The answer a check is not allowed to give

By ·

A traffic light has three colours and no ambiguity at all. Amber is not a hedge. The highway code says what it means and what you do about it, and it says so before you get to the junction.

A check — a test, a monitor — has a third answer too, and no code says what it means or what you do about it. Most questions worth asking about a running system have three: yes, no, and I looked, and I cannot tell you.

The third one is not a failure of the check. It is frequently the correct answer, and it is a harder thing to produce than either of the others, because a check that can say it has to know what it did not look at. Passing is easy — you ran, nothing objected. Knowing the shape of your own blind spot is a different object entirely — that is coverage, and a test cannot know what it never tested.

But it is worth being exact about what that answer is, because it is not a third state of the system. Is this service healthy is a yes-or-no question and it stays one. I cannot tell you is not an answer to it — it is a statement about the measurement. One output, two different objects, and only one of them is about your service.

Which is why it has no destination, and you can see that before building anything. The gate downstream was built to consume the verdict. Coverage is not a value of the verdict, so the gate has no slot for it. If unknown blocks the release, unknown is red, and you have built an expensive way to be pessimistic — expensive once the retry costs somebody an afternoon rather than a machine a millisecond. If unknown lets it through, unknown is green, and you have built nothing.

Monitoring has carried unknown for years: no data, insufficient samples. The interesting part is not that the value exists. It is what it is wired to do when a release is waiting on it. Almost always, one of the other two.

So the work is not the measuring, and it is not the engineering either. It is writing the highway code first: agreeing, in advance and with the people who will be waiting on the answer, what happens when the instrument declines. That took a parliament. Unknown, in the pipelines I have worked on, never got so much as a meeting.

And the agreement is expensive for a reason that has nothing to do with difficulty. A red has to be defended and a green never does. When a check blocks a release, somebody comes to ask you why. Nobody is ever asked to justify a green on the day they ship it. You get asked in the postmortem, months after the afternoon when the decision was actually made.

Under that asymmetry, the answer that gets given is the one nobody will make you defend. Every call leans the same way, and none of them had to be wrong for that to happen.

An instrument that can decline is not more advanced. It is the same instrument, wired to something that agreed beforehand to receive a question back.

Amber is easy to build. What makes it work is that everyone waiting at the junction had already been told what it meant.