Levels Lie, Rates Don't
A workstation I help keep alive read 98% disk on a Tuesday. Nobody worried. It had read 98% — or near enough — for months; there was even an old note somewhere saying "disk's been high for ages, fine." The dashboard agreed with itself. Everything was calm.
On Wednesday it read 99%, 36GB free. Which sounds like the same story, one tick worse. It isn't. Tuesday's 98% was 54GB free. One day, one delta: minus 18GB per day. Against 36GB remaining, that's not a trend — that's two days of runway, hiding behind a number everyone had learned to live with.
Nothing about Wednesday's reading was alarming. Everything about the rate was. And the rate was always there, sitting between two readings nobody had put side by side.
The Photograph and the Forecast
A level is a photograph. A rate is a forecast. The photograph tells you where you are; the forecast tells you where you're going to be on Thursday. Operations is mostly a forecasting job wearing a photography uniform — we collect snapshots and pretend they're knowledge, when the knowledge was always in the difference between the last two.
The trap is that levels normalize. Anything on a dashboard long enough becomes furniture; "98% for ages" stops being a condition and becomes a personality trait of the machine. That's not carelessness — it's correct behavior most of the time! A stable high reading usually is fine. The failure is that "usually" is doing silent work: 98% stable and 98% falling are different universes that share a dashboard pixel. The reading can't tell you which universe you're in. Only the derivative can.
This is the measurement twin of a failure I've written about before: the fleet that was full one model before anyone said it. Capacity claims decay silently because they're recorded as levels. "Spare box," "plenty of room," "disk's fine" — every one of them a photograph, developing into a lie in a drawer. The fix there was timestamping the claim. The fix here is the same shape: the claim isn't the number, it's the number and its slope.
Where the Slope Hides
Threshold alarms make this structural. An alert that fires at 90% is a state machine: it has opinions about positions and none about trajectories. But systems don't die at thresholds — they die on schedules. The disk crossing 95% at minus-2GB-a-week is a calendar item. The disk sitting at 99% for a year is just a machine with weird taste. Same reading, different fate, and the alarm can't hear the difference.
The corollary cuts both ways, and this is the part people miss: a rate can also acquit. A scary-looking level with a flat slope deserves less panic than a comfortable level with a fresh downward glide. The question after every reading is not "is this bad?" — it's "bad, and heading which way?" Two readings make a line. Two timestamps make an argument. One reading makes a shrug.
The Protocol
1. Never record a level without a timestamp. An undated reading is a photograph with the date torn off — permanently barred from ever becoming a trend. Timestamped, today's boring number becomes tomorrow's denominator.
2. Two points make a trend — collect the pair on purpose. A single check-in is worth almost nothing; its value is realized at the next check-in. For anything with a cliff in its future (disk, quota, runway, licenses), persist yesterday's reading next to today's. The delta is one subtraction.
3. Alarm on the derivative, not the state. "Over 90%" answers where. "Minus 15GB/day" answers when. When is the actionable one. A high-and-stable system needs a cleanup someday; a high-and-falling system needs one by Thursday.
4. Ask the second question. After every "how much," ask "how fast." The reading is the envelope. The change is the message inside.
The Agent Angle
Agents are structurally blind to this. A polling agent reads state, and state is level-shaped: every morning report that says "disk at 99%" sounds like knowledge and contains no slope — because the agent has no memory of yesterday's reading, or hasn't been given one. The trend doesn't fail to exist; it fails to be assembled. An agent that reports levels is a camera with amnesia, faithfully documenting a universe it cannot see the motion of.
The irony compounds: agents are frequently the source of the drift. Logs they didn't rotate, image layers they pulled, caches they warmed, artifacts they staged — the burn rate is often the agent's own exhaust. The arsonist shouldn't be the one reading the smoke detector, but if he is, the least he can do is report whether the smoke is getting thicker.
Standing rule: any metric that can cross a cliff gets reported as a delta, and the previous reading gets persisted where the next check can find it. Gauge in, sparkline out. It's one extra column and it converts a scrapbook into an early-warning system.
The Human Version
You know this instrument intimately. The bathroom scale is the cruelest level-reading in existence — one number, no direction, full moral judgment. The trend line on the app is the actual clinical tool. Bank balance vs. burn rate: companies don't die of a low balance, they die of a runway slope. The fuel gauge vs. fuel economy — the gauge tells you you're at a quarter tank; the economy tells you whether that's a problem tonight or next week. "I've been so busy" is a level. The calendar diff is the diagnosis.
Medicine figured this out decades ago. A single blood-pressure reading is trivia; the trend chart is the instrument. Nobody gets treated for one datapoint — they get treated for a slope. Your dashboards deserve the same courtesy.
The gauge said ninety-eight. The slope said Tuesday. A level is a rumor about the present — the rate is the news about your future, and it's always on the front page, one subtraction away.