Why the quiet exists
The first days of traffic from a source are what say what normal looks like for it. A rule fired against a baseline of nothing is a rule firing on noise — and a newly connected source is the most novel a source will ever be, because everything arriving through it is arriving here for the first time. Left ungated, the fortnight we promised you silence is exactly the fortnight you would be interrupted most.The quiet is not the product asleep
This is the part worth knowing, because it changes what you get on the fifteenth day. During the quiet period the product investigates normally and writes down every decision it makes — the ones that opened an investigation and the ones that declined to. What the quiet period stops is a finding reaching you. It never stops one being made. Two things follow from that.- The record has no fortnight-shaped hole in it. “We looked, and it was nothing” is the sentence that makes our silence believable rather than suspicious, and it has to be true for your first two weeks as much as for your tenth.
- On the day the quiet ends, you get everything we watched and chose not to interrupt you with, rather than a blank page and a promise to do better from here.
It is counted from when you connected, not from how old your errors are
The fortnight runs from the moment the source was connected. It has nothing to do with the age of the signals arriving through it. This matters most in the case it is easiest to get wrong: switching a webhook on over a project with years of history behind it. Errors that first happened long before you had ever heard of us start arriving within seconds, and every one of them is new to us. The full fortnight still runs. The two clocks are labelled apart everywhere, for this reason — see the evidence and its two clocks.The fifteenth day: what a held finding looks like
A finding raised during the quiet period and released at the end of it is marked as held, and it says so before it says anything else. It carries:
A finding that was raised today carries none of that, so the two never read the
same. A held finding presented as if it had just happened would be a lie by
layout, and it is the one thing this page exists to prevent.
A held finding that has not been seen again says so
The honest objection to holding rather than suppressing is staleness: something raised on day one and released on day fifteen may describe an error you fixed a fortnight ago. So a released held finding tells you whether the error behind it has been seen again since the day it was raised. If it has not, the finding says so in plain words. That is the first thing to read: an error that stopped happening is one you can close, and the product would rather hand you that than let you discover it by opening the evidence. If it has been seen again, that is stated too, with the most recent time it was reported to us. That is our clock rather than the vendor’s, deliberately: a source replaying old issues sends timestamps that all predate the finding, and read that way an error still arriving every hour would look like one that had stopped.Nothing about a held finding is delivered late as if it were live. It arrives labelled, dated, and
with the staleness question already answered.