# SAIL ST8 INTO THE STORM
## v1.3 XPRIZE Robustness and Graceful-Degradation Design

**Design question:** Can Harbor Zero remain honest, useful, and safe when sensors, models, power, communications, disposal routes, and institutional agreements fail together?

**Revision principle:** v1.2 designed an adaptive operating system. v1.3 removes the assumption that the operating system can reliably observe, compute, communicate, or command after a compound disaster.

---

# 1. EXECUTIVE DESIGN SHIFT

The remaining feasibility gap is optimistic observability.

A post-liquefaction, post-earthquake waterfront under atmospheric-river conditions may lose instruments, reference elevations, communications, power, access, model calibration, and trusted records at the same time. The system therefore cannot depend on a complete sensor network, a continuously updated digital twin, rapid geotechnical interpretation, a functioning waste route, or universal adherence to a pre-event compact.

Harbor Zero v1.3 is designed around five doctrines:

1. **Unknown defaults to restrictive, not safe.**
2. **No single sensor, model, agency, or communications path may authorize clearance.**
3. **The system must degrade from high-resolution prediction to coarse conservative control without producing false precision.**
4. **Every capability has a declared failure state and a manual fallback.**
5. **A failed intervention, rejected vessel, suspended treatment train, or unresolved disagreement may be evidence that the system is working.**

The new prize proposition is:

> Harbor Zero is not a system that prevents failure. It is a system that fails visibly, locally, reversibly, and without converting uncertainty into false assurance.

---

# 2. DESIGN-BASIS COMPOUND EVENT

Harbor Zero must be validated against a defined compound-event family rather than one cinematic scenario.

The design basis includes combinations of:

- strong earthquake shaking;
- liquefaction and lateral spreading;
- differential settlement;
- damaged shoreline armoring and buried utilities;
- uncertain source geometry;
- aftershocks;
- high tide or storm surge;
- atmospheric-river rainfall;
- wave and wake action;
- stormwater and groundwater loading;
- power loss;
- communications fragmentation;
- sensor fouling and drift;
- inaccessible laboratories;
- blocked road and marine transportation;
- mixed-waste destination rejection;
- public distrust and contradictory data releases.

No single event realization is “the” forecast. The validation program samples this event space.

---

# 3. SYSTEM-WIDE FMECA

Harbor Zero must maintain a living Failure Modes, Effects, and Criticality Analysis.

Each component records:

- function;
- failure mode;
- local effect;
- system effect;
- means of detection;
- possibility of common-cause failure;
- safe default;
- manual fallback;
- recovery action;
- validation test;
- accountable owner.

## Priority failure modes

| Failure mode | System danger | Safe default | Required fallback |
|---|---|---|---|
| Pore-pressure network lost | False green shoreline status | RED / remote only | ShakeMap-based inspection priority, remote imaging, conservative geotechnical review |
| Reference monuments displaced | False settlement interpretation | Invalidate local datum | Independent GNSS, vessel survey, visual fiducials, manual resurvey |
| Turbidity sensors foul | False low or high plume indication | Mark data unavailable | Grab samples, optical backscatter cross-check, model envelope widened |
| Model loses forcing data | Precise but stale route guidance | Withdraw route rating | Precomputed scenario envelope and tide-stage rules |
| Primary command center inaccessible | Coordination paralysis | Transfer authority | Alternate command node and paper mission boards |
| Digital provenance ledger unavailable | Evidence cannot be synchronized | Preserve local signed records | Tamper-evident paper custody and delayed reconciliation |
| Waste destination rejects load | Residual accumulation | Throttle or stop treatment | Surge storage and reprioritization |
| Decon system fails | Cross-zone transfer | Suspend entry/exit | Alternate decon node or shelter-in-place for asset |
| Community compact disputed | Trust system stalls | Publish disagreement | Independent dissent record and parallel split analysis |
| Registered vessel arrives damaged | Certification no longer valid | Reclassify at arrival | Limited tasking or rejection |
| Potable-water telemetry fails | Unknown supply integrity | Isolate affected segment | Stored water and physical sampling |
| Aftershock occurs during work | Injury and source disturbance | Immediate stop-work | Muster, resurvey, and reauthorize |

The FMECA must include correlated failures. “Backup” equipment placed on the same fill, using the same power source and communications network, is not independent redundancy.

---

# 4. GEOTECHNICAL DECISION SYSTEM UNDER PARTIAL BLINDNESS

## 4.1 ShakeCast is a triage input, not a safety declaration

A ShakeMap/ShakeCast-type system may rank structures and lifelines for inspection using shaking estimates and pre-event fragility information. It cannot determine whether a post-event shoreline footprint is safe for entry.

Harbor Zero therefore uses a three-layer geotechnical process:

### Layer A — Regional shaking and fragility triage

Inputs:

- estimated shaking intensity;
- mapped liquefaction susceptibility;
- pre-event fragility curves;
- known utility and shoreline vulnerabilities.

Output:

- inspection priority;
- presumed damage state;
- initial RED zones.

### Layer B — Remote change detection

Inputs:

- drone or vessel imagery;
- synthetic-aperture radar where available;
- sonar and bathymetric change;
- displaced fiducials;
- visible cracking, slumping, piping, boils, settlement, or revetment loss.

Output:

- evidence of change;
- areas requiring exclusion;
- locations where prior geometry is no longer valid.

### Layer C — Task-specific field authorization

Inputs:

- functioning local instruments;
- short-duration reconnaissance;
- utility status;
- tide, wave, and weather window;
- escape route;
- task load and equipment footprint.

Output:

- authorization for one task, one footprint, and one time window.

No layer may independently produce a general “site safe” status.

## 4.2 Thresholds must be site-calibrated

v1.3 should not invent universal numerical values.

The design uses dimensionless or site-calibrated trigger families:

- excess pore-pressure ratio, based on local effective stress;
- cumulative and rate-of-change displacement;
- factor-of-safety or deformation estimates for the relevant failure mode;
- observed scour relative to the design section;
- utility leakage or loss-of-containment indicators;
- aftershock shaking relative to the task authorization basis.

If the required measurement is unavailable, the authorization becomes more restrictive.

## 4.3 Sensor survivability

Sentinel instruments are classified by failure independence:

- buried;
- surface-mounted;
- vessel-observed;
- remotely sensed;
- manually surveyed.

At least one monitoring mode must not share the same physical failure mechanism as the others.

Sensors are tested through:

- shake-table loading;
- cyclic pore-pressure and settlement testing;
- saltwater immersion;
- debris impact;
- cable pullout;
- power interruption;
- fouling;
- telemetry loss.

## 4.4 Narrative solution

Maya does not act because a green light appears.

She acts after the system loses half its geotechnical data and defaults the shoreline to RED. The heroic decision is stopping a politically urgent intervention.

---

# 5. HYDRODYNAMIC MODELING THAT CAN FAIL GRACEFULLY

## 5.1 Three model tiers

### Tier A — Precomputed scenario atlas

Generated before the event for combinations of:

- tide phase;
- wind and waves;
- rainfall/runoff;
- particle-size and settling classes;
- alternative source locations;
- multiple release magnitudes;
- damaged shoreline geometries.

Stored locally in static form.

Purpose: maintain coarse decision support without high-performance computing or live telemetry.

### Tier B — Reduced-order local ensemble

Runs on rugged local hardware or a vessel node.

Uses:

- surviving observations;
- simplified transport physics;
- ensemble source terms;
- uncertainty expansion when data disappear.

Purpose: update scenario weights and identify areas of greatest disagreement.

### Tier C — High-fidelity regional model

Uses the best available hydrodynamic and sediment-transport tools when central computation and data feeds are available.

Purpose: detailed forecasting, hindcasting, and longer-term planning.

Loss of Tier C must not eliminate all route and sampling decisions.

## 5.2 No “safe route” output

The system publishes:

- probability bands;
- scenario disagreement;
- observation age;
- data coverage;
- transport mechanism;
- operational consequence.

Route status is policy layered on science—not a direct model output.

## 5.3 Resuspension thresholds

Use the ratio:

> **R = modeled or measured bed shear stress / site-specific critical erosion shear stress**

Critical erosion stress must be established pre-event through defensible site-specific erosion or sediment testing. It is not assumed from a generic mud value.

Operational categories:

- R well below 1: lower resuspension potential, subject to uncertainty;
- R near 1: sensitive transition;
- R above 1: active erosion/resuspension plausible;
- unknown R: route cannot be credited as low-risk.

## 5.4 Attribution limits

A local reduction in turbidity or contaminant flux is not automatically credited to Harbor Zero.

Evaluation must compare:

- intervention and non-intervention locations;
- tidal phase;
- rainfall;
- background variability;
- particle-size changes;
- model counterfactuals;
- uncertainty.

The trailer should avoid claiming causal victory from one falling sensor trace.

## 5.5 Narrative solution

The high-fidelity model goes offline.

The local system falls back to a broad scenario envelope and closes a route it can no longer defend. The model becomes less precise and more conservative on screen.

---

# 6. POWER, COMMUNICATIONS, AND DATA CONTINUITY

## 6.1 Independent communications paths

Harbor Zero uses multiple modes with different failure mechanisms:

- terrestrial fiber where available;
- public-safety radio;
- marine VHF;
- satellite communications;
- local mesh;
- vessel-to-vessel relays;
- physical data transfer;
- paper mission and custody records.

Mesh is one layer, not the layer.

## 6.2 Independent power paths

Critical nodes declare:

- normal power;
- battery endurance;
- generator fuel;
- vessel power;
- solar or other local generation where applicable;
- load-shedding order;
- restart requirements.

The operating picture visibly reports which nodes are running on temporary power and for how long.

## 6.3 Minimum viable operating picture

When digital systems fragment, the response maintains a coarse shared picture containing only:

- current exclusion zones;
- last verified observations;
- data age;
- active protective actions;
- vessel and crew accountability;
- treatment and waste capacity;
- open disputes;
- next update time.

The system does not attempt to recreate a high-resolution digital twin on paper.

## 6.4 Data reconciliation

Offline nodes may develop conflicting records.

The synchronization protocol:

1. preserves both versions;
2. identifies the conflict;
3. records the decision made at the time;
4. reconciles only after provenance review;
5. never silently overwrites the losing version.

---

# 7. COMMUNITY EVIDENCE COMPACT AS A CONTESTED INSTITUTION

The Evidence Compact is not assumed to create trust or prevent litigation.

It is designed to make distrust operationally survivable.

## 7.1 Pre-event legal architecture

The compact requires:

- memoranda defining access, custody, publication, and independent testing;
- funding insulated from the principal responsible party;
- preselected laboratories plus alternates;
- conflict-of-interest disclosure;
- rules for privileged, enforcement-sensitive, and publicly releasable information;
- a dispute clock;
- explicit acknowledgment that participation does not waive legal rights.

## 7.2 Failure states

The compact must function when:

- one party withdraws;
- a laboratory loses accreditation or access;
- a sample split is insufficient;
- chain of custody is challenged;
- a result is leaked early;
- the agency and community experts interpret the same result differently.

## 7.3 Dissent protocol

A formal disagreement packet contains:

- agreed facts;
- disputed facts;
- consequence of each interpretation;
- immediate protective action;
- evidence needed to resolve the dispute;
- deadline for update.

The public sees disagreement without being forced to choose between “official science” and “community truth.”

## 7.4 Equity authority

The community liaison has defined powers to:

- request a split sample;
- place a dissent into the official record;
- trigger language-access and fisher outreach;
- request reassessment of a closure or reopening;
- observe custody and laboratory transfer.

The liaison does not unilaterally command operations or declare contamination.

---

# 8. JUBILEE REGISTRY WITH CERTIFICATION DECAY

Pre-certification reduces friction. It cannot eliminate post-event requalification.

## 8.1 Certification lifecycle

Every mission module has:

- issue date;
- expiration date;
- maintenance state;
- crew currency;
- test history;
- current configuration;
- known deviations.

Certification automatically degrades after:

- major storm exposure;
- collision;
- equipment modification;
- crew substitution;
- contamination;
- missed maintenance;
- loss of documentation.

## 8.2 Arrival requalification

At arrival, command verifies:

- vessel condition;
- module function;
- crew status;
- fuel and endurance;
- fittings and power;
- communications;
- contamination status;
- decon and waste plan;
- task-specific operating envelope.

A previously green asset may become amber or red.

## 8.3 Unregistered assets

Unregistered vessels are not ignored.

They enter a provisional pathway:

- humanitarian support;
- cold-zone logistics;
- observation;
- limited nonhazardous tasking;
- no controlled-zone work without requalification.

## 8.4 Regulatory friction as a design variable

The registry records which missions require:

- federal tasking;
- state authority;
- port approval;
- worker qualification;
- hazardous-material transport authorization;
- radiological controls;
- environmental approval;
- liability coverage.

Exercises measure the time and failure points in these interfaces.

---

# 9. TREATMENT AND WASTE AS A COUPLED BOTTLENECK

## 9.1 Treatment cannot be sized independently

Maximum treatment throughput is the minimum of:

- captured-water supply;
- pretreatment capacity;
- power;
- verified hold capacity;
- residual packaging;
- worker availability;
- waste surge storage;
- transportation;
- receiving-facility acceptance.

The smallest capacity controls the system.

## 9.2 Waste posture levels

### W0 — Routable
Waste profile accepted and transport available.

### W1 — Hold
Destination or transport delayed; surge storage available.

### W2 — Throttle
Storage margin approaching the declared minimum; treatment reduced and prioritized.

### W3 — Stop
No defensible storage or disposition path; treatment halts except for immediate life-safety decontamination.

## 9.3 Surge-capacity validation

Do not select an arbitrary number of days.

Define:

> **Hold endurance = usable segregated storage / worst credible residual generation rate**

Then stress it with:

- destination rejection;
- blocked roads;
- closed port;
- storm delay;
- repackaging;
- resampling;
- worker shortage.

The design basis includes margin and unusable capacity. Capacity shown on a drawing is not assumed fully usable.

## 9.4 Mass-balance standard

The system must close:

- water volume;
- solids mass;
- container count;
- residual location;
- custody.

Contaminant mass balance is reported within method-specific analytical uncertainty rather than forced to an unrealistic exact closure.

## 9.5 Narrative solution

The first treatment loop succeeds technically but is throttled because a mixed-waste profile is rejected and the secured barge is nearing its usable segregation limit.

The antagonist is not failed technology. It is the coupled system.

---

# 10. FOOD, LIVELIHOOD, AND EQUITY CONTINUITY

A harvest closure is not a complete protective action unless the response addresses its consequences.

The plan must include:

- multilingual shoreline notification;
- direct outreach to subsistence and recreational fishers;
- substitute food distribution;
- livelihood assistance or emergency compensation;
- tissue sampling with transparent location and species selection;
- public distinction between precautionary closure and confirmed tissue impact;
- reopening criteria;
- long-term health and exposure communication.

The trailer should show both the closure marker and the replacement-food distribution point.

This prevents environmental protection from shifting the full burden onto the community already carrying the legacy risk.

---

# 11. VAPOR, BUILDING REENTRY, AND DRYING SEDIMENT

Add a separate land-side decision track for:

- damaged buildings over contaminated fill;
- broken utility conduits;
- volatile chemicals where present;
- soil gas and vapor intrusion;
- wet sediment or soil that may later dry and generate dust;
- indoor air and reentry decisions.

Building reentry is not granted by an outdoor shoreline reading.

Where the contaminant profile warrants it, the system uses:

- utility isolation;
- indoor-air screening;
- soil-gas or subslab evaluation;
- ventilation controls;
- dust suppression;
- controlled access;
- later confirmatory sampling.

The pathway may intensify after the storm as surfaces dry.

---

# 12. SEA-LEVEL RISE AND REMEDY ADAPTATION

Harbor Zero is not only an emergency layer. It creates a feedback loop for long-term remedy resilience.

The remedy performance envelope should be reassessed against:

- higher mean water levels;
- changed groundwater gradients;
- saltwater intrusion;
- larger waves and storm surge;
- shoreline slumping;
- cap erosion;
- differential settlement;
- changed sediment deposition;
- repeated earthquake damage.

## Adaptation triggers

Examples include:

- loss of cap thickness or armor;
- repeated exceedance of design shear conditions;
- unacceptable groundwater rise;
- settlement beyond the remedy allowance;
- increasing contaminant flux;
- repeated institutional-control failure.

A trigger may require:

- additional armor;
- cap repair;
- revised monitoring;
- source removal;
- access restriction;
- relocation of vulnerable infrastructure;
- managed retreat from an operating area.

The film should not end with a permanent return to the pre-event design.

---

# 13. PHYSICAL AND OPERATIONAL VALIDATION PROGRAM

## Testbed A — Geotechnical and hydraulic physical model

Use scaled or component testing to examine:

- liquefaction-induced settlement and lateral spreading;
- revetment damage;
- piping and seepage;
- wave and current interaction;
- scour;
- sensor survival;
- temporary-control deployment limits.

The objective is not perfect replication of HPNS. It is identification of failure modes and work envelopes.

## Testbed B — Hardware-in-the-loop coastal model

Inject:

- uncertain source term;
- sensor dropout;
- fouling;
- stale tides;
- altered bathymetry;
- failed communications;
- aftershock;
- rainfall pulse.

Compare:

- high-fidelity model;
- reduced-order ensemble;
- precomputed atlas;
- no-model baseline.

## Testbed C — Full-scale logistics exercise

Include:

- damaged and uncertified vessels;
- incompatible fittings;
- exhausted crews;
- failed decon;
- limited fuel;
- waste destination rejection;
- blocked transport;
- simultaneous humanitarian needs.

## Testbed D — Evidence and governance red team

Inject:

- mislabeled sample;
- false positive;
- false negative;
- delayed result;
- leaked preliminary result;
- disputed custody;
- legal withdrawal;
- contradictory agency statements.

## Testbed E — Long-duration remedy resilience analysis

Stress long-term remedy alternatives under:

- sea-level rise;
- storm surge;
- changed groundwater;
- cap erosion;
- repeated seismic damage;
- institutional-control failure.

---

# 14. XPRIZE PERFORMANCE METRICS

## Safety and honesty

- zero false “all clear” declarations in challenge scenarios;
- zero controlled-zone transfers without accountability;
- every route and work authorization includes data age and uncertainty;
- every aftershock triggers the declared reauthorization process.

## Graceful degradation

Challenge the system with staged loss of:

- primary power;
- primary communications;
- high-fidelity model;
- major sensor groups;
- command facility;
- waste destination.

Measure whether it retains essential protective functions without inventing precision.

## Evidence integrity

- all samples and field readings retain provenance;
- conflicting records remain visible;
- correction time is measured;
- dissent is published through the defined process;
- no silent data replacement.

## Modeling

Evaluate:

- probabilistic calibration;
- forecast skill relative to baseline;
- false-low-risk route rate;
- uncertainty growth during data loss;
- benefit of active sampling.

## Geotechnical control

- unsafe work is stopped;
- inspection priority is correct more often than a no-information baseline;
- no general clearance is produced from regional shaking data alone;
- authorization expires under declared triggers.

## Waste

- 100% container and custody accounting;
- water and solids ledger closure;
- contaminant balance reported within analytical uncertainty;
- treatment throttles before storage failure;
- incompatible streams remain segregated.

## Equity

- fisher and shoreline-user notification time;
- language coverage;
- substitute food and livelihood support activation;
- community split-sample participation;
- closure and reopening criteria published.

---

# 15. REVISED TRAILER ARC

## 0:00–0:24 — Adaptation with visible redundancy

Show a maritime district that survives because it is layered, repaired, and imperfect.

## 0:24–0:38 — Correlated failure

The quake does not merely turn screens off.

It:

- displaces reference markers;
- parts one mooring;
- damages a shoreline segment;
- takes out power and telemetry;
- leaves some local systems alive;
- coincides with an atmospheric-river warning.

## 0:38–0:50 — False choice interrupted

“Fortress or harbor.”

River interrupts:

> “Neither. We’re blind. Stop the traffic.”

## 0:50–1:03 — Evidence and uncertainty

Show:

- failed instruments;
- repeatable surviving anomaly;
- split sample;
- conflicting drawings;
- ROV/sonar evidence;
- model envelope widening;
- shoreline defaulting to RED.

## 1:03–1:18 — Graceful degradation

Show:

- the high-fidelity model offline;
- paper mission board;
- selected vessel requalification;
- unsafe shoreline work cancelled;
- contained treatment throttled;
- waste route rejected;
- community dissent posted publicly.

## 1:18–1:26 — Unequal consequences and time

Show:

- harvest closure;
- replacement-food distribution;
- DAY 12;
- MONTH 4;
- continuing tissue and sediment sampling.

## 1:26–1:30 — Final image

The final image is not a functioning perfect system.

It is a visibly damaged response network still maintaining:

- exclusion;
- accountability;
- evidence;
- drinking water;
- community support;
- one controlled operation.

**Final line:**

> “We built it to fail without lying.”

Alternative, more expansive:

> “We could not keep everything working. We kept failure from becoming permission to lie.”

---

# 16. FINAL XPRIZE POSITION

v1.3 should no longer promise resilience through technological completeness.

It should demonstrate resilience through:

- conservative defaults;
- independent evidence;
- distributed authority;
- visible disagreement;
- bounded interventions;
- stop-work power;
- mass balance;
- residual storage;
- time-aware recovery;
- equity support;
- explicit failure testing.

The resulting concept is more difficult and less utopian.

It is also more original.

> **Harbor Zero is a coastal emergency system whose most important output is not a plume map, a treatment rate, or a command dashboard. Its most important output is a defensible decision made under partial blindness—and a complete record of why that decision was made.**

---

# 17. PRIMARY TECHNICAL GROUNDING

- U.S. Geological Survey, ShakeCast and ShakeMap documentation.
- NOAA National Ocean Service, San Francisco Bay Operational Forecast System.
- U.S. EPA, Superfund contaminated-sediment guidance and adaptive site management resources.
- U.S. EPA, climate-resilience technical fact sheets for contaminated sediment and containment remedies.
- U.S. Army Corps of Engineers, quantitative risk assessment and FMEA/FMECA resources.
- FEMA, continuity guidance for communications, facilities, and essential functions.
- U.S. Navy BRAC Program Management Office, Hunters Point Naval Shipyard Parcel F Record of Decision and site documents.