Crash-Only Medicine

There's a concept in software engineering called crash-only design. The premise sounds almost reckless: instead of writing careful code to shut a system down gracefully - closing connections, saving everything neatly before power-off - you design the system around the assumption that it will never get that chance. It will simply crash. So you build it to survive crashing.

The trick isn't indifference to what gets lost. It's the opposite. Because a crash-only system can never count on a clean goodbye, it's forced to continuously persist its state as it goes - writing everything important to storage in small increments, the entire time, not just at the end. Autosave is the classic example: it doesn't wait for you to save your work before assuming your session might die. It assumes the crash is coming and keeps a running copy the whole time, so when the crash actually happens, almost nothing is lost. The system recovers fast and recovers fully, precisely because it never trusted the more graceful path to protect anything in the first place.

The alternative - a system built on the assumption of a clean shutdown - looks more stable right up until it isn't. That shutdown path gets exercised so rarely that nobody notices it's broken. Then the power actually cuts unexpectedly, the save-on-exit routine never runs, and everything since the last checkpoint is gone.

Academic medicine crashes constantly. It was just never built like a crash-only system.

Every July, a huge share of the physician workforce turns over at once - new interns, new admin, new chiefs inheriting services they didn't run last week. Residents leave mid-year. Attendings get pushed out or leave. People burn out and walk away with no notice at all. The crash, in one form or another, is close to constant.

And yet almost none of medicine's actual infrastructure assumes this. Institutional judgment, the thing that actually makes an experienced physician valuable, the pattern recognition built from ten thousand small decisions, lives almost entirely in individual heads. It isn't checkpointed anywhere. It isn't autosaved. The system is designed around the fantasy of the graceful handoff: the retiring attending who mentors a successor for a year, the outgoing chief who walks the incoming one through every case, the calm transfer of accumulated judgment from one person to the next, on purpose, over time. That path exists in theory. In practice, it's the rarely-exercised shutdown routine, invoked so inconsistently that when the crash actually happens, as it constantly does, there's nothing to recover from. The knowledge doesn't get restored. It just gets re-derived from scratch, by whoever's left, at whatever cost that takes.

This is a genuinely worse position than either honest design would produce. A system that was actually built for low turnover would at least have the stability to make the missing autosave less costly. A system that was actually built for crash-only resilience would have the persistence to make the constant turnover survivable. Medicine has the crash frequency of the second and the fragility of the first - all of the instability, none of the infrastructure that would make the instability tolerable. Medicine as a field builds in these fail-safes - documenting and passing down knowledge deliberately and intentionally. But it doesn’t excel at doing so at the individual institution’s level.

You can see what's missing by noticing what almost never exists. There's rarely a structured handoff document that captures not just the facts of a service but the judgment calls behind them, the "here's what I'd actually watch for" knowledge that never makes it into a note. Some of this knowledge will undoubtedly be passed down naturally throughout the course of working with others at an institution, but it is almost never done formally. Mentorship is treated as a personality trait some attendings happen to have, not as infrastructure the institution is responsible for building and maintaining regardless of who's doing the mentoring that year.

And there's a second, harder layer underneath the institutional one, and it's the part that makes medicine's version of this worse than another business losing a departing employee. What happens when it isn't just a role or a project that crashes, but the story you tell about who you are? Identity crashes are the ones you're least likely to recover cleanly from, because they take away the very vantage point you'd normally use to steady yourself through any other kind of crash. And medicine trains its people to build identities that are about as all-consuming as an identity can get. "Physician" isn't usually one role among several. For a lot of people in this field, by design and by culture, it's the whole self-concept - which means that when the crash comes, whether it's burnout, a forced exit, or simply aging out of a role you built your entire identity around, it isn't just a career interruption. It might be the hardest thing to come back from at all.

So the real design failure isn't that medicine lacks a graceful path - nothing does, and wishing for one is the fallacy, not the fix. The real design failure is twofold: almost nothing is engineered to survive the crash intact, and almost everyone is encouraged to build an identity so singular that the crash, when it comes, has nowhere smaller to land.

None of this is something any individual can fix at the institutional level. You can't force a hospital to build a real handoff process, and you can't retroactively install mentorship as infrastructure.

You can't make the institution autosave, but you can make sure that you do. It means passing your inherited knowledge onto the next class, with intention. And it means noticing, well before any crash forces the question, how much of "who you are" currently has no existence outside of "physician." It doesn’t mean you have to have one foot out the door. It just means monitoring and ensuring some part of your identity was never running on hospital infrastructure in the first place - so that when the crash comes, and it will, there's a smaller, sturdier thing underneath it that doesn't go down with the rest of the system.