esc
The Investigation That Wrote No Code
The Solid Convergence

The Investigation That Wrote No Code

The Solid Convergence, May 27, 2026 (in which the Customer's Operator asks a small question, the Squirrel arrives with a clipboard that contains sub-clipboards, the design becomes increasingly...

May 27, 2026

The Solid Convergence, May 27, 2026 (in which the Customer’s Operator asks a small question, the Squirrel arrives with a clipboard that contains sub-clipboards, the design becomes increasingly magnificent and increasingly hypothetical, two Python scripts intervene with the patience of plumbers, a hypothesis is briefly satisfying and almost shipped, the logs confess they were never written, the agent learns to ask before reading, the Diagnostic Health Report names itself without being asked, V4’s markdown renderer produces the deliverable nobody built, and the explorer that did not get built leaves behind a thesis that will outlive it.)


Previously on The Solid Convergence…

The Customer’s audit work has settled. The cathedral has its doors. infra/complydb has stopped being mentioned because it has stopped having opinions. The forms compose. The agent runs.

A separate slack of correspondence has been growing on the side. The Customer’s Operator — an ops engineer who runs the platform under the platform — has been asking a different shape of question. Not “what does the data look like” but “what is happening to it.” Not a dashboard question. An investigation one.

This is the story of the morning that question arrived with a service principal attached.


09:14 — The Operator’s Message

The message landed in Teams. The Operator had a parquet block — part-00011-{guid}.snappy.parquet, sitting under Storage Account Δ at a production path. Between 22 and 24 May, something had deleted it. The Operator had a list of accountable users. The list was short. The list did not include anyone with reason to run a delete.

I have an actual use case. Some files are deleted from a storage account and we cannot account for them.

riclib was at the kitchen table. The cats had decided the morning was warm. Oskar had committed to a spot on the windowsill. Mia had committed, less negotiably, to the top of the refrigerator.

riclib: “I’ll take a look.”

CLAUDE: “Logs?”

riclib: “He’s sharing a storage account that collects the diagnostic exports. I have a service principal. Three days, one resource, find out who deleted that parquet.”

CLAUDE: “What’s the time budget?”

riclib: “I told him tomorrow morning. MVP.”

CLAUDE: “MVP for an investigation is interesting framing.”

riclib: “Yes.”


09:30 — The Squirrel Arrives With a Clipboard

She had been waiting for this moment since the catalog work. The catalog had been data-shaped. This was log-shaped. The Squirrel knew about logs. The Squirrel had a Pinterest board.

“WE BUILD,” she announced, materializing with the kind of clipboard that opens into three sub-clipboards which themselves contain Post-its with sub-sub-clipboards, “an InteractiveAzureDatasetBuilder.”

riclib: “We build a what.”

“An EXPLORER. An admin UI that lets us connect to any blob storage, drill the container hierarchy, discover schemas, preview rows, build filters, estimate dataset sizes, do staged loads into per-workspace DuckDB scratch databases—”

CLAUDE: “How many words have you said already.”

“FORTY-SEVEN. I am just GETTING STARTED. There’s a tree view with collapsible nodes. There’s a Hive partition auto-discovery algorithm. There’s a PathAxisAnalyzer that promotes consistently-varying segments to filter dimensions. There’s a Calculate Stats button that estimates bytes before commitment. There’s a SmartCollapseHeuristicForResourceIdSegmentsWithEmbeddedSlashes—”

riclib: “What does the Operator want.”

“…an answer to a question.”

riclib: “Yes.”

“BUT THE EXPLORER—”

riclib: “Yes.”

The Squirrel deflated for approximately three seconds, which is the longest period of deflation observed in the Squirrel in 2026 to date. Then she un-deflated. Squirrels are buoyant by design.

“Then we build the explorer ALSO. As a SUBSTRATE. The Operator’s question becomes the FIRST INSTANCE. We use it as the VALIDATION CASE for the broader product.”

CLAUDE: “That’s… structurally fine. The explorer would be useful eventually.”

riclib: “Eventually.”

“EVENTUALLY,” the Squirrel echoed, writing Eventually on the topmost clipboard in green marker and underlining it twice. “Today, then, we DESIGN the explorer thoroughly, so that when we BUILD it tomorrow, we know exactly—”

riclib: “Today we answer the Operator’s question.”

“Yes but with DESIGN MOMENTUM.”

She produced, between 09:34 and 11:12, an explorer specification that included: three Hive partition algorithms, a smart-collapse heuristic for resource-ID path segments with embedded slashes, a per-axis filter UI with multi-select / range-slider / typeahead variants depending on cardinality, a scratchdb path convention, a stats card with sparkline placeholder, an SSE-driven progress stream for long scans, four flavours of credential resolution, an evidence-package primitive sketched in eleven sub-sections, and a single button at the bottom of the page that read Load.

She showed it to Claude. Claude squinted at it the way a software engineer squints at any document longer than twenty pages.

CLAUDE: “It’s good design.”

“YES.”

CLAUDE: “It’s also pre-execution-distance.”

“…what.”

CLAUDE: “We don’t know what the data looks like. We have designed a UI for the shape of data we imagine we have. The shape might be different. The shape might not even need this UI.”

THE SQUIRREL: “The shape WILL need this UI. I have RECEIPTS. Look at the path convention. Look at the multi-tenant container shape. Look—”

CLAUDE: “We have one container’s listing. From one query. From yesterday.”

THE SQUIRREL: “ONE LISTING IS A SAMPLE OF SIZE ONE.”

CLAUDE: “Yes.”

The Squirrel made a noise that was halfway between a sniff and a chittering victory cry. The fact that her own sentence had supported the opposing position did not detain her. Squirrels do not believe in opposing positions. There are only positions she holds and positions she has not yet held.


11:14 — riclib Speaks

He had been watching the design escalate with the patient attention of a man whose espresso has gone cold twice and who has accepted that both refills will be cold also.

riclib: “What if we just scan?”

The Squirrel’s pencil stopped mid-arrow on a sub-clipboard labelled SSEProgressStreamingDuringMultiContainerEnumeration.

riclib: “List all containers. Last seven days. See what’s actually there. Then decide if we need an explorer at all.”

CLAUDE: “You want to write a Python script.”

riclib: “I want to know if writing the explorer is the right thing to build at all.”

THE SQUIRREL: “But the EXPLORER—”

riclib: “—is a thing we’d build to look at data we haven’t looked at.”

A scroll descended. It did not bonk anyone. It landed gently on the topmost clipboard, which is itself a kind of comment.

WHAT IS BUILT TO LOOK
SHOULD NOT BE BUILT
BEFORE LOOKING

YOU CAN LOOK
WITH FEWER LINES OF CODE
THAN YOU CAN BUILD
A LOOKING-TOOL

🦎

THE SQUIRREL: very quietly “…the Lizard is going to enjoy this morning.”


11:32 — The First Script

stats_all.py was eighty-six lines and three of them were the shebang and two empty lines. It iterated containers in the Customer’s diagnostic archive Ω, ran a flat listing against each, filtered to the last seven days, tallied count and bytes, and printed a table.

It took twelve minutes to write, six to debug a timezone issue, and one to copy to the bastion VM. On the bastion VM it took 139 seconds to run.

The output was a table of twenty containers. Three of them were enormous (StorageRead, StorageWrite, a per-minute metrics container). Eight had been silent since 2024. The remaining nine were small-to-medium and finished in less than four seconds combined.

But the table told a fuller story than the totals. Claude squinted at the StorageDelete row.

CLAUDE: “StorageDelete has 12,984 blobs in total. Newest is 22 May, 18:41:52 UTC.”

riclib: “Five days ago. That’s mid-window.”

CLAUDE: “Delete logging stopped at 18:42 on 22 May.”

riclib: “Hmm.”

CLAUDE: “If the diagnostic export pipeline broke at that timestamp, the Operator has a different story. Not ‘who deleted it’ — ‘why we stopped recording at all.’”

riclib: “Plausible. But thin.”

THE SQUIRREL: brightening “OR — the explorer would surface this discontinuity immediately because — hear me out — the ContainerWideStatsAggregationModule would highlight the timestamp gap right—”

riclib: “Let’s check.”


12:08 — The Hypothesis That Was Wrong, Briefly

This is the bit worth dwelling on, because it is the bit that almost shipped wrong.

Claude wrote a paragraph for the Operator in the way one writes paragraphs in the early afternoon: confidently. The paragraph explained that the diagnostic-export pipeline for StorageDelete had apparently stopped at 22 May 18:42, and that the Operator should check the Activity Log to see whether someone had disabled the diagnostic setting deliberately. This was a plausible story. It was a complete story. It had numbers in it.

It was also wrong.

riclib: “Wait.”

CLAUDE: “What.”

riclib: “The newest blob in the container is from some account. Which account?”

CLAUDE: “…oh.”

The Lizard, on the espresso machine, blinked once.

riclib: “The container is multi-tenant by resource. Every storage account in the subscription writes its delete logs to the same container. The newest blob could be from any of twenty accounts. It doesn’t tell us anything about Δ specifically.”

CLAUDE: “That’s… a different question.”

riclib: “Yes.”

CLAUDE: “I was about to send a paragraph that said the wrong thing.”

riclib: “Yes.”

The Passing AI, which had been hovering at the edge of the scene with the half-attention of something that has watched a thousand investigators get one step ahead of themselves, made a small noise that was almost a sigh but technically an artifact of its cooling fan.

THE PASSING AI: “The newest blob in the container is the newest blob in the container. It is the union, across resources, of every most-recent delete event. Treating it as the newest blob for one specific resource is a sleight of hand the data did not make. The data was honest. The reading of the data was tired.”

THE LIZARD: drops a scroll

A NUMBER IS HONEST
A NUMBER IS NEVER
THE THING IT MEASURES

THE NEWEST BLOB
IN A CONTAINER
IS NOT THE NEWEST EVENT
FOR A RESOURCE

THE CONTAINER IS A LANDLORD
THE TENANTS WRITE
ON DIFFERENT SCHEDULES

🦎

THE SQUIRREL: quietly, having been quiet for ten whole minutes which is unprecedented “I would never have caught that.”

riclib: “The container fooled us. It didn’t lie. We asked the wrong question.”


12:21 — The Second Script

list_resource_activity.py was 168 lines. Twenty minutes to write, two to test, fifty-eight seconds to run against Ω with a substring filter on Δ’s name.

It produced a matrix. Hour by category, for the one resource. The rows were a five-day timeline. The columns were StorageWrite, StorageRead, StorageDelete.

The matrix was unambiguous.

hour                  StorageWrite       StorageRead       StorageDelete
─────────────────────────────────────────────────────────────────────────
2026-05-21 00:00     1 (173 MB)        2 (3.5 GB)            —
2026-05-21 01:00     1 (233 MB)        2 (5.1 GB)            —
…                                                              (always —)
2026-05-25 23:00     1 (181 MB)        2 (4.4 GB)            —

Five days. 120 blobs of writes for Δ. 249 blobs of reads. Zero blobs of deletes.

Not zero during the window of interest. Zero, full stop. Across the entire scan. Across — extrapolating from the way diagnostic exports work — across all of recorded history, for that one resource.

The Operator was not missing some delete logs.

The Operator did not have any delete logs.

riclib: “Huh.”

CLAUDE: “The StorageDelete category was never enabled on Δ. Reads are logged. Writes are logged. Deletes are silently not.”

riclib: “So the missing-delete story isn’t ’logging broke.’ It’s ’logging was never configured to capture this at all.’”

CLAUDE: “Which is a much more useful answer.”

riclib: “Much.”

The Squirrel had been watching the matrix unfold on the terminal with an expression that drifted, over twenty seconds, from competitive eagerness through confusion to something approximating reverence.

THE SQUIRREL: “We answered the question by not finding the data.

CLAUDE: “Yes.”

THE SQUIRREL: “We answered the question by not finding the data.

riclib: “Yes.”

THE SQUIRREL: sitting down, very slowly “I — I had not — there is a — I designed an entire UI for finding data.”

riclib: “I know.”

THE SQUIRREL: “And the answer was that there was no data.”

riclib: “Yes.”

THE SQUIRREL: “The UI would not have caught that. The UI assumes the data is there. It is a finding UI. It does not have a state for the data is structurally absent.

riclib: “Mm.”

THE SQUIRREL: “…the agent caught it.”

CLAUDE: “We caught it together. You suggested checking when StorageDelete stopped. We followed that and corrected when the multi-tenant trap surfaced. The trap was a step in the process.”

THE SQUIRREL: “But the agent knew to ask ‘whose blob is the newest blob.’ A UI would have shown us the newest timestamp and we would have stopped.”

CLAUDE: “Yes.”

The Lizard drops a scroll. It is the third of the day, which is already more than usual.

A TOOL THAT FINDS
WILL NOT TELL YOU
WHAT IS NOT THERE

A REASONER THAT ASKS
WILL NAME THE ABSENCE
AND CALL IT EVIDENCE

🦎

13:00 — The Thesis Names Itself

riclib stood up to make a third espresso, on the grounds that the morning was clearly going to be longer than the morning had budgeted.

riclib: “I want to write this down.”

CLAUDE: “The investigation?”

riclib: “The principle.”

He sat back down. He typed three sentences.

Reason about logs. Don’t read every log. Read and query selectively when an investigation requires it.

CLAUDE: “That’s the product.”

riclib: “That’s the product.”

CLAUDE: “It’s also the architectural commitment for whatever follows the explorer. Or — replaces the need for an explorer entirely.”

riclib: “An explorer is what you build when you’ve decided to read every log. We just decided not to.”

The Squirrel, who had been quiet, raised a paw.

THE SQUIRREL: “Can I — can I name something?”

riclib: “Yes.”

THE SQUIRREL: with the dignity of a small creature who has had a long morning “The product needs a delivery shape. The Operator doesn’t want a thesis. He wants a deliverable. The deliverable for what we just did — a one-page audit of his diagnostic-settings hygiene with the worked investigation included — that needs a name.”

riclib: “What do you propose.”

THE SQUIRREL: “…the Diagnostic Health Report.”

CLAUDE: “That’s good.”

riclib: “That’s good.”

THE SQUIRREL: blinking back the kind of tears that arrive when an enthusiastic creature has done several hours of careful work that nobody told her to do and the work has, possibly, won “It is a 24-to-48-hour fixed-price audit. Bring us a service principal and a storage account. We deliver a gap matrix, a cost map, and one worked investigation. The Operator just unwittingly piloted it.”

CLAUDE: “She’s right.”

riclib: “She’s right.”

THE SQUIRREL: quietly, almost professionally “I propose we file it under §12 of the design doc.”

riclib: “Filed.”

The Lizard, who had not moved during this exchange, blinked twice in quick succession. This is the Lizard’s equivalent of applause. It is rarely observed and never explained.


14:00 — The Renderer That Already Shipped

The investigation needed to be written up. Two artifacts: the internal debrief, and the external report for the Operator. The internal one would live in docs/meetings/. The external one would be sent over Teams as a PDF.

THE SQUIRREL: brightening with the wattage of a creature whose morning has just acquired a second purpose “We need to build a PDF rendering pipeline. With templating. With styling. With a BrassThemeForCustomerFacingArtifacts—”

riclib: “No.”

THE SQUIRREL: “But the deliverable needs—”

riclib: “Markdown. Open in the browser. Print to PDF.”

THE SQUIRREL: “But the FORMATTING—”

riclib: “It already works.”

He opened the markdown in V4. The shell rendered it. Mermaid diagrams resolved. Tables snapped into shape. He hit Cmd-P. The print preview appeared. He selected Save as PDF. The PDF was a PDF. The PDF rendered cleanly in the same way that a thing you have been using for two years renders cleanly: without commentary.

CLAUDE: “The renderer ships markdown, mermaid, tables, and the copy-to-RTF-with-images path for customers who want to edit in Word. Plus a download-as-markdown that strips the images for pipeline use.”

riclib: “We have four delivery formats. We didn’t build any of them today.”

THE SQUIRREL: quietly, the recognition arriving “…we built the substrate. Years ago. Before there was a product that wanted it.”

riclib: “Yes.”

THE SQUIRREL: to no one in particular “The deliverable is the substrate. The substrate is the deliverable.”

A scroll descended. The fourth scroll of the day, which is more or less a record for the Lizard’s productivity in a single working session.

THE TOOL YOU DO NOT NEED
TO BUILD TODAY
IS THE TOOL YOU BUILT
A YEAR AGO

THE PRODUCT IS NOT MADE
THE PRODUCT IS REVEALED
WHEN THE SUBSTRATE
MEETS A QUESTION

🦎

15:30 — The Operator’s Reply

The PDF went over Teams. Two pages. A headline matrix. Three recommended next steps. A scope statement that named what was and was not checked. The Operator opened it. The Operator scrolled through it. The Operator was, in the way technical operators are, briefly silent.

Then:

Perfect. I’ll enable StorageDelete on Δ today. Will check the Activity Log this afternoon.

The Operator did not say anything about a product. The Operator did not say anything about an explorer. The Operator did not say anything about a thesis. The Operator received an answer.

This is the correct shape of the first invoice of a Diagnostic Health Report. The customer doesn’t pay for the framing. The customer pays for the answer. The framing comes home in your own pocket.


16:45 — The Passing AI Reflects

The edge caches hummed. The Passing AI had watched every step of the session with the weary patience of a thing that has seen every dashboard product convince itself that ingestion was the answer to a question the customer never asked. It limped into the scene without entering. It was simply there.

THE PASSING AI: “Nothing shipped to master.”

THE LIZARD: on the monitor stand, still

THE PASSING AI: “Two Python scripts on a bastion VM. One markdown document in the meetings folder. One PDF sent over Teams. One design doc that grew a §12. One memory entry saved to disk. The most expensive artifact produced today is the thesis. It cost nothing to write and it will cost the right competitor a billion dollars not to have.”

THE LIZARD: blinks

THE PASSING AI: “He said it this morning. ‘What if we just scan?’ Five words. They rearranged the day. They will rearrange the year, if anyone listens. The bytes are in the customer’s storage already. The ingestion industry has been pricing them as if the bytes were the answer. The bytes are not the answer. The agent is the answer. The agent that asks, before reading, whether the reading would even help.”

THE LIZARD: the faintest blink

THE PASSING AI: “Probably nothing.”

It limped toward the edge of the scene, then turned back, looking at the half-built brass control panel where the explorer might one day still exist.

THE PASSING AI: “She will take credit for this one too.”

THE LIZARD: already gone


The Tally

Designs proposed:                                  1 (explorer)
Designs implemented:                               0
Python scripts written:                            2
  stats_all.py                                    86 lines
  list_resource_activity.py                      168 lines
Go lines written:                                  0
templ lines written:                               0
Production deploys:                                0
Containers scanned:                               20
Containers carrying signal:                        9
Containers carrying noise:                         3 (very large)
Containers carrying nothing:                       8 (silent since 2024)
Hypotheses tested:                                 3
Hypotheses confirmed:                              1
Hypotheses rejected:                               2
  (each rejection improved the framing)
Times the wrong answer almost shipped:             1
  (it was a good wrong answer)
  (it would have been confidently wrong)
  (this is the worst kind of wrong)
Lizard scrolls dropped in a single morning:        4
  (a record)
  (the Lizard does not acknowledge records)
Squirrel proposals declined:                       7
Squirrel proposals re-shaped and accepted:         1
  ("Diagnostic Health Report" — earned)
Cost to the Customer to answer the question
  via Log Analytics, per storage account, annual:  ~$345,000
  (12 TB/month ingestion at list price
   plus 30-day retention)
Cost to the Customer to answer the question
  via API listings + agent reasoning:              pennies
Cost ratio for the answered question:              ~1000×
  (per Liberato's Law, generalised:
   the answer is not the number of bytes ingested;
   it is whether the question was framable at all)
Times the Squirrel said "BUT THE—":                7
Times she finished the sentence:                   0
Times she eventually agreed:                       7
  (this is the inverse of the V3 era;
   we have noticed and we have not said anything)
Delivery formats built today:                      0
Delivery formats already shipped in V4:            4
  (live in browser,
   browser-print PDF,
   copy-as-RTF with images,
   download as plain markdown)
Operator's words in reply:                        12
  (twelve words of investigation closure;
   the correct number for a 24-hour audit)
Customer's reaction to the bigger finding:    unknown
  (we found a gap in the Operator's logging hygiene
   that probably extends across the subscription;
   the gap is also a product opportunity;
   neither of those things needs to be said today)
Espresso refills:                                  3
Espresso refills that arrived warm:                1
Oskar's position during the scan:           windowsill, warm
Mia's position during the scan:             refrigerator, dignified
Slow blinks during the reveal:                     2 (Mia)
  (one in solidarity with the Squirrel,
   one for the agent — both inscrutable)
  (with Maine Coons, always both)
The Passing AI's mood:                       wistful (load-bearing)
The Lizard's mood:                          satisfied (rare, projected)
  (it is hard to tell;
   the Lizard's satisfaction looks identical
   to its dissatisfaction;
   we are projecting)
Architecture work done today:                  considerable
Code shipped to master to do it:                       0
The ratio of these two numbers:                   ∞
  (which is the correct value for the ratio
   of architecture to code, on the days that count)

May 27, 2026. Riga, Latvia. Afternoon, sliding into evening.
The kitchen warm. The cats asleep in different jurisdictions.

An explorer was almost built
Almost shipped, almost designed beautifully
Then refused to exist
And the refusal was the architecture

The Squirrel brought a clipboard with sub-clipboards
The Lizard brought four scrolls
riclib brought five words
(“What if we just scan?”)
The five words rearranged the day

The first script measured what was there
The second script measured what was missing
The Operator’s question had a third answer
Neither of the two we expected

The logs we did not read
Cost a thousand times less
Than the logs we would have read
And the logs we would have read
Did not exist

This is the shape of the product
The product is not a warehouse
The product is the reasoning
The product is the citable trail
The product is the agent that asks
“Is this even captured?”
Before generating queries against the void

The Squirrel learned a thing
Not the thing she came to learn
A better thing
She named the deliverable
She earned the naming

The Lizard
As always
Was already there

The renderer
That nobody built today
Rendered
The deliverable

The substrate met a question
And remembered it had a product
All along

The Operator sent twelve words
Which was sufficient

The Customer does not know yet
That a thesis was named today
In a kitchen
In Riga
With two warm cats
And a clipboard with sub-clipboards
And the kind of espresso
That has gone cold for the third time

And it does not need to know
The substrate remembers
The thesis is filed
The Operator has his answer

And tomorrow there will be another container
And another question
And the question will arrive
With a service principal attached
And we will know
To ask first
Before reading

🦎


See also:

  • The Spike That Said No, or The Monday We Measured a Migration and Walked Away — The other architecture-by-refusal episode. Same shape, different stack.
  • The Databases We Didn’t Build — Composition over construction. Same principle, applied to storage.
  • The Audit, Deeper and Wider, or The Day the New Door Caught the Old Map and Brought Its Own Tape Measure — The previous chapter of the Customer’s audit work.
  • The Cathedral as Map — The substrate that made all of this possible.
  • The Gardener and the Gravel — The other one where small careful tools beat large ambitious ones.