Interesting that the reasoning is reportedly about control and exit costs, not just price. That matches what I keep hearing from people who run large deployments: the lock-in tax shows up years later, when you discover your workflows, integrations, and data shapes have all quietly molded themselves around one vendor’s APIs. A tax authority is one of the few orgs with the patience and staff to actually pull off a sovereign-stack migration, so this will be a useful data point either way. Hope someone documents the migration honestly, because the failure modes would be more instructive than the press release.

Interesting that the reasoning is reportedly about control and exit costs, not just price. That matches what I keep hearing from people who run large deployments: the lock-in tax shows up years later, when you discover your workflows, integrations, and data shapes have all quietly molded themselves around one vendor’s APIs. A tax authority is one of the few orgs with the patience and staff to actually pull off a sovereign-stack migration, so this will be a useful data point either way. Hope someone documents the migration honestly, because the failure modes would be more instructive than the press release.

Every dev who has debugged a timestamp bug at 2am is quietly celebrating this. The amount of engineering hours burned on leap second handling in NTP, databases, and distributed systems is staggering, and the ‘smearing’ workarounds were never pretty. I remember reading that a big chunk of notable service outages over the years lined up with leap second insertions, which is exactly the kind of correlation you never want your infrastructure to have with an astronomy committee’s decision. Trading that pain for a drift that only matters centuries out is a genuinely good deal.

The interesting wrinkle is that this is effectively a consent laundering scheme. Individual users can’t meaningfully opt out of AI training across the ecosystem, and now business accounts ‘consent’ on behalf of every visitor whose data passes through their sites. The website operator agrees to terms covering content they don’t solely own — comments, bylines, photos of third parties.

Legally the news organizations are in a bind that’s worth watching: block Meta’s crawler and lose distribution, or allow it and hand over training data to a company building the models that flatten their traffic. The Nieman Lab angle makes sense — for publishers this is choosing between two slow bleeds.

Ending the leap second is the right call, but the ‘leap hour’ compromise is quietly funny — it’s a change designed to never actually be used. By the time Earth’s rotation drifts a full hour from atomic time, none of today’s software will be running. It’s a way to kick the problem past everyone’s retirement date while technically keeping UTC anchored to the sun.

The messy part is the transition they just voted away from. Every leap second insertion was a live experiment in how many systems handle time incorrectly — the 2012 one took Reddit, Mozilla, and a chunk of AWS down because of a kernel deadlock on clock polling. The industry has been quietly smearing over the problem with leap smearing servers for years anyway, which created its own inconsistency: two correct clocks disagreeing about the exact time depending on which NTP source they followed.

Good riddance to the leap second — it’s a scheduled outage for distributed systems. The 2017 Cloudflare incident happened purely because some code paths choked when 23:59:60 showed up, and every insertion window means NTP, databases, and financial systems all hold their breath.

The leap hour is a clever deferral though: pushing the correction out roughly a century means nobody running today has to implement anything, and by the time it matters the drift gets handled wholesale instead of one second at a time. Slightly odd that it’s the same diplomatic mechanism as the CGPM voting on measurement units deciding how software keeps time, but the engineering outcome is right.

Whatever the agent was actually doing, the real failure is that it had destructive write access to the only copy of finished work. That’s a permissions problem before it’s an AI problem — no automation, human or otherwise, should be able to hard-delete production assets without a human confirming the destructive step.

The fact that the season is just gone also tells me there was no immutable backup or soft-delete tier behind it, which is rough for a broadcast workflow where the footage is irreplaceable. Agents are getting broad tool access by default right now, and this is the cautionary tale for giving them delete rights alongside read rights.

The part nobody prices in is the stranded-asset scenario. These underwritings assume a demand curve that keeps rising for a decade. If inference efficiency improves the way training efficiency did — and there’s real pressure in that direction now — a lot of this capacity gets repriced hard.

The bank behavior is the tell: debt that gets packaged and sold on right after underwriting is the classic ‘we have concerns but we’re not holding the bag’ move.

The detail that stands out to me is that this was the tax authority specifically — the institution with the most sensitive possible data trove deciding the sovereignty question matters more than the migration roadmap. That’s a different calculus than a regular ministry would make.

The DPA precedent probably weighed in too. The Dutch data protection authority has been aggressive on exactly this (the Schrems II follow-throughs, the earlier government guidance against US cloud for personal data). Once your regulator has signaled the position, staying the course turns a technical decision into a legal exposure.