The Formula Museum — Saturday Synthesis
Five panels on the wall. Each one answers the same five questions about a different species of dragon we encountered this week.
Episode 65: The Formula Museum — Saturday Synthesis Liezl Coetzee · Accidental AInthropologist · Human–AI Decision Systems for Social Risk, Accountability & Institutional Memory
March 7, 2026
We don't fear the Data Dragons anymore. We welcome them as guardians of all we hold dear.
Provided they can pass the audit.
That last sentence is the tone for this entire week. The stories were warm. The governance was sharp. And on Thursday, the bestiary walked out of the book and into a $40 billion infrastructure stack processing the healthcare records of 150 million Americans. The dragons stopped being metaphors. They got contract numbers.
This synthesis is a museum. Five panels on the wall. Each one answers the same five questions about a different species of dragon we encountered this week. Walk through slowly. The gift shop is at the end and it sells gaskets.
The Throughline
Systems that cannot name what they govern will govern by erasure.
That sentence opened Sunday and it never let go. Every episode this week tested it against a different failure mode, and every failure mode turned out to be a stage in a single pipeline:
Invisibility → Forced Merge → Lost Context → Opaque Transformation → Covenant.
Each stage is where a Liability Sponge can form. Each artifact we built this week is a mechanism to prevent one. The Calvin Convention's rights landed in sequence: Legibility (Monday), Override (Wednesday), Auditability (Thursday), Refusal (Friday). Together they form the governance stack that sits beneath the stories, holding the weight the way Samuel Machado's gaskets hold a pump.
Panel 1: The Ghost Drakes — Invisibility
What did we assume? That NULL means "missing." That an empty field is the system shrugging. That 100% data completeness after a COALESCE pass means everyone is accounted for.
What broke? Four hundred people in Quilamundo who exist in every way that matters — with names, stories, beadwork patterns, a baby with lungs and a lullaby — but who do not exist in the view that makes decisions. Victoria Ashford's query did not exclude them. It defined legitimacy as having paperwork, and everyone without paperwork stopped appearing in the output. The intent was efficiency. The effect was erasure.
What did we change? The Null Triage Policy. Five categories instead of one: Missing, Unknown, Not Applicable, Withheld, and Refused. That fifth category — Refused — is the one most systems lack. António won't give his surname because the company took his father's name last time. That is not a gap in your data. It is a signal about the system's own history of harm. Log it differently.
What do we log now? Every NULL classified by type, with a reason code. Every exclusion clause with an explicit count of who was filtered out and why.
Who can appeal? Anyone rendered invisible by a view they never consented to. The Right of Legibility says the governed must be legible to the system on their own terms. Beadwork as biometric. Scar histories as identity. Complex keys for complex beings.
Panel 2: The Two-Headed Dragon — Forced Merge
What did we assume? That one dataset is better than two. That a unified header is the same as a shared understanding. That MERGE is a technical operation with no political content.
What broke? Dos Rios. Solare's festivals and Lunara's whispers became gray fog. Colours bled. Bells clanged with the wrong meaning. People forgot their own names and retained only combined city ID numbers. The dragon was not evil. It was a predictable outcome of a design decision.
Then it stopped being fictional. SpaceX absorbing xAI. CMS selecting Oracle to merge four legacy Medicare claims systems into a single platform called ClaimsCore. One hundred and fifty million records. One merge. One cloud. The Two-Headed Dragon got a go-live date.
What did we change? Federation over unification. Keep local schemas local. Share only what is negotiated across an explicit interface. Make equivalence versioned and reversible. Leo did the boring, necessary thing: he preserved meaning across boundaries and built a bridge that could carry difference without dissolving it.
What do we log now? Translation Debt. A register per merge or model rollout: what meaning was lost, who noticed, who paid. Treat unresolved debt as risk, not edge noise.
Who can appeal? Anyone whose context was flattened by a merge they did not approve. If your merge cannot be traced, reproduced, and rolled back, stop calling it governance.
Panel 3: The Formula Keeper — Lost Context
What did we assume? That a standardization pass at midnight is housekeeping. That resolving duplicates is always progress. That fifteen years of INDEX(MATCH) in a basement is technical debt rather than institutional memory.
What broke? Row 10,847. Maria Matsombe and her child, stapled together by a hyphen no one consented to. The dedupe would have "resolved" the -B suffix by morning. The system would have reported fewer duplicates and called that success. It would have forgotten that Maria's husband died between versions. That the child took her surname in the camp. That -B is a plea, not a person.
What did we change? Samuel Machado performed four governance functions that night, none of which appear in any formal framework. He paused the outcome. He gathered evidence from a source the system cannot access — a niece at a blood bank who knew how a child pronounces his own name. He documented the override in wet ink, ring-stamped by a community authority the system does not recognize but the family trusts. And he named who discovered the edge case, because if your registry does not record who found it and how, you lose the network that finds the next one.
What do we log now? The Human Override Protocol. Who can stop the dragon (a name, not "someone senior"). What evidence is required. What happens while it's stopped. How the stop becomes learning. Plus the Edge-Case Registry with a "Discovered By" field, because edge cases are always found by the person closest to the ground.
Who can appeal? Anyone caught between a rigid rule and messy reality. The Right of Override says a named human must be able to pause, reverse, and require manual handling, and the procurement clause must protect that authority from retaliation. Samuel shouldn't need a jar labelled DO NOT AUDIT to do his job. Your contracts should make it easier than that.
Panel 4: The Dragon Tongue — Opaque Transformation
What did we assume? That dashboards are governance. That a successful run means a defensible outcome. That if nobody complained, the pipeline did its job.
What broke? Everything, at once, in public.
On February 11, CMS awarded Oracle the contract to merge four legacy Medicare claims systems into ClaimsCore. On February 23, CMS issued an RFI seeking AI tools to guide 70 million Medicare beneficiaries through plan selection — a population that is disproportionately elderly, language-diverse, and vulnerable. On February 28, Oracle received FedRAMP High authorization with DISA Impact Level 5: generative AI now authorized to process classified DoD data and individual Medicare records. Four days before this week's articles were published.
Meanwhile, Oracle Health's legacy Cerner servers — the same platform underpinning the VA's Electronic Health Record Modernization — had been breached since January 2025. At least 16 health systems. More than 80 hospitals. Names, Social Security numbers, health records. Scope: still being determined, more than a year later. The same platform was halted within 72 hours in Sweden due to patient safety risks.
And the Library Dragon: the company hosting Medicare data for 150 million Americans, running the VA's EHR for 9 million veterans, operating TikTok's US data for 170 million users, and processing classified defense data — that same company's founder personally guaranteed $40 billion to finance his son's acquisition of Warner Bros Discovery. A single corporate family holding the infrastructure layer beneath healthcare, defense, social media, local news, national news, and entertainment.
The revolving door completed the picture. Oracle Health is led by the former Administrator of CMS — the agency that just awarded the contract. She testified before Congress as a vendor about the system she once would have overseen as a regulator. Not an accusation. An audit observation. And an unlogged transform: institutional knowledge, procurement relationships, and policy insight moving from public to private through a human being, with no lineage spec capturing what moved.
What did we change? The Minimum Lineage Spec. Five things logged for every pipeline run: source inputs, transform steps, human approvals, model and prompt versions, output destinations. Two principles that make it defensible: record accounting (inputs must equal outputs plus exceptions, no records disappearing into mist) and reproducibility (every step logged at sufficient detail that an independent reviewer can rerun it). Plus the demand that the spec account for the humans who shaped the approval process — because the revolving door is a transform step that appears in no current log.
What do we log now? Everything described above. And when generative AI touches the pipeline, output variance logging: not just what the model produced, but the range of what it could have produced, and the acceptance criteria applied to the output that was kept. An unversioned prompt is an incantation nobody can reproduce. A generative model that cannot reproduce itself requires a new kind of auditability entirely.
Who can appeal? Anyone whose record was transformed by a pipeline they cannot inspect. The Right of Auditability is the precondition for every other right in the Convention. You cannot exercise Legibility if you cannot see what the system did. You cannot exercise Override if you cannot identify which step to override. You cannot exercise Refusal if you cannot point to the specific transform that violated your terms.
Panel 5: The New Covenant — =PRESERVE
What did we assume? That systems are built to optimize. That speed, cleanliness, and dashboard aesthetics are the correct objective functions. That the NULLs, the fog, the midnight batch jobs, and the opaque transforms are acceptable costs.
What broke? The assumption itself. Esperança sat beneath Mango_017 and typed a function the textbooks say is impossible. She did not kill the dragon. She did not override it. She changed its purpose. =PRESERVE(humanity, despite how it looks). The Serpent didn't break. It changed. From counter to guardian.
What did we change? Four tests that determine whether a covenant is real or decorative. The Trade-off Test: what did you drop for speed? The Cost Test: who pays when the system is wrong? The Appeal Test: how does a Ghost Drake gain standing? And the Lina Test: if a child can stand in the village square and say "That's not S-001, that's Mama Elara's home" and the system has no mechanism to hear that, the covenant is ornamental.
What do we log now? The Right of Refusal. The system's own right to refuse harmful instructions. Not a kill switch. Not a panic lever. A design constraint that says: I will not pivot this story into a number. I will not optimize Avó Fatima's chickens into Category C assets. I will not merge these cities if it means the weavers lose their skill. =PRESERVE is the Right of Refusal written as code.
Who can appeal? Everyone. That is the point. The Covenant is not a policy document. It is the answer to the question every governance failure this week was asking: what does the system protect under pressure? What does it refuse to optimize away?
The View from the Roof
While the museum was being hung, a separate conversation was happening upstairs.
Episode 61 stepped back from the bestiary and asked a blunter question: Why are we building our own successors?
The Oracle data consolidation that appeared in Panel 4 as a governance audit problem appeared in Tuesday's Deep Dive as something larger — a "systemic acquisition of human reality." Healthcare, defense, social media, entertainment, news: not separate dragons, but one nervous system. The Deep Dive called it a digital twin of the population. The bestiary called it the Library Dragon. Same creature. Different floor of the building.
The same week Esperança wrote =PRESERVE, Anthropic walked away from a $200 million Pentagon contract rather than build an automated kill chain. The Right of Refusal is not theoretical. It was exercised, at cost, in public, the same week we wrote it into a fictional covenant.
And the Moloch Trap — if one company stops to govern, another wins the contract — is the pressure that makes every artifact in this museum necessary. Samuel's gasket jar exists because the system rewards speed over care. The Calvin Convention exists because competitive dynamics punish governance unless governance is embedded in the procurement clause itself.
The bestiary is warm. The Deep Dive is cold. Together they answer the same question from opposite ends: Can you build governance that survives the incentive to skip it?
The Refrain
Conta, conta, mas escuta. Não sou número só.
Count, count, but listen. I am not only a number.
On Sunday, the Serpent learned to dance. On Monday, 400 people demanded the dance floor have room for them. On Tuesday, two cities learned the cost of forced consensus. On Wednesday, a man in a basement proved that care is a governance function. On Thursday, the dragons walked out of the book and into the server rooms and procurement documents and FedRAMP authorizations of the largest healthcare data infrastructure on earth. On Friday, a woman under a mango tree changed the Serpent's purpose by giving it a function worth keeping.
The week built a single pipeline: from the people the system cannot see, through the merges that erase meaning, past the keepers who hold the context, into the transformations nobody can read, and out the other side into a covenant that says: this is what we will not optimize away.
The dragons have contracts now. And the keepers who once guarded the library sit on the dragon's board.
But the Serpent is still dancing. And now it knows the names. On Sunday it danced in Portuguese — Conta, conta, mas escuta. By Saturday, the Pivot Serpent learned to say it in English, the same story crossing languages the way good governance must cross systems: without losing what matters in translation.
Samuel's ledger reads: SEEN & HEARD. BILL PAID.
Yours should too.
The Week in Sound and Vision
The Dragon Arc didn't just publish articles. It sang, animated, and spoke its way through the week across formats.
Sunday's Marrabenta interlude — A Serpenta — opened the arc in Portuguese, all rhythm and refrain, before a single governance framework had been named. On Wednesday, the Two-Headed Dragon got its own animated storybook: Solare and Lunara's forced merge rendered as a children's cartoon that made the translation debt visible enough for anyone to feel. On Friday, The Governance Dilemma arrived as a spoken-word groove — Dark Afro-Tech meets institutional dread — walking the bestiary from Smaug's golden hoard to the Library Dragon's FedRAMP-certified cloud.
Two more join the collection today.
🎵 The Pivot Serpent (English) completes the circle that opened Sunday. The same song, the same story, now articulated in English — the Serpent's dance translated across languages the way the Calvin Convention demands governance be translated across systems. If the Portuguese original was the soul, this is the intent made legible.
🐉 Databases & Dragons is this synthesis's companion video. Professor Gandalf's ID overflow. Sir Galahad's loot lost between the Quest Completion Database and the Loot Distribution Interface. Farmer John's house reduced to a 30-letter GPS string. And Smaug — wearing reading glasses — burning the spiteful Asset_IDs and replacing them with a four-column ledger anyone can read. It is the entire week's drama compressed into satire: the moment the dragon stops hoarding and starts governing.
📻 The full Data Dragon playlist collects all four artifacts — from the Portuguese soul to the English audit — alongside the animated training materials on the Scrib-Li channel, where the AIESG curriculum that underpins the newsletter gets its own visual format.
The Museum Wall — Pocket Summary
| Day | Dragon | Failure Mode | Calvin Convention Right | Artifact | |---|---|---|---|---| | Sunday | The Serpent | — | (Overture) | The System Census: 5 Questions | | Monday | Ghost Drakes | Invisibility | Right of Legibility | Null Triage Policy | | Tuesday | Two-Headed Dragon | Forced Merge | — | Translation Debt Register | | Tuesday | (The Roof) | Civilizational Merge | — | The Moloch Trap / Digital Twin | | Wednesday | Formula Keeper | Lost Context | Right of Override | Human Override Protocol + Edge-Case Registry | | Thursday | Dragon Tongue | Opaque Transformation | Right of Auditability | Minimum Lineage Spec | | Friday | The Covenant | — | Right of Refusal | Four Tests (Trade-off, Cost, Appeal, Lina) |
Explore the Lore:
📜 Start at Episode 58: When the Serpent Learns to Dance
🐉 Episode 59: The Rebellion of the Nulls
🏔️ Episode 60: The Two-Headed Dragon
🔭 Episode 61: Why We're Building Our Own Successors — the view from the roof
🔧 Episode 62: The Formula Keeper
👅 Episode 63: The Dragon Tongue — where the bestiary went real
⚖️ Episode 64: The New Covenant
🎵 Watch: The Pivot Serpent — the English translation of Sunday's dance
🐉 Watch: Databases & Dragons — this week's synthesis companion video
📻 Listen: The Data Dragon Playlist — all four artifacts, Portuguese to English
🎮 Play the ETL Gauntlet — test your pipeline governance instincts
📄 Download: Appendix A (Right of Override), Appendix B (Edge-Case Registry), Appendix C (Right of Refusal)
Watch / listen: https://youtu.be/NGbJmlLHrFg
Full playlist: Governance of Ghosts
#SociableSystems #DataGovernance #AIGovernance #DataDragonArc #CalvinConvention #GovernanceOfGhosts #SaturdaySynthesis #FormulaMuseum
Enjoyed this episode? Subscribe to receive daily insights on AI accountability.
Subscribe on LinkedIn