who checks it
will notice:
- the crisis clock is :math:`r_{M \rightarrow \text{out}} = 9.000`/yr, mean duration **40.58 days**
- the fast mode is :math:`r_{\text{relax}} = 9.067`/yr, mean **40.28 days**
They differ by 0.74 %, and :ref:`b16-why-the-smaller-root-is-the-onset-rate` shows :math:`r_{\text{relax}} > r_{M \rightarrow \text{out}}`
strictly whenever :math:`r_{M \rightarrow R} > 0`. Both round to "40 days", so **no published
number is affected.** But the two exponentials in the closed form are *decay modes
of the whole system*, not the two physical stages of one round.
Here is the cleanest way to see that they are genuinely different decompositions.
**The physical decomposition.** Let :math:`n_{MAD}` be the number of crises
before one escalates. Total time waiting in Risky is a sum of :math:`n_{MAD}`
exponentials at rate :math:`r_{R \rightarrow M}`; total time spent inside crises is a sum of the
same :math:`n_{MAD}` exponentials at rate :math:`r_{M \rightarrow \text{out}}`. Section 8.1
shows each of these totals is itself exponential, with rates
:math:`r_{R \rightarrow M} p_{M \rightarrow D} = 0.03333` and :math:`r_{M \rightarrow D} = 3` respectively --- means
30 years and 1/3 year, adding to 30.333. **The means are right.**
**But these two pieces are not independent.** They share the same
:math:`n_{MAD}`: a world unlucky enough to need six crises spends longer at
*both* activities. So the variance does not add:
.. list-table::
:header-rows: 1
:widths: 56 22 22
* - Variance of the waiting time
- value (yr²)
- source
* - if the physical pieces were independent
- 900.11
- :math:`1/(r_{R \rightarrow M} p_{M \rightarrow D})^2 + 1/r_{M \rightarrow D}^2`
* - true value
- 913.44
- :math:`1/r_{\text{onset}}^2 + 1/r_{\text{relax}}^2`
* - implied covariance between the pieces
- +6.67
- half the difference
* - covariance, measured by simulation
- +6.66
- 200,000 runs
The closed form's two exponentials **are** independent --- that is what the
factorisation of the transform means --- but they are a *different pair* from the two
physical stages. Both pairs give the same mean; only the closed-form pair also gives
the right spread. This is why the derivation cannot be short-circuited by "just add the
waiting and the crisis time as if independent".
.. _b16-the-shifted-exponential-picture-and-where-the:
The shifted-exponential picture, and where the shortcut fails
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
For :math:`t` beyond a few months the :math:`e^{-r_{\text{relax}} t}` term is negligible
and
.. math::
P(T_{R \rightarrow D} > t) \;\approx\; \frac{r_{\text{relax}}}{r_{\text{relax}} - r_{\text{onset}}}\,
e^{-r_{\text{onset}} t}
\;=\; e^{-r_{\text{onset}}(t - t_{0})},
\qquad
t_{0} = \frac{1}{r_{\text{onset}}}\ln\!\frac{r_{\text{relax}}}{r_{\text{relax}}-r_{\text{onset}}}
With base-case values :math:`t_0 = 0.1105` yr = **40.4 days**, and expanding the
logarithm shows :math:`t_0 \approx 1/r_{\text{relax}}` = 40.3 days. So the entire exact
law can be described in one sentence:
.. admonition:: The whole result in one sentence
:class: tip
**The waiting time behaves like an exponential of rate 0.0331 per year that starts
about forty days late.**
That forty-day delay is why one horizon, and only one, needs the exact law.
.. list-table:: Table D. The retired exponential shortcut, measured against the exact law
:header-rows: 1
:widths: 22 20 20 38
* - horizon
- shortcut :math:`1-e^{-t/T_{R \rightarrow D}}`
- exact
- error
* - 1 yr
- 3.243 %
- 2.900 %
- **overstates by 11.8 %**
* - 10 yr
- 28.084 %
- 27.907 %
- +0.18 percentage points
* - 20 yr
- 48.281 %
- 48.216 %
- +0.07 pp
* - 40 yr
- 73.251 %
- 73.282 %
- |approx| 0.03 pp
At one year the forty days are 11 % of the window, and the shortcut --- an exponential
fitted to the correct mean --- ignores them. Over a decade or more the delay is
irrelevant. **The one-year figure is the one everyone quotes, and it is the only one
the shortcut got wrong.**
Across the four scenarios of b16 Table 3 the one-year overstatement is 12.3 %, 11.8 %,
11.5 % and 10.6 % --- so "about 11--12 percent", not "about 12 percent in every
scenario" as b16 currently says (b16-extra section 13).
.. admonition:: Reported because it is the paper's own standard
:class: note
An earlier draft of b16 computed the headline one-year probability with this
shortcut and called it exact: **3.24 % (1 in 31)** where the true figure is
**2.90 % (1 in 34)**. No conclusion changed. But a paper whose only request is that
others check its arithmetic has no standing to make that request until it has
checked its own --- which is also why this document exists.
.. _b16-which-question-is-being-asked-and-what-we-are-not-in:
Which question is being asked --- and what "we are not in a crisis today" is worth
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
An objection worth taking seriously: *the world has been running for eighty years, so
any "start-up" correction is an artefact of where the model happens to start the clock.
In reality the system started up long ago.*
The objection is half right, and working out which half is instructive --- because both
halves turn out to be computable, and they give different answers to the question
everyone quotes.
**Two legitimate starting conditions.**
*(a) Start from Risky, known.* This is what b16 does. It encodes a fact we actually
possess: **as of today the world is not in an acute nuclear crisis.** Onset therefore
cannot happen in the next few weeks without a crisis first arriving and then running its
course, so the hazard begins at zero and relaxes upward.
*(b) Start from the long-run condition.* Ask instead for a *typical* year, with no
knowledge of today's state. The right initial condition is then the quasi-stationary
distribution --- 98.9 % Risky, 1.1 % already in a crisis.
**Under (b) the correction vanishes exactly.** Started from the quasi-stationary
distribution, the waiting time is **precisely exponential** at rate
:math:`r_{\text{onset}}`, with no second term at any horizon:
.. math::
P(T > t) \;=\; e^{-r_{\text{onset}}\, t}
\qquad\text{(exact, for a quasi-stationary start)}
This is the defining property of a quasi-stationary distribution, and it is checked
numerically against the full two-exponential formula in ``code/crosschecks.py``: the two
agree to machine precision at 0.25, 1, 5, 20 and 80 years.
.. list-table:: Table J. The same model, two questions
:header-rows: 1
:widths: 44 20 18 18
* - Question
- Law
- :math:`P(\leq 1\text{ yr})`
- used by
* - **(a)** "We are not in a crisis today. What is the chance within a year?"
- two exponentials
- **2.90 %**
- b16
* - **(b)** "In a typical year, what is the chance?"
- one exponential, rate :math:`r_{\text{onset}}`
- **3.25 %**
- ---
**Three things follow.**
**1. The relaxation rate is not academic; it is the price of information.** The gap
between the two rows --- 0.35 percentage points, about 11 % of the figure --- is exactly
what the knowledge "no crisis is running today" buys. Drop
:math:`r_{\text{relax}}` from the treatment and that knowledge cannot be expressed at
all; the model would have to answer question (b) while being asked question (a).
**2. b16's choice is the conservative one, and this was not previously stated.**
Question (b) is arguably the more natural reading of "the annual probability", it is
simpler, and **it gives the larger number.** b16 reports the smaller. That is the right
instinct for a paper asking to be checked, but it should be said out loud rather than
left for a reader to discover --- and it answers in advance a critic who suspects the
two-exponential machinery of having been introduced to inflate anything. It deflates.
**3. It also explains the retired shortcut.** The exponential shortcut that an earlier
draft used, :math:`1 - e^{-t/T_{R \rightarrow D}}`, gives 3.24 % --- almost exactly
row (b). The shortcut was not nonsense; **it was the right answer to the wrong
question.** That is a more useful diagnosis than "it was wrong", and it is the reason
the error was hard to see.
.. admonition:: What this does *not* license
:class: warning
Row (b) is not an alternative headline to be quoted when it suits. The two rows
answer different questions, and only one of them is the question a reader asks when
they ask "what is the risk *now*". Reporting (a) while a crisis is in fact running
would understate the risk badly --- the hazard from inside a crisis is
:math:`r_{M \rightarrow D} = 3`/yr, ninety times the long-run rate. The model's
answer depends on the state of the world at the moment it is asked, which is a
feature, not an inconsistency.
.. _b16-onset-is-certain-only-its-schedule-is-uncertain:
Onset is certain; only its schedule is uncertain
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.. _b16-the-statement:
The statement
^^^^^^^^^^^^^
For **any** positive escalation rate, however small, the world reaches Dead with
probability one.
*Proof.* Crises keep arriving: since gaps have finite mean, the number of crises by
time :math:`t` grows without bound as :math:`t \rightarrow \infty`. Each escalates
independently with probability :math:`p_{M \rightarrow D} > 0`, so the chance that the first
:math:`n` all fail to escalate is :math:`(1-p_{M \rightarrow D})^{n} \rightarrow 0`.
Therefore :math:`P(\text{onset eventually}) = 1`. ∎
The same conclusion is visible in the closed form: both exponentials in
:math:`P(T_{R \rightarrow D} > t)` decay, so :math:`P(T_{R \rightarrow D} \leq t) \rightarrow 1`.
**Nothing about this depends on the size of the rates.** They set the *schedule*. They
do not set the *outcome*.
.. _b16-rates-that-change-over-time:
Rates that change over time
^^^^^^^^^^^^^^^^^^^^^^^^^^^
Assumption A3 (constant rates) can be dropped too. If :math:`r_{R \rightarrow M}(t)` varies, onset
remains certain provided crises keep coming --- formally, provided
:math:`\int_0^{\infty} r_{R \rightarrow M}(t)\, dt = \infty` and the escalation probability does
not fall to zero fast enough for :math:`\sum_i p_i` to converge. Since b16 SIA-X2 argues
that :math:`r_{R \rightarrow M}` has been **rising**, the constant-rate model is conservative in
the direction that matters: a rising crisis rate shortens the wait.
.. _b16-the-consequence-that-policy-has-to-face:
The consequence that policy has to face
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Take a risk-reduction programme far more successful than anything achieved in eighty
years: **ten times fewer crises** (:math:`r_{R \rightarrow M} = 0.01`/yr) **and** crises three
times less likely to escalate (:math:`p_{M \rightarrow D} = 1/9`). Then
.. math::
\mathbb{E}[T_{R \rightarrow D}] \;=\; 9 \times 100\ \text{yr} + \tfrac{1}{3}\ \text{yr}
\;=\; \mathbf{900\ years}
A thirty-fold improvement in the schedule --- and the destination is unchanged.
.. admonition:: The strongest objection to this, answered honestly
:class: note
*"Nine hundred years is not a problem. Take the win."*
That objection deserves a straight answer rather than a dismissal, and the straight
answer has two parts.
**First, it is right about the size of the prize.** Ten times fewer crises would be
the greatest achievement in the history of arms control, and this arithmetic says
its value is enormous. Nothing here argues against risk reduction; the model
*quantifies* how much good it does.
**Second, it is wrong about the kind of thing it is buying.** Nine hundred years is
a mean under the assumption that the improvement is permanent. No arms-control
arrangement in the nuclear age has been permanent. The 1987 INF Treaty lasted 32
years. New START, the last instrument limiting the two largest arsenals, expired on
2026m02d05 with no successor agreed. When an arrangement lapses, the rates return ---
and the memorylessness of :ref:`b16-what-a-rate-means` means the world gets no credit for the quiet
years it banked. **Risk reduction buys time; only removing the arrow changes the
destination.**
That is not this paper's opinion. It is what a first-passage calculation says about
an absorbing state, and it is why elimination and risk-reduction are different
*kinds* of measure rather than different amounts of the same one.
SIA-5 --- Claude's statistics table (scenarios and sensitivity)
----------------------------------------------------------------------------
All figures come from the exact first-passage distribution (SIA-4), with :math:`r_{M \rightarrow R} = 6`/yr,
:math:`r_{M \rightarrow D} = 3`/yr, per-crisis death probability :math:`p_{M \rightarrow D} = r_{M \rightarrow D}/r_{M \rightarrow \text{out}} = 1/3`. No figure in
these tables is offered as invariant; the claim that is invariant is the *inequality* of the final
column (the car-crash comparison, SIA-9), which holds in **every** scenario, including the most
optimistic.
.. list-table:: Table 3. Waiting times to onset of accidental nuclear winter, by scenario
:class: longtable
:header-rows: 1
:widths: 22 8 8 8 8 8 8 8 8 14
* - Scenario
- crisis rate /yr
- mean
- median
- |leq| 1 yr
- |leq| 10 yr
- |leq| 20 yr
- |leq| 40 yr
- |leq| 80 yr
- x car-crash [#carcrash]_
* - optimistic *(= Tertrais)*
- 0.03
- 100.3 yr
- 69.6 yr
- 0.88%
- 9.40%
- 18.00%
- 32.83%
- 54.94%
- **18x**
* - **base (4-in-40)**
- **0.10**
- **30.3 yr**
- **21.1 yr**
- **2.90%**
- **27.91%**
- **48.22%**
- **73.28%**
- **92.89%**
- **58x**
* - *(= Lewis et al.)*
- 0.15
- 20.3 yr
- 14.1 yr
- 4.30%
- 38.68%
- 62.60%
- 86.09%
- 98.08%
- 87x
* - pessimistic
- 0.30
- 10.3 yr
- 7.2 yr
- 8.34%
- 61.99%
- 85.71%
- 97.98%
- 99.96%
- 168x
.. [#carcrash] Individual annual mortality is :math:`P(\text{onset} \le 1\text{ yr}) \times q_{\text{dead}}`,
against the **global** road-death baseline of :math:`1.49\times10^{-4}` per person per
year (WHO 2023: 1.19 million deaths, ~15 per 100,000) and :math:`q_{\text{dead}} = 0.3`. Earlier
drafts used the US rate, which is *lower* than the global rate and therefore inflated
this column; the claim is about most people, so the baseline must be too. SIA-9
gives the full ladder, including the worst-affected country on record.
**Sensitivity to the per-crisis death probability.** The escalation probability 1/3 is the paper's
softest structural input (SIA-6, SIA-11). Varying it from 1/10 to 1/2 --- the full range anyone has
proposed, spanning both ends of Kennedy's estimate --- while holding the crisis rate at its base value
of 0.1/yr:
.. list-table:: Table 9. Sensitivity to the per-crisis death probability
:class: longtable
:header-rows: 1
:widths: 16 22 14 14 16 18
* - per-crisis death prob.
- implied rates
- mean
- median
- P(onset |leq| 1 yr)
- x car-crash
* - 1/10
- ``rMADcrisisCalms`` = 27, ``rMADcrisisToWinter`` = 3
- 100.3 yr
- 69.6 yr
- 0.96%
- 19x
* - 1/5
- ``rMADcrisisCalms`` = 12, ``rMADcrisisToWinter`` = 3
- 50.3 yr
- 34.9 yr
- 1.84%
- 37x
* - **1/3 (base case)**
- ``rMADcrisisCalms`` **= 6,** ``rMADcrisisToWinter`` **= 3**
- **30.3 yr**
- **21.1 yr**
- **2.90%**
- **58x**
* - 1/2 *(= Kennedy's upper end)*
- ``rMADcrisisCalms`` = 3, ``rMADcrisisToWinter`` = 3
- 20.3 yr
- 14.1 yr
- 4.05%
- 82x
The parameter moves the waiting time, not the direction. Across the whole range the mean wait moves by
a factor of five and the car-crash comparison never falls below **19x** --- so even at 1/10, below
anything the paper's structure or its anecdotal anchor suggests, an individual remains an order of
magnitude more likely to die of accidental nuclear winter than in a car crash. And stochastic certainty
holds for any death probability above zero (Section 8): the parameter sets the schedule, not the
outcome.
SIA-6 --- Calibrating the crisis rate, and the 1/3
----------------------------------------------------------------------------
Everything in the forecast is either structural or algebra (SIA-4); two numbers must come from the
world. This appendix fixes both: the crisis rate :math:`r_{R \rightarrow M}`, and the per-crisis death probability
:math:`p_{M \rightarrow D} = 1/3`.
**These two are not separately identified, and this appendix does not pretend otherwise.** Fixing
:math:`p_{M \rightarrow D}` at 1/3 is part of what *defines* which near-disasters count as entries into a
MAD crisis and are therefore counted by ``rMADcrisisStarts``; a higher true per-crisis chance implies a
correspondingly lower effective crisis rate, and the forecast depends on their **product**. The
trade-off is worked out exactly in :doc:`b16-extra
<../extra/b16-extra-waiting-time-derivation_mmv1_2026m09d07>`, section 14.1 --- the one place that
does so.
**The criterion, fixed before counting.** A *civilization-threatening nuclear crisis* --- an entry into
the MAD crisis state --- is any incident in which at least one nuclear-armed party's command authority was
confronted with a launch/no-launch decision, or in which nuclear weapons were physically brought to the
brink of detonation. This criterion was fixed **before** counting and is applied unchanged below. A
criterion adjusted after seeing the count is not a measurement.
**The source.** Rather than assemble a private list, the paper calibrates against the largest published
catalogue: the 60 historical incidents of Baum, de Neufville and Barrett (2018) :cite:`Baum2018`. Using
someone else's data removes one degree of freedom from an exercise that has too many; the classification
below is the paper's own and is the part a reader should attack first.
**Incidents are not excursions.** This distinction does most of the work. Six of Baum et al.'s sixty
entries belong to the *same* Cuban missile crisis (the crisis itself, the Duluth--Volk bear incident,
the B-59 submarine, the Okinawa missile order, the Florida satellite false alarm, and the Penkovsky
false warning). The parameter :math:`r_{R \rightarrow M}` counts **entries into the MAD crisis state**, not incidents, so
those six contribute **one**. Lewis et al. (2014) :cite:`Lewis2014` independently list four separate
Cuban-crisis entries, corroborating the distinction from outside this paper. A catalogue of sixty
incidents therefore does not imply sixty crises, and any calibration that treats it as one overstates
:math:`r_{R \rightarrow M}` by roughly an order of magnitude.
**What the classification returns.** Of the sixty, **twenty-seven are excluded as peripheral** (threat
rhetoric, contingency studies, failed non-state acquisition, weapons accidents with no live launch
pathway); a further **twenty-three are serious but were caught by procedure** rather than by human
judgment or luck. The remainder, after collapsing the Cuban-crisis entries, are the five excursions of
Table 1 --- of which **four fall inside the forty Cold-War years**, giving
.. math::
r_{R \rightarrow M} \;\approx\; \frac{4}{40} \;=\; 0.1 \text{ per year}
.. list-table:: Table 1. Historical entries into the MAD crisis state, 1945--2026
:class: longtable
:header-rows: 1
:widths: 5 7 18 38 20 12
* - #
- Year
- Event
- Explanation --- what actually happened
- Why it qualifies
- Cold War?
* - 1
- 1961
- Berlin Crisis [#berlin]_
- The USSR demanded Western forces leave West Berlin. In October, Kennedy considered a
first strike: a White House/Pentagon group produced a detailed plan to destroy Soviet
second-strike capability by attacking 1,077 targets, after intelligence showed a much
larger US arsenal than believed. He gave a speech instead.
- a disarming first-strike plan reached the President's desk
- yes
* - 2
- 1962
- **Cuban Missile Crisis**
- The reference event. Thirteen days. Internally it contains at least five further
incidents (see note below), including the B-59 submarine, whose captain ordered the
nuclear torpedo prepared and then, after consulting Vasili Arkhipov and the political
officer, surfaced instead (the account, and what is contested in it: SIA-X7).
- launch decisions reached officers with authority; human judgment, not procedure,
stopped them
- yes
* - 3
- 1983
- Petrov (Serpukhov-15) [#petrov]_
- Soviet satellites indicated an incoming US missile launch. Duty officer Stanislav
Petrov judged it a false alarm and declined to report it. He was right: sunlight on
high cloud.
- a launch indication reached a human whose judgment was the filter
- yes
* - 4
- 1983
- Able Archer
- A realistic NATO command exercise simulating nuclear release, during a period when
Soviet leadership feared a genuine first strike. Soviet leadership moved to bunkers;
nuclear bombers went to runway alert.
- Baum: "how close they were to launching their own attack is unclear"
- yes
* - 5
- 1995
- Norwegian Rocket
- A Norwegian scientific rocket matched the flight profile of a submarine-launched
missile intended to blind Russian radar by EMP. Russian forces went to full alert and
Yeltsin activated the nuclear command suitcase --- the only confirmed activation.
- launch authority was physically engaged by a head of state
- no
* - --
- 1945
- World War II [#ww2]_
- The atomic bombings of Hiroshima and Nagasaki: the only historical instance of nuclear
war.
- **excluded from the rate** --- see [#ww2]_
- --
.. [#petrov] **Petrov --- retained, with the reservation recorded.** On Baum's text alone, roughly
five missiles were indicated, which is implausible for a first strike, and downstream
corroboration would very likely have failed; on a strict reading the decision never
reached release authority. He is retained because he is among the most widely
acknowledged near-misses and because Lewis et al. (2014) independently include him
(Serpukhov-15, Table 1). **The forecast does not depend on him:** excluding Petrov gives
three Cold-War excursions, a crisis rate of 0.075/yr, and an annual onset probability of
2.19 percent --- 1 in 46.
.. [#ww2] **World War II --- excluded from the rate, and why it is nonetheless in the table.**
It was a one-sided use, not an entry into the two-sided crisis state this model tracks,
so it is not an observation of :math:`r_{R \rightarrow M}`. What it establishes is not a probability
but a **capability**: that these weapons were in fact deployed against whatever
objections stood in the way at the time. The model assumes :math:`r_{M \rightarrow D} > 0`. World War II is
the observation that :math:`r_{M \rightarrow D} > 0` is not a hypothesis.
.. [#berlin] **Berlin 1961 is this paper's own addition** and is not in Lewis et al.'s list. It is
included because a live disarming-first-strike plan reaching a head of state meets the
criterion above more directly than several incidents that are conventionally
listed. A reader who rejects it should use the three-excursion row above.
**The two published poles, and what each implies.** How many incidents count as near nuclear use is
contested, and Baum names the dispute: *"analysts disagree on how close they were to nuclear war --- for
example, Lewis et al. (2014) consider them to have come pretty close, while Tertrais (2017)
disagrees."* Rather than adjudicate it, this paper reports both poles.
.. list-table:: Table 2. What the two published poles imply for :math:`r_{R \rightarrow M}`
:class: longtable
:header-rows: 1
:widths: 20 10 34 24 12
* - Position
- Count
- Explanation --- what they counted
- :math:`r_{R \rightarrow M}` (/yr)
- P(onset |leq| 1 yr)
* - **Tertrais (2017)**, skeptical
- 1
- 37 episodes reviewed; concludes safety mechanisms held throughout, and that only one
significant incident has occurred in ~34 years (Black Brant, 1995). Excludes
accidents, unauthorized launch, and terrorism by stated scope.
- **0.029**
- 0.85% (1 in 117)
* - **This paper**, Table 1
- 4 (Cold War)
- Berlin 1961, Cuba 1962, Petrov 1983, Able Archer 1983; criteria fixed before counting;
Norwegian Rocket 1995 falls outside the Cold-War window.
- **0.100**
- 2.90% (1 in 34)
* - **Lewis et al. (2014)**, inclusive
- 6 (Cold War)
- Their Table 1 lists 13 cases of near nuclear use; collapsed to excursions (four of the
thirteen are Cuban-crisis entries) this gives six Cold-War excursions: Cuba 1962, the
1973 Arab--Israeli war, NORAD 1979, NORAD 1980, Serpukhov-15 1983, Able Archer 1983.
- **0.150**
- 4.30% (1 in 23)
* - **Lewis et al.**, whole era
- 10 / 77 yr
- Adds the 1991 Soviet coup, Black Brant 1995, Kargil 1999, and the 2001--02 Kashmir
standoff.
- **0.130**
- 3.75% (1 in 27)
Three things follow. **The scenario range of the tables contains both published poles:** the optimistic
corner (0.03/yr) is Tertrais's implied rate; the pessimistic corner (0.3/yr) lies *above* Lewis et
al.'s and rests on the non-stationarity argument of SIA-X2, where it is argued rather than cited.
**The base case is more conservative than Chatham House:** Lewis et al.'s reading implies 1 in 23 per
year against the base case's 1 in 34, so a paper adopting the most inclusive published position
wholesale would forecast a *higher* risk than this one. **And the disagreement is narrower than it
looks:** the two poles are separated by a factor of about five in :math:`r_{R \rightarrow M}`, and --- because the
car-crash inequality (SIA-9) is robust across that whole span --- they are not separated at all on the
question the paper actually asks.
**The 1/3, and why it is structural rather than measured.** When the system enters a crisis, two
competing processes race: de-escalation (rate :math:`r_{M \rightarrow R} = 6`) and escalation to exchange (rate
:math:`r_{M \rightarrow D} = 3`), so :math:`p_{M \rightarrow D} = r_{M \rightarrow D}/r_{M \rightarrow \text{out}} = 1/3`. This is not arbitrary: it is grounded in
the three-mode failure pattern (over-Simplify, over-Complicate, over-Reach) formally derived in
:doc:`Matheo-b12 ` (the OSCR Collapse theorem). A crisis resolves through one
of three modes --- reduced to a manageable narrative (returns to Risky), buried under diplomatic
work-arounds (returns to Risky), or pushed past the point of no return (Dead). Two of three de-escalate,
one escalates; hence :math:`r_{M \rightarrow R} = 6` (two escape modes at rate 3) and :math:`r_{M \rightarrow D} = 3` (one death mode).
**The equiprobability of the three modes is a modelling assumption, not a derived result** --- it is the
weakest joint in the paper, and SIA-5 shows the direction survives across the full :math:`p_{M \rightarrow D}`
range from 1/10 to 1/2.
**The only empirical anchor is weak, and it brackets rather than corroborates.** President Kennedy
privately estimated the probability of nuclear war during the Cuban crisis at "somewhere between one in
three, and even" (Sorensen, *Kennedy*, 1965; via Allison and Zelikow, *Essence of Decision*, 2nd ed.,
1999). This is the closest thing to a measurement of :math:`p_{M \rightarrow D}` that exists: one
participant's subjective estimate, from inside one crisis, recorded second-hand. Against his range of
1/3 to 1/2, the model's 1/3 is the **low** end. Against the historical record read through Laplace's
rule of succession (SIA-11), the model's 1/3 is roughly **3.7x too high** at :math:`n = 4`. The two
available anchors pull in opposite directions; the chosen value sits between them, closer to the one
that produces the lower forecast. The parameter is bracketed, not measured, and the paper says so rather
than picking the flattering anchor and calling it support.
SIA-7 --- Why Michaelis--Menten kinetics matters (the general case)
----------------------------------------------------------------------------
.. epigraph::
*In se magna ruunt* --- great things collapse upon themselves.
-- Lucan, *Bellum Civile* (*Pharsalia*) I.81 (c. AD 61--65)
That complex magnificence tends to fail suddenly, and under its own weight, is an intuition roughly
two thousand years old. It is not this paper's discovery, and it is not offered here as evidence ---
a poet's observation is not a rate. What the ancient version lacks is the two things that would make
it usable: a **mechanism** that says why such failure is sudden rather than gradual, and a **number**
that says how long one should expect to wait. This appendix supplies the first; SIA-8 supplies the
second. The reason to record the intuition at all is that it is old and widely shared, which makes
the finding below less exotic than it may first appear --- and correspondingly harder to dismiss as
a modern alarm.
*This appendix carries no numbers; SIA-8 carries them.* Onset is a two-step scheme: the world must
first enter a crisis (Risky |rarr| MAD crisis), and the crisis must then commit to exchange rather than
resolve (MAD crisis |rarr| Dead). A two-step scheme with a reversible first step and a committed second is
exactly the **Michaelis--Menten** form used for enzyme kinetics --- substrate binds, then either
releases or is converted. Three consequences follow for *any* positive rates, independent of the
calibration:
- **Saturation.** There is a maximum onset hazard --- you cannot die faster than the escalation rate
:math:`r_{M \rightarrow D}` --- so the process behaves like a mechanism that can only work so fast.
- **Long idle stretches.** A saturating process that is in its dangerous state a small fraction of the
time produces long calm periods as a matter of course, then ends one. Non-observation is the
expected behaviour, not evidence of safety.
- **Memorylessness.** No anniversary is a deadline; the wheel is spun afresh each year. That is what
makes the risk durable and the intuition about it unreliable.
**Why the analogy earns its keep --- and it is not an analogy.** The value of Michaelis--Menten kinetics
has never been that enzymes are simple. An enzyme is a large machine wandering an enormous configuration
space, and the details of how it finds and binds its substrate are, in the general case, hopeless to
model. The achievement of the treatment is that *you do not need them*: all that complexity is absorbed
into an effective encounter rate, and the waiting time to product follows from that rate and two others.
The same structure holds here, and it is the reason this paper can exist. The "configuration space" is
the space of historical causal chains --- every way the world can arrange itself into a nuclear crisis,
which no one can model. It need not be modelled, because the encounter rate can be **measured** instead,
from the record of times the world did in fact enter that state (SIA-6). The near-miss record plays
exactly the role a measured :math:`k_{on}[S]` plays in enzymology: the empirical stand-in for a
mechanism too complex to derive. And the correspondence is not loose --- solving the scheme's own
first-passage equations for the rate of reaching Dead returns the Michaelis--Menten rate law at every
point, the same function rather than an approximation in a limit (SIA-8 gives the identity and the
numbers).
SIA-8 --- The Michaelis--Menten numbers (this system)
----------------------------------------------------------------------------
**The identity, exactly.** Solving the first-passage equations (SIA-4) for the rate at which the chain
reaches Dead gives
.. math::
v(r_{R \rightarrow M}) \;=\; \frac{1}{T_{R \rightarrow D}} \;=\; \frac{r_{R \rightarrow M}\, r_{M \rightarrow D}}{r_{R \rightarrow M} + r_{M \rightarrow R} + r_{M \rightarrow D}}
which is **identical, at every point**, to the Michaelis--Menten rate law
.. math::
v \;=\; \frac{V_{max}\, S}{K_m + S}
under the reading below. This is not an analogy that holds in a limit; it is the same function.
.. list-table:: The dictionary
:header-rows: 1
:widths: 26 40 14 20
* - Michaelis--Menten
- RiskyMAD
- Value
- Meaning here
* - substrate :math:`S`
- crisis rate :math:`r_{R \rightarrow M}`
- 0.1/yr
- how often the world enters a nuclear crisis
* - :math:`K_m`
- :math:`r_{M \rightarrow \text{out}}`
- 9/yr
- how fast a crisis resolves, either way
* - :math:`V_{max}`
- :math:`r_{M \rightarrow D}`
- 3/yr
- the escalation step --- **you cannot die faster than this**
* - :math:`k_{cat}/K_m`
- :math:`V_{max}/K_m = r_{M \rightarrow D}/r_{M \rightarrow \text{out}}`
- 1/3
- the specificity constant
* - commitment to catalysis
- :math:`p_{M \rightarrow D} = r_{M \rightarrow D}/r_{M \rightarrow \text{out}}`
- 1/3
- the fraction of crises that go all the way
The defining property holds **exactly**: the rate is half-maximal when :math:`S = K_m`, and here
:math:`v(9) = 1.5 = V_{max}/2`. The system saturates: as :math:`r_{R \rightarrow M} \rightarrow \infty`,
:math:`v \rightarrow r_{M \rightarrow D}` --- however often crises arrive, the world cannot be destroyed faster than the
escalation step permits.
**Where this system sits.** With :math:`r_{R \rightarrow M} = 0.1`/yr and :math:`K_m = 9`/yr,
.. math::
\frac{S}{K_m} \;=\; \frac{r_{R \rightarrow M}}{r_{M \rightarrow \text{out}}} \;=\; 0.011
--- **ninety times below half-saturation**. The system is deep in the first-order regime, which is
*why* the simple product :math:`r_{R \rightarrow M} \cdot p_{M \rightarrow D}` works at all: it is the low-substrate limit of
a saturating law, and it agrees with the exact solution to 1.1 percent. Saturation would require a
crisis roughly every six weeks. The model therefore operates where the correspondence is not merely
valid but linear --- the easy case, and the one most favourable to a sceptical reader.
**A consistency check that was not fitted.** The parameters :math:`r_{M \rightarrow R}` and :math:`r_{M \rightarrow D}` were set from the
three-mode structure (SIA-6) with no reference to crisis durations. Yet they imply a mean crisis
resolution time of :math:`1/r_{M \rightarrow \text{out}} \approx 40` days; the Cuban missile crisis lasted thirteen. Those
agree to well within an order of magnitude, from a parameter fixed for independent reasons --- offered
not as confirmation but as the absence of a contradiction that could easily have appeared.
**What the quiet years prove.** The system spends about **one percent of its time** in the bound state:
:math:`r_{R \rightarrow M}/(r_{R \rightarrow M}+r_{M \rightarrow R}+r_{M \rightarrow D}) \approx 0.011`. The rest of the time the doomsday substrate is elsewhere
and the world looks safe --- because it *is* safe, most of the time. A process quiescent 99 percent of
the time and lethal 1/3 of the time it is not will produce long calm stretches as a matter of course: at
the base rate the median wait is 21 years, yet roughly one run in forty survives past 127 (both are the
same model). An observer inside the long run concludes the risk is small; an observer inside the short
one does not; neither observation moves the underlying rate. The non-observation of nuclear war since
1945 is precisely what this model predicts most of the time, and is therefore weak evidence about the
parameters --- a property of the variance of first-passage times in a saturating two-step scheme, and
checkable by running the model.
SIA-9 --- The car-crash comparison
----------------------------------------------------------------------------
The forecast is made tangible against a mortality risk societies accept without alarm: dying in a
motor-vehicle crash. The comparison must be like-for-like --- **annual probability, per person, death
against death** --- so three quantities are kept distinct.
**The baseline.** Road traffic kills about **1.19 million people a year** worldwide, roughly **15 per
100,000**, or :math:`1.49\times10^{-4}` per person per year :cite:`WHO2023RoadSafety`. The paper uses
the **global** figure, because its claim is about most people. The US rate
(:math:`1.22\times10^{-4}`; 40,901 deaths at 12.21 per 100,000 in 2023 :cite:`NHTSA2024`) is *lower*
than the global average, so using it would inflate every multiplier below --- the direction a motivated
author would choose, and the reason not to.
**The model's output is not a mortality.** RiskyMAD forecasts the annual probability that accidental
nuclear winter *begins*, not the probability that a given individual dies. The two differ by the death
fraction
.. math::
q_{\text{dead}} \;=\; P(\text{individual dies} \mid \text{nuclear winter begins})
so individual annual mortality is :math:`P(\text{onset}) \times q_{\text{dead}}` --- and it is this product, not
:math:`P(\text{onset})`, that may be set beside the road-death figure.
**Where** :math:`q_{\text{dead}}` **comes from.** It is not this model's output. Xia et al. (2022) estimate that even
a *small* regional exchange (~100 warheads, 5 Tg soot) causes about **2 billion** famine deaths within
two years, while a full US--Russia exchange (150 Tg) causes **over 5 billion** :cite:`Xia2022`. Against
a world near 8 billion those are :math:`q_{\text{dead}} \approx 0.25` and :math:`q_{\text{dead}} \approx 0.63`. This paper uses
:math:`q_{\text{dead}} = 0.3`, near the **low** end and corresponding to the smallest exchange anyone models.
.. list-table:: Table 6. Individual annual mortality against the global road-death baseline
:header-rows: 1
:widths: 30 16 24 30
* - Scenario
- P(onset |leq| 1 yr)
- Individual mortality
- Relative to road deaths
* - optimistic (= Tertrais's implied rate)
- 0.88%
- :math:`2.6 \times 10^{-3}`
- **18x**
* - **base**
- **2.90%**
- :math:`8.7 \times 10^{-3}`
- **58x**
* - Lewis et al.'s implied rate
- 4.30%
- :math:`1.3 \times 10^{-2}`
- 87x
* - pessimistic
- 8.34%
- :math:`2.5 \times 10^{-2}`
- 168x
**The stress test.** Three inputs are chosen rather than measured: the crisis rate, the death fraction,
and the baseline. A reader is entitled to suspect that three choices all landing in the paper's favour
is no coincidence --- so each is pushed to its least favourable defensible value **at the same time**.
.. list-table:: Table 7. Every soft input pushed against the conclusion, simultaneously
:header-rows: 1
:widths: 26 30 44
* - Input
- Least favourable defensible value
- Why that value is admissible
* - crisis rate
- **0.03/yr** (P = 0.88%)
- Tertrais's own reading of the record --- the most sceptical published position
(SIA-11)
* - death fraction :math:`q_{\text{dead}}`
- **0.25**
- Xia et al.'s *smallest* modelled exchange, 100 warheads :cite:`Xia2022`
* - baseline
- **7.3e-4/yr**
- Libya, ~73.4 per 100,000 (2013) --- **the highest national rate on record**, nearly
five times the global average :cite:`WHO2015RoadSafety` :cite:`GuinnessRoadDeath`
.. admonition:: What survives the stress test
Against the **global** baseline, with the most sceptical crisis rate and the lowest published death
fraction: **15x**. Against the road-death rate of **the worst-affected country on record** --- Libya,
at nearly five times the global average --- with those same two concessions: **3x**.
**The inequality holds at every corner, including all three corners at once.** It is not rescued by
any single input and cannot be attacked by disputing any single input. The multiplier is a range ---
roughly threefold at the most punishing corner constructible, sixtyfold at base, a few hundredfold at
the pessimistic one. The *direction* does not move.
**The scope switch, and why the number of billions does not matter.** Individual annual mortality is the
*only* axis on which these two risks are commensurable, which is why the comparison runs there. On every
other axis they differ, and every difference runs the same way. A car crash is **idiosyncratic**: it
kills you and perhaps a few others; the world continues, an insurer pays, the institutions that
investigate it exist the next morning. Nuclear winter is **systemic**: it kills you, everyone you know,
the institutions, the counterparty, and the investigator. This is why nothing depends on whether the
toll is one billion or eight: at :math:`q_{\text{dead}} = 0.25` the inequality holds; at :math:`q_{\text{dead}} = 1` it holds; only
the multiplier moves. A reader who wants to argue about the billions is arguing about a number the
conclusion does not use.
.. admonition:: The risk is not unpriced. It was priced, and the price was "uninsurable."
Nuclear war is excluded from essentially every insurance policy written --- property, casualty, life
--- by a standard **nuclear exclusion clause** :cite:`GAO2008NBCR`. Not because the risk is small,
but because it is **uninsurable in principle**: insurance requires risks that are independent, so a
pool can absorb them, and a solvent counterparty who survives to pay. Nuclear winter violates both by
construction. The US Treasury told Congress that war insurance "is not a feasible means for handling
war losses of the magnitude which might be expected in a nuclear conflict."
So the profession that prices catastrophic risk for a living has already examined this one and
declined it. The inequality in Table 6 is therefore not a claim that actuaries missed something; it
is a claim about what happens when a risk is *removed from the domain where risk expertise operates*
--- it stops being measured, then stops being mentioned, and then people conclude from the silence
that it is small. The government's own record shows the pattern: asked whether nuclear, biological,
chemical and radiological attacks were insurable, the resulting review :cite:`GAO2008NBCR` catalogued
the exclusions and the *severity* but did not estimate the *likelihood*; frequency was treated as
outside the question. That unasked question --- how often --- is the one this study answers.
.. caution:: :math:`q_{\text{dead}}` **is the softest number in this paper, and it is doing real work.** Every figure
in Table 6 scales linearly with it; it is anchored to Xia et al. :cite:`Xia2022` rather than derived
here, and the anchoring is coarse. A reader who prefers a different :math:`q_{\text{dead}}` may rescale the final
column directly. The inequality against the global baseline survives for any :math:`q_{\text{dead}} > 0.017` ---
computed at the **optimistic** corner, the one this paper leans on, and roughly fifteen times below
the lowest published estimate. (Taken at the base case the threshold would read :math:`q_{\text{dead}} > 0.004`,
which does not hold where the paper actually leans, so the optimistic-corner figure is the honest
one.)
SIA-10 --- Related work
----------------------------------------------------------------------------
.. _b16-what-is-new-here:
**What is new here, stated narrowly.** Priority in this field does not attach to the
subject, and this study does not claim it. Quantitative estimation of nuclear-war risk has
a published literature, summarised below, and the headline figure reached here
**corroborates** that literature rather than displacing it --- Hellman's current published
position of about 1 per cent per year sits within a factor of three of this paper's
base-case onset hazard. What follows is therefore a list of five narrow claims, each set
beside its nearest published relative, so that a reader can see exactly where this study
adds and exactly where it does not.
.. list-table:: The five claims, and what each is measured against
:class: longtable
:header-rows: 1
:widths: 32 36 32
* - Claimed as new
- Nearest published relative
- What the difference is
* - **The exact first-passage law**
- Barrett, Baum & Hostetler (2013): fault trees and **Poisson processes**
- a Poisson shortcut gives a rate; the first-passage law gives the waiting time whose
rate that is. The two differ by 1.1 % here, and the shortcut cannot produce the next
three rows at all.
* - **The whole distribution**, not a point estimate
- Hellman (2008, 2021): a single annual probability
- a mean of 30.3 years and a median of 21.1 are the same model; reporting one number
hides the spread that decides how a reader should act.
* - **Michaelis--Menten as an identity**, not an analogy
- the kinetics literature, used illustratively elsewhere
- the two rate laws are the **same function** under one substitution, at every
parameter value --- not an approximation holding in a limit.
* - **The mean survives without the exponential assumption**
- the memorylessness assumption, usually asserted and left
- the strongest objection a trained sceptic raises is answered rather than conceded.
* - **The identifiability result**
- --- (no published relative found)
- the crisis rate and the per-crisis chance are **not separately estimable** from this
record; only their product is. Anything that varies one while holding the other
fixed is reading the record wrongly.
.. admonition:: The evidence that the gap was open is cited, not asserted
:class: important
**Baum (2018)**, reviewing the field, lists *"quantify historical incidents in terms of
how far they went in their respective nuclear war scenarios"* among the things still to
be done, and warns that such incidents are *"prone to historical interpretation."*
SIA-6 does exactly that quantification, and inherits exactly that difficulty.
**A published review naming a contribution as an open problem is better evidence of a
gap than any timestamp**, and it is evidence a reader can check without taking the
author's word for anything.
Quantitative estimation of nuclear-war risk is a small literature. Barrett, Baum & Hostetler (2013)
:cite:`Barrett2013` :cite:`Barrett2013b` build the closest methodological ancestor: a framework of
fault trees and Poisson processes for inadvertent US--Russia nuclear war from misinterpreted
early-warning false alarms. Baum, de Neufville & Barrett (2018) :cite:`Baum2018` extend the scope to
fourteen scenarios and --- decisively for this paper --- compile the dataset of **60 historical
incidents** on which SIA-6 calibrates; Baum (2018) :cite:`Baum2018b` reviews the whole field.
Two findings of that review shape this paper. First, the quantification attempted here is named there as
*undone*: Baum lists "quantify historical incidents in terms of how far they went in their respective
nuclear war scenarios" as future work, and warns the incidents are "prone to historical
interpretation." SIA-6 does exactly that, and inherits exactly that difficulty. Second, the field's
bottleneck is **uptake, not analysis**: nuclear policy decisions "have made little use of risk
analysis... the limiting factor is mainly the use of risk analysis for decision-making, such that people
working on nuclear war risk should emphasize outreach to decision-makers." SIA-X3 and SIA-X5 are this
paper's engagement with that finding.
**A neighbouring literature, arriving from outside risk analysis.** Work on societal collapse reaches
nuclear war by an unrelated route. Kemp (2025) :cite:`Kemp2025` surveys the collapse of past societies
and turns in its later chapters to the present global order, naming nuclear war among the threats to
it alongside climate breakdown, artificial intelligence and pandemics. The convergence is worth noting
precisely because the method has nothing in common with the one used here. So is the limit: that
literature names the threat without estimating a rate for it. It therefore corroborates the *subject*
of this study and none of its numbers --- and it leaves open the same gap that Baum names as undone
and that SIA-9 finds in the insurance record. How often is the question, and it is the one this paper
answers.
**Hellman --- the nearest ancestor, and what he did with the number.** Hellman (2008)
:cite:`Hellman2008` is the closest predecessor: a fixed-rate chain on the Cuban crisis estimating
deterrence failure via a single mechanism, :math:`\lambda_{CMTC} = \lambda_{IE} P_1 P_2 P_3`, giving a
range of :math:`(2\times10^{-4},\, 5\times10^{-3})` per year. Three things must be said, because the
figure is routinely misused.
- **It is not a total-risk estimate.** Hellman states the analysis "neglects other trigger mechanisms
such as command-and-control malfunctions and nuclear terrorism" and "therefore underestimates the
threat" (p. 21). Citing its upper bound as his ceiling on nuclear-war risk misreads him.
- **He revised it upward, in print.** Hellman (2021) :cite:`Hellman2021` concludes the risk "currently
appears to be on the order of **1 percent per year**", with an order-of-magnitude range from ~0.3 to
3 percent (bounded above by 10 percent, below by 0.1). That is his current published position, and
the figure this paper's estimates should be read against --- within a factor of three of this paper's
base-case onset hazard (SIA-4).
- **He shaded two parameters downward for a stated non-epistemic reason:** "To temper the possibility of
this article being seen as alarmist, it only considers the first three possible initiating events."
That bears on audiences, not on the world. It is not a criticism of Hellman, who named his own
adjustment in print --- more than most --- and reached the right order of magnitude thirteen years
early; it is a criticism of the situation he was in, and it generalises (SIA-X5).
The upshot: an independent model, with no MAP and no stake in one, reaches within a factor of three of
this one. **This forecast is not an outlier** --- and it is more conservative than the most inclusive
published reading (SIA-6).
SIA-11 --- Strongest objections, and known weaknesses
----------------------------------------------------------------------------
Where the strongest sceptic and this paper agree is on *method*. Tertrais (2017)
:cite:`Tertrais2017` closes by proposing that "the conversation between proponents of deterrence and
anti-nuclear activists should revolve around the costs and benefits equation," and asks whether the
system is "tolerably safe." This paper is an attempt to write that equation down and to put a number
on "tolerably." The dispute is not about whether the question is a cost-benefit one --- the sharpest
critic says it is --- but about what the arithmetic returns once it is done.
**"In all the incidents, safety mechanisms worked" --- the strongest form of the sceptical case.**
Tertrais's most forceful argument is not that the world has been quiet (SIA-7 answers that) but
that in every documented near-miss one can *watch* the safeguard engage --- dual phenomenology,
fail-safe defaults, procedure holding "even in the early 1960s when they were rudimentary." That is
positive evidence of a working system, not mere absence of catastrophe, and it earns a positive
answer. The answer is to *grant it, and to have already priced only what it leaves behind.* The
calibration of SIA-6 excludes the twenty-three incidents "caught by procedure" precisely because
the system worked in them; they are not counted as entries into the MAD crisis state. What remains --- the
four Cold-War excursions --- are the cases in which procedure did *not* suffice and the filter was
human judgment or luck (Arkhipov, Petrov) or an unresolved question (Able Archer). The forecast is
built on the residue *after* the working system is credited in full. "The system worked" is
therefore not a rebuttal of this paper; it is one of its inputs. The disagreement is only over the
four times it did not --- and whether four in forty years is reassuring.
**Tertrais (2017): the strongest published objection.** :cite:`Tertrais2017` argues that mankind has
not repeatedly stood "on the brink", that the absence of any deliberate explosion since 1945 reflects
"human prudence and the efficiency of mechanisms devoted to the guardianship of nuclear weapons," and
--- most damagingly for a constant-rate model --- that "the probability of failure increases markedly
with time only if conditions do not change---and conditions do change." Four responses, in ascending
order of force.
#. **His implied rate is already in this paper.** One significant incident in thirty-four years is
:math:`r_{R \rightarrow M} \approx 0.029`/yr; the optimistic scenario uses 0.03/yr, chosen independently and
before the comparison was made. The most sceptical published reading and this paper's most optimistic
corner are the same number. The disagreement is not about that corner but about whether it is the
right one.
#. **His scope is narrower than this model's**, which is why his rate is a corner and not a centre. His
review, he states, "does not cover the risk of an accidental nuclear explosion, an unauthorized
launch, or a terrorist act" --- but those are additional routes into the same absorbing state, so his
count is, if anything, an under-count. Granting it grants the most favourable reading available.
#. **The declining-incident count may be an artifact of declassification.** The incidents he counts are
the declassified ones; Cold-War material has had thirty extra years to surface. A constant true rate
plus a declassification lag produces exactly an apparent decline in *known* incidents.
#. **Conditions changed in both directions, and he counts only one.** Fail-safes improved; so did the
ways to fail --- cyber intrusion, hypersonic compression, automated decision support (SIA-X2). His
argument establishes that some holes were closed, not that the sum is falling.
None of this refutes him. Response (1) grants a great deal: if his reading is right, the answer is the
optimistic column --- and *even that* puts individual annual mortality at eighteen times the global
road-death baseline (SIA-9). **The disagreement between the most sceptical published position and this
paper does not reach the paper's conclusion** --- which is the strongest thing the paper can say about
its own robustness, because it is a statement about a critic's numbers rather than the author's.
**"A single use need not become Armageddon" --- the escalation-staircase objection.** Tertrais,
following Herman Kahn :cite:`Kahn1965`, argues that the nuclear threshold is not so thin that one use
makes the next casual: escalation may be "a staircase where the last stairs are considerably higher,"
resistance rising rung by rung, so a limited exchange need not cascade to a global one. If sound, this
weakens the model's collapse of every escalation into the absorbing Dead state, and it is recorded here
as a genuine open flank rather than closed by assertion. Three things bound it. First, *Dead is
nuclear winter, not first use*: the absorbing state is crossed at a soot threshold, and Xia et al.
(2022) :cite:`Xia2022` find even the smallest modelled exchange (~100 warheads) injects enough soot to
cause about two billion famine deaths (SIA-9) --- so "limited" and "below the winter threshold" are
different claims, and only the second would help a sceptic. Second, *the model already carries the
distinction*: SIA-1 treats limited exchanges that do not trigger a winter as milestones toward
normalising one, not as Dead. Third, to rescue the conclusion the staircase must guarantee that
escalation halts *below* the soot threshold every time, indefinitely, across every actor --- a
stronger and less defensible claim than Kahn's, and one Tertrais himself declines to make for
"North Korea or Pakistan." The flank is real; the burden it imposes falls on the optimist.
**The Laplace re-weighting a reviewer will try.** A reader may ask what happens if :math:`p_{M \rightarrow D}` is
calibrated from the record too, rather than taken from structure (SIA-6). Suppose :math:`n` crises met
the criterion and none escalated. Under a uniform prior the posterior mean of :math:`p` is Laplace's
rule of succession, :math:`1/(n+2)`; estimating :math:`r_{R \rightarrow M} = n/T` over :math:`T = 77` years gives an
effective hazard
.. math::
h_{\mathrm{eff}} \;=\; \frac{n}{T} \cdot \frac{1}{n+2}
\;=\; \frac{n}{T\,(n+2)} \;\xrightarrow[n \to \infty]{}\; \frac{1}{T}
Counting more crises raises :math:`r_{R \rightarrow M}` and lowers :math:`p`, and the effects very nearly cancel:
0.86 percent/yr at :math:`n=4`, 1.08 at :math:`n=10`, approaching 1.30 as :math:`n` grows without bound
--- a limit that converges on Hellman's independently derived ~1 percent (SIA-10). It is **reported, not
adopted**, chiefly because it is a *re-weighting, not a measurement*: trading a rising :math:`r_{R \rightarrow M}`
against a falling :math:`p` so that they cancel redistributes an assumption rather than adding
information. Three further reasons: :math:`1/T` is a posterior *mean* under a flat prior, not a ceiling;
the record is weak evidence at :math:`n=4` (surviving four crises at :math:`p=1/3` has probability
:math:`(2/3)^4 = 19.8` percent); and at :math:`n=1` the rule returns :math:`p = 1/3` exactly, so if Cuba
is treated as singular, Laplace and Kennedy agree to the digit.
**"By this logic one must fear everything" --- the Pascalian-mugging objection.** A reader may
turn the decision argument (Section 10) against itself: if any non-zero probability of an unbounded
loss compels action, then every speculative catastrophe --- a physics experiment, a stray
asteroid, an engineered pathogen --- makes the same infinite claim, and a civilization heeding them
all could do nothing else. The objection is serious, and it is why the paper does not rest on
unbounded loss alone. Four features separate this forecast from such a mugging, and a mugging has
none of them. (1) *The probability is estimated, not asserted* --- counted from a public claims
history (SIA-6), not conjured to make a downside infinite. (2) *The mechanism is demonstrated, not
speculative* --- the atomic bombings of 1945 establish that the escalation rate is positive as a
matter of record, not hypothesis (SIA-6, WWII note). (3) *The loss is bounded and priced, not
infinite* --- the paper sets a finite, dated transition cost (Section 9) against a finite per-year
mortality (SIA-9), never against infinity. (4) *The exposure is involuntary, collective, and
repeated* --- unlike a wager one may decline, every person is in the cylinder every year regardless
of consent. A mugging trades everything against an unfalsifiable, one-off, vanishing chance; this
weighs a bounded, checkable premium against a measured, recurring one. The objection rightly
rejects the first. It does not touch the second.
**Known weaknesses, stated by the authors.**
- **Crisis-rate uncertainty (§7.1).** Four excursions in forty years is a small sample; the true rate
could be higher (unreported incidents) or lower (selection bias). The scenario range exists because
this number is not known to better than a factor of a few. The favourable direction is *bounded*: if
the count is revised up while the survival record is held fixed, the inferred escalation probability
falls in step and the product is bounded --- an undercount is not a licence for an arbitrarily higher
figure. This is a weaker claim than the argument invites, and a stronger position: it cannot be
attacked by disputing the count.
- **The classification is a judgment layer, not data (§7.1b).** Two calls should be attacked first: the
1961 Berlin crisis (this paper's own addition, absent from Lewis et al.) and Petrov (the most famous
case and the weakest of the four). Neither carries the forecast: removing Petrov gives three Cold-War
excursions, 0.075/yr, and 2.19 percent per year --- 1 in 46.
- **The 1/3 is the weakest joint (§7.3).** The forecast reduces to a product of two numbers; the first
is counted (SIA-6), the second is **not counted at all**, and equiprobability of the three failure
modes is not implied by their trichotomy. No revision closes this. What the paper does instead is stop
the parameter from carrying the conclusion alone: the stress test (SIA-9) pushes it, the crisis rate,
and the baseline against the thesis simultaneously, and the inequality still holds threefold. A reader
who rejects 1/3 entirely should go to that table, not to this one.
- **Model simplicity (§7.2).** Three states cannot capture dozens of actors, thousands of weapons, or
complex escalation ladders. The simplicity is a strength (transparent, auditable) and a weakness (may
miss dynamics that change the conclusion).
- **The death fraction is anchored coarsely (§7.8).** :math:`q_{\text{dead}} = 0.3` is tied to Xia et al. rather than
derived; every mortality figure scales linearly with it, so the ratios in SIA-9 are order-of-magnitude
while the *inequality* against the global baseline survives for any :math:`q_{\text{dead}} > 0.017`.
- **Stationarity is assumed in critics' favour (§7.9).** A constant :math:`r_{R \rightarrow M}` cannot accommodate
both Tertrais (rate falling) and SIA-X2 (rate rising); the scenario range brackets both readings
rather than adjudicating between them.
- **What the model cannot predict (§7.5).** Not when a specific crisis occurs, who is involved, or the
trigger --- only a probability distribution, which is falsifiable. The practical MAP transition
mechanism (§7.4), non-Western strategic lenses (§7.7), and the COOP reading (§7.6) are open questions
carried downstream to :doc:`Matheo-b17 ` and
:doc:`Matheo-b18 `.
.. _b16-the-claim:
The claim
~~~~~~~~~~~~
.. admonition:: The mean waiting time is distribution-free
:class: important
:math:`\mathbb{E}[T_{R \rightarrow D}]` depends on **only three numbers**:
1. the mean time between crisis onsets, :math:`1/r_{R \rightarrow M}`;
2. the mean duration of a crisis, :math:`\tau`;
3. the probability that a crisis escalates, :math:`p_{M \rightarrow D}`.
It does **not** depend on the *shape* of either waiting-time distribution. No
exponential assumption, no memorylessness, no Markov property is required.
.. _b16-what-this-buys-tested-against-a-hostile-substitution:
What this buys, tested against a hostile substitution
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Replace the model's exponential crisis duration with the **actual** duration of the
Cuban missile crisis --- thirteen days, fixed, not random, as unlike an exponential as
a distribution can be --- and keep only the mean ten-year gap between crises:
.. math::
\mathbb{E}[T_{R \rightarrow D}] \;=\; 3 \times 10\ \text{yr} \;+\; 3 \times \frac{13}{365.25}\ \text{yr}
\;=\; 30 + 0.107 \;=\; \mathbf{30.11}\ \text{years}
against 30.33 years from the full model: a change of **0.7 %**. Substituting a fixed
gap of exactly ten years between crises changes the mean by **nothing at all**, since
only its mean enters.
.. list-table:: Table G. What A2 actually carries
:header-rows: 1
:widths: 40 30 30
* - Result
- Needs the exponential form?
- If A2 fails
* - the mean wait (30.3 yr)
- **no** --- means only
- unchanged
* - the certainty of eventual onset
- **no** (:ref:`b16-onset-is-certain-only-its-schedule-is-uncertain`)
- unchanged
* - the Michaelis--Menten identity
- yes
- becomes approximate
* - the median and the full distribution
- yes
- shape moves; ordering of scenarios does not
* - :math:`P(T_{R \rightarrow D} \leq 1\,\text{yr})` = 2.90 %
- **yes, most of all**
- this is the figure genuinely at risk
**So the honest summary is a split verdict**, and it is more useful than either a
defence or a concession. The mean and the certainty are robust to the assumption most
readers will attack. The one-year probability --- the number most often quoted --- is
the one that genuinely depends on it. A critic who says "your memorylessness assumption
is unrealistic" has landed a hit on 2.90 %, and none at all on 30.3 years or on the
certainty result.
.. _b16x-certainty:
.. _b16-what-none-of-this-establishes:
What none of this establishes
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This document has checked the arithmetic thoroughly enough that further checking of the
arithmetic has close to zero value. It is important to be equally clear about what
remains untouched --- because a reader who mistakes a well-checked derivation for a
well-checked forecast has been misled, and this paper would then have done harm.
**The calibration is where the real exposure sits.** Every number depends on
:math:`r_{R \rightarrow M} = 0.10`/yr and :math:`p_{M \rightarrow D} = 1/3`. These come from b16 SIA-6:
:math:`r_{R \rightarrow M}` from counting civilization-threatening crises in the historical record
against a criterion fixed before counting, and :math:`p_{M \rightarrow D}` from a
three-outcome structural argument, anchored anecdotally on Kennedy's own estimate for
Cuba. **No amount of algebra can support either number.** A critical reader should push
there, and b16 SIA-6 already names the equiprobability of the three OSCR modes ---
the structural assumption behind :math:`p_{M \rightarrow D} = 1/3` --- as "the weakest joint
in the paper".
**The model's shape is a choice.** Three states is a decision about what to ignore ---
limited exchanges, escalation ladders, multi-party crises, the difference between
inadvertent and deliberate use. Section 10 shows the mean is robust to a great deal;
it says nothing about whether the *right* three states were chosen.
**The death fraction is imported.** :math:`q_{\text{dead}} = 0.3` comes from the
nuclear-winter literature, not from this model, and every "times car-crash" figure is
directly proportional to it. Section 14.2 works through what it counts, what it leaves
out, and why 0.3 is a floor rather than a central estimate.
**And a forecast is not a solution.** That this document exists at all should not be
read as progress toward preventing the outcome it describes. It is progress toward
being able to defend a number --- which is a much smaller thing.
.. admonition:: Where marginal effort is worth most
:class: important
Stated plainly, because it is the practical conclusion of the whole audit:
**further work on the mathematics has low value; work on the calibration has high
value.** The algebra is now checked four ways and is not going to be overturned. The
crisis rate and the escalation probability have been challenged by exactly the
published authors b16 cites, and that is where a critical reviewer will go.
The two subsections below are the beginning of that work, not the end of it.
.. _b16x-identifiability:
.. _b16-the-crisis-rate-and-the-escalation-probability-are:
The crisis rate and the escalation probability are not separately identified
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.. admonition:: This is the one place the trade-off is worked out
:class: important
Everywhere else in this paper and in b16 that names the crisis rate or the per-crisis
chance points **here**. The two are a single calibration, and any argument that
varies one while holding the other fixed --- in either direction --- has to answer
this section first.
Two of the model's three inputs cannot be pinned down independently by anything this
paper measures, and it is better to say so exactly than to leave a reader to discover
it.
**The exact statement.** From :ref:`b16-reading-the-formula` the mean waiting time is
.. math::
T_{R \rightarrow D} \;=\;
\frac{1}{r_{R \rightarrow M}\; p_{M \rightarrow D}} \;+\; \frac{1}{r_{M \rightarrow D}}
Holding the escalation rate :math:`r_{M \rightarrow D}` fixed, the mean depends on the
crisis rate and the per-crisis chance **only through their product** --- exactly, not
approximately. Any pair with the same product gives the same answer:
.. list-table:: Table I. Four calibrations with the same product
:class: longtable
:header-rows: 1
:widths: 18 18 16 16 16 16
* - crisis rate
- per-crisis chance
- product
- mean wait
- :math:`P(\leq 1\,\text{yr})`
- implied crisis duration
* - 0.03 /yr
- 1/3
- 0.010
- 100.33 yr
- 0.88 %
- 40.6 d
* - 0.05 /yr
- 1/5
- 0.010
- 100.33 yr
- 0.93 %
- 24.3 d
* - 0.10 /yr
- 1/10
- 0.010
- 100.33 yr
- 0.96 %
- 12.2 d
* - 0.30 /yr
- 1/30
- 0.010
- 100.33 yr
- 0.98 %
- 4.1 d
**What follows, and it cuts three ways.**
*First, fixing the chance at 1/3 is what defines the crisis count.* The two inputs are
a package. Choosing :math:`p_{M \rightarrow D} = 1/3` is equivalent to choosing a
counting criterion for what qualifies as a "Cuban-Missile-Crisis type" near-disaster:
it says the events being counted are those with about a one-in-three chance of running
all the way. Set the chance higher, and the same forecast requires a correspondingly
higher effective crisis rate; set it lower, and a lower one. Neither number is known on
its own; what the calibration has to get right is the **product**.
*Second, this makes the forecast more robust than it looks.* A critic who says "1/3 is
too high" has not damaged the result unless they also hold the crisis rate fixed --- and
holding it fixed is itself a choice, because the crisis count was defined by the very
criterion being disputed. The claim that has to survive is a claim about one number, not
two.
*Third, the compensation is exact for the mean and inexact for short horizons.* The four
rows above agree on the mean to the last printed digit and disagree at one year
(0.88 % against 0.98 %, a spread of 11 %), because they imply different crisis
durations --- 40 days against 4 days --- and the short-horizon figures are sensitive to
exactly that (:ref:`b16-the-shifted-exponential-picture-and-where-the`). **So the trade-off is a genuine freedom for the mean and the
median, and only an approximate one for the one-year number.** The 40-day figure is the
one independently checkable against the historical record: real crises last days to
weeks, which is what picks out the first row rather than the last.
.. _b16-what-the-death-fraction-counts-and-what-happens-after:
What the death fraction counts, and what happens after two years
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
:math:`q_{\text{dead}} = 0.3` deserves more scrutiny than a single imported number
usually gets, because every "times car-crash" figure in b16 is directly proportional to
it.
**The two-year horizon is real, and it is a truncation.** The figures in Xia et al.
(2022) are deaths **by the end of year 2** after the exchange --- about 2 billion for
the smallest exchange modelled (5 Tg soot, ~100 warheads) and over 5 billion for a full
US--Russia exchange (150 Tg). They are not totals. The climate perturbation is not over
at two years: the published simulations find effects persisting for **a decade or
more**, with global temperatures still below normal up to fifteen years after the war
:cite:`Robock2007,Coupe2019`, and more than twenty-five years of cooling, with
unprecedented ozone loss, even for the far smaller regional case :cite:`Mills2014`.
Robock found as early as 1984 that snow and sea-ice feedbacks make the cooling longer
and larger than in models without them :cite:`Robock1984` --- the mechanism that makes
the mortality tail long rather than sharp.
.. 2026-09-24 CITATION CHECK (llog hell/ll/study/b/16/b16-arkhipov-section1-siax7-llog_2026m09d24_11h11.rst,
appended section). The four citations above were checked against Crossref and the authors'
archive copies: all bib fields held (Robock2007's D13107 confirmed on the paper's own header).
Three phrasings claimed more than the papers say and were narrowed:
"with recovery over roughly two decades" -> "global temperatures still below normal up to fifteen
years after the war" (Coupe2019 p. 8534, WACCM4, run for 20 years; Robock2007 ran 10 years and
finds cooling still 4 C after a decade, p. 6 of 14; neither states a two-decade recovery);
"multidecadal cooling and ozone loss" -> "more than twenty-five years of cooling, with unprecedented
ozone loss" (Mills2014 p. 161: ozone loss is "unprecedented", not multidecadal);
"showed ... prolong the cooling well beyond the atmospheric lifetime of the soot itself" -> "found
... make the cooling longer and larger than in models without them" (Robock1984 p. 668; p. 667
calls them "possible longer lasting effects"; the lifetime comparison is not in the letter).
The argument that follows (0.3 is conservative) needed only "a decade or more", and still has it.
.. note:: :cite:`Mills2014` models a *regional* (5 Tg class) conflict, not the full
exchange this paper's Dead state describes. It supports the claim that recovery is slow;
it must not be leaned on for large-exchange magnitudes. No peak-cooling figure is quoted
in this section, because the argument needs only the duration. All four citations in
this paragraph were checked against the papers on 2026-09-24.
**So b16's 0.3 is conservative twice over.** It takes the *smallest* exchange's figure
for a *full*-exchange scenario, and it stops counting at the two-year mark while the
disruption runs an order of magnitude longer. The scenario-matched, same-horizon figure
is **0.63**. Substituting it would roughly double every multiplier b16 reports --- the
base-case comparison would move from 58 |times| the road-death risk to about 122
|times|.
.. admonition:: Recommendation, not a change
:class: important
This is stated here, not applied. b16 SIA-9 should say in one clause that 0.3 is a
deliberate **floor** rather than a central estimate, and what the scenario-matched
value would do to the table. A paper that quietly uses a conservative input is being
careful; a paper that *says* it is using a conservative input, and shows what the
central value would give, is being audited --- and only the second is consistent with
this study's own request.
**On a permanent ice age.** No published simulation known to this draft reports a
transition to a self-sustaining glacial state. The modelled excursion is decades long,
severe, and reversible; the albedo feedbacks lengthen it without locking it in. This
should be checked rather than taken on trust here, and it is the one claim in this
section that rests on absence of evidence rather than on a cited result.
**And a simplifying assumption worth stating plainly.** This study does not distinguish
between outcomes at the bottom of the range: total extinction, and a scattered few
million survivors restarting from something close to a pre-agricultural baseline, are
both **Dead**. The model's absorbing state is the *irreversible loss of the civilization
that built the weapons* --- b16 SIA-1 already says this, in those words --- and nothing
in the forecast depends on resolving what happens below that line. It is a real
simplification: it means the model cannot speak to recovery, and does not try to. One
clause in b16 SIA-1 making the extinction-versus-remnant equivalence explicit would
close the last of the ambiguity.
SIA-12 --- Reproducibility
----------------------------------------------------------------------------
Every input is public and every step is open to inspection. The complete model, the simulation results,
and the MAP escape proposal are published on a single-page poster (SD1), designed for maximum
transparency.
**Where the companion code is.** Four Python files sit beside the companion study in the
project repository, at ``hell/mm/b/16/extra/code/``: ``riskymad_exact.py`` (the exact
first-passage law --- every quantity in the BEST Names index of SIA-1, as a function),
``reproduce_tables.py`` (recomputes every published figure in this paper and reports HELD
or BREACH for each), ``crosschecks.py`` (the independent routes, checked against each other
to machine precision), and the figure script that also writes the numbers behind each plot
as plain text. They need nothing beyond the Python standard library, each runs on its own,
and they use the same Explicit names as the Evolvix model above and as the BEST Names
index, so a reader moves between paper, model and code without a lookup table.
Running ``reproduce_tables.py`` prints one line per published figure. At the time of
writing it reports **52 of 52 HELD, 0 BREACH** --- a reader who finds otherwise has found
something worth reporting.
**They are deliberately not offered as a web download.** A file served from this site
carries no version in its address, so updating a script would silently change what a
stable link hands back --- the "refresh in place" this series refuses everywhere else. The
code will instead be deposited as a **versioned archive with its own DOI**, so that a
reader can fetch exactly the version a given result was computed with, and cite it. Until
that deposit exists this paragraph is the honest answer: the code is public, in the
repository, at the path above.
.. figure:: /_file/pdf/gnp/mmv3/supporting-doc/sd1/sd1-how-to-avert-accidental-nuclear-winter-and-why-its-urgent-iv_llol_qqv4_2025m12d03-page.webp
:alt: SD1 poster --- How to Avert Accidental Nuclear Winter and Why It's Urgent
:width: 100%
:align: center
**Figure 8:** The SD1 poster --- full model code, simulation results, and MAP escape path on a single
page. Download: :doc:`SD1 `.
**To reproduce the simulation results:** (1) download the Evolvix prototype compiler from
:doc:`/good-news-pack/vv/mmv3/supporting-doc/evx-compiler/index`; (2) enter the model code of SIA-1
(equivalently, from the SD1 poster); (3) run the stochastic simulations; (4) compare against the
published forecasts. **To check the arithmetic instead**, the closed-form first-passage law of SIA-4
needs no compiler at all. The dataset (Baum et al.), the classification criteria (SIA-6, fixed before
counting), and every table cell are public, so a reader who rejects a call can strike it and recompute.
The code is public, the compiler is public, the results are public. **#AuditTheMath.**
SIA-13 --- Potential-solution details
----------------------------------------------------------------------------
The ring (Sections 6 and 9) states the remedy; this appendix supplies the formal apparatus, the concrete
specification, and the companion-paper map. Its narrative counterparts --- Arkhipov and Gorbachev, the
ten Nuclear Kings, Cnut, Earth-in-Escrow --- are in Section 6 and are not repeated here.
**MAD is metastable, not stable.** Mutually Assured Destruction has prevented nuclear war for eighty
years, and the model does not deny it; what it adds is one word. A *stable* equilibrium returns to its
state after a perturbation (a ball at the bottom of a bowl); a *metastable* one looks stable until a
large enough perturbation carries it irreversibly past a threshold (a ball on the rim). MAD is the ball
on the rim: small crises resolve and the system returns to apparent equilibrium, but the threshold is
eventually exceeded --- stochastic certainty --- and the model *measures* the basin depth (1 in 34 per
year at base, no better than 1 in 113 under the most sceptical reading). This is consistent with the
crisis-stability literature (Schelling, 1960; Jervis, 1978), to which the model adds the quantitative
result that literature lacks: a distribution over time-to-failure. MAD prevents nuclear war on any given
day; it does not prevent it over any given century. A strategy that works locally and fails globally is
a delay mechanism.
**MAP and the Commitment Trichotomy.** Mutually Assured Progress replaces "if you attack, we both die"
with "if we both invest in recalibration, we both thrive." Its formal basis is the Commitment Trichotomy
(:doc:`Matheo-b13 `, th6): in a Prisoner's Dilemma cooperation cannot emerge
from rational self-interest alone, but a credible first-mover who commits at genuine, irreversible cost
converts the game into an Assurance Game, in which cooperation is rational *if* the other reciprocates.
.. list-table:: Nuclear MAD/MAP Payoff Matrix (Qualitative)
:header-rows: 1
:widths: 25 35 35
* -
- **Side B: Cooperate (reduce)**
- **Side B: Defect (maintain)**
* - **Side A: Cooperate (reduce)**
- Both reduce risk, save resources. High payoff for both.
Mutual progress (MAP).
- Cooperator vulnerable. Worst for cooperator, best for
defector. Classic Prisoner's Dilemma outcome.
* - **Side A: Defect (maintain)**
- Defector gains temporary advantage. Best for defector,
worst for cooperator.
- Status quo continues. Stochastic certainty of death for
both (Section 8). Both lose over the long term but *feel* safe locally.
Mutual destruction (MAD).
Three responses exist: **defect** (the default --- assume defection, defect; stable but
self-terminating); **cooperate naively** (exploitable and unsustainable); or **volunteer credibly**
(commit first, at genuine cost, visibly and checkably) --- the only one that changes the payoff matrix
for everyone else. That third option is not hypothetical: Arkhipov (1962) and Gorbachev (late 1980s)
each took it, both Russians, and each "won a world war that never happened" (Section 6). The first-mover
payoff already includes the largest reputational prize the international system has --- Gorbachev's 1990
Nobel Peace Prize --- paid out once for precisely this move and currently unclaimed. The recalibration
mechanism itself is the Jubilee System (:doc:`Matheo-b14 `, ax25): every 50
units (7 cycles of 7, plus 1) accumulated imbalances are systematically reset --- an engineering
specification for a self-correcting civilization, not a utopia.
**What MAP looks like concretely.** (1) Staged, mutual, *verifiable* arms reduction --- not unilateral
disarmament but reduction with checking at every step. (2) Truth-channel restoration as a security
measure, since degraded information channels raise the crisis rate. (3) Jubilee cycles applied to
international resource allocation --- removing the structural conditions that make arms races feel
necessary, not redistribution. (4) The Great Jubilee Race: the MAD |rarr| MAP transition in 7--8
checkable stages with all ten Nuclear Kings participating. (5) FiShFus (Fiduciaries Sharing Futures):
~288,000 paid long-term thinkers maintaining the "NOT OK" self-assessment the self-correction cycle
requires --- a civilizational immune system at roughly $8 per person per year (~2 cents per day).
**The ten Nuclear Kings --- what the term means, and what it does not.** "King" is an abstraction for
*sovereign*: the holder of an unappealable decision, answerable to no authority above it. The form of
government is irrelevant (presidents, premiers, chairmen, supreme leaders and prime ministers all
appear), and "Nuclear" is never dropped. The ten are ten thrones, nine of them armed --- the United
States, Russia, China, North Korea, India, Pakistan, Israel, France, and the United Kingdom --- with
Iran included because its declared intention to join means a solution excluding it would not be a
solution: **intent adds crisis pathways whether or not the warhead exists** (SIA-X2), which requires no
claim about anyone's motives. The irony is the point: each is sovereign over his own arsenal and nothing
else in this model. The crisis rate is what the world does to him; the per-crisis death probability is
what a crisis does once started; and **the absorbing state does not check credentials.**
**Two structural roles for the ten**, without which ResearchCity cannot scale. *They must permit it,
because any one of them could end it:* a ResearchCity that will not take up arms is permanently
destructible --- which is the proposal, not a weakness, because an institution that cannot defend itself
cannot become one of the things it was built to correct, and everyone can check that this is so;
permitting it therefore costs the ten nothing they would want to keep, which is what makes refusing it
informative. *They must stay at the table as reviewers, because a solution not transparent to all ten
binds none of them:* the ten are recruited as reviewers --- the same request the paper makes of every
reader, addressed to those who hold the classified data that would settle it.
**Caveats stated plainly.** The symmetric ten-equivalent-Kings model is conservative: real heterogeneity
(the US and Russia hold ~90 percent of warheads; China's no-first-use doctrine; Israel's opacity;
regional India--Pakistan and North Korea dynamics) produces *more* crisis pathways, not fewer.
"Verifiable" is itself a hard problem --- arms control has both successes (INF on-site inspection) and
failures (Iraq pre-1991, North Korea); the claim is not that checking is easy but that staged checking
with milestones is structurally possible and the alternative is worse. And the transition passes through
configurations of temporarily elevated uncertainty; that risk is real, but the choice is not "safe
status quo versus risky transition" --- it is a *finite* transition risk followed by structural escape,
against infinite-horizon certainty of death.
**What the escape window costs.** The escape transition (``rRiskyEscape``) is zero not because it is
impossible but because nothing has been built; the escrow window is the interval during which it can be
made non-zero, and Section 9 (Table 8) prices it. A moratorium is not the solution, and calling it one
would be a category error: nothing in a treaty sets the crisis rate to *exactly* zero (Section 8), and
only that changes the outcome; the window buys building time, not safety. The stages cannot simply be
compressed, because each stage's checkability depends on the previous one having been checked, so
compression relocates the risk rather than removing it.
.. figure:: /_file/pdf/hell/mm/b/16/fig/model-riskyescapehatch-5state-evolvix-code-iv_llol_qqv2r0p0_2026m07d24-fig.webp
:alt: The RiskyEscapeHatch model code in Evolvix --- six actions, adding a Risky to MADI to MAP route
:width: 100%
:align: center
**Figure 9:** The escape as code, printed beside the base model of SIA-1 so the difference can be
read directly. Actions 1--3 are unchanged: the world still enters a MAD crisis at 0.10/yr, still de-escalates
at 6/yr, still over-reaches to Dead at 3/yr. Action 4 --- the *direct* jump from Risky to MAP ---
still carries rate 0: it has never been built. What is added are the two rates the escape actually
turns on, and the code labels them as such: Action 5 opens a route from **Risky** to **MADI** (``key
rate start``) and Action 6 carries **MADI** on to **MAP** (``key rate finish``). The values shown
are illustrative of a *built* escape, not measured --- the point of the figure is that the escape
costs exactly two new lines, and that today both of them are unwritten. **#AuditTheMath**
**Companion papers.** The formal argument is self-contained; the companions supply the axiomatic
framework. **Upstream:** :doc:`Matheo-b11 ` (a panentheistic axiom system),
:doc:`Matheo-b12 ` (the self-correction bifurcation and the OSCR collapse
theorem behind the 1/3), :doc:`Matheo-b13 ` (the Commitment Trichotomy),
:doc:`Matheo-b14 ` (the Jubilee System and the Binary Attractor theorem behind
SIA-X2), and :doc:`Matheo-b15 `. **Downstream:**
:doc:`Matheo-b17 ` (falsifiable predictions; who executes the plan and how to
test whether they are genuine) and :doc:`Matheo-b18 ` (the Call to Action, and
the COOP for the MAD |rarr| MAP transition). Nothing in the forecast depends on any claim in these: a
theological motivation *removed a disincentive to measure; it did not supply the measurement* (SIA-X5),
and :doc:`the secular reading ` exists to make that easy to check.
SIA-14 --- The scriptural roots of the decision (for those who care)
----------------------------------------------------------------------------
*Optional depth. Nothing in the main text depends on it --- the decision at the centre (Section 5)
stands entirely in secular terms. It is set out here, for readers who care, because three of history's
clearest statements of exactly this gate-keeping choice --- the life-or-death decision put to a whole
people --- come from Moses, Joshua, and Jesus, and each maps cleanly onto the secular language used in
the ring. It is offered to be tested, not believed.*
**Moses --- the two roads, and why death comes first.** *"I have set before you life and death ...
therefore choose life"* (Deuteronomy 30:19). This is the decision of Section 5. The single change
made in the ring is the order: Moses could say *life and death* because he was pronouncing a blessing;
this paper must say *death and life*, because in an absorbing-state problem death is the **default** ---
the outcome that arrives if nothing is chosen. The inversion is not a correction of Moses; it is the
same choice, read from the side of a system that self-destructs unless it is actively steered.
**Joshua --- the commitment that coerces no one.** *"Choose you this day whom ye will serve ... but as
for me and my house, we will serve the LORD"* (Joshua 24:15). This is the *form* of the personal
statement in Section 5. Joshua puts the choice to the people and leaves it genuinely theirs, while
naming his own answer without hedging --- exactly the register the author adopts: a first-person
commitment that binds no one else and imposes nothing.
**Jesus --- why "life by choice" *is* "keep searching, out loud".** Two sayings, read together, supply
the content of the secular "life" road. First: *"Whoever confesses me before others, I will confess
before my Father; whoever denies me, I will deny"* (Matthew 10:32--33; Luke 12:8--9). Read as a loyalty
test this sounds narrowly devotional; read structurally it is a statement about **public commitment**
--- what you are willing to stand behind, in front of others, is what gets carried forward. Second, the
name itself. In this series' dictionary, |Yas| (the name YhowShua) is read as |RealQuestAnswer|, from
his own words *"Who searches will find, and who asks will receive"* (Matthew 7:7--8): **whoever goes on
a real quest will find real answers.** The name is the program. So "confessing the name", stripped to
its secular core, is *publicly committing to keep searching for the truth* --- which is what a
**ResearchCity** institutionalises, and what the ring calls "life by choice".
**Jesus --- and why the search ends in a Jubilee.** His stated mission, at the outset, was to *"proclaim
the acceptable year of the LORD"* (Luke 4:18--19) --- in the older law, the **Jubilee**: the periodic
reset that returns what has accumulated in a few hands to everyone (Leviticus 25). That is the second
half of the "life" road: a search whose fruits are hoarded curdles back into the thing it replaced, so
the same choice carries a Jubilee-based cycle that returns those fruits, on schedule, to all. On this
reading the mission was left unfinished --- not because the idea failed, but because, by the account,
those who could have carried it did not, and abandoned it when it mattered most. The paper's whole
request (Section 6, and Step 0) is that this time enough people do not.
.. admonition:: A personal conviction (LLoL) --- offered to be tested, not believed
The author states plainly, as personal conviction and **not** as a result this paper proves: that
the life and teaching read here was, for him, what the benzene-ring dream was for Kekulé --- the
seed of the whole framework --- and that he holds the way of *Real Quests for Real Answers* to be a
superior way of understanding the world, and will defend it. This is testimony, not evidence, and it
is placed here, in an optional appendix, precisely so that nothing in the paper's secular argument
rests on it. **#AuditTheMath** applies to it too.
SIA-15 --- The decision arithmetic, and why caution lowers the threshold
----------------------------------------------------------------------------
Section 9 states the break-even and reports a band. This appendix supplies the derivation, the
risk-aversion result the ring only asserts, an independent cross-check by a different method, and the
provenance of the numbers. Its limits are separated out into SIA-16, so that a reader who wants the
objections can find them whole rather than distributed through the derivation.
**What this calculation is called, so nobody has to guess.** The frame is a **cost-benefit analysis**
--- the benefit is valued in money and set against the cost. The specific move is a **break-even (or
threshold) calculation**: rather than compute a net benefit, solve for the one unknown and ask how
small it may be. The rule applied is an **expected-value calculation**, probability times amount. Only
the risk-aversion subsection below is **expected-utility theory** in the sense axiomatised by von
Neumann and Morgenstern :cite:`NeumannMorgenstern1944`, and only there is the word *utility* used. It is **not** a cost-effectiveness analysis, which compares cost per unit of effect without
valuing the effect in money; and it is **not** what the personnel-selection literature calls "utility
analysis", which is an unrelated procedure that happens to share the word.
**The break-even, derived.** Let :math:`K` be the annual cost per person of the programme, :math:`r`
the annual probability of onset (Section 4), :math:`E` the value one person places on the catastrophe
being averted, and :math:`p` the probability that the spending in fact averts it. Treating the outcome
as all-or-nothing --- it is averted or it is not --- the expected annual benefit per person is
:math:`p\,r\,E` and the annual cost is :math:`K`. Spending is worth making when
.. math::
p \, r \, E \;>\; K
\qquad\Longleftrightarrow\qquad
p \;>\; \frac{K}{r \, E}
Dimensionally :math:`[p] = 1`, :math:`[r] = \mathrm{yr}^{-1}`, :math:`[E] = \$`, so both sides of the
first form are dollars per person per year. Worked at the base rate with :math:`K = 8`,
:math:`r = 0.029`, :math:`E = 9 \times 10^{5}`: the denominator is
:math:`0.029 \times 9 \times 10^{5} = 26{,}100` and :math:`p > 8/26{,}100 = 3.065 \times 10^{-4}`, i.e.
1 in 3,262.8. Substituting :math:`r/100` for a hundredfold overstatement gives
:math:`p > 3.065 \times 10^{-2}`, i.e. 3.065 percent. **These are the exact values; Table 10 in Section 9
rounds each of them upward** --- to 1 in 3,000 and 3.5 percent --- so that the ring never states a
requirement easier than the arithmetic supports (Section 4, on how this paper states its numbers).
.. admonition:: A hundredfold overstatement is one operation, and it is well defined
:class: note
"The danger is overstated a hundredfold" can mean three things, and they agree to within about one
percent, so the paper treats them as one move. Dividing the crisis rate :math:`r_{R \rightarrow M}` by 100 gives
an annual probability of 0.000296 and a median wait of 2,080 years; dividing the annual probability
directly gives 0.000290; solving instead for a median of :math:`100 \times 21.1 = 2{,}110` years
requires :math:`r_{R \rightarrow M} = 0.000988` and returns 0.000293. At rates this small the forty-day crisis
stage is negligible against the waiting time, so the first-passage law of SIA-4 is effectively
linear in :math:`r_{R \rightarrow M}` and the knob behaves as one knob.
**Why the benefit is credited for one year only.** Both sides of the inequality are annual flows, and
the comparison is a steady-state one: pay :math:`K` this year, and with probability :math:`p` avert a
hazard that carried probability :math:`r` this year. Nothing is credited for the years afterwards,
although a hazard actually retired stays retired and the cost of a completed programme would stop being
paid. Both simplifications run against the conclusion, which is why they are kept.
**For readers who count cautiously: the same question with risk aversion.** Everything above prices the loss at its plain money value. Nobody responsible for a catastrophe reasons
that way, and neither does the literature on catastrophic risk: a loss that takes everything weighs
more than its arithmetic sum, because there is no replacement and no second attempt. The last sack of
grain in a famine year is worth more than the thousandth in a good one. This subsection makes that
precise, and the result runs opposite to the common intuition that caution makes spending harder to
justify.
**Setup.** Let :math:`V` be the reader's valuation of the state of the world, :math:`W` the present
state, and let the catastrophe destroy a fraction :math:`L` of it --- destroyed *of the same thing*
:math:`E` is measured against, so that the plain-money stake is :math:`E = L\,W`. Nothing here requires
:math:`W` to be wealth; it is whatever the reader was willing to put a number on when setting
:math:`E`. Measure the averted loss in units of value at the margin *today*, since that is the currency
in which :math:`K` is paid:
.. math::
\widehat{E} \;=\; \frac{V(W) \;-\; V\!\bigl(W(1-L)\bigr)}{V'(W)}
**Proposition (parameter-free).** *For any increasing concave* :math:`V`, :math:`\widehat{E} \ge E`,
*with equality exactly when* :math:`V` *is linear on* :math:`[W(1-L),\, W]`. *Consequently the
threshold* :math:`p^{*} = K/(r\widehat{E})` *satisfies* :math:`p^{*} \le K/(rE)` *: risk aversion lowers
the required prospect of success. It never raises it.*
**Proof.** Concavity is exactly the statement that a differentiable :math:`V` lies below its tangent:
:math:`V(y) \le V(x) + V'(x)(y-x)` for all :math:`x, y` in the domain. Put :math:`x = W` and
:math:`y = W(1-L)`, so that :math:`y - x = -LW`:
.. math::
V\!\bigl(W(1-L)\bigr) \;\le\; V(W) \;-\; V'(W)\,L\,W
Rearranging and dividing by :math:`V'(W) > 0` gives
:math:`\widehat{E} \ge L W = E`. Equality holds precisely when the tangent bound is tight across the
interval, i.e. when :math:`V` is affine there. Since :math:`p^{*}` is inversely proportional to the
stake, :math:`\widehat{E} \ge E` gives :math:`p^{*} \le K/(rE)`, which is the whole proof.
**The consequence worth stating twice.** The risk-neutral case is not one point in a range --- it is
the **boundary**. Table 10 is therefore a *ceiling* on the required prospect of success, and every
reader who values a catastrophic loss at more than its money sum is entitled to a smaller number than
the one printed. That is the durable half of this appendix: it survives any parametrisation, because it
never chooses one.
**Checked numerically as well as proved.** 160,000 random draws of :math:`(W, L)` across eight concave
valuations --- square root, logarithm, constant relative risk aversion at :math:`\eta = 2` and
:math:`\eta = 5`, linear, :math:`1 - e^{-ax}`, a quadratic, and a piecewise-linear kink --- using exact
rather than numerical derivatives, returned a minimum ratio :math:`\widehat{E}/E` of 0.999999986. Every
value below 1 was traceable to floating-point rounding on the *linear* cases, where the true value is
exactly 1. **HELD: no counterexample found.**
**The standard closed form, for those who want a number.** The parameter :math:`\eta` below is the
**relative risk aversion** of the valuation, :math:`-x\,V''(x)/V'(x)`, in the sense of Arrow and Pratt
:cite:`Pratt1964` :cite:`Arrow1971`. With constant relative risk aversion,
:math:`V(x) = x^{1-\eta}/(1-\eta)` for :math:`\eta \ne 1` and :math:`\ln x` at :math:`\eta = 1`, the
ratio evaluates to
.. math::
\frac{\widehat{E}}{E} \;=\; \frac{1 - (1-L)^{\,1-\eta}}{(1-\eta)\,L}
\qquad\text{and at }\eta = 1:\quad \frac{-\ln(1-L)}{L}
At :math:`\eta = 0` this returns 1, which is the risk-neutral case and serves as the check. Applied
estimates of :math:`\eta` cluster between about **1 and 2**: Evans (2005) :cite:`Evans2005` obtains
values near unity to somewhat above it across twenty OECD countries, and Groom and Maddison (2019)
:cite:`GroomMaddison2019` reach a preferred UK figure near 1.5 by four independent revealed-preference
routes, with a confidence interval that excludes 1. Nothing in this appendix rests on the choice; the
proposition above holds for every value of :math:`\eta` greater than zero, and for concave valuations
that are not of this family at all.
.. list-table:: Table 11. How much a risk-averse valuation raises the stake, and so lowers the threshold
:header-rows: 1
:widths: 22 19 19 19 21
* - :math:`\eta`
- :math:`L = 30\%`
- :math:`L = 50\%`
- :math:`L = 90\%`
- ceiling at :math:`L = 50\%`, mid stake ($900,000)
* - 0 (risk-neutral)
- 1.00
- 1.00
- 1.00
- 1 in 3,000
* - 1 (logarithmic)
- 1.19
- 1.39
- 2.56
- 1 in 4,500
* - 1.5
- 1.30
- 1.66
- 4.81
- 1 in 5,400
* - 2
- 1.43
- 2.00
- 10.0
- 1 in 6,500
.. warning:: **Read the table as illustration, not as measurement.** Neither :math:`\eta` nor :math:`L`
is measured here, and a factor table can be made to say almost anything by choosing them. It is
printed because a reader is entitled to see the order of magnitude the proposition implies --- but
the proposition, not the table, is what this appendix asks anyone to rely on. One cell in particular
invites misuse: :math:`\eta = 2` with :math:`L = 50\%` returns a factor of exactly 2, from which it is
tempting to say that caution *halves* the required prospect of success. It does so for that pairing and
no other, and nothing measures that pairing. The durable claim here is the **direction**, not any
multiple.
**An independent cross-check, by a different method.** The break-even above prices a single year at the margin. A second and structurally different route ---
a multi-year expected-utility comparison of two survival paths --- was computed separately and is
reported because it agrees where agreement is informative and disagrees where the disagreement is the
useful part.
Take one person's whole position as :math:`W`, score outcomes by :math:`\sqrt{\cdot}` (constant
relative risk aversion at :math:`\eta = 1/2`, the shape economics teaches with), set the horizon at one
median wait, count the person's own life and every descendant at zero, and compare survival while doing
nothing against survival if the escape is built halfway through the horizon, at a cost of eight dollars
a year. Solving for the prospect of success at which the two are equal:
.. list-table:: Table 12. The same question by a multi-year expected-utility route
:header-rows: 1
:widths: 30 22 24 24
* - assumed median wait
- overstatement
- break-even
- as odds
* - 20 years (this paper)
- ---
- 0.039 %
- 1 in 2,600
* - 50 years
- 2.5x
- 0.108 %
- 1 in 930
* - 200 years
- 10x
- 0.454 %
- 1 in 220
* - **2,000 years**
- **100x**
- **4.6 %**
- **1 in 22**
**What the comparison shows.** At the base case the two methods land within the same order of
magnitude --- 1 in 2,600 here against 1 in 326 to 1 in 32,628 across the stake band of Table 10, whose
middle stake gives 1 in 3,263 --- and under a hundredfold discount they give 4.6 percent here against
0.31 to 30.6 percent there. The
conclusion is invariant across both. **The precise figure is not**, and that is why Section 9 reports a
band rather than a number: two defensible methods, each internally consistent, differ by enough that
quoting three significant figures from either would assert a precision neither has.
.. admonition:: Why this appendix reports a band and not a number
:class: important
The two routes **agree where agreement is cheap and disagree where it is informative**, and the
disagreement is the reason Section 9 quotes bounds rather than figures.
At the observed hazard they land in the same place: 1 in 2,600 by the multi-year route, against a
ceiling of 1 in 3,000 at the annual route's middle stake. Under the hundredfold discount they
separate --- 4.6 percent against 3.5 percent at that same middle stake, and 0.35 to 35 percent across
the full stake band. Both are internally consistent. They differ because they price different things: a single year
at the margin against two survival paths over a horizon, with risk aversion built into one and held
out of the other as a separate result.
Two defensible methods differing by that much **cannot jointly support three significant digits**,
and quoting either to that precision would assert an accuracy neither has. What both support, and
therefore all this paper claims, is the order of magnitude and the direction: a required prospect of
success **in the thousandths at the observed hazard, and in the low percentages even at a hundredfold
discount.**
**Reproduce either in an afternoon.** The annual break-even needs no code. The multi-year route needs
this much:
.. code-block:: python
from math import sqrt
W, c, T = 100.0, 100*160/500_000, 20.0 # units of W; c = $8/yr over 20 yr
def threshold(M, eps=0.0, u=sqrt):
S0, S1 = 0.5**(T/M), 0.5**((T/2)/M) # survive doing nothing / escape at T/2
EU0 = S0*u(W) + (1-S0)*u(eps)
uw, ue = u(W-c), u(max(eps-c, 0.0))
return (EU0 - (S0*uw + (1-S0)*ue)) / ((S1-S0)*(uw-ue))
for M in (20, 50, 200, 2000):
q = threshold(M)
print(f"median {M:>5} yr: q* = {q*100:7.4f} % = 1 in {1/q:,.0f}")
**What the eight dollars buys, so the figure is legible.** At eight billion people, eight dollars a
person a year is about **64 billion dollars a year**. Two published figures put that in proportion, and
one source supplies both: SIPRI records world military expenditure at **2,718 billion dollars in 2024**,
and puts the global military burden --- the share of world output spent on arms --- at **2.5 percent**
:cite:`SIPRI2025Milex`, which fixes world output near 109 trillion dollars without needing a second
source. So the programme would cost **about one fortieth of world military spending**, and **about six
parts in ten thousand of world economic output.** Both roundings run in the direction that *over*-states
the cost (the exact ratios are one in 42.5 and 5.9 in ten thousand), per the rule stated in Section 4.
Split across the ResearchCity's roughly 1,600 units it is about **40 million dollars per unit per year**:
sixteen hundred ordinary research-institute budgets, which is a quantity a reviewer can weigh against
things already funded. The staffing figure behind it --- about 288,000 fiduciaries, roughly 180 per unit
--- is in SIA-13. ((( Both proportions move with the year they are taken from, and 2024 is the latest
SIPRI year at the time of writing. )))
SIA-16 --- What the decision arithmetic does not establish
----------------------------------------------------------------------------
Stated here in one place, at length, so that a reviewer does not have to assemble it and so that
nothing below arrives as a discovery. Every item runs against the case Section 9 makes.
**It does not establish the hazard rate, and cannot.** :math:`r` arrives from Section 4 and SIA-6,
where it is counted from someone else's catalogue under a rule fixed before counting. Section 9 assumes
that number; it is not a second argument for it. What Section 9 shows is only that *if* the hazard lies
anywhere across a very wide band --- two orders of magnitude wide --- the decision does not change.
That is a reason to pay for the rate to be attacked. It is never a substitute for attacking it.
**The stake does not aggregate, and must not be multiplied out.** :math:`E` is a per-person figure and
every term in the inequality is per person; the units check in Section 9 holds only in that form. A
reader who multiplies a stake in the millions by eight billion people obtains a total exceeding all
world output, which is the well-known arithmetic of aggregating statistical-life valuations and is not
a result of this paper. Nothing here requires or implies that total, and no claim below the line is
made about what any society could actually afford to spend.
**The stake is a value judgement and is left to the reader.** What an averted nuclear winter is worth
to one person is exactly where values enter, and no arithmetic settles it. Table 10's band is offered
so that a reader can find their own figure inside it and read off the consequence, not as an estimate
the paper defends. Any reader who thinks the band wrong replaces one number and recomputes one line ---
which is the whole reason the calculation was arranged this way rather than as a single result.
**It says whether an outlay is worth making, not which outlay is best.** Answering the second question
would require knowing how the prospect of success grows with spending, and nobody knows that. A
decision theorist will see within a minute that the calculation treats :math:`p` and :math:`K` as
independent when they plainly are not. That is a real limitation and it is not repaired anywhere in
this paper; what can be said is that the answer does not depend on repairing it, since the threshold is
cleared by a wide margin at the one outlay actually costed.
**The concavity result is about the valuation of the residual world, not about survival.** SIA-15's
proposition holds for any concave valuation of what is left after the catastrophe, with :math:`L` the
destroyed fraction *of whatever the stake was measured against*. It is not a result about mortality
risk, and it should not be read as one: the literature on valuing changes in survival probability is a
separate and harder one, and this paper does not enter it. If a reader sets :math:`E` from a
statistical-life valuation and then applies a wealth-shaped curvature to it, that reader has mixed two
scales, and the factor table of SIA-15 is illustrative at best for them --- the parameter-free
proposition still holds, because it never asks what the scale is.
**The value of being proven wrong is counted at zero.** A careful public account of why this forecast
fails would retire an urgent claim and redirect the effort it is consuming. That is a real benefit and
it is nowhere in the arithmetic. Counting it would make the case for a review stronger, which is
precisely why it is left out.
**Reviewing is a different question from funding, and an easier one.** Section 9 prices the programme.
The request in Section 11 is for a review, whose payoff arrives whichever way it comes out --- so it is
properly a question about the **value of information** in Howard's sense :cite:`Howard1966`, what it is
worth to find something out before deciding, rather than a break-even on a gamble; and the two should not
be conflated. They are easily conflated, because a request to *check* something and a proposal to
*fund* something can arrive in the same breath and share a price tag. Section 9 prices the programme;
Section 11 asks only for the review; and the arithmetic that supports the one is not the arithmetic
that supports the other. The distinction is drawn explicitly because a reviewer who notices it before
the paper does is entitled to distrust everything nearby.
**The Precautionary Principle is deliberately not invoked.** It would appear to help and would in fact
cost more than it gives. The principle --- in German law and usage the *Vorsorgeprinzip*, and the same
thing as the precautionary principle of environmental and European law --- licenses action against
harms that are conceivable where knowledge is incomplete. This paper is not in that position: it has a
rate counted from a claims history and a threshold that can be checked, so it does not need a principle
designed for the absence of both, and invoking one would invite exactly the objection SIA-11 answers,
that any unbounded downside compels action. The rigorous form of what is actually being used is the
distinction between ruin and risk (Section 10) :cite:`TalebEtAl2014`. **What this paper borrows instead, and it is not a warrant.** A near neighbour of the precautionary
principle, easily confused with it and entirely different in purpose, is the *Vorsichtsprinzip* of German
commercial accounting --- HGB § 252 (1) no. 4 :cite:`HGB252`. It requires that a balance sheet be valued
cautiously: **all foreseeable risks and losses must be recognised as soon as they are foreseeable, while
gains are recognised only once realised.** The asymmetry has a name of its own, the *Imparitätsprinzip*,
and its purpose is that whoever reads the accounts is never surprised in the unfavourable direction.
That is a rule about **how to state what you have**, not a rule about what to do under uncertainty, which
is why it can be borrowed here without borrowing a contested normative claim. Section 4 states the borrowed
form: every figure in the ring is a bound that under-claims, every rounding runs against this paper, and
the appendices keep the exact values so the discipline can be audited rather than trusted. ((( It is worth
being explicit that the two readings of "prudence" point in opposite directions here, and that this paper
takes only one of them. Prudence about *the danger* would mean planning for the worst case. Prudence about
*one's own claim* means asserting the least the evidence will bear. Only the second is the accounting rule,
and only the second is used --- which is why the ring quotes the optimistic corner beside the base case
rather than the pessimistic one. A paper that used the first while calling it the second would be helping
itself to the word. )))
**And a limit on what a review is for.** The author is not in a position to check his own work: years
have gone into it, and confidence built that way is a statement about a person rather than about the
world. The two can lie far apart, and this would not be the first time. That is why the request in
Section 11 hangs on the *weak* number rather than the strong one. Nobody is asked to believe that the
escape route works. It is enough to hold that it is not ruled out --- which is what the threshold above
converts into a decision, and it is the least this paper could ask for while asking for anything at all.
SIA-X1 --- Why a biologist, and why "top-down"
----------------------------------------------------------------------------
*Provenance of the forecast, and the modelling philosophy behind it. The ring needs none of this; it is
set out for the reader who wants to know who ran the calculation, why, and why its method can be trusted
at all. It is numbered* X1 *so the other appendix numbers stay put; the full set will be renumbered in
one pass at the end.*
**Why a biologist is asking.** Loewe is a mechanistic evolutionary systems biologist whose life's work
is Evolvix, a *century-stable extensible humane* computer-language meant to make accurate modelling in
biology simpler --- motivated by decades of analysing the complex evolutionary systems biology of
real-world organisms. Dreaming that big invites an obvious objection: why spend still more decades
defining a language for researchers who may be extinct before it matures? So Loewe's practical question
is also an existential one: will anyone still use computers in a hundred years --- enough to justify
pushing past "good enough for now"? To decide it, in 2020 he turned the Prototype Evolvix Compiler
(REF-LINK) --- built while he was an assistant professor, with his lab in a *wide interdisciplinary
diversity-encouraging* ("wid-e") research centre, in a building "built for a hundred years" (2010) at
the University of Wisconsin--Madison, on a US National Science Foundation CAREER grant --- onto the
forecast reported here. It proved informative enough to settle that original question. It was also so
simple that he had to ask why neither he nor anyone he could find had run it before. The rest of this
appendix is that answer.
**Why not "bottom-up".** Even naming "the right state of mind" among humans is near-certain to start
endless argument over what it is and who has it --- hence the old advice to avoid religion, politics,
sex, and math in polite company. Too many people blindly assume the standing to settle such questions,
and the resulting flame wars over symbols have a well-documented habit of becoming literal wars, fought
by blindly assuming that leveraging whatever weapon is at hand is a fair way to win the argument.
Forecasting such wars from first principles looks hopeless, and for good reason. Centuries of science
have shown that the physical world is hard to model accurately; carbon-based biology is immeasurably
harder; the information riding human minds is harder still. Bernal (1929) named this rising cascade
"the world, the flesh, and the devil". Even if computers had the right bottom-up structure for every
relevant model, estimating the parameters would exceed all the world's computing capacity: a bottom-up
account predicts hyper-astronomically many roads to catastrophe --- far too many to enumerate, and far
too many to avert one at a time. This paper attempts no better bottom-up model. That would demand
intimate knowledge of jealously guarded "national security" secrets the author neither has nor wants;
let all the boys keep their secret toys. None of it is needed to see what hides in plain sight --- only
the patience to build the right top-down model.
**Why "top-down" works --- the stare at "nothing".** Einstein reportedly credited his breakthroughs
less to being cleverer than others than to staying with a problem longer than almost anyone. The
"secrets in plain sight" reported here demanded exactly that: a stare at "nothing" long enough that most
give up before reaching the narrow, definable path it hides --- the mathematically expressible core of
how humanity's self-destruction might be averted. For "nothing" is never quite the same twice; it is
whatever should, or should not, be there from a given point of view. Adding what should not be there, or
removing what should, can turn a paradise into a hell-scape; adding what should and removing what should
not can in principle do the reverse --- but only for people who know what they are doing. That
instability is the whole difficulty: "nothing is stronger than God" and "nothing is more evil than the
devil" use one word for opposite things. A fresh, hard look at "nothing" turns out to matter both for
cutting the countless NULL-shaped bugs out of programming languages and for forecasting waiting times to
accidental nuclear winter --- because it governs how wars are counted. There is a paradise-versus-hell
difference between "no disaster" because rivals competed peacefully, as in sport, and "no disaster"
because someone like Arkhipov, staring hard at "nothing", narrowly averted one --- winning a world war
for *all sides* at once. Why is there no annual "Arkhipov Day", on which the world renews its resolve to
do the right thing about "nothing" --- the most obnoxious advanced persistent threat that can plague any
civilization that has not yet learned to defend against it? The claim sounds overwrought; but if the
Matheo Study Series (b11--b21, LINKREF) holds up, "nothing" really is such a threat, and this paper ---
in which "nothing" plays so central and confusing a role --- is one exhibit for the point.
.. CONDENSED from LLoL's original when this appendix was tightened (2026m07d21) --- a few specific
phrases were dropped; restore any you want. (a) Bernal's cascade was LLoL's term "work-logic
cascade", changed above to "rising cascade". (b) The instability-of-nothing passage also carried:
"Many say 'the devil is in the details', some say 'God is in the details'", and the point that
turning a hell into a paradise works "only if those working on it know what they are doing, by having
well-designed work-logic cascades for turning this vision into reality for everyone." (c) A published
example was named: "2007 Bgs".
**Two worked precedents.** The confidence that a system this complex can be collapsed to something small
comes from having watched it done. The first precedent is from biochemistry: Michaelis--Menten kinetics
estimated reaction speeds from simple top-down observation long before anyone could simulate, atom by
atom, how an enzyme catalyses a reaction. The same move collapses the complexities of a nuclear-armed
world; the details are in the Michaelis--Menten appendix. The second is from complex multiplicative
systems such as organisms: Loewe found a long log-normal tail of rare-but-large harmful mutational
effects, supported by fruit-fly DNA-diversity data (Loewe 2006), the very shape the law of large numbers
produces in multiplicative systems (LOGNORM BOOK-cite). Both are cases where a top-level model earns
real, decision-grade traction on a system whose low-level detail is hopeless. Fortunately for this
forecast, an evolutionary systems biologist (LINK EvoSysBio 2016) spends a career meeting such cases ---
watching how "nothing" leaves its traces in real data. Building on that experience, Loewe turned to a
system he had grown up with and long dismissed as "boring".
SIA-X2 --- Why the crisis rate increases over time
----------------------------------------------------------------------------
The base model assumes a *constant* crisis rate. This is a conservative simplification; the upstream
framework gives formal reasons to expect the rate to **increase**, which would make the base-case median
of ~19 years an **upper** bound and the model optimistic.
**The degradation cascade.** The three-mode failure pattern (over-Simplify, over-Complicate, over-Reach;
formally derived in :doc:`Matheo-b12 `) predicts that any self-assessing system
which declares itself "OK" enters a self-reinforcing degradation cycle. Applied to nuclear-armed
civilizations: complex geopolitics is reduced to *us-vs-them* binaries while the truth channels degrade
under noise (over-Simplify); arms-control treaties with loopholes and verification regimes with
exceptions add work-arounds without restoring the channel (over-Complicate); and a crisis that an
earlier era would have managed becomes unmanageable because the correction mechanisms have eroded
(over-Reach).
**No stable middle.** The Binary Attractor theorem (:doc:`Matheo-b14 `, th8)
holds that there is no stable ground between the self-reinforcing degradation pattern and the active
self-correction cycle (Zoning, Investigating, Organizing, Navigating) that counteracts it: scope a
problem, examine it honestly, structure a response, steer through implementation, repeat --- stopping
restarts the degradation. A civilization not actively engaged in that cycle is converging toward the
degradation attractor, from which escape becomes harder. Delay is not neutral; it is convergence.
**Some holes closed; others opened.** Section SIA-11 sets out Tertrais's argument that the rate is
*falling* --- fail-safes perfected, lessons learned, known incidents rare since 1983. That argument is
serious and its conclusion is the paper's optimistic column. But Tertrais's evidence establishes only
that specific failure modes were fixed; it does not establish that the total is falling, because it
counts only the closings. Since those fail-safes were designed, the failure surface has changed in kind:
command-and-control systems have acquired network attack surfaces that did not exist; hypersonic
delivery compresses the decision window that dual phenomenology needs in order to work; and automated
decision support inserts a class of error whose failure modes are, by construction, unlike the human
ones the existing procedures were built to catch. Whether the sum exceeds the improvements is not known;
the claim here is only that it is not obviously negative, and a forecast assuming it *is* negative is
making the stronger assumption.
**Pathway growth is quadratic.** Bilateral crisis pathways grow as :math:`\binom{k}{2}`, so nine
nuclear-armed states carry thirty-six dyads where five carried ten --- a factor of 3.6 in the number of
dyads that can produce a crisis, before any account of how much less practised the newer dyads are at
managing one. A tenth state is plausible on the current trajectory, though it has not happened and this
paper does not forecast it. And each new entrant makes possession more ordinary: a horror that is
routine is harder to abolish than one that is shocking, so the crisis rate and the difficulty of
reducing it move together, in the wrong direction, for reasons that have nothing to do with anyone's
malice.
**The last cap came off in February 2026, and this is not an interpretation.** New START --- the final
treaty limiting the deployed strategic arsenals of the two states holding ~90 percent of the world's
warheads --- **expired on 5 February 2026**, having been extended once (2021) for the five years its
text permits, with no further extension legally available and no successor and no negotiations under way
:cite:`FAS2026NewSTART` :cite:`ICAN2026NewSTART`. Russia's verification cooperation had already lapsed
in 2023. For the first time since 1972 there is no agreed ceiling on US and Russian strategic forces and
no inspection regime attached to one. Treaties constrain arsenals rather than crises, so this does not
by itself raise the crisis-rate parameter; what it removes is the transparency and predictability that
made crises *legible* to the other side --- the input on which every de-escalation in Table 1 depended.
Everything else in this appendix is inference about mechanisms; this is a dated fact with a citation, and
it is the kind of evidence the pessimistic column had otherwise lacked.
.. caution:: **What this appendix does not claim.** (1) No claim is made about any state's doctrine,
motives, theology, or intentions; the argument is about the number of dyads, the transparency of the
channels, and the character of the failure surface --- all observable without attributing anything to
anyone. (2) Two illustrations that might be expected here are deliberately absent: an assertion about
Russia's stated conditions for use, for which no primary source was located; and a characterization
of the 2026 Iran--US--Israel escalation, which the authors cannot check to the standard the rest of
the paper is held to. Neither is load-bearing, and current events date quickly: a forecast resting on
this year's headlines deserves the scepticism it will receive.
SIA-X3 --- The field report: there is no channel
----------------------------------------------------------------------------
SIA-X5 argues that *uptake, not analysis*, is the binding constraint, and that a forecast delivered
without a course of action will be declined. That claim is testable, and the author has been testing it.
This appendix reports what came back --- as **data** on the paper's own uptake hypothesis, falsifiable by
a single reply. It is neither a complaint nor a credential nor an appeal: the paper asks for nothing
money can buy, and if the uptake hypothesis is right, this outcome is exactly what it predicts.
**What was attempted, and what came back.** In December 2025, open letters (OL0--OL6, OL10) were sent by
post to the Washington representations of the President of the United States, Pope Leo XIV, the Prime
Minister of Israel, the President of Russia, the UN Secretary-General, and the US Speaker of the House,
and the author travelled to Washington to attempt delivery in person. **No response was received from
any recipient.** The delivery failed *at the medium*, and that is the finding: the US Secret Service
treats unsolicited letters of this kind as spam, and a letter containing a USB stick (how the data
travelled) as a security risk; :doc:`OL10 `, the most
technical of the set, reached no addressee directly at all. The honest finding is **not** "they were
told and ignored it" --- it is that *there is no channel*: the agents whose task is to protect a head of
state have no procedure to pass on a claim about an existential risk to the person whose task is to act
on existential risks, and the procedures that exist are designed to discard exactly this. Nobody can
rebut it by saying they would have read it; the submission was never a thing that could arrive.
Parallel approaches confirmed the shape. **Institutions that price risk** (banks, including in the course
of a legal proceeding) produced no route to anyone with risk-assessment competence --- though that test
was weaker than it looks, since no actuary was reached, and unnecessary, since the actuarial profession
*has* already answered in writing: nuclear war is excluded by standard clause as uninsurable (SIA-9).
**Institutions that ought to care** (churches, whose own values make catastrophic risk to the whole
human family their explicit concern) responded indistinguishably from those with no such commitment.
**The public** responds uniformly *"What can I do?"* followed by resignation --- not apathy but the
fourth feature of a super-wicked problem :cite:`Lazarus2009` :cite:`Levin2012` operating as specified:
when a problem seems too large for individual action, discounting the future becomes the rational-feeling
default and inaction is chosen without ever being decided (Section 8 explains why inaction is not
neutral).
**Why there is no channel: a structural reading.** The pattern is old and has a name. **A system in
which the only body empowered to authorize a correction is the body that would be corrected cannot
correct itself from the inside** --- the third defining feature of a super-wicked problem, *the central
authority needed to address it is weak or non-existent* :cite:`Lazarus2009` :cite:`Levin2012`. At the
close of the Middle Ages, Martin Luther observed the same blockage: reform required a council, only the
pope could convene one, so errors could be corrected only with the assent of those whose short-term
interests the correction opposed. It is cited for the structure and not the man, because it shows the
blockage is real, persists for centuries, and is eventually resolved at a cost far exceeding the cost of
resolving it early. The nuclear case has the same shape: **only the ten can convene the ten** --- each is
party to the matter, none can propose the discussion without appearing to concede something, and there is
no authority above them.
**But the shape is not identical, and the difference is the opening.** Three convening paths exist, not
equally exhausted. (1) The **United Nations** convened the TPNW negotiations in 2017; the nuclear-armed
states boycotted and it entered into force in 2021 without them --- so its convening power on this
precise question has been *measured*, and the ten do not come. (2) The **Holy See** signed *and ratified*
the TPNW the day it opened, holds no arsenal, is party to no deterrence relationship, and has stated that
*possession* is immoral :cite:`ICANHolySee` --- the only convener that is not also a defendant, and it
has not been tried. (3) **Any one of the ten** could put the waiting-time question on an agenda tomorrow
--- the strongest path, because under the Commitment Trichotomy (SIA-13) the first credible mover *is*
the mechanism that shifts the game from Prisoner's Dilemma to Assurance.
**The two requests.** *To whoever convenes: convene.* The ask is not that anyone accept this paper's
answer but that the ten be brought to a table to say whether the arithmetic is wrong --- **if it is
wrong, that is the best available outcome**, and the fastest route to it is for the people with the
classified data to say so; if it is not, they are the only people who can change it. That is why the ten
are addressed as *reviewers*. *To everyone else: check the arithmetic, and say what you find.* Experts
and officials move when there is public interest and, on this evidence, not much before --- which makes
the smallest available action the operative one. The actionable form of both requests is the ring's Call
to Action (Section 11). **#AuditTheMath.**
SIA-X4 --- Eighty-one anniversaries
----------------------------------------------------------------------------
On 6 August 2026 the world marks the eighty-first anniversary of Hiroshima. This paper makes no claim
that the date matters. **It matters that the date does not matter** --- which is the whole of SIA-7. The
process is memoryless; no anniversary is a deadline; there is no year in which the wheel is not spun.
That is precisely what makes the risk durable and the intuition about it unreliable.
What can be said is narrower, and it is not rhetorical. Eighty-one anniversaries have passed, and over
that period the crisis rate has not fallen --- with reasons to think it has risen (SIA-X2): the
nuclear-armed states have grown from five to nine and a tenth is declared; New START expired on 5
February 2026 with no successor and no negotiations under way :cite:`FAS2026NewSTART`, leaving the
strategic arsenals of the two largest holders uncapped for the first time since 1972; and the failure
surface has acquired cyber intrusion, hypersonic compression of decision windows, and automated decision
support, none of which existed when the fail-safes now credited with our survival were designed.
**Eighty-one years of quiet is exactly what this model predicts most of the time** (SIA-7). It is not
evidence that the arithmetic is wrong. It is the reason nobody looks.
SIA-X5 --- Why numbers like this go unmeasured
----------------------------------------------------------------------------
There is a pattern worth naming, because it bears on how much confidence to place in the *absence* of
forecasts like this one. **Risk analysts under-report risks for which they can see no remedy.** An
unbearable number with no exit attached is one a person finds reasons not to compute --- or, having
computed it, reasons to temper. This is not an accusation of character but a structural feature of doing
risk analysis on a problem one cannot solve, and it predicts exactly what Hellman recorded of himself
(SIA-10).
**The present author is the stronger case, and it cuts against him.** He grew up as the Cold War ended,
works on existential problems by profession, and had every modelling tool this paper uses; the model is,
by the standards of problems he had already solved, trivially simple --- three states, four transitions,
a closed-form answer obtainable in an afternoon. **He still took years even to look.** What changed was
not new data or a new method but that a candidate escape (Section 6) had been worked out first, and only
then did looking at the number become bearable.
That admission carries an obvious hazard, and it should be stated before a reader states it: if
envisioning a solution is what made the problem visible, perhaps the problem was constructed to fit the
solution. The reply is evidential, and offered to be checked rather than accepted.
- **The number does not depend on the escape.** Hellman, who has no MAP and no stake in one, reaches ~1
percent per year, within a factor of three of the base case (SIA-10). A preferred solution driving the
estimate would not land that close to a man who had no such solution.
- **The inputs are not this paper's.** The incident catalogue is Baum's; the classification criteria
(SIA-6) were fixed before counting, stated in full, and every cell is recomputable by anyone who
disagrees with a call.
- **The corner most favourable to critics is published here.** Tertrais's reading of the record and this
paper's optimistic scenario are the same number (SIA-11).
*A candidate escape removed a disincentive to measure. It did not supply the measurement.*
**The risk is not unknown. The arithmetic is.** That nuclear war would be catastrophic is among the most
widely known facts on Earth, public for eighty-one years; the choice to live with it has been made,
repeatedly and knowingly, by everyone. What is absent is narrower: **a waiting-time distribution** --- not
"this could be very bad" but "here is the probability per year, the median, and what it costs to wait."
Baum finds that nuclear policy decisions "have made little use of risk analysis," not that anyone is
unaware of nuclear war. The two claims must not be run together. The defensible claim is the smaller one:
if someone with the background, the motive, the tools, and a three-state model still took years to
*compute* it, it is not reasonable to assume that heads of state --- who have none of those four --- have
been shown a waiting-time forecast. **The likeliest explanation for the absence of this calculation from
nuclear policy is not that it was weighed and rejected; it is that the number was never put in front of
anyone in a form that could be acted on** --- and SIA-X3 reports what happened when someone tried.
SIA-X6 --- Draft status and change record
----------------------------------------------------------------------------
*This appendix collects the draft-status and provenance notes that would otherwise clutter the top of
the paper. It is APPEND-ONLY: new entries go at the bottom, nothing above is rewritten.*
**Draft status: OOv3r0p0 (2026m07d18) --- a soft-ring rewrite of OOv2, not yet reviewed by LLoL.**
OOv3 carries the *same content and the same numbers* as
:doc:`OOv2 <../oov2/b16-riskymad-waiting-time_oov2_2026m07d16>`, re-ordered so the **decision** sits
at the centre and all rigour moves into the Supporting Information Appendices (SIAs) at the end.
OOv2 is retained, unedited, as a labelled superseded artefact --- a record of how AI-assisted work
can over-complicate. This working draft holds the full ring (Sections 1--11) and all Supporting
Information Appendices (SIA-1--14 and X1--X6); the ring is under active author revision, and the
SIAs were ported from OOv2.
**What changed between OOv2 and OOv3.** Set out in full, with the method used to check that no
number moved, in :doc:`What Changed Between OOv2 and OOv3
`. In brief: the shape changed (40 nested sections
became 11 ring sections plus 19 SIAs), the arithmetic did not, and one block of material was added
--- a sustained engagement with the strongest published objection, two further objections answered,
and six figures. The earlier transition is recorded in :doc:`What Changed Between MMv5 and OOv2
` --- that is the revision where the numbers *did*
move.
**Front matter (2026m07d25).** The title page, author byline, credentials and Declarations
footnotes were ported here from OOv2 and stamped to the OOv3 variant, following the Matheo-series
title-page convention. The draft-status note that previously sat above the title was moved into this
appendix, so the paper opens on its title rather than on its own bookkeeping.
**Authorship declarations and References restored (2026m08d03).** The OOv2 -> OOv3 port had dropped
the closing *Authorship, Contributions, and Declarations* section and the ``.. bibliography::``
directive. Without the latter, all 31 ``:cite:`` calls in this draft resolved into the reference list
of a *different* paper (``study/matheo/b15/b15-math-deadlock-mmv5``) and OOv3 rendered no reference
list of its own. Both are restored below, ported verbatim from OOv2 with only the RST labels
re-stamped ``oov1-`` -> ``oov3-`` to avoid duplicate-label collisions. The byline, credentials and
identity footnotes 4--7 are NOT repeated here --- they already sit on the title page above.
.. _b16-sia-x7:
SIA-X7 --- B-59, 27 October 1962: the account, and what is contested
----------------------------------------------------------------------------
*This appendix holds in full, with its sources, the account that Section 1 compresses into one
paragraph. It first stood in Section 1 (2026-08-06) and moved here the next day; on 2026-09-24 it was
extended by the second, better-recorded crisis of that day and by the crew testimony that records it.
The ring needs none of it: the crisis rate is calibrated without B-59 (SIA-6), and the central result
survives the sceptic's reading of the record (SIA-11). It is set out for the reader who wants to know
what that paragraph is compressing, who records each step, and --- just as important --- how much of it
is contested and by whom.*
**A hot steel tube, and the meaning of nothing.**
In 1962 on Oct 27 --- the Saturday on which the Cuban Missile Crisis came closest to ending badly ---
the Soviet submarine B-59 lay pinned beneath a United States Navy anti-submarine group in the Sargasso
Sea, near the American quarantine line. She was a diesel-electric boat built for the North Atlantic,
and her cooling had failed on the way out: the diesel coolers blocked with salt, the rubber sealing
tore, the electric compressors broke. The carrier USS *Randolph* headed the group hunting her, and
B-59's own sonar men counted fourteen surface units above them. On the account of her radio-intercept
officer, Vadim Orlov, the batteries were flat, only emergency lighting still worked, the compartments
stood at 45--50 °C and reached 60 °C in the engine compartment (113--122 °F, and 140 °F), and the
carbon dioxide had climbed to what he called "a critical practically deadly for people mark". Duty
officers began going down at their stations --- one, then another, then a third, "falling like
dominoes". It went on, he wrote, for about four hours :cite:`Orlov2002,Savranskaya2005`.
What was happening above was that the Americans were dropping practice depth charges: hand-grenade-sized
signalling devices meant to force a submarine up, not to sink her. The procedure had been published on
24 October to all ships and delivered to the Soviet Foreign Ministry, which promptly handed it back:
four or five harmless explosive sound signals meant *rise to surface*, and a submarine hearing them
should surface on an easterly course. That afternoon USS *Cony* logged: "Challenged submarine contact
by dropping five (5) hand grenades" :cite:`NSArchive2002Submarines,Voorhees2023`.
Whether anybody aboard B-59 knew the procedure is disputed: Savranskaya and Dobbs say the captains did
not; Plokhy and Hastings say they did but could not tell practice charges from real ones (the accounts
are compared in :cite:`Voorhees2023`); and the boat's torpedo officer later called the explosions
pre-arranged signals to surface :cite:`Leonenko2012`. Nor were they the only explosions: the American
*Julie* search system worked by setting off small charges in the water and listening for the echo
:cite:`Arkhipov1997,Mikhailov2012`, and inside a steel hull one bang sounds much like another. Orlov
describes charges that "exploded right next to the hull", then
something "stronger than the grenades ... apparently a practical depth bomb", and a noise like "sitting
in a metal barrel, which somebody is constantly blasting with a sledgehammer". *We thought --- that's
it --- the end.* What one side sent as a knock on the door, the other side received as an execution.
The Americans, for their part, did not know what they were prodding. B-59 carried a T-5 torpedo with a
nuclear warhead of roughly Hiroshima yield, and so did each of the three other boats in her flotilla.
Washington did not know those weapons were at sea at all :cite:`NSArchive2002Submarines`.
B-59 did not know what was happening either. A boat of that class could receive Moscow only at or near
the surface, and she was having to run too deep to listen. For days, nothing had come in.
**That nothing is the hinge of this paper.**
Silence from Moscow was consistent with two opposite worlds. In one, the crisis was still only a
crisis, and the boat's job was to stay hidden and wait. In the other, the war had already started,
their country was already burning, and there was no longer anybody at the far end of the radio. The
same nothing fits both. It is not a signal that the world is safe; it is the *absence* of a signal,
and an absence carries no evidence about which of the two worlds produced it.
Nothing else was available either: no orders, no proof, no way to look. Captain Valentin Savitsky ---
on Orlov's account, published forty years afterwards --- took the worse reading and ordered
the nuclear torpedo readied. The words attributed to him are: *"Maybe the war has already started up
there ... We're going to blast them now! We will die, but we will sink them all --- we will not
disgrace our Navy."* :cite:`Orlov2002`
Aboard was Vasili Arkhipov, chief of staff of the 69th Submarine Brigade, riding B-59 by assignment
rather than by command. The boat's commander was Valentin Savitsky, newly appointed to her for this
voyage. The two held the same rank, Captain 2nd Rank, and were of an age: Arkhipov, born in 1926, was
"essentially a contemporary of the submarine commanders" :cite:`Komarov2022`. What set him apart
was position, not rank, age or command. As the brigade's chief of staff, second only to the brigade
commander (who sailed in B-4), he was the boat's *starshiy na bortu*, the "senior officer aboard" for
the voyage :cite:`Komarov2022,Mikhailov2012,Savranskaya2005`. In Soviet naval usage the phrase names an
officer from a higher staff embarked in a ship he does not command. The captain still commanded the
boat, and nothing in the sources gives Arkhipov a formal veto. How much his position counted shows
in what happened on the surface that night: he gave the order to cancel the dive, and it was obeyed
:cite:`Leonenko2012`. The
year before, he had been among the officers who held together the crew of the reactor-stricken
submarine K-19. He could
not prove that the war had begun. He could not prove that it had not. He was breathing the same foul
air, under the same hammering, as ignorant as everybody else in that compartment.
**Be careful here, because this is where the famous version and its source part company.** The
story as usually told has three officers whose agreement was required and one of them refusing. For
this afternoon the only witness, Orlov, says something quieter: *"we did not fire the nuclear torpedo --- Savitsky was able to
rein in his wrath. After consulting with Second Captain Vasili Alexandrovich Arkhipov and Deputy
political officer Ivan Semenovich Maslennikov, he made the decision to come to the surface"*
:cite:`Orlov2002`. No vote, no veto, no single defiant word --- a furious, exhausted captain who
talked to two colleagues and changed his mind. The vote and the veto were added downstream of that
sentence; none of the crew accounts contains them. In an interview Orlov stressed "the crucial role
played by the brigade chief of staff Vasili Arkhipov in talking Captain Savitski out of any rash
actions" (:cite:`Savranskaya2005`, p. 247), but what Arkhipov said below the surface is not recorded.
The quieter version is sourced and, for this study's purpose, the stronger one. What the argument needs is not a hero but a *deliberation* --- the fact
that a decision of this kind turned on whether anybody in that submarine was willing to think
straight and say so out loud, and on nothing else.
**What broke the tie was not evidence. It was the asymmetry of being wrong.**
Suppose he was wrong about there being no war, and insisted on surfacing while his country burned: the
cost was his boat, his career, and the disgrace of showing a Soviet submarine to the enemy on the
surface, unable to dive, in the open. Bad, and survivable --- somebody else would still be there to
fight the war. Suppose instead the torpedo went and there had been no war: the cost was the war. The
two errors were not the same size. One was recoverable and one was not, and that --- not any new fact
--- is the entire argument.
**No rule could have supplied that.** Notice what was doing the work: not a procedure, but a judgement
about which the procedures were silent. No rulebook could have covered this case, and not for want of
diligence --- covering it would have required writing out, printing, carrying and *remembering* a
library of rules for scenarios that never happened, under conditions in which a rule not remembered is
a rule removed. Rules run out exactly where the stakes peak. What has to take over there is the old
legal virtue of judging by the purpose of a rule when its letter cannot reach the case --- Aristotle's
*epieikeia*, usually translated as equity or reasonableness. In that compartment it meant two concrete
things: extending equal human dignity to the enemy crews the torpedo would have killed, and assigning
honest weights to each possible state of an outside world about which no data had arrived for days.
That capacity is not a personal virtue this paper hopes for. It is a function, and functions can be
staffed, trained and paid for --- which is what Sections 6 and 11 eventually ask for.
**The third option was to do nothing at all**, and this is the part most easily missed. Arkhipov did
not have to be right; he only had to *speak*. The order had already been given. The quiet, safe,
blameless course --- the one that broke no rule, that nobody would ever have recorded as a decision,
and that cost him nothing whatever in the next five minutes --- was to say nothing and let the order
stand. Doing nothing was not neutral. Doing nothing was the option that ended the world. Cheapest now,
fatal later, and invisible as a choice: that combination is the exact shape of the risk this paper
prices.
Somebody spoke instead. And then, in an afternoon built entirely out of ambiguous nothings, B-59 did
the one unambiguous thing still available to her: *"We gave an echo locator signal, which in
international navigation rules means that 'the submarine is coming to the surface.' Our pursuers
slowed down"* :cite:`Orlov2002`. One signal, meaning one thing, under a rule both sides had agreed to
in advance --- and read correctly, first time, by an enemy in the dark who had spent four hours being
misread. The batteries were finished in any case: the commander of her helmsman group and her
torpedo officer both say it was the empty battery, not the charges, that brought her up
:cite:`Mikhailov2012,Leonenko2012`. She surfaced at 20:52 local time, into the American searchlights
:cite:`NSArchive2002Submarines`.
**The second crisis came on the surface, and it is the better recorded.** It is told by two officers
inside the boat, the torpedo officer Anatoly Leonenko and the helmsman-group commander Viktor Mikhailov,
in memoirs printed in 2012 :cite:`Leonenko2012,Mikhailov2012`, and --- second-hand, but in print by
2004 --- by the captain of the sister boat B-4, Ryurik Ketov :cite:`Ketov2012`. Savitsky, Arkhipov and
a signalman with a portable searchlight went up to the bridge. American aircraft came in low with their
searchlights on; the Soviet accounts have them firing ahead of or past the boat, while no American
record mentions gunfire and the most thorough sceptic rejects it :cite:`Voorhees2023`. Savitsky gave the
order that instinct gives a submariner under fire: *"Urgent dive! Torpedo tubes No. 1 and No. 2,
prepare for firing!"* Tube 1 held the nuclear torpedo; it had been loaded there before the boat left
port :cite:`Leonenko2012`. In the scramble for the hatch the signalman jammed with his searchlight in the
shaft --- the accounts differ on who was held up behind whom --- and Arkhipov was still on the bridge.
He saw an American ship calling them by lamp, and cancelled the dive: *"The chief of staff, noticing
that the American frigate had begun calling us by searchlight, gave the command to cancel the dive"*
:cite:`Leonenko2012`; *"The chief of staff, Captain 2nd Rank Arkhipov, gave the command: belay the dive,
signalman to the bridge"* :cite:`Mikhailov2012` (both translated from the Russian). The American side of
the same minutes survives in a pilot's report written that December: the destroyers "also used a signal
light to ask the contact if he needed any assistance" (:cite:`NSArchive2002Submarines`, doc. 47). B-59
answered by lamp that she belonged to the USSR and asked for an end to the provocation, and the aircraft
broke off.
Arkhipov's own account names the mechanism he stopped. Asked in 1997 why the submarine had not used its
weapons, he answered that at the first cannon shot the commander "could have instinctively, without
contemplation ordered an 'emergency dive'; then after submerging, the question whether the plane was
shooting at the submarine or around it would not have come up in anybody's head. That is war."
:cite:`Arkhipov1997`. He did not say that he was the one who stopped it: in his telling the
searchlights blinded the commander until "it became clear that the plane was firing past and along the
boat". Mikhailov, writing later, was less modest on his behalf: some minutes had separated them from
using a nuclear torpedo against American ships, and only thanks to Arkhipov's composure had the world
avoided a nuclear conflict :cite:`Mikhailov2012`. A Russian naval historian who quotes the memoirs in
full reaches the same verdict --- the brigade chief of staff "did indeed show composure and defuse the
situation" --- and explains why no document will ever confirm the order: the pencil rough log was
destroyed on schedule, and no captain would let a breach of the nuclear-use procedure into the fair log
(:cite:`Komarov2022`, p. 175).
The standing rule shows why the moment mattered. Before departure the fleet's chief of staff told the
captains to use the special weapon in three cases, one of them *if you surface, they fire on you, and
you are holed* (:cite:`Savranskaya2005`, p. 240; :cite:`Ketov2012`). A surfaced boat that believed it was
under fire was therefore inside the rules for its nuclear torpedo. The dive would not by itself have
fired the torpedo --- the launch procedure required three keys, and on the best evidence the weapon was
never armed (:cite:`Savranskaya2005`, p. 252) --- but it would have taken the boat back into the silence
where, as Arkhipov put it, nobody could any longer ask whether the fire had been aimed at them.
B-59 charged her batteries under escort, broke contact a few days later, and stayed at sea for about
another month before she was ordered home :cite:`Orlov2002,Leonenko2012`.
**Then nothing happened, and the nothing lasted forty years.** There was no headline, because there
was no event. The reward for making the right call under about the worst conditions a human being can
be given was that the world did not notice, and could not: the evidence of what was prevented is
precisely the absence of what was prevented. That Soviet submarines had carried nuclear torpedoes into
the quarantine at all became widely known only at a conference in Havana in 2002 --- four years after
Arkhipov died :cite:`NSArchive2002Submarines`. He never saw the world learn what it had been spared.
In the one public statement he made about that day, in Moscow in 1997, he asked why the submarine had
not used its weapons and answered without mentioning himself :cite:`Arkhipov1997`.
The one substantial recognition came from a private foundation, posthumously, fifty-five years late,
and was collected by his daughter and his grandson :cite:`Davey2017`.
So one word has already done three separate jobs. *Nothing* was the ambiguous silence he had to read.
*Nothing* was the cheapest thing he could have done about it. And *nothing* is what a success of this
kind looks like from the outside, permanently --- which is how a civilization can be repeatedly saved
and never find out that it needed saving, and why eighty-one quiet years feel like proof of safety
when they are nothing of the kind (Section 7).
**Who records what.** Nothing numerical depends on this list. It is here so that each step above can
be traced to a named witness and checked.
- *The afternoon order and the decision to surface*: Vadim Orlov, the attached radio-intelligence
officer, is the only witness, and his accounts shift over time, from no tension at all in 2000 to
the full scene in 2002 :cite:`Orlov2002,Voorhees2023`.
- *The night order and Arkhipov's countermand*: Anatoly Leonenko (torpedo officer) and Viktor Mikhailov
(helmsman group), from inside the boat :cite:`Leonenko2012,Mikhailov2012`; Ryurik Ketov, captain of
B-4, second-hand, in print by 2004 :cite:`Ketov2012`. The historians who have read the memoirs accept
it, the sceptic Voorhees included: "Arkhipov's steadiness prevailed" (:cite:`Voorhees2023`, p. 139).
- *The American signals*: the destroyers' deck logs and the pilots' narratives, written in 1962
:cite:`NSArchive2002Submarines`.
- *Arkhipov himself*: one public statement, in 1997, which does not mention his role :cite:`Arkhipov1997`.
- *His widow*: he told her "how they almost fired a nuclear torpedo at an American destroyer"
(:cite:`Savranskaya2005`, p. 247).
- *Soviet documents*: none. The Northern Fleet's draft debriefing report, published in 2022, is silent
about B-59 :cite:`NSArchive2022Underwater`, and the Defence Ministry's 2022 release held nothing on
it :cite:`Radchenko2024`.
.. note:: **A caution, placed here rather than in a footnote.** Almost every element of this account
comes from memory, not from documents, and a specialist reader will know it. The afternoon rests on
one oral source, recorded forty years later and published by a journalist :cite:`Orlov2002`, then
translated and given scholarly form by Svetlana Savranskaya :cite:`Savranskaya2005` --- who is thus
both the translator of that source and its principal interpreter. The night rests on two crew
memoirs printed together in 2012, after a second-hand version was already in print, so they are not
fully independent; they differ in small details, which argues against copying
:cite:`Leonenko2012,Mikhailov2012,Ketov2012`. Tertrais (2017) :cite:`Tertrais2017` holds that the
rules of engagement for the torpedo were not met, that it is unclear any vote took place, and that a
fellow officer testified Savitsky "never lost it". Radchenko (2024) :cite:`Radchenko2024` puts it
flatly: "the evidence is not particularly good for it. It's all oral history" --- adding that when
the Russian Defence Ministry declassified Cuban Missile Crisis material in 2022 he looked for
confirmation and "there was nothing", though he immediately qualifies that this "in itself doesn't
prove anything". The most thorough sceptic, Voorhees (2023) :cite:`Voorhees2023`, compares nine
published accounts, rejects the aircraft gunfire, finds that the nuclear torpedo was almost certainly
never armed, and credits the peaceful outcome to the multi-key rule and mutual restraint rather than
to luck --- yet he too concludes that "Arkhipov's steadiness prevailed". Stern (2012) :cite:`Stern2012`,
working from the American tapes, does not name Arkhipov at all: in his telling the captain
reconsidered, or "was finally persuaded to wait by another officer". His corrective is that several
independent things had to go right on that one day, so B-59 was one contingency among them and not
the single hinge of history.
**And the drift is measurable, and it runs both ways, which is the useful part.** Set the popular
telling beside the accounts it claims to rest on and the additions become visible one at a time: a
required vote of three, a veto, a lone refusal, a single word --- none of which appear in any crew
account. A fiftieth-anniversary newspaper column can be read as one step of that growth, stating
plainly that "the launch of the B-59's nuclear torpedo required the consent of all three senior
officers aboard" and that "Arkhipov was alone in refusing permission" :cite:`Wilson2012` --- neither
sentence traceable to any witness. But the record also grew in the other direction. The
better-recorded episode, the night countermand, reached print only in 2004 and the crew memoirs only
in 2012, so the scholarly accounts of 2002--2008 missed it. Nobody lied either way: the legend is more
dramatic than its sources, and the sources are fuller than the first scholarship. That is worth
pausing on, because a reader is entitled to ask whether this paper does the same with its own
numbers. The answer offered is not a promise but a method: every figure in the paper names the
appendix that produces it, from public data, so that any drift can be measured rather than trusted.
**Nothing numerical in this paper rests on any of it.** The crisis rate is calibrated without
Arkhipov --- B-59 is one incident inside the single Cuban excursion (SIA-6) --- and the central
result survives on the sceptic's own reading of the record (SIA-11). On every account, a nuclear
torpedo was at sea on the most dangerous day of the crisis, unknown to the ships hunting it, and it
was not fired. The story is illustrating a decision here, not carrying a number. And Stern's
correction, taken seriously, runs *toward* this paper rather than against it: many independent
contingencies on a single afternoon is what a high crisis rate looks like from the inside.
Then notice *why* the record is thin, because that is the thesis in miniature. It is thin because
nothing happened. Catastrophes generate archives; averted catastrophes generate silence and a few
contested memories. A civilization that measures only what occurred will systematically
under-measure how often it nearly did not survive --- and will price the risk accordingly.
.. SOURCING STATUS of the story above, as of 2026m08d06. The five ``(TODO CITE)`` markers of the
first draft are RESOLVED: seven entries were added to ``source/_bib/b16-nuclear-risk.bib``
under a cluster header that carries the standing warning (Orlov2002, Savranskaya2005,
NSArchive2002Submarines, Radchenko2024, Stern2012, Wilson2012, Davey2017).
``scripts/check-bib.py``: no duplicate keys; the seven show as "missing from build cache",
which is the expected stale-cache state for keys added since the last build.
THE ORLOV SCAN HAS NOW BEEN READ (2026m08d06, later in the same session). Every figure used
above is confirmed verbatim --- temperatures, the CO2 mark, the dominoes, the four hours, the
barrel/sledgehammer, the fourteen surface units, ``Randolph'', and Savitsky's words. It forced
two corrections, both applied:
(a) NO WATER RATIONING appears anywhere in the document. The claim was CUT, not softened.
(b) THE THREE-OFFICER VOTE AND ARKHIPOV'S REFUSAL ARE NOT IN THE SOURCE. Orlov writes only
that Savitsky ``was able to rein in his wrath'' and decided to surface after consulting
Arkhipov and Maslennikov. No vote, no veto, no single word. The text above now says this
explicitly and uses the quieter sourced version. DO NOT let the dramatic version back in,
however often it is repeated elsewhere.
THE GUARDIAN ARTICLE HAS ALSO NOW BEEN READ (LLoL supplied the full text, 2026m08d06). It
forced a third correction:
(c) IT DOES NOT CONTAIN THE "GONE DOWN WITH YOUR SHIP" REMARK, which is the only thing it had
been cited for. That beat was CUT, not softened; no source for it has been found, and the
Soviet debriefing records are closed. Do NOT restore it by citing Wilson2012. The entry is
now cited for something it genuinely is: a dated, widely read INSTANCE of the accretion,
asserting the three-officer consent rule and the lone refusal, neither traceable to Orlov.
ONE ITEM REMAINS OPEN:
(1) LLoL's supplied account attributes the radio silence to US BROAD-BAND JAMMING. No source
found for that, and the Orlov scan gives only an inability to establish connection with
the General Staff. Do not restore the jamming claim without a source.
Standing rule for all of it: if a detail cannot be sourced cleanly, CUT it rather than soften
it --- the argument needs none of them (see the caution note above).
2026-09-24 CORRECTION to the status above (llog hell/ll/study/b/16/b16-arkhipov-section1-siax7-llog_2026m09d24_11h11.rst).
The "single primary source" framing is WITHDRAWN. Found and read 2026-09-22/23: Arkhipov's own
1997 address (NSA EBB 808 doc. 1; full Russian in Naumov2012); the crew memoirs of Leonenko and
Mikhailov (Naumov2012), which record the NIGHT episode and Arkhipov's countermand; Ketov's
second-hand version (in print by 2004); Savranskaya 2005 in full (Belfer PDF via Wayback); Voorhees
2023 in full; Miller's 1962 pilot narrative with the signal lamp (EBB 75 doc. 47); Komarov 2022
(NSA-hosted PDF, pp. 158, 173--175). Stern 2012, searched in full text, does not name Arkhipov.
Corrections (a) water rationing and (c) the "gone down with your ship" remark still stand: neither
appears in any new source. Correction (b) stands for the afternoon and extends to the night: no
crew account contains a vote or a veto. Open item (1), US broad-band jamming, is STILL OPEN: no new
source mentions it (Arkhipov 1997 speaks only of unreliable radio contact). Primary copies and RU/EN
translations of the memoirs: balospe-launch Sources/B-59-Arkhipov-1962/ (private).
2026-09-24, LATER: open item (1) is CLOSED. LLoL no longer holds the jamming claim: he recalls only
that B-59 was out of contact with Moscow for about three days, for whatever reason. The live text
has never carried jamming since 2026-08-06; it gives the sourced cause ("too deep to listen") and
nothing more. Nothing to restore, and nothing left to look for.
.. PROPOSAL A (PARKED, not live, and now HISTORICAL) --- kept because it records what was
considered. It concerns the 2026m08d06 layout, in which the whole story block below stood
at the top of Section 1; that layout ended on 2026m08d07, when the block was moved into
this appendix and Section 1 was given the one-paragraph compression. The switching
instructions therefore no longer apply as written. Original text follows verbatim.
--- PROPOSAL A (PARKED, not live) --- question-first opening. To switch, delete the
"A hot steel tube" bold lead from the first paragraph of the story block, put the two
paragraphs below at the very top of Section 1, and replace the "Which raises the question
this paper exists to answer / How long does a civilization ... / This is not a philosophical
question ..." block with the third paragraph below. The story block, the caution note, and
the "The author's own answer" paragraph are IDENTICAL in both proposals.
--- A-top (goes first) ---
How long does a civilization with nuclear weapons survive without periodic rebalancing?
This is not a philosophical question but a practical one of great value for long-term
planning. It is also, as posed, an abstraction --- and abstractions about nuclear war are
cheap. So before it is turned into arithmetic, here is the whole of it compressed into one
man, one compartment, and one afternoon.
--- A-pivot (replaces the "Which raises the question" block, sits after the caution note) ---
**That is the question above, at the scale of a single compartment.** Arkhipov's position is
not merely historical: it is the standing position of anybody who has looked at the present
arrangement and found the silence ambiguous. Nobody can prove the danger is real. Nobody can
prove it is not. The asymmetry is the one he faced. **Do you surface?**
----
.. _oov3-b16-authorship:
Authorship, Contributions, and Declarations
==================================================
*The author byline, credentials, and identity footnotes 4--7 appear on the title page above. This
section carries the declarations that belong at the end of the paper.*
**Competing interests.** The author is the creator and core compiler architect of Evolvix,
the modelling system used to produce the simulations in SIA-1, and the proposer of
ResearchCity, the institution named in Section 6. This paper argues that a risk is
underestimated and that an institution the author proposes should be built to address it.
The author benefits, in reputation and potential funding, if that argument is accepted.
**A reader should weigh the argument accordingly, and the paper is constructed so that this
is possible:** the incident data are Baum, de Neufville and Barrett's rather than the
author's; the classification criteria were fixed before counting and are stated in full;
the closed-form solution is checkable by hand; the most sceptical published rate ---
Tertrais (2017) --- is carried in Table 3 (SIA-5) and its corner is worked through in
Section 10; and SIA-9 reports, in Table 7, what happens when every soft input is pushed
against the author's own conclusion at once. SIA-X5 states the reverse exposure --- that a
candidate remedy is what made the author willing to compute the number in the first place
--- and explains why that removed a disincentive to measure without supplying the
measurement.
**Provenance.** What changed between the MMv5 floor and this draft --- what was refined,
what was corrected, and the one claim that was removed --- is set out in full in
:doc:`What Changed Between MMv5 and OOv2 `
and :doc:`What Changed Between OOv2 and OOv3 `,
together with links to the complete audit trail. Those pages exist so that this one does not
have to argue with its own history in the margins. The single correction carried in the body
of the paper is the headline figure (Section 4), because a reader holding the older
number is entitled to know why it moved.
----
.. _oov3-b16-references:
References
==================================================
.. bibliography::
:style: apa
:filter: docname in docnames