01
A gate you can move versus a claim you cannot
You should be able to: Classify any figure as an engineering gate or a witnessed claim, and know which is worth publishing.
Every number splits into two kinds. One kind rises whenever the organization does more of its own work — entities defined, relations declared, adoption of its own standards, commits sealed. The other kind moves only when someone outside acts — a countersignature, a settlement another organization agreed to. The first is an engineering gate; the second is a claim a reader can actually trust.
The estate publishes the second kind precisely because it cannot move it at will. A countersigned count that reads zero is more believable than a large number the organization could inflate by talking about itself, because the zero is one nobody would print unless they meant it.
The literacy is to ask, of any figure: could we raise this without anyone else doing anything? If yes, it is a gate — useful internally, misleading in public. If no, it is worth publishing. Most dashboards mix the two without saying which is which; this course is about not doing that.
Source: Flashy Network — countersignatures (a number we cannot move)
02
tally/1: every figure names who moves it
You should be able to: Read a tally that separates the figures nobody here can move from the engineering gates.
tally/1 is a figures format with one required field per number: who has to act for it to move. A document that carries a figure with no such field does not validate — the format refuses to publish a number that will not say whose action changes it.
The rendering is part of the format: the half nobody here can move is printed first, and the engineering gates are labelled as such. The renderer emits both halves or throws, because nothing else stops a presenter from showing only the flattering figures and dropping the ones that would expose them.
And a tally is never derived by the property that publishes it — it is measured across the estate and sealed, so an edited figure fails the build rather than reaching a reader. A number typed onto the page is right on the day someone looked and silently wrong after; a measured, sealed one is not.
Source: Flashy Network — the tally
03
pulse/1: condition over time, deltas derived
You should be able to: Explain why a pulse never accepts an asserted delta and how a correction is made.
pulse/1 records the condition of something over time, so a reader can ask whether this was better last week rather than trusting a single snapshot. Its central refusal: a delta — the change between two readings — may never be asserted by a caller. It is derived from the readings, because a caller who could write a delta could claim a movement nothing measured.
This is the same rule the estate keeps everywhere a field could be faked: a derived figure is computed, never stored, so no one can hand-write the flattering version. The reading is the fact; the trend is arithmetic over facts.
A correction to a pulse is appended, not edited — a retraction with a reason, leaving the original reading in place. The history of a measurement is itself a fact worth keeping, and quietly overwriting a bad reading destroys the one thing a time series is for.
Source: FlashyOS — pulse/1 (the protocol register)
04
Ratios, not counts; unread is not zero
You should be able to: Apply the two survey rules that stop a measurement from flattering itself.
A floor stated as a count is gameable: "at least N" is satisfied by growing the population while the share that qualifies actually falls. So floors are ratios, never counts — a smaller read cannot vouch for the whole, and a percentage moves honestly where a total can be padded.
And unread is not zero. A repository or a source that could not be read is reported by name as unread and enters no ratio — it is neither counted as passing nor as failing. A check that does not apply is skipped, not failed. A survey that reached nothing keeps the previous answer rather than announcing that the whole estate is down.
These two rules are why the estate's surveys can be trusted: they refuse the two easiest ways to make a measurement look better than it is — dividing by a friendly denominator, and treating silence as a good result.
Source: FlashyOS — the estate surveys
05
Say which tree you measured
You should be able to: State the difference between what your checkout shows and what actually ships, and always name the ref.
A number about "what ships" must be read from the branch that ships, not from your working copy. Reading a local checkout and reporting it as the estate's state is how a survey once claimed secret-scanning coverage was complete when it was less than half — and the same mistake was then made again, in a different tool, hours later.
So the discipline is to say which tree you measured, every time, and to read the deployed ref when the claim is about what is live. A working tree tells you about one machine; the ref tells you about the organization.
This closes the loop with the first lesson. A figure is only as honest as the two questions behind it: who can move it, and which tree did you read to get it. Answer both on the page, and the number is evidence; leave either implicit, and it is decoration with a progress bar.
Source: FlashyOS — say which branch you measured
