i
FLR·B·003

The Hawaii Alert, 2018

broke: constraint & confirmation-of-consequence documented

On the morning of 13 January 2018, an operator at Hawaii's Emergency Management Agency intended to run the routine internal test of the ballistic-missile alert system and instead sent the live warning — BALLISTIC MISSILE THREAT INBOUND TO HAWAII. SEEK IMMEDIATE SHELTER. THIS IS NOT A DRILL — to every phone in the state. Thirty-eight minutes passed before the official correction.

The official post-mortems (FCC; state) describe the interface: the live alert and its test sat as near-identical items in the same menu, the confirmation step was the same reflexive are you sure? that guarded both, and — the detail this building exists for — there was no way to un-send. Every floor of the Institute is present in the failure: a menu without separation of consequence (Floor 3), a confirm where the stakes demanded ceremony (the Undo vs Confirm entry's limit case), no recovery flow (Floor 4), and a whole system (Floor 5) where one dropdown was load-bearing for a state's peace of mind.

STATE EMA — ALERT MENU Amber Alert (CAE) – Kauai Tsunami Warning (CEM) – State PACOM (CDW) – State Only DRILL – PACOM (CDW) – State Only the live one the drill, one row down
FIG B·003 — reconstruction after the official reports: consequence without geometry.
The lessonConsequence must be legible in the interface's very geometry: the catastrophic action cannot live one row away from the routine one, dressed identically. Confirmation is not ceremony-proportional by default — the designer must make it so. And for the truly irreversible, the absence of undo is itself a design decision, made by whoever didn't make it.
The recordFCC Public Safety & Homeland Security Bureau report (2018); Hawaii EMA internal investigation; both public.
StairwellConstraint · mapping · error tolerance — three principles, one morning.
Upstairs kinThe menu is a Floor 3 pattern; the missing un-send is Floor 4's recovery flow, absent where it mattered most.

Why documented: The FCC’s own public report on the 13 January 2018 false alert.