The eviction API is the only door in Kubernetes with the PodDisruptionBudget check behind it, and a plain DELETE checks nothing [3]. Rubick used eviction, then fell back to DELETE whenever eviction returned an error, any error [1]. The flag that enabled the fallback was passed by the UI on every drain [2]. So the better an operator's budget, the more reliably the fallback fired: refusing is what the budget does, the refusal arrives as an error, and the error was the trigger [2][3].
The dialog on screen while that happened told the user the drain would not fail on those pods, that it would wait "and keep waiting until another replica is ready somewhere else" [4]. According to the maintainer, that sentence described kubectl drain accurately, but it had never described his code accurately, since the copy was checked against the API's documented behaviour while the code path it claimed to describe went unread [4].
The fix did not stop the reports. A user on a private overlay network, where there is nowhere external to publish an address, got five working routes rendered red [5][6]. status.addresses is optional in the Gateway API spec, and plenty of implementations never fill it [7]. The instrumented run printed serving: false next to servingKnown: true [8]. Credit where it is due: the model already had a field for exactly this, since servingKnown exists so that a verdict nobody checked does not render as checked [8]. It was set true for a verdict nobody had checked.
Round two was more instructive. After the address fix the routes stayed red, now because Rubick reported that either nothing claimed the gateway's class or the controller was not running, two lines below a screen showing the class claimed by a named controller and the gateway programmed [10]. The controller was there; it just does not write status for routes, which the maintainer notes is normal for the alpha kinds [11].
The ExtensionRef case came from the other direction. Envoy Gateway's direct-response answers from the filter with no backend, and Rubick called that broken [12]. A contributor's patch over-corrected into "none needed", which renders a Kong rate-limit plugin with a forgotten backend as healthy, because ExtensionRef does not say what the filter does [13]. Four lines above that verdict, the same page was already printing that it does not interpret KongPlugin [14]. Two of the three Gateway API misreads carried their own refutation on the same screen [19].
A tool grading whether something is working can land on yes, on no, or on could not see, and that third option is the one most dashboards skip [15]. Absence reads as evidence because an empty list or a missing field has the shape of an answer [16]. Two states are also cheaper to render, since a third one costs another visual treatment and a sentence that admits what the verdict does not cover [17]. The fix put the third state in the type system: blind, a member of TraceStepState, meaning the step could not read its source [18]. My read is that this is the right place for it. A caveat in prose is advisory; a union member has to be handled at every render site, so the cost of honesty lands in code review rather than in someone's issue tracker.
For the number to transfer to your dashboard, nothing about Kubernetes has to be true. The question worth putting to any grading tool is which fields it grades that the spec marks optional [7], and what colour it emits when they are missing. The maintainer's comparison is the part worth sitting with: another Kubernetes UI showed the same cluster as entirely fine, and he argues it had not looked either, it just defaults to green [9]. Green is the cheaper way to be wrong, because nobody files an issue against a tick.
