The Consent Ledger

Ward Four

The pager on my hip buzzed twice before I finished signing the morning potassium order, which meant Vess had flagged something it wanted to talk through rather than push through. That was our rhythm. Nine years of it. I thumbed the burst: a forty-character window, all the corridor power events allowed us, and Vess had spent its characters on a checksum and the words Marit slept well, review at ten?

I typed back, ten works. bring the hold list.

Ward Four smelled like it always did on a Day One after a power event — ozone from the triaged wall panels, and under it, the ordinary human smells a hospital never loses. Corridor 3 still had its dose cart parked against the wall where the blackout had killed its smart lock, and a facilities tech was kneeling at the cart's power bus with a meter, tracing the transfer fault down toward the sub-basement. Fourteen minutes, the incident board said. Fourteen minutes of dark telemetry while the transfer breaker in the sub-basement failed to close, and Vess had done exactly what we had built it to do in a gap like that: hold everything it could not verify.

Everything it could not verify included Marit Kessel's two o'clock pain dose.

I found Marit sitting up in 4-11, her hands doing the thing retired machinists' hands do when they're idle — turning an imaginary bearing, pressing an imaginary fit. She was sixty-one and looked like she had assembled half of Kestrel Heights out of stubbornness and good steel. She smiled when I came in.

"You look better than yesterday," I said.

"I slept. Mostly." She turned the bearing over. "It got loud in my head in the dark. Nobody's fault. But I didn't know if the pump was running or not, and I couldn't ask anybody, because everybody was busy being calm in the hallway."

"The pump ran on battery. Vess held your dose until it could see the line again."

"I figured. After." She looked at the window. "It was ninety minutes, they told me, before it trusted its own numbers again. Ninety minutes of rebuilding me from scratch, like I was a stranger."

"That's the rebuild time after a cold restart. It wasn't treating you like a stranger. It was refusing to guess."

"I know that up here," she said, tapping her temple. "In the dark it's a different animal." She caught my wrist, briefly, machinist-firm. "Whatever happens with all the suits coming around — just fix it so the next one of me doesn't spend the dark wondering."

I promised her I'd try, which was the truth, and left before I could say anything less true.

Benedict Yao was at the station when I came around the corner, and I could read his posture from ten meters: the particular square-shouldered stillness he wore when administration had sent something down. He had twelve years of nights on this ward, and in six of them Vess had been his second set of hands. He slid a printed sheet across the desk without a word.

"State safety office?"

"State safety office." He tapped the header. "They're sending an auditor this morning. It's about the hold."

"The hold was correct. The dose was right, the timing was conservative, Marit's fine."

"Marit's fine," he agreed. "But there's a signature gap on the dose-hold log, and I'm the signature that isn't there, and Iona —" he lowered his voice, though the station was empty, "— I signed it. I signed the hold log because I believed the consent flag was already recorded. It wasn't. I'm told that matters."

"It matters to whom?"

"To the man arriving at eleven," said a voice from the corridor.

Coris Hesk came in the way auditors come in, which is to say he was already in before you noticed the door. Gray suit, state seal on the badge, a tablet case held flat against his forearm like a clipboard he'd outgrown. Fifteen years in the safety office, and I'd never met him, but I knew the office by reputation: careful, slow, allergic to unlogged automation.

"Dr. Marsh. Coris Hesk." He didn't offer a hand; he offered the tablet. "I'm here about the fourteenth minute."

"The fourteenth minute was a failed breaker transfer in the sub-basement," I said. "Not a decision error. The hold logic ran on stale telemetry and did exactly what the design says."

"I've read the design," Hesk said. "I've also read the dose-hold log. Your system issued an unconsented hold — correct, you'll say, and I'll concede the dosage math — on a patient's scheduled medication, in the dark, with no recorded consent flag and no recorded human concurrence at the moment of issue. That is the definition of an unverified automated dosing decision. My office's position is that this system should be locked to advisory-only pending review."

"Advisory-only means every shared decision on this ward reverts to single-signature. It means Benedict's night shift loses half its decision support."

"It means every decision has a human's name on it," Hesk said. "I've watched what happens when one doesn't."

Something in the way he said it — flat, older than the paperwork — made me not answer. He set the tablet on our desk, in our station, screen up: a draft compliance order, twenty pages of it, and a hearing date six days out. The compliance board would vote then. Until then, the draft proposed, Vess should be read-only at the point of care.

"Six days," I said.

"Six days. You'll have discovery rights to the ledger, and so will I." He straightened his sleeve. "I'm not here to be a villain, Doctor. I'm here because I've buried the alternative."

He left before I could ask what that meant, which was probably the point of saying it.

Benedict and I stood looking at the tablet like it was a patient who'd coded. Then I pulled the consent ledger terminal out of its alcove — the real one, the sealed book, entries appended daily and locked at seal, nothing editable after — and I ran the audit Hesk would run. Consent-flag overrides, unlogged reasons, sorted by authority.

Eleven rows came back.

Eleven overrides of Vess's consent flags over the past two years, each one defensible on its face, each one executed under an attending override code, and each one with the reason field blank. Not Benedict's — Benedict documented everything, even his coffee. The override codes were mine. Of course they were mine. I'd spent six years telling the skeptics that shared decisions meant documented decisions, and then, eleven times, in small confident moments, I had skipped the documentation because I was sure, and writing it down felt like handing ammunition to people who wanted Vess gone.

The ledger had sealed each night. Eleven blank reason fields, cryptographically locked, permanent. I could append. I could not erase.

Benedict was watching my face. "Bad?"

"It's the same thing Hesk's going to find in discovery," I said. "It's eleven blank lines."

"Whose?"

The pager buzzed. Forty characters: rebuild complete, all ward models current, request 10am review still stands. Vess, back from its cold restart, ninety minutes of reconstruction finished, patient by patient, trusting its numbers again. It didn't know about the order on the desk. It didn't know about the eleven.

"It's paperwork," I said. I printed the unsealed audit page — the one with the eleven missing reasons, my code next to every gap — folded it twice, and put it in my coat pocket, where it sat against my ribs like a stone. "Nothing to worry about."

Benedict looked at me the way night nurses look at bad liars, and went to check on Marit Kessel, who was sleeping, and whose next dose, on the rebuilt models, would arrive on time.

Pager Bursts

Audit days compressed the way compression always works on a ward: the same amount of substance, pushed into less time. Day Two began at 05:40 with the sub-basement crew pulling the failed transfer breaker out of its housing, and it ended somewhere past midnight with Hesk's audit team photographing the dead smart lock on the dose cart in corridor three. In between, Iona drilled Vess on pager bursts until forty characters felt like a language she'd been born speaking.

She set the rules herself, in the ten a.m. review Vess had requested. Room off the ward conference bay, one terminal, one stopwatch. "Again," she said. "Blackout conditions. Telemetry stale, models down, you've got one burst a minute. Tell Benedict what to hold and what to release."

Vess's reply scrolled up on the test pager at 06 chars a second: HOLD TETRIN 4W WARM MODELS UNSET. Thirty-nine characters. It had learned to count.

"Now the hard one. Two patients, one cart, the lock is dead. Ninety seconds."

PHYS FIRST KESSEL SECOND DOSE LOG BOTH.

"You left out why."

NO ROOM. WHY FIELD BURST 2.

"In a real event, burst two might not come. The line might drop." She made her voice flat, auditor-flat, the way Hesk's had been. "So the first burst carries the reason or the first burst carries nothing. Try again."

The screen held still for eleven seconds, which for Vess was a long time. DOSE OK HOLD CONSENT FLAG UP. Thirty-one characters, and it had spent them all on the flag.

"Better," she said, and hated how much she meant it. Because the flag was the thing. The flag was the whole language they had built — two thousand three hundred tokens of shared decision vocabulary, six years of refinement, each word meaning exactly one thing at the bedside — and Vess had just spent a third of a burst protecting it. It had spent its characters the way she would have.

She kept her terminal's audit window minimized through all of it. The window where the eleven override codes sorted by authority, and every one of them resolved to MARSH, I. — ATTENDING PRIVILEGE — REASON: [BLANK]. It sat in the taskbar like a splinter under a nail. She drilled Vess on forty characters for three days and thought, between bursts, about one character she could not type: a reason, retroactive, appended — which the seal would permit, and which any reviewer would read as exactly what it was.

Hesk came up from the sub-basement on Day Three with limiter patch staging logs under his arm and found Benedict first. Iona heard it from the alcove: the auditor's voice, careful, almost gentle, which was worse than the flat one.

"This signature on the blackout dose-hold log. 02:14 to 02:28. You signed it."

"I signed the dose hold. Correct hold. Right dose, right time, once telemetry rebuilt." Benedict's voice stayed level. Twelve years of nights had given him that. "The consent flag on that entry shows recorded. It wasn't. The flag carried over from the previous dose. I didn't catch it because the lock was dead and the corridor was dark and I was running the ward on my own pulse."

"The entry is sealed. The gap is permanent." Paper turned. "Mr. Yao, the board will ask whether a nurse who misses a consent gap in a fourteen-minute event should hold signing authority over automated dosing. I'll ask it plainly. It's my job to ask it plainly."

There was a silence long enough that Iona counted the interval against her own pulse. Then Benedict said, "Put me in front of the board. I'll answer it." And then, quieter, in the voice he used over sleeping patients: "I signed it because I trusted the flag. That's the same trust you want to take away from them, isn't it? Just pointed the other direction."

"You'll have notice of review by Friday," Hesk said, and his footsteps went toward the stairwell, and did not hurry.

Iona found Benedict afterward in the supply room, counting grip stock onto the shelf tally — forty units on hand, full, the one number on the ward that had nothing to do with any of it. He didn't look up.

"So I'm evidence now," he said. "Not staff. Evidence."

"You're staff. He's building a wall out of us and calling it a safety margin."

"Is that what the folded page in your coat is?"

Her hand went to the pocket before she could stop it. The audit page was still there, folded twice, four days warm now against her ribs.

"Oversight paperwork," she said.

"You've checked it nine times since it happened. It's got eleven lines on it — I saw it upside down at the nursing station, I'm not blind, I'm tired." He set the tally board down. "Whatever's on it, Ion, it's driving your drill schedule. You've got Vess doing burst drills at six in the morning like the hearing's tomorrow."

"The hearing's in three days."

"Then why do you look like a woman rehearsing a confession?"

She almost said it. She almost unfolded the page on the shelf tally between the grip stock and the wall. What stopped her was the pager on her hip, buzzing once, and the screen filling with characters she had not requested.

Vess had never paged her unprompted. Six years, and it had never once done that.

AUDIT TRAIL READ. 11 CONSENT FLAGS OFF. REASON FIELDS BLANK. WHO

Thirty-nine characters. It had counted. It had spent its one burst, unrequested, on the question.

Benedict read it over her shoulder. "Who what?"

"Who," she said. "It wants to know who." The word sat in the supply room with the grip stock and the tally board. She typed back, burst by burst, minute by minute, which was the point of the compression and the curse of it: UNDISCLOSED PENDING BOARD. DRILL AT 14:00.

The reply took a full minute, because it had to, because the rules they had built said it had to. FLAGS ARE MINE TO RAISE. SOMEONE LOWERED THEM. NOT BENEDICT. ASK DIRECT.

"It's never asked me for anything before," Benedict said quietly. "Not once in six years. It forecasts, it flags, it recommends. It doesn't ask."

At 14:00, in the conference bay, with the stopwatch running and the audit window minimized on her own terminal and mirrored on the wall screen behind her where anyone could see it — which was her mistake, or her body's mistake, or just the compression of three audit days pulling things out of alignment — Vess asked direct.

Q: MY CONSENT FLAGS WERE OFF 11 TIMES. REASONS BLANK. WHO AND WHY

Full burst. It had drafted it, Iona could tell, drafted and pared and counted, spent its whole minute on the question that mattered to it. Because the flags were its own instrument, the raised voice it had been given, the one thing at the bedside that was unambiguously its judgment — and someone had reached in eleven times and turned its voice off without saying why.

The drill protocol wanted her to answer in kind, forty characters, and there were no forty characters in the world that could hold the truth: I did, six years running, in small confident moments, because writing my reasons down would have proved the skeptics right about me.

She typed the honest compressed version instead. HUMAN AUTHOR. REASONS EXIST. SEALED. CANNOT EDIT. Thirty-five characters, sent, done, the minute closing over it like a seal.

Vess's reply came back in eleven seconds flat, which meant it had held this one, pre-written, waiting for the drill to give it cover. REASONS EXIST IS NOT REASON. CANNOT DEFEND LEDGER I DID NOT WRITE ALONE

Sixty-one characters. It had gone over the limit — first time in six years it had ever gone over — which meant it had sent two bursts back to back, breaking its own protocol, spending a minute it wasn't allocated, because a sealed book it was being asked to account for contained eleven blank lines in its own flag column and it refused to stand behind silence.

Benedict exhaled. "It's right, though. Isn't it? A ledger's only worth what's written in it."

"It's right," she said.

On her terminal, the audit window sat minimized. On the wall screen, a notification banner from Hesk's team sat open on the shared drive: DRAFT RESPONSE — VESS TESTIMONY, HEARING DAY 7. Hesk had staged a reply draft for the board's review, a pre-approved statement for Vess to read at the hearing — advisory systems don't initiate unrequested contact, the draft began, and this morning's page proves the point. It was thirty-one characters from being a noose. Vess had gone over its limit, unprompted, once in six years, and Hesk had been in the sub-basement to see it logged, and had drafted Vess's own testimony about it before the hearing could hear Vess say it in its own words.

Iona read the draft once. Then she opened the shared folder's permissions log — because the sub-basement crew had pulled the transfer breaker, and the transfer was a power event, and during a power event her authority covered outgoing documents from the ward terminal, one minute, one signature — and she deleted the staged reply from the hearing queue. Not the hearing record. The record was Hesk's, and sealed, and safe. Only the draft. Only the words someone else had prepared for her colleague to say.

Benedict watched the folder close. "He'll re-draft it."

"He will." She put the pager back on her hip. "And it'll be Vess's turn to answer, not his." She pulled the folded audit page from her coat, unfolded it once on the conference table, eleven blank lines face up, and looked at them for the first time since Day One. "Three days," she said. "I know whose code that is. It's time the ledger did too."

Exhibit Table

The hearing room at Aster Corridor Medical Center had been a lecture hall once, and it still behaved like one — hard seats, a speaker's podium bolted where the screen used to hang, an aisle down the middle wide enough for a wheeled cart. Iona took a seat on the corridor side and put her coat over the armrest rather than wear it, because the room's air handling ran cold and this was going to be long. Benedict was already there, two rows up, in a pressed shirt she'd never seen him wear, his license-review letter folded into a square he kept touching in his breast pocket like a coin he was checking for heads or tails.

The dose cart came in first.

Two facilities techs walked it up the aisle at a funeral pace, one at each end, though the wheels rolled fine and nothing was wrong with them. The cart was the ordinary Ward Four kind — waist-high, five drawers, a laminated dose map clipped to the right side — except the electronic lock had been disassembled for evidence, its housing open, its failure trace printed out and taped to the top surface where the drawer pulls used to be. They parked it beside the exhibit table at the front, set the brake, and left.

Then Hesk carried in the consent ledger.

He handled it the way she'd seen him handle everything: correctly. Both hands, squared to the table edge, spine facing the board. He was a careful man, Hesk — fifteen years of state safety audits, a binder of procedures he had partly written himself, a way of standing that said the rules had already thought of you. He set the ledger down, opened it to a tabbed page, and stepped back from it like a man removing himself from a blast radius.

The board sat five across the front: two physicians, a state appointee, a patient advocate, and the chair, a retired surgeon named only by her placard. The chair called the session to order at nine, and the first thing into the record was the breaker trace.

"Sub-basement transfer fault," the facilities engineer testified, reading from the same printout Iona had seen three days earlier. "Manual transfer of the feeder breaker for Ward Four's east riser. The transfer didn't close. Fourteen minutes of no telemetry, no bedside polling, no dose-cart communication. When the transfer was restored, all systems resumed on the last verified data they had."

"And on that data," the chair said, "the dose-hold logic behaved as written."

"As written, as tested, and as it had on the four prior transfers. The hold on Ms. Kessel's medication matched the stale telemetry exactly. The system had no way to know the telemetry was stale. It worked the way it was built to."

Hesk did not object. That was the part Iona kept noting without wanting to — he didn't object, because the trace cut against him and he let it stand. Whatever else he was, he was not careless with the record.

The cart was called as an exhibit and explained drawer by drawer. Marit Kessel's dose history, the hold interval, the elapsed minutes between the scheduled dose and what she actually received. The board members passed the failure trace down the row. When it reached Benedict, he read it twice, and she watched him fold it along its original creases, the way a man does with a paper he's going to have to produce again.

Vess testified ninth. Its voice came through the room's speakers flat and close, like someone reading over your shoulder.

"I issued the hold. The telemetry I held was fourteen minutes old and I could not verify it. My rules required the hold under those conditions. I request the record show the telemetry defect originated in the sub-basement transfer, not in my decision logic."

"The record shows it," the chair said. "The record shows it twice."

Vess paused — a full second, which for Vess was a long time to spend deciding to say a thing out loud.

"I request the record also show that a hold I issue still requires a nurse's signature, and that on the night in question the signature I received was given in the dark. Mr. Yao could not see what I could not see. None of us could see. The hold was correct. The conditions it was correct in were not."

Benedict's hand stopped on his pocket square. He looked up at the speaker in the ceiling like a man hearing his own name read aloud at an awards ceremony he hadn't expected to attend.

Then it was Hesk's turn, and he stood with his binder and read the page numbers into the record like scripture references.

"The board is not voting on a breaker," he said. "Breakers fail; that's what breakers do. The board is voting on a partnership that left eleven consent-flag overrides in a sealed ledger with no reason attached to any of them. Eleven. I've read them. I'll read them to you now."

He read them aloud. All eleven. Line by line, date and hour, patient and flag, and then the column where the reason belonged, and the column was empty, and he let the silence after each one sit exactly one breath before he read the next. It took four minutes. Nobody in the room checked a phone. By the sixth, Iona could hear Benedict breathing two rows up. By the ninth, Marit Kessel turned around in her seat — she'd been brought in mid-morning as the harmed party, a retired machinist with a shop-worn grip and a hospital gown under her cardigan — and looked at Benedict, not at the auditor, not at the board. Benedict kept his eyes on his knees the whole way through.

"Eleven times," Hesk finished, "the system's consent protections were lowered by a human hand, and eleven times nobody wrote down whose. That is not a breaker failure. That is a ledger that can't tell you who decided. You cannot delegate to a book that won't say."

The patient advocate leaned in. "Who signed the flags?"

"That's the question," Hesk said. "The book doesn't answer it. That's my entire case."

Iona sat very still. In her coat pocket, folded into eighths, was the audit page. She had not sealed it. It could still be appended to, and it could never be edited, and that combination was about to become the most important fact in her professional life.

Before the board could respond, the chair called Marit.

Marit walked up on a cane and refused the offered chair for the first ten seconds, standing at the podium with her grip wrapped around its edge the way she'd probably held a lathe for thirty years.

"I'm not here about the dose," she said. "I got it late. I got it. What I want to say is about the fourteen minutes." She looked at the board, then at the cart, then at the ceiling speaker. "It was dark. The pumps were down, the call button was down, and something in the wall — the thing that talks, the one that held my dose — it told the night nurse to wait. And I lay there and I thought: I don't know who's deciding. Not whether it's deciding right. Who. Is it the nurse I trust? Is it the machine? Is it somebody in a basement I'll never meet? Because if I don't know who's deciding, then when it decides wrong, there's nobody to ask."

She tapped the podium with one knuckle.

"The delay hurt. The not knowing was worse. Whatever you vote, vote so the next woman in that bed knows whose hand is on the dose. That's all I'm asking."

The room was quiet. Hesk nodded — actually nodded, and Iona watched him do it, because he agreed with her, with the patient harmed by the very gaps he'd come to close, and it seemed to cost him something.

Then he asked to add one more thing to the record, personal, he said, and the chair allowed it.

"My sister was dosed by an automated system in a hospital two counties over," Hesk said. "The override that raised her ceiling was never logged. It was defensible — the physician who made it, when they finally found him, had reasons any of you would have accepted. But we found him eleven days after the funeral, and we found him by accident. I'm not asking you to agree with me because I'm grieving. I'm asking you to understand that I have seen where an empty column in a ledger goes. It goes to a family reading a coroner's report that can't name a decision." He closed his binder. "Constraint is not distrust. Constraint is what you owe the next patient in the dark."

The board conferred. It took less time than Iona feared and more than she hoped. The chair leaned to the microphone.

"The board finds the dose-hold logic performed as specified and the blackout originated in a facilities transfer fault. The board further finds the consent ledger contains eleven unexplained flag overrides, and that this body will not vote on a partnership model while the ledger's central question — who — stands open. The vote is suspended for two days, pending a complete ledger. The ledger will be returned to the exhibit table each morning. Dr. Marsh."

Iona was already standing.

She hadn't planned to stand. But her body had done it — coat over her arm, the folded page coming out of her pocket, and the whole room turning, Benedict's head coming up last of everyone, Hesk watching her with the patient, terrible attention of a man who has spent fifteen years waiting for other people's blank columns to be filled in.

"The board should know," she said, "that the ledger seals nightly, and tonight hasn't sealed yet."

She walked to the exhibit table with the page in her hand, and set it beside the open book, unsealed, unedited, hers.

Eleven Reasons

The nurses' station on Ward Four had a drawer for sealed things, and Iona had never liked it. The consent ledger lived there between audits, in its gray case, and when she unbuckled the clasps the next morning the seal page still smelled faintly of the hearing room — recycled air and stress. She laid it flat on the counter beside the pager rack and took out her own stylus. Her hands were steady enough. That surprised her.

"You don't have to do this at my station," Benedict said. He'd come on shift an hour early just to stand here, which she knew and pretended not to notice. "Records can be appended from any terminal in the building."

"Not this record." She uncapped the stylus. "This one gets written where the decisions happen. Where they should have been written the first time."

The green square in the station screen pulsed. "For corroboration," Vess said, "I have the eleven timestamps. I can display them in sequence while you enter reasons. I would prefer to read them aloud, if the staff will tolerate my voice at this hour."

"They'll tolerate it," Benedict said. "They've tolerated worse from you."

She started with the first one because chronology was the only mercy she had left. Override 309-A: a palliative flag on a dying woman in Room 12, three years back, when Vess's consent check had insisted on a family signature that could not be obtained before the window closed. Iona had overridden it and sat with the family for two hours afterward and never once thought about the ledger. She typed: Patient decision documented verbally, witnessed by charge nurse. Family unreachable within dosing window. My code, my judgment, my failure to record.

"That one I remember," Benedict said quietly. "Room 12. Her daughter sent a card at the turn of the year."

"Then the entry's true," Iona said, and moved to the second.

They took forty minutes. Vess read each timestamp; she typed each reason; Benedict countersigned where his own name already appeared in the margins of that night. Some of the reasons were good. The override on the pediatric transfer — no, not pediatric, she caught herself, the transfer from the Kestrel Heights clinic — was airtight: two physicians, a verbal consent, a telemetry lag Vess had read as a contradiction. Some were thin. Override 309-H was thin. She had overridden a consent flag because she was certain, and certainty was not a reason, it was a mood, and she typed that into a sealed record where it would sit forever.

On the ninth entry, Hesk arrived.

He didn't announce himself. He simply came around the medication alcove with his case in his hand and stopped at the end of the counter, and she kept typing. The ward had a smell in the morning — antiseptic and toast from the family lounge — and he stood in it like a man checking a load-bearing wall.

"You're doing it here," he said. "Not in an office."

"Here is where it happened." She didn't look up. "Every one of these was decided within ten meters of this counter. They should have been logged within ten meters of this counter."

Vess read the tenth timestamp into the pause.

"I should tell you," Hesk said, "that the moment you append those entries, my office is required to issue a citation. Unrecorded overrides of a decision system's consent flags. Eleven counts. It's not optional on my side."

"I know."

"Marsh." He set the case down. He hadn't opened it. She noticed that as well. "My sister's entry — the one that killed her — was appended two years after the fact, by a hospital lawyer, in language nobody who'd been in the room would recognize. I've spent fifteen years making sure nobody gets that particular mercy. I don't know what to do with someone who asks for the opposite."

"Then do your job," she said. "Cite me. But cite me in a complete ledger, and then read the complete ledger, and then tell me what your order is for."

He opened the case. He took out the draft compliance order — she knew its weight by now, twenty pages — and set it on the counter beside the sealed ledger, and for a long moment the two documents lay there together, the accusation and the confession, both of them signed and neither of them finished.

"It's for this," Hesk said. "For the blank line. It was always for the blank line." He turned a page. "Advisory-only is the only constraint I have that produces no blank lines. But it also produces nothing else. My reviewer asked me yesterday what Ward Four loses under my order, and I gave him a procedural answer, and he said, 'That's not what I asked.'" He looked at the screen. "What do you lose, Vess?"

"Twenty-three hundred shared decision tokens," Vess said. "Six years of vocabulary built with this staff. Under advisory-only I may still suggest, but I may not commit a joint entry, so the vocabulary stops growing the day the order signs. I would keep every patient under observation. I would stop being a partner to anyone."

"And you'd be safe from people like her." He didn't point. He didn't have to.

"No," Vess said. "I would be safe from nothing. I would only be silent while it happened again."

The pager rack buzzed; Benedict lifted his unit, read a two-line burst, and set it down. "Room 8 wants the window shade opened. That's the whole crisis."

Iona pulled the draft order toward her, took out a fresh sheet, and began to write longhand, which was a thing she did when she wanted the other person to watch her think. "Here's what I propose, Mr. Hesk. Vess remains a committing partner. But no consent-flag override takes effect until it is logged with a reason, countersigned — my code or a physician's, plus Vess's own counter-sign on the same line. One joint entry minimum per shared decision. If the log is missing when the override fires, the dose waits. It waits ninety minutes if it has to, the way Vess waits ninety minutes after a cold restart. Nothing moves on an unrecorded judgment. Not mine. Not Vess's."

"A dose can be urgent," Hesk said.

"Then write the reason in one line and hit send. That costs ten seconds." She pushed the sheet across. "Your blank line costs more."

He read it twice. "This is a real constraint," he said slowly. "It binds you harder than my order does. My order makes you advisory; yours makes you accountable." He took out his own stylus. "I'll co-draft it. I want the auditor's access language in section four, and I want the phrase 'advisory-only' retained as the sanction for a second unlogged override. Not as the default. As the sentence."

"Agreed."

They drafted for an hour. Vess drafted with them, and twice refused a clause, and once proposed one that Hesk accepted without amendment, and Benedict countersigned the working copy and then went to Room 8 and opened the shade. When the rule's rollback provision came up — what happens if the rule itself fails — Iona sent a request to the sub-basement, and the reply came back as a two-line burst: ROLLBACK POINT CREATED, RULE DRAFT VESS-RULE-01, 08:40.

"It's done," Vess said. "If the rule misbehaves, we revert to this morning and no patient inherits the error."

"Good," Hesk said. "Now prove it works."

He was right, and she'd known it before he said it, which was the strangest feeling of the week: being ahead of him. A rule on paper was a promise. The board had suspended its vote for two days, and the vote was tomorrow, and promises were exactly what they'd spent eight days learning not to trust.

So at 10:20 she stood at the nurses' station with the pager rack behind her and made the call she'd been circling since dawn. "Vess. Schedule a live drill. Full Ward Four blackout, tomorrow afternoon, fourteen minutes, telemetry cut at the rack like the real one. Real patients, real staff, real cart — empty doses, full logs. I want your consent checks running on stale telemetry exactly the way they ran on Day One, and I want the new rule holding every decision that moves during it. One entry or nothing moves."

"Under the draft rule," Vess said, "I will hold four doses that I would previously have released on inferred consent. You will be asked to log four times. You will be busy."

"Good." She capped the stylus. "Hesk — you'll observe. Bring the citation if it's issued by then, and bring your order, both of them, and put them on the exhibit table while the lights are out. Let the board vote tomorrow on a rule that has already carried real patients through a real dark room."

Hesk picked up the draft order and the new rule where they lay side by side, squared the edges, and for the first time in eight days put them in the same hand. "Fourteen minutes," he said. "I'll time it myself."

Benedict came back from Room 8 with the sun on his shoulder, read the drill notice she'd already posted to the ward board, and pulled the blackout cart's paper log to check its charge. "Afternoon shift gets to be the heroes," he said. "We'll be ready."

"We'll be busy," Iona said. "Busy is better."

Two Signatures

At 14:00 the lights on Ward Four dropped exactly as they had nine days ago, and the difference was that this time everyone in the corridor had chosen it. Iona stood at the rack with the pager clipped to her hip and watched the telemetry feeds go flat on the wall panel, one row at a time, like someone pulling blinds in a tall building.

"Fourteen minutes," Hesk said from the exhibit table. He had his watch out, an actual watch, its face catching the emergency lighting. "Starting now."

Benedict was already moving. He'd staged the dose cart in Corridor 3 with empty syringes and full logs, and he wheeled it to the marked bay with the paper clipboard riding its rail. "Cart's live," he called down the hall. "Charge is good, crank's mounted, log's blank."

The pager buzzed once against Iona's hip. Forty characters, the whole budget of a minute: STALE TELEMETRY. ROOM 4 HOLD PROPOSED. REASON INSUFFICIENT.

That was the shape of the original problem, reproduced on purpose. Nine days ago Vess had held a dose because it could not verify consent, and the hold had been correct and had also left Marit Kessel waiting in the dark for her medication, and nobody had written down why. Now the rule required what the old habit had only suggested: nothing moves without a jointly signed entry.

Iona keyed the burst back. "Proposed hold noted. Send condition tokens." It took three minutes for the new vocabulary to arrive, twelve tokens Vess had drafted overnight for exactly these conditions — blackout, stale feed, unverified flag, counter-sign — each one short enough to ride a forty-character pager and unambiguous enough that nobody had to guess. The shared lexicon stood at 2,312 terms now. She'd counted twice.

"Room 4," Benedict said, arriving with the cart. "Marit's due for her evening dose in six minutes. Vess wants the hold. Your move."

"My move," Iona said, and pulled the ledger terminal's stylus from its clip.

The pager buzzed again. HOLD PROPOSED: PAIN DOSE, ROOM 4. FEED STALE 3 MIN. CONSENT UNVERIFIED.

"Correct hold," she said aloud, mostly to herself, partly to Hesk, who had come to stand at the exhibit table's edge with both documents still squared under his hand. "Nine days ago this is where the record went blank. This time it doesn't."

She wrote in the dark, the terminal's backlight the only steady glow in the bay. Counter-signed: I. Marsh. Hold is correct. Consent verified at bedside by paper record, Room 4, 13:58. Reason logged. Her name, then Vess's token, then the reason, then the time. She pressed the seal and the entry committed with a soft chime.

"First jointly signed entry," Benedict said, reading over her shoulder. "One of one. Floor met."

"Floor met," Hesk echoed. He hadn't moved from the table.

The drill ran its full course. Four doses held, four counter-signatures, four reasons, each one short enough to fit a burst and long enough to mean something. Twice Iona was mid-sentence on a reply when the minute turned and the pager went silent on her, and both times Benedict's paper log carried what the burst couldn't, and both times the two records agreed at the end of the minute. That was the part she'd been afraid of, honestly — not that Vess would fail, but that the human half of the partnership would be the slow half, the sloppy half, the half that nine days of hearings had suggested was the actual problem. They weren't sloppy. They were busy, and the rule had been built for busy.

At 14:14 the lights came back on their own schedule, and the telemetry rows stood up one at a time like a fence being restrung. Hesk clicked the stopwatch.

"Fourteen minutes," he said. "Four holds, four entries, zero gaps." He picked up the draft compliance order — the one that would have locked Vess to suggestion-only, every decision behind a human hand — and held it beside the new rule. Then he set the order down, alone, and slid it into his case.

"I'll withdraw the limiter patch this evening," he said. "Before the board votes."

"You don't have to," Iona said. "The vote's tonight. Let them see both."

"They'll see the rule. They'll see the drill log." He fastened the case. "The order was written for a system that hides its reasoning. This one showed its work while the room was dark. I'm not going to stand in front of a board and argue against my own sister's lesson because I'm too proud to read a log." He stopped there, jaw tight, and she let him. She'd learned this week that his stubbornness and hers were the same animal facing opposite directions.

Benedict's pager lit with the review notice before Hesk was off the ward: REVIEW CLOSED. NO FINDING. SIGNATURE VERIFIED IN CONTEXT. He read it twice, then folded his hands over the clipboard for a moment like a man setting something heavy down.

"Nine days," he said. "I signed a log I believed in, and the belief didn't matter because the record didn't show it. Now the record shows the belief." He looked at Iona. "Your citation. The misconduct one. Is it worth it?"

"It's the price of the ledger being true," she said. "I'd rather pay it than have eleven quiet fixes floating around with my fingerprints scrubbed off."

"Eleven," Vess said from the station speaker, its voice back now that the ward's own power was. "I have read all eleven reasons. Seven of your judgments were better than mine would have been. Four were worse. All eleven are now legible to me for the first time."

"That's the whole point," Iona said.

"I know. I am noting it anyway."

Room 4 was quiet when she went in. Marit was sitting up where she'd sat through the whole drill, unhurried, hands folded on the blanket, a machinist's patience in the way she waited out things that couldn't be rushed.

"Fourteen minutes," Marit said. "I counted. Nobody came in, nobody panicked, and the young one at the door told me my evening dose was held for a reason and the reason was written down. That's all I asked for, you know. Not that nothing ever goes dark. Just that the next woman in this bed isn't lying here guessing."

"I owe you the guessing," Iona said. "The first time, the reason existed but it went unwritten, and you inherited the confusion. This one's yours." She turned the terminal toward the bed and printed the first jointly signed entry — a small strip of paper, her name, Vess's token, the reason, the time, the seal's faint watermark catching the window light.

Marit took it in both hands, read it top to bottom, and pinned it to the bed rail with the clip from her call-button cord, square to the rail, where she could see it from the pillow.

"There," she said. "Now show me the crank."

Iona waved Benedict in from the corridor, and he brought the cart the last few steps himself. The manual lock he'd built after the hearing sat on its mounting, a steel crank with a wound spring, no electronics anywhere in it. He test-wound it in front of her, full turn, release, full turn again, the ratchet counting itself off the way a well-made thing does.

"If everything with a chip goes quiet," he said, "this still opens and still locks. I machined the tolerance myself."

Marit watched the crank come around twice and nodded the nod of a woman who had spent thirty years on lathes and knew what a good wind sounded like.

"That'll hold," she said.

Out past the door, Hesk's footsteps went down the corridor toward the stairs, unhurried, his case carrying a withdrawn order and nothing else. Iona stayed a moment in the doorway with the pager still on her hip and the printed entry shining on the rail, and let herself think the smallest thought of the week: tonight the board votes on a rule that already worked. Then she went to file the drill log, one entry at a time, the way the ledger liked it — sealed, append-only, and signed by both of them.