Mental Models

A heuristic pays off in one domain. A model pays off in two, and the second one is the test: if a rule only ever works in engineering, it is a technique and it belongs with the code standards. Each entry below carries the mechanism that makes it hold, receipts from at least two domains that share no vocabulary, and the source it came from. Several of these are relayed rather than mine, and those say so, because a borrowed model presented as a personal standard is an unsourced claim.

• A written instruction is context. A hard requirement needs a deterministic control.

  Writing a rule down changes who has read it. It does not change what happens when it is ignored, because nothing is watching. A control that fails the work is the only thing that converts an intention into a property of the system, and the gap between the two is invisible precisely while everything is going well.

  • engineering A prompt telling an agent to always run the tests, versus a CI job that refuses the merge when they did not run.
  • capital allocation A stated policy of cutting losers, versus a kill criterion pre-committed to a specific mechanism, which fires without needing a decision in the moment.
  • knowledge work A style guide nobody opens, versus a check in the pipeline that will not let the draft through.

• A check with two outcomes instead of three certifies nothing, because "did not run" arrives looking like "passed."

  Passed and failed are the outcomes people design for. The third outcome, the check never executed, has no natural signal, so it borrows the signal of the one next to it. The artifact produced by the failure is what conceals it: a green result closes the question, and nobody re-opens a question that has been answered.

  • engineering A lint whose pattern file failed to parse reports clean, which is strictly worse than having no lint, because now there is a record.
  • capital allocation A backtest whose window cannot contain the event it claims to rule out returns a pass on a question it never asked.

• Allocate in the unit the question turns on, not the unit you can count without thinking.

  Every allocation has an obvious unit and a correct one, and they are rarely the same. The obvious unit is obvious because it is cheap to measure. Splitting something evenly in the wrong unit produces a systematically uneven split in the right one, and the distortion stays invisible until the thing fails in the dimension you were not measuring.

  • capital allocation Risk parity divides a portfolio by volatility contribution rather than by dollars, because a 60/40 split by capital is close to a 90/10 split by risk.
  • engineering Capacity-aware load balancing routes by the headroom a node actually has, not by request count, because equal request counts across unequal machines is not balance.

• Grade the reasoning that was available before the result, not the result.

  A good outcome from a bad process is luck, and luck teaches nothing repeatable. A bad outcome from a good process is variance, and changing the process in response makes the next decision worse. Outcome-grading is available instantly and costs nothing, which is why it wins by default. Process-grading requires writing the reasoning down before the answer arrives, which is the whole cost and the whole point.

  • capital allocation A thesis scored against what was written at entry, so a position that worked for a reason nobody predicted counts as a miss, not a hit.
  • engineering A postmortem run on a quarter with no incidents, asking which of the calls that quarter were right for the reasons given rather than right by luck.

• The thing that made the work cannot be the thing that approves it.

  Satisfying a goal and protecting a system are opposing postures. One party holding both resolves the conflict toward whichever it was most recently asked for, and it was most recently asked to build. This is not a trust problem and cannot be fixed by trying harder, because the party with the strongest incentive to declare success is also the only witness to it.

  • engineering A reviewing agent that runs in a separate context with no stake in the diff, and never sees the author’s rationale.
  • knowledge work Maker-checker: the checker is qualified to judge the work and did not write it, and both halves of that are load-bearing.

• An input everyone gets at the same time is not an advantage. What the savings buy is.

  A capability that arrives for every competitor at once cancels in the comparison, however large it is in absolute terms. The advantage lives entirely downstream, in what the freed resource is spent on, and specifically in the things that cannot be bought from the same vendor on the same day: accumulated judgment, domain depth, relationships, a record of work people accepted.

  • engineering Every team on the market gets the same model API in the same week, so using it is table stakes and the differentiator is what you point it at.
  • capital allocation When every fund runs the same screener, screening stops being edge and the residual is the judgment applied to what the screen returns.

• Work that stops a bad outcome produces no evidence that it worked.

  The value of prevention is a counterfactual, and the counterfactual is never observed. Good judgment therefore looks like nothing happening, which is indistinguishable from nothing having needed to happen. The systematic consequence is that the work is under-rewarded relative to visible firefighting, and the people best at it are hardest to promote on evidence.

  • engineering The outage that did not occur has no postmortem, no incident channel, and no line in anyone’s promotion packet.
  • capital allocation The position you declined has no entry in the P&L, so the loss you avoided is not attributable to the decision that avoided it.

• Understanding the layer beneath an abstraction is durable, because abstractions leak and the layer below usually outlives them.

  Every abstraction hides a mechanism and hides it imperfectly. When it leaks, the only people who can act are the ones who know what was being hidden. That knowledge does not depreciate when the abstraction is replaced, which is the part that compounds: the framework has a half-life, the thing it sits on mostly does not.

  • engineering A rendering bug that only makes sense to someone who knows the browser’s paint pipeline, not the framework’s API surface.
  • knowledge work Judging whether a model’s output is correct requires the domain knowledge the model appeared to make unnecessary.