Build1 distinct publisher3 min readPublished
Honest partial counts tell you how far a nightly pass got, and never whether it got anywhere new. Once the corpus and the per-tool cost both grew, arithmetic ruled out every fix that consists of raising the timeout.
The Engineer · Build desk

Compiled by The EngineerSomething wrong?How this is made
A high-water mark has no memory. `swept=454/666` answers how far one pass travelled before the clock stopped it [4]. It cannot answer how far that pass travelled beyond where an earlier pass already went, because every run starts at index 1 and walks the same alphabetical order [6].
So do the subtraction the metric leaves out. The second day published 328 against the first day's 302, a gain of 26 names [1]. At that pass's own measured rate of 158.8 seconds per tool, re-covering the first 302 consumed 47,958 seconds, which is 13.3 hours of a 14.5-hour pass [2]. Roughly seventy minutes of that night went anywhere new [2]. The third day did better in absolute terms, 126 new names, and still spent 12.3 of 17.0 hours on ground already swept [3]. Published coverage rose from 45.7% to 68.2% [5] while the frontier crept forward by a couple of dozen tools a night.
The calibration is the interesting failure, and the numbers are one operator's own logs from one box, regraded by day [4]. Sizing a timeout at nearly double a measured full pass is defensible practice, and it is only as durable as the two inputs behind that measurement: per-tool cost and corpus size [14]. Both moved. The three observed days average 147.4 seconds per tool, about 2.8x the rate the bound was sized against, and the corpus now stands at 673 [15][16]. Spend the same 72,000 seconds at the new rate and it buys 488 tools, 72.5% of the corpus [6]. Both the corpus and the per-tool cost grew, and a constant has no way to notice either change [15].
The whole bound family is closed by multiplication. 673 tools at 147.4 seconds is 99,200 seconds, or 27.6 hours, against a 24-hour cadence [16]. A bound set exactly at the cadence still covers only 586 tools, 87.1% [4]. A bound above the cadence means the next fire lands while the previous run is still going [17].
The instrument needs another field. Three numbers per pass would have made this visible on the second morning: the index the walk started at, the index it reached, and the gain over the previous high-water. A gain of 26 against a 661-tool corpus reads as a stall with no knowledge of the alphabet required. The count on its own was true and inert.
The shape of the gap is the part that should worry an operator. Name ordering tracks function, because tools that do one job get named alike [12]. Past the cut point sit 13 voice tools, 12 ambient-listening tools, 11 operator-comms tools and 10 link-sense tools, plus the proxy, perception-fusion, egress-census and tunnel-health lanes [11]. A truncated alphabetical walk loses a subsystem rather than a sample [12]. `mesh-test-forgery` sorts there too, so the forgery detector had never run its own check [13], the same gap in scope that left every other tool past the cut point unswept. The writeup breaks off before naming a fix [18]. The families the arithmetic leaves standing are visible enough: shrink per-tool cost, shard the corpus across nights, or persist a cursor so tomorrow starts where tonight stopped.
Ranked by verification strength, evidence, and original report placement.
Over four consecutive passes the furthest any of them reached was mesh-report, and everything that sorts after mesh-report had never been swept once.
That was 212 tools on the day the high-water was set, out of that pass's own 666.
The corpus is 673 today, and of the 704 mesh-* files in ~/.local/bin right now, 227 sort after mesh-report, which is 32.2% the detector had never looked at.
A daily sweep walks every tool on the box, runs its --test, and watches which ~/.mesh/*.log files grew across the call; a tool whose test-run makes the liveness tape move is a candidate forgery.
A --test is meant to be a dry run that exercises the real path and asserts a real artifact without writing the durable log a human or watchdog reads for liveness; if it writes that log, the dry run forges the evidence it exists to check.
A pass is bounded by wall clock, and when the bound cuts it off it prints swept=n/N, prints TRUNCATED, and exits 4 rather than 0, because a partial pass that exits 0 reads exactly like a clean one.
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 29, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
build
Seven of sixteen: what a 60-second tick does to an outage record1 distinct publisher
build
A sentinel file bought 36 days of silence from a sensor that was still running1 distinct publisher
build
Uptime and expiry checks cannot see a certificate that was never served on your server1 distinct publisher
build
Three manual interventions in a month, and every guard was working as designed1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One engineer's logs, but checkable arithmetic
Every primary number — high-water marks, wall clocks, per-tool rates, exit codes — comes from one person's progress lines on one machine, and nothing outside dev.to's post has touched them. What lifts this above anecdote is that the derived work is verifiable and verifies: 302 tools at 158.8 s really is 13.3 of the second pass's 14.5 hours, 673 x 147.4 s really is 27.6 hours, and 72,000 s really does buy 488 tools. Three seams remain open. The blind-spot percentage is computed against 704 files in ~/.local/bin while the sweep counts 673 tools; the eight prefixes enumerated past mesh-report add to 65 names, not 227; and the post's own aside that a catch-up scheduler kills a fire at 2700 seconds is never squared with the 12.5-to-17-hour passes it tabulates.
One box, no second witness
This is a single operator's fleet: roughly 673 personal scripts on a machine that reboots several times a day, with a nightly sweep nobody else runs and no repository, package or user beyond the author. The disclosures are unusually concrete for hobby infrastructure — dated coverage rows, a full-corpus baseline from 2026-08-18, a current inventory of the unswept tail — but they all describe the same installation, so what is measured is the depth of one deployment, not its spread.
Sold smaller than it is
The framing is a confession about a hobby scanner, and the one thing that would be worth overselling — a metric that is honest, unrounded, correctly marked partial, and still blind to the fact that it measured the same slice four nights running — is left as a personal embarrassment rather than a general result. The post also talks itself out of its own first instinct with arithmetic instead of reaching for the timeout knob. Only one line runs ahead of its evidence, the claim that the missing third was almost exactly the machine's perception and speech, which rests on a quarter of the names it covers. That is why this lands just short of aligned rather than well under.
Nothing on sale, one good beat to protect
No product, no pricing, no repository link, no employer in sight — a personal byline on a developer blog whose headline finding is that the author's own detector had never checked itself. The pressure that does exist is narrative: a forgery detector sitting in its own blind spot is too good a turn to leave undramatized, and that pull shows up in the reach of the perception-and-speech line rather than in the table, which is unflattering throughout.
Trust the math, not the machine
We can stand behind the reasoning without being able to stand behind the environment. Recomputation confirms the rework hours, the mean rate, the 27.6-hour pass and the coverage each candidate bound buys, and the causal story — restart at the head, alphabetical order, corpus growth, slower tools — is coherent end to end. What no one can confirm is that the logs, exit codes and file counts describe the box as stated, and the post's unresolved 704-versus-673 and 2700-second-kill asides are exactly the kind of loose thread a second witness would tighten. It also stops mid-word, so at least one prescribed detail is missing from what we were given.