The critical never queues behind the bulk.

The surgeon who sorted

Before Dominique-Jean Larrey, the wounded waited where they fell until the battle ended — then were treated in order of rank: officers first, however lightly scratched. Larrey, Napoleon's chief surgeon, built fast horse-drawn ambulances — ambulances volantes — to reach the wounded during the fighting, and then did the more radical thing: he sorted them. By urgency alone. The dying colonel-of-nothing before the grazed general; the salvageable before the comfortable. The French verb trier, to sort, gave the practice its name: triage.

Underneath the battlefield drama is a cold scheduling insight that took medicine decades to articulate and computing decades more: when you cannot do everything, the decision of what never waits must be made in advance — because at the moment of overload, the queue itself is what kills.

How a node drowns in its own rescue

Here is the failure that motivated this whole layer — observed live during this system's development. A validator falls behind (a GC pause, a network blip, anything). It starts catching up: bulk-fetching the blocks it missed. The catch-up traffic floods its own connection — and starves the small, urgent consensus messages that represent now. Starved of now, it falls further behind, so it fetches harder, so it starves longer. The rescue is the drowning. No amount of bandwidth fixes this; the fix is Larrey's: the fast heartbeat must never wait behind the history download, and that ordering must be decided before the crisis, not during it.

Five colors of urgency

So every message in Hyperscale carries a class — a triage tag on a spectrum from "treat immediately" to "can wait indefinitely": live consensus at the top; then the traffic that completes blocks; then cross-shard progress; then recovery; and at the bottom, bulk catch-up. The tail of the spectrum is sheddable by design: bounded queues, capped shares of the connection, drop-on-overflow. Under stress, catch-up degrades gracefully and retries later; consensus does not degrade at all.

Notice what this does to the death spiral: the lagging node's own bulk fetching can no longer starve its own consensus intake. It keeps hearing now while it back-fills then — at whatever rate the priority spectrum leaves for it — and the loop that fed on itself simply has nothing to eat. (The urgent classes are also precisely what the archive's fetch obligations and the provisions ride on when gossip fails them.)

Malice is just another load pattern

Everything above assumes traffic that is merely heavy. But some of the crowd at the door is hostile — and the same triage discipline handles it, because the safety rules already make Byzantine content harmless (the overlap), leaving only Byzantine volume to bound:

Two quieter rules complete the intake. Bounded speculation: a flood of far-future garbage can't drag a replica's attention beyond a capped distance from its last certified block, so hostile peers can't inflate its view or burn its CPU verifying fantasy. Reputation with receipts: every gossiped message gets an explicit accept/reject verdict that feeds peer scoring — a peer that keeps sending junk loses standing deterministically, on every honest node that hears it.

Overload tells the truth

A system under overload reveals its actual priorities — the ones enforced by its queues, not the ones written in its mission statement. Priority isolation here is a standing invariant — exercised, not assumed: the fault suite floods, partitions, and drops traffic class by class and asserts the consensus heartbeat never misses (the crash lab).