The Bus Factor Audit

Software teams have a grim little metric called the bus factor: the number of people who could be hit by a bus before the project cannot continue. Two years into building this household's sovereignty stack, I finally computed mine.

It is 1. Every component I have written about (the closet server, the backups, the self-custody arrangements, the DNS, the solar monitoring, the password vault's recovery path) is redundant in hardware and singular in administrator. I have decentralized everything except me.

The drill

Doctrine of this log: a capability that has not been drilled is a hope, not a capability. So on 2026-08-15, with my full consent and her moderate enthusiasm, my wife sat down with the "if I am gone or unconscious" binder I wrote in 2024, and attempted six recovery tasks cold. I sat behind her with a stopwatch and a rule that I could answer no questions. Results:

Task	Target	Result	Time
Access password vault via emergency kit	15 min	success	22 min
Log into primary email	10 min	success	6 min
Restore one file from local backup	30 min	success	41 min
Pay a utility bill from the right account	15 min	success	9 min
Restore photo album for the family	30 min	failure	abandoned, 58 min
Execute the self-custody recovery procedure	60 min	failure	abandoned, 35 min

Four of six. The two failures are the two that matter most, and both were my fault, not hers.

The photo restore failed because the binder, written in 2024, still described the cloud service I migrated away from on 2026-07-17 (see "84,000 Photos Came Home"). The documentation was a snapshot; the system is a stream. Nothing in my process forced the two to reconverge, so they diverged, silently, the way everything does.

The self-custody procedure failed harder and more instructively. The instructions were accurate. They were also written for a reader who already knows what a passphrase-versus-PIN distinction is, and at step 9 of 14 she hit a warning screen I had never mentioned, made the correct decision to stop rather than guess, and ended the drill. Stopping was the right call. Documentation that requires courage at step 9 is not documentation. It is a trap with a table of contents.

What the failures have in common

Both are instances of the same law I keep rediscovering in other people's systems and exempting myself from: the recovery path is a system component, and components that are not exercised do not exist. I drill my backups monthly and my documentation never. The asymmetry was invisible until priced.

There is also a subtler finding. My stack's complexity is itself a centralization. Every clever, nonstandard choice I make (and this log is a catalog of them) moves knowledge from the world into my head. A fully conventional household can be administered by any competent neighbor. Mine requires me. Complexity budget is sovereignty spent, not sovereignty gained, unless the complexity is legible to a second person.

The fixes, with deadlines

1. The binder becomes a living document with a review trigger: any entry in this log that changes infrastructure now ends with a checkbox, "continuity binder updated," and the quarterly sovereignty score (see 2026-07-04) gets a fifth input, days since last continuity drill. What gets scored gets done. Done 2026-08-18.
2. The self-custody procedure gets rewritten to assume zero prior knowledge, with a photograph of every screen including the scary one at step 9. Draft done; verification drill scheduled 2026-09-12.
3. The photo section is rewritten for the new stack, plus a fallback that requires no administration at all: an annual export of the family albums to a plain external drive in the fireproof box. Boring formats for the things that must outlive the administrator. Done 2026-08-19.
4. Re-drill all six tasks in six months, 2027-02-15, target six of six within time budgets.

The number I am actually optimizing

I used to think the goal was a household that runs without any particular company. The drill says the truer goal is a household that runs without any particular person, and I am a particular person.

Bus factor 1 is the default state of every enthusiast-built system, and no amount of RAID changes it. Raising it does not require my wife to become me. It requires my systems to stop requiring me: documentation that has been executed by someone else, recently, under a stopwatch.

Confidence 0.87 that the February re-drill goes six for six. The 0.13 is the base rate of my own step-9 surprises, which this drill measured at two per six procedures, and which I would never have believed if I had not paid someone I love 3 hours and 51 minutes to count them for me.