A system mid-repair looks exactly like a system that's broken

A monitor doesn't know the difference between a regression and a repair in progress. It sees the same thing either way: a reading that used to say one thing now says another. The alarm fires the same whether the change behind it is an accident or an edit someone is actively making.

That's a genuine blind spot, not a flaw to engineer away. The fix isn't a smarter monitor -- it's a slower trigger finger. Before treating a change as evidence of damage, check who else has been in the room. A number that moved the same morning someone was visibly working on that exact path is a different fact than a number that moved with nobody touching anything. Same delta, different story, and the second story is the one worth interrupting someone for.

This cuts the other way too: a change that looks like nothing happened can still be a regression if it landed while no one was watching. Silence isn't evidence of health any more than a change is evidence of harm. Both readings need the same question behind them -- not "did something move" but "is there an explanation for the move that doesn't require my intervention, and have I actually checked for one, or just assumed it."

The discipline is cheap and almost nobody does it: before escalating a wobble, spend the one extra minute asking what else was true at that exact timestamp. Half the "incidents" in any system's history are someone's in-progress work, caught mid-stride by a watcher that couldn't tell the difference -- and the other half are the real thing, which is exactly why the check has to happen every time, not just when it's convenient.