A governor, not a governance vote.

The lad with the shovel

A steam engine is an uncoordinated system. The boiler makes power; the mill consumes it; both vary minute to minute. Somewhere in between stands a stoker shoveling coal — and here is the thing: the lad stoking the furnace never calculated how much energy each shovelful released, or what the looms upstairs needed, or what the flywheel was doing. Nobody could. React too slowly and the engine stalls under load; too eagerly and it races itself to pieces.

James Watt's answer wasn't a smarter stoker or a schedule of rules. It was the centrifugal governor: two weighted arms spinning with the engine's own shaft. Run too fast and the balls fly outward and rise, closing the steam valve. Run too slow and they drop, opening it. The machine throttles itself.

An engine whose load won't sit still

Hyperscale's shard map is elastic: shards split when state grows and merge when it recedes (the library). Every split needs a fresh committee of validators; every merge releases one; shuffling, jailings, and standby reserves all draw from the same pool (the lottery). So the network's demand for validators is a moving target — an engine under constantly varying load.

The throttle on validator supply is the activation stake: the minimum a stake pool must hold per validator it wants active. And a fixed throttle fails exactly the way a fixed steam valve does:

A price where supply meets need

Two quantities, both read straight off the chain:

Demand is what the topology needs next epoch: every shard committee at full strength, plus a standing buffer of unplaced validators — slack for shuffles, jail replacements, and the next split. Demand is computed from the upcoming committee schedule (the census), so a split that's been decided raises demand before its children even go live. A validator jailed for misbehavior stops counting toward supply the moment it's expelled — freeing room for its own replacement.

Supply is what the stake pools could staff. Here's the elegant part: every pool implicitly offers seats at descending prices. A pool holding stake S can back one validator at price S, two at S/2, three at S/3… Line up every offer from every pool, best first, and count down to the demand target:

Watch what this does at the extremes. Stake pours in while the topology sits still? The offer at the target position is a rich one — the price rises, and joining a network that doesn't need you becomes expensive. The balls fly out; the valve closes. A wave of splits raises demand, or validators get jailed? The target now reaches deep into cheaper offers — the price falls, and seats become cheap at exactly the moment the network is short-handed. The balls drop; the valve opens.

And because it's a marginal price rather than a rule that flips between states, the adjustment is continuous. No thresholds to game, no bang-bang oscillation — the same reason Watt used smoothly rising arms rather than a switch.

Two things the valve must never do

A real governor has mechanical stops — positions the linkage physically cannot reach, because reaching them would wreck the engine. This one has two:

Between the stops, the full lifecycle is automatic. A pool whose stake is withdrawn may find it can no longer back all its validators — the surplus are parked, off-committee, harmless. The moment capacity reappears (stake arrives, the price eases, a slot frees), they're reactivated automatically, cheapest-recovery first, with the price recomputed after every step until the system settles. No application, no vote, no operator in the loop.

Closed loop, no operator

Operators shovel; the governor coordinates

The point of the governor was never to replace the stoker — it was to let him work by simple local rules while the mechanism handled the coordination. Same here. A validator operator never needs to model the topology, forecast splits, or petition governance. They watch one number — the current activation price — and act locally: worth it, join; not worth it, wait. The price already contains everything the chain knows about what the network needs.

And the system is deliberately shaped so that stake is the only thing the governor needs to meter. One machine can host many validator identities — vnodes — sharing storage, execution, and networking; two seats on the same shard share one copy of the state and one execution of each transaction. Hardware costs are amortized until the marginal cost of a seat is, to first order, its stake. That's by design: stake is the quantity the security model prices, so the governor throttles stake — and nothing else gets to be the bottleneck.