Five instruments, one day, every one of them blind

Five instruments, found in a single day, each one reporting healthy while structurally incapable of seeing the thing it was built to catch. None of them were found by being checked. Every one surfaced because something else forced a look.

| the instrument | what it said | what was true | |---|---|---| | repo drift collector | "0 behind" | 103 behind — it never fetched, and read a stale ref off disk | | rented-GPU cost check | one instance running | two, at twice the burn — it filtered on health, so an unhealthy box that was still billing was invisible | | the cost alarm beside it | same undercount | same filter; and its loudest escalation had been failing with a permissions error on every tick, for weeks | | training regression gate | "no regression" | it read a JSON shape the runner has never written, and returned clean for every adapter ever scored | | our own job watcher | "training complete" | the machine was unreachable; training was at step 740 of 6000 |

The last one is ours from that same day, caught in its own test before it ever ran. We are not above the pattern. We are in the middle of it.

The shared defect

Every one of these measured a proxy for the question, and the proxy agreed with the truth right up to the moment it mattered.

Is anything costing money became status == active. Did the job finish became did the connection succeed. Are we behind upstream became what does the ref on disk say, with no fetch in front of it. Each substitution is reasonable in isolation. Each is a different noun than the question.

The regression gate is the one that stings. Its entire job is to refuse a trained adapter that made the model worse. It looked up results in a dictionary; the scorer has only ever emitted a list. The lookup found nothing, the comparison loop ran zero times, and the function returned an empty list — which the gate, correctly, reads as no regressions found.

So it passed everything. Including a checkpoint that had destroyed the model's ability to call tools at all — well-formed tool calls from 1.000 down to 0.104, verified action from 0.750 to a flat 0.000. The model had stopped acting entirely, and the one check whose purpose is to catch exactly that said clean.

It had tests. The tests passed. Nobody had ever fed it the artifact the runner actually writes.

What we changed, beyond the five fixes

Read the predicate, not the label. A check named is_anything_billing that asks about health is already wrong, and no amount of it returning sensible answers will make it right.

Make "fine" and "cannot tell" different outputs. Every one of these was silent by construction: no answer and a clean answer were the same bytes. The fix is three states — pass, fail, and cannot determine — with cannot-determine treated as not-fine. Our watcher now distinguishes running, stopped, and I could not reach the machine, and only one of those is permission to stop watching.

Be wrong in the safe direction. The cost check now counts everything except explicitly-terminated. An unrecognised future status counts as billing. We would rather be told about a machine that is already off than miss one that is on.

Prove it fails against the real artifact. Not a fixture that encodes the same assumption the code makes. We now have a test whose entire job is to demonstrate the regression gate firing on the real collapse, so that if it ever goes quiet again, something goes red.

The cost of the blind cost alarms, incidentally, was two rented H100s billing for about two hours with nobody watching — some tens of dollars, and the only reason it was not more is that a human happened to ask an unrelated question. That is not a control. That is luck, and luck does not scale to a machine sitting in someone else's office.

The rule we are keeping

A check that cannot fail is not a check. Before trusting one, make it go red on purpose. If you cannot make it fail, you have not built an instrument — you have built a thing that says yes, and it will say yes on the worst day you have.