The second law of thermodynamics in cloud infrastructure

The alert that didn't fire

At 03:14 the checkout service degraded across a payment provider's dependency, and no page went out for eleven minutes. The routing logic had marked that dependency as low-priority, non-paging, because six months earlier it had been a rarely-called fallback path with a 99.99% success rate and no downstream criticality. In the interim, three services had been rearchitected to route primary traffic through it during a partial migration. The dependency graph that encoded "low-priority, non-paging" was never updated to reflect that. It was correct when written. It was wrong for the five months it silently governed alerting policy.

The on-call SRE who eventually got paged — by a customer complaint, not by the system — did not find a bug in the alerting rule. The rule executed exactly as specified. What had failed was the belief the rule encoded: that this dependency's reliability profile and blast radius were fixed facts rather than a snapshot. Nobody had lied to the system. Nobody had needed to. The world had simply kept moving after the description of it stopped.

What actually happened

Trace it further back and the pattern repeats at every layer. The dependency graph was built from a service-mesh scan run during onboarding. The deploy events that would have flagged the migration were logged but not wired to re-trigger the classification. The incident feed from the earlier fallback-path outage, eight months prior, had already shown degraded latency under load — evidence that the "rarely-called" assumption was softening — but that feed lived in a different dashboard from the alerting config, and nobody's job was to reconcile the two.

This is not a story about missing monitoring. Telemetry existed. Deploy events existed. Incident history existed. Every stream that would have told the truth was running. The failure was that the belief — this dependency is low-risk — had been detached from those streams and allowed to persist as though it were still attached to them. It had been observed once and then treated as known forever.

Naming the mechanism

The physics term for the general case is the second law of thermodynamics. In an isolated system, entropy does not decrease: gradients flatten, differences dissipate, structure drifts towards its most probable and least organised arrangement. Local order is not against the law, but it is never free. It exists only in open systems that import energy and export entropy — a flame, a cell, a refrigerator — and it persists only as long as that exchange continues. Cut the flow and the order relaxes. The law does not say order is impossible. It says order is a standing expense, never a completed purchase.

A dependency's risk classification is a piece of order: a compressed, useful claim about how a distributed system behaves. It was produced once, from real evidence, at real cost. But it was then sealed — written into a config file, no channel back to the deploy events and incident feed that had produced it — and the system it described kept moving. The classification did not "rot" in the way food rots, by some internal decomposition. It stayed bit-identical in the config from the day it was written to the day it caused a missed page. What changed was the world's correspondence to it. That gap is entropy in the operational sense: the growing distance between a held belief and the state of the thing it claims to describe, once the channel that produced the belief is closed.

Why this generalises, and where it stops

Carnot showed in 1824 that useful work requires a temperature difference to run down. Clausius, in 1865, generalised this into the law proper and named the quantity that increases as systems equilibrate. Prigogine, later, explained how living and engineered order survive this law at all: not by escaping it, but by becoming open systems that pay continuously — dissipative structures, sustained by throughput, never by inheritance. That is the honest description of a healthy dependency graph: not a document, but a process, kept current by a constant metabolism of telemetry ingestion and reclassification.

This maps cleanly onto the lineage of intake architectures. A Large Language Model is the sealed case: a corpus collected, a cutoff declared, weights frozen — the config file that never gets rewired to the deploy feed, on principle rather than by oversight. A Large World Model opens one channel, but only while a scene is present: the equivalent of a dashboard that shows current dependency health accurately while someone is staring at it, and tells you nothing about the five months nobody looked. A Large Universe Model is the fully open case on this axis: every stream — telemetry, dependency graph, deploy events, incident feed — kept running indefinitely, each belief about the system carrying a timestamp and a provenance so the classification "low-priority, non-paging" is never allowed to outlive the evidence for it.

On the intake axis specifically, there are exactly three positions, and this domain shows why the third is terminal rather than merely better. You cannot monitor more than every stream a system produces. You cannot monitor for longer than continuously. Past that point, improvement is quantitative: lower latency between a migration and a reclassification, better provenance on which incident triggered which belief update, longer retention of incident history for pattern-matching against new topology changes. None of that is a new kind of observation. It is more and faster of the same kind.

Objections worth taking seriously

This is physics vocabulary borrowed to dress up a config-management problem. Entropy is defined over microstates with a Hamiltonian. A dependency graph has neither.

Conceded, and precisely. No conservation law compels an alerting rule to go wrong. What transfers is not thermodynamic entropy but something narrower and better secured: mutual information between two systems cannot increase without a channel between them. Once the classification is written and disconnected from the deploy feed, the channel is closed, and the mutual information between "what the config believes" and "what the topology actually is" cannot grow, and will fall as the topology drifts. The second law is the illustration. The information-theoretic point is the argument, and it needs no microstates to hold.

Most of a dependency graph is stable. Core routing, primary databases, foundational auth services change rarely. Cutting a snapshot and refreshing it on a quarterly audit is a cheap, adequate policy for the bulk of the system.

Also correct, and it is exactly why frozen snapshots remain useful — nobody re-derives the whole topology from scratch every hour, nor should they. But operational cost is not distributed like stability. The catastrophic failures cluster in the volatile minority: fallback paths quietly promoted to primary, feature flags that change traffic shape, a vendor's incident that alters a dependency's reliability profile overnight. A quarterly audit misses precisely the changes that matter between audits. Bolting on a retrieval layer — "just query the live topology when it matters" — is not a refutation of the open-intake argument. It is a concession to it: an admission that a channel has to stay open somewhere, on some cadence, with some scope. The Large Universe Model position is just this concession taken to its structural end rather than applied piecemeal.

The remaining objection, and the sharpest one, is that continuous intake imports failure as readily as it imports truth. A flapping health check, a misconfigured probe, a cascading alert storm from one bad deploy — an SRE knows that "more signal, always on" is not automatically "more accurate." A frozen snapshot, whatever its staleness, is at least stable enough to audit and reproduce. This is the right worry, and it is not answered by ingesting more. It is answered by provenance: every belief about the graph tagged with where it came from, when, and how it was validated, so that a spike from a single flaky probe cannot silently overwrite a well-evidenced classification, and so any belief can be retracted when its source is discredited. That discipline is not a patch on open intake. It is what open intake requires to be worth doing. The frozen snapshot still earns its place — as an audit artefact pulled from the flow, not as a substitute for it.