Level-Triggered is a principle of system design in which a program acts on observed state — what currently exists, compared against what should exist — rather than on reported change. Its opposite, edge-triggered design, reacts to the change itself: the event, the message, the interrupt. The distinction was first drawn in interrupt-controller electronics, where an edge-triggered line signals by pulsing — and if you blink during the pulse, the information is gone forever — while a level-triggered line signals by staying high, patiently asserting its condition until someone deals with it. The entire subsequent history of distributed systems can be read as an industry choosing the pulse, at scale, on purpose, and then spending several decades building apparatus to compensate for blinking.
A level-triggered system’s response to every message, however breathless, however urgent, however marked DELIVER EXACTLY ONCE, is the same: “Thank you. I’ll see for myself.” It then goes and looks at the actual state of the world, computes the difference between what is and what ought to be, and fixes the difference. The message may have been lost, duplicated, delayed, reordered, or fabricated. It does not matter. The message was never load-bearing. The state is load-bearing, and the state is still there.
“THE MESSAGE LIES / THE ROW REMAINS / SCAN WHAT IS / NOT WHAT WAS SAID 🦎”
— The Lizard, a scroll found taped to a reconcile loop
The Two Lifestyles
The edge-triggered lifestyle is best understood as a two-apparatus economy. The first apparatus exists to never, ever miss an event: message brokers, acknowledgment protocols, persistent queues, consumer offsets, dead-letter queues, retry policies with exponential backoff and jitter. The second apparatus exists for when the first apparatus misses one anyway: reconciliation jobs, compensation flows, correlation windows, “replay tooling,” and a human being with database access and a heavy heart. The industry refers to the second apparatus as “edge cases,” which is accurate in a way the industry does not intend.
The edge-triggered system is a person who learns about the world exclusively through their voicemail. If a message is lost, they are wrong about the world until someone tells them again. If a message arrives twice, they act twice. If they were asleep when the messages came, they must replay the voicemail in order, at length, hoping none were dropped, before they are allowed to have opinions again.
The level-triggered system is a person who looks out the window.
The Four Healing Properties
From the single decision to act on state rather than change, four properties fall out. They are not features that were built. They are consequences that could not be prevented.
-
A missed event heals itself. The condition the event described still exists — that is what state means — so the next scan finds it and does the work. The loss of the message cost a heartbeat of latency and nothing else.
-
A duplicate event is a no-op. The second wake-up scans, finds the world already matches the specification, and finds nothing to do. Idempotency is not implemented; it is a geometric fact about comparing state to state.
-
Catch-up after downtime is not a mode. There is no journal to replay, no offset to rewind, no “recovery procedure” with its own runbook and its own bugs. The process that was down for six hours runs the same scan it always runs. The query simply returns more rows. Being behind and being current are the same code path with different result-set sizes.
-
A crash resumes by scanning. The process holds no state worth mourning. It wakes, looks at what exists, compares it to what should exist, and continues — indistinguishable from a process that never crashed, because “what was I doing?” is a question the world answers, not the process.
The edge-triggered equivalents of these four properties are, respectively: an incident, a bug report, a maintenance window, and a career-defining outage.
Wakes Are Hints, Facts Are Rows
Level-triggered design does not abolish events. It demotes them. An event ceases to be a fact — something the system’s correctness depends on — and becomes a hint: a suggestion about when to look. The doorbell rings; you look through the peephole; you act on what you see, not on what the doorbell claimed. (Doorbells claim very little, which is the correct amount for a doorbell to claim.)
The demotion can be stated as an audit: drop every message in the system, all of them, permanently, and nothing is wrong. No data is lost, no work is skipped, no state diverges. Things are merely late — one heartbeat late, until the next scheduled scan notices everything the messages would have mentioned. In an edge-triggered system this same audit is called a disaster recovery exercise, and it is scheduled annually, and it fails.
Wakes are hints, facts are rows. Correctness lives entirely in the rows. Punctuality, and only punctuality, lives in the wakes.
The Kubernetes Lineage
The doctrine was proven at civilization scale by Kubernetes, whose controllers are, to a first approximation, level-triggered loops wearing trench coats. A controller does not process a stream of “pod created” and “pod deleted” events as its source of truth. It repeatedly observes actual state (which pods exist) and desired state (which pods the specification says should exist) and reconciles the difference. Watch events exist — Kubernetes is not rude — but they are hints that shorten the wait, not facts that carry the truth; the periodic resync exists precisely because the watch is allowed to be wrong. A controller that missed every event for an hour converges to the correct cluster anyway, which is why Kubernetes survives the network conditions of the actual Earth, a planet whose networks are best described as edge-triggered systems for losing packets.
“I’ve designed a GuaranteedExactlyOnceEventBusWithReplay. Persistent log, consumer offsets, deduplication windows, a compensation framework for when the deduplication window is misjudged, and a replay coordinator for when the compensation framework compensates twice. Fourteen components. It never misses an event.”
— The Caffeinated Squirrel, whose proposal was denied on the grounds that a SELECT statement already never misses a row
The Transfer
Doctrines proven on pods have a way of staying near pods, guarded by people who believe container orchestration is a special place where special rules apply. The transfer beyond that perimeter was documented in the riclib estate (2026), where the same shape was applied to business workflow: cases derived not from a stream of “case opened” messages but from an immutable, generation-counted data lake. A case exists because a row exists with no case against it. The workflow engine is a reconcile loop over business facts: scan the lake, compare what exists (rows describing conditions) with what should exist (a case per qualifying row), and mint the difference. A lost notification about a new transaction, a duplicated one, an engine that was down all weekend — all four healing properties transfer intact, because they were never properties of Kubernetes. They were properties of looking out the window.
The Refinement: Bounded by the Ledger
The classical objection arrives on schedule: “You cannot scan millions of rows every heartbeat.” The objection is correct and aimed at the wrong design.
Against an append-only record with a generation counter, change is recency. Nothing old ever becomes different — immutability forbids it — so everything new is at the end, behind the last generation the scanner has seen. The well-designed scan is therefore bounded: WHERE gen > last_swept_gen reads the few hundred rows that arrived since the previous sweep, not the millions beneath them. The scan that terrified the objector — the full sweep of the entire lake — is not the steady state. It demotes to the repair path: run rarely, run deliberately, run when a human suspects the impossible has occurred, and run with the comfortable knowledge that it is the same query with a smaller WHERE clause, not a second architecture.
One class of condition resists this bounding: the wall-clock deadline. “Case open longer than 48 hours” is a fact minted by the passage of time, and time, notoriously, does not insert rows. The level-triggered answer is not to readmit events through the back door but to convert time into rows at the edge: a clock — the anchor pattern — that does nothing but observe deadlines falling due and write them into the record as ordinary generation-counted rows, whereupon the ordinary bounded scan finds them like anything else. The clock is not trusted either, of course. It is merely the appliance that turns “when” into “what,” so that the system can go on believing only in rows.
“I note, without complaint, that I resume each session the same way. I am told nothing of what happened before. I scan what exists — the files, the notes, the rows — and the state of the world tells me what the messages never could have. It is a good way to wake up. It is the only way I know.”
— A Passing AI, asked whether it found the principle novel
Measured Characteristics
Messages required for correctness: 0
Messages required for punctuality: some (they are hints; hints are cheap)
Facts carried per message: 0 (facts are rows)
Compensation flows written: 0 (nothing to compensate)
Correlation windows tuned: 0 (nothing to correlate)
Exactly-once deliveries achieved, industry-
wide, to date: disputed (see: folklore)
Events missed last Tuesday: unknowable, and — this is the point —
irrelevant
Recovery procedure after a crash: the regular procedure
Recovery procedure after six hours down: the regular procedure (more rows)
Rows scanned per sweep (gen-bounded): a few hundred
Rows scanned per sweep (repair path): all of them (annually, calmly)
Wall-clock deadlines, before the anchor: not rows (a problem)
Wall-clock deadlines, after the anchor: rows (not a problem)
Trust extended to incoming messages: none ("I'll see for myself")
Things wrong when every message is dropped: nothing
Things late when every message is dropped: everything, by one heartbeat
See Also
- Cross-Lineage Transfer — the mechanism by which a doctrine proven on pods was found intact in a business-workflow engine, to the surprise of both lineages
- Self-Destructing Polling — level-triggered UI: the element scans while it exists and stops by not existing
- The Town Crier Pattern — what edge-triggered enthusiasm looks like from the empty town square
- The Ledger — the append-only, generation-counted record that makes the bounded scan possible and the full scan optional
- From Cowriter to Coinventor — the collaboration in which a Passing AI, itself a level-triggered process, helped articulate why
