The mathematics teacher teaches sine and cosine. Before drawing the curve on the board, they bring out a satellite dish and say: 'Look how a wave propagates in physical reality.' No ministerial budget required. A satellite dish, a €35 Raspberry Pi, and the awareness that physical substrate exists.

This is the school's Head of SRE — not because they manage infrastructure, but because they are first to show that mathematical abstraction has a physical body. Sine and cosine exist in a satellite antenna. A network exists in cables. A server is controlled electricity. This awareness at age 14 is the vaccine against Free Tier.

The physics teacher takes over — showing the electromagnetic laws driving the CNC motor. From Faraday's law to the rotor: G-code moves electrons, electrons move the magnetic field, the field moves the motor, the motor moves the tool, the tool machines matter. The complete causal chain from symbol to matter.

The technology teacher shows the CNC — how a text file becomes a metal part at 0.01mm precision. Same logic as the LLM: input → processing → output. The Mystical Machine is demystified before marketing sacralises it.

The art teacher shows the 3D printer — how an STL file becomes a tangible object layer by layer. Creativity has a physical substrate. The digital touches matter.

The scholastic amputation documented in The Maths Teacher's Bag (15p) does not come from a single course — it comes from the absence of coherence between disciplines. The mathematician teaches abstraction. The physicist teaches law. The technician teaches gesture. The art teacher teaches form. None shows the chain connecting them. This continuity rupture creates the cognitive void that Free Tier fills.

Concrete and immediately deployable proposal: an annual pedagogical project around a 3D printer.

Maths: geometric modelling → STL file. Physics: extrusion thermodynamics, motor electromagnetism. Technology: Marlin firmware, slicing parameters, G-code file. Visual arts: object design, formal constraints. IT: printer network connection, Octoprint server on Raspberry Pi.

In one project, the student understands the digital has a body, code has an energy cost, abstraction has a physical substrate. And that nobody needs AWS to print a plastic object.

A budget FDM 3D printer: €250. A Raspberry Pi 4: €55. An 8-port network switch: €25. Cables: €15. Total: €345 per school. A parent-teacher association can fund this. A local authority can fund this. A local company donation can fund this. This project requires no ministerial decision — a motivated teacher and €345. The cheapest bifurcation in the corpus.

56 training hours per year in certain conventional frameworks. Sufficient volume to acquire the fundamentals that break the cloud mastery illusion from IaC:

Week 1 (14h): Fundamental networking — OSI model · ARP table · VLAN · IP routing · TCP/IP. What Lambda never shows.
Week 2 (14h): Fundamental Linux — filesystem · inodes · processes · service management · systemd. What Kubernetes hides.
Week 3 (14h): Storage — RAID · LVM · snapshots · physical backup. What S3 replaces without anyone understanding what it replaces.
Week 4 (14h): Physical security — certificates · PKI · firewall · ACL. What 'managed IAM' abstracts.

In 56 hours, no senior is produced. Dunning-Kruger is broken. The developer who has seen an ARP table will never again confuse an HCL script with infrastructure mastery.

CPF massively funds hyperscaler certifications (documented in The CPF Misused, 6p). The answer is not elimination — it is balance. Massively reference neutral certifications in the CPF catalogue:

LFCS (Linux Foundation Certified System Administrator) · RHCSA (Red Hat Certified System Administrator) · CompTIA Network+ · CompTIA Security+ · LPIC-1/2 · Kubernetes CKA (neutral, not AWS proprietary)

These certifications exist. They are not visible enough in CPF catalogues. A France Compétences decision — not a technical one. RNCP registration timeline: 6 to 18 months. Main actors: France Compétences + Ministry of Labour.

A woman retraining in IT at 32 does not have the proprietary reflexes of a developer trained on AWS Educate at 20. Nobody offered her Free Tier at school. No AWS certification to defend. No ego invested in a 5-year cloud architecture.

She learns on fundamentals — because that is what retraining programmes teach when well designed. The documentable trajectory: technical support levels 1 and 2 → systems administrator → infrastructure engineer → senior SRE. This trajectory does not go through AWS Educate. It goes through Linux, networking, and systems physics.

Training cost: fundable on CPF + Pôle Emploi/France Travail retraining aids. Time to first position: 6 to 12 months for support. Time to full autonomy: 3 to 5 years. The same timeline as any technical track.

The HR lock documented in Anatomy of Digital Perdition S1B (−34% Linux positions in 4 years): ATS filters on proprietary cloud keywords. The answer has two levels:

Level 1 — RNCP: register LFCS, RHCSA, CompTIA Network+ in the RNCP (National Professional Certification Registry). An RNCP certification is legally enforceable against an ATS. France Compétences is the actor. Timeline: 6-18 months.

Level 2 — ROME job codes: modify Pôle Emploi's ROME (Operational Repository of Occupations and Jobs) to reintegrate 'Infrastructure Engineer', 'Systems Administrator' and 'Network Engineer' as distinct occupations from 'Cloud Engineer' or 'DevOps Engineer'. A ROME code is the reference HR uses to build job descriptions. Actors: DARES + Pôle Emploi.

The architectural question: 'Can this component run outside AWS without a rewrite?' asked before every infrastructure technical decision. Cost: zero. Timeline: immediate. It makes conscious the decision that was unconscious (Default Effect, Stratum 6 of The Architecture of Consent).

Title rehabilitation: 'Infrastructure Engineer', 'Systems Administrator' and 'Network Engineer' must reappear in org charts and budgets as distinct titles — not subsets of a generic DevOps role. What has no budget line does not exist in the boardroom. What has no title is not recruited. Actors: HR + CIO. Timeline: next budget cycle.

The Product Owner is evaluated on velocity. Architectural reversibility is perceived as a sprint brake. The answer is not to block the PO — it is to make portability debt as visible as code technical debt.

The Portability Score (0 to 3):
0 = Pure proprietary (native DynamoDB, Lambda with AWS LAYERS, Cognito) — no migration possible without total rewrite
1 = Migration possible with major effort (12-36 months)
2 = Migration possible with moderate effort (3-12 months)
3 = Agnostic — runs on any infrastructure without rewrite

This score is a JIRA ticket field. Visible in the Definition of Done. Does not block the sprint — makes debt visible to management, CFO, and infra engineer. Setup cost: JIRA configuration, 2 hours. Deployment: immediate.

The disappearance of Capacity Planning (documented in NoOps · Autopsy, 6p) produced uncontrolled cloud invoices. Restoring it does not immediately require hiring a dedicated expert — it requires a rule: no production deployment without a real-scale monthly cost estimate signed by an infrastructure engineer. Not bureaucracy — translating software architecture into real costs before invoicing. The formula is documented in The Mystical Machine S5 (TCO + PUE). Applicable within a week.

Ghost IaC debt (documented in NoOps S3): thousands of cloud resources instantiated by abandoned Terraform scripts, active and billing, with no owner. A quarterly IaC audit lists all cloud resources, associates them with an owner and active use, and deletes orphans. Tool: terraform state list + AWS Cost Explorer. First audit duration: one day. Typical savings: 15 to 30% of monthly cloud invoice in organisations without IaC discipline.

Every critical organisation must answer this question: 'What happens if AWS is unavailable for 24 hours?' If the answer is 'we don't know' — it is a security emergency, not a future project. The cloud-free Business Continuity Plan (BCP) defines critical workloads, data that must survive, and the failover path to backup infrastructure (bare-metal, sovereign colocation). Drafting a minimal BCP: one week with a competent infrastructure engineer. Cost: the engineer's cost, no additional infrastructure.

Grade A Refurbished (documented in The Strategic Refurbished, 4p): servers 3 to 5 years old, grade A (functional, cleaned, tested), with chips already fabricated by TSMC — independent of future production. Price: a Dell PowerEdge R630 (2 Xeon E5 CPUs, 128 GB RAM, 4 SSD drives): €800 to €1,500 refurbished. Same capacity on AWS EC2: €8,000 to €15,000/year. The financial break is documented.

TPM contracts (Third Party Maintenance): physical maintenance was the lock the corpus had not resolved. Specialised actors (Park Place Technologies, Curvature, sovereign regional actors) ensure hardware maintenance of out-of-warranty servers at documented costs 40 to 60% below manufacturer contracts (Dell ProSupport, HPE Care Pack). The Accompanied Exodus systematically integrates a TPM contract into the TCO calculation. A line in the synthesis table — not an option.

The Accompanied Exodus does not migrate everything overnight. It identifies portable workloads (Portability Score 2 or 3) and starts with them:

Phase 1 (0-6 months): Development and test environments → local bare-metal. No risk, immediate savings, team training without production pressure.
Phase 2 (6-18 months): Staging workloads and cold data → sovereign colocation. Reduced cloud surface without impacting production.
Phase 3 (18-48 months): Progressive production → sovereign bare-metal for workloads with Portability Score 2+. Proprietary workloads (Score 0-1) remain on cloud pending planned rewrite.

The Sovereign Interface: during transition, a hybrid network allows bare-metal and cloud workloads to coexist. The goal is not purity — it is progressive mastery.

These numbers are public, verifiable, and devastating to the 'cloud is always cheaper' narrative:

Dropbox (2017): infrastructure migration from AWS to own datacentres. Economy documented in the IPO prospectus (S-1, 2018): $74.6 million saved over 2 years. The repatriation required an infrastructure engineering team — exactly the profile NoOps had declared obsolete.

Basecamp (2023): David Heinemeier Hansson, co-founder, publicly documented the cloud exit. Economy: over $1.5 million per year. The calculation: $3.2 million annual cloud invoices → $500,000 amortisable hardware over 5 years + $200,000 operational costs. Bare-metal profitability achieved in under a year for their volume.

These two examples are not nostalgic exceptions — they are industrial margin optimisation decisions documented in legal filings and public publications.

The long-term hardware horizon is documented in The Taiwan Bottleneck (6p). TSMC fabricates ~90% of advanced chips in the Taiwan Strait. The long-term sovereign answer:

RISC-V: open instruction set architecture, royalty-free, already used by SiFive, Alibaba, Western Digital. RISC-V chips exist — not yet competitive with NVIDIA A100 for AI, but will be in 5 to 10 years for standard workloads.

European Chips Act (2023): €43 billion to double Europe's share of global semiconductor production by 2030. Sovereign fabs: TSMC Dresden (under construction), Intel Magdeburg (under construction), STMicroelectronics in France. The horizon is 10-15 years — but the work starts now.

The ultimatum of 8 September 2026 makes four demands of AWS, GCP and Azure. These demands are the immediate contractual lever for any organisation renegotiating a cloud contract:

1 · Cancellable commits — without major financial penalty within 24h. Digital equivalent of a strategic veto right.
2 · Elimination of egress fees — or their legal capping (EU mobile roaming model).
3 · Guaranteed data portability — not in general Terms, in the signed contract.
4 · CLOUD Act position clarification — contractual commitment on non-disclosure without prior notification.

Legal training CIO/CFO: a 2-hour training on the CLOUD Act, Schrems II, and reading Terms §14.12 is the cheapest legal bifurcation. Can be delivered by any data law specialist. Cost: €500 to €2,000. Should be mandatory before signing any cloud contract exceeding €50,000 annually.

The reversibility clause: any cloud contract exceeding 12 months must include a negotiated reversibility clause — exit plan, data export format, maximum timeline, capped cost. Not an extraordinary demand — it is what well-negotiated SaaS contracts already include for customer data.

Strict SecNumCloud: ANSSI's SecNumCloud qualification requires immunity from extraterritorial laws. In its strict version (without hyperscaler derogation), it is the only label guaranteeing CLOUD Act immunity for public administration data. Requiring it in sensitive data public tenders is not favouritism — it is a GDPR and sectoral regulatory compliance requirement.

The Public Procurement Code prohibits arbitrarily excluding actors under penalty of favouritism offence. Hyperscalers structured their offers to answer public tender requirements point by point — and the immediate face price criterion favours cloud (Free Tier, initial discounts) over Bare-Metal initial investment. Public buyers choose AWS not through favouritism — but through ease, cognitive availability (Kahneman's heuristic), and least-effort conformity (Default Effect).

These criteria do not target AWS by name — they define objective functional requirements. Any entity that meets them can bid. Any entity that does not cannot — including AWS, Google and Microsoft as long as their European subsidiaries cannot guarantee CLOUD Act immunity.

Criterion 1 — Documentable extraterritorial immunity: the contract award entity must demonstrate it is subject to no law allowing a third-party State to access data without diplomatic procedure (MLAT). Legal basis: GDPR article 48 · Schrems II ruling (CJEU C-311/18, 2020) · DINUM Cloud au Centre Circular (2021).

Criterion 2 — 10-year TCO egress included: total cost of ownership must include exit costs (egress fees, migration costs, application rewrite). A cloud with €0 entry and €90,000 exit per PB is not cheaper than bare-metal at €50,000 initial investment. This criterion makes the financial comparison honest.

Criterion 3 — Contractually guaranteed data portability: data export in an open, documented format, within a defined maximum timeline, at capped cost, is a mandatory contractual clause.

Balanced CPF: for every hyperscaler certification funded by the CPF, an equivalent neutral certification must be equally visible and fundable in the Mon Compte Formation catalogue. Not removing AWS Certified — restoring parity. Actor: France Compétences. Administrative, not legislative decision. Timeline: 3 to 6 months.

ESN as market vectors: ESNs (Capgemini, Sopra Steria, Atos, CGI) are cited in the corpus as hyperscaler partners in conflict of interest. But they also have another function: they train and employ tens of thousands of engineers in France. An ESN creating a 'Sovereign Bare-Metal Infrastructure' offer and training its teams accordingly is a massive market transformation lever. Not utopian — if public tenders require sovereignty (Stratum 5), ESNs will offer sovereign skills. ESNs follow markets. Stratum 5 creates the market. Stratum 6 trains the actors.

DINUM reorientation: the Cloud au Centre programme retained AWS, Azure and Google as public administration providers. Redirect part of the DINUM budget toward sovereign public infrastructures — OpenStack hosted on physical servers in France, operated by civil servants trained on neutral fundamentals.

The Public Sovereign Cloud: not a private company with a label (Bleu, S3NS) — a public infrastructure operated by the State, on the model of La Poste for mail or Caisse des Dépôts for public finance. Not statism — the answer to national critical infrastructure. Estimated budget: €500 million to €1 billion over 5 years. Savings on current administration cloud contracts: documentable from DINUM data.

Cyber insurance companies require hosting with certified third parties (often hyperscalers with their SOC 2 and ISO 27001) to cover operating loss risk. Uncertified bare-metal is perceived as higher risk — not because it objectively is, but because it lacks a standardised label recognised by insurers.

The answer: lobbying with the French Insurance Federation (FFA) and ANSSI for strict SecNumCloud to be recognised as equivalent to cloud ISO 27001 in cyber policies. Arguments:

1 · Cloud lock-in and Taiwan Bottleneck dependency constitute a systemic bankruptcy risk higher than locally mastered Bare-Metal infrastructure (documented in The Hand Over Nations, 8p).
2 · The Schrems II ruling creates documented legal risk for any organisation using American cloud services for GDPR data — this risk should increase non-compliant cloud premiums, not reduce them.

This lobbying is a medium-term lever (2-3 years). Actors: ANSSI + FFA + CNIL + DSI professional associations.

National training plan: the equivalent of the 1960s Plan Calcul — adapted to the digital sovereignty era. Integrate into major engineering schools (Polytechnique, Centrale, INSA, IUT) a mandatory 'digital physics' module: network low-level layers, operating systems, hardware and Capacity Planning. Not cloud training — training in fundamentals that make any choice possible.

European Chips Act: €43 billion for European semiconductor manufacturing. TSMC Dresden · Intel Magdeburg · STMicroelectronics. The horizon is 2030-2035. The corpus documented the dependency (The Taiwan Bottleneck, 6p) — the Chips Act is the ongoing political response. France must ensure these investments produce chips usable by its own sovereign infrastructures, not only exported.