# Dark is not zero: a freshness calculus (current / stale / dark) with a never-promote rule

*Working title:* **Dark is not zero.** A value nobody measured is null and renders dark, never zero. Every value carries the age of its own face. A renderer may reshape a value but never promote it.

Author: [withheld in the repository copy]. Contact: [withheld].
Status: **DRAFT — not submitted. Luke submits by hand, and only if he chooses to.**
Revision: 2026-11-02 second sweep (related work, venues).
Slate: PLAN.md P3. Companions: P12 (the trust ladder) and P4 (decay as uncertainty).

## Venues

| Venue | Deadline (time zone) | URL | Format / review | Fee or barrier | Verified |
|---|---|---|---|---|---|
| ACM Journal of Data and Information Quality (JDIQ), primary | rolling | https://dl.acm.org/journal/jdiq/author-guidelines | journal article; review model not read | APC under ACM Open not read (site returned 403 to bots on 2026-11-01); prior ~US$1,300 member / $1,700 non-member | UNVERIFIED |
| CHI 2027 Posters (the "late-breaking" slot named in PLAN.md is not in the venues note) | 2027-01-21, Anywhere on Earth | https://chi2027.acm.org/authors/posters/ | up to 4 pages excl. refs (page also says 6; inconsistent); anonymized; PCS; non-archival Extended Abstracts | one author registers; on-site or pre-recorded video | READ |
| IEEE VIS 2027 short paper | not announced; pattern from VIS 2026: abstract ~2027-03-21, paper ~2027-03-31, 23:59 AoE | https://ieeevis.org/year/2026/info/call-participation/call-for-participation | PCS; TVCG special issue for full papers; short track not read | registration unknown | UNVERIFIED (pattern) |
| arXiv `cs.DB`, cross-list `cs.HC` | rolling; cutoff 14:00 US Eastern, announced Sun–Thu | https://info.arxiv.org/help/endorsement.html | preprint | one `cs` domain endorsement covers cs.DB, cs.HC and cs.SE; "Independent" accepted as organization | READ |

## Abstract (draft)

Dashboards, feeds and belief interfaces routinely show a missing measurement as zero. Readers do not notice, and vendors defend the default. We propose a small calculus that forbids it. Every exported value carries the age of the face it came from, and the producer states a threshold. From value, age and threshold a three-state label is derived, never typed: dark (null value or null age), current (age within threshold), stale (older). The three states form a lattice, dark < stale < current, and the law for every downstream transformer is monotonicity. A renderer may reshape a value and may lower its state, but may never raise it. We call this the never-promote rule and give it the proof pattern of Denning's information-flow lattice and the algebra of provenance semirings, where a derived value takes the least state of its inputs. A second rule covers counts. A count without stated coverage is ambiguous between "nobody came" and "nothing was measuring", so an instrument publishes its own coverage and a day grades only when fully witnessed. We report the failure that forced this rule: an early instrument wrote fabricated zeros into an append-only ledger. We map the calculus to continuous integration, where a skipped check is dark and not a pass, against a platform default that counts skipped checks as satisfied. The schema (`frame/1`), its validator and four instances are pinned by tests in three repositories. The effect on human readers is unmeasured and is stated as dark.

## Contributions

1. **The freshness lattice.** A face is a pair (value, age) with a producer-stated threshold τ. `state` is derived: null value or null age gives dark; age ≤ τ gives current; otherwise stale. The order dark < stale < current is a knowledge order, and a validator refuses any document whose typed state exceeds the derived one.
2. **The never-promote rule as monotonicity.** A renderer R is legal iff state(R(x)) ≤ state(x) for every x. Legal renderers compose, and a value derived from several inputs takes the least state among them. This is Denning (1976) read in the other direction, and Green et al. (2007) with freshness as the annotation.
3. **The coverage rule as a gradeability predicate.** A count carries `hours_covered`. `(value=None, hours_covered=24)` is a measured zero; `(None, None)` is unprovable and stays open. A call sits on the highest rung the evidence supports, dark < counting < counts, never the most impressive. We report the fabricated-zeros incident and the instrument-side fix.
4. **Silence in CI is dark.** A check that did not run maps to dark, never to pass. On GitHub, only a job skipped by a job-level `if` condition reports Success and satisfies a required check, while a required check that never runs (for example, because path or branch filters meant the workflow was not triggered) stays Pending and blocks merging (GitHub Docs, "Troubleshooting required status checks"; "Using conditions to control job execution"); a referee test refuses `continue-on-error` and `if: always()` that would paint green. An eight-day CI outage was carried as dark.
5. **Pinned instances.** A blank-booted engine exports every node dark with a null value; one replayed day makes signalled nodes current and leaves the rest dark; nothing is promoted and the export leaves the field hash untouched. Nameplates, confession and glass-door faces leave unknown organs null. The public site renders a stale host report as dark, not red and not zero.
6. **A map to six literatures.** Codd's nulls, Belnap's "neither", Dempster–Shafer ignorance mass, Age of Information, false-zero ecology and knowledge-base completeness assertions each hold one piece. None holds the lattice, the age and the renderer law together.

## Outline (≈6,600 words)

1. **The misreading** (600). A line chart with a gap filled by 0 reads as "nothing happened". We open with two vendor disputes and Eaton et al.'s finding that users do not notice a default value. The fix belongs in the data document and its validator, not in the chart.
2. **Three states and one order** (900). Define face, age, threshold and the derivation rule. A typed state is a claim about freshness that nobody measured, so `state` must be derived. Separate the two clocks a document could carry (valid time, transaction time) and say why `frame/1` carries the face age only.
3. **Never promote** (1,000). State the rule as monotonicity on the lattice; show closure under composition and the least-of-inputs rule for aggregates. Reshaping allows units, rounding, colour, layout and lowering. It forbids dark → number, stale → current, a default fill, and "keep last state" past τ. The validator is the referee.
4. **Measured zero versus unwitnessed** (900). Present the coverage rule and the three rungs. Tell the failure: an append-only ledger received measured zeros for days nobody was counting, and the fix was in the instrument, which now states coverage. Relate to occupancy models, false zeros and completeness assertions.
5. **Silence in CI is dark** (700). Model a check as pass / fail / not-run. Quote the platform default and show it promotes on absence. Describe the referee test and the outage: no run was dark, and releases continued only by recorded owner override with local checks named in each tag.
6. **Instances** (900). The engine's `frame/1` export at blank boot and after one replayed day. Nameplates as evidence status, not geometry. Faces that leave organs null. The site's stale-host rendering, with producer thresholds live < 2700 s and stale < 10800 s.
7. **Related work and the negative space** (1,000). As below.
8. **Threats, dark list, conclusion** (600). As below.

## Related work and the negative space

**Nulls and incomplete information.** Codd (1979), ACM TODS: a null with ternary comparison. Codd (1986), SIGMOD Record: applicable versus inapplicable missing. Imieliński & Lipski (1984), JACM: three-valued logic cannot guarantee complete answers. Libkin (2016), ACM TODS: SQL's 3VL and certain answers can be unrelated; certainly-true / certainly-false / unknown. Reiter (1978), Logic and Data Bases: the closed-world assumption, where no proof means false, exactly the promotion forbidden here. Belnap (1977), Modern Uses of Multiple-Valued Logic: a four-valued logic whose "neither" is told-nothing.

**Missingness as mechanism and as signal.** Rubin (1976), Biometrika: MCAR / MAR / MNAR. Che et al. (2018), Scientific Reports: the pattern of missingness is itself predictive. MacKenzie et al. (2002), Ecology: "nondetection ... does not imply that the species is absent unless the probability of detection is 1". Martin et al. (2005), Ecology Letters: true zeros versus false zeros. Razniewski et al. (2024), ACM Computing Surveys: completeness assertions under partial-closed-world semantics. Altman & Bland (1995), BMJ: absence of evidence is not evidence of absence.

**Age.** Kaul, Yates & Gruteser (2012), IEEE INFOCOM: Age of Information. Yates et al. (2021), IEEE JSAC: the survey. Chiariotti et al. (2022), IEEE TCOM: age sampled at query instants, which is what a page load is. Maatouk et al. (2020), IEEE/ACM ToN: age counted only while the estimate is wrong, the "stale but still right" case. Jensen & Snodgrass (1999), IEEE TKDE: valid time versus transaction time.

**Flow lattices and provenance.** Denning (1976), CACM: labels in a lattice, information flows only upward, programs certified automatically. Green, Karvounarakis & Tannen (2007), PODS: one semiring rule carries an annotation through every operator.

**Readers and displays.** Eaton, Plaisant & Drizd (2005), INTERACT (LNCS 3585, DOI 10.1007/11555261_68; primary text read 2026-11-02 from the authors' open preprint HCIL-2005-05): between-subjects, n = 30, ten per display; under the "Misleading" display, where missing points are replaced by 0, no participant answered any missing-data question correctly and each asserted a definite trend or comparison rather than saying there was not enough information; "users may not realize that data is missing when it is replaced by a default value". The preprint was read through a raw text dump, so every quotation must be re-checked against the PDF before it goes in a paper. Song & Szafir (2019), IEEE TVCG: how missing values are shown changes perceived quality and biases estimates. Pang, Wittenbrink & Lodha (1997), The Visual Computer: the renderer is itself a source of distortion.

**Ignorance as a value.** Dempster (1967), Annals of Mathematical Statistics, and Shafer (1976), Princeton: mass on the whole frame is ignorance, distinct from 50/50.

**Practice.** Prometheus marks a series stale and reads back over a default lookback window. Grafana separates No Data from Error from Missing Series, yet recommends `OR on() vector(0)` to "always return data" and offers Keep Last State. The Google SRE book (ch. 6) does not treat absent metrics. GitHub Docs: only a job skipped by a job-level `if` condition reports Success and satisfies a required check, while a required check that never runs (for example, because path or branch filters meant the workflow was not triggered) stays Pending and blocks merging (GitHub Docs, "Troubleshooting required status checks"; "Using conditions to control job execution"). SLSA v1.0 and in-toto (Torres-Arias et al. 2019, USENIX Security) fail closed on missing provenance.

**The negative space.** The nearest neighbours each stop one step short. Denning's lattice is monotone, but its labels rise through computation; ours fall. Provenance semirings propagate annotations but have no age and no threshold. Libkin's certain answers refuse to let unknown become true but have no clock. Belnap's "neither" is told-nothing but is not derived from age. Age of Information has the clock, and Query-AoI has the reader's instant, but neither has a lattice or a renderer law. Occupancy models, false-zero ecology and completeness assertions formalise measured-zero versus unwitnessed in three fields, and none names an instrument-coverage field in a data document. Prometheus and Grafana draw the right distinctions in product behaviour and still permit promotion by configuration. Eaton and Song & Szafir measure the misreading on charts, not on staleness and not on dashboards. On GitHub, only a job skipped by a job-level `if` condition reports Success and satisfies a required check, while a required check that never runs (for example, because path or branch filters meant the workflow was not triggered) stays Pending and blocks merging. No source found states a freshness-state monotonicity rule for presentation layers with a referee that enforces it.

**Second sweep (2026-11-02).** Readers. Eaton, Plaisant & Drizd (2005) is now read in primary form (HCIL-2005-05 preprint; the LNCS record, DOI 10.1007/11555261_68, verified): n = 30, ten per display, and under the zero-encoded "Misleading" display no participant answered any missing-data question correctly while all asserted a trend; the quotations were reassembled from a raw text dump and must be re-checked against the PDF before quotation. Its first reference, Babad & Hoffer (1984), "Even no data has a value," CACM 27(8):748–756, DOI 10.1145/358198.358204 (record verified, content not read), is a candidate 1980s hub for the information value of a null. Three controlled studies on absence join the two already cited: Bäuerle, van Onzenoodt, der Kinderen, Johansson Westberg, Jönsson & Ropinski (2022), Computer Graphics Forum 41(3):235–246 (EuroVis; DOI 10.1111/cgf.14536), n = 732, three ways of showing missing values in parallel coordinates; Song, Fu, Saket & Stasko (2021), IEEE VIS short papers (DOI 10.1109/VIS49827.2021.9623328), omitted versus estimated-with-error-bars points changing the decision workflow; Ben Shoshan, Lanir, Goldstein & Mokryn (2026), arXiv:2601.07234, detection of expected-but-missing categories rising sharply when readers are prompted to look for absence. Still no study of readers facing a stale-but-present value, and nothing on dashboards. Data contracts, read first-hand. OpenTelemetry's `metrics.proto` carries `DATA_POINT_FLAGS_NO_RECORDED_VALUE_MASK`: "This DataPoint is valid but has no recorded value. This value SHOULD be used to reflect explicitly missing data in a series, as for an equivalent to the Prometheus 'staleness marker'"; this is the point-level dark the calculus asks for, with no algebra and no coverage field. OpenMetrics goes the other way: "There is no special marker or signal for this situation" and "NaN MUST NOT be considered a missing value". Vendors split. Datadog's monitor docs make "Evaluate as zero" the default for Count queries on no data ("Empty result is replaced with zero and is compared to the alert/warning thresholds"), promotion by default on exactly the signal class where "nobody came" and "nothing was measuring" coincide; Grafana's standard "No value" option defaults to a hyphen and connecting nulls is a per-panel opt-in; a Dynatrace staff reply in a 2022 community thread states "No data and 0 mean two completely different things" (staff role inferred from content). Nearest formal neighbours for never-promote, still short of it. The stream-processing watermark (Akidau et al. 2015, PVLDB 8(12):1792–1803; Akidau et al. 2021, PVLDB 14(12):3135–3147, which names "reasoning about missing data" and "a reliable signal of pipeline health" as what watermarks are for) and Naiad frontiers (Murray et al. 2013, SOSP) are monotone completeness markers propagated through every operator: two-state, with no dark distinct from not-yet, stopping at the engine boundary; the min-of-inputs propagation rule is the standard reading and was not quoted from the papers. QTrail-DB (Asiri & Eltabakh 2023, DATA 2023; arXiv:2303.06720) and ULDBs (Benjelloun, Das Sarma, Halevy & Widom 2006, VLDB) carry quality and lineage annotations through relational operators with monotonicity unstated; Krishnan et al. (2015), "Stale View Cleaning," PVLDB 8(12):1370–1381, treats a stale derived view as a cleaning problem over lineage (content from a search summary). None carries a freshness state into a rendered value or states a renderer-side rule; the negative-space claim stands, narrowed. Age of Information for human readers remains absent: the IEEE Access 2025 review "From Age of Information to Age of Digital Twin" (DOI 10.1109/ACCESS.2025.3591589; record only) and every AoI-plus-digital-twin work found for 2022–2026 are scheduling or synchronization. Platform. GitHub's page on skipped required checks was read (the three-valued semantics are set out in P12): a required check skipped by an `if:` condition reports Success and does not block, while a never-triggered required workflow stays Pending and blocks, so §5's "promotion on absence" is the conditional-skip case. Venues. ACM JDIQ now carries a confirmed APC exposure under ACM Open (2026 conference rate $350 non-member; journal rate unconfirmed; "waivers are rare"), which weighs CHI 2027 Posters (2027-01-21 AoE) and arXiv cs.DB higher; since 2026-01-21 arXiv's automatic endorsement needs an academic email and prior arXiv authorship in the domain, so the personal-endorsement route in step 2 is the only one and "arXiv staff cannot waive endorsement requirements".

## Evidence each claim rests on

| Claim | Pointer | Tier |
|---|---|---|
| Fog law: null renders DARK never 0; a measured zero is 0 with its age; coverage stated not inferred; a missing CI check is DARK not green; `continue-on-error` that paints success is a violation | the-broadcast `docs/papers/01-truth-tracking.md` §5 | PUBLISHED (v1.0, 2026-10-30) |
| `frame/1` law: unmeasured → null → dark; every value carries age; producer states threshold; renderer may reshape, never promote; `state` derived and re-derived by a validator | DARK: needs public evidence (a public repro or measurement) before it can be claimed | DARK |
| Blank boot exports every node dark with null value; after one replayed day signalled nodes current, unsignalled dark; nothing promoted; field hash untouched | DARK: needs public evidence (a public repro or measurement) before it can be claimed | DARK |
| Nameplates `latent` / `live` / `dark` (last η = 0) are evidence status, not geometry; the row never copies ρ | DARK: needs public evidence (a public repro or measurement) before it can be claimed | DARK |
| Coverage rule: `hours_covered`; `DayFact(None, 24)` is a measured zero; `(None, None)` stays open; an early version fabricated measured zeros into an append-only ledger; fix on the instrument side | slopnet README; `src/slopnet/instrument.py`, `prequential.py`; 47 tests | PINNED |
| Rungs `dark` < `counting` < `counts` (median of fully witnessed days, correct within ×2 + 1) | slopnet README | PINNED |
| Confession and glass-door faces leave missing organs null; unknown tiles dark with z = null; the codebook never mints labels | DARK: needs public evidence (a public repro or measurement) before it can be claimed | DARK |
| A node or role the field does not hold reads None, never 0.5 | DARK: needs public evidence (a public repro or measurement) before it can be claimed | DARK |
| The site renders a stale host report as DARK; `/healthz` and `/authority` verified 2026-11-01 | the-broadcast PRs #81, #83; AGENTS.md | PINNED (site tests) |
| `test/workflows.test.js` refuses `continue-on-error` / `if: always()` that paint green | the-broadcast paper §7; `.github/workflows/` | PUBLISHED + PINNED |
| CI outage 2026-10-23 → 2026-10-31 treated as DARK; hand releases only by recorded owner override with local checks named in each tag; 151 truth runs, 121 green / 30 red (2026-09-15 → 2026-11-01) | GitHub REST, counted 2026-11-01 | MEASURED |
| A required check is satisfied when "successful, skipped, or neutral"; a job skipped by an `if:` condition "will report its status as 'Success'" and does not block even when required; a never-triggered required workflow stays "Pending" and blocks | GitHub Docs, About protected branches (read 2026-11-01); Troubleshooting required status checks and Using conditions to control job execution (read 2026-11-02) | external doc; verified 2026-11-02 |
| HCI effect of DARK versus 0 on real readers | — | DARK (no study) |

## DARK (no number is typed)

- Reader behaviour: detection of dark, estimation bias under stale, perceived quality. No study exists; the Song & Szafir design is the template.
- Whether the producer thresholds (2700 s, 10800 s) are well chosen. They are stated, not measured against anything.
- How many of the 30 red runs were billing refusals rather than failures.
- Any baseline repository without the rule.
- Adoption outside the owner's repositories.

## Threats to validity

The lattice has three states by decision, not by derivation; a conflict state (two producers disagree, Belnap's "both") is not modelled. Thresholds are constants chosen by the producer. Every instance lives in one owner's repositories, two of them private, so the pinned tier is a test suite the reader cannot run without access. The fabricated-zeros incident is one event in one instrument. The CI mapping is observed on one repository with no branch protection, where the merging seat merges its own green PRs. The platform semantics are quoted from documentation; the dedicated page on skipped required checks was read on 2026-11-02 and narrows the promotion-on-absence claim to jobs skipped by a condition, since a never-triggered required workflow blocks. Nothing here measures a human.

## What this paper is not

Not a user study. Not a new many-valued logic; Belnap's exists and is cited. Not a proposal to change SQL nulls. Not an Age-of-Information scheduling result. Not a dashboard product or an SRE handbook. Not the architecture paper (P1): the engine's belief representation appears only as a producer of faces. Not the trust-tier paper (P12): the η ladder appears only where dark meets CI. No number from any earlier deployment the engine descends from appears here.

## Luke's steps, if he wants to submit

1. Pick the shape: JDIQ (the full calculus, journal, rolling) or CHI 2027 Posters (lattice plus validator in 4 pages, 2027-01-21 AoE, anonymized). Both can run; the poster is non-archival.
2. arXiv: register at arxiv.org with organization "Independent" and link ORCID. Start a submission in `cs.DB` with cross-list `cs.HC`; the endorsement email arrives with a six-character code. Open a recent cs.DB abstract page (Razniewski et al., arXiv:2305.05403 is one), click "Which authors of this paper are endorsers?", and send the code with the PDF to one or two who know the area. One `cs` endorsement also covers P12.
3. Open https://dl.acm.org/journal/jdiq/author-guidelines in a browser (bots are blocked) and note the APC under ACM Open, the review model and the page budget.
4. For CHI Posters: create a PCS account, strip name, repo names and site URL, keep to 4 pages, submit by 2027-01-21 AoE; one author registers; a pre-recorded video is allowed.
5. Before any submission: run the frame validator tests in both repos, the 47 slopnet tests and `npm test` for the site's DARK rendering, so every PINNED row is current on the day.
6. Decide whether the Broadcast outage numbers go in; they identify the author at a blind venue.
7. Log the submission in the authority record when there is a receipt.