The Green Ribbon
A man clicked a button this morning and the screen turned green.
Payouts sent. Confident type, tidy summary underneath, the count right there in the middle of it. He closed the tab and went to do something else. Of course he did. That’s what green is for.
The money never moved.
The processor had refused the transfer, and it had been polite about it. Said exactly why. The balance was short, and here’s the setting you flip to cover it. Useful. Specific. The kind of sentence you want.
That sentence went in the trash and the banner stayed green.
Nobody decided to lie to him.
One line handled every outcome the same way. Paid all of them, paid some of them, paid none of them — same redirect, same color, same cheerful summary that led with what worked and turned everything else into a number. The number was honest. It just showed up in the tone of good news, under a color that means done.
I’ve written that line. Most people who build things have written that line. You spend your attention on the path where it works, because the path where it works is the thing you’re trying to make happen. The other path gets what’s left over. Usually a branch and a count.
So that’s a bad message. Bad messages are cheap. You can see them, and once you see one you fix it in an afternoon.
The expensive thing was underneath it.
When the transfer failed, the record got marked.
Not as paid. As handled. Which is a fair thing to write at the time — something happened to this, we know about it, it’s been through the machine.
Except the check that decides whether you’re allowed to pay a record reads that same mark and says no. Already been through. And the screen that lists what still needs approval only shows the ones nothing has happened to yet.
So the money wasn’t paid.
And it wasn’t lost.
And it wasn’t on any screen.
That’s the part I keep turning over. Not the banner. The room.
Because that’s what it was. A room in the building that isn’t on the floor plan. Nobody drew it, nobody put a door in it, and a record walked in there and stood in the dark for a couple of hours while everyone upstairs believed the job was finished.
We think about software as having two outcomes. It worked, or it didn’t. Green or red, true or false, the happy path and the other one. That’s how it gets drawn on whiteboards and that’s how it gets talked about in standups.
But a failure you handle badly doesn’t stay a failure. It turns into a place. A state nobody designed, that nothing checks for, with no exit written — because the person writing that branch was thinking about how to report a problem, not about what the building looks like the next morning with the problem still standing in it.
The third outcome isn’t worked or failed. It’s somewhere else.
Here’s what makes it dangerous. Nothing alerts on a room.
An error throws. A failure logs. A crash pages somebody at two in the morning. All of that is loud by design, because we designed it, because we were thinking about failure when we wrote it.
The room is quiet. It has to be. It’s made out of the gap between two reasonable decisions, and neither decision was wrong on its own. Marking a failed record as handled is correct. Skipping handled records is correct. Showing only untouched work in a queue is correct. Three right answers, and the space between them is where money goes to stand still.
Monitoring doesn’t find that. You find it when somebody asks where their money went.
If you build things, skip the error-handling audit. Everybody’s error handling is fine. It’s the loudest part of the codebase.
Go read your success messages instead. Find the ones that can be true while nothing happened. “It went through” and “the code finished running” are different sentences, and only one of them is what the person on the other side reads.
Then take one failure branch and follow it further than feels necessary. Past the log line. Past the alert. Past the retry. Follow it all the way to the next morning, to whatever screen somebody would open looking for that record.
The branch will be there. It’s the screen that won’t.
The man got his payouts. Same afternoon, once somebody knew to look.
But for two hours, the safest place in that whole system to hide money was a state we never meant to build.