An evacuation order should not have to be a tweet

This summer has made the question hard to ignore. Heat settles over the continent and does not lift for days. Forests catch, and a town is told to leave within the hour. Elsewhere the taps are rationed, and everyone on the grid is asked to stop watering the garden before the supply runs short. Each of these is a warning that someone has to deliver fast — and deliver to the people who are actually in the affected streets, not to an audience scattered across the country.

Europe isn't short of official warning channels. Cell broadcast can light up every phone in a given area, and apps like NINA or KATWARN push alerts to anyone who installed them; those are the backbone, and nothing here replaces them. But authorities still fall back to a social-media timeline for the fast, granular detail — so the evacuation order also goes out as a post, on a platform like X, where it reaches whoever follows the account and happens to be looking that minute. Everyone else hears it from the person next to them, or not at all.

That is the wrong pipe for a warning, and the wrongness is structural: a bigger account doesn't fix it. We think Snakken's architecture happens to be the right pipe, and this post is us reasoning out loud about how it would work — and where it would have to stop.

Why a timeline can't do this

A social timeline is built to deliver content to followers, ordered by something that approximates interest. Geography is incidental to it: the platform mostly doesn't know, and isn't built to care, whether you are standing in the affected field or reading from another country. So an authority that needs to reach "everyone physically here, right now" has to approximate it with "everyone who follows us and is awake," and hope the overlap is good enough.

Snakken starts from the opposite end. The one thing our servers know about your position is the coarse H3 cell your phone resolved locally: a neighbourhood-sized hexagon, never your coordinates. For nearly everything we build, that constraint is a limitation we design around. For a warning it is the whole point: a cell is precisely the unit an authority wants to address. "Deliver this to the people in these cells" is a query our system can already answer, and it answers it without anyone — us included — needing to know who those people are.

We'd be reusing more than we'd be building

Most of the pieces a warning needs already exist for other reasons:

• Cell-targeted delivery. The feed is already assembled per cell. An alert is a payload addressed to a set of cells instead of individuals.
• A validated source. We already have a way to confirm that an account genuinely speaks for the place or organisation it claims to be — that the café really runs its own page. The same author-and-instance validation is what lets a fire service or a festival's safety office prove an alert came from them. A warning carries its validated source and a badge, every time.
• The feed itself. We already have a surface that decides what sits at the top of your neighbourhood. A warning is the one item we would let sit above everything else — placed there by severity, not by the ranking that orders normal posts.

The new work is mostly the part that has to feel different.

A register that breaks our own tone

Snakken is a warm place: rounded type, paper background, the occasional bit of wit. A warning has to walk into that room and change it. So the alert register deliberately drops everything friendly — no decoration, plain type, high contrast, a single severity colour carrying the weight. The visual break is part of the message: if a Snakken screen suddenly looks nothing like Snakken, that itself tells you to pay attention before you've read a word.

Severity runs on a fixed scale, so the colour and the language are never improvised:

• Info — context, no action needed.
• Warning — something is developing; prepare.
• Danger — act now.
• Extreme — immediate threat to life.
• All-clear — the situation is over.

The same scale drives how loudly the warning is delivered, which is the next question.

Three ways in, by severity

A warning shouldn't always shout, and it shouldn't always whisper. We'd let severity decide which of three surfaces it reaches:

1. The lock screen. For Danger and above, a push — at the top severities, the kind of critical alert that comes through even on silent. This is the only level that interrupts you.
2. The top of the feed. Every active warning sits above the rest of the neighbourhood, as a full banner for the serious ones or a collapsed pill for the milder ones. You can tap it away once you've seen it; it stays one tap from coming back.
3. A warnings section. A plain list of what's active and what's recent, each opening to a detail view with the full text, the source, and a map of the area concerned.

Lower-severity items live only in the feed and the list. The lock screen is reserved, because a channel that interrupts you for everything stops interrupting you for anything.

Only sources we can verify

The hardest line is the simplest to state: a warning may only come from a verified authority — a weather service, the fire brigade, the police, or a verified organiser for their own event. Never user-generated, no exceptions. The serious register only works if it is never wrong, and the fastest way to ruin it is to let one unverified "danger" through. That bar means our coverage starts narrow and grows only as real authorities and organisers verify themselves. We treat that narrow start as the right call.

And it comes with a line we'd repeat everywhere the feature appears: Snakken does not replace official channels. Emergency numbers, cell broadcast and national warning apps like NINA or KATWARN are the source of truth; we are an additional way for their message to reach the phone of someone standing in it. Saying so plainly is part of the feature, not fine print.

Two things a timeline can't do

Once a warning is location-aware, two ideas open up that a broadcast post can't reach:

• A shelter finder. Official advice is often physical — get indoors, reach a cool space out of the sun, move away from the smoke. On-site, with the same coarse position, the app can turn that instruction into a direction: here is the nearest covered space, this way. The advice stops being words and becomes an arrow.
• A safety status. A quiet, hyperlocal "are you safe?" (I'm safe / I need help), so the people around a corner from you know how you are, and you know how they are. It is the neighbourly version of an emergency check-in, scoped to the cell rather than your whole contact list.

Neither is a feature a national alert can carry, because neither makes sense without knowing roughly where you are standing — which is exactly the thing we do know, and only that.

One situation, one thread

A live emergency is not a stream of separate alerts; it is one situation that keeps changing. So an update is never a new warning — it's the same thread moving forward. Updates are marked as such, stacked under the original on the lock screen rather than buzzing again from scratch, and shown in the detail view as a running log, newest at the top, under a prominent as of timestamp so you always know how fresh the picture is. First the report, then the updates, then the all-clear — the same thread and source from start to finish.

What this would cost

Honesty requires the trade-off list, and this feature has a long one:

• We are a phone, not a siren. A device that is off, dead, or left at home gets nothing. We can sit alongside cell broadcast and apps like NINA or KATWARN; we cannot stand in for them, and we'd be wrong to imply otherwise.
• Cell granularity cuts both ways. Addressing by neighbourhood cell is what protects your location, and it also means a warning reaches a slightly wider area than the precise hazard. We'd rather wake a few extra streets than miss the edge of the danger zone — but it is a real imprecision, not a rounding error.
• We deliver to a cell, not to people. Because we don't know who is in a cell, we can't confirm a specific person received or read a warning. The privacy property and the delivery-receipt gap are two readings of one fact.
• The serious register's power is also its weak point. A channel that earns instant attention is exactly the channel worth attacking, and all of it rests on the validation holding: one spoofed Extreme alert would discredit the one channel that can never cry wolf. The feature raises the bar for confirming who is speaking.
• Coverage depends on others. No authority verifies, no warnings flow. The feature's value in any given neighbourhood is gated on real institutions choosing to show up — which we can invite but cannot manufacture.

None of this is built yet, and we're sharing the thinking before the code. The thesis underneath it is the part we're most sure of: a hyperlocal, location-bound network can do the one thing a crisis asks of a communication channel — reach the people who are actually there. The established platforms, built to reach followers, can't. If that's right, carrying official warnings isn't a feature bolted onto Snakken; it's the clearest thing the architecture is already good for.