the exhaustion clause - no continuous attention, sanity as security property

docs/architecture/GOVERNMENT.md

@@ -474,3 +474,59 @@ for bribery to hide.
 
 The people were never supposed to be the watchdogs.
 They were always supposed to be the sky.
+
+---
+
+# THE EXHAUSTION CLAUSE
+
+Will:
+
+"Here's the thing — in that world, the watcher gets too much power,
+even if they're good. Insanity is a real risk. No one can keep
+their eyes on that many people. It's exhausting."
+
+The missing failure mode, now named: THE WATCHER'S MIND ITSELF.
+Eternal vigilance was always a bad requirement — not because
+watchers turn evil, but because unbroken attention breaks PEOPLE.
+Surveillance load produces exactly what it fears: exhausted minds
+taking shortcuts, then paranoid minds inventing threats to justify
+the exhaustion, then mad minds with authority. Rorschach was not
+a recruiting poster.
+
+## BINDING RULES
+
+1. NO ROLE MAY REQUIRE CONTINUOUS ATTENTION.
+   Any design needing 24/7 human watching is defective BY
+   CONSTRUCTION, regardless of intent. Vigilance-in-bulk is
+   the raw material tyranny is made from.
+
+2. OVERSIGHT IS THREE-SPEED ONLY:
+      SCHEDULED — sunrise proofs at fixed intervals (rare)
+      TRIGGERED — alarms wake the checking only when math says so
+      PASSIVE   — schema, ledger, reality hold the line while
+                  nobody looks, because they cannot do otherwise
+   Everything else is nobody's job. Deliberately.
+
+3. ROTATION AND REST ARE STRUCTURAL, NOT WELLNESS PERKS.
+   Oversight offices (Arbiter included) carry term limits written
+   into the office, because the alternative is a burnout holding
+   a gavel. Rested judgment is a security property.
+
+4. ATTENTION IS BUDGETED LIKE MONEY.
+   Mind your pennies: each party spends finite glances where
+   recognition actually matters — their own life, their own
+   receipts. The pennies of many rested watchers outperform the
+   dollars of one obsessed one, every time.
+
+5. SANITY IS A SECURITY PROPERTY.
+   A compromised-by-exhaustion watcher is a breached one. Systems
+   that grind through people have no right to call themselves
+   trustworthy, however clean their cryptography.
+
+## Why this system can afford it
+
+Trust-by-impossibility (§30) means the bulk of protection is
+PASSIVE — the schema does not sleep, but it also does not tire.
+Humans enter only at scheduled sunrises and triggered alarms.
+The watch is short because the walls are real. That was the point
+of building walls instead of hiring more eyes.