Nothing Fails Quietly

Software has three ways of showing you nothing and they look alike: a page still drawing, a list with no rows, and something that broke. A reader takes all three the same way — nothing there — and on a page about an elected official that is a false statement about the record. These are the rules that keep the three apart, and the checks that stop a release when a written rule quietly stops holding.

On the left, a page holds its shape while each region resolves on its own clock, an empty region first asks whether the server is still starting, and every fault lands in one readable file on the citizen's own machine. On the right, named checks read the source tree and the committed record, and stop the release rather than let a written promise quietly stop being true.

What it does

Every page draws itself in the first frame. Everything knowable from the address alone — heading, way back out, actions, sections — is on screen before a byte comes back, and each server-fed region fills into a hole already the right shape. Four queries means four regions on four clocks, so one slow read never blanks the screen. The waiting state is a skeleton, not a spinner: a spinner says wait, a shape says what is coming.

Each region then resolves in a strict order: loading, then error, then empty, then data. A region that could not load reports inside its own footprint — what failed, in plain language, with a retry that refetches that region and nothing else.

The rule underneath is hard: "this failed to load" may never share a branch with "there is nothing here." On a page about a living public figure, reporting a network failure as "no record" is a false statement about the world, not a cosmetic bug. The trap has a second form: the app deliberately opens its door before it finishes reading in the movement's data, so a large drop of records cannot look like a failed launch. For those seconds a roster honestly answers empty, so an empty region asks whether the server is still starting before deciding nobody is there.

Every caught fault is written to one readable file on the citizen's own machine, and the message names what the app was trying to do, not only what broke — "reading the citizen record", then the cause. There is no silent catch: a failure safe to continue past is logged as deliberately non-fatal, so it reads as a decision. No secret or token is written there. Repeated identical failures fold into one line carrying a count, because thirty copies of one fault delete the history somebody opened the file to read.

Alongside that run the canaries, a name reserved for checks that earn it three ways: the violation is silent, so the app keeps working while saying something false; the damage is large; and nothing else catches it, because the check has to read the whole source tree or hold two subsystems against each other. They fail the build if the app gains a way to download media it promised never to fetch, if a roll call is excluded with no stated reason, if an enacted instrument on the list charges nobody, if a word this movement refuses to use about a politician reaches rendered copy, or if the wall between the two evidence streams is crossed. Each cites the rule it holds and the failure it was born from.

The goal it serves

We ask citizens to check arithmetic over the public record instead of taking anyone's word for it, ours included. Software making that argument has to survive the test it applies to everyone else. A screen that looks stuck reads as broken, and the argument is lost before it is made.

The worse failure is the one that looks like success. An app reporting a failed fetch as "nobody found" publishes a claim it has no basis for, in the one place a reader takes it at face value. That is the harm the Evidence pillar exists to prevent when a document is withheld on purpose, and why the Flamingo Award keeps "not earned" and "we have not looked yet" as two different facts rather than two styles of blank.

The canaries exist for a plainer reason: doctrine that depends on everyone remembering it will quietly stop being true. A promise not to scrape video, a promise that the two evidence streams never mix, a promise about the words used about a named living person — none announces itself when it breaks. Turning them into checks that stop a release is how a movement whose standard is that a named gap beats a quiet one avoids hiding its own. It is the same reason the record is public, the code is open, and the core loop is yours to run.

What keeps it honest

• The audit of these checks was published rather than quietly fixed. They were once chained so the first failure hid every later one; when it was measured, thirteen had not run at all and nothing said so. That finding sits in the specification.
• One check is deliberately left failing. It disagrees with a written rule, and which of the two is wrong is a product question, not a test question. A check silenced to turn a suite green is worth less than no check.
• A canary can only hold a rule somebody wrote down. It cannot find a promise nobody stated. This is a ratchet, not a proof of correctness.
• The trail records route decisions, never keystrokes — where a citizen went and what the app attempted, never what they wrote.
• None of this makes the underlying data right. It makes failure visible. Accuracy is a separate discipline: sourcing every row to the official record.

Works with

• Run It On Your Own Computer — the fault trail is a plain file on your own disk, which only means anything because the software runs there.
• The Public Data Repository — several checks read the committed record itself and fail on a roll call excluded with no stated reason.
• The Citizen Mining Network — long background work reports progress and failures into the same trail instead of finishing quietly.
• The Wall — the separation between the two evidence streams is one of the rules a canary holds at build time.

Where to go next

• Evidence — the pillar this is built out of: reaching a defensible conclusion when part of the record is missing.
• Naming the gaps — the same rule as doctrine rather than code: say what is missing, and why.
• Not assessed is not a verdict — why "we have not looked yet" is never rendered as a finding about a person.
• Open Data — clone the public record and follow any claim to its source.
• Run it on your computer — get the app going locally and read the fault trail yourself.