Derek · part 7 of 8
The Spinner That Belongs to Nobody
On the eternal loading icon, the ten lines of code that would kill it, and the billion-dollar organisations that cannot find a single person to write them
Readers of this series will recall Derek who paid too much four times already and still thinks he got a very good deal. Today, nobody is trying to take money from Derek, they simply can not work out how to accept it.
I. Derek and the Doorkeeper
Let us begin, as one must when confronting a truly spectacular piece of collective incompetence, with the case of the man who typed his password correctly.
Derek wishes to log in to the website of IHG, a hotel conglomerate of nineteen brands and several thousand properties, for the suspicious purpose of giving it money. If Derek mistypes his password, the site informs him at once: a tidy red message, the work of a system functioning exactly as designed. If Derek types his password correctly, he is shown a spinning wheel. Indefinitely. This is not just my own experience or satire of my own manufacture; it is the complaint, in nearly these words, of users on the Head for Points forum in April 2025. Failure produces an answer. Success produces eternity.
Remember that, because it is the clue Poirot would circle twice. The error path exists. Somebody built it, tested it, shipped it. What is missing is the success path, or at any rate a success path that recognises the shape of the answer the server actually sends. The machine knows whether Derek may come in. It has, somewhere in its bowels, resolved the question. It lacks only the one conditional branch required to tell him, and so the wheel turns, a little prayer flag of the digital age, signifying nothing. The site punishes honesty and rewards error, and one could not design a neater emblem of the enterprise if one tried; nobody tried, which is precisely the point of this essay.
Kafka wrote a parable about this. A man comes before the Law and finds a doorkeeper, who tells him he cannot enter just now. The man waits. He waits years. Dying, he asks why no one else ever sought admittance, and the doorkeeper replies that the door was made for him alone, and will now be shut. The parable is generally read as theology. I read it as a bug report.
Derek’s wheel has cousins everywhere. Lufthansa’s multi-city booking tool, by the testimony of its own most loyal customers on FlyerTalk, crashes with grim consistency at the payment step. The same airline group’s booking portal collapsed outright in April 2024 and again that October, events sufficiently total that Tag24, Handelsblatt and AeroTelegraph all covered them as news. IHG customers attempting to redeem free-night certificates have watched bookings march confidently to the final “book reservation” step and then expire without a syllable of explanation. The IHG payment form rejected valid postcodes for months, per user reports collected on JustUseApp. A sign-in button that does nothing under Firefox’s strict tracking protection sat in a public bug tracker (webcompat issue #133178) from February 2024, where anyone at IHG might have read it.
The travel industry will tell you, with a sigh of practised weariness, that this is what complexity looks like. I intend to show you, using the industry’s own architecture and a control case from a harder trade, that complexity is the alibi and not the culprit. The wheel spins forever for one reason only: it belongs to nobody.
II. The Courtesy of the Strongest Case, or The Iron Beneath
Let us first do the incumbents the courtesy of stating their case at its strongest, because it is genuinely strong, and the demolition of a defended position is worth ten demolitions of an undefended one.
A single economy booking on Lufthansa touches, at minimum, fifteen distinct systems from eight or more vendors spanning six decades of technology: the Amadeus global distribution system (1987 vintage, since modernised), the Altéa reservation, inventory and ticketing stack, NDC distribution through what was Farelogix, external payment processors, the card schemes’ 3-D Secure apparatus, fraud screening, the Miles & More loyalty estate dating to the 1990s, a marketing tag layer, a third-party CDN, departure control, and the government APIS pipework through which your passport details flow to the Home Office. The Amadeus ticketing backend alone runs to half a million lines of C++ across ninety subsystems. The elderly cores beneath all this process tens of thousands of transactions per second at roughly hundred-millisecond latencies, and they speak EDIFACT and Type B messaging to a presentation layer that speaks REST and GraphQL. Lufthansa knows this is hard; it engaged Capgemini to build a reference architecture for the whole industry precisely because a passenger flying from A to B via C passes through a thicket of IT-supported processes spread across subsidiaries and partners.
So let no one say the problem is trivial. The iron core is one of the engineering marvels of the twentieth century, and it still works.
Grant the loyalty gate its honest purpose too. Requiring identity before showing a price is not, in itself, necessarily a swindle: a known customer is a fraud-screened customer, a priceable customer, a customer whose preferences reduce search costs on both sides of the counter. Cory Doctorow, no friend of these firms, concedes the underlying economics even as he condemns the use to which they are put: any source of lock-in becomes an invitation to shift value from customers to the house, and the airline, as he put it in April 2026, knows you cannot miss a funeral and knows how much headroom remains on your credit card. The gate has a raison d’être. The question is what happens when the gate jams.
And here the strong case collapses, because of where the bodies are actually found.
III. The Ledger, or Where the Bodies Are Found
Here is the finding that should end careers, and will end none.
The research behind this essay assembled every documentable case of the indefinite pending state (the spinner that never resolves) across these incumbents: twelve cases in all, drawn from forums, trade blogs, bug trackers and the German trade press. Twelve is a small number and the sourcing is public complaint rather than laboratory capture; the pattern is establishable from it, the precise percentages are not, and the honest reader should hold both halves of that sentence at once. Read the pattern, then, and not the decimal places.
Of the twelve, ten fall into the cheapest-to-prevent failure classes known to the trade. Four are missing state transitions: the request succeeds or fails, but the interface has no branch for the answer it received. Two are swallowed rejections: an error comes back and no handler ever moves the screen off “loading.” Two are third-party scripts blocking the critical path, of which more shortly. The remainder are an unsurfaced gateway failure, a double-submit lock that never releases, and a callback that never fires.
Now the other column of the ledger, and attend closely, because this is the decisive finding. The number of these failures attributable to fare calculation is zero. The number attributable to inventory management is zero. Loyalty-point reconciliation: zero. Fraud screening, regulated payment rails, the strong-customer-authentication labyrinth: zero, zero, zero. Not one documented spinner was caused by anything in the fifty-year-old iron. The ancient cores work with the dour competence of a Soviet tractor; nobody on FlyerTalk has ever complained that Amadeus mispriced a fare into eternity. Every single failure lived in the presentation layer, the youngest code in the estate, the thin film of JavaScript wrapping API calls in a browser tab.
Lay the booking funnel end to end and the inversion becomes almost comic. Search and availability, a genuinely intricate problem of distributed inventory: low failure rate. Fare calculation, the black art on which the whole revenue model depends, performed against rule sets of Byzantyne complexity: no observed spinner failures at all. Then the funnel reaches its shallow end, the parts a competent graduate could build in a fortnight, and the drownings begin. Login: chronic. The payment form’s mere rendering: chronic. The booking confirmation, which consists in its entirety of telling a customer whether the thing he just paid for happened: chronic. The industry has constructed a machine that performs differential pricing across a continent in a tenth of a second and cannot reliably display a sentence. It is as if a cathedral’s flying buttresses stood for six centuries while the front door jammed weekly, and the diocese, asked about the door, gestured solemnly at the difficulty of buttresses.
What would prevention cost? The engineering estimate behind these twelve cases, and I present it as an estimate, runs as follows. A missing state transition wants perhaps ten lines of code. A swallowed rejection wants a five-line catch handler. A blocking script wants one HTML attribute, the word defer, typed once. The whole documented dozen, by this reckoning, represents one to two engineering days. Against this stands a single instructive horror from outside the airline world: a WooCommerce booking site whose two optimisation plugins each deferred the other’s scripts, so that the payment iframe missed its loading window, producing 87 per cent checkout abandonment. One case study only, but it shows the going rate of one wrong attribute: nearly nine customers in ten, wallets open, turned away at the till by a setting.
Is this too much to ask of firms spending billions on information technology? Apparently so.
IV. The Control, or A Harder Problem, Solved by Fewer People
The incumbents’ last redoubt is the claim that travel is uniquely hard, and it is here that the control case does its executioner’s work. Full disclosure, so the reader can weigh my testimony: the reference platform in question is the one in whose engine room I spend my working days.
UK motor insurance is, by any sober comparison, the harder problem. The airline answers to consumer law and GDPR; the insurer answers to those plus the FCA, the Insurance Distribution Directive, and Solvency II. The airline’s real-time computation is fare and inventory lookup; the insurer’s is rating, underwriting, fraud screening and know-your-customer checks against external databases (the Motor Insurers’ Bureau, the claims-and-underwriting exchange, the DVLA) in the seconds between quote and bind. The airline’s mid-transaction change is a rebooking; the insurer’s mid-term adjustment re-rates, re-underwrites, recalculates pro-rata and re-issues the legal documents. And the consequence of failure differs in kind: a failed booking strands a holiday, a failed policy puts a driver on the road uninsured, which in this country is a criminal offence.
This harder, more regulated, more consequential flow runs without indefinite pending states, and the mechanisms responsible are almost embarrassing to list. Every asynchronous call carries a timeout: if the enrichment service does not answer in n seconds, the screen moves to an error state with a retry button. Every response shape has a handler: loading resolves to success, error or timeout, and there is no fourth, unhandled fate. Marketing scripts are deferred off the critical path, and no analytics tag can stand between a customer and the payment form. One team owns the funnel from quote to policy, and that team watches the completion rate, so a spinner would be noticed in minutes and carry somebody’s name within the hour. None of this is sophisticated. It is the state-machine hygiene taught in the first month of a frontend education.
Nor is this one shop’s fluke. Socotra, a cloud-native insurance platform, reported 99.9978 per cent uptime for 2025, under twelve minutes of total downtime across forty-eight upgrades; the figure is the company’s own and should be read as such, but it is at least a published number with a name attached, which is more than any travel incumbent offers for its checkout.
The technologists will object that the comparison is unfair: the insurtech is a greenfield, while Lufthansa drags six decades of archaeology behind it. To which I say: look again at the ledger. The failures are not in the archaeology. The Amadeus core, the genuinely old and genuinely hard part, performed flawlessly in every documented case. What fails is the newest code in the building, the part with no excuse, the part the greenfield comparison fits exactly.
V. Conway’s Ghost, or The Seam Nobody Sews
If the fix is ten lines and the firms have billions, why does the wheel still spin? The answer was given in 1968 by Melvin Conway: organisations ship their org charts. Martin Fowler’s gloss is that interactions designed to be straightforward become complicated when the teams responsible for them do not work together, and a 2024 IEEE study (which I have at second hand, via Adam Analytics) put the figure at 72 per cent of architectural mismatches tracing to misalignment between team structure and system boundaries.
Watch the principle operate on our twelve cases. The Lufthansa multi-city tool dies at payment: precisely the seam where the frontend team’s state machine meets the Amadeus API team’s contract meets the payment provider’s iframe, three organisations, one intersection, no owner. IHG’s website declares the system temporarily unavailable while the IHG app books rooms happily: two teams, two codebases, two edges of one backend, and the defect lives in the boundary rather than the domain. The April and October 2024 Lufthansa outages propagated from an external IT provider straight to the customer’s screen because no team owns the transition between “the edge is down” and “the customer sees an informative sentence.” The Firefox sign-in bug sat at the intersection of IHG’s identity system and the browser’s privacy features, a corner of the map assigned to no one at all. Each team’s error handling ends at its own boundary, like a feudal lord’s writ ending at his river. Errors that cross boundaries are dropped, and the spinner is the sound they make on landing.
To Conway add the absence of any error budget. Google’s site-reliability discipline halts feature work when a service exhausts its reliability budget; the policy is written down and enforced. No incumbent documented in this research publishes any equivalent for the metric that should matter most, the percentage of initiated bookings that complete. Without a service-level objective there is no budget; without a budget, reliability competes against features every sprint and loses, because a new feature appears on an executive dashboard and a spinner appears only in Derek’s browser.
VI. The Extraction Engine, or Friction with a P&L
I can hear a second objection forming, this one from the cynics, and the cynics deserve their hearing too: surely some of this friction is on purpose?
Some of it certainly is, and we should be specific, because vagueness is a convenient hiding place. Doctorow has called the airlines “patient zero in the junk-fee plague”, the pioneers of unbundling the seat from the bag from the right to change one’s mind, each fee carrying margins a narcotics cartel would blush at. The loyalty wall that IHG erects before showing prices, and the programme gate Lufthansa interposes before seat selection, are lock-in machinery, and they capture data whether or not they capture affection. The Elliott Report found 82 per cent of hotel loyalty-programme members frustrated with the programmes ostensibly designed to delight them. In 2025 a former MakeMyTrip engineer admitted on the record to coding the dark patterns his erstwhile employer was assuring regulators did not exist. Whether the gates measurably lift enrolment is unquantified, since the A/B tests are not published; the gates themselves are not in dispute. Call all of this Bucket A: deliberate friction, designed, owned and monetised.
Doctorow has given the age its word for all of this: enshittification, the staged degradation of a platform as it claws back the value it once dangled. The word is doing heroic work this decade, and within Bucket A it earns every syllable. But the spinner is not in Bucket A, and enshittification cannot carry all of the blame, because enshittification is a theory of intent: it requires a strategist, a lever, a beneficiary. Nobody designs an infinite spinner. A hung page converts no one, upsells no one, extracts nothing; it is pure deadweight loss, hated equally by the customer and the chief revenue officer. The wheel is the product of something cheaper than malice and harder to prosecute. So why does it persist alongside the deliberate friction? Because of an asymmetry of parentage. Extraction has a named owner with a profit-and-loss line: the loyalty programme, the ancillary-revenue unit, organs that at many airlines now out-earn the actual flying of aeroplanes. Completion has no owner at all; it is diffused across “digital” teams like fog. Every sprint, the orphan competes against children with parents, and every sprint the orphan loses. The engineers who could kill the spinner in an afternoon are spending the quarter building the next gate. Doctorow’s chief executive, yanking his lever, does not order the wheel. He merely ensures that everyone who might stop it is otherwise engaged.
The tag manager makes the point in miniature. Marketing owns it; engineering has no veto over it; and so checkout pages accumulate fifteen to thirty third-party scripts contributing two to five seconds of main-thread blocking, the documented leading cause of interaction failures across the web: scripts that track, scripts that test, and scripts measuring the abandonment they themselves cause. How much of Lufthansa’s and IHG’s hanging is script-blocking versus missing transitions cannot be apportioned without instrumented testing; the mechanism, however, is documented to the point of tedium. Mencken said nobody ever went broke underestimating public taste. It turns out you can come quite close by overestimating your own JavaScript.
The customer, note, is the only party who cannot see any of this machinery. Derek sees one spinning glyph’s worth of nothing; the other side of the counter sees the database, the logs, the unread bug tracker. Whatever follows, none of it is his fault.
VII. The Timeout as a Moral Test
Strip the analysis to its load-bearing beam. An indefinite pending state requires, to abolish it, a timeout and a transition. A timeout is a single integer, denominated in milliseconds. A transition is a single conditional branch. Together they are perhaps ten lines of code and zero architectural novelty. When a firm spending billions on technology cannot deploy ten lines, the finding is organisational rather than technical: no individual human being, anywhere in the org chart, is accountable for the state machine executing in the customer’s browser. The last yard of a fifty-year supply chain, the only yard the customer ever sees, is terra nullius. The wheel is a confession rendered in CSS, and it confesses neglect rather than malice, which is the precise and defensible charge: not fraud, not conspiracy, but an architecture of unaccountability in which the cheapest defect in software engineering survives inside the most expensive systems on earth.
The insurance control settles the question of possibility. A smaller team, a harder problem, a stricter regulator, a criminal consequence for failure, and no eternal wheel, because one team owns the whole flow and every asynchronous question is guaranteed an answer on screen. The travel incumbents’ problem is hard, and that is the cruellest part of the joke: they solved the hard part decades ago. The iron core hums. What they cannot manage is the last inch, the sentence to the customer, the branch that says what the machine already knows.
Kafka’s doorkeeper was, by these standards, a model of customer service. He acknowledged the man. He answered questions across the years. At the end he explained that the door had been made for him alone, and shut it, which is to say he implemented the error path and the timeout. The spinner does less. The spinner is the doorkeeper who has wandered off, leaving the lamp burning.
For Derek, three lines for the beer mat: A spinner past half a minute will not resolve; the answer exists and the page lacks the sentence to deliver it, so stop waiting. Before paying a second time, check your email and your bookings page, because flows that die at the final step have sometimes booked you anyway, and the double charge is yours to dispute. And when the website fails, try the app, or when the app fails, the website: they are different teams knocking on different doors, and usually only one door is jammed.
Derek will try again tomorrow, because the certificate expires and the points were earned and hope, in a loyalty member, springs institutional. The fare engine will price his room flawlessly across ninety subsystems built before he was born. And then the page will show him the small rotating glyph, which is the truest thing these companies publish, for it discloses in one image what the annual report conceals in two hundred: the hard parts work, the cheap parts fail, and the wheel spins because it belongs to nobody. Derek, regrettably, belongs to it.