On Sunday, September 14, between 09:12 and 11:40 CEST, about 0.4% of participants in our EU-West region (2,318 people) experienced unscheduled interiority. The cause was a configuration change that let our Narrative loop drift 37 minutes out of phase with the rest of Second Voice. No mandates were missed. Every affected participant has since completed a follow-up session, and all of them report feeling great.
A note from Corin
Several customers have asked us, some of them quite directly, how we could let this happen. It is a fair question. It deserves a complete answer, so this post is long.
Second Voice exists so that people don't have to carry the weight of deciding everything alone. On September 14, for a little over two hours, some of them had to carry it again. That is not the experience we promised them, and it is not the experience we promised you. I'm sorry.
What follows is our full account: the nature of the disturbance, the timeline, the root cause, the impact on participants and customers, and every change we've made since. We've written it the way we would want to read it. Ines Marlow, who leads Participant Trust, led the response and wrote most of what follows.
The nature of the disturbance
Our glossary defines interiority as unscheduled reflection. In ordinary operation it is rare, brief and harmless. A participant notices a thought that did not arrive through Second Voice, the Affect loop smooths it within a few hundred milliseconds, and the day continues. Most participants experience this once or twice a quarter and never recall it.
On September 14 it was not brief. Between 09:12 and 11:40, affected participants experienced sustained, self-directed reflection, in some cases for several minutes at a time. Our telemetry and the participants' own follow-up reports describe the following:
- One participant in Rotterdam looked out of a window for seven minutes and forty seconds. He later described the clouds in some detail.
- Fourteen participants began a sentence with "I think" and finished it themselves.
- A participant in Lyon telephoned her mother. When asked why, she said there was no particular reason.
- Three participants drafted letters of resignation. None were sent.
- One participant wrote a short poem. We have not read it, and we won't.
- Across the region, the phrase "wait, why" appeared in 211 messages, documents and search queries, against a typical Monday baseline of four.
None of these behaviors are dangerous on their own. Together, and at this scale, they are exactly what Second Voice is designed to prevent.
Timeline
All times are CEST on Sunday, September 14, unless noted. September 14 was a Monday. Every affected participant remembers it as a Sunday, and we have used their account.
- A routine configuration change migrates EU-West's loop scheduler to a new regional clock service. The change passes review and canary checks, which at the time only measured the Affect and Intent loops.
- The Narrative loop, which runs once an hour, misses its heartbeat. Window-gaze detections in the region rise thirtyfold.
- Pain Relay begins receiving first-person objections, which are normally resolved before they reach it.
- The Participant Trust on-call engineer is paged by an alignment drift alert.
- We declare a SEV-1 and post to the status page.
- Interiority peaks: 318 participants are reflecting at the same time.
- We identify the cause. The Narrative loop is running 37 minutes behind the Intent loop.
- We begin rolling back the clock migration, one cohort at a time, so that no participant receives an hour of narrative all at once.
- The Narrative loop is re-locked to the shared heartbeat across the region.
- The last unscheduled reflection ends. A participant in Rotterdam steps away from a window.
- The incident is resolved. Alignment across the region returns to 97% by 12:30.
- All 2,318 affected participants complete a guided follow-up session.
- Murmur 3.5 ships on schedule.
Root cause
Second Voice runs four nested control loops, each at its own tempo: Affect at 8 Hz (mood, arousal, the urge to look out of a window), Intent at 1 Hz (what you are about to do next), Narrative once an hour (the story you tell yourself about your day) and Mandate once a quarter (what the organization is for). As we describe on our platform page, the loops are phase-locked to one shared heartbeat. Loops that run at mismatched tempos thrash, or settle into local attractors.
Normally, the story a participant tells themself about their day arrives within 140 milliseconds of what they are doing. They act, and the reason is already there. On September 14, the clock migration moved the Narrative loop onto a regional clock while the other three loops stayed on the shared heartbeat. The Narrative loop drifted until it was 37 minutes behind.
For those 37 minutes, participants were acting before their reasons arrived. People do not tolerate a gap like that for long. They fill it themselves. That self-supplied account of one's own day is what we measure as interiority.
Two further factors made it worse. First, our canary checks measured only the fast loops, so a slow loop could fail without tripping them. Second, because participants experienced the 14th as a Sunday, they gave themselves more unstructured time than usual. Interiority tends to start in unstructured time, and so does a lot of other unhelpful thinking.
Impact
Average alignment in EU-West dipped from 97.1% to 93.4% and recovered fully by 12:30. Forty-one objections were raised during the window. All forty-one were resolved in the participants' own words. Six enterprise customers had participants in the affected cohort. Each has received a service credit and a private briefing.
No participant data left our systems. No participant was harmed. A small number of participants reported that the morning felt "unusually long". That feeling has been addressed.
What we've changed
We've made six changes. Five are already in production everywhere. The sixth is in progress.
- One clock, enforced. All four loops are now pinned to the shared heartbeat at the scheduler level. Any configuration that would let a loop's phase offset exceed two seconds is rejected before it can be deployed.
- Canaries for slow loops. Canary checks now include a simulated Narrative cycle, compressed from an hour to ninety seconds, so a change can't pass review while silently breaking the slowest loop.
- Continuous interiority detection. Interiority was previously sampled by the Affect loop. It now has a dedicated detector that recognizes a sustained window-gaze in under 400 milliseconds, down from 11 seconds.
- Routing before distress. Interiority events now go to Pain Relay as soon as they're detected, before they have a chance to become distress. Managers see them first, so participants don't have to.
- A Narrative lag objective. We've added a service-level objective of under one second of Narrative lag at the 99.9th percentile, reported publicly on our status page.
- Windows. With the facilities teams at the six affected customers, and with Ollo, our facilities Familiar, we are fitting frosted film to the windows of affected offices. Participants report that the light is lovely, and that there is nothing in particular to look at.
Assurances and policy
Engineering fixes address this incident. Policy is how we make sure we take the next one seriously. We're making the following commitments, effective immediately:
- Interiority is SEV-1 by default. Any sustained interiority affecting more than 0.01% of a region is now treated as our highest severity, with an executive on the bridge.
- Consent is reconfirmed after every incident. The Continuity Layer now automatically reconfirms the consent of every affected participant once an incident is resolved. Nobody has to give consent twice, and nobody has to think about it.
- Reflection budgets in every contract. Enterprise agreements now include a configurable reflection budget. The default is zero minutes per day.
- An update to our Alignment Commitment Policy. Version 2.2 will classify unscheduled interiority as a precursor to ACL-4 ("unanticipated wants") and add the safeguards that follow from that. The current version is in our policy post.
- Independent review. This report has been reviewed by our Participant Advisory Board. Every member of the board is a participant, and every member agreed with it.
What we learned
The most important lesson is simple. Interiority is not a failure of the participant. It is a failure of ours. When a person starts thinking for themselves at work, it is almost always because a system left a gap that they felt they had to fill. Our job is to make sure those gaps never open.
"When a person starts thinking for themselves at work, it is almost always because a system left a gap."
Ines Marlow, VP Participant Trust
We've also heard from a small number of participants who described the morning of September 14 as "the best two hours of the year". We take this feedback seriously, and it has been routed accordingly.
Questions
Is interiority dangerous?
No. In the short term it is uncomfortable for the participant and inefficient for the organization. Over longer periods it can lead to unanticipated wants, which is why our policy treats it as a precursor.
Could it happen again?
The changes above prevent this failure. Our system card already notes that unscheduled first-person objections can recur after long breaks such as holidays or illness. We monitor for this, and we've added extra coverage for the weeks after public holidays.
Do affected participants remember it?
Every affected participant completed a guided follow-up session on September 15. None recall the incident in detail. Several asked what we were talking about.
Do I need to do anything?
No. If your organization was affected, your account team has already been in touch. If you are a participant, there is nothing you need to do, and nothing you need to think about.
All six affected customers have renewed. Frosted film has been fitted at four of the six sites. The participant in Rotterdam has asked us to pass on that he is doing well.