SLOs from history, not hope

An SLO is a target value for an SLI. That definition has an order in it: the indicator exists first, and the target is a value on its scale. A team that sets "99 percent" before it has an indicator has set a target on nothing, and the first thing the indicator does when it arrives is embarrass the target.

Harborlight had lived with "basically 99" for a year. The number came from a meeting, not a query, and the settlement team had planned around it: a manual check on the report at 7 am, no contingency for a late one. When the measured month came in at 95.14, the target was not merely wrong; a downstream team had built a morning around it. That is what a target does. People plan on it. So it has to be a number the pipeline can keep.

• Target - the value of the SLI the reader has agreed is good enough, over a stated window. "95 percent of hourly partitions good over any rolling 30 days."
• Achieved - what the SLI actually returned over the same window. Harborlight: 95.14 percent. The target is chosen against this, and below it.
• Error budget - one hundred percent minus the target, in events. At 95 percent over 720 partitions that is 36 bad partitions; at 99.9 it is 0.72. Session 3 spends it hour by hour; tonight it only decides which night the budget runs out.
• Exhaustion night - the first night the cumulative count of bad partitions exceeds the budget. From that night on, the promise is broken regardless of what happens next.
• The p50 night - the median night's compliance. At Harborlight the median night is clean, 24 of 24. Promising that for every night is the 99.9 trap.
• Review date - the date the target is allowed to change. A target without one either never moves or moves in every argument.

• "Don't pick based on current performance." The warning is against locking in a heroic month. If the pipeline hit 99.6 last month because two engineers babysat it through a migration, 99.6 is not what the pipeline delivers; it is what the two engineers delivered, and they will not do it every month.
• "Keep it simple." One target, one window, one indicator. A target with a weekday clause, a holiday exemption and a separate number for the last hour of the day is a target nobody can hold in their head, which means nobody can plan around it.
• "Avoid absolutes." 100 percent is not a target; it is a wish. It leaves no budget at all, so the first bad partition of the month is a broken promise and every night after it is indistinguishable from the last.
• "Have as few SLOs as possible." Each one is a promise somebody has to check, report and defend. Three that matter beat twelve that get ignored.
• "Perfection can wait." The full phrasing is that it is better to start with a loose target that you tighten. A loose target kept teaches the reader to trust the number; a tight one broken teaches them to ignore it.

"Do not pick from current performance" and "read the history before you write the target" sound opposed. They are two halves of one rule. The history tells you what the pipeline achieves without heroics: the typical month, the bad month, the spread between them. Current performance, in the sense the guidance warns against, is the best recent number. You read the history to find the typical month, and you set the target below it, not at the best one.

Harborlight's typical month is around 95 to 96 percent. Its best recent month was the migration month at 99.6. Its best recent night is 24 of 24, and 25 of the last 30 nights look like that. The target that the guidance points to is under 95.14: a number the pipeline clears in an ordinary month with nobody staying late. The numbers it warns against are 99.6 and 99.9.

Same thirty nights, same 35 bad partitions clustered in five incidents. The only thing that changes across the rows is the budget, which is one hundred percent minus the target, times 720.

• 95 percent survives the month by one partition. That is real headroom, but thin: one more bad hour on night 27 and it breaks on night 27 instead.
• 97 percent survives the late load and the outage and dies on the corrupt batch. Night 15's six bad partitions take the count from 17 to 23 against a budget of 21.6.
• 99 percent allows 7.2 bad partitions. The outage on night 9 alone is 14. The promise does not survive a single incident of that shape.
• 99.9 percent allows 0.72 of a partition. Less than one. The three late partitions on night 4 are four times the whole month's budget.

In the meeting, someone has the nightly dashboard open. Twenty-five green nights out of thirty. The median night is perfect. "We are basically at three nines" is a true statement about the typical night and a false statement about the month, and the room hears the second one.

As a monthly promise, 99.9 percent of 720 partitions allows 0.72 bad partitions. That is not one bad partition; it is less than one. The first incident of any size breaks it, and Harborlight's first incident was the smallest of the five: three late partitions on night 4, four times the month's entire budget. From night 4 to night 30 the pipeline is in breach, and the 26 clean nights that follow do nothing to change that, because a broken promise does not heal.

A 95 percent promise the pipeline keeps is worth more to the settlement team than a 99 percent promise it breaks on night 9. That sounds backwards until you ask what the reader does with the number. They plan around it. A kept 95 tells them: expect roughly one bad partition in twenty, build the morning check to tolerate it, and trust the report the rest of the time. A broken 99 tells them nothing, because from night 10 the contract is in default and every report after it carries the same asterisk.

• Kept promises compound. Three months of a kept 95 and the reader stops re-checking the report by hand. Three months of a broken 99 and they build a shadow process.
• Budget is a currency only while there is some. At 95, there is budget left on night 30 to decide whether a risky backfill can run tonight. At 99, that decision was taken away on night 9.
• A loose target is not a low bar. It is the bar the history clears. 95 percent still means 36 bad partitions a month is the ceiling, and last month used 35 of them.

The target moves on a date, not in an argument. Harborlight's contract names the first day of the next quarter, and it names what has to be true by then for 95 to become 97: the coverage check from session 1 in production for the whole quarter, and the connector retry that the night 21 postmortem asked for, shipped and observed through at least one flapping night.

• Tighten after the fix, not before it. A tighter target does not make the pipeline more reliable; the fix does. The target follows the evidence that the fix worked.
• One step at a time. 95 to 97 is a budget of 36 falling to 21.6. Going to 99 in one move is a budget of 7.2, which last month's outage alone would have doubled.
• Loosening is allowed too. If a quarter's history says the pipeline no longer clears the target without heroics, the honest move is down, with the reason written in the contract. A target that only ever tightens is a target that will eventually be ignored.

The window in the contract is any rolling 30 days, and the query computes it for every night. A calendar month does something worse than being imprecise: it resets the budget at midnight on the first. Everybody learns that the safest time to ship a risky change is the second of the month, when the budget is full and the consequences of spending it are four weeks away. A rolling window has no such day. The budget you spend on the second is still gone on the twentieth.

If the platform you inherit reports SLO compliance by calendar month, the target line can stay, but the review conversation needs a one-line note: the calendar number and the rolling number will differ, and the rolling one is the honest one.