Evidence Classes: Unknown Is Not Zero

"Some numbers are the meter. Some are a guess wearing the meter's clothes. A missing number is neither — it's unknown."

Not all numbers are equal

Say you want to know where your internet went this month. The gateway that meters your connection reports one authoritative total — that's the meter, and it's true. Each machine's own network counters suggest who spent it — but those candidate numbers can double-count local traffic, overlay traffic, or the same bytes seen from both ends. Same units, wildly different trust. Mixing them is how a dashboard lies with a straight face.

Missing is unknown, never zero

A machine that's asleep reports nothing. The tempting move is to write 0 in its cell and move on. But nothing reported and zero used are different facts, and a sum that treats them as equal invents data. The honest value for a gap is unknown — and unknown must never be silently added as if it were a measured zero.

Correlation is a clue, not a control signal

Suppose one machine's usage looks like it lines up with a spike on the meter. That is a hint worth investigating — and nothing more. You do not automatically pause, throttle, or block a machine because its candidate number correlated with an authoritative one. A guess rendered in a confident UI is still a guess; acting on it as if it were proof is how you punish the wrong host.

Label every number's class

The fix is small and total: every value the system shows should declare whether it's authoritative, a candidate, or unknown. Once the class travels with the number, a reader can never mistake a clue for a measurement — and the engine can refuse to do arithmetic that pretends they're the same.

Absence of evidence is not evidence of zero. A gap is a question mark, and a question mark summed as a number is the first lie a monitoring system tells.

Code

Three classes, never averaged together·python

# Same units (GB), three different classes of trust.
evidence = {
    "gateway_wan":   Authoritative(438.0),  # the meter. this is the total.
    "office_iface":  Candidate(120.0),       # includes LAN + overlay. a clue.
    "laptop_iface":  Unknown(),              # asleep. NOT 0.0.
}

# WRONG -- a gap becomes a fact:
#     total = 120.0 + 0.0            # invented the laptop's 'zero'

# RIGHT -- classes stay separate:
authoritative_total = evidence["gateway_wan"].value      # 438.0, trusted
attribution = { "office": "~120 (candidate)",
                "laptop": "unknown" }                    # honest gap

# The engine refuses to add an Unknown() into a sum. The gap is
# reported as a gap, not smoothed into a confident wrong number.

Exercise

Pick a number your own tools show you that is actually a candidate, not a meter (an app's self-reported memory, a per-tab bandwidth estimate, a 'time spent' counter). Write down what authoritative source could confirm it, and what a truly missing reading should display instead of 0.

Hint

If the honest display for 'we didn't measure' is a dash or the literal word 'unknown' rather than 0, you've understood it. The moment a gap renders as 0, it starts getting summed.

Evidence Classes: Unknown Is Not Zero

Not all numbers are equal

Missing is unknown, never zero

Correlation is a clue, not a control signal

Label every number's class

Code

External links

Exercise

Progress

Comments 0