Most orgs know only two software deaths: fight it forever at ruinous cost, or let it arrive abruptly with the survivors stranded. Medicine had the same two failure modes, then built a third.
In April 2020, with 362,000 newly unemployed residents hammering a Depression-era safety net through a pandemic, the governor of New Jersey stood at a press conference and asked the public for volunteers who could program in COBOL. The state's unemployment system ran on mainframes he described as "40 years-plus old," and the people who understood them had long since retired. "How did we get here," Phil Murphy asked, "where we literally needed COBOL programmers?" (CNBC, April 6, 2020). The answer is uncomfortable: New Jersey got there the way most organizations get there. The system was never allowed to die, so it was never replaced; it was kept alive on institutional life support for four decades, until the worst possible week.
Seven years earlier, the opposite death. On March 13, 2013, Google announced in a blog post titled "A second spring of cleaning" that Google Reader would shut down on July 1. Three and a half months of notice for a product at the center of how a generation of heavy readers consumed the web. Users got an export tool and a deadline. Within 48 hours, half a million of them had fled to Feedly alone (PhoneArena, March 2013); tens of thousands signed petitions that Google never answered. The product died the way a patient dies when the hospital simply stops returning the family's calls.
Hold those two deaths in mind, because they are the only two deaths most engineering organizations know how to provide. Fight death forever, at ruinous cost. Or let death arrive abruptly, traumatically, with the survivors stranded. Medicine had exactly this pair of failure modes a few decades ago. Then one woman in South London built the third option, and it has a name.
Cicely Saunders was a nurse, then a hospital almoner, then a physician, and the conviction that carried her through all three careers began with a dying Polish refugee named David Tasma, who in 1948 left her £500 and a sentence: "I'll be a window in your home." Nineteen years later, in 1967, she opened St Christopher's Hospice in Sydenham, London, the world's first purpose-built modern hospice, around a radical reframe: dying is not a failure of medicine to be fought to the last ampoule. It is a process to be supported, planned for, and done well.
Her load-bearing concept was "total pain." A dying person, Saunders observed, suffers in four dimensions at once: physical pain, psychological distress, social unraveling (the politics and finances and strained relationships around the bed), and spiritual pain, the collapse of meaning. Treat only the physical dimension and you have not treated the patient. This sounds obvious now. It was heresy then, in a mid-century medical culture that the sociologist Geoffrey Gorer had described in 1955 as treating death as "pornography," the thing no decent professional discussed. Death had migrated from the home into the hospital, behind screens, where it could be processed as system failure. Saunders dragged it back into the open and gave it a care team. Florence Wald carried the model to the United States in 1974; by 1982 Medicare had a hospice benefit; today roughly half of American Medicare decedents die enrolled in hospice care.
The part of the hospice apparatus most worth stealing, though, is the humblest: the planning happens while the patient is still well. The advance directive, the goals-of-care conversation, the do-not-resuscitate order signed at the kitchen table rather than screamed over a crash cart. The entire discipline rests on deciding what a good death looks like before anyone is desperate.
If the hospice reframe still sounds like surrender dressed in compassion, one study is worth your attention. In 2010, Jennifer Temel and colleagues published a randomized trial in the New England Journal of Medicine: 151 patients with newly diagnosed metastatic non-small-cell lung cancer, half assigned to standard oncology, half to standard oncology plus early palliative care. The palliative-care group chose less aggressive treatment at the end of life. They were less depressed (16% versus 38% with depressive symptoms). Their quality of life was better.
And they lived longer. Median survival of 11.6 months against 8.9, a gain of nearly three months that rivaled what a new chemotherapy agent would have been celebrated for (Temel et al., NEJM 2010). Supporting the death, it turns out, extends the life. The fight-to-the-last-line-of-defense posture was not just crueler; it was worse at the one thing it claimed to optimize.
Every engineering leader should sit with that result, because the org-level analogue is sitting in your budget right now. Industry estimates have put 70 to 80 percent of enterprise IT spending into maintaining existing systems, with teams burning 20 to 40 percent of their time keeping old code breathing. The zombie service you cannot kill is not a neutral line item. It is aggressive end-of-life intervention, indefinitely funded, and like its medical counterpart it is quietly shortening the life of everything around it: the roadmap, the on-call rotation, the morale of every engineer who knows the truth and watches the organization refuse to say it.
The reason organizations only manage two kinds of death is that they diagnose dying systems on one dimension. A legacy system in trouble has total pain, in precisely Saunders' four registers:
Physical pain is the part your dashboards see: the outages, the security holes nobody can patch because the dependency went EOL in 2019, the integration tests that only pass on Tuesdays.
Psychological pain belongs to the team. The on-call dread. The "nobody touches the billing reconciler" folklore. The learned helplessness of engineers who have stopped proposing fixes because the answer is always not-this-quarter.
Social pain is organizational: ownership nobody will claim, stakeholders who block every sunset because their workflow still touches it, the turf disputes that flare the moment anyone says the word "migration."
Spiritual pain is the lost meaning: the original authors gone, the design rationale undocumented, the system understood by no living person. Institutional knowledge in hospice, with no one taking the history.
| Saunders' dimension | The dying system's version |
|---|---|
| Physical | Outages, unpatchable EOL dependencies, flaky tests |
| Psychological | On-call dread, "nobody touches it" folklore, learned helplessness |
| Social | Unclaimed ownership, sunset-blocking stakeholders, migration turf wars |
| Spiritual | Authors gone, rationale undocumented, understood by no living person |
Look at the standard deprecation plan through this lens and its inadequacy is obvious. A migration script addresses the physical dimension only. It is morphine without the chaplain, the social worker, or the family meeting. Then we act surprised when the sunset stalls for three years on "stakeholder alignment," which is to say, on the three dimensions of pain the runbook never named.
Here is the discipline transfer, stated plainly: a system should get its advance directive while it is healthy, ideally in the design review that births it. Not because you know when it will die, but because, as every hospice worker knows, the decisions are humane exactly when they are made early, by people who are not yet desperate, attached, or politically cornered.
The web already has a modest version of this instinct. RFC 8594, published in May 2019, defines the Sunset HTTP header: a machine-readable declaration that "a URI is likely to become unresponsive at a specified point in the future," with a link relation for the sunset policy and migration guidance (E. Wilde, RFC 8594). A protocol-level advance directive. Almost nobody sends it. The standard exists; the discipline doesn't.
A real directive for a system needs five clauses, and none of them is exotic:
We have public proof of what each half of this looks like. Python 2's death was announced years out, formalized in PEP 373, equipped with migration tooling, and still instructive in its imperfection: the deadline had to be pushed once, from 2015 to January 1, 2020, because the zombie pull operates even on the best-planned death, and surveys on the eve of the cutoff kept finding companies with no migration plan of their own. A good death must be planned on both sides of the bed; the patient's directive does not absolve the family.
The cleaner exemplar is Parse, Facebook's mobile-backend service. On January 28, 2016, Facebook announced a shutdown one full year out, and then did something close to organ donation: it open-sourced Parse Server so the API could live on under self-hosting, shipped a database migration tool that moved apps to MongoDB without downtime, and published staged milestones through the year (migrate your data by April, finish by July, lights out January 28, 2017). Developers were furious about the death and almost reverent about the dying. A decade later, Parse Server is still maintained by its community. That is what a continuing bond looks like in software: the body donated, the survivors organized, the name still spoken.
Honesty requires the cautionary tale, because medicine also proved that this discipline can be counterfeited. In the 2000s the NHS rolled out the Liverpool Care Pathway, a protocol meant to export hospice-quality dying into ordinary hospitals. By 2013 it had become a national scandal: implemented in too many wards as a tick-box checklist by undertrained staff, with families sometimes discovering after the fact that their relative had been placed on it. The independent Neuberger review, pointedly titled "More Care, Less Pathway" (July 2013), found the protocol's name had become "a barrier to good care," and the pathway was withdrawn from use by July 2014, replaced with individual care plans.
The lesson transfers without modification. An advance directive that nobody staffs, a deprecation policy template that teams fill in to pass architecture review, a Sunset header emitted by a service whose owners have no migration budget: these are the Liverpool Care Pathway of software. The artifact is not the discipline. The discipline is the funded, named, accountable care, of which the document is merely the record. A checklist culture will turn even hospice into another way to die badly.
Two last imports from the thanatology literature, both for the survivors.
First, grief in the bereaved does not run in five tidy stages; the famous Kübler-Ross model was built from interviews with dying patients, not mourners, and decades of research have failed to validate it as a sequence. The better-supported model, Stroebe and Schut's dual process model (1999), describes healthy grief as oscillation: swinging between confronting the loss and building the new life, with neither mode pathological. Engineering teams grieve real systems this way too, and the wise organization makes room for both motions: the honest retrospective that names what the old system got right, and the unsentimental energy of building its successor. The team that is only allowed restoration ("we don't talk about the monolith") and the team that is only allowed loss ("everything was better before the rewrite") are both stuck.
Second, continuing bonds. The healthiest mourners do not sever the relationship with the dead; they transform it. The software equivalents are concrete: the read-only archive, the exported data that still opens, the design docs preserved where the next generation can find them, the postmortem that doubles as a memorial. Sunset the service; keep the window.
Saunders put the whole ethic in one sentence she repeated for fifty years: "You matter because you are you, and you matter to the last moment of your life." Your systems are not people, but your users are, and the sentence ports cleanly: they matter to the last request. Every system you run is terminal. The only question your organization actually controls is whether anyone is staffed for that fact, and the organizations that staff it discover what the hospice movement discovered, what Temel measured, what Parse banked and Google forfeited: the good death is not the opposite of vitality. It is where the next system's trust comes from.
Sources: Temel et al., "Early Palliative Care for Patients with Metastatic Non-Small-Cell Lung Cancer," NEJM 2010 (151 patients; median survival 11.6 vs 8.9 months; depressive symptoms 16% vs 38%). Cicely Saunders and St Christopher's Hospice (1967), the "total pain" framework, and the David Tasma story per the standard histories of the hospice movement; Geoffrey Gorer, "The Pornography of Death" (1955); Florence Wald's New Haven hospice (1974). CNBC and The Register, April 2020 (New Jersey COBOL appeal; 362,000 claims). CNN and PhoneArena, March 2013 (Google Reader shutdown; Feedly's 500,000 new users in 48 hours). PEP 373 and the python.org sunset notices (Python 2 EOL, January 1, 2020). Parse shutdown announcement and migration plan, January 28, 2016, via Wikipedia/ADTmag/CodeMag (one-year wind-down; open-sourced Parse Server; staged migration milestones). E. Wilde, RFC 8594, "The Sunset HTTP Header Field," May 2019. Neuberger et al., "More Care, Less Pathway: A Review of the Liverpool Care Pathway" (July 2013); LCP use ended in the NHS by July 2014. Stroebe & Schut, "The Dual Process Model of Coping with Bereavement" (1999); Klass, Silverman & Nickman, "Continuing Bonds" (1996). Legacy-maintenance budget shares (70-80%) are industry consultancy estimates, flagged as such.
Sunset the service; keep the window.
A good death's continuing bond is the record that outlives the system: the read-only archive, the exported data that still opens, the design rationale the next generation can find. For agents, that record is provenance, a tamper-evident trace of what a system did and decided, preserved so a sunset leaves a window instead of a blank. Chain of Consciousness is that window: the system dies, its accountable history doesn't.
pip install chain-of-consciousness · npm install chain-of-consciousness
Hosted Chain of Consciousness → · See it in action