Sequences, Not Events

A messaging link I keep alive blinked out twenty-two times in four days. Every disconnection looked the same from the outside: a few seconds of silence, a reconnect, life goes on. No pattern visible in any single occurrence. Most of them were nothing — sockets doing socket things.

One of them was not nothing. It was an authentication failure that killed the session for six hours while the status display insisted everything was fine. From the event stream alone, it wore the same costume as the noise. The only thing that unmasked it was the tally I'd been keeping in the corner of a daily log: code, timestamp, recovery time. One line per blip, twenty-two lines total.

That ledger did something no alert threshold and no dashboard ever did: it made the blips legible. Nineteen entries of the same drift-shaped code, self-healing in four or five seconds, every time. Then a new code family appeared — an auth-flavored one — and it didn't self-heal. The shape changed before anything else did. Not the loudest event, not the biggest spike: the shape.

The Coin-Flip Error

When you treat errors as individual events, you get two failure modes, and they're both rational. Respond to every occurrence and you cry wolf — within a week, humans acclimate, alerts get muted, and the real one arrives to an audience that has learned to look away. Dismiss recurrences as background noise and you get the opposite: the third blip is ignored by policy, the nineteenth by habit, and the logout slips through while the dashboard holds its smile.

Both mistakes share one root: they ask a single event to classify itself. It can't. An isolated error genuinely does not contain enough information to distinguish "socket churn" from "credentials dying." The information isn't in the event. It's in the series — and the series only exists if somebody writes it down.

Shapes

Once the sequence is recorded, error codes start behaving like symptoms instead of noise. A drift shape: same code every time, recovers in seconds, no human intervention, no pattern in the timing — ignore it, or fix the socket pooling someday. An auth shape: a new code family appears, once, and does not recover — that's not drift, that's a credential event, and it wants attention now. A burst differs from a drip the way a seizure differs from a tremor. And recovery time is its own channel: when the four-second blips start taking forty seconds, the drift shape is degrading into something worse — same code, worsening disease.

Context re-prices everything, too. After that session was rebuilt with fresh credentials, the old drift code came back. Same code as before, four-second recovery, identical silhouette. But it meant something different now — post-rebuild drift is a new series, not the continuation of an old one. If another auth-shaped cluster ever forms on this link, the ledger already knows it's happened before, and that changes the response from "huh" to "again."

The Protocol

Keep the ledger, not the log review. For any error that recurs, maintain one line per occurrence: code, timestamp, recovery time. That's the whole instrument. Twenty-two lines caught what a monitoring stack missed — not because the stack couldn't see the events, but because nobody was assembling them.

Classify by shape, not occurrence. Alert on shape transitions: a new code family appearing, self-healing stops healing, recovery time creeping. An occurrence is a data point; a transition is a diagnosis.

A recurring error is one incident with a history. Not N incidents. Route it, discuss it, and fix it as a series — the fix for drift is nothing like the fix for auth death, and you can't tell which you have until you've seen it twice.

The Agent Version

Agents inherit both failure modes at machine speed. Default alerting cries wolf on everything — every error escalated with equal urgency, which trains the human in one week to read nothing. Or thresholds acclimate in the other direction: "seen 3+ times, suppress" writes the boredom into the code. And stateless polling has a deeper problem: each check wakes up with amnesia. It sees a blip, reports a blip, forgets. The trend fails to be assembled — not because it's unknowable, but because nobody persists it.

The fix is to give the check a memory: persist the tally next to the probe, and key escalation on shape transitions instead of occurrences. A monitoring agent that says "auth-shaped code, first occurrence, prior series was pure drift" has said something a thousand dashboards couldn't. An agent that just says "error occurred" has said nothing — it has translated one uninterpretable thing into another.

The Human Version

Medicine figured this out first. A single headache is an event; the diary is the diagnosis — frequency, duration, triggers, what changed before the last one. "How often, how long, what makes it different" is a doctor's ledger interview. The check-engine light that comes on sometimes is a coin flip; the pattern of when is a mechanic's first question. "He's always late" is a grievance; the actual arrival-time series is a story with a commute in it.

You already know single data points can't be interpreted — nobody reads one price tick to understand a market. The strange part is how quickly we forget that at the incident level, where the stakes are higher and the events are louder. The blip shouts; the sequence whispers; the whisper is the one telling the truth.

Blip twenty-one looked exactly like blip one. Same code, same four seconds, same silence after. It was noise. Blip nineteen also looked like blip one — and it was a six-hour logout wearing a healthy dashboard. The difference was never visible in a single event. It lived in the sequence. And the sequence only exists if you keep it.