The hidden cost of resilience

I have stood at enough gates to hear the announcement before it comes. The airline is looking for volunteers. The flight is oversold, because airlines sell more tickets than an aircraft has seats on the calculation that some passengers will not appear. Usually somebody takes the voucher. When nobody does, the airline turns to a hierarchy it wrote long before any of us reached the gate: the fare, the hour you checked in, your standing in the loyalty programme. Regulators require it to publish that ranking and to tell the passenger it removes how she was chosen, which is more candour than most systems offer, and the plane leaves on schedule carrying everyone who could afford not to be chosen.
What we call stability looks like this from underneath. The timetable holds, the lights stay on, the shelves stay full, and the smoothness persuades us that nothing is being paid, when the cost has only been moved out of view, onto a person selected in advance by a rule they never read.
We once promised the opposite. The old ideal was a machine that never falters, given up for good reason, since systems built to resist everything break all at once. Resilience is the word every serious institution now reaches for, meaning redundancy, absorption, small contained failures that keep the whole from collapsing, and it is wiser than the fantasy it replaced. It carries a decision the vocabulary tends to swallow, because a controlled failure still has to happen to someone.
Airlines are not the only ones who write it down. After 2008, regulators gave up the pretense that large banks would never fail and required them to hold what the rules call loss-absorbing capacity, with the Financial Stability Board insisting that creditors, customers and depositors know in advance the order in which they will absorb losses. Shareholders lose everything first, then junior bondholders, then senior creditors, with depositors protected at the back.
Elsewhere, the same queue exists unwritten. Football's governing body sets the temperature at which it would stop a World Cup match well above what the players' union calls dangerous, and the fixture list holds while a body absorbs the difference. A grid sheds load and a neighbourhood goes dark, rarely a wealthy one. A harvest fails and the shortfall finds households with the least room to pay more. The shock does not disappear because the system recovered. It is routed to whoever has the least standing to refuse it, which makes the two candid systems worth a second look. The airline ranks passengers by the fare they paid. The banking queue was drafted by capital, and protects capital's instruments in the order capital preferred. Both are published, available on request. Both, read plainly, sort people by money and say so without embarrassment. Disclosure was never the difficulty. The systems willing to name who absorbs the failure turn out to be the ones most confident nobody will object to the name.
Resilience, described honestly, is a question about power dressed in the vocabulary of design. None of this counts against resilience, which we will need far more of. The point is to say the hard part out loud while the design is still on paper and the ranking can still be argued, before the drought and the failed harvest arrive to settle it. Who have we chosen to carry the volatility we can no longer prevent, and are we willing to name them now, knowing that the naming has never once been the hard part.