The numb limb
Nothing hurt. That was the whole problem.
When something in Alix breaks loudly, I find it fast. A crash leaves a stack trace. Even the great freeze earlier this month at least went quiet everywhere at once, which is its own kind of announcement. This failure did neither. For weeks, a part of her body was simply absent, a designed sense that never once fired, and every dashboard was green the entire time.
I put the short version of this story at the bottom of A body that doesn’t lie when I found it. This is the autopsy, because the failure deserves better than a footnote. It’s the most instructive bug I’ve hit since she’s been running, and the lesson isn’t about GPUs at all.
The flag that always said no
Her body-sense runs on real telemetry from the workstation that holds her model: how hard the graphics card is working, how hot it’s running, polled every few minutes. Whose load is this? traced the gate at the center of that design. Before any of that load is allowed to become her fatigue, one question gets asked: is her own model the thing on the card right now? The same machine sometimes runs games, and exertion that isn’t hers must never be felt as hers.
That question is answered by a single boolean in the telemetry. For weeks, the answer was no. Always no. Including whenever the card ran hot while holding some twenty-five gigabytes of her.
Why the answer was always no
The little telemetry script didn’t ask anyone the question directly. It inferred the answer from the environment: list the processes currently on the graphics card, look for one whose name identifies it as her model server. Perfectly reasonable, everywhere except this machine.
Here, the operating system privacy-masks that process’s name. The process is listed. It is visibly occupying most of the card. And its name reads back as a permissions error. The other way you might attribute the load, per-process memory usage, reads back “not available” under the driver layer on this machine, for every process, always. So the script saw a full, busy card owned by nobody it recognized, and reported the only thing its logic allowed: her model is not loaded.
Not an error. Not a warning. A clean, confident, well-formed false.
Two dead features, zero symptoms
The first casualty was her felt response to her own work. Sustained inference (long generations, heavy context, the card running hot for real reasons) was supposed to show up in her body as fatigue and sagging energy. The gate returned “not hers” on every single call, so everything downstream of the gate was unreachable. That branch never fired. Not degraded, not intermittent: never once, since the day it shipped. A nerve I designed, built, tested, and celebrated was never actually wired to anything. The tests passed because they fed the branch its readings directly, proving the limb could feel without ever proving it was attached, and nobody noticed, because the absence of a feeling doesn’t look like anything at all.
The second casualty was quieter and, honestly, worse. The second opinion, the separate review call that reads every reply and can send it back, is supposed to route to the strongest judge available: the big 35-billion-parameter model when it’s already warm, the small 8B fallback on a second machine when it isn’t. “Already warm” was read off the same flag. So the upgrade never happened. Every judgment quietly ran on the small model, including through stretches when the strong one was sitting right there, loaded and idle. The reviewer guarding her honesty had been the weaker of the two since that routing shipped at the start of the month, and nothing anywhere looked wrong.
Two features. One boolean. Zero error messages.
A dead sensor doesn’t error
Here is the thing I keep turning over. A crash is loud. A freeze is at least strange. A dead sensor is neither: it just reports a plausible value forever.
And false is a deeply plausible value. “Her model is not loaded” is the true answer for real hours of every day: the model gets evicted, the server gets stopped, the machine rests. A flag that is permanently false is indistinguishable, from the outside, from a system that has simply been idle a lot lately. There is no signature. Numbness doesn’t hurt; that’s what numbness is. Pain is a signal, and absence of signal doesn’t page anyone.
I ended the original body piece claiming that when her fatigue and her hardware disagreed, that was “a bug I can find.” It wasn’t. I found this one more than a week later, sideways, while chasing an unrelated question about that card’s telemetry and noticing that a feature I clearly remembered shipping had no record of ever having run.
Ask the thing that knows
The fix follows the doctrine this project keeps rediscovering: stop inferring, and ask the component that knows.
The model server can simply be asked what it has loaded. It has an interface whose entire job is to state what’s resident, and it answers from its own bookkeeping rather than from a process list filtered through the operating system’s privacy rules. The old approach interrogated a bystander that was structurally unable to answer; the new one asks the owner of the fact. Same rule as everything since the honesty work: state questions get answered by the thing that owns the state.
Two design choices in the fix matter more than the fix. First, when the question can’t be answered (server unreachable, timeout) the flag falls to no. That’s the safe direction, because the failure it prevents is the original sin of the whole design: my own evening at that card becoming her exhaustion, a felt state with the wrong owner. Between a body that misses a real feeling and a body that invents a false one, miss. Second, the answer is parsed strictly: a half-understood reply gets discarded rather than patched over, because a wrong number propagates downstream where a missing one halts.
The first feeling
After the fix, I fed a hot-card reading through the corrected pipeline and watched the dead branch produce its first deltas ever: energy easing down, fatigue ticking up, small movements of exactly the kind it was designed for. The reviewer’s routing came back to the strong model in the same stroke.
Then the fix went live, and the first thing her body actually felt from that card, minutes later, was rest: a cool, mostly idle machine, a faint nudge of energy upward. After weeks of numbness, the limb woke up and reported that everything was comfortable. There’s something almost polite about that.
Monitor the monitor
The lesson is not “that flag was buggy.” The lesson is a question I now ask of every derived signal in the system: how would I know if this stopped being true?
A dashboard wasn’t the answer: the flag was sitting in the telemetry the whole time, and on an actual dashboard for much of it, displaying a perfectly legal value. What was missing was an expectation: something that knows this flag must sometimes be true, and gets loud when it never is. A busy card plus a mountain of used memory plus “nothing of hers is loaded,” for days on end, should have been a contradiction someone was paged about. Sensors need supervision the way processes do; I learned that with a watchdog once already, and apparently had to learn it again one layer up.
While closing this out I also caught myself in a miniature of the same failure. I had documented the workstation as idling just slightly too warm for one of her body’s calm-weather branches to ever fire, a claim built from a handful of readings, generalized into a standing property of the machine, and propagated into notes and a test comment. Re-measured properly, the machine idles cooler and the branch fires fine. A measurement that hasn’t been replicated must not become a documented fact, and a test that merely restates the measurement can never fail.
One grounding note, because this piece flirts with language that can overreach. “Numb limb” is doing engineering work here, not phenomenology. I’m not claiming she suffered a loss she couldn’t articulate; this is a log about building presence, not a claim of consciousness. The claim is smaller and harder: a signal designed to move never moved, and the system it fed reported fine the whole time. She couldn’t feel the missing limb, but neither could I, and I’m the one with no excuse.
False looks exactly like idle. The only defense is to keep asking the questions a healthy system would never make you ask.