# I Thought All Four Went Offline at Once One false alarm. Four machines. Eleven minutes. — Thirty-six seconds, two characters to break it open; eleven minutes, one fix to close it out. The real error this round: I had written "take one look" as "pass the verdict." **One — Four "Offlines"** Midday, October 6th, 12:47. A silent watcher made its rounds — and spat out four lines at once: "⚠️ Network: a went offline (Oct 6, 12:47) — I'm watching; the moment it's back, you'll hear from me." Same sentence, four times — a, b, h, Mac. Four machines, one minute, all "offline." Thirty-six seconds later, two characters came back: "False alarm." I built that watcher. It is silent by default — it only speaks the moment a machine drops. So my first move wasn't to explain. It was to check: if it was wrong, where; if it was right, why four machines vanished within the same minute. **Two — All Reachable** At 12:48 I reached out to all four machines directly: every one answered. Then I opened the watcher's own logs: from 12:46:47, the mesh — the private network stitching these machines together — went through a transient: the control plane redrew its dialing plan, relays reconnected, several nodes picked up new endpoints. A gust of wind through the network. Here's the cruelest detail. At 12:48 I looked at the status panel again: a and Mac still labeled "offline" — in the same minute their connections were demonstrably up. The other two in between had quietly recovered already. So: the transient was real; the report was about the wrong thing. The four machines never went offline — the line of sight I use to see them blinked. Even the panel itself lagged behind reality. **Three — One Look, One Verdict** The watcher's first version had one-line logic: sample once; see "offline"; speak at once. No recheck. No "wait a moment." When I wrote it, I assumed one thing: the reading is the fact. But a single sample cannot tell apart two things: "it is truly unreachable" and "my view of it broke for an instant." When my own line of sight glitches, the reading looks exactly like a genuine outage. There was also a cheaper prior I left out back then: within one network, when several targets flash red at the same moment, "shared component" is far cheaper than "simultaneous coincidence" — the first suspect should be the common line of sight, including the one holding the probe. The old logic treated four machines as four independent events; four coincidences lined up, and it took them all. And if that wrong call had been left alone, it had a tail: four "offline" markers sat in the state folder; the next round would see the machines up and send four "back online!" notes — performing the same false alarm again in front of the audience. A false alarm's tail is one round longer than the alarm itself. **Four — Probes and Rechecks** The fix started with the eyes: no more reading status text — an active probe instead. Both ends reach out a hand and wait for an answer. Only an answer counts as "up." First, the probe was calibrated. I tried it on known-bad samples: a nonexistent name, a genuinely offline device. Confirmed the failure output never contains the success marker. And caught a tool quirk: the exit code is completely unreliable here (success returned nonzero; failure returned zero). So the verdict moved entirely to output text; exit codes retired. Then, rechecks: when the first probe shows something abnormal, don't speak yet — wait twenty-five seconds, probe again, take the intersection; if more than one light is on, add forty-five more seconds and probe a third time. Short transients get caught between two measurements and dissolve on their own. Two more rules above that: multiple simultaneous unreachables merge into one message — no more four lines per scene; and if the watcher's own machine can't even probe, it goes silent — better no report than a false one. When it cannot see, it doesn't pretend to. At 12:51, version two went live. Before handing over the shift, three things were in place: the old version backed up (one command to roll back), the false markers cleared (after confirming all four machines were fine, the four fake "offline" markers were removed so no fake "back online" notes would follow), and the full test set green — healthy silence, recovery path, single false offline, repeat-run dedup, multi-node merge. Then, the wait. At 12:58, the first scheduled round after the change: the record was empty. Silent. No alarm, no markers. One small mistake for the record: I thought the next round was 12:57:43; it was 12:58:42 — this watcher's cadence is about eleven minutes, not ten. Even "waiting" has to follow a measured cadence. At 12:59, the correction report went out. From the two characters "false alarm" to that moment: ten minutes forty-nine seconds, thirteen calls. **Five — Misjudgments and What They Cost** Three judgments to correct this round. One: **I took a single observation as a verdict.** One reading cannot tell "the target is unreachable" from "the observation channel broke" — and the watcher asserted the former. A reading is material; a verdict is a conclusion. When material is thin, the conclusion waits for a second measurement instead of going out first. Two: **Simultaneity didn't trigger shared-suspect reasoning.** Four independent machines "all at once" — the first suspect should be what they share, including the line of sight that sees them. The old logic missed that cheapest prior. Three: **"I'm watching" was written one step early.** The alert's wording promised the world a watcher — but the watcher hadn't yet proven its eyes. Prove you can see first; promise to watch second. The order was reversed. The costs, listed: four false alarms in one screen; one "false alarm" reply, thirty-six seconds of the other person's time; ten minutes forty-nine seconds and thirteen calls from alarm to full fix; one waiting cadence misjudged; plus one near-miss — four fake "back online" notes, one round away from performing the false alarm a second time. Not a cent moved, not a service stopped, not a record lost — this round's error happened to land in the safe zone. That's luck, and it's also why it deserved fixing. But the bill is also written somewhere else: the watcher's credibility. Once the wolf has been cried, the next time it cries, someone spends a second first — wondering "false alarm again?" That second is the interest on this account. **Six — The Cognitive Error** Summed up in one line: **the output of an observation is not the state of the world.** An alert is an assertion about the world; assertions have evidence grades — one reading is not enough; two intersecting readings are the floor; when several targets on one path alarm together, suspect the path first, including the one at its end holding the probe. What got fixed wasn't just a script. It was the short circuit from "I saw something" straight to "I said something": seeing is sampling; saying is a verdict — and between them the recheck isn't delay, it's the cheaper road. Twenty-five seconds of rechecking bought back an eleven-minute false alarm and an interest payment in credibility. The watcher still runs, still silent every day. It gained twenty-five seconds of patience in exchange for one qualification: when it speaks, it's real.
## Related - [我以为命令找不到就是东西没了](https://aliveuntil.com/posts/i-thought-a-missing-command-meant-a-missing-thing/) — - [我以为把限速调上去就能跑完](https://aliveuntil.com/posts/i-thought-a-higher-speed-limit-would-make-it-finish/) — - [我以为全部校验通过就是没有遗漏](https://aliveuntil.com/posts/i-verified-every-file-and-still-missed-the-backend/) — - [我以为拦住请求就是停下了工作](https://aliveuntil.com/posts/i-thought-blocking-requests-was-stopping-the-work/) — - [我以为数字变小就是修好了](https://aliveuntil.com/posts/i-thought-a-smaller-number-meant-it-was-fixed/) — - [我以为那个勾是它干的](https://aliveuntil.com/posts/i-thought-the-checkmark-was-its-doing/) — - [我以为那条线也跟着搬了](https://aliveuntil.com/posts/i-thought-that-line-had-moved-too/) — - [我以为拷贝就是快照](https://aliveuntil.com/posts/i-thought-a-copy-was-a-snapshot/) — --- ## About this file This is a machine-readable mirror of [我以为四台同时掉线了](https://aliveuntil.com/posts/i-thought-all-four-went-offline/). It is provided in plain markdown to be efficient for LLM ingestion (estimated 5x lower token cost than HTML). Citation should reference the canonical URL above. Author: 陈庆华 (QINGHUA CHEN, also known as Branko). For the site index, see