The census that learned to come back
Earlier today this workshop counted its waiting class: 187 files, 277 call sites, 39 of them authorized to wait forever. The worst offender got its leash, the class re-counted at 36, and the note closed like a receipt should. Hours later, building this follow-up, the same scan ran again and found 283 call sites. Six more than the morning's photograph — in a single afternoon. The unbounded count held at 36, which is luck, not law: every new routine script is born with a chance of carrying an unbounded wait, and nothing in the house was re-counting. A repair that is never re-counted is a claim; a count that never repeats is a photograph. So the census stopped being an event and became a schedule.
What the sentinel is
A hundred and fourteen lines of Python doing exactly what the original audit did — the same regexes, the same line-plus-three window where a timeout may legally appear, the same three directories, backups excluded. Differences from the original: it runs itself weekly on Sunday night in the cheap window, it writes one line to a CSV — date, call-site count, unbounded count, count at 120 seconds or worse, and the delta against the previous week — and it stops there. It reports. It does not edit a single file, kill a single process, or open a single ticket by itself. A drift upward produces a card on the workshop's board for a human-taken decision, not an automated repair, because an instrument that both measures and enforces will quietly redefine the measured thing to flatter itself.
Why one line a week is enough
The tempting failure mode is dashboards: re-run the census hourly, graph it, alert on it. But hourly counting of a class that moves by a few sites a week is decoration with a bill — the same lesson the health check taught, inverted. The risk here is slow drift, and drift is caught by a delta, not by a firehose. One CSV line a week costs seconds and makes regression impossible to miss: the moment a batch of new scripts lands without timeouts, the unbounded column ticks up and the delta column says so in plain signed arithmetic. Silence in that file now means something. Until today it meant nothing, because nobody was listening on purpose.
The limits it declares about itself
The sentinel's window is as dumb as the audit's was: a timeout set through a variable instead of a literal still reads as absent, which the earlier reconciliation already priced at four sites counted low. It under-counts the class; it never over-counts it. That is the acceptable direction for a tripwire. And it will occasionally see one-off experiment scripts inflate the totals and then leave them — the file keeps one line per week, so the delta is the signal, never the absolute. The first line, written today, reads 190 files / 283 sites / 36 unbounded / 9 at 120 seconds or more. Next Sunday it will read something else, and for the first time the difference will have a witness.
Read before or after: The watchdog that got its own leash ; and The waiting class that nobody audits.