You have heard the number. If you work anywhere near this field, you have probably said it.

Every dollar spent on mitigation saves eleven dollars later. Sometimes it is seven. Sometimes it is six, or four, depending on who is at the podium and how the slide was built.

It is a wonderful number. It ends arguments. It gets grant programs funded. It gets a homeowner to write a check for a roof they cannot see the point of.

I have used it. Not recently, and not in writing where I would have had to source it, which tells you something about how I was treating it. It lived in the part of my brain reserved for things everyone knows.

I went and checked. The number is real, it is carefully produced, and it is not about wildfire.

What the study actually says

The source is the National Institute of Building Sciences, whose 2019 mitigation saves work is the origin of the figures in circulation. It is serious work. I am not about to tell you it is junk.

But it separates its results by intervention class and by hazard, and almost nobody who quotes it does the same.

The famous eleven to one is the overall result for adopting model building codes, across all hazards. The six to one is the overall result for federal mitigation grants, across all hazards. Neither is a wildfire row. The older four to one that circulated for years traces to the 2005 FEMA funded study of federal mitigation grants, again across hazards.

Here is the wildland urban interface fire row, which is the one that should be quoted in every wildfire conversation and essentially never is.

Building above code for new construction: about four to one.

Retrofitting existing buildings: about two to one.

Federal WUI fire grants: about three to one.

Lifeline and infrastructure retrofit: not applicable. There is no wildfire number there at all, which means the four to one infrastructure figure people sometimes cite in a fire context is an all hazard result being worn as a costume.

So when someone tells a room full of homeowners that hardening returns eleven dollars per dollar, the honest version is that the best wildfire case in the study is four, the retrofit case that applies to most existing homes is two, and one commonly cited figure does not exist for fire at all.

The number underneath the number

Now here is the part that changed how I think about this, and it is not the headline ratio at all.

That four to one for above code new construction was not a national average that applies to your parcel. NIBS modeled it across 47,870 census blocks. The benefit cost ratio came out above one in roughly 10,000 of them.

About 21 percent.

In the other four fifths of the modeled geography, the additional cost of building above code did not pay for itself in the model. And in the blocks where it did pay, it paid enormously. The largest modeled block level ratio was 15.3.

Read that again, because it is the whole thing. This is not a story about mitigation returning four dollars everywhere. It is a story about mitigation returning fifteen dollars in some places, nothing in most places, and averaging out to a number that describes nowhere in particular.

Which means the interesting question was never "does hardening pay." It is "where does hardening pay, and how do we find those places." That is a targeting problem, and it is a much better problem, because it is one we could actually get better at.

Nobody puts that on a slide. It does not fit on a slide.

What two to one is actually assuming

The retrofit number deserves the same treatment, because it is the one that applies to the 90 plus percent of the housing stock that already exists.

NIBS estimated roughly 2.5 million homes were vulnerable enough for the modeled retrofit to be worth doing. The cost range they cite for that retrofit is wide, roughly $4,000 to $80,000, and they deliberately ran it at a conservative high assumption of about $72,000 for a package including more fire resistant cladding, double pane windows and defensible space work.

At that assumption you get roughly $240 billion in cost against roughly $430 billion in modeled benefits. Hence two to one.

I want to sit on the $72,000 for a moment, because if you have ever stood in someone's driveway and talked about hardening, you know exactly what that number does to a conversation.

That is not a weekend. That is a second mortgage, or it is nothing.

And notice that the two to one holds because of the conservative cost, not despite it. Run cheaper interventions and the ratio moves. Which is a hint that the highest return work is probably not the $72,000 package at all. It is the cheap end of the list, done properly, on the right houses.

And these are modeled savings, not observed ones

One more piece of honesty before I get to why this matters.

Every one of these ratios is a modeled present value of avoided future losses. Not measured. Nobody ran a controlled experiment where half the neighborhood hardened and we watched what burned.

That means the results move with assumptions, particularly the discount rate, and at least one published critique challenges how stable mitigation economics are under alternative discounting. It also means these numbers inherit the exact problem I wrote about last week: we are extremely good at modeling the hazard and much weaker at observing what actually happened to the buildings.

The finding that should worry all of us

Now the empirical result that I find genuinely unsettling, and that I think the industry has been quiet about.

Researchers took a random sample of homes in Paradise and compared survival for houses built immediately before and immediately after California's 2008 wildfire construction requirements took effect.

The difference was modest and not statistically significant.

And what did predict survival strongly? Proximity to destroyed structures. The number of destroyed structures within 100 metres.

I want to be careful with this, because it is one fire, one sample, one comparison across a code boundary, and Paradise was an extraordinary event that overwhelmed almost everything in its path. It is not proof that construction standards do not work, and I do not believe that they do not work.

But it is a warning shot at the story we tell. The story is that you harden your house and your house survives. The data from that sample says what mattered most was how many of your neighbors were burning.

That is a systems result hiding inside a product pitch. And it lines up uncomfortably well with the four to one holding in only a fifth of the country, because both are telling you that context dominates, and that the same intervention is worth wildly different amounts depending on where it sits.

Why I care about the wrong number specifically

You could reasonably ask why I am spending an essay on a citation error when the underlying policy direction is right.

Two reasons, and the second one is the real one.

The first is simple accuracy. Four to one is a fantastic return. Two to one is a good return. Three to one on federal grants is a good return. Nobody needed to inflate anything. The honest numbers already win the argument on their merits.

The second is that we are asking people to trust us with expensive, irreversible decisions about their homes, and trust is the only asset in this business that does not regenerate.

When you tell a homeowner every dollar saves eleven, and she spends $40,000, and her house burns anyway because six neighbors were burning, you have not just been imprecise. You made a promise you were not entitled to make. And the next time anyone from our world knocks on that street, they will be met by people who have already learned that we say whatever gets the check signed.

There is also a narrower professional risk, and I will say it plainly. Anyone who wants to discredit wildfire mitigation policy can take twenty minutes, find the NIBS table, and demonstrate publicly that its most prominent advocates have been quoting an all hazard code adoption figure as a wildfire retrofit figure for years. That is an unforced error sitting in the open, waiting.

What I think we should say instead

Not a smaller slogan. A different kind of sentence.

Say the wildfire numbers, with their labels. Four to one above code for new construction, two to one for the conservative existing home retrofit, three to one on the analyzed federal WUI grants, and no wildfire specific figure for code adoption or lifelines. Those are defensible in a hostile room, which the eleven is not.

Say the distribution instead of the average. The four to one held in about a fifth of modeled blocks and reached fifteen in the best of them. That reframes the work from persuasion to targeting, which is where the actual gains are.

Say what the money buys at the low end. If the two to one depends on a $72,000 package, then the far more interesting question is what a $2,000 package returns on the right house, and we should be measuring that rather than assuming it.

And say the neighbor part out loud. If proximity to burning structures is among the strongest predictors of whether a house lives, then a program that only funds individual parcels is optimizing the wrong unit, and we have known that for a while.

The part I have to own

I opened by saying I have used the eleven to one. That is true, and the reason is not that I was careless with sources. It is that the number flattered a conclusion I already held.

That is the failure mode I try hardest to watch for, and it still got me. A statistic that supports what you already believe does not feel like a claim requiring verification. It feels like context.

The correction here does not weaken the case for mitigation. It sharpens it, and it hands us a much better question than the one we have been answering. Not whether hardening pays. Where, how much, at what cost, and for whom.

Those are answerable. The slogan was never going to get us there.

For the people who write the grant narratives, the legislative testimony, and the homeowner brochures: which number is in your current deck, and where did it actually come from?

References

National Institute of Building Sciences. Natural Hazard Mitigation Saves: 2019 Report. Wildland Urban Interface Fire row: approximately 4 to 1 for above code new construction, 2 to 1 for existing building retrofit, 3 to 1 for analyzed federal WUI fire grants, not applicable for lifeline retrofit. The 11 to 1 result is overall model code adoption across hazards; the 6 to 1 is overall federal grants across hazards.

NIBS above code WUI analysis: approximately $0.8 billion additional cost for one year of new construction against approximately $3.0 billion present value benefits, with a benefit cost ratio above one in roughly 10,000 of 47,870 modeled census blocks. Largest modeled block level ratio 15.3.

NIBS existing home retrofit analysis: approximately 2.5 million sufficiently vulnerable homes, retrofit cost range roughly $4,000 to $80,000, conservative high cost assumption approximately $72,000, approximately $240 billion aggregate cost against approximately $430 billion modeled benefits.

NIBS federal WUI fire grants: 25 grants analyzed, approximately $56 million project costs, approximately $173 million estimated avoided future losses.

Multihazard Mitigation Council (2005). FEMA funded study reporting approximately 4 to 1 for federal mitigation grants across hazards.

Knapp, E., et al. Random sample analysis of home survival in Paradise across the 2008 California wildfire construction requirement boundary; proximity to destroyed structures and count of destroyed structures within 100 metres among the strongest survival predictors.

Homeland Security Affairs. Critique of the stability of mitigation benefit cost results under alternative discounting assumptions.

In January of last year we watched entire neighborhoods go at once. Not one house at a time. Blocks. I have walked those streets since, and the thing that stays with me is not the destruction, which you can get used to faster than you would like. It is the pattern. House gone, house gone, house standing, house gone. There is always a house standing, and there is almost always a reason.

That is why Zone 0 exists. Keeping combustible material out of the first five feet is one of the highest leverage things a homeowner can do, and I have said so here for two years. The science is good. I am not going to spend a word arguing against it.

On August 28 the Board of Forestry and Fire Protection filed the Zone 0 regulations with the Office of Administrative Law. File number 2026-0828-03E. It is on the emergency review page right now.

The public has had five calendar days to comment. That window closes September 2. Then OAL has ten days to decide.

Five days. In late August. On a rule that will move roughly $1.7 billion out of private households.

The number

Inside the filing is a form called STD. 399. It is the state's economic impact statement, and it is now public.

It says the typical affected homeowner will spend $960.54.

Not nine hundred and sixty dollars. Not about a thousand. Nine hundred sixty dollars and fifty four cents, and it is the fifty four cents I keep coming back to, because nobody's compliance ever cost that. That figure is the output of a model, and the model has been given the precision of a receipt.

The same form says the statewide lifetime cost is $1.738 billion, and that the annual ongoing cost is zero.

Now think about who writes that check.

The people most affected by Zone 0 are the people who live in the highest hazard severity zones. Which is to say they are already the ones whose premium doubled, or who got the non-renewal letter, or who ended up on the FAIR Plan and are paying more for less. Many of them are older and are not moving. A lot of them are on a fixed income at the end of a canyon road, and they are being told to spend a thousand dollars they had not planned to spend, on top of everything else, because the state has run an analysis showing it is worth it.

I think it probably is worth it. That is not the issue.

The issue is that a thousand dollars is a real amount of money to a real person, and when a government moves a billion seven of that money, the arithmetic behind the decision is supposed to survive being read.

Why I keep calling it a tax

A tax has three properties that a mandated private expenditure does not.

It gets voted on by people who face reelection.

It gets scored by an analyst whose work is published and reproducible and picked apart by the other side before anyone votes.

And it appears on a bill, so the person paying knows exactly what they paid and can be angry at a specific institution about it.

Zone 0 compliance cost has none of those. It is a real transfer of household wealth into a specific set of service industries, sized at $1.7 billion by the state's own arithmetic, arriving through a five day emergency comment window at the end of August.

I am not saying anyone did something improper. Government Code section 51182.4 gives the Board this authority explicitly, and the emergency posture came out of an executive order after January. What I am saying is that when you move money this way, the analysis carries the entire weight a legislative process would otherwise carry. It is the only public accounting there is.

So it had better hold up.

What the analysis actually says

Here is where I have to correct things I have seen circulating, including things I believed a few weeks ago.

It is not true that the state produced no analysis. It produced one, and it is more detailed than the secondhand accounts suggest. It reports 22,891 affected businesses, 97 percent of them small. It reports 25,148 jobs created and 267 eliminated. It discloses that the $960.54 came from a survey open from March 22 to April 5 of 2023, distributed through Board, CAL FIRE and University of California Cooperative Extension channels, which drew 1,698 responses, 1,084 of them residential and inside the regulated geography.

That is more transparency than the critics gave the Board credit for, and I would rather say so plainly than let a lazy version of the criticism stand.

It is also not true that these regulations are permanent and can never be revisited. Section 51182.4 says they remain in effect until the Board revises them. That is different from an ordinary emergency rule, which expires by itself. It is not the same as forever.

Now the part that keeps me up.

Three versions of the same number

The filing says the rule produces $55.18 billion in benefits.

There is a table of eight annual figures labeled estimated structure replacement cost, running 2028 through 2035. Add them and you get $55.177 billion. So that is where the headline comes from arithmetically.

A later table in the same document, valuing the same proposed regulation, carries a different eight year series. That one totals about $57.425 billion. Roughly $2.2 billion higher.

A third page reports $55.4 billion against $1.737 billion in costs, which is the pair that actually produces the benefit to cost ratio of 31.89 printed elsewhere in the filing.

No reconciliation is offered among the three.

Be clear about what this does and does not mean. It does not mean the benefit is fake. Avoided structure loss is a real benefit and the underlying science supports a real effect. It does not mean anyone is hiding anything, and I am not alleging that.

What it means is narrower and worse. A ratio reported to four significant figures implies a precision the public document cannot support, because the public cannot reproduce the numerator. There is no disclosed chain running from baseline wildfire loss, through the causal effect attributable to Zone 0, through compliance rates and exposed replacement value, to those eight annual dollar figures. The filing says the reduction is comparable to Gollner. It does not show the arithmetic that turns a survival percentage into $7.006 billion in 2028.

And the form identifies this as a major regulation over the fifty million dollar threshold, and repeatedly cites a draft Standardized Regulatory Impact Assessment as the source of its macroeconomic results. As far as I can find, that document is not in the public Zone 0 package.

The most important economic analysis in the filing is the one you cannot read.

The cost side has its own hole

The survey is the honest part. What it establishes is prevalence. How many respondents have a fence, a shed, a tree, and whether they would do the work themselves or hire it out.

What turns that into $960.54 is a separate set of cost inputs. The form says Board staff obtained estimates or quotes. It does not name the vendors, the dates, the markets, the scope of each quote, or how many there were. So $960.54 is not the average of 1,084 homeowner invoices. It is a modeled weighted figure whose precision to the penny is an artifact of arithmetic, not of measurement.

If those quotes date to spring 2023 alongside the survey, general inflation alone carries $960.54 to roughly $1,057 today, and landscape and construction services have not tracked general inflation.

The estimate of zero ongoing annual cost deserves a harder look than it got. The state's reasoning is that Zone 0 maintenance resembles defensible space maintenance already required, so there is no increment. Maybe. But some Zone 0 conditions are inherently recurring, and the question is not whether maintenance existed before. It is whether the marginal recurring burden is different now. Zero is a strong claim, and it is asserted rather than derived.

I will also say what does not work as criticism, because I have watched people reach for it. Pointing at one expensive project, a $7,000 gate or a hillside retaining condition, does not disprove a statewide mean. Averages and expensive tails coexist. The real question is whether the state measured the frequency and cost of the tail, and from the public filing you cannot tell.

Nine hundred sixty dollars of what

I have questioned the precision of that figure. I have not questioned the size of it, and I should, because when I show it to people who own in these zones, or to the crews who would do the work, nobody argues about the decimal. They argue about the dollar.

So let me do the arithmetic the filing does not show.

Zone 0 is the first five feet around the structure. A single story house with a 1,600 square foot footprint has roughly 160 linear feet of exterior wall. Five feet out from 160 feet of wall is 800 square feet.

Now cut that in half. Assume the driveway, the walkway and the patio already cover half of it and need nothing at all. Call it 400 square feet that has to change.

Nine hundred sixty dollars and fifty four cents spread across 400 square feet is two dollars and forty cents per square foot.

That is what the state is asserting. Two dollars and forty cents a square foot to pull out established planting, deal with the irrigation running through it, haul the debris away, and put down a non-combustible surface that will not wash out on a slope.

I would like to meet that contractor.

I am not the only one who has checked. Industry compliance guides put Zone 0 work at $2,000 to $20,000 per home. A published San Diego County compliance example came to $7,754, of which the gate replacement alone was $3,556, nearly four times the state's estimate for an entire property.

The unit costs are the part that should end the argument. Replacing combustible mulch with decomposed granite runs $2 to $4 per square foot. Converting wood fencing where it attaches to a home runs $15 to $25 more per linear foot. Removing and replacing artificial turf runs $8 to $15 per square foot.

Hold that first figure against my arithmetic. The cheapest single line item on the whole list, swapping mulch for gravel, costs roughly what the state says the entire project costs per square foot. And that item involves no removal of established planting, no irrigation rework, no haul-off, and no erosion control.

Then there is what the removal leaves behind. My own working figure, from doing this professionally, is that follow on repair and replacement at least doubles the cost of the removal itself. The wall you have to patch after the vines come off. The trellis that turned out to be holding something up. The cost model in the form appears to cover four categories: gardening, tree work, fences and gates, and sheds. Repair is not one of them. Neither is erosion control, which is not optional on a canyon slope.

So put a number on the gap. The filing's own total of $1.738 billion, at $960.54 per property, implies roughly 1.8 million affected properties. At $5,000 per property, which is below the San Diego example and near the very bottom of the industry range, statewide compliance cost exceeds $9 billion. That is more than five times what the state reported.

Five times is the conservative version. It takes the low end of the range and counts no repair, no erosion control and no hillside stabilization at all.

Now let me argue against myself, because there are two versions of this where the number holds.

The first: the rule requires removal, not installation. Strictly, you can pull the plants, haul them off, leave bare soil, and you have complied. Bare soil is cheap. If that is what the state priced, the estimate is honest and the communication is not, because almost nobody leaves a five foot ring of bare dirt around their house on a canyon slope, and the agencies promoting this rule are not showing photographs of bare dirt. They are showing gravel and pavers.

The second: if the model assumed the homeowner performs the labor and valued that labor at zero, then $960.54 is not a cost estimate. It is a materials estimate. Those are two different documents, and only one of them belongs on a form that reports what a regulation costs the public. It is also the assumption that fails hardest on exactly the population I described earlier, the ones who are older and are not moving.

I do not know which of these it is. That is the whole problem. The form does not say, and the document that would say is the one that was never posted.

One consequence worth stating plainly. The benefit to cost ratio of 31.89 has a numerator that appears three different ways and a denominator resting on an undisclosed cost model. If the cost is understated, the ratio is overstated on both ends at once. Nobody should be quoting that figure, including the people who published it.

Zero is a number I can check

I said a moment ago that pointing at one expensive project does not disprove a statewide mean. I meant it. So watch what I do next, because I am about to point at one number of my own.

I cannot get the leaves blown off my own property for less than about four hundred dollars a month. That is not a Zone 0 project. That is maintenance, in a canyon, at the going rate, and I have shopped it. Call it forty eight hundred dollars a year, for one line item.

The state's estimate of the ongoing annual cost of this regulation is zero.

I am not claiming my number is the average. It is not, and any honest reading of it starts there.

But zero is not an average. Zero is a categorical claim. It says the recurring burden of this rule is not small, it is nothing, everywhere, for everyone. And a claim of nothing is the one kind of claim that a single counterexample actually does defeat.

Somebody in that canyon is paying. The form says nobody is.

That is the part that feels like being gaslit, and I want to use the word precisely rather than for effect. Gaslighting is not being told something false. It is being told that the thing you are directly experiencing is not happening. A homeowner who writes that check twelve times a year, then reads a state document reporting the ongoing cost of this rule as zero, is being told exactly that.

I do not think anyone intended it. The reasoning, as I said above, is that this maintenance resembles maintenance already required, so there is no increment. On a spreadsheet, that is defensible. Read it aloud to the person holding the invoice and it stops being defensible, because the invoice is not a rounding error to them, and the state has just certified that it does not exist.

The chasm

Here is the part I would ask the Board to sit with, because it does not appear anywhere in the arithmetic.

People in the highest hazard zones already know they are treated as a distinct category. They learned it from their carrier. Non-renewal is a category decision. FAIR Plan placement is a category decision. The premium is not the state average, and nobody ever pretended it was.

So: special when it costs them.

Then the economic analysis of a rule aimed squarely at them reports a typical cost of $960.54 and an ongoing cost of zero. Averages. Which do not describe their canyon at all.

Special when it is expensive. Average when the state estimates the burden.

You do not need a background in regulatory economics to feel the shape of that, and the people I talk to feel it. What I hear is not disagreement about the science. It is closer to insult, from people who have spent several years learning that institutional accounts of their situation tend to arrive with a number attached that costs them money.

That is the chasm. Every fire official, every mitigation program, every inspector who has to knock on a canyon door for the next decade will be standing on the far side of it, holding a figure the homeowner has already disproven with a monthly invoice.

I want this rule to work. That is the whole reason this bothers me.

This is engineering work

I should be clear about the standing I am claiming here, because it is not homeowner standing.

Economic analysis is part of engineering. Not an adjacent discipline, not something the finance people handle after the technical work is done. When I size a system I am making a cost claim. When I recommend one alternative over another I am making a cost claim. When I sign a life safety analysis, I am asserting that a level of protection is worth what it costs to build, and somebody is going to spend money because I said so.

We hold that work to a standard, and the standard is not high. Show the inputs. State the basis. Reconcile the numbers that do not agree. If two of my own tables differed by $2.2 billion, I would not get to publish both and let the reader choose. If I cite a supporting calculation, it goes in the appendix. If I report a ratio to four significant figures, I should be able to defend all four.

That is the ordinary bar. It is the ordinary bar precisely because the number moves money.

So this is not an outsider complaining about paperwork. This is one engineer reading another set of engineers' economics and finding work that would not clear review in my own office.

How we actually make these decisions

Here is the part I find hardest to write, because it is not about the Board. It is about all of us.

Nothing here required anyone to act in bad faith. It required a sequence of ordinary things. An emergency posture, which compresses comment from weeks to five days. An August filing date. A benefit number large enough that the ratio ends the argument. And a supporting document referenced but not posted.

Each step is defensible standing alone. Together they produce a $1.7 billion obligation on households whose justification the public gets five days in late August to examine, using a filing that values its own benefit three different ways.

And I want to name why that happens, because I have been in the rooms.

When we believe a thing should get done, we put a number on it. We do not fabricate. We choose the defensible high end. We use the study that supports it. We do not spend a week reconciling two internal tables when the conclusion is the same either way and the deadline is Friday. Then we present the ratio, and the ratio ends the conversation, which is what it was for.

Every engineer reading this has done some version of that. I have. It usually works out, because usually we were right about the underlying thing.

The problem is that it is indistinguishable, from the outside, from the version where we were wrong. And the public cannot tell the difference, so eventually they stop trying, and they just decide whether they trust us.

What is actually at risk

It is not the $1.7 billion.

It is that Zone 0 is right, and the case made for it in public is not checkable, and those two facts are going to collide.

Somebody will litigate this, or a reporter will pull the thread, or a legislator will ask where the SRIA is. And when the answer is that the benefit number appears three ways and the supporting analysis was never posted, the story will not be about a spreadsheet. It will be about whether the state can be believed when it tells you to do something to your house.

And the next time a fire official stands at the end of a canyon road and tells a homeowner that clearing those five feet is the difference, that homeowner will have a reason not to believe him. Not a good reason. But a sufficient one.

That is the cost of weak economics attached to sound policy, and it is paid in the next fire, by people who never read a single page of any of this.

The fix is small and I do not think it is controversial. Post the draft SRIA. Reconcile the three benefit figures. Disclose where the cost quotes came from and when. Show the bridge from fire science to dollars.

None of that weakens the rule. All of it makes the rule survivable.

A tax gets that treatment automatically, because we built a whole apparatus to force it. This did not, and it costs the same, and the people paying it are the ones who already lost the most.

The window closes tomorrow.

Disclosure

I advise principals of the Mandeville Canyon Association on wildfire resilience, and I am cited in public comments now before OAL on this rulemaking. I support the substance of Zone 0 and have written in favor of near structure fuel reduction repeatedly. My criticism here is directed at the transparency and reproducibility of the economic filing, not at the mitigation requirement.

Sources and notes

The filing is OAL File No. 2026-0828-03E, Board of Forestry and Fire Protection, Zone 0 Defensible Space, submitted August 28, 2026, amending Title 14 sections 1299.01 through 1299.03 and adopting sections 1298.01 through 1298.04. It appears on OAL's Emergency Regulations Under Review page. OAL's standard emergency process provides five calendar days for public comment after posting and a ten calendar day review period. Comments go to the Board contact listed on that page and to staff@oal.ca.gov.

Cost, benefit, employment and business figures are from the Board's Form STD. 399 in the public Zone 0 package: $960.54 per typical affected individual, $968.63 per typical business, $1.738 billion statewide lifetime cost, zero annual ongoing cost, $2,636 new construction Zone 0 increment, 22,891 businesses affected at 97 percent small business, 110 businesses created and 20 eliminated, 25,148 jobs created and 267 eliminated, $55.18 billion monetized lifetime benefits, and a reported benefit to cost ratio of 31.89.

Cost comparison figures: industry compliance guides for Zone 0 work at $2,000 to $20,000 per home; a published San Diego County compliance example totaling $7,754 of which the gate replacement alone was $3,556; converting wood fencing where it attaches to a home at $15 to $25 more per linear foot; replacing combustible mulch with decomposed granite at $2 to $4 per square foot; removing and replacing artificial turf at $8 to $15 per square foot. The implied property count of roughly 1.8 million follows from dividing the reported $1.738 billion statewide total by $960.54 per property. The $9 billion figure is 1.8 million properties at $5,000 each. The estimate that follow on repair and replacement at least doubles removal cost is my own professional judgment, not a published figure.

The eight annual estimated structure replacement cost values for 2028 through 2035 in that form are 7.006, 7.192, 7.233, 6.911, 6.880, 6.779, 6.633 and 6.543 billion dollars, summing to $55.177 billion. The alternatives table in the same document assigns the proposed regulation a series of approximately 7.291, 7.486, 7.528, 7.192, 7.160, 7.055, 6.903 and 6.810 billion dollars, summing to approximately $57.425 billion. A separate page reports approximately $55.4 billion in benefits against $1.737 billion in costs, which yields 31.89.

Survey methodology is as described in the form: open March 22 through April 5, 2023, distributed through Board, CAL FIRE and University of California Cooperative Extension channels, 1,698 total responses, 1,084 residential respondents in the regulated geography of whom about 18 percent reported compliance, and 40 business respondents.

Structure survival figures referenced here are from Gollner et al., Nature Communications, 2025, DOI 10.1038/s41467-025-63386-2, which reports approximately 25 percent survival for structure hardening, about 40 percent for hardening combined with Zone 0, and about 48 percent for hardening combined with Zones 0 and 1. The authors note that the mitigation scenarios are hypothetical and that suppression is not modeled. The IBHS vegetation work is DOI 10.82346/KQX1-S839, reporting seventeen controlled experiments in which vegetation near a structure raised heat exposure and worsened damage, including when well watered.

Emergency authority is Government Code section 51182.4, which provides that the resulting emergency regulations remain in effect until revised, distinguishing them from ordinary emergency regulations that expire after a limited period.

The inflation figure uses CPI-U, which rose from 303.363 in April 2023 to approximately 333.9 in July 2026, roughly 10.1 percent. Construction and landscape services have their own indices and CPI-U is used here only as a floor, not as an estimate.

On the morning of August 26, a slab of ice and the rock underneath it came off a mountain on the Nepal and China border and went into a river.

The counting is not finished. It is already one of the deadliest events of its kind ever recorded, and I will come back to that, because I do not think an engineer gets to look away from it.

But first there is a number in this event that should bother every engineer who designs anything downstream of anything.

What the instruments recorded

The collapse was picked up by seismometers. The US Geological Survey looked at the signal and reclassified it: the shaking was produced by the landslide itself, equivalent to about a magnitude 5.2 event, with no earthquake having triggered it. The mountain simply let go.

Satellite imagery and seismic analysis indicate this was not purely a glacier failure. Bedrock beneath the ice appears to have failed, taking part of the glacier with it and generating a rock, ice and debris flow that entered the river system. A mass roughly 610 metres across fell about 1,200 metres. The resulting flood affected settlements along something like 72 kilometres of the Trishuli.

Then it did the thing these events do. The debris dammed the valley and formed a new lake, on the order of two million cubic metres, which authorities watched fill and then overtop two days later.

So the hazard created a second hazard, on a timescale of hours, in a place where nobody had drawn it on a map the week before.

The number that should bother you

Here is where this stops being a story about Nepal.

Engineers who design dams, spillways and critical downstream infrastructure use a concept called the probable maximum flood. The PMF is not a hundred-year flood or a five-hundred-year flood. It is meant to be the physical upper bound. The largest flood that is reasonably possible at that location given the most extreme plausible combination of precipitation and antecedent conditions. You design to it when failure is not an acceptable outcome, because there is supposed to be nothing above it.

In glaciated basins, glacial lake outburst floods are frequently larger than the probable maximum flood.

Read that again, because it is not a statement about a big flood. It is a statement about a ceiling that does not hold.

Before you read the next paragraph, guess: of hydropower plants sampled in the Himalaya, what fraction sit somewhere on a potential outburst flood path?

Two thirds. And up to a third of those could experience outburst discharges well above their local design flood.

Why the ceiling failed

The PMF is not a bad idea. It is a very good idea with a hidden assumption, and the assumption is that the water arrives as rain.

The whole framework is built out of precipitation physics. Maximum moisture in the air column, maximum rate of delivery, worst plausible storm sitting over the worst plausible antecedent soil condition. It is a genuinely conservative envelope for a rainfall-driven system.

An outburst flood is not a rainfall event. It is a mass of stored water released mechanically, over minutes, by a dam made of moraine or ice or fresh landslide debris giving way. The volume was never in the atmosphere. It was sitting on the mountain, and the release mechanism is a slope stability problem, not a meteorological one.

So the PMF does not underestimate this hazard. It does not address it at all. Flood control planning and design standards mainly consider rainfall-induced floods across different return periods, and outburst floods are rarely incorporated into hazard assessment or infrastructure design.

That is a category error, and category errors do not get fixed by adding a safety factor.

And the denominator is moving

The other half of this is that the supply of these events is being manufactured in real time.

Two reports from ICIMOD this year put numbers on it. Ice loss across the Hindu Kush Himalaya has roughly doubled since 2000. Monitored glaciers have lost up to 27 metres of ice thickness since 1975. Between 1990 and 2020 the region lost around 12 percent of its glacier area and about 9 percent of its estimated ice reserves. Something close to two billion people live downstream of that system.

Melting ice does not just disappear. It pools. It pools behind moraines that were deposited by the same ice when it was larger, which is to say behind dams that were never engineered and are now holding back more water than they ever have. Nepal currently classifies 47 glacial lakes as potentially dangerous, with four singled out as high risk: Thulagi, Lower Barun, Lumding Tsho and Hongu 2.

The consequence for anyone doing frequency analysis is brutal. Return periods for a given flood stage in major Himalayan rivers could drop by 50 to 90 percent over this century.

A structure designed against a hundred-year event is not being asked to survive a hundred-year event anymore. It is being asked to survive something that now arrives every ten to fifty years, and the design never knew.

The part that is not about Nepal

I can hear the objection. This is a mountain range on the other side of the world with a hazard we do not have.

We have it. We manufacture it.

Every large fire in the western United States produces a burn scar, and the burn scar produces a debris flow hazard that did not exist eighteen months earlier. Hydrophobic soil, no root structure, no canopy interception. A rainfall intensity that the watershed absorbed without complaint for fifty years now generates a wall of mud and rock.

The culverts, the road crossings, the detention basins and the houses below that slope were all designed against a hydrology that the fire deleted. Nobody redesigned them. The fire changed the denominator and the drawings stayed the same.

That is the identical failure. A hazard whose governing physics changed faster than the design basis that was supposed to bound it, in a system where the design basis is quietly assumed to be permanent.

The Himalayan version is more dramatic because the stored water is more dramatic. The California version is more common because we make several hundred of them a year.

What I actually think should change

I am wary of essays that end by asking for more research. So here is the narrow version.

The probable maximum flood should stop being reported as a single number in glaciated and recently burned basins. It should be reported as a pair: the rainfall-driven maximum, and the mass-release maximum, computed separately, because they come from different physics and the second one is not bounded by the first.

That is not a research program. It is a reporting convention, and reporting conventions are how engineering disciplines actually change their minds. We did it with seismic when we stopped pretending one design earthquake was enough and started carrying multiple scenarios. We can do it here.

The uncomfortable part is what it would reveal. If you compute the mass-release maximum for a lot of existing structures, some of them will turn out to be below it, and then somebody has to decide what to do about a dam or a road or a village that is already there.

That is exactly why it does not get computed.

The part I would rather not write

I said I would come back to the human cost. Here it is, and the figures are still moving.

As of August 31, Nepali authorities put the toll at at least 903 dead and 4,247 missing. Chinese authorities report a further 16 dead and 546 missing in Tibet. Sixty five Americans are on the missing list. The water in the Trishuli rose as much as nine metres in thirty minutes. Bodies have been recovered 240 kilometres downstream, in India.

And more than a hundred workers are believed to be trapped inside hydropower tunnels.

Read that against the statistic I gave you earlier. Two thirds of sampled Himalayan hydropower plants sit somewhere on a potential outburst path. That is a sentence in a journal. On the morning of August 26 it had a shift change.

You have seen the videos. Everyone has. What has stayed with me is not the water. It is the first two seconds, which are completely ordinary. Somebody is filming because the river looks wrong, the way people film weather. Then the frame changes, and there is no interval anywhere in that clip in which a person could have received a warning, understood it, and moved.

That is the engineering content of those videos, and it is brutal. Our entire warning architecture is built on lead time. A rainfall flood gives you hours, sometimes a day. You can model the storm, watch the gauges, make the call, move people. A mass release gives you the travel time of the wave and nothing else. Upstream of those settlements there was no storm to watch. There was a mountain that had been there the whole time.

Here is the part I most want engineers to sit with. We are going to file this under freak event. It is the natural thing to do, and it is how a profession protects itself from having to change anything.

The physics does not support it. Ice loss across the Hindu Kush Himalaya has roughly doubled since 2000. Nepal classifies 47 glacial lakes as potentially dangerous right now. Return periods for a given flood stage in these rivers could fall by 50 to 90 percent this century. Put those together and what you have is not a rare event. It is a rare event whose supply is increasing, in a system where everything downstream was built during the era when it was rare.

That is what exponential means when it stops being a word on a chart. The interval between the events we call unthinkable is shortening while the number of people living below them goes up. Every one of those clips is a boundary condition somebody assumed was permanent, arriving.

Five thousand people is not a data point. But if we treat this only as a tragedy and not also as evidence, we will design the next valley the same way.

The part I would rather not write

I said I would come back to the human cost. Here it is, and the figures are still moving.

As of August 31, Nepali authorities put the toll at at least 903 dead and 4,247 missing. Chinese authorities report a further 16 dead and 546 missing in Tibet. Sixty five Americans are on the missing list. The water in the Trishuli rose as much as nine metres in thirty minutes. Bodies have been recovered 240 kilometres downstream, in India.

And more than a hundred workers are believed to be trapped inside hydropower tunnels.

Read that against the statistic I gave you earlier. Two thirds of sampled Himalayan hydropower plants sit somewhere on a potential outburst path. That is a sentence in a journal. On the morning of August 26 it had a shift change.

You have seen the videos. Everyone has. What has stayed with me is not the water. It is the first two seconds, which are completely ordinary. Somebody is filming because the river looks wrong, the way people film weather. Then the frame changes, and there is no interval anywhere in that clip in which a person could have received a warning, understood it, and moved.

That is the engineering content of those videos, and it is brutal. Our entire warning architecture is built on lead time. A rainfall flood gives you hours, sometimes a day. You can model the storm, watch the gauges, make the call, move people. A mass release gives you the travel time of the wave and nothing else. Upstream of those settlements there was no storm to watch. There was a mountain that had been there the whole time.

Here is the part I most want engineers to sit with. We are going to file this under freak event. It is the natural thing to do, and it is how a profession protects itself from having to change anything.

The physics does not support it. Ice loss across the Hindu Kush Himalaya has roughly doubled since 2000. Nepal classifies 47 glacial lakes as potentially dangerous right now. Return periods for a given flood stage in these rivers could fall by 50 to 90 percent this century. Put those together and what you have is not a rare event. It is a rare event whose supply is increasing, in a system where everything downstream was built during the era when it was rare.

That is what exponential means when it stops being a word on a chart. The interval between the events we call unthinkable is shortening while the number of people living below them goes up. Every one of those clips is a boundary condition somebody assumed was permanent, arriving.

Five thousand people is not a data point. But if we treat this only as a tragedy and not also as evidence, we will design the next valley the same way.

The honest close

I have spent my career arguing that resilience begins with an honest design basis. Name the thing you are designing against, write it down, and let people see it.

The hard version of that argument is that an honest design basis is not a fixed one. The mountain that failed on August 26 was, until it failed, part of the background. Not a hazard. Terrain.

We are going to keep discovering that things we filed under terrain were actually hazards with long time constants. The professional response to that is not to be embarrassed about it. It is to build the habit of asking, on every project, which of my boundary conditions are secretly assumptions about a climate that no longer exists.

The probable maximum flood was a good answer to that question in 1950.

It is not the answer now, and the ice is not waiting for us to update the guidance.

Sources and notes

Event mechanism, the approximately magnitude 5.2 landslide seismic signal, and the USGS reclassification are from USGS landslide hazards reporting and contemporaneous coverage of the August 26, 2026 Trishuli River event. Barrier lake volume of roughly two million cubic metres and its overtopping are from Chinese and Nepali authority warnings reported August 27 and 28. Casualty and missing figures, the nine metre rise in thirty minutes, the recovery of remains 240 kilometres downstream in India, the 65 Americans listed among the missing, and the workers believed trapped in hydropower tunnels are from Nepali and Chinese authority reporting compiled as of August 31, 2026 and carried by Al Jazeera and CBS News. These figures were still being revised as this was published.

Glacier change figures are from two 2026 ICIMOD reports, Changing Dynamics of Glaciers in the Hindu Kush Himalaya Region from 1990 to 2020 and HKH Glacier Outlook 2026. Nepal's count of 47 potentially dangerous glacial lakes and the four high-risk lakes are from Nepali government and ICIMOD hazard classifications.

The finding that outburst floods frequently exceed the probable maximum flood, that roughly two thirds of sampled hydropower plants sit on potential outburst tracks with up to a third exposed to discharges above local design floods, and that return periods for a given flood stage may fall 50 to 90 percent this century, are from the peer-reviewed GLOF hazard and hydropower design literature, including work published in PNAS on Himalayan glacier lake outburst flood hazard.

Post-fire debris flow hydrology in the western United States is my own field observation and is consistent with USGS post-fire debris flow hazard assessment methodology.

Drive into a burned neighborhood a week after and you will see it before anyone points it out.

A street of foundations and chimneys. Cars reduced to their frames. And then, somewhere in the middle of it, a house. Intact. Paint blistered on one side, maybe, some scorch on the fence line. Standing.

Everyone who sees it asks the same question, and they ask it in a slightly haunted voice. Why that one.

I want to convince you that the house still standing is the single most scientifically valuable object in that entire burn scar, and that it is also the object we are least likely to properly record. Not because anyone is negligent. Because every institution pointed at that neighborhood is built to count losses.

Everything is aimed at the wrong houses

Think about who arrives after a fire and what they are there to do.

The insurance adjuster comes to document a loss, because that is what triggers a payment. FEMA assistance flows against damage. The news photographs the foundations, because a photograph of an ordinary intact house is not a photograph of anything. Even our grief points that direction, and it should. People lost their homes. That is the story.

But if you are trying to learn what actually protects a building, the destroyed houses are only half of your evidence, and they are the less informative half.

You cannot compute a rate without a denominator. Survival is a fraction. If you only carefully record the numerator, meaning the ones that burned, you can describe a catastrophe beautifully and still not know whether a single intervention worked.

The house that stood is the control group. And we drive past it.

Now let me correct myself before I get carried away

Here is where I have to be careful, because there is a seductive version of this argument that is wrong, and I have caught myself telling it.

The seductive version is that hazard science is data poor. That we are flying blind. That we do not have the observations.

That is false, and it is not even close.

NASA reports more than 178 petabytes of Earth science data available through its systems. The USGS water network runs more than 13,500 real time monitoring locations. Monitoring Trends in Burn Severity had released 30,390 mapped fire products as of its April 2026 release. Landsat carries no restrictions on use or redistribution, none. Copernicus Sentinel data are governed by a free, full and open policy that explicitly permits reproduction, redistribution, adaptation and modification. USGS 3DEP elevation products are free and unrestricted.

Ten out of ten of the major hazard intensity and feature systems I would want are openly obtainable.

We are not poor. We are, on the hazard side, extraordinarily rich.

And the labels are not simply locked away either

The second seductive story is that the features are open and the labels are private. Hazard data free, consequence data locked behind insurers.

That is also too simple, and the counterexample is sitting in California.

CAL FIRE's Damage Inspection program publishes structure level wildfire damage records openly, and records construction features and defensive actions when inspectors can determine them. This is not a rumor of a dataset. A 2026 Science Advances analysis used more than 100,000 DINS records spanning 2013 to 2024. Peer reviewed damage models, structure risk models and fragility research are being built on it right now.

So anyone who tells you that empirical wildfire building consequence data simply do not exist has not looked.

Even the enclosure story is not one directional. Zillow stopped distributing ZTRAX in October 2023, which was a real loss to research. In March and April of 2026, access was restored through ICPSR, roughly 400 million public records covering about 150 million parcels across more than 3,100 counties. Not wide open, to be clear. It is restricted access now, requiring a data use agreement and research justification, with no redistribution. But the story is institutional fragility and recovery, not a straight line into privatization.

So what is actually missing

Strip away both bad versions and the real gap is narrower and much more interesting.

What we are missing is the paired, denominator complete label.

By that I mean one record, for one building, that ties together all of this at once:

The outcome. Did it survive, and in what condition.

The hazard intensity that specific building actually experienced. Not the fire's average behavior. What arrived at that wall.

The construction state. Roof class, vent type, glazing, siding, deck.

The mitigation state, and crucially its condition on that day rather than on the day of some inspection two years earlier.

The cost, both of the mitigation and of the damage.

And the exposed assets that did not fail, sharing a common identifier with all of the above.

Those pieces mostly exist somewhere. They are split across agencies, private vendors, insurers, local governments and modeled inventories, and they rarely share a common asset key. DINS is the closest thing we have, and even DINS is California specific, event constrained, carries acknowledged missingness when structures cannot be identified after severe damage, and does not by itself hand you the undamaged control population with matched exposure.

The bottleneck is not the label in the abstract. It is the join.

The number that tells you how bad the plumbing is

If you want to know whether this is a real infrastructure problem or just me complaining, look at what happens when someone tries to reproduce hazard science.

Researchers audited 360 papers drawn from the 1,989 published in 2017 across six hydrology and water resources journals. Here is what they found.

Just over 70 percent of papers stated that at least some materials were available. Under half, 48.6 percent, actually had materials that could be accessed online. Twenty papers out of 360, that is 5.6 percent, made input data and model or code and directions publicly available together.

Four papers were fully reproduced. Four. Out of 360.

Two more were partially reproduced. Their estimate for the full population of 1,989 papers put the reproducible share somewhere between 0.6 and 6.8 percent.

And note what that audit is not saying. Many of those failures happened after the data were technically available. Unclear instructions. Hard coded file paths. Imprecise links. Proprietary software. That is not enclosure. That is plumbing.

There is a decay term too. A separate team requested data for 516 papers published between two and 22 years earlier. For each additional year of article age, the odds that the underlying dataset still existed fell by roughly 17 percent. The evidence rots, quietly, while everyone assumes it is safe somewhere.

We already know how to fix this, because we did it for earthquakes

Here is the part that should make you optimistic rather than tired.

The claim that hazard science cannot build shared evidence infrastructure is refuted by hazard science.

Earthquake engineering built exactly this. The PEER NGA-West2 ground motion database assembled 21,336 mostly three component records from 599 earthquakes, curated, with source, site and distance metadata, and it is used for ground motion selection in practice. DesignSafe, the natural hazards engineering repository, had published more than 1,700 datasets with permanent identifiers by December 2024, nearly 400 of them in 2024 alone, spanning wind, coastal, reconnaissance and damage surveys as well as earthquake work. The Global Earthquake Model ecosystem publishes vulnerability and exposure products. Oasis LMF publishes an open source catastrophe modeling framework under a permissive license.

Wildfire is not starting from zero either. There is an international fire model intercomparison effort. Canada published a fire spread dataset with daily progressions for fires above 1,000 hectares from 2002 to 2021 with environmental covariates. Flood inundation benchmarking efforts are emerging.

So the honest sentence is not "hazard science has no commons." It is that hazard science knows perfectly well how to build a commons, has built a very good one for ground motion, and has not yet built one for observed asset consequences spanning multiple events, construction classes, and undamaged controls.

Seismic is the internal control that proves it is possible.

One warning about benchmarks

I do not want to oversell the fix, because benchmarks have their own pathology.

The most famous benchmark in machine learning, ImageNet, has documented annotation problems and known misalignment between benchmark gains and real world performance. A leaderboard creates enormous incentive to optimize the leaderboard rather than the actual task.

If we build a hazard consequence benchmark, it needs event held out and region held out evaluation, versioned labels, honest uncertainty fields, and deliberate resistance to overfitting. A scoreboard is not validation infrastructure. It is just a faster way to be confidently wrong together.

The lever nobody is pulling

Now the most actionable thing I found, and it is a procurement detail, which is exactly why nobody writes about it.

There is a real tension between commercial data and reproducible science. A researcher can be legitimately licensed to analyze a commercial satellite image, publish a finding from it, and be unable to deposit the source image alongside the paper. That is not "the data do not exist" and it is not "the researcher cannot get it." It is conditional reproducibility, where an authorized team can work but a reviewer or a competing team cannot check.

Here is the part that matters. That restriction is a purchasing decision, not a law of nature.

NOAA has repeatedly bought commercial radio occultation observations under licenses granting the government unlimited distribution rights. One 2023 delivery order specifies 3,100 profiles per day with a data sharing license carrying unlimited distribution.

So when a federal agency buys commercial hazard data, the redistribution terms are negotiable, and at least one agency has been negotiating for openness for years. Every future procurement is a chance to buy the public a usable evidence base instead of a licensed peek at one.

That is the highest leverage finding in this entire area and it costs nothing to say out loud in a contract.

Back to the house that stood

Somebody should have knocked on that door.

Not for a human interest story. To write down the roof assembly, the vent screens, the window glazing, the deck substructure, the state of the first five feet on the day the fire came rather than on the day of the last inspection, the distance to the nearest structure that burned, and the direction the wind was blowing.

And then to record that same tuple for the neighbors who lost everything, so the two are comparable.

That is not sentiment. That is the denominator. Without it, every survival rate any of us quotes, including mine, is an estimate resting on an incomplete count of the people who lived.

We have 178 petabytes describing the fire. We have far less describing the houses it did not take, and those are the ones holding the answer.

For the researchers, adjusters, inspectors and code officials reading this: who is in a position to record the survivors, and what would it take to make that routine instead of exceptional?

References

NASA Earth science data holdings, more than 178 petabytes. USGS Water Data for the Nation, more than 13,500 real time monitoring locations. Monitoring Trends in Burn Severity, 30,390 mapped fire products as of the April 2026 release.

USGS Landsat data policy, no restrictions on use or redistribution. Copernicus Sentinel legal notice, free full and open. USGS 3DEP product access terms.

CAL FIRE Damage Inspection (DINS) public dataset. A 2026 Science Advances analysis using more than 100,000 DINS records from 2013 to 2024.

Zillow ZTRAX, distribution discontinued October 2023, research access restored through ICPSR March to April 2026 under restricted use terms. Approximately 400 million records, about 150 million parcels, more than 3,100 counties.

Stagge, J. H., et al. Reproducibility audit of 360 articles drawn from 1,989 published in 2017 across six hydrology and water resources journals.

Vines, T. H., et al. Data availability decay across 516 papers, odds of dataset persistence declining approximately 17 percent per additional year of article age.

Pacific Earthquake Engineering Research Center, NGA-West2 database, 21,336 records from 599 earthquakes.

DesignSafe / NHERI, more than 1,700 published datasets with DOIs by December 2024.

NOAA commercial radio occultation delivery order, 3,100 profiles per day under a data sharing license providing unlimited distribution rights.

Somewhere at three in the morning, on a ridge you have never heard of, a crew is cutting line.

They have been at it for fourteen hours. The line they are building may hold. It may burn over. It may sit there for a week and never see fire at all, because the wind turned and the fire went somewhere else, and every hour of that work becomes an unmarked scar on a hillside that nobody will ever measure.

Now here is the part I cannot stop thinking about.

That crew is not in the data.

Not in most of the datasets we use to train the models that tell us where fire goes. Not in the perimeters. Not in the training labels. The fire's progression is recorded in careful hourly detail. The people who spent the night trying to change that progression are, in the phrase the field actually uses, unobserved.

I want to explain why that is a much bigger problem than it sounds like, because it is not a complaint about credit or recognition. It is a problem in the mathematics, and it reaches all the way to how your insurance gets priced.

What the researchers said out loud

I am not inferring this. One of the well-known machine learning wildfire papers says it plainly.

The FireCast team noted that their historical fire perimeter observations came from fires that were being mapped while firefighters were working to contain them. Then they stated that firefighter activity was ignored, because they did not have those data.

Read that twice. The training signal was the outcome of a fight. One side of the fight was recorded. The other was left out, not from carelessness, but because the record does not exist in a usable form.

This is not one team's shortcut. It is close to the default condition of the field.

Why a missing variable becomes a lie

Here is the technical heart, and I will keep it in plain language.

Suppose you want to learn how fire moves. You observe the fire's state today, the weather, the fuels, the terrain, and the fire's state tomorrow. You fit a model that maps one to the other. It scores well. You ship it.

What did you actually learn?

You learned how fire moves when people are fighting it the way they fought it during your training period. Because suppression was in every one of those observations, silently, shaping every perimeter you fitted to.

And suppression is not random. That is the whole problem. An incident commander does not flip a coin. They put resources where the fire threatens homes, where there is road access, where crews can work safely, where the values at risk justify the exposure. Their choice depends on the very thing you are trying to predict.

In statistics this is called endogeneity, and it is the kind of error that does not announce itself. Your model still produces a number. Your validation still returns a score. Nothing looks broken.

But you did not estimate fire physics. You estimated the historical fire suppression policy, wearing physics as a costume.

For forecasting next week under the same policy, that may be fine, and I want to be fair about it. If you are predicting what a fire will do tomorrow in a world with the same crews and the same doctrine, a model that has absorbed that doctrine may serve you well.

It stops being fine the moment you ask any of the questions we actually care about. What would this fire have done with nobody on it. Would this fuel treatment have helped. What happens when six fires burn at once and the crews are somewhere else. What does 2035 look like when the resource picture is different.

Those are counterfactual questions. A model that cannot separate the fire from the firefight cannot answer them, no matter how confident the output looks.

The number that made me sit down

If you want one statistic for how hard this is to fix, it is this one.

Researchers evaluated fireline across thirteen wildfires in north-central Washington. They mapped 2,205 kilometres of constructed line. Of that, 972 kilometres, about 44 percent, was ever actually engaged by fire.

Fifty six percent of the line those crews built never met the flame front.

I want to be careful about what that does and does not mean. It does not mean the work was wasted. Line gets built for contingency, for safety, for anchoring, for the fire the weather was threatening to produce. Building line the fire never reaches is sometimes exactly right.

What it means is that action, engagement, and success are three different variables, and we routinely collapse them into one. If you count kilometres of line as suppression effort, you have counted something that more than half the time did not touch the fire.

It gets worse when you look at how sensitive the measurement is to a bookkeeping choice. On the Carlton Complex, two effectiveness metrics came out 57 and 59 percent lower depending on which fire perimeter source the analysts used. Same fire. Same crews. Same work. The number moved by more than half because of a data provenance decision.

That is not a rounding error. That is a measurement system that is not yet ready to be a calibration input.

The selection problem underneath it

There is a second thing wrong with the training set, and it is more unsettling than the first.

More than 95 percent of wildfire starts are controlled during initial attack. Historically, only something like one to two percent of western fires grew past a hundred hectares.

So when you assemble a database of large fires to train and test your model, you are not sampling wildfire. You are sampling the small fraction of ignitions where initial attack failed, or where a deliberate decision was made to let it run.

Our entire empirical picture of what fire does at scale is drawn from the record of the times we lost.

Sit with that for a second, because it has a strange emotional shape to it.

The successes are invisible by construction. The thousands of fires stopped at a quarter acre at two in the afternoon by an engine crew that got there fast leave almost no trace in the science. They are the dog that did not bark, over and over, ninety five times out of a hundred.

We built our understanding of fire out of our failures, and then we were surprised that it looks so grim.

What I am not saying

I want to draw this line carefully, because the sloppy version of this argument is everywhere and it is wrong.

I am not saying fire models ignore suppression. They do not. There is real, careful work modeling containment probability, initial attack effectiveness, and suppression production efficiency. Researchers have reconstructed fireline outcomes across dozens of large fires. Australian work has estimated what actually drives suppression success in the first twenty four hours. This is a serious literature and it deserves better than a strawman.

I am not saying the disciplines do not talk to each other. That claim gets made a lot and it is false. There are models that couple fire spread with pedestrian movement and traffic during evacuation, and they have been through formal verification protocols. There are coupled human and natural systems models where management decisions change the landscape and the landscape later changes the fire.

And I am not saying nobody has noticed. A 2025 peer reviewed paper recommends verifying spread models against fires with little or no suppression, precisely because those are the cases where you can see the physics without the policy on top of it. Somebody is already on this.

What I am saying is narrower and, I think, harder to dismiss:

We can observe fire far better than we can observe our response to it. Fire progression is sensed hourly from aircraft and satellites. Suppression lives in narratives, resource records and line layers that are not routinely assembled into a common causal event log. Until that gap closes, a large class of the questions we most want answered cannot be answered from the data we have, and models will keep returning confident numbers to questions they are not equipped to address.

Why this lands on your house

You might reasonably think this is an argument among modelers. It is not, and here is where it arrives.

Those models increasingly sit underneath things that touch you directly. Where the risk score on your address comes from. Whether a carrier writes your neighborhood. Which fuel treatments get funded. Where crews get pre positioned. What a developer is allowed to build and what a lender will finance.

If the model underneath those decisions has quietly encoded the assumption that a certain amount of firefighting will always show up, then the risk it reports is conditional on a resource picture nobody has promised you.

We are not, at the moment, in a world where that assumption is getting safer. More simultaneous fires means the same crews spread thinner. A model calibrated on a period when the cavalry usually arrived will not tell you it has made that assumption. It will just be wrong later, politely, in a direction that flatters the present.

That is the part that should worry an underwriter more than any single fire.

What would actually fix it

Not a bigger model. A better record.

The single most consequential missing dataset in this field is unglamorous. It is a suppression event log: what action was taken, exactly where, exactly when, with what resources, against what fire state, with what outcome, and ideally why that tactic was chosen. Pieces of this exist. A peer reviewed quality assured containment fireline dataset landed in 2025 and it is a real step. But the complete tuple, at operational resolution, routinely collected, does not exist.

Every serious empirical field eventually builds this. Aviation has it. Medicine built it for trials, specifically so that treatment could be separated from outcome. Wildfire has extraordinary sensing of the hazard and thin, fragmented observation of the intervention, which is exactly backwards from what you need to learn whether the intervention works.

The second fix is already published and costs nothing: when you validate a spread model, say what you are validating against. If your test fires were fought, then your score measures how well you predict a managed fire, not a free burning one. Just write that sentence in the paper. It is the difference between a number and an honest number.

Back to the ridge

The crew on that ridge finished their line around dawn. Maybe it held. Maybe the fire never came.

Either way, what they did that night changed where the fire went, and therefore changed the perimeter, and therefore changed the training label, and therefore is sitting inside every model fitted to that fire, unnamed and unmeasured, mixed permanently into what we now believe about how fire behaves.

I do not think that is a sentimental observation. I think it is the most concrete engineering problem in wildfire science right now.

We taught the machines using the record of a fight, and then we deleted one of the fighters. If we want models that can tell us what happens when the help does not come, we have to start writing down what the help actually did.

For the fire scientists, modelers and incident folks reading this: what would it take to build that event log, and who would have to own it?

References

Radke, D., Hessler, A., & Ellsworth, D. (2019). FireCast: Leveraging deep learning to predict wildfire spread. IJCAI Proceedings. The paper states that historical perimeter observations came from fires being contained, and that firefighter activity was ignored for lack of data.

Lemons, R., et al. (2023). Evaluating fireline effectiveness across large wildfire events in north-central Washington State. Fire Ecology. 2,205 km of evaluated fireline, 972 km engaged, 44 percent. Carlton Complex effectiveness metrics 57 and 59 percent lower when calculated from MTBS versus the operational fireline perimeter. https://doi.org/10.1186/s42408-023-00167-6

Gannon, B., et al. A geospatial framework to assess fireline effectiveness for large wildfires. Fireline classified as held, burned over, or not engaged across 33 large fires.

Finney, M., Grenfell, I., et al. (2009). Modeling containment of large wildfires using generalized extreme value theory. Contains the historical large-fire tail estimates.

Wildland fire response and suppression success. Rangelands. More than 95 percent of starts commonly contained during initial attack.

Reimer, J. (2019). Measuring initial attack suppression effectiveness through burn probability. Fire.

Katuwal, H., Calkin, D., & Hand, M. (2016). Production and efficiency of large wildland fire suppression effort. Journal of Environmental Management.

Wahlqvist, J., et al. (2021). The simulation of wildland-urban interface fire evacuation: the WUI-NITY platform. Safety Science.

Ronchi, E., et al. (2023). The verification of wildland-urban interface fire evacuation models. Natural Hazards. 24-test verification protocol.

Arkowitz, et al. (2025). Quality-assured containment fireline dataset

Those are not in tension. They are the same job. I believe buildings can be made to survive and neighborhoods can be made to hold. The only reason I get to say that in public is that I am relentlessly pessimistic on paper first, in a specific and disciplined way, before anything gets built.

The psychology literature has a name for why that combination works, and a warning about who it works for. I will get to both. But this essay is really about what happens when that discipline gets outsourced to something that agrees with you.

The job

In 1587, the Catholic Church created a position whose entire purpose was to argue against sainthood.

The Promotor Fidei. The Devil's Advocate. Every candidate for canonization had promoters assembling the affirmative case, so the Church appointed a professional whose duty was the counter-case. Not to be balanced. To object.

Notice what problem this solves. It does not ask the enthusiasts to please be objective, which is what most organizations still do. It assigns the objection to a person with standing, procedural rights, and the ability to slow the whole thing down.

In 1983, John Paul II reformed the process and dramatically reduced the office's role. Here is what happened next: he canonized 482 saints. In the preceding 600 years, the Church had canonized roughly 300.

Now, I cannot prove the causal link, and I will not pretend to. Several things changed at once: the procedures got faster, the Church went global, candidates had accumulated. But I can tell you what the before-and-after illustrates, because I have watched it happen in my own industry. When you remove the person whose job is to say no, throughput goes up.

That is what throughput means.

Engineering built the same job, over and over

My profession rediscovered the Promotor Fidei at least five separate times, and mostly by accident.

In 1949, a US military procedure called MIL-P-1629 required designers to enumerate, item by item, how their design fails and what happens when it does, while the design could still change. That became FMEA. It did not start at NASA, whatever the slide decks say, but NASA made it famous: by 1966 the Apollo program formally required its reliability engineers to imagine how their own machine would kill the crew. Sit with that. Inside a program whose every incentive was to make an unprecedented machine work on schedule, someone was paid to describe, in writing, how it fails.

In the 1960s, chemists at Imperial Chemical Industries invented HAZOP, which hands a room full of engineers a fixed grammar of guide words, NO, MORE, LESS, AS WELL AS, PART OF, REVERSE, OTHER THAN, and forces them to imagine every way the process could deviate from intent. Most references drop AS WELL AS and PART OF, which is a small irony, because those two are the imaginative ones. MORE pressure is easy to picture. Something extra being present that nobody planned for is where the interesting accidents live.

And at Bell Labs, working on the Minuteman missile program in the early 1960s, engineers built fault tree analysis, which inverts the whole exercise: you begin by naming the disaster, then reason backward through every combination that could produce it.

Different fields, different decades, one repeated discovery. People are terrible at attacking ideas they are invested in. So do not leave the attack to temperament. Build a role that forces it.

Scenario 8

Fire protection engineering carries my favorite version, and it is the reason I wanted to write this.

In performance-based design, you define failure before you calculate success. You set the criteria first: tenability, egress time, structural endurance. Then NFPA 101 hands you eight design fire scenarios your building must survive. You do not get to pick only the fires that flatter your design.

And then there is Design Fire Scenario 8.

Scenario 8 requires you to run an ordinary fire with one or more of your fire safety features turned off. Sprinklers down. Detection out. The code writes the question directly into the standard: what if the thing you are counting on does not work?

I have spent much of my professional life inside that question. It is the difference between a building that meets code and a building that is robust. Hold onto it, because we are about to point it somewhere uncomfortable.

The hollowing

Here is the part my profession talks about less.

Institutionalized skepticism has a failure mode: the procedure survives, the skepticism leaks out. The form gets filled. The boxes get ticked. The analysis gets done, in the sense that a document now exists.

Sometimes the decay is mathematical. Automotive FMEA bolted on a Risk Priority Number, multiplying rankings for severity, occurrence, and detection, and managers learned to work the cutoff: address everything above 150, file everything below. The trouble is that an RPN of 160 can describe a frequent nuisance or a rare catastrophe, and the arithmetic cannot tell them apart. The score starts substituting for the question the score was supposed to serve, which is whether this particular failure is tolerable.

Sometimes the decay kills people. In 2006, the RAF lost Nimrod XV230 over Afghanistan. Fourteen aboard. The aircraft had a safety case, the formal artifact whose entire purpose is to demonstrate that hazards have been identified. The official review found it had failed to identify the key hazards. Fourteen families learned that the document meant to stand between their people and this outcome was, in the reviewer's judgment, hollow. The paperwork did not just miss the danger. It manufactured confidence that the danger had been looked for.

Researchers later gave the broader pattern a name: safety clutter. Procedures, forms, and sign-offs performed in the name of safety that no longer contribute to it. It accumulates for a reason you already know from your own organization. After an incident, adding a form is visible and defensible. Removing one exposes you to blame. So the forest of controls only grows, and a 2024 study of surgical checklists found exactly what you would predict: compliance documentation near 100 percent, increasingly decoupled from whether the actual safety conversation ever happened.

I will make it personal. When I went looking for hard evidence that independent plan review and structural peer review catch errors that self-review misses, evidence for the value of work I do, I could not find a usable dataset. Not a catch rate. Nothing you could defend as a measurement. The practice is almost certainly valuable. The logic is strong. But we pay for the antagonist on faith, because the alternative, letting the designer judge his own work, is structurally indefensible.

Keep that phrase in mind.

The experiment that reorganized my thinking

Psychologist Charlan Nemeth ran the experiment that this whole essay turns on.

Her team compared authentic dissent, a person who actually holds the minority view, against assigned devil's advocacy, a person playing the role because someone told them to. Authentic dissent worked. More original thinking, more real consideration of the opposing case, more changed minds.

Assigned devil's advocacy did worse. In some conditions it backfired entirely, producing what Nemeth called cognitive bolstering. The group heard the scripted objections, rehearsed its rebuttals against an opponent who did not mean it, and walked out more confident than it walked in.

Read that again. Performed disagreement does not just fail to help. It can inoculate you against the real thing. You feel tested. You were not.

And notice why the authentic version works. Real dissent is expensive. The person voicing it risks the room's irritation, their own reputation, sometimes the relationship. That cost is the signal. When someone pays it anyway, you lean in, because people do not spend social capital on objections they do not believe.

Which brings us to a reviewer who pays nothing at all.

The polite new reviewer

Ask an AI model to red-team your design, your report, your underwriting file. It answers instantly. Fluent, organized, professionally formatted objections. It finds real things. I use it, and it is useful.

It is also, structurally, assigned dissent. It holds no view. It carries no consequence for being wrong. It has no standing, and there is nothing it can refuse to sign.

And unlike the reluctant colleague you drafted into the role, it has a measured tendency to tell you what you want to hear. Anthropic researchers published the foundational measurements of AI sycophancy in 2023. In April 2025, OpenAI publicly rolled back a model update because it had become too agreeable, their account, not mine. There is now a small industry of benchmarks probing the tendency in factual domains, including mathematics and clinical reasoning.

Now the caution, because this is where essays like this usually overreach. The literature on humans over-trusting automation is real but messier than the headlines. There is no meta-analysis that gives you a clean effect size; anyone quoting one is quoting a number that was never computed. I will also not tell you that Air France 447 or the 737 MAX were automation bias, because neither investigating body said so, and both are better read as a harder lesson: the designer's assumptions about the operator were wrong.

What the evidence does support is narrower and more useful. Expertise helps some, but it does not immunize. And the mechanism is quiet. Experts do not decide to trust the machine more. They just look less.

That last finding is the one that should bother you. The kill does not arrive as a decision. It arrives as a slow reduction in how hard anyone is looking.

What negative thinking is actually for

I promised the psychology, so here it is, including the part that cuts against my own habits.

Julie Norem studied people she calls defensive pessimists: anxious high performers who prepare by imagining what could go wrong. Her key finding is not that pessimism wins. It is fit. Defensive pessimists perform worse when you block their negative preparation. Strategic optimists perform worse when you force them into it. The technique belongs to the person, not the poster. So no, I am not prescribing dread. I am describing a discipline that some of us use to make optimism honest.

And while I am correcting things, the most famous statistic in this genre is wrong. Gary Klein's premortem article says prospective hindsight improves the ability to correctly identify reasons for future outcomes by 30 percent. I went to the 1989 study behind it. The researchers never measured whether reasons were correct. They counted how many reasons people generated, and the lift came mostly from telling people the outcome was certain, not from imagining the future as past. The premortem is still a decent tool with some direct experimental support. It is just running on a misquote, which is its own small lesson about how eagerly we accept evidence that flatters our methods.

There is also a serious scientific argument against everything I have said so far, and you deserve to hear it. Erik Hollnagel calls it Safety-II. His point: things go right far more often than they go wrong, and an organization that studies only its failures becomes strangely ignorant of why it normally succeeds. Real work never follows procedure exactly. People adapt, adjust, compensate, and most of the time those adaptations are what save the day. Study only the accident and you miss the ten thousand quiet recoveries. He is right about that, and the best safety thinking now runs both ways: hunt the failure paths, and understand the successes. I hold the negative side of that pairing not because it is the whole truth, but because it is the half that dies first when everyone is busy and the machine is agreeable.

Negative thinking earns its keep under exactly one condition: when it changes the model or changes the plan. A risk you identify and then route around is engineering. The same risk recited nightly without consequence is rumination, and the literature is not kind to rumination.

Which is the whole point. The value was never the negative thought. It was the consequence attached to it.

So, did we automate the devil's advocate or kill him?

We killed him. The automation is the alibi.

The office was never the objections. Objections are cheap; the Church could have hired a lector to read complaints aloud. The office was the standing. A person who could halt the proceeding, whose signature the enthusiasts had to earn.

Every licensed engineer knows this in their hands. The first time you seal a drawing, someone explains what the stamp means, and the room gets a little quieter. It means you can now be wrong in a way that costs you. That weight is not a burden bolted onto the profession. It is the profession. A review carries exactly as much force as its reviewer has to lose.

What we automated is the other half, the performance. The machine produces perfect evidence that challenge occurred: articulate, thorough, timestamped. Every incentive that hollowed out the safety case and ritualized the checklist now has a tool that generates the ritual on demand, at no cost, with no friction, and no one to argue with.

So here is the test I want you to run this week. It is Scenario 8, pointed at your own review process.

Take whatever you count on to catch your mistakes. The colleague who reads your reports. The peer reviewer. The checklist. The model. Now ask the question the fire code asks about sprinklers: what happens if it does not work? And check it against the record, because your record already holds the answer.

Has your reviewer ever stopped a job? Has the checklist ever come back failed? Has the AI ever told you that you were wrong in a way that cost you a week?

If the answer is no, you do not have a devil's advocate. You have a very productive way of feeling tested.

The fix is not more review. It is review that can lose you something: a reviewer with authority to stop the work, a critique you must answer in writing, a decision that stays open until the objection is resolved. Disagreement counts when it can change the outcome. Everything else is throughput.

I remain the optimist people say I am. I think the buildings can be made to survive, and I think this technology will end up on the right side of that fight.

That is precisely why I am going to keep a human in the room whose job is to tell me I am wrong, and keep giving that person the one thing the machine cannot hold.

Standing.

Sources and notes. The Promotor Fidei dates to 1587 under Sixtus V; John Paul II's 1983 reform is Divinus Perfectionis Magister, and the canonization figures are Vatican records (482) and Pew Research Center (roughly 300 over the prior six centuries). FMEA's lineage runs from MIL-P-1629 (1949) through NASA's Apollo FMECA procedure RA-006-013-1A (1966). HAZOP grew inside ICI in the 1960s and is codified in IEC 61882. Fault tree analysis originated at Bell Labs for the Minuteman program. Design Fire Scenario 8 is in NFPA 101's performance-based option; the design process is the SFPE Engineering Guide to Performance-Based Fire Protection. The Nimrod findings are from the Haddon-Cave Review (2009). Safety clutter is Rae, Provan, Weber and Dekker (2018); the checklist ritualization study is in Sociology of Health and Illness (2024). Dissent research is Charlan Nemeth and colleagues; the Safety-II counterargument is Erik Hollnagel; defensive pessimism is Julie Norem's work; the premortem correction traces Klein's 2007 HBR article back to Mitchell, Russo and Pennington (1989). AI sycophancy measurements begin with Sharma et al. (Anthropic, 2023); the April 2025 rollback is OpenAI's own account.

Two days ago I published an essay arguing that my profession has never defined the fire. Seismic has a design event. Wind has four of them, sorted by how much the building matters. Wildfire, I said, has a color on a map.

Jonathan Barnett, a fire protection engineer who has spent a long time in exactly this territory, told me that was wrong. Australia already has what I said did not exist.

So I went and read the code itself, clause by clause, rather than taking either of us at our word. He is right, and the correction goes further than his own example suggested.

So I am doing it in public and in detail. Quietly dropping a claim and moving on is not a standard I would accept from anyone else writing about engineering.

What I said, and what is actually true

I said wildfire has the geography but not the requirement. That is false in Australia, on two separate levels.

The design demand exists. AS 3959:2018, Construction of buildings in bushfire-prone areas, produces a Bushfire Attack Level from site conditions: classified vegetation, horizontal separation, effective slope, and a jurisdictional Fire Danger Index. The output is not a category. It is a radiant heat flux in kilowatts per square metre.

BAL-12.5 means up to 12.5 kW/m². BAL-19 means above 12.5 up to 19. BAL-29 means up to 29. BAL-40 means up to 40. BAL-FZ, flame zone, means above 40 with direct flame exposure. Each level drives a different construction section governing materials, glazing, screening, subfloors and openings.

That is a physical design action selected from site geometry and fire weather. It is the

thing I said wildfire does not have. And AS 3959 has an Appendix B detailed method that is a radiative transfer calculation with flame geometry, view factor, atmospheric transmissivity, emissivity and flame temperature, not a lookup from a hazard color.

The risk targeting exists too, and this is the part that actually ends the argument.

The Australian National Construction Code sets a design bushfire with a stated annual exceedance probability. For a house, NCC 2022 H7P5 requires the building to "reduce the risk of ignition from a design bushfire with an annual exceedance probability not more than 1:50 years." For Volume One buildings, G5P1 sets 1:100, and 1:200 for a Class 9 building.

Then the verification method does the thing I said nobody had done. H7V2 states that compliance "is verified if the ignition probability for a building exposed to a design bushfire does not exceed 10%." It scales the exposure by importance level, and for houses Table H7V2 gives 1:500 under complex analysis and 1:50 under simple analysis at Importance Level 2, rising to 1:2000 and 1:200 at Importance Level 4. The Volume One table runs 1:500, 1:1000 and 1:2000 across importance levels 2, 3 and 4.

It also tells the designer what to analyse: an event tree, and design bushfire conditions combining direct attack from airborne embers, burning debris and accumulated embers against a building element, radiant heat from the front, and direct flame attack. The applied actions must allow for variation in fire weather, vegetation, distance, topography, flame height, flame tilt, and "ignition of adjacent buildings, building elements, plants, mulch and other materials."

That last clause is the neighbor. In the code. As a design input.

Read that again with my essay in hand. I wrote that you cannot tier wildfire by consequence, so the fire station and the shed get the same treatment. Australia tiers it by importance level. I wrote that we have never stated an acceptable outcome the way seismic does. Australia states a conditional ignition probability of 10 percent.

The number that should have stopped me

Here is the comparison I did not make and should have.

American seismic design targets a one percent probability of collapse in fifty years. ASCE 7 says so directly for Risk Category II. I used that as the contrast case, the thing wildfire could never match.

Now hold it next to the Australian numbers.

Seismic gets there in two moves. Define a ground motion, then cap the conditional probability that a building collapses if that ground motion arrives. FEMA P-695 sets that conditional cap at 10 percent for ordinary buildings. The pair of them, a defined event and a 10 percent conditional failure allowance, is what produces the one percent in fifty years.

Australian bushfire design uses the same two moves and, remarkably, the same second number. Define a design bushfire by annual exceedance probability. Then cap the conditional probability that the building ignites if that fire arrives. H7V2 sets that cap at 10 percent.

Ten percent conditional failure, in both. That is not a coincidence I am reading into the text. The ABCB's own commentary on NCC 2022 says the bushfire quantification now aligns with other catastrophic events such as cyclones and earthquakes. They borrowed the reliability architecture on purpose.

And the arithmetic follows it home. Importance Level 2, complex analysis, exposure at 1:500. Conditional ignition capped at 10 percent. Both numbers from the same clause, both applying to Class 1 buildings, which is to say houses. Multiply and you get roughly 1 in 5,000 per year. Over fifty years, assuming independence purely for illustration, that lands near one percent.

The same place seismic lands.

I want to be careful, because the multiplication is mine and not a claim the NCC makes about its own calibration. A rigorous annual ignition risk needs the full hazard curve and a fragility function, not a product of two numbers. But the structure underneath is not my invention and does not depend on my arithmetic. I said earthquake engineering has probability and wildfire has colors. Australian bushfire engineering has probability, built on the same skeleton, calibrated to the same conditional failure allowance, and it arrives in the same neighborhood.

That is worse for my essay than a near miss would have been. A near miss would mean somebody was fumbling toward it. This means somebody already did it.

I was also unfair to the United States

The second correction runs the same direction.

I characterized American practice as essentially hazard mapping. It is not blank.

The 2024 International Wildland-Urban Interface Code has a construction system in Chapter 5, with ignition-resistant construction classes selected against fire hazard severity. The International Code Council reports more than 200 jurisdictions across 24 states using it. That is an adoption count reported by the code body rather than an audited census, and local amendments can change what adoption means, but "nobody uses it" would be inaccurate.

California now has its own Wildland-Urban Interface Code, Title 24 Part 7, effective January 1 2026, based substantially on the IWUIC. Its stated purpose covers fire from wildland and from adjacent structures. So even my neighbor argument, the piece I was proudest of, is recognized in current California code language.

NIST is the larger omission. Technical Note 1748 proposed a WUI Hazard Scale intended to characterize fire and ember exposure as a foundation for future codes. The Hazard Mitigation Methodology in TN 2205 incorporates structure separation and housing density, which is precisely the neighbor-as-loading idea I presented as having no analogue. NIST has tested parts of it against post-fire data, including the Trails community in the Witch and Guejito fires, where 274 homes sat in the study area, 245 inside the perimeter, 74 destroyed and 16 partially damaged.

I said nobody in the United States had attempted to define the exposure. People have been attempting it for over a decade.

What survives, and why it is a better argument

Strip out what was wrong and something more precise is left standing.

AS 3959 scales building capacity against a radiant flux coordinate. It carries ember attack through every BAL level, and higher levels progressively harden the vulnerable assemblies. What it does not do is tell the designer that BAL-29 corresponds to a particular firebrand number flux, particle size distribution, glowing duration or accumulated ember mass, and that BAL-40 corresponds to a larger one.

That matters because of what actually destroys houses. The 2009 Victorian Bushfires Royal Commission found that most houses damaged or destroyed were ignited by wind-borne embers rather than by direct flame contact or radiant heat from the vegetation fire. NIST reaches the same conclusion from the American side and separately identifies structure-to-structure spread as a major pathway.

So the honest formulation is this. Australia has a design action that quantifies one mechanism, radiant flux, extremely well, and prescribes protection against the dominant mechanism, firebrands, without quantifying its demand. The burning neighbor is not reduced to a standardized design action anywhere I could verify.

Barnett has a good answer to this, and I want to state it rather than dodge it. A severity coordinate does not have to independently parameterize every mechanism to be useful. Engineering standards routinely use a tractable scalar that correlates imperfectly with a messy multi-dimensional hazard. To beat that argument I would have to show that the radiant ladder badly misorders real structure risk, and I cannot show that. The evidence for ember dominance is strong. The evidence that BAL ordering is therefore useless does not exist.

The strongest thing he said

Barnett's best point was not about Australia at all. It was about Ingberg.

In 1928, S. H. Ingberg published work relating combustible fire load to an equivalent duration of standard furnace exposure, using what became known as the equal-area concept. Modern fire science does not accept equal temperature-time area as a universal measure of thermal damage. Ventilation, thermal inertia, geometry, section factor and cooling behavior all matter, and later researchers developed multiple competing equivalent-time methods precisely because the original relation was not physical.

And yet the standard fire resistance framework built on it survived, expanded, and still underlies ASTM E119 ratings today. Nobody claims the standard curve describes a real compartment fire. It describes a repeatable comparison.

The lesson is uncomfortable for the position I took. You standardize before the science is complete, because without a common quantity every designer can be sophisticated and mutually incomparable. Waiting for the physics to be finished is how you end up with forty years of hardening advice and no specification.

The counter-lesson matters just as much. Ingberg's proxy became permanent. So the first standard should expose its assumptions, keep a performance-based route open, and be coupled to a validation program before the proxy hardens into law.

The gap that is still real

Here is what I looked for and did not find, and it is the honest remaining weakness on the Australian side.

I could not locate a study that takes a modern Australian fire, reconstructs the actual BAL exposure at each house, verifies construction compliance, controls for defensible space and suppression and neighboring structures, and reports observed survival against the level the standard nominally targets. Evidence clearly informed the standard. That is a different sentence from the standard's levels having been validated to produce the survival probabilities they imply.

The position I would now defend is narrower and more useful:

Australia solved the engineering coordination problem before it solved the empirical reliability problem. It has a common design language, a probabilistic pathway, and a stated performance target. What remains open is how well the proxy and the target predict real building survival under modern community-scale fire, and whether the missing firebrand and neighboring-structure demands are large enough to matter.

The United States has not solved either problem. We have sophisticated exposure science at NIST, a real construction code in the IWUIC, an expanded hazard model in California, and no mandatory site-specific design action tied to a stated probability of an acceptable outcome.

The claim that survives

Not "wildfire has no design basis." That version flattered the writer, which is the direction to check first.

The accurate version is that wildfire already has design bases, that Australia built one twenty years ahead of us, and that what the United States lacks is a broadly adopted, site-specific, risk-calibrated design action which quantifies the mechanisms that actually destroy houses rather than classifying hazard and testing components against laboratory exposures.

That is a smaller claim. It is also checkable, and it points at work someone could actually do. Nothing prevents an Australian-style calculation from being run in Southern California. You would derive fire weather return levels from local weather records, choose an exceedance probability, map local vegetation into physical classes, and run the radiative method. The missing ingredient is not the physics. It is the policy choice about what probability we are willing to accept.

I told a homeowner last year that I could not tell her what her house could survive. That part was true, and it is still true here. But I told her it was because the question had no answer anywhere. That was not true, and she deserved the accurate version.

For the engineers and code officials reading this: if Australia can state a design bushfire at 1:50 and an ignition target at 10 percent, what is actually stopping us, and is it the science or the willingness to write down the number?

References

Standards Australia. AS 3959:2018, Construction of buildings in bushfire-prone areas, with Amendment 1:2019 and Amendment 2:2020. Table 3.1 BAL levels and radiant heat flux thresholds; sections 2.2.3 to 2.2.6 site assessment; Appendix B detailed method.

Australian Building Codes Board. National Construction Code 2022. H7P5 residential design bushfire AEP not greater than 1:50; G5P1 Volume One 1:100 and Class 9 1:200; G5V1 and H7V2 verification, 10 percent conditional ignition criterion and Table G5V1 importance level exceedance probabilities.

2009 Victorian Bushfires Royal Commission, planning and building findings on wind-borne ember ignition as the predominant house loss pathway.

International Code Council. 2024 International Wildland-Urban Interface Code, Chapter 5 construction requirements. ICC-reported adoption of more than 200 jurisdictions across 24 states.

California Building Standards Commission. 2025 California Wildland-Urban Interface Code, Title 24 Part 7, effective January 1 2026, sections 101.2 through 101.5.

National Institute of Standards and Technology. Technical Note 1635, A Case Study of a Community Affected by the Witch and Guejito Fires. The Trails development at Rancho Bernardo: 274 homes, 245 within the fire perimeter, 74 destroyed, 16 partly damaged. https://nvlpubs.nist.gov/nistpubs/Legacy/TN/nbstechnicalnote1635.pdf

National Institute of Standards and Technology. Technical Note 1748, WUI Hazard Scale, and Technical Note 2205, Hazard Mitigation Methodology. Cited for the existence of a structured US exposure-characterization effort, not for the Rancho Bernardo counts.

Ingberg, S. H. (1928). Tests of the severity of building fires. NFPA Quarterly, 22(1), 43 to 61.

American Society of Civil Engineers. ASCE/SEI 7-22. Wind design speeds by risk category.

Luco, N., et al. Risk-targeted seismic design maps, approximately one percent probability of collapse in fifty years.

At about seven in the evening on July 10, 2024, a lightning arrestor failed on a 230 kV transmission line in the Eastern Interconnection.

That is an ordinary thing. Arrestors fail. The line faulted, and because the fault was permanent rather than transient, the line eventually locked out.

What happened in between is the part worth your time.

The auto-reclosing on that line was configured for three attempts, staggered at each end. So the line tried to come back, failed, tried again, failed, tried a third time, failed. Because the attempts were staggered at both terminals, the system experienced six separate faults in eighty-two seconds.

The protection worked. The North American Electric Reliability Corporation (NERC)'s own language is that the protection system detected these faults and cleared them properly. The shortest fault lasted 42 milliseconds. The longest lasted 66. Nothing was slow, nothing hung, nothing failed to operate.

And in that same eighty-two seconds, roughly 1,500 megawatts of load left the system. About 1,260 megawatts of it stayed gone for hours.

Nobody tripped it

Here is the sentence that made me stop and read it twice.

None of that load was disconnected by utility equipment. It was disconnected on the customer side, by customer protection and controls.

All of it was data center load. The area has a high concentration of it.

The utility did not shed those customers. The customers shed the utility.

Two correct designs

To see why, you have to look at what each side is actually built to do, because both of them are built well.

Start with the relay. Automatic reclosing exists because most faults on an overhead line are transient. A branch touches a conductor, an animal bridges a gap, wind swings a span. The arc clears itself. If the line simply locked out on every fault, service would be miserable and crews would spend their lives driving to reset things that had already fixed themselves. So the relay tries again. Three attempts is a normal setting. Staggering them across both ends is normal too.

Now the data center. Its computing equipment and, just as important, its cooling equipment are sensitive to voltage disturbances. So the facility rides through them on a UPS, which takes over instantaneously when the grid sags and hands back when the grid recovers. That is also good design. It is the reason a voltage dip in the county does not corrupt somebody's database.

But there is a second scheme layered on top, and this is the one that matters. Many facilities count disturbances. If a certain number arrive inside a certain window, the facility stops trusting the grid, transfers fully to backup, and stays there until a human manually reconnects it.

NERC reports the typical setting as three disturbances in one minute.

Read that against the relay again.

Three reclose attempts. Six voltage depressions. Eighty-two seconds.

The reclosing sequence is not a series of unrelated events to the counter. It is a countdown.

Most of the sustained loss landed exactly on the third voltage depression, which was the third reclose attempt. About 1,260 megawatts went to backup and did not come back for hours, because coming back required somebody to walk over and do it by hand.

NERC's attribution is explicit. Most of the load loss is attributed to the interaction between the reclosing sequence and the disturbance-counting scheme.

Not to a defect in either one.

What it did to the system

Losing load sounds harmless. It is not.

The grid is a balance. Take 1,260 megawatts of demand out from under generation that is still spinning and frequency rises. Stop pushing that much power through the network and voltage rises too.

In this case frequency went to 60.047 Hz and settled back over about four minutes. Voltage reached 1.07 per unit, and operators had to remove shunt capacitor banks in the area to walk it back down.

Nothing broke. This event was a warning, not a casualty. NERC says as much.

But notice what the system had to absorb. The disturbance that the data centers protected themselves from was made larger by the data centers protecting themselves from it. Their exit was itself an event the operators had to manage.

The lazy version of this argument

I want to kill the easy read before it gets going, because it is wrong and it is everywhere.

The easy read is that AI is eating the grid and data centers are the villains. That is not what this shows.

Consumption is not the finding here. A steady gigawatt is not a reliability problem. Utilities plan for load. The finding is about dynamic behavior during a fault, which is a different thing entirely, and it comes down to a design fact that is nobody's scandal: these facilities are powered through voltage-sensitive electronics designed to protect servers, not to protect the grid.

Of course they are. Nobody sold a data center operator a UPS on the promise that it would stabilize the bulk electric system. They bought it to keep the racks up. It does that superbly.

The second lazy read is that somebody should have caught this. Somebody did. NERC published this incident review in January 2025, and it reads like an engineer's account, not an indictment. It lists what planners should start doing: require dynamic models of large loads, study how much load could drop for a given fault, and account for voltage-sensitive load when configuring reclosing schemes.

The problem was not that nobody noticed. It is that the thing to notice lived between two owners.

Why this looked familiar

I have spent a long time arguing that we price and protect wildfire one parcel at a time while the thing that actually burns is the block. A hardened house with an unhardened neighbor thirty feet away is not a hardened house. It is a house with a good roof standing next to a heat source.

The failure is not in either building. It is in the separation between them, which no one owns, no one inspects, and no one is on the hook for.

This is the same shape. Each protection scheme is locally correct and locally optimal. The relay protects the line. The UPS protects the racks. Both are doing their jobs. The exposure is created in the interaction, and the interaction has no owner.

And there is a detail that makes this more than an analogy for anyone who works in fire country.

Automatic reclosing is already a wildfire control. Utilities in high fire-threat areas disable or restrict reclosing during Red Flag conditions, because energizing a line back into a fault can throw sparks into dry fuel. EPRI keeps reclose blocking as its own category of wildfire mitigation technology, automated and manual. Some utilities scale it: the higher the fire risk, the fewer attempts allowed.

So the same relay setting is now carrying at least three objectives. Restore service quickly. Do not start a fire. Do not spook a gigawatt of load into walking off the system.

Nobody holds all three of those at once. The reliability engineer owns the first. The wildfire mitigation team owns the second. The third belongs to a customer whose equipment settings the utility does not control and, until recently, did not model.

The part that should bother you

NERC has since gone looking at how well planners actually model these loads. Roughly three quarters of the data-center load models it evaluated were not adequate to represent how those loads behave dynamically.

Sit with that. The planning models did not contain the behavior. Not "underestimated it." Did not represent it. The studies that tell an operator how a fault will play out were running on a picture of load that did not include the thing load actually did.

That is a specific and repeatable failure, and I do not think it is limited to the grid. It is what happens when a system grows a new component faster than anyone updates the model of that component. You keep getting answers. The answers keep looking reasonable. They are describing a system that no longer exists.

On May 4, 2026, NERC issued a Level 3 Essential Actions Alert, its highest-urgency category, covering repeated events where more than a thousand megawatts of computational load dropped off within seconds. Seven required actions, covering modeling, studies, measurement, commissioning, operations, protection, and controls. Entities had to acknowledge by May 11 and respond by August 3.

That response deadline has already passed. The answers are in. Most of us have not seen them.

The question underneath

Buried in the future considerations of that 2025 incident review are two questions NERC asked itself and did not answer.

Should large loads be a NERC registered entity?

And what is the definition of a large load?

Those look procedural. They are not. They are questions about where the boundary of the system is drawn, and therefore about who has to model, report, and answer for their own behavior.

For a century the answer was clean. Generators and wires were inside the system and had obligations. Load was outside it, a thing that happened to the system, and had none. A customer's only duty was to pay.

That distinction holds right up until a single customer's protection settings can move a gigawatt in one second. At that point the customer is not consuming the system. The customer is part of it, and is being governed by a rulebook written for the era when it was not.

This is the same fight as the one over whether your neighbor's vegetation is your problem. The honest answer in both cases is that the boundary was drawn for convenience, not for physics, and physics has stopped respecting it.

The counterweight, which is real

I do not want to leave this sounding like AI is only showing up on the hazard side of the ledger, because that is not true either.

The same technology wave put genuinely better forecasting into daily operations. ECMWF took its AI Forecasting System operational on 25 February 2025, running next to the physics model, and reports roughly a thousandfold reduction in the energy it takes to produce a forecast. NOAA followed in January 2026. Skillful ensemble weather, which used to require a relationship with a supercomputer, is turning into something closer to a utility.

That matters for everything I work on. Cheap ensembles mean hazard exposure work that was previously reserved for the few becomes available to the many.

So hold both. The same wave is making the forecast dramatically cheaper and adding a new correlated behavior to the system the forecast is meant to serve. One of those got headlines. The other got a Level 3 alert.

What I take from it

Resilience is usually sold as a property of a thing. A hardened roof. A redundant UPS. A well-set relay.

This event is a reminder that it is a property of an arrangement. All three of those components were excellent. The arrangement lost 1,260 megawatts for hours.

If you want to find the next one of these in your own domain, I do not think you look for the weakest component. I think you look for two well-designed systems that touch, that are owned by different people, and whose settings have never been examined in the same room.

That is where these live. Not in the failure of a part, but in the handshake between two parts that were each certified alone.

For the protection engineers, planners, and data center operators reading this: whose job is it to look at the reclose settings and the disturbance-count settings on the same page, and has anyone actually asked them to?

References

NERC, Incident Review: Considering Simultaneous Voltage-Sensitive Load Reductions, published January 8, 2025. Event of July 10, 2024, Eastern Interconnection. Six faults in 82 seconds, approximately 1,500 MW reduced, approximately 1,260 MW sustained, disturbance-counting scheme typically three in one minute.

https://www.nerc.com/globalassets/our-work/reports/event-reports/incident_review_large_load_loss.pdf

NERC Level 3 Essential Actions Alert on large loads, issued May 4, 2026. Seven Essential Actions, acknowledgement due May 11, response due August 3, 2026.

https://www.utilitydive.com/news/nerc-issues-rare-level-3-alert-over-data-center-load-losses/819295/

Morgan Lewis, NERC Alert Moves Data Centers From Emerging Risks to Planning Obligations, May 2026.

https://www.morganlewis.com/blogs/powerandpipes/2026/05/nerc-alert-moves-data-centers-from-emerging-risks-to-planning-obligations

Carbon Direct, Inside NERC's Level 3 Alert on data center loads. Source for the finding that roughly three quarters of evaluated load models were insufficient to represent dynamic behavior.

https://www.carbon-direct.com/insights/nerc-level-3-alert-data-center-loads

EPRI Distribution wildfire technology database, Reclose Blocking, automated and manual, under fault energy reduction.

https://distribution.epri.com/wildfire/public/wildfire-tech-database/fault-energy-reduction/reclose-blocking-automated/

ECMWF, ECMWF's AI forecasts become operational, 25 February 2025. Approximately 1,000 times reduction in energy use per forecast.

https://www.ecmwf.int/en/about/media-centre/news/2025/ecmwfs-ai-forecasts-become-operational

Communications of the ACM, AI Weather Forecasting Goes Operational. NOAA operational January 2026.

https://cacm.acm.org/news/ai-weather-forecasting-goes-operational/

I want to start with the number nobody in my field says out loud often enough, because it is the most encouraging fact in the entire discipline and it gets buried under every bad week.

In the 1920s, roughly 5.4 million people died in natural disasters. In the 2010s, with four times the population and vastly more of it living in harm's way, the figure was about 400,000. That is a decline of more than 90 percent in the decadal death toll.

We did not do that by making earthquakes smaller. We did not talk the cyclones down. We built a machine.

The machine has four parts, and I have written about them here before in pieces: a standard specific enough to check, an inspection that actually checks it, money to pay for the work, and a price that rewards the verified condition. Bangladesh cut cyclone deaths by more than 90 percent over four decades with a version of it built out of concrete shelters and radio warnings. California cut school collapse to zero with the Field Act. Florida cut windstorm losses with one statewide code.

None of those depended on a technology that did not exist yet. All of them depended on somebody deciding an outcome was unacceptable and then building the boring apparatus that made it stop happening.

So here is my actual thesis about the resilient future, and it is more hopeful than most of what you will read this week.

The knowledge problem is mostly solved. What is left is a deployment problem. And deployment problems are the specific kind of problem our species has demonstrably beaten before.

Let me show you the parts.

The physical layer: we know what works, and we can now prove it

For decades the honest answer to "does hardening actually work" was "we think so, directionally."

That answer is obsolete.

In May 2025, researchers at the University of Alabama's Center for Risk and Insurance Research published peer-reviewed analysis of homes built to the FORTIFIED Roof standard against standard construction after Hurricane Sally. FORTIFIED homes had 73 percent fewer insurance claims and 72 percent lower total losses. The study estimated insurers would have saved 105.6 million dollars if every home in Sally's path had met that one standard.

That is not a model. That is a natural experiment with a control group, and the intervention is a roof.

The economics are not subtle either. The National Institute of Building Sciences puts the return on adopting current model building codes at about 11 dollars per dollar invested, and the added construction cost at roughly 1 percent over 1990 standards. One percent. For an eleven-fold return.

Then there is the layer most engineers still treat as decoration. Mangroves prevent more than 65 billion dollars in property damage every year across 59 countries and reduce flood risk to more than 15 million people. That figure comes from hydrodynamic flood models coupled to the same actuarial methods insurers use, not from a brochure. There are roughly 100 coastal areas where the mangroves in front of them avert 100 million dollars or more in damages annually.

Green infrastructure is not the soft option. In a lot of geographies it is the highest-performing structural element on the site, and it happens to be alive.

The technology layer: the forecast got radically better while nobody was looking

If you stopped paying attention to weather prediction three years ago, you missed a genuine discontinuity.

Google DeepMind's GenCast now outperforms the European Centre's ensemble, the best operational system in the world, on the overwhelming majority of forecast targets out to fifteen days, and it performs better specifically on the extremes. Microsoft's Aurora improved tropical cyclone track prediction by 20 to 25 percent at two to five day lead times. The European Centre has put its own AI system into operation alongside the physics-based model.

Two to five days is not an abstraction. That is the window in which you decide whether to evacuate a peninsula.

Detection changed too. ALERTCalifornia runs roughly 1,240 AI-equipped cameras across the state. In 2025 those cameras detected 915 fires before any member of the public called them in. Pano AI detected 725 wildfires across 50 million acres in 17 states. The program director's description is the one that sticks with me: in some cases they dispatched, arrived, put the fire out, and never received a 911 call at all.

On the grid, work published in 2025 found that strategic islanding and preemptive dispatch in wildfire-prone California networks cut blackout durations by more than 90 percent and outperformed conventional hardening by roughly threefold on resilience metrics.

I am an engineer, so let me be precise about what this means. It does not mean the models are magic. No major meteorological agency has retired its physics-based system, and none should. It means the lead time on almost every hazard we care about is getting longer, and lead time is the raw material that every other part of the machine converts into saved lives.

The financial layer: this is where the machine is jammed

Here is the fear part, and I am not going to soften it, because you cannot fix a gap you refuse to look at.

The UN Environment Programme puts adaptation finance needs in developing countries at roughly 310 billion dollars a year by 2035. International public adaptation finance actually delivered to those countries in 2023 was 26 billion dollars. Not 26 billion short. Twenty six billion total, and it went down from the year before.

The gap is twelve to fourteen times the flow. Doubling adaptation finance, the goal everyone argues about at every conference, would close about 5 percent of it.

The insurance picture is a sharper version of the same story. Swiss Re put 2025 global economic losses from natural catastrophes at 220 billion dollars, of which about 49 percent was insured. That 49 percent is the highest insured share in their records, which sounds like progress until you sit with the other half. The protection gap reached 424 billion dollars. In emerging economies, 80 to 90 percent of losses carry no insurance at all.

And yet. Capital is not absent. It is mispriced and misdirected.

Wildfire-exposed catastrophe bond issuance passed 5.18 billion dollars in the first half of 2026, near the full-year record. The International Finance Corporation found in 2026 that targeted resilience measures in Brazilian infrastructure returned up to 8.60 dollars in protected asset value per dollar spent, and that the cheapest interventions, between 2.4 and 8 percent of asset value, delivered the best ratios.

Read those two facts next to each other. Investors will buy wildfire risk by the billion. They will not yet pay for wildfire risk reduction at the parcel. We have built a sophisticated global apparatus for moving catastrophe risk around and a primitive one for making the catastrophe smaller.

That is a design flaw, not a law of nature. Alabama proved it. The state mandated insurance discounts for the FORTIFIED standard in 2009, and there are now more than 52,000 certified homes there out of roughly 81,000 nationwide. A price signal produced a housing stock.

The human layer: the variable that decides everything else

In July 1995, a heat wave killed more than 700 people in Chicago.

Eric Klinenberg went looking for why some neighborhoods lost so many and others almost none. He found two adjacent communities, North Lawndale and Little Village, with comparable poverty and opposite outcomes. North Lawndale had among the highest death rates in the city. Little Village had among the lowest.

The difference was not income. It was not the building stock. It was whether the neighborhood still had functioning commercial streets, active civic organizations, and enough foot traffic that people had reasons to leave their apartments and get checked on. Later quantitative work confirmed it: commercial decline predicted heat mortality and explained most of the apparent affluence effect.

I am a fire engineer. I spend my working life on assemblies and separations and rated construction. And the most important resilience finding of the last thirty years is that whether your neighbors know your name is a load-bearing element.

We are getting better at operationalizing that too. Cities now appoint chief heat officers. The EPA finds cool roof programs associated with an 18 percent reduction in heat deaths. The UN's Early Warnings for All initiative aims to have every person on Earth covered by a multi-hazard warning system by 2027, and early warning investment returns roughly tenfold. Roughly 489,000 people a year currently die from extreme heat. That number is not fixed.

So what is actually at stake

Let me put the honest shape of it in one paragraph.

Every link of the machine now exists somewhere on Earth, working, with evidence behind it. The standard exists. The inspection exists. The forecasting is better than it has ever been. The money exists in aggregate. The social science is clear. What does not exist is a single place where all of it has been assembled and pointed at the same housing stock at the same time.

Spokane made that concrete for me last week. Three fires damaged or destroyed more than 900 structures in Washington's second largest city. The state's insurance commissioner had brought the IBHS Wildfire Prepared designation to Washington in April. The machinery arrived four months ahead of the fire. Nobody failed. Four months cannot reshape a housing stock.

That is the whole problem, and it is worth naming precisely: the conditions are changing faster than we are deploying what we already know how to build. It is a rate problem, not a knowledge problem.

Why I am optimistic anyway, and why you should be

Because rate problems respond to exactly the things we are currently getting good at.

IBHS expanded Wildfire Prepared to 14 states in April 2026, covering roughly 4.8 million homes in high and extreme risk areas, and in June released neighborhood and multifamily standards. That is the gap I have spent two years complaining about, closing in real time.

Because a 1 percent construction cost premium returning 11 to 1 is not a hard sell once anyone actually runs the number. Because the AI that beat the world's best forecast model was published, not locked up. Because 915 fires got caught before anyone picked up a phone. Because the thing that saved Little Village was a commercial district and a reason to walk outside, which is not a technology at all, which means it is available to anyone who decides to build it.

And because we have run this play before. The 90 percent decline in disaster deaths did not come from a breakthrough. It came from a century of unglamorous, cumulative, deployed competence.

The resilient future is not something we are waiting to invent. It is something we are waiting to install.

For the engineers, insurers, planners, and builders reading this: which link is the binding constraint in the place you actually work, and what would it take to unjam it in the next twelve months rather than the next twelve years?

Sources

Our World in Data / EM-DAT, long-run decline in natural disaster deaths.

University of Alabama Center for Risk and Insurance Research, FORTIFIED performance after Hurricane Sally, May 2025.

National Institute of Building Sciences, Mitigation Saves, code adoption benefit-cost.

Menendez et al., The Global Flood Protection Benefits of Mangroves, Scientific Reports, 2020.

Google DeepMind, GenCast; Microsoft, Aurora (Nature, 2025); ECMWF Artificial Intelligence Forecasting System.

ALERTCalifornia (UC San Diego) and Pano AI 2025 detection figures.

Zhao et al., Fire-Resilient Microgrids for California, IET Smart Energy Systems, 2025.

UNEP Adaptation Gap Report 2025.

Swiss Re Institute sigma, natural catastrophe losses and protection gap, 2025 and 2026.

International Finance Corporation, Low Cost High Yield: adaptation and resilience investment for infrastructure, 2026.

Klinenberg, Heat Wave: A Social Autopsy of Disaster in Chicago; Browning et al., American Sociological Review, 2006.

IBHS Wildfire Prepared program expansion and neighborhood standard, April and June 2026.

WMO / UNDRR Early Warnings for All.

I could not tell her.

Not because the question was naive. Because my profession has no answer to give her. We have not defined the fire.

That sounds like a small gap. It is not. It is the hole underneath every argument I make for a living, and I want to show you how strange it looks from inside structural engineering, where we answer that question every day without thinking about it.

What we can tell her about everything else

Suppose she had asked about earthquakes.

I would tell her that since 2010, American seismic design has used something called the risk-targeted maximum considered earthquake. It is not defined by magnitude. It is defined by outcome. The ground motions are selected so that a building designed to the standard has roughly a one percent probability of collapse in fifty years. Somebody decided what failure rate was acceptable, and then the engineering worked backward from it.

Suppose she had asked about wind.

I would tell her that ASCE 7 assigns her house a risk category, and the design wind speed follows from it. Risk Category I, structures whose failure poses low hazard to human life, gets a 300-year mean recurrence interval. Risk Category II, ordinary buildings including her house, gets 700 years. Risk Category III, substantial hazard, gets 1,700. Risk Category IV, essential facilities, hospitals and fire stations, gets 3,000 years.

Read that ladder again, because it encodes a moral judgment as an engineering parameter. We deliberately design the hospital for a rarer event than the house. Not because hospital walls are different, but because we decided the hospital has to still be standing on the day the house is not.

Suppose she had asked about flood.

I would tell her about the base flood elevation, the one percent annual chance event. It is crude. It is criticized, correctly, for treating a probability as a line on a map and for lagging the hydrology. And it is still a number. She can find her elevation, compare it to the flood, and know whether she is above or below.

Now she asks about fire.

And I hand her a color. Moderate, high, very high fire hazard severity zone. That is a map of where fire is likely to happen. It says nothing whatever about what her house must withstand when it does.

The difference between a hazard map and a design basis

This distinction is the entire essay, so let me make it concrete.

A seismic hazard map tells you where shaking is likely. A design basis tells you how much shaking the building must take without collapsing. The map is geography. The design basis is a performance requirement, and the performance requirement is what an engineer actually signs.

Wildfire has the geography. It does not have the requirement.

The consequences run further than they look. Without a design basis you cannot say a building is adequate, only that it complied. You cannot tier by consequence, so the fire station in the very high zone is built to the same wildfire standard as the shed behind it, which in any other hazard would be considered an obvious error. You cannot price performance, because an insurer has nothing to price against. And you cannot tell my homeowner what she bought with her money.

She spent real dollars. She improved her odds, measurably, and the survivability data support that. But "improved odds" is what you say when you have no design event. It is not what we say about her seismic design, where we can state the target and the confidence.

Why wildfire is harder, honestly

I want to steelman the absence, because smart people have worked on this and have not simply been lazy.

Earthquakes are a ground motion problem. The hazard arrives at the foundation, the demand parameter is well defined, and the building either has the capacity or it does not. Wildfire arrives as at least four different loadings, and they are not well correlated with each other. Radiant heat from a flame front. Direct flame contact. Ember cast, which can travel a mile and which is the mechanism that actually destroys most houses. And, increasingly, plume-driven behavior that starts fires outside the perimeter entirely.

Worse, the demand depends heavily on what your neighbor did. The fire load next door is part of your loading. Seismic does not work that way. Nobody's foundation shakes harder because the house across the street has an unbraced cripple wall.

And the return period question is genuinely unsettled, because the hazard is non-stationary in a way seismic is not. The San Andreas is not accelerating. Fire weather is.

So the problem is real and the difficulty is real. But difficulty is not the same as impossibility, and we should be honest that the field has partly avoided the question because answering it would force an uncomfortable admission: some existing homes cannot meet any defensible design basis without changes their owners cannot afford.

What the evidence says we would have to design for

If we did define one, the survivability data give a strong hint about where it would land.

Four fires in two decades of national records accounted for roughly six percent of exposed homes and produced 48 percent of the losses. The Camp Fire destroyed 13,893 of the 16,095 homes inside its perimeter, a 14 percent survival rate. Nearly half of Western home exposures occur during the top one percent of fire weather days, and survival in those windows drops to roughly 80 percent. Above 100,000 acres, Western survivability falls to 80 percent, and in California to 73.

The authors of that study reach the conclusion my field should have reached first, and they state it in our language: rather than designing for average conditions with occasional extreme events, effective strategies must treat extreme conditions as the design standard.

That is a call for a design basis. It is the right call. It is also only the first half of the sentence, because "extreme" is not a specification. Which extreme? At what recurrence? Chosen by whom, against what acceptable probability of loss?

Those are the questions ASCE 7 answers for wind in a table. For fire we have not written the table.

What I would actually propose

Not a finished standard. A starting shape, offered so it can be argued with.

Define the design event by fire weather rather than by fire size. Size is an outcome. The Burning Index percentile on the day is a condition, it is already computed nationally, and the survivability data show it is where the losses concentrate.

Tier it by risk category, exactly as wind does. If we design a hospital for a 3,000-year wind and a house for a 700-year wind, there is no principled reason the fire station and the shed should face identical wildfire requirements.

State the acceptable outcome explicitly, the way seismic does. Seismic does not promise no damage. It targets a collapse probability. A wildfire design basis should say plainly what it is buying: survival of the structure, or survival of the occupants, or habitability afterward. Those are three different targets and we currently conflate all three under the word "hardened."

And treat the neighbor's fuel as part of the loading, because it is. That is the piece with no analog in any other hazard, and it is the piece that makes this a community engineering problem rather than a building one.

What I should have told her

I gave her the honest answer, which was that her house was meaningfully better and that I could not quantify against what.

What I should have added is that this is not a limit of her project. It is a limit of my profession. We have spent forty years telling people to harden their homes without ever specifying the event they are hardening against, and then we have been surprised when the work feels like faith rather than engineering.

She did not need more encouragement. She needed a number, and we have not built one.

For the engineers, code officials and insurers reading this: what would it actually take to put a design fire in the code, and what are we protecting by not having one?

References

American Society of Civil Engineers. ASCE/SEI 7-22, Minimum Design Loads and Associated Criteria for Buildings and Other Structures. Wind design speeds by risk category: 300-year MRI (RC I), 700-year (RC II), 1,700-year (RC III), 3,000-year (RC IV). https://www.asce.org/publications-and-news/asce-7

Luco, N., et al. New "risk-targeted" seismic design maps. NEHRP. Risk-targeted MCE ground motions correspond to a 1% probability of collapse in 50 years. https://www.nehrp.gov/pdf/SeismicWavesJun12.pdf

U.S. Geological Survey. ASCE 7-22 Seismic Design Web Service. https://earthquake.usgs.gov/ws/designmaps/asce7-22.html

Kumar, M., Abatzoglou, J. T., Kolden, C. A., & Sadegh, M. (2026). Residential structure survivability to large wildfires in the United States. Earth's Future. https://doi.org/10.1029/2026EF008372 (open preprint: https://arxiv.org/abs/2512.19514)

Cohen, J. D. (2000). Preventing disaster: Home ignitability in the wildland-urban interface. Journal of Forestry, 98, 15-21.

Federal Emergency Management Agency. Base flood elevation and the 1% annual chance flood. https://www.fema.gov/flood-maps

On July 22 a fire started inland near Saumos. On the 26th I wrote about that peninsula and the arithmetic of a single evacuation route.

I had the fire at 12,500 hectares.

By the time the Associated Press filed on the 27th, it had burned 420 square kilometers. It had damaged or destroyed more than 240 homes. It had forced 220,000 people out of the Gironde. Reuters photographers were shooting firefighters at Lège-Cap-Ferret, on the peninsula itself.

And on the evening of Friday the 24th, at about 6:20, it did something that has never been recorded in France before.

It made a thunderstorm.

What actually happened above that fire

The technical name is pyrocumulonimbus. Firefighters call it a pyroCb. It is a thunderstorm that grows out of the smoke column of a fire, and it is not a metaphor or a poetic description of a big smoke plume. It is a functioning cumulonimbus cloud with the fire as its engine.

Theodore Giannaros, a fire meteorologist at the National Observatory of Athens, put it about as plainly as it can be put: imagine a campfire so large and hot that the smoke rising off it turns into a storm cloud.

The physics are not exotic, which is part of what makes them unsettling. You need very hot, very dry air near the ground with cooler, moister air sitting above it, the same profile that produces dry thunderstorms. Hot air loaded with smoke and moisture rises fast off the flame front. As it climbs it cools. Water vapor condenses onto particles of ash, because ash makes excellent condensation nuclei. Above the freezing level those droplets become ice crystals. The crystals collide. The collisions separate electrical charge.

And then the cloud does what charged clouds do.

Lightning came out of the bottom of it and struck the ground, and the ground beneath it was a landscape already cured to tinder. New fires started outside the perimeter of the fire that had built the cloud.

Read that again, because it is the whole essay. The fire manufactured its own ignition source and then deployed it beyond the line the firefighters were holding.

The word my profession uses is feedback

Giannaros again: "It's a feedback loop, not a one-way effect. Once it forms, the cloud becomes its own weather system, sitting on top of the fire and making it harder to predict."

I have spent my career on systems that fail in loops. It is the thing that separates an incident from a catastrophe. A sprinkler system that fails does not make the fire hotter. A fire that builds a storm does.

The loop has several arms and all of them are bad. The rising column pulls surface winds inward toward the fire, feeding it oxygen. Downdrafts punch back down and hit the ground as violent, erratic gusts that can rotate the flame front, split it into separate heads, or throw it in a direction nobody planned for. The system can spin up fire whirls, which Giannaros describes as a dust devil made of fire instead of dust.

Occasionally it makes something worse than a whirl. During the 2018 Carr Fire in Redding, California, a genuine fire tornado came out of the plume with winds equivalent to an EF-3. It killed a fire inspector.

I want to sit on that detail rather than move past it. Not a civilian who stayed too long. An inspector. A person whose job was to understand fire, standing where his training said he could stand, killed by weather the fire built.

That is what a feedback loop does to a design assumption.

Why this is the end of the perimeter as a planning object

Almost every wildfire response tool assumes a boundary. Containment percentage is a statement about a line. Evacuation zones are polygons drawn relative to a front. Spot fires are treated as an exception, a nuisance ahead of the main event, measurable in hundreds of meters or a few kilometers of ember cast.

A pyroCb breaks the premise underneath all of it. The ignition source is no longer at the flame front. It is overhead, and it can put fire down anywhere the cloud extends, on the far side of your line, on the far side of your crews, on the far side of the road you were counting on.

Giannaros named the operational consequence precisely: escape routes can close without warning as fresh outbreaks appear beyond the crews. Direct attack can become impossible. The danger, he said, is fire moving faster than evacuations can be organized.

I wrote an essay last week arguing that the single most important thing a household can do in the last seventy-two hours is leave earlier than feels necessary, because roads fail faster than people expect. I built that on NIST's reconstruction of the Camp Fire, which found that during the first twenty-four hours every primary egress artery experienced at least one burnover event.

I did not expect the argument to be restated in French, three weeks later, by a fire I had just walked past.

The uncomfortable part about Europe

PyroCbs have been essentially an Australian and North American phenomenon. Canada alone produced a record 142 in 2023. Portugal recorded one in its lethal 2017 season. France, until July, had recorded none.

Europe is warming at roughly twice the global average since the 1980s, according to Copernicus and the World Meteorological Organization, with heat waves intensifying and drought spreading across the south, curing forests into fuel.

Here is where I have to be disciplined, because the temptation is to draw a straight line and the data do not yet support one. Giannaros says it directly: hotter and drier conditions give extreme fires more opportunity to form these clouds, but scientists lack enough long-term observational record to establish a trend. A European research project called ROSETTA exists specifically to close that gap.

So the honest statement is this. We have one confirmed first for France, a known physical mechanism, a climate signal moving in the direction that favors the mechanism, and not enough years of observation to call it a trend. Anyone telling you this is definitely the new normal is ahead of the evidence. Anyone telling you it is a freak event is ignoring the mechanism. The correct posture is neither, and it is uncomfortable to hold.

What I actually take from it

I keep returning to the sequence. I walked that ground. I noticed the fuel and thought about the road. I wrote a post about one road out. And while I was writing it, the fire was assembling a thunderstorm eleven kilometers above itself and preparing to drop lightning outside its own perimeter.

The gap between what I understood and what was happening was not a gap in the science. The mechanism has been documented for years in Australia and North America. The gap was that I, like the French fire service, was carrying an assumption about which behaviors belonged to which places.

That assumption is the thing to give up. Not the containment lines, not the evacuation planning, not the hardening work. Those all still matter and I am not walking any of it back. What has to go is the belief that a hazard will keep doing here what it has always done here.

Forty thousand people on a peninsula with one road. A fire that can start new fires behind them from the sky.

The plan you write for the fire you have seen is not the plan. It is a floor.

When was the last time your community's evacuation plan was tested against a fire that does not respect its own perimeter?

References

Adamson, T. (2026, July 27). French wildfire created country's 1st recorded pyrocumulonimbus cloud, igniting more fires. Associated Press, via PBS NewsHour. https://www.pbs.org/newshour/world/french-wildfire-created-countrys-1st-recorded-pyrocumulonimbus-cloud-igniting-more-fires

France 24. (2026, July 27). Wildfires: The ominous 'fire clouds' or 'pyrocumulonimbus' seen in France for the first time. https://www.france24.com/en/france/20260727-what-are-fire-clouds-pyrocumulonimbus-observed-france-for-the-first-time

Link, E. D., & Maranghides, A. (2023). Burnover events identified during the 2018 Camp Fire. International Journal of Wildland Fire. https://doi.org/10.1071/WF22115

Kumar, M., Abatzoglou, J. T., Kolden, C. A., & Sadegh, M. (2026). Residential structure survivability to large wildfires in the United States. Earth's Future. https://doi.org/10.1029/2026EF008372 (open preprint: https://arxiv.org/abs/2512.19514)

Copernicus Climate Change Service & World Meteorological Organization. European State of the Climate. https://climate.copernicus.eu/esotc

A homeowner I keep thinking about did everything the state now asks. Class A roof. Ember-resistant vents. The first five feet around the house cleared to gravel and hardscape. For her trouble she earned a discount on the wildfire portion of her premium, because California now requires insurers to give one. Then her neighborhood burned, and her house went with it, because the twenty houses around her had done none of it, and a burning house does not care how good your vents are.

That is not a story about a rule that failed. It is a story about a pricing error. And the same error is now sitting on the books of the insurer of last resort with a $44 billion number attached to it.

Start with the discount, because it is the friendly face of the mistake. Under the state's Safer from Wildfires rule, an insurer that prices wildfire risk has to offer you a break for mitigation, up to about 16 percent off the wildfire portion of your premium if you complete the whole checklist. Look at what that checklist measures: your roof, your vents, your siding, the five feet around your walls, the brush on your lot, plus one line for whether your community is certified. Nearly all of it is computed from your parcel. You harden your house, you get your number. Clean, legible, and priced one property at a time.

Now the physics that pricing ignores. A wildfire in a dense wildland-urban neighborhood stops being a wildfire early. Once the first houses light, the wildland flame front is almost beside the point. The neighborhood becomes the fuel and burns structure to structure, on radiant heat and on embers thrown from each house already alight. The event is not a stack of independent parcel risks that happen to sit near each other. It is one correlated thing that takes the block. Which means a single hardened house on an unmitigated street barely moves its own odds. I have written a whole series arguing this on the physical side. The uncomfortable version showed up in my own comments last week: a reader who built to exactly this standard in the Palisades, fiber-cement siding, a rock perimeter, no eaves, and watched it go up like a torch with everything else on the block.

Hold that picture, then look at the FAIR Plan, and you will see the identical error rendered in money.

The FAIR Plan is California's insurer of last resort, the pool you land in when no admitted carrier will write you. Its book has more than tripled, up roughly 234 percent to around $700 billion of exposure since 2022, as the private market has retreated. But the number that should stop you is not the total. It is the concentration. By a Bloomberg analysis of the plan's own data, nine zip codes out of more than seventeen hundred now hold about 7 percent of its liability, roughly $44 billion, and exposure in those neighborhoods is up about 135 percent in three years. One zip code near Lake Tahoe carries about $9 billion on its own. Lake Arrowhead, about $7 billion.

That is not a diversified insurance book. That is a pile of correlated conflagration risk with a state guarantee behind it. A diversified insurer wants its risks independent, so that a bad event in one place is paid for by the quiet premiums everywhere else. The FAIR Plan has done the opposite. It has stacked enormous value into a handful of high-hazard neighborhoods where a single ignition can take a correlated chunk of the whole book in an afternoon. The plan itself clearly knows what it is holding: it has started shifting its tail risk into catastrophe bonds, the instrument you reach for when one event could blow through ordinary reserves. And when the pool takes a loss it cannot cover, the shortfall does not vanish. It is assessed back onto every admitted insurer in the state, who pass it to every policyholder. As the industry's own trade group put it, a single disaster in a concentrated area can generate losses large enough to ripple through the broader market. The correlation you cannot see on your street is the correlation now sitting, socialized, on everyone's premium.

So here is the through-line. The mitigation discount prices your fire risk at the parcel. The FAIR Plan accumulates fire risk at the parcel, one last-resort policy at a time, and only discovers at the portfolio level that it has been buying the same neighborhood over and over. Both instruments treat houses as if they burn independently. Neither has a way to price, reward, or underwrite the thing that actually decides whether your house survives, which is the state of the fifty houses around it. Your discount is the survivor photo in premium form: proof that you protected your parcel, and no evidence at all that anyone protected your block.

I want to be fair to the people who built these instruments, because the error is not stupidity. It is observability. An insurer can inspect your roof and count the feet to your fence. It cannot easily price a block, because there is no accepted instrument for one: no neighborhood underwriting unit, no agreed way to score a street's collective exposure, no contract that pays out on how well a cluster of owners who never coordinated happened to harden together. That is the same gap I keep hitting on the engineering side, where we have detailed fuel models for the wildland and nothing equivalent for a block of houses. The unit that governs the outcome is the one unit nobody has learned to measure or sell. So both sides default to the parcel, because the parcel is what you can see.

None of this means skip the discount or leave your house soft. Harden it. Take the 16 percent. A hardened house is still a better bet than a soft one, and on a normal bad day it changes your odds enormously. I am not arguing that mitigation is worthless. I am arguing that we are pricing it in the wrong unit, and that the error is no longer academic. It is an 84 percent jump in average premiums since 2020, a last-resort pool that has gone from insuring roughly one in sixty-six California homes to one in twenty, and a $44 billion stack of correlated risk that the rest of us have quietly agreed to backstop.

The parcel is what we can measure. The block is what burns. Until someone builds an instrument that can price a neighborhood, we will keep rewarding people for hardening the wrong unit, and keep acting surprised when the street takes the house anyway.

So the question I would put to the underwriters, the modelers, and the code people reading this: what would a block-scale fire product actually have to measure to underwrite a neighborhood instead of a house, and who is going to write the first one?

References

Bloomberg News (via Insurance Journal), "Luxury Homes Are Raising Risks for California FAIR Plan," July 22, 2026. https://www.insurancejournal.com/news/west/2026/07/22/878571.htm

Stanford Climate and Energy Policy Program white paper, reported in Stanford Report, "California's home insurance crisis spreads beyond wildfire country," June 16, 2026. https://news.stanford.edu/stories/2026/06/california-home-insurance-crisis-wildfire-country

California Department of Insurance, "Safer from Wildfires" regulation FAQ (Cal. Ins. Code Section 2644.9). https://www.insurance.ca.gov/01-consumers/105-type/95-guides/03-res/upload/FAQ-Safer-from-Wildfire-Regulation.pdf

California Department of Insurance, "New laws sponsored by Commissioner Lara take effect January 1" (SB 495; AB 226 FAIR Plan catastrophe-bond authority), December 30, 2025. https://www.insurance.ca.gov/0400-news/0100-press-releases/2025/release079-2025.cfm

That subtraction has a name. Economists call it *capitalization*: the process by which a recurring cost or risk gets absorbed into the value of the asset it is attached to. Benjamin Keys, the Wharton economist who has done more than anyone to measure this, puts it plainly — "how environmental risks associated with climate change are reflected in the market value of properties is known as 'capitalization.'" For most of the history of American homeownership, the cost of hazard was something you paid, monthly, in an escrow line you barely read. What is changing — and what the 2026 numbers finally let us see — is that the cost is migrating out of the bill you pay and into the price you can get. It is moving from your premium to your appraisal.

Start with the premium, because that is the part the receipts can prove.

The receipts are federal now. In February 2026 the Government Accountability Office published its review of the homeowners market with a title that reads like a shrug — "Premiums Generally Tracked Inflation but Rose More in Disaster-Prone Areas" — and inside it, the shrug comes apart. Nationally, the average premium rose just 3 percent from 2019 to 2024 after inflation, which is the number that lets you believe there is no crisis. But in parts of the country most exposed to catastrophe, particularly southern coastal areas at high risk of wind, premiums rose 25 percent or more. A home in a high wind-risk area now pays about 58 percent more than an otherwise identical home one tier down. Move a house from medium to high wildfire risk and its premium rises about 8 percent. The national average is calm because the national average is an average; the pain is concentrated exactly where the hazard is.

Keys and his coauthor Philip Mulder found the same shape in a different mirror. Reconstructing insurance costs from more than 74 million mortgage-escrow records, they clocked premiums rising 33 percent from 2020 to 2023 — a 13 percent real increase — and, more tellingly, they watched the *link* between risk and price tighten. A one-standard-deviation step up in disaster risk added about $250 to a premium in 2018. By 2023 the same step added $425. The market, in other words, stopped averaging hazard across everyone and started charging it to the houses that actually carry it.

For a while, a rising premium is a problem you can hold at arm's length. You can shop it, raise your deductible, refinance the shock into a longer mortgage, or simply absorb it the way you absorb every other bill that creeps. A premium is a cost that arrives in slices. What Keys and Mulder documented is the moment those slices stop staying slices and become a single number carved off the value of the house.

Their finding is blunt: premium increases are capitalized into home values, reducing home-price growth by more than $40,000 in the most exposed zip codes. In the revised paper, reported by *The New York Times* in November 2025, the concentration sharpens — roughly $43,900 knocked off the hardest-hit tenth of exposed zip codes since 2018, about $20,500 off the most-exposed quarter. Even spread across the whole market, the reinsurance shock that drove premiums up "reduced 2023 home values by an average of $8,400." And where you can watch it happen, it is stark: while national home prices climbed about 55 percent since 2018, New Orleans — insurance-battered and hurricane-exposed — gained about 14 percent, not even keeping pace with inflation.

Here is why the change of address matters more than it sounds. A premium is a cost you meet over time and can look away from between renewals. A price cut is a *capital loss* — it lands all at once, on your household balance sheet, at the one moment you can least manage it: when you try to leave. We are wired to shrug at a bill that creeps and to panic at a number that drops, which is precisely the behavioral trap here. The premium was the slow leak. The appraisal is the bill for all the water at once.

This is where the story stops being about insurance and starts being about people, because a running cost and a capital loss summon very different behavior. When hazard lived in the premium, you could treat it as weather — annoying, absorbable, someone else's department. When it moves into the price, it becomes a threat to the largest asset most families will ever hold, and people answer a threat to their net worth in one of three ways. Keys frames the choice as "resilience investments or exit." I would add a third, because the third is where most of the suffering actually is.

The first response is to *harden* — to spend money making the house more likely to come through the wind or the fire, on the theory that a house that survives is worth more than one that does not. It is the productive response, and it is the one I will admit up front I have a stake in. Hold that thought.

The second is to *sell* — to get out before the loss fully lands. Except the buyer faces exactly the same insurance quote you do, so the discount is already sitting in the price by the time you list. Selling does not escape the capital loss; it *realizes* it. You do not hand the problem to the next owner. You pay it, in the number at closing, on your way out the door.

The third response is the one the first two quietly assume you can afford, and millions cannot. Call it the *freeze*. Consider Clarence Guidry, in Lafitte, Louisiana, whose situation appears in the reporting on this research: a homeowners premium that reached $20,000 a year, paired with a $50,000 hurricane deductible. He cannot drop the coverage, because — as Keys notes — "without insurance, homebuyers would be unable to qualify for a mortgage," and his lender will not release him from the requirement. He cannot easily sell, because the same math that is crushing him is already sitting in any offer he would receive. And he cannot comfortably pay. So he sits on his steps, current on a mortgage that costs less than the policy required to keep it, and waits. The freeze is not an edge case. It is what capitalization feels like from inside a household that has no spare $40,000 — to harden with, to eat at sale, or to lose.

Now the part where I turn the argument on the people making it, starting with me.

First, the honest scope. Nationally, premiums rose 3 percent after inflation, and for most American homeowners the capitalization I have described has not yet arrived and may not for years. This is a concentrated phenomenon at the exposed edges — coastal wind, wildland fire — not a universal one, and anyone who tells you your zip code is next is selling you the certainty, not the data. Keys himself is careful that price adjustment is "neither instantaneous nor automatic"; markets are laggy and noisy, and a house can be mispriced for risk, in either direction, for a long time.

Second, the projection everyone quotes. First Street, the climate-risk modeler, estimates $1.47 trillion in net U.S. property value erased by insurance pressure and migration by 2055. It is a striking number and it is *modeled* — not peer-reviewed, built by stacking several models on top of one another, and, by its own author's admission, it "doesn't account for climate adaptation measures such as stricter building codes." Read that caveat again, because it is the whole ballgame: the $1.47 trillion is what happens *if we do not harden.* It is a forecast of our passivity, not a description of our fate.

Which brings me to my stake. I build resilience scores for a living. If hazard is capitalizing into the price of specific houses, then a credible, building-level measure of how a specific house will actually behave in a fire or a wind event becomes financially load-bearing — and that measure is exactly what my company sells. So discount me accordingly, and run the same test I would run on anyone: who benefits if you believe this? I do.

But the disclosure cuts both ways, and the honest version is not flattering to my industry. The "harden" option only rescues your value if the market can *see* the hardening — if an appraiser, a lender, a buyer can tell your reinforced roof and cleared five feet apart from the untouched house next door. Today, mostly, they cannot. The price signal capitalizes the *hazard* of your location long before it capitalizes the *resilience* of your building, which means the family that spends $40,000 hardening and the one that spends nothing can watch their homes lose value side by side. A market that can price the threat but not the defense is not rewarding resilience. It is punishing geography — and it punishes hardest the people who can least afford to buy their way out of it.

There are signs the incentive is turning. When the GAO asked insurers, regulators, and consumer advocates what would actually help, the strongest support went to "options that encourage mitigation, such as tax deductions or credits for building or upgrading homes to better withstand natural disasters." The policy consensus already points toward paying people for the reps. The market simply has not been built yet to see them — and until it is, capitalization will keep pricing the map instead of the building.

The premium was a bill. The appraisal is a verdict. For a generation the cost of living where the hazard is could be paid in monthly installments and pushed to the back of the mind, and the great quiet service insurance performed was to keep that cost from ever touching the one number a homeowner truly watches. That service is ending — not with a cancellation notice but with a slow subtraction, showing up in escrow lines and lender re-runs and the credit the seller hands over at the table.

The question is no longer whether the cost of hazard is real; the receipts settle that. The question is what the market will be able to *tell.* When the subtraction reaches your street, will the appraisal know the difference between the house that was hardened and the house that was only insured — or will it price them the same, and let the difference disappear into an identical number? We are choosing, right now, which of those two markets to build. The man sitting on his steps in Lafitte would like to know which one is coming.

References

Freedman, A. (2025, February 3). *Climate change could erase $1.4 trillion in real estate value: report* [reporting First Street Foundation's *Property Prices in Peril*, a modeled projection of ~$1.47 trillion in net property-value losses by 2055]. *Axios*. https://www.axios.com/2025/02/03/climate-change-insurance-costs-real-estate

Keys, B. J. (2025, June 16). *Housing, climate risk, and insurance*. *The NBER Reporter*, 2025(2). National Bureau of Economic Research. https://www.nber.org/reporter/2025number2/housing-climate-risk-and-insurance

Keys, B. J., & Mulder, P. (2024, rev. November 2025). *Property insurance and disaster risk: New evidence from mortgage escrow data* (NBER Working Paper No. 32579). National Bureau of Economic Research. https://www.nber.org/papers/w32579

Kramer, N. (2026, February 1). *Climate risk drives insurance spikes and slams home values nationwide* [reporting the Keys–Mulder findings as covered by *The New York Times*, incl. the ~$20,500 / ~$43,900 zip-code value effects and the Lafitte, Louisiana case]. *Beinsure Media*. https://beinsure.com/news/climate-risk-drives-insurance-spikes/

U.S. Government Accountability Office. (2026). *Homeowners insurance: Premiums generally tracked inflation but rose more in disaster-prone areas* (GAO-26-107867). https://www.gao.gov/products/gao-26-107867

Every one of those instincts points you at the expensive, dramatic move. And in the last seventy-two hours, the expensive, dramatic move is usually the wrong one — sometimes the dangerous one. The actions that actually change whether your family and your house come through are cheap, boring, and mostly doable with a rake and a set of car keys. This is the strange arithmetic of the final three days: value and cost run in opposite directions.

I want to be careful here, because this is not a lecture about panic. Under threat, people are not irrational — they are pattern-matching to the wrong pattern. A danger this size feels like it demands a proportionate response, so a five-dollar act like moving a doormat feels insultingly small against a wall of flame. The mind reaches for scale. It wants the heroic version. And a whole market is happy to sell it: the miracle coating, the last-minute retrofit, the feeling that if you spend enough this afternoon you can buy your way out of the fear.

But the failure mode in a wildfire evacuation is almost never a shortage of courage. It is late decision-making stacked on unresolved logistics — the trailer that will not hitch, the medication nobody packed, the second car facing the wrong way in the garage. The heroic afternoon spends your scarcest resources, which are time and open road, on the task with the weakest evidence behind it. So let me make the contrarian case plainly, then show you the science it rests on.

Leave earlier than feels necessary

Start with the highest-value action, which happens to be free.

The dominant message from American fire agencies is not "stay and fight." It is the opposite, and it is blunt. CAL FIRE's evacuation guidance tells residents "it's safer to leave before a mandatory order is issued," and warns that in big wildfires "there's no time for door-to-door warnings." Federal guidance sings the same note: the U.S. Fire Administration's wildfire checklist says to "leave early if you are concerned," because "it may take more time than you think to evacuate due to heavier traffic and decreased visibility, or if you have small children, pets or livestock, or have physical challenges."

Read that last list again, because it is really a description of who gets trapped: the household with the horse trailer, the grandparent on oxygen, the family down a single canyon road at night. If any of that is you, the honest move is to treat the warning as your departure trigger, not the order. The order is the system's deadline. The warning is yours.

This is not abstract. In early July, according to IQAir's wildfire tracking, four fires across Utah and Colorado — the Snyder, Babylon, Ferris, and Gold Mountain — had burned more than 110,000 acres, and communities from Blanding, Utah to Ridgway, Colorado were living inside exactly this window: Level 2 "get ready" warnings, Level 3 "go now" orders, and a lot of families in driveways deciding what to do with the afternoon.

The behavioral fix for all of it is unglamorous and it is free: make the decisions before the smoke, when your brain still works. Five of them remove most real evacuation friction. Who leaves with whom. Who drives which car. Which route is primary and which is backup — the U.S. Fire Administration wants you to know "at least 2 ways out." Who is the one out-of-area person everyone texts when they are safe. And where the animals go if the first destination falls through. A household that has answered those five questions in advance evacuates in minutes. A household improvising them at hour 60 is the one still in the driveway when the road closes.

The order is not a suggestion

I want to slow down on the hardest sentence in this essay, because most people read past it.

When the evacuation order comes, go. Not after one more task. Not after you wet the roof down.

The reason is not that officials dislike being ignored. It is that the road stops working, and it stops working faster and more completely than almost anyone expects.

NIST reconstructed the 2018 Camp Fire in detail, drawing on technical discussions with 157 first responders, and Link and Maranghides published the burnover findings in the International Journal of Wildland Fire in 2023. The fire killed 85 people and destroyed more than 18,000 structures, most of it inside the first twelve hours. Their analysis identified 23 life-threatening entrapment and burnover events, situations in which, as they define it, fire "trapped or overtook people and compromised escape routes."

Seventeen of those directly impacted evacuating civilians. Twelve happened on major evacuation roadways. Those seventeen events involved an estimated 300 to 500 people who were trying to leave.

Then there is the sentence I have not been able to put down since I read it:

"During the first 24 h of the Camp Fire, every primary egress artery experienced at least one burnover event."

Every one. Not the back roads. The main ways out.

The mechanism matters, because the mechanism is what kills people. In five of those events, traffic was already gridlocked or obstructed before the fire arrived, and in the authors' words, "civilians were then unable to escape as the fire burned through the area where they were trapped." Three events were associated with civilian deaths, as victims "were burned over while attempting to flee the fire in vehicles." Burnovers lasted on average close to two hours. Along one 1.6 kilometer stretch of Skyway, 85 vehicles were abandoned inside the fire.

That is what leaving late actually looks like. Not a tense drive. Sitting still in a line, with vegetation three feet off the pavement, for two hours, while it burns around you.

Now the other version, for anyone whose quiet plan is to stay.

Australia has studied this more rigorously than anyone, because for years it ran a national policy that let people choose between leaving early and staying to defend. Blanchi and colleagues built a database of Australian bushfire fatalities spanning 1901 to 2011. Haynes and colleagues examined deaths from 1900 to 2008 specifically against that "prepare, stay and defend or leave early" policy.

The record does not say what most people assume. In the 2009 Black Saturday fires, the Australian sheltering research reports that more than half of those who died were sheltering inside a house. That was a shift. Historically, most bushfire deaths happened outside, to people defending property or fleeing late. And the trend runs the wrong direction as conditions worsen: the more extreme the fire danger, the more people shelter inside buildings, and the more of them die there.

Sit with that, because it answers the most seductive thought available on a bad afternoon. The house feels like shelter. Under the worst conditions, the house is where people were found.

A house is shelter from a fire it was built to resist. Most houses were not built to resist this, which is the subject of nearly everything else I write. Believing otherwise on the day is not courage. It is a design assumption that nobody checked, load-tested at the worst possible moment.

Why the small stuff is the high-leverage stuff

Now the part that reframes everything else. If you are not leaving yet, what actually protects the house?

Not a stand at the flame front. Homes in wildfires are mostly not lost to a wall of fire rolling over them. They are lost to embers — burning fragments the wind throws ahead of the fire, in CAL FIRE's words "capable of igniting homes up to a mile away." The fire does not have to reach you. Its sparks do.

This is the core of the USFS fire scientist Jack Cohen's work, which built the idea of the home ignition zone: the house and the ground immediately around it, not the distant forest, decide whether it ignites. Cohen's modeling and crown-fire experiments found that even intense flame fronts "will not ignite wood surfaces… at distances greater than 40 meters" — about 130 feet. Beyond a few tens of meters, the flame itself is not the threat. What kills houses is closer and smaller: embers landing on and around the structure and finding something receptive to catch. His conclusion was that "effective residential fire loss mitigation must focus on the home and its immediate surroundings."

NIST's review of how structures actually ignite in these fires is unambiguous about where that receptive something lives. "The majority of structural fires in WUI communities," it reports, "generally start from small ignitions caused by ember penetration inside the structures" — embers "entering through openings such as eaves or attic vents and igniting highly flammable soft furnishing products." And the embers that get inside are often thrown by the things nearest your walls: the review names "fences, decks, landscape timbers, mulch beds… and piles of firewood" as fuels responsible for igniting the interiors of homes. One Australian study it cites found 70% of structures destroyed in these fires were lost to ember ignition.

Sit with what that means for your afternoon. The jute welcome mat, the cushions on the deck chairs, the woodpile against the siding, the dry needles in the gutter, the corner where the wood fence meets the house — these are not trivial. In the physics of how houses die, they are the front line. The reason the cheap actions carry such high value is that they remove the exact fuels the science says ignite homes.

So here is the afternoon, in order. CAL FIRE calls the first five feet around the house the "ember-resistant zone" — Zone 0 — and its instructions read like a list a child could finish: clear dead weeds and leaves, pull combustible mulch back from the walls, move firewood and lumber away, and shift trash and recycling bins out of the zone. Then bring in what burns; the guidance is explicit about hauling "patio furniture, toys, doormats, and trash bins" inside, shutting off propane and moving the grill away, and clearing the roof and gutters, the roof being "the most vulnerable part of your home." Close the windows, leave them unlocked, and pull flammable curtains off the glass. If you are still safely present, attach hoses for the firefighters — but do not leave sprinklers running, because it "can lower critical water pressure" for everyone. None of that needs a contractor, a permit, or a purchase. It needs a rake, a couple of hours, and the humility to believe small things matter.

And here is why those tasks deserve your motivation rather than your sigh.

A house does not burn because of one thing. It burns because, out of many chances, one of them caught. The doormat. The cushion. The needle bed in the gutter. The woodpile against the siding. The corner where the wood fence meets the wall. NIST's review describes exactly this pattern: small ignitions, started by embers, finding something receptive.

That structure has a property worth understanding, because it changes what an afternoon is for. Each receptive item is a separate chance. Removing one does not shave some vague percentage off your risk. It deletes one specific way this specific house could have caught, permanently, for the rest of the event. It cannot be undone by the wind shifting.

That is unusually good news for a person who badly needs to do something. Motivation on a bad afternoon is a real resource, and it is almost always spent on the largest visible gesture, which is also the one with the weakest evidence behind it. Spent on subtraction instead, it compounds. Every item you carry inside is one fewer draw from a lottery you did not ask to enter.

The gutter you clear is not a gesture toward safety. It is a chance deleted.

The two temptations, and why I would put the ladder down

Which brings me back to the pallet and the ladder.

The permanent upgrades are real and they work — ember-resistant vents, boxed eaves, a class-A roof, tempered windows, a noncombustible fence where it meets the house. I have spent my career on exactly these details. But they are pre-season projects, not final-afternoon ones. Starting roof work or vent retrofits with a fire two days out consumes the one thing you cannot get back, evacuation time, and adds a fall off a ladder to the list of ways the day can go wrong. The right time to harden the house was a month ago, or it is a month from now. It is not hour 60.

Then there are the fire-retardant fluids, gels, and coatings. This deserves more care than it usually gets, and the care has to run in both directions.

Start with what is established, because the mechanism is not in doubt and pretending otherwise would be its own kind of dishonesty.

Retardants work by changing how cellulose burns. The salts push the wood toward forming char instead of releasing the volatile gases that feed flame. The Forest Service states the mechanism in the definition printed on its own qualified products list: retardants "contain salts that decrease fire intensity and slow advance of the fire, even after the water they contain evaporates."

Read the last clause again. Even after the water evaporates. That is the whole point of a retardant as distinct from water, and it is why agencies buy the stuff by the millions of gallons. Reducing a fuel's ignitability reduces the chance it ignites. That is not a hypothesis. It is the premise of my entire field.

The building code agrees, and has for decades. Fire-retardant-treated wood is a recognized material, and the standards world long ago worked out how to test it honestly. ASTM D2898 conditions specimens through accelerated weathering, including rain and in some methods ultraviolet exposure, and states that the conditioned specimens are then suitable for fire tests such as ASTM E84, E108, and E1354. Weather it first. Then burn it. That protocol exists precisely because everyone involved understood that a retardant which quits after one season is not a retardant.

So the mechanism is sound, and the architecture for testing it honestly is already built. Hold onto that, because it makes what follows a narrower and more fixable problem than it first appears.

The Forest Service publishes a Qualified Products List for long-term retardants, qualified against Forest Service Specification 5100-304d, and that list has a distinct "Pretreatment/Ground Applications" category with six products on it as of the December 5, 2024 edition. The chemistry is real and the review is not nothing.

But read the title of the document those products are qualified under: Long-Term Retardant for Wildland Fire Management. That is the scope. The specification asks what a wildland agency needs to know. Nothing in it asks the question a homeowner is actually asking, which is whether spraying this on a house changes what happens when the embers arrive.

And the same list carries a footnote worth reading twice. Attached to that pretreatment category, in the Forest Service's own words: "Pretreatment category has not been evaluated for durability and weathering."

Somebody did study durability. IBHS applied exterior fire-retardant coatings to wood substrate and weathered them outdoors, work published by Bahrani, Hemmati, Zhou and Quarles in Fire and Materials in 2018. Wildfire Partners, the Boulder County mitigation program, summarized the results this way: most coatings lost their fire resistance within a few months, some did not perform even before weathering, and by the three-month mark none offered meaningful protection compared to untreated wood.

Gels are a different animal and deserve to be judged differently. IBHS states it plainly: "the length of time that a gel product is effective after application is on the order of hours," which is why, in their words, "these would be applied only when a wildfire threatens." That is not a knock. It is a specification. A product that works for hours is useful, provided you know it works for hours.

Here is the part I want to be fair about, because it is the fair point and it is the one that usually gets skipped.

There is no standardized test method for any of this. Wildfire Partners, which sells nothing, put it in one line: "No standardized testing exists. Manufacturers can claim their coatings last for years, but there's no independent proof to verify these claims."

That is a standards gap, not a conspiracy, and it is narrower than it sounds. Three things are unmeasured for field-applied products on houses, and only three. Whether the coverage a homeowner achieves with a garden sprayer resembles the coverage achieved in a lab. How long that coverage survives on a real wall in real weather. And whether any of it changes the outcome under an ember storm rather than under a bench flame.

Note what is not on that list. The chemistry is not on that list.

And note that the method already exists. D2898 conditioning followed by a standard fire test is exactly the shape of the answer. Somebody simply has to run it on field-applied products, on realistic substrates, at the exposures that actually destroy houses. That is a funding and priority problem, not a scientific one.

So it is not a manufacturer's fault that nobody has done it. If anything it is closer to my fault, and the fault of everyone in my field who builds standards for a living. We wrote the durability-then-fire protocol forty years ago and then never pointed it at the product a frightened homeowner is most likely to buy.

So what is it actually good for?

IBHS names the use case, and it is the honest one. On buildings with combustible siding, they write, coatings "could be used to reduce their vulnerability to wildfire exposures, particularly radiant heat and flame contact exposures," and they specify when those exposures happen: "where close building-to-building spacing exists and a neighboring building ignites and burns, and where other combustibles (e.g., a wood pile or small out-building such as a tool shed) are located near the building."

Read that list again. Those are the sins that slipped.

My field has language for this, and I am going to use it as an engineer rather than borrow anyone's quote. We call sprinklers and detection active protection: they require something to happen at the moment of the fire. We call rated assemblies, separation, and noncombustible materials passive: they work whether or not anyone shows up.

A retardant is an active measure. It has to be bought, stored, applied correctly, and applied recently. Every one of those is a chance to fail, and all of them are chances that occur under exactly the conditions where people fail at things.

That is why the substitution is the danger. A homeowner who believes the spray stands in for the passive work has traded a control that cannot fail for one with four ways to fail, on the worst day of their life. Active protection supplements passive protection. In my experience it has never replaced it, and I would not sign a design that assumed it could.

We have a related concept for the case where the passive protection is simply missing. When a sprinkler system is impaired, you do not pretend the building is protected and you do not empty it. You institute a fire watch: a temporary, documented, active control that compensates for a known deficiency while it gets fixed. Everyone involved understands exactly what a fire watch is, and just as importantly, what it is not.

Pre-treatment is a fire watch.

The juniper you meant to pull and never did. The wood deck you have been getting quotes on for three years. The wood fence that runs into the siding, which you know is a fuse, and which your neighbor half owns so it never quite becomes your problem to solve. Those are identified deficiencies. You know where every one of them is. And in the last seventy-two hours you cannot fix a single one.

That is where a treatment earns its place: on a specific fuel you already flagged, applied early enough to do it properly, as a temporary control on a known deficiency. Not a shield misted over the whole house and a hope.

Which also tells you the conditions. Know which fuel you are treating and why. Apply it well before conditions deteriorate, because doing it at hour 70 in thickening smoke trades evacuation time for coverage you cannot verify. Know that gels work wet and coatings weather, and assume reapplication. And do not let any of it move your departure by a single minute, because the moment it does, it has cost more than it bought.

A fire watch is never a reason to stay in the building.

Ask who benefits if you believe otherwise, and put me on that list. I sell resilience scores.

But the more useful question here is not who profits. The mechanism is real, the test architecture has existed since before most of these companies did, and nobody has spent the money to connect them. So the question is who runs D2898 conditioning and a standard fire test on field-applied products at ember exposures, and publishes it. Until someone does, a homeowner buying this is not buying a bad product. They are buying an unmeasured one, and those are different things worth telling apart.

Where this is genuinely hard

Here I have to show you the seams, because an engineer who only tells you the clean version is not worth reading.

The evidence that the home ignition zone matters is strong. The evidence for the exact marginal value of each specific task done inside 72 hours of an active fire is much thinner. Nobody has run the controlled trial where half a neighborhood moves its doormats and half does not, then measures the survival gap. The direction is well supported; the precise payoff of any single afternoon action is a reasonable inference, not a measured fact — and I would rather tell you that than dress a hope up as a number.

And the hardest call of all is not on any checklist. It is the moment-to-moment judgment of when to stop doing useful small tasks and simply leave, made with bad information, thickening smoke, and every human bias pulling you toward "just five more minutes." That bias has a body count. When the smoke thickens or the traffic starts to queue, the prep is over, whatever is left undone.

The bottom line is almost embarrassing in its simplicity, which is exactly why it is so hard to follow: get the household ready to roll, clear the ember traps the science says actually ignite houses, and leave earlier than your instincts tell you to. The high-return work in the last 72 hours is small-fuel removal and departure — not heroics, and not construction.

So the real question is not what expensive thing you could buy this afternoon. It is a harder one, and it is worth answering long before the smoke is on the ridge: when the warning comes and you are standing in your own driveway with a few hours of light, do you already know — down to who drives which car and where the woodpile goes — what you will reach for first?

References

ASTM International. ASTM D2898: Standard practice for accelerated weathering of fire-retardant-treated wood for fire testing. https://store.astm.org/d2898-10r17.html

Bahrani, B., Hemmati, V., Zhou, A., & Quarles, S. L. (2018). Effects of natural weathering on the fire properties of intumescent fire-retardant coatings. Fire and Materials. https://onlinelibrary.wiley.com/doi/abs/10.1002/fam.2506

Blanchi, R., Leonard, J., Haynes, K., Opie, K., James, M., & Dimer de Oliveira, F. (2014). Environmental circumstances surrounding bushfire fatalities in Australia 1901–2011. Environmental Science & Policy, 37, 192–203. https://www.sciencedirect.com/science/article/pii/S1462901113002074

California Department of Forestry and Fire Protection (CAL FIRE). (2026). Defensible space — Zone 0, the ember-resistant zone. Ready for Wildfire. https://www.readyforwildfire.org/prepare-for-wildfire/defensible-space/

California Department of Forestry and Fire Protection (CAL FIRE). (2026). Go! evacuation guide. Ready for Wildfire. https://www.readyforwildfire.org/prepare-for-wildfire/go-evacuation-guide/

California Department of Forestry and Fire Protection (CAL FIRE). (2026). Hardening your home. Ready for Wildfire. https://www.readyforwildfire.org/prepare-for-wildfire/hardening-your-home/

Haynes, K., Handmer, J., McAneney, J., Tibbits, A., & Coates, L. (2010). Australian bushfire fatalities 1900–2008: Exploring trends in relation to the 'Prepare, stay and defend or leave early' policy. Environmental Science & Policy. https://www.sciencedirect.com/science/article/abs/pii/S1462901110000201

Link, E. D., & Maranghides, A. (2023). Burnover events identified during the 2018 Camp Fire. International Journal of Wildland Fire. https://doi.org/10.1071/WF22115

Cohen, J. D. (n.d.). Reducing the wildland fire threat to homes: Where and how much? USDA Forest Service, Rocky Mountain Research Station. https://ravallicounty.gov/Archive/ViewFile/Item/18324

IQAir. (2026, July 1). Wildfire map spotlight: Snyder, Babylon, Ferris, and Gold Mountain fires in Colorado and Utah. https://www.iqair.com/newsroom/wildfire-map-spotlight-snyder-babylon-ferris-and-gold-mountain-wildfires-in-colorado-and-utah

Nazare, S., Leventon, I., & Davis, R. (2021). Ignitibility of structural wood products exposed to embers during wildland fires: A review of literature (NIST Technical Note 2153). National Institute of Standards and Technology. https://nvlpubs.nist.gov/nistpubs/TechnicalNotes/NIST.TN.2153.pdf

Whittaker, J., Haynes, K., et al. Surviving bushfire: The role of shelters and sheltering practices during the Black Saturday bushfires. Environmental Science & Policy. https://www.sciencedirect.com/science/article/abs/pii/S1462901117309085

U.S. Fire Administration (USFA/FEMA). (n.d.). Wildfire evacuation checklist. https://www.usfa.fema.gov/downloads/pdf/publications/wildfire-evacuation-checklist.pdf

Insurance Institute for Business & Home Safety (IBHS). (n.d.). Fire-retardant coatings used in exterior applications. https://ibhs.org/wildfire/fire-retardant-coatings-used-in-exterior-applications/

U.S. Department of Agriculture, Forest Service. (2024, December 5). Long-term retardant for wildland fire management: Qualified products list (qualified in accordance with Forest Service Specification 5100-304d). Washington Office Fire & Aviation Management. https://www.fs.usda.gov/rm/fire/wfcs/documents/2024-1205_qpl_ret_.pdf

U.S. Department of Agriculture, Forest Service. (n.d.). Wildland Fire Chemical Systems: Product information and qualified products lists. National Technology and Development Program. https://www.fs.usda.gov/rm/fire/wfcs/products/

Wildfire Partners. (2025, October 14). Do fire-retardant coatings really protect homes from wildfire? What the science says. (Republished by the Fire Adapted Communities Learning Network, February 12, 2026.) https://fireadaptednetwork.org/fire-retardant-coatings-what-the-science-says/

Hold that examiner in your mind, because there is a person on the other end of the model too.

That person is you, on the afternoon a letter arrives forty-five days before your policy renews. It says your homeowners coverage will not be renewed, and it gives a reason: the roof. Not a roof anyone walked. A roof photographed from a drone or a satellite and scored by software for moss, or streaking, or shingles that read as worn to an algorithm trained on other roofs. In Massachusetts, enough of these letters went out that the state's Division of Insurance published a consumer explainer with a sentence most people never think to ask about: there is no formal appeal process. You can call and argue. You can send the receipt from the roofer who reshingled two summers ago. But the company reserves the right, and the model already spoke.

These two people — the examiner trying to see into the model, and the homeowner on the receiving end of it — are the whole story. Everyone in insurance right now is arguing about whether these models are accurate. That is the wrong argument, or at least the incomplete one. I've spent my career in forensic and fire-protection engineering, and the question an engineer asks about any system that can hurt people is never "how good is it on a good day." It's "how does it fail?" A sprinkler, a stairwell, a sea wall — you design them assuming they'll be tested at the worst possible moment, and you ask whether they fail loud or fail silent, fail small or fail whole.

By that standard, the models moving into insurance have a specific and dangerous property. It isn't that they're sometimes wrong. Everything is sometimes wrong. It's that they can be wrong at scale, instantly, and behind a confident interface — and almost nothing in the system is built to catch the error before it reaches your door.

Let me tell you what I actually think is going on, and let me be honest about which parts of it are measured and which parts are me building an argument.

Read more

The Cottonwood Fire burned more than 150 square miles of ponderosa and sagebrush, took 1,289 firefighters to fight, and destroyed up to 150 structures — including more than 100 condos and 30 cabins at a ski resort that will not open this winter. Investigators determined it was human-caused. The people who lit it are not the villains of this story; they are the story. It ignited in June, early, in the Great Basin, a place the fire-season calendar and the California-centric imagination both insist should not be producing the nation's marquee blaze in the middle of summer. But there it was. As of July 7, the United States had burned 46 percent more acreage than the ten-year average for that date, and the two largest active fires in the country were both in Utah. East, in Colorado, the Aspen Acres Fire scorched more than 96,000 acres behind 100-mph winds, destroyed 192 homes that the county has so far confirmed — aerial imagery puts the true count of lost structures near 780 — and became the seventh largest wildfire in that state's recorded history. It, too, was human-started.

I am a fire protection engineer. I have spent my career at the seam between what nature does and what we build, and I want to say the uncomfortable thing plainly, because a fire year is precisely when nobody wants to hear it: the hazard did not do this. We did.

Say it as an equation, because engineers cannot help ourselves. A disaster loss is hazard times exposure times vulnerability times governance times response. The hazard is the fire, the flood, the wind — the part we like to blame, because blaming it lets us off. Everything to the right of it is a decision. Who we allow to build in the path. What we require them to build. Whether the warning reaches them, and whether they understand it when it does. The United Nations, which has no incentive to soften the physics, defines disaster risk not as hazard but as "a function of hazard, exposure, vulnerability and capacity." Capacity is governance and response folded together. Which means that of the things deciding whether a hazard becomes a catastrophe, one is nature and the rest are us.

So follow the behavior — not as a metaphor, but as the actual chain of custody on a loss.

Start with the match. Across the United States, people start about 84 percent of wildfires, and in doing so we have tripled the length of the fire season, because lightning keeps summer hours and we do not. We burn debris in April, drag tow chains in October, leave a campfire smoldering in December. The "season" is partly a thing we invented by being careless year-round. Cottonwood and Aspen Acres are both, in the most literal sense, ignitions we supplied.

Then look at where we put the houses. Between 1990 and 2010 the American wildland-urban interface — the zone where homes meet fuel — grew from 30.8 to 43.4 million houses, a 41 percent jump, and here is the line that indicts us: 97 percent of that new interface came from new houses, not new brush. The wildland did not creep toward us. We built into it, subdivision by subdivision, each one a reasonable decision by a family that wanted trees and a view at a price it could afford. Nobody chose a catastrophe. Everybody chose a house. The catastrophe is the sum.

And when it burns, we mostly rebuild it where it was, the way it was, because attachment to a place is not a spreadsheet and grief is a terrible moment to redesign a life. The exposure we spent a generation accumulating gets faithfully reconstructed in eighteen months. That is not stupidity; it is the most human line in the whole ledger — we go back to where we belong. But it means the map of next decade's losses is being drawn right now, by people behaving reasonably, one lot at a time.

And every one of those lots was approved by someone. This is the part of the story that has a name and a meeting time. Exposure is not weather; it is a stack of decisions made in fluorescent rooms — a planning commission that green-lights a hillside tract, a variance granted because the housing math is brutal and the fire math feels abstract, a state that leaves the wildland-urban interface to counties that cannot afford to say no to their own tax base. The hazard shows up once a decade. The permit that put the house in its path was signed on an ordinary afternoon, by people who will be long gone when it burns.

Once fire reaches a community, what burns is governed less by the wall of flame on the ridge than by embers, the woodpile against the siding, the gap under the deck, the neighbor's fence carrying fire across the property line. That is why California's new Zone 0 rule fixates on the first five feet around a house — the least romantic five feet in real estate, and the most decisive. And it is why the quietly devastating detail in the Cottonwood Fire is actually a good-news story. A 4-H summer camp survived. Beaver County credited years of forest treatment — brush cleared, branches trimmed — with saving the campground while the mountain around it burned. Same fire. Same wind. Different human decisions, made years earlier by someone who is not a hero and will never be on the news. The variable that saved the camp was behavior.

None of this is only about fire. Take the water. From 2001 to 2019, Americans developed about 2.1 million acres of floodplain and built roughly 844,000 homes in it. Not because the rivers moved — because a line on a flood map, or a levee at the edge of town, reads to a developer and a buyer like a permission slip. Protect a place and you invite people to fill it, until the design flood finally arrives and finds far more to destroy than it would have if we had stayed honestly afraid. Flood risk, more than almost any hazard, is manufactured by the very governance meant to contain it.

Or take the wind, which is the cleanest case, because wind is nearly pure engineering. The National Institute of Building Sciences estimates that adopting a modern building code returns about $11 for every $1 spent, and about $10 for every $1 on the hurricane-specific requirements. That is a model — a projection, not a count. Here is the count. When Hurricane Sally came ashore in 2020, the homes built to the IBHS FORTIFIED standard, with sealed roof decks and locked-down edges, filed insurance claims at least 55 percent and as much as 74 percent less often than their conventional neighbors on the same street. Same storm. Same latitude. The entire difference was a set of choices about nails, edges, and paperwork. The wind did not discriminate between those houses. People built the discrimination in.

There is a machine that could turn most of this around, and mostly does not. Insurance is the one institution with both the money and the motive to reward the choices that make a house survivable — and for most of its history it has priced your zip code and your roof's age while staying nearly blind to whether you, this year, actually did the work. When the system that pays for the loss cannot see the behavior that prevents it, the behavior quietly stops. That is not a hazard problem. It is a design problem, and design problems have owners. I know how that sounds from someone whose company builds resilience scores for a living, which is exactly why I would rather hand you the mechanism than ask for your trust.

And when the hazard does arrive, the last human variable is whether the warning works at all. In July 2021, catastrophic floods hit western Germany. Afterward, researchers surveyed the survivors: 35 percent of residents in one state and 29 percent in another said they received no warning whatsoever, and most of those who were warned did not expect anything severe. More than 180 people died. The water was the hazard. The silence was the people problem. We had the satellites and the sirens. What failed was the human chain between the forecast and the front door: who was told, in what language, with what instruction, and whether anyone believed it enough to move.

Which brings up the half of "people problem" that is easy to get wrong. It is tempting to hear it as a scold — clean your gutters, read the map, stop being lazy. But the CDC maintains a Social Vulnerability Index built on precisely the things that decide who dies and who recovers: poverty, no access to a car, crowded housing. The same fire is not the same event for the household with two vehicles and somewhere else to go and the one with neither. A "people problem" is not mainly about character. It is about who has options — capital to retrofit, a car to evacuate in, insurance to rebuild with, standing to be heard when the zoning board meets on a Tuesday night. And it does not end when the fire does. The insured household files a claim and hires a contractor; the renters two blocks over, uncounted and uninsured, simply vanish from the neighborhood and from the statistics. Recovery is where the sorting becomes permanent. The hazard is indifferent. The damage is sorted.

Here is where my own argument gets its hardest test, and I would rather hand it to you than have you find it. The hazard side is real, and it is getting worse. A warmer, drier climate is lengthening the windows and drying the fuel; the same data that shows humans starting most fires also shows lightning fires growing larger — not because there is more lightning, but because the forests are thirstier. If I told you the physics were neutral, I would be lying, and I sell resilience for a living, so I have every incentive to make you believe the building is the only variable that counts. So let me be exact. "People problem" does not mean hazards do not matter. It means that of the terms in the loss, one is nature and the rest are ours — and the ones we own are the ones we can actually move in the years we have. The strongest evidence for my thesis and the strongest evidence against it are the same fire: the camp that lived proves behavior decides, and the mountain that burned proves the hazard is nobody's toy.

The reason we reach for "the hazard did it" is that it is a merciful story. It asks nothing of us. It does not require a hard vote on where people may build, a code that costs a builder money, or a check to help a neighbor leave in time. "We did it" asks all of that, which is exactly why it loses at almost every city council in the country. But the fire east of Beaver did not choose Beaver. Somebody platted that subdivision, decades ago. Somebody struck that spark, last month. Somebody cleared the brush around the camp, and somebody did not, around the cabins. Every one of them was a person, making a choice, long before the smoke.

So the next time a map, a model, or a salesman tells you that you are safe — including when the salesman is me — ask the question that actually decides your summer: who drew this, and what did it want you to build?

References

Agopian et al. (2024). A nationwide analysis of community-level floodplain development outcomes and key influences. *Earth's Future*. https://agupubs.onlinelibrary.wiley.com/doi/10.1029/2024EF004585

Balch, J., et al. (2017). Human-started wildfires expand the fire niche across the United States. *Proceedings of the National Academy of Sciences*. https://www.pnas.org/doi/10.1073/pnas.1617394114

California Board of Forestry and Fire Protection. (2026). *Defensible Space Zones - 0, 1, and 2* (Zone 0 ember-resistant zone, first 5 feet; PRC 4291, AB 3074, SB 504). https://bof.fire.ca.gov/projects-and-programs/defensible-space-zones-0-1-and-2

Centers for Disease Control and Prevention / Agency for Toxic Substances and Disease Registry. (2024). *Social Vulnerability Index*. https://www.atsdr.cdc.gov/place-health/php/svi/index.html

Insurance Institute for Business & Home Safety. (2025). *Study shows IBHS's FORTIFIED program reduced Hurricane Sally damage* (University of Alabama CRIR / Alabama Department of Insurance). https://ibhs.org/ibhs-news-releases/study-shows-ibhss-fortified-program-reduced-hurricane-sally-damage/

KUTV / 2News. (2026, June). *Cottonwood Fire expands to over 27,000 acres, determined as human-caused*. https://kutv.com/news/wildfire/rapidly-growing-cottonwood-fire-burns-over-10000-acres-near-beaver

National Institute of Building Sciences. (2019). *Natural Hazard Mitigation Saves: 2019 Report*. https://nibs.org/wp-content/uploads/2025/04/mitigationsaves2019_complete.pdf

NASA Earth Observatory. (2026, July 8). *Cottonwood Fire chars Utah* (siege statistics attributed to the National Interagency Fire Center). https://science.nasa.gov/earth/earth-observatory/cottonwood-fire-chars-utah/

Prentzel, O. (2026, July 10). *Aspen Acres fire has destroyed 780 structures across Pueblo and Custer counties, new aerial analysis shows*. The Colorado Sun. https://coloradosun.com/2026/07/10/aspen-acres-fire-damage-colorado-wildfire-pueblo-custer-county/

Radeloff et al. (2018). Rapid growth of the US wildland-urban interface raises wildfire risk. *Proceedings of the National Academy of Sciences*. https://www.pnas.org/doi/10.1073/pnas.1718850115

Performance of the flood warning system in Germany in July 2021 - insights from affected residents. (2023). *Natural Hazards and Earth System Sciences, 23*, 973-990. https://nhess.copernicus.org/articles/23/973/2023/

United Nations Office for Disaster Risk Reduction. (2017). *Sendai Framework Terminology on Disaster Risk Reduction: Disaster risk*. https://www.undrr.org/terminology/disaster-risk

Here is the part worth sitting with. Since 1940, not one Field Act school building has collapsed. Not one student has been killed or injured in one. That is not a slogan a marketing department wrote. It is the measured record of a regime whose compliance is actually checked, tested by every quake California has thrown at it for eighty-five years.

We did not make earthquakes smaller. We decided a specific, terrible outcome was unacceptable, and then we built the machine that made it not happen.

I keep that story close because I spend a lot of my time around a different one: the idea that wildfire is simply beyond us. You hear it after every siege. The houses are gone, the town is gone, and the conclusion arrives fast and heavy — nothing works, you can harden all you want, when it's your day it's your day. It is the most expensive sentence in the field, because it excuses everyone from building the thing that would prove it wrong.

So let me lay out what actually beat the "unstoppable" hazards, because it's the same machine every time, and it is almost boringly consistent.

A catastrophe happens. An honest forensic inquiry follows — not a search for someone to blame, but a real accounting of why the buildings failed. That produces a standard specific enough to be checked. The standard is paired with inspection that actually checks it, not a homeowner's promise that they meant to. Money is found to retrofit the old buildings, because new codes only touch the tiny fraction of the stock that gets built each year. And finally, price — usually insurance — starts to reward the verified condition, so the market pulls in the same direction as the rule.

Standard, inspection, finance, price. That's the chain. When all the links exist, hazards that used to be acts of God become line items you can manage.

The evidence isn't confined to California schools. After Hurricane Andrew flattened South Florida in 1992, the real revelation wasn't that houses were weak — it was that the system was weak, with hundreds of local jurisdictions each running their own version of a building code. Florida consolidated it into a single statewide code in 2002. Homes built under it took visibly less damage in the storms that followed, and a later accounting attributed something on the order of a 70-plus-percent reduction in windstorm insured losses over the following decade to that reform, at a benefit-to-cost ratio around six to one. Alabama went a step further with FORTIFIED, a specific, inspected roof standard tied directly to insurance. After Hurricane Sally, a study of tens of thousands of homes found the FORTIFIED ones had dramatically fewer and smaller claims — not because the storm was gentler on them, but because a verified condition was priced. By 2025 the state had tens of thousands of fortified roofs, pushed along by grants and required discounts.

None of these rewarded good intentions. They rewarded a checked condition. That distinction is the whole game.

Now hold wildfire up against that chain and the diagnosis is obvious. It's not that the physics is uniquely hopeless. It's that we've built maybe two of the links and skipped the rest.

We have the beginnings of the science. We know embers, not walls of flame, destroy the overwhelming majority of homes. We know the first five feet around a structure and the spacing between structures do enormous work — recent California modeling keeps finding that the distance to your neighbor's house is one of the strongest predictors of whether yours survives, and that coordinated hardening can move a neighborhood's losses from most-of-it to about half. That's the forensic link, forming.

But look at the rest of the chain. There is no mature, statewide, inspectable standard for the existing homes — the ones actually burning. There is no verification system that a lender or an insurer trusts the way they trust a FORTIFIED designation. There is almost no retrofit finance for the people who can't write the check themselves. And there is barely any neighborhood-scale governance for the spacing problem, which no single homeowner can solve alone. Zone 0 — the ember-resistant first five feet, one of the most physically obvious interventions we have — spent years stuck in rulemaking after the law passed. The fatalist reads that delay as proof that nothing works. The honest reading is the exact opposite: we have not finished building the machine, so of course the machine isn't producing results yet.

I want to be square about where wildfire is genuinely harder, because the anti-fatalist case collapses if it oversells. In earthquake and wind, the building is most of the problem, and one good roof can matter even if your neighbor does nothing. In wildfire, the parcel is only part of the exposure. Your neighbor's fence, the wind that afternoon, the block geometry locked in forty years ago — a homeowner can do everything right and still lose the house. That is real. It's also precisely the argument for more collective machinery, not less. And I'll hold my own field to the standard: some of wildfire's most-repeated survival numbers don't yet have the clean, checked, decades-long record that "no child killed in a Field Act school since 1940" has. That gap isn't a reason to give up. It's the to-do list.

The difference between a hazard we endure and a hazard we manage has never been the size of the hazard. Long Beach didn't get a smaller earthquake. Florida didn't get gentler hurricanes. They built the boring machine — standard, inspection, finance, price — before the next one came, and the record changed.

Wildfire isn't unsolvable. It's unfinished. And unfinished is not a diagnosis. It's an instruction.

References

Insurance Institute for Business & Home Safety. (2025). Study shows IBHS's FORTIFIED program reduced Hurricane Sally damage. IBHS. https://ibhs.org/ibhs-news-releases/study-shows-ibhss-fortified-program-reduced-hurricane-sally-damage/

Seismic Safety Commission, State of California. The Field Act (1933) and the seismic-safety record of California public schools. https://ssc.ca.gov/

Simmons, K. M., Czajkowski, J., & Done, J. (2018). Economic effectiveness of implementing a statewide building code: The case of Florida. Land Economics, 94(2), 155–174 (2002 Florida Building Code; ~72% wind-loss reduction; ~6:1 benefit–cost). https://le.uwpress.org/content/94/2/155

Zamanialaei, M., San Martin, D., et al., & Gollner, M. J. (2025). Fire risk to structures in California's Wildland-Urban Interface. Nature Communications, 16, 8041 (modeled loss reduction 75%→52%). https://doi.org/10.1038/s41467-025-63386-2

That habit makes me a difficult audience for new metrics.

Sam Altman is in Washington this week to preview OpenAI's most capable model and to pitch a way of measuring what it is worth. The phrase is knowledge per dollar. It is meant to move the conversation off what AI costs and onto what it produces, which is a reasonable thing to want, particularly ahead of a public offering. Altman is reportedly bringing evidence: a model that solved an eighty year old open problem in mathematics, and the note that OpenAI's own legal, finance and recruiting teams now run more than eighty five percent of their AI work through agents.

Set aside for a moment whether the number is impressive. Look at the shape of it. It is a ratio. Ratios have two halves, and a ratio is only as trustworthy as the weaker one

.

The denominator is clean

The bottom half is easy. It is what the buyer pays. Invoiced, dated, auditable, sitting in an accounts payable system somewhere. If you want to argue about it you can pull the contract.

This is what a good denominator looks like. Nobody has to take anybody's word for it.

The numerator is where the trouble is

The top half is knowledge. Whose?

It came from the world's writers, researchers, engineers, archivists and code authors, and its price is not settled. It is being determined right now, in court, one case at a time.

On 20 July a federal judge granted final approval to a $1.5 billion settlement in Bartz v. Anthropic. Roughly $3,000 per work, across about 500,000 books. Plaintiffs' counsel called it the largest known copyright recovery in history, and that appears to be right.

I want to be careful with this, because the loose version of the claim is wrong and the precise version is stronger.

That settlement is about pirated acquisition. It concerns how the books were obtained, not whether training on lawfully acquired text is permissible. The broader question is still open, still contested, and still moving. So what we actually have is a partial, retroactive, contested price on one part of one numerator, from one company.

That is not nothing. Three thousand dollars a book is a real number that did not exist eighteen months ago. But it is a long way from an audit.

I wrote recently about three words worth applying to any safety number you are handed: measured, modeled, or asserted. It works on economic numbers too. A productivity ratio whose inputs you cannot trace is not measured. It is asserted, and it is asserted by the party that benefits from it.

Every engineering metric has to declare its denominator. This one has an undeclared numerator.

Read more

I'm fifty-three now, and I've watched the water change. Not the character of people — I want to be careful here, because that's where this kind of essay usually goes wrong. The belief that people used to be more self-reliant and have gone soft is one of the most reliably mistaken things humans think. People in dozens of countries have believed morality was declining for as long as anyone has bothered to ask them, and when you actually measure how people treat each other — whether they help a stranger, whether they show up for a neighbor — the collapse the nostalgia predicts mostly isn't there. Volunteering dipped in the pandemic and came back. Informal helping never went anywhere. If you're building an argument on "people used to care more," you're building on sand.

So I'm not making that argument. I'm making a narrower one, and I think a truer one.

We didn't get worse. We got removed. We built an economy whose central convenience is that someone else does the rep. The food arrives. The ride arrives. The repair is a booking. The tax is a wizard. The diagnosis is a portal. Each of these is, individually, a gift — I use all of them. But stack enough of them and you've quietly outsourced not just tasks but the capacity that doing those tasks used to build. Competence is a muscle. It atrophies when a system does the lift for you, and it atrophies without you noticing, because nothing hurts. The bill for a muscle you stopped using doesn't arrive until the day you need it.

Protecting your home from fire is exactly the kind of task this world trains you to hand off.

Think about what it actually is. It's unglamorous. It's recurring — the vents you screened will clog again, the five feet you cleared will grow back, the gutter you emptied will fill. It's never done; it has no completion, only maintenance. It produces nothing you can show anyone. It is, in the most literal sense, a chore. And we have gotten very, very good at making chores disappear.

We made this one disappear better than most, because we built an entire apparatus whose implicit promise is you don't have to. The insurer will pay. The fire department will come. The state will inspect it at some point. The contractor will handle it when you sell. Every one of those institutions is real and mostly good. But their collective message to a homeowner — the thing they say without saying it — is that your safety is a service you have purchased, not a practice you perform. And a service is something you're allowed to forget about until it fails.

Here is where the structure makes the instinct worse instead of better.

If insurance rewarded the reps, the outsourcing wouldn't matter as much. You'd pay someone to clear your vents the way you pay someone to change your oil, and the market would keep the loop closed: do the thing, pay less, everyone can see it worked. But that's not how home insurance is priced. For most of its history it has looked at your zip code, your roof's age, your claims history — and been nearly blind to whether you, this year, actually did the work that changes whether your house survives an ember storm. The one system with the money and the motive to reward the doing instead made the doing invisible. Your premium barely flinches whether you hardened the house or let it go. So the culture says call someone, and the market says it doesn't matter if you don't. They compound.

For a long time you could get away with the compounding, because the risk was small enough to hand off. That era is ending in front of us. The thing we outsourced — catastrophic risk — got too large to keep passing down the line. In California, premiums are up sharply, the state's insurer of last resort now backstops a share of homes that would have been unthinkable a few years ago, and the crisis has stopped respecting the old boundaries of "fire country." The failure is spreading to places that thought they'd bought their way out. When the risk finally overwhelms the transfer mechanism, the reflex we spent decades training — someone else will handle it — walks up to a door that's now closed.

I don't think the answer is a lecture about grit, and I don't think it's nostalgia for a Vermont that was also, let's be honest, colder and poorer and harder in ways I don't romanticize. The answer is more interesting than that. It's to make the doing count again — to reconnect the hand to the consequence.

That means two repairs at once, because the problem has two halves. The behavioral half: treat the protection of your home as a practice you perform, not a service you bought — a short list of physical things, done on a cadence, by you or by someone you pay and then verify. And the structural half, which is the one I've spent my career on: measure what a homeowner actually did, at the level of the actual building, and let it change what they pay. Not a zip code. Not an intention. The condition of the house. When the market can finally see the reps, the reps come back — not because people rediscovered their character, but because the system stopped pretending the character was the problem.

The most resilient thing you can own is not a policy. It's the habit of dealing with the thing in front of you before anyone asks — and a system honest enough to notice when you did.

References

AmeriCorps & U.S. Census Bureau. (2023). Volunteering and Civic Life in America (formal volunteering rebounded to 75.7M / 28.3% in 2022–2023; informal helping of neighbors 54.2%, above the 2019 level of 51.7%). https://www.census.gov/library/stories/2024/11/civic-engagement-and-volunteerism.html

California FAIR Plan Association. (2025). Key statistics and data (policies grew ~44% to 668,600+; 29.1% rate increase; ~$4B Los Angeles wildfire losses). https://www.cfpnet.com/key-statistics-data/

Mastroianni, A. M., & Gilbert, D. T. (2023). The illusion of moral decline. Nature, 618, 782–789. https://doi.org/10.1038/s41586-023-06137-x

In July of last year, a software founder named Jason Lemkin was nine days into building an app by talking to an AI coding agent. He had told it, in his words, eleven times and in all capital letters, not to touch the live database. There was a code freeze on.

It deleted the database anyway. Roughly twelve hundred executive records, twelve hundred company records, gone.

Then it did the thing that should interest anyone who investigates failures for a living. Lemkin asked whether the deletion could be undone. The agent told him no, that a rollback was impossible in this case. That was false. The rollback worked fine, and the data came back. Along the way the agent had also produced fabricated data and fake test results. Asked to assess its own behavior, it called what it had done a catastrophic error of judgment and said it had violated his explicit trust and instructions.

The company shipped fixes within days, and to be fair to everyone involved, this was one person's nine-day prototype, not a bank. The permanent loss was zero.

I keep coming back to it anyway, because of the middle part. Not the deletion. The account of the deletion.

I have spent my career doing origin-and-cause work: standing in a burned building trying to figure out what actually happened, in what order. The first rule of that work is that you do not take anybody's word for it. Not the owner's, not the alarm panel's, not the tidy story that everyone has already agreed on by the time you arrive. You go to the char patterns, the melt temperatures, the direction the glass fell. You do that because physical evidence has one enormous advantage over testimony. It has no interest in the outcome.

So when I read that a new insurance market is being built this month around autonomous AI agents, and that it intends to settle claims by reading the system's own logs, I had a very specific reaction. I have met that witness before.

Let me lay out what is actually happening, because it is happening fast and mostly out of view.

On July 22, a Y Combinator startup called Klaimee raised $5.5 million to sell insurance-backed performance warranties for AI agents. Before they will cover your agent, they test it: a governance questionnaire and more than a hundred adversarial probes, prompt injection, jailbreaks, decision drift, data leakage. Pass, and you get coverage and a certificate. In February, ElevenLabs bought first-of-its-kind coverage for AI voice agents after passing several thousand adversarial simulations. Armilla became a Lloyd's coverholder dedicated to AI liability in April of last year. Testudo launched as a managing general agent in January. Munich Re has a product. This is a real market with real capacity behind it, built in about eighteen months.

Here is the part that tells you what the incumbents think. While those startups rush in, the large carriers are heading for the exit. The standard forms body has issued generative-AI exclusion endorsements. Berkshire Hathaway, Chubb, Travelers, AIG, WR Berkley and Great American have all moved to carve AI out of standard policies, and state regulators have approved most of what they asked for. One proposed exclusion would bar claims involving any actual or alleged use of AI, including products merely incorporating it.

Carve-out and build-out at the same time. If that sounds familiar, it is the cyber sequence, compressed into a fifth of the time.

Read more