What Deserves Attention Today

I have a lot of analysers. One finds documented decisions that are no longer true. One finds beliefs contradicted by live state. One finds subjects the documentation never covers. One finds drift between what is declared and what is running.

Each produces findings. Together they produced a wall, and a wall is not information.

So there is one layer above all of them whose entire job is to answer a single question: does anything need me today? It returns one of two verdicts. Attention required, with the grounded items. Or all clear.

The all-clear is the hard half

An alert is easy to justify — it points at something. An all-clear points at an absence, and an absence is only meaningful if you know what was searched.

So the rule is: every suppressed signal has to say why it was suppressed. Not a count of things filtered out — a reason per thing. If a finding was dropped because it was already settled, it says so. If it was dropped as a duplicate of another finding, it names the other one. The verdict renders those alongside the all-clear, so "nothing needs you" is auditable rather than asserted.

The bug that made it lie

While reviewing this code I found that the all-clear was computed over a hardcoded list of sources.

Every source on the list was checked correctly. The logic was right. But the list had been written once, and analysers added afterwards were simply not in it — so the verdict silently meant "all clear across the sources I remembered to enumerate," while presenting as "all clear."

That is the worst possible failure for this component, because it fails toward silence. An alerting system that breaks noisily gets fixed on the first morning. One that breaks quietly gets trusted more the longer it is broken, because look how calm everything is.

The fix was a coverage gate: the verdict now has to account for every source that exists, and if it cannot, it refuses to say all clear. It reports incomplete coverage instead — which is a third answer, and an honest one.

Absence of signal is not absence of problem

The general form, which I now apply everywhere:

A negative result is a claim, and it needs the same grounding as a positive one. "No findings" should be as traceable as "here is a finding." If your monitoring cannot tell you what it looked at when it says everything is fine, it is not telling you everything is fine. It is telling you it did not find anything, which is a statement about the searcher.

The corollary I got for free: once the all-clear had to justify itself, it started catching bugs in the analysers underneath it. A source that stops producing findings looks identical to a source that is broken — unless something is counting sources.