The Sorting Machine
The same machine an earlier essay watched sort children, now sorting homes, operating with constitutional force under existential stress, with a language model bolted on top.
The village
In a de-occupied village in Kharkiv oblast, a woman in her seventies stands in front of what used to be her house. She has owned it since 1986. The deed is a paper booklet in a drawer that no longer has a wall behind it. To be compensated, she will need a property record that the state's digital registry does not hold, because her ownership was never digitized.
She is a composite, but every part of her is documented.4 The pre-2013 paper deed that the registry cannot match, the age that correlates with being offline, the village that sat under occupation: these are the recorded seams of Ukraine's recovery system, not invented hardship. I have assembled one person from them because the argument is about a pattern, and a pattern is easier to see in a face.
An earlier essay in this series described this machine in American special-education offices, where a classification system decided which children received support and which received labels, and where the label, once assigned, became the thing the institution then confirmed. Move the machine to a country under invasion and the category it assigns is no longer a school placement. It is a home. The stakes change completely. The machinery does not change at all.
The frame
Geoffrey Bowker and Susan Leigh Star gave us the load-bearing idea.1 The most powerful classification systems are the ones nobody experiences as classification at all. They sink into the background, become infrastructure, and from there they sort the world while remaining invisible to the people being sorted. James Scott gave us the other half.3 Before a state can act on a population, it has to make that population legible: render it into records, categories, and standard forms it can read at a glance. What cannot be made legible cannot be served, and often cannot be seen.
A wartime state has to do this at speed and at scale. Which damage, whose property, which category, how much, paid to whom, and quickly, because people are living through winters without roofs. So the classification gets built fast, under fire, and then it acquires the force of law: it decides who is restored and who is not. That is the same place the companion piece in this series, Unratified, located the identity layer of digital public infrastructure. A system that carries constitutional force without ever having had a constitutional moment. eRecovery is that argument pointed at property instead of identity.
“Classification systems provide both a warrant and a tool for forgetting… the moral questions are buried in technical decisions.”
Bowker & Star, Sorting Things Out (1999)
The machine
Here is the machinery, concretely, and at the scale it actually runs. Ukraine launched eRecovery, branded eVidnovlennia, through Diia in 2023: you apply for compensation for damaged or destroyed property in the app, with repairs to a damaged home funded up to 500,000 hryvnia.11 By 22 September 2025 the program had compensated 134,771 families, a total of UAH 45.3 billion: 110,909 payments for damaged homes and 23,862 housing certificates for destroyed ones.13 This is not a demo. It is one of the largest live compensation systems on earth, and it works.
Alongside it, the Council of Europe established the Register of Damage for Ukraine, which sorts claims into a coded scheme: group A for individuals, B for the state, C for legal entities, more than forty categories opened in stages.10 The codes are worth seeing, because the category scheme is not a metaphor for Bowker and Star's argument. It is a literal instance of it.18
The Register of Damage sorts every loss into a coded category. This is not a metaphor for Bowker and Star. It is the scheme. Tap a group.
A3.1 is the woman in the village. Her loss has a code. Whether she can be paid against it is a separate question, decided one layer down.
To pay you, the machine first has to confirm you own what you say you owned, against the State Register of Property Rights. And it is the front door of the state, not a side channel: more than 14 million people use the Diia ecosystem, by the ministry's count roughly every fourth citizen,12 with around 59 percent of Ukrainians using government e-services.6 The builders are also not naive about who lacks a smartphone. Ukraine runs mobile administrative service centres and a free “digital suitcase” service: an administrator travels to a person's home with the equipment to deliver services on the spot, aimed at the elderly, people with disabilities, and residents of damaged communities.7 Hold onto that, because it is the strongest objection to everything that follows.
Run a claim
Before the argument, the machine. Configure a claimant and watch where the claim stops. The second toggle is the one to play with: assisted filing, the mobile centre that comes to the door. Watch which gates it opens and which it does not.
Configure a claimant. Watch where the claim stops, and notice that assisted filing opens the first gate but not the others.
The claimant opens Diia, signs in, and starts an eRecovery application.
Ownership is verified against the registry and the property is found.
The damage maps onto an open compensation category and proceeds to adjudication.
Every gate passed. This is the claim the machine was built to process, and it processes it fast.
The removable gate and the load-bearing one
That funnel hides the whole argument in plain sight, so let me say it directly. There are two very different kinds of gate in this machine, and they are constantly confused for each other.
The first is an access gate: do you have the phone, the connection, the account, the literacy to operate the app. This gate is real, and it is the one everyone talks about, and Ukraine is genuinely working to remove it. The mobile centre and the digital suitcase exist precisely so an administrator can file on behalf of the woman in the village. Toggle assisted filing in the funnel and the identity gate opens. That is a being-solved problem.
The second is a classification gate: is your house in the registry, does your loss fit a category. This gate does not care how the claim was filed. An administrator with a laptop in your kitchen still queries the same State Register of Property Rights, and if your 1986 deed was never digitized, the query still comes back empty. The home visit got the claim to the wall faster. It did not move the wall. Assisted filing is an answer to the access critique. It is not an answer to the classification critique, because the barrier was never the phone.
Pull the levers
One claimant shows you the gates. A whole village, with the levers in your hands, shows you which gate is load-bearing. There are three things a government could change: bring people online (assisted filing), accept proof outside the registry, or complete the registry itself. Only one of them collapses the red.
100 households, an illustrative model with the gate rates set to the documented figures. Three levers. Watch which one actually moves the green.
At 40% completeness, 48 households stop at the registry and 21 never file at all. Drag the slider to 100% and watch the registry column collapse. That is the lever, and it is the one nobody can toggle in an afternoon.
A model, not a measurement. Completeness starts at the documented ~40%; offline and pre-2013 status are weighted onto the older and rural share.
The lesson is in your hands now. Assisted filing clears the grey, the device-excluded, and that matters. But the ember column, the people stopped at the registry, barely moves until you either complete the base or cut a path around it. Solving access makes the classification gate more visible, not less, because the only people left outside are the ones the categories cannot hold.
Three predictions the theory already made
None of this is a surprise to anyone who has read the source material. The failure modes are the infrastructure properties, showing up on schedule, with names and numbers attached.
Star's rule: infrastructure inherits the limits of the base it was built on. The State Register of Property Rights is about 40 percent complete, and mostly holds property registered after 2013.4 Bowker and Star have a word for what then happens to a person: torque, the twisting of a life to fit a record built for a different shape of life. The pre-2013 owner must retroactively manufacture a digital trace of a thing everyone in the village already knows she owns. The machine inherited a pre-war gap and turned it into a wartime test of paperwork.
Every classification makes an “other” box, and the other box has a population. The self-built home with no formal title. The house inherited and never re-registered. Damage in a category not yet opened. These claimants are not so much rejected as unrepresentable: there is no field for them. Bowker and Star called this the residual category, and warned it is where a classification quietly stores the people it was not designed to hold. Mark Schuller documented the same mechanism in the humanitarian response after Haiti's earthquake: the very metric of counting, the number of people still classified as displaced, pushed toward excluding those who did not fit the countable categories.17 Here it holds people whose houses are gone.
Infrastructure is transparent to those it fits and a wall to those it does not. The obvious wall is the device: 38 percent of Ukrainians over 70 do not use the internet.5 But that wall has a door now, the assisted channel.20 The wall without a door is legibility, in Scott's sense: the person whose ownership the state cannot read. You can carry a laptop to her kitchen, and the registry will still not know her house exists. The device gate is a queue. The legibility gate is a category of person.
The same machine, four states
Ukraine is not alone in this, and it is not the worst case, and seeing the company it keeps is what turns the diagnosis into a prescription. Take the same three-axis test, completeness of the base, who lands in the residual category, and whether there is a path when the record is missing, and run it on four states at once.
Ukraine is not alone, and not the worst case. The variable that decides who falls out is not how digital the state is. It is whether there is a path when the record is missing. Tap a regime.
After Hurricane Maria, roughly 60% of applicants were denied, largely over title and heirs'-property documentation. Then in 2021 FEMA began accepting self-certification of ownership, and re-extended assistance to about 42,000 previously-denied households. The same wall, then a deliberate door cut into it.
Estonia finished the base. FEMA cut a door. Aadhaar refused one and still excludes the poorest. Ukraine is choosing now.
The pattern is sharp once you line them up. The decisive variable is not how digital the state is; Aadhaar is more comprehensive than eRecovery and excludes more people, while Estonia is the most digital of all and excludes almost no one. The variable is the escape hatch. And the United States, of all systems, built the one Ukraine still needs: after years of denying disaster aid over title documentation, FEMA simply began accepting a sworn self-certification of ownership, and tens of thousands of previously-denied households were paid.14 The fix is not theoretical. Someone has already run it.
The agent on top
In September 2025 Ukraine added the part that makes this the wartime edition and not just a wartime example. It launched Diia.AI, billed as the world's first national AI assistant that delivers government services rather than merely advising on them. By the Kyiv Independent's account it was tested by 100,000 users in its first 24 hours and passed a million within a week.8 A citizen can now ask, in plain language, how to get compensation for a destroyed home, and an LLM agent will try to do it for them.
The architecture is the interesting part, and it is genuinely well built. According to Kitsoft's chief executive Oleksandr Iefremov, the agent never touches the registries directly.9 A Model Context Protocol “defines the interface through which the AI agent can initiate a limited set of pre-approved actions.” A controlled service layer “prevents the AI agent direct access to state registries or service business logic.” Registry data reaches it through Trembita, Ukraine's data-exchange bus. This is exactly the safety design you would want from a state agent. It is also where the two halves of this research program meet: an agent architecture sitting on top of, and mediated through, a state classification system.
Diia.AI, top to bottom. Tap a layer. Read what it does, then read what it forecloses.
Defines the interface through which the agent can initiate a limited set of pre-approved actions.
“Find the house the registry does not contain” is not a pre-approved action. The protocol is the leash, and the leash is the point.
For the claimant you configured upstream, the agent runs clean: every registry read it needs is there, and it completes the claim. This is the case it shines on.
A language model that politely cannot find your house is, underneath the conversation, the same machine that could not find it before.
The agent can only take pre-approved actions, and “find the house the registry does not contain” is not one of them. It reads through a bus that can only pass what the registries hold. The controlled service layer that makes the agent safe to deploy is the same layer that guarantees it inherits, and cannot override, the legibility gate below it. A new interface does not relitigate who counts as legible.19 The agent is the most fluent thing in the stack and the least able to change the one fact that decides the woman's claim.
What this is not
The honest concession, because the argument is worse without it. This is not a claim that Ukraine's digital state is bad, and it is not “AI is bad.” The opposite, on both counts. eRecovery has moved 45 billion hryvnia to more than 134,000 families in the middle of an invasion, which is a staggering achievement. The mobile centres are a real answer to the access problem.7 Diia.AI is the most ambitious public-sector agent deployment anywhere. If your objection to this essay is “but they built the assisted channel,” you are right, and that channel is exactly why the remaining problem is the interesting one.
The point is not that the builders were careless. It is the reverse. Classification infrastructure, when it works this well and this fast, is precisely when its exclusions stop looking like accidents and start looking like fate. A clumsy system fails visibly and gets fixed. A good one draws its line so cleanly that the line reads as the natural shape of the world. The better the machine, the more its residual category disappears from view, and the more it needs someone standing outside it to point and say: there are people on the far side of that, and their houses are also gone.
What it would take
The prescription is narrow, and the comparative shadow already named the load-bearing piece. The access work is underway. The classification work has a worked precedent.
The load-bearing barrier is the missing record, so the answer is a way to establish ownership that does not depend on the 2013 cutoff: testimony, older paper deeds, neighbour attestation, archival and satellite evidence, adjudicated by a human with authority to enter a finding. This is exactly what FEMA did when it accepted self-certification, and tens of thousands of denied households were paid as a result. It is the single highest-leverage change, and it does not require digitizing one new deed first.
The explorable shows the registry lever moves the most green of all. Digitizing the missing records is not back-office hygiene; for the people it covers it is the difference between being legible and being unrepresentable. Estonia's lesson is that the cleanest fix is a complete base. It should be resourced and timed as a recovery program, not deferred as IT.
134,771 families paid is the number the machine can serve, and it is rightly celebrated. The number that matters for legitimacy is the one nobody publishes: how many claimants reach the registry gate and stop, and who they are. A residual-category dashboard would make the legibility wall visible to the people who built it.
The return
Back to the village. The good news is real: an administrator can now drive out to her, sit at her table, and file the claim. The machine has come to her door. And then it will query the registry, and the registry will not know her house, and the most advanced wartime digital state on earth will tell her, politely, in fluent Ukrainian, through the world's first national AI assistant, that it has no record of the place she has lived for forty years.
134,771 families have been restored by this machine, and that number is not a rounding error to wave away; it is the achievement. But the woman in the village is not in it, and she is not a rounding error either. That is what classification infrastructure does at its best. It does not slam a door. It opens every door but the one that matters, and makes the line it draws feel like the natural order of things, right up until you are the one standing on the far side of it, in front of the place your house used to be. The earlier essay watched the machine sort children. This one watched it sort homes, under fire, with an agent on top and a helper at the door. It is the same machine. It always was.
The same essay, two countries and two stakes. The Sorting Machine watches special-education placement sort children for compliance; the Wartime Edition watches Ukraine's eRecovery sort homes under fire. Same residual category, same inherited installed base, far higher stakes.
Classification as Infrastructure names the pattern in the abstract and inside AI systems. The Wartime Edition shows it converging in one live system: an LLM agent sitting on top of a state classification machine, mediated through MCP and the Trembita bus, inheriting every category the registry already enforces.
Two readings of digital public infrastructure that carries constitutional force without a ratifying moment. Unratified builds the identity layer in the reader's hands; the Wartime Edition points the same argument at property, where the category assigned is a home and the adjudicator is a wartime state.
Seeing Like an AI Company runs Scott's legibility on a corporate proposal; the Wartime Edition runs it on a wartime compensation registry. A state can only restore what it can read, and the household whose 1986 deed was never digitized is the one it cannot read.
Both apply Bowker and Star to a system that became constitutional without meaning to. The Invisible Architecture traces it in psychiatric diagnosis; the Wartime Edition traces it in Ukraine's damaged-property registry, where the residual category holds people whose houses are gone.
What the State Keeps reads the state as a classified inventory evaluated from above. The Wartime Edition reads one wartime state's compensation machine from below, from inside the residual category it cannot represent.
References
Every figure in this essay is drawn from public reporting and is cited here. Tap a superscript in the text to read the note inline, or expand a card below for the full source and a link.