Honest Unknowns

"'I don't know' is a real answer. A system that can't say it will lie to you instead."

Three Facts, Not One Boolean

The easiest way to model 'is it up?' is a boolean: true or false. It's also a trap, because it silently merges three genuinely different facts. running means it's up and proven. stopped means it's really down. missing means it isn't installed at all. And there's a fourth that the boolean has no room for: unknown — the probe couldn't determine the answer. A boolean forces you to pick a lie: an unknown becomes a false 'down' or a false 'up,' and either one will eventually mislead someone at exactly the wrong moment.

Firelink keeps all four distinct. 'I couldn't reach the host' is not 'the service is down.' 'The health path timed out' is not 'the app is missing.' Each carries different next steps, so collapsing them destroys information the operator needs.

Every Observation Is Timestamped and Sourced

An observation without a timestamp is a rumor. Every fact the census records carries a measured_at and a probe source, so a reader always knows not just what was observed but when and by which probe. Stale data isn't wrong, but it must announce its age — 'running, as of eight minutes ago' is a very different claim from 'running, just now,' and hiding the difference is how a dashboard quietly ages into fiction.

Never Wear Someone Else's Observation as Your Own

This honesty extends across ownership boundaries. Firelink may show Watchfire's per-host reachability as a read-only overlay — but it carries Watchfire's own observed_at, and is never dressed up as a fresh Firelink probe. Borrowing another owner's observation and presenting it as your own live measurement is a subtle lie about how fresh and how yours the data is. Firelink shows Watchfire's data as Watchfire's, timestamped by Watchfire — one owner per fact, applied to observations, not just declarations.

Give 'unknown' a first-class seat, and stamp every observation with when and by whom it was made. A model that can only say up or down will convert every ambiguity into a confident falsehood; a model that can say 'unknown, measured two minutes ago, by this probe' lets a human weigh the fact honestly.

Code

Four states, timestamped, and a borrowed overlay that admits it·typescript

type ServiceState = "running" | "stopped" | "missing" | "unknown";
// unknown != stopped != missing. Each implies a different next step.

type Observation = {
  state: ServiceState;
  measuredAt: string;   // WHEN — an observation with no timestamp is a rumor
  source: string;       // WHICH probe produced it
  why?: string;         // for 'unknown', the specific reason
};

// A borrowed observation from another owner keeps ITS timestamp and name:
type WatchfireOverlay = {
  reachable: boolean;
  observedAt: string;   // Watchfire's own time, NOT a fresh Firelink probe
  owner: "watchfire";   // shown as theirs, never as ours
};
// Presenting borrowed data as your own live measurement is a lie about freshness.

Exercise

Find a status indicator in your world that only has two states (up/down, ok/error, online/offline). Identify a real situation where the truth is actually 'unknown' — the check couldn't run, timed out, or lost the connection. Which of the two states does it currently lie as? Then redesign it to carry a distinct unknown plus a measured_at, and describe how that changes what an operator does when they see it.

Hint

The lie is usually 'it shows down when it just couldn't check.' That trains operators to ignore 'down' (crying wolf) — until a real outage looks identical to a probe hiccup and gets ignored too. A distinct 'unknown' preserves the meaning of 'down.'

Three Facts, Not One Boolean

Every Observation Is Timestamped and Sourced

Never Wear Someone Else's Observation as Your Own

Code

External links

Exercise

Progress

Comments 0