The Line That Never Widened
Copyright© 2026 by Alexander Winston
Chapter 14: The Console That Owned Nothing
May 2000 through March 2001
The management-products team had rebuilt Curtis’s half-desk reconstruction on a single large monitor in the Provo lab, and for about four minutes it looked like the best thing anyone in the building had shown him all year.
Every source he remembered spreading across his own desk was there at once: Compaq’s hardware events, the UnixWare system messages, Cluster Services’ membership and resource history, the NSS volume state, the eDirectory object changes, the GroupWise agent logs, the print and NCP status lines. One screen, one timeline, no folder anywhere in sight.
Then Curtis leaned in and read the sequence a second time. According to the display, GroupWise had finished recovering before the failed node lost power.
Nobody had faked anything. The team traced it back within the hour: a hardware event got stamped the instant the controller detected it, a UnixWare message when the operating system wrote its own log, a trap only once the management server actually received it over the wire, a GroupWise entry only after an internal buffer finally flushed to disk. Four honest clocks, four honest delays, one dishonest-looking picture the moment they all landed in the same list without anyone marking which was which.
One of Lillian’s junior engineers wanted to fix it the fast way — reorder the display by the sequence everyone already knew had actually happened, since the underlying records themselves weren’t being touched. Lillian wouldn’t allow even that much. The moment the screen showed an order the records didn’t actually prove, she said, it stopped mattering that the underlying data was still honest; the only thing a viewer would ever see was the display, and the display would be lying on their behalf whether anyone intended it to or not.
Lillian Hargrove, who ran the management-products group and had been proud of that screen for exactly as long as it had taken Curtis to notice the problem, killed the demonstration before anyone from outside the room saw it. “We don’t show this to a customer, or to our own executives, until we can defend the order it’s claiming,” she said. “A clean-looking screen that’s wrong is worse than Curtis’s desk ever was.”
Sarah recognized the sentence before Lillian finished it. It was the same discipline that had governed every product this platform had produced so far, restated for a screen instead of a directory or a database: earn trust by stating plainly what you don’t yet know.
She hadn’t come to Provo expecting to recognize anything. Lillian’s group had been building toward this demonstration for well over a year, on a budget and a schedule that had never once crossed Sarah’s desk for approval, and the room Sarah had walked into wasn’t a kickoff — it was a team already fluent enough in its own mistakes to catch one in front of the person it most wanted to impress.
The cross-product review that followed was Lillian’s meeting, not Sarah’s, and she ran it that way from the first sentence. Marcus came for clustering, Diane for GroupWise, Priya for print, Avery’s people for Compaq, along with engineers representing eDirectory, NSS, and NCP — everyone whose product was about to be asked to say something true about itself on somebody else’s screen.
What came out of it was a common event envelope, modest enough for the year it was actually being built in: every participating agent or adapter would supply, wherever its source allowed it, the original product and source; the physical node and, kept entirely separate, the virtual service or resource identity involved; both a source timestamp and the moment the management server actually received the event; an identifier, a severity, and plain human-readable text; the object or resource affected; a flag for whether the entry described a condition, a requested action, a completed action, or an outcome still genuinely unresolved; and a reference back to the untouched original record, wherever that record actually lived. The console could normalize fields so events could be searched side by side, but the raw entry and the source’s own wording had to survive underneath the normalized version. Translating was allowed. Rewriting was not.
Eric made the platform question concrete before anyone could leave it vague. The console service itself — the correlation engine and the event repository, the actual center of the house — would run natively on UnixWare. That said nothing about where an operator’s own screen happened to sit, and nothing about every adapter either: an agent installed to watch a NetWare server belonged on that NetWare server, an agent watching Windows or another vendor’s system belonged there too, while an adapter collecting from a source that couldn’t host code of its own — an SNMP-only device, say — could run centrally without changing what it was reporting on. What mattered was where the service that made sense of all of it actually lived, and Novell wasn’t going to put that anywhere but the platform it was asking its customers to grow into.
An engineer from the NetWare side of the room asked, not unreasonably, whether that decision quietly told existing NetWare-only customers they’d bought a management product with an expiration date. Eric didn’t pretend the tension wasn’t real. “Their agents keep running right where they already are, and we keep supporting them for as long as the coexistence period runs,” he said. “What we won’t do is put the correlation engine and the repository underneath everything on the platform we’re already helping people leave. That’s not a slight against NetWare. It’s just where the next twenty years of engineering time is actually going.”
One of the NSS engineers asked, mostly out of curiosity, whether the object relationships eDirectory already stored couldn’t simply be extended a little further to save everyone the trouble of a second database. It was the kind of question that came up, in one form or another, nearly every time a new product met the directory for the first time, and it gave the meeting exactly the excuse it needed to reaffirm a line the directory and clustering work had already drawn years earlier rather than assume everyone in the room still remembered it. eDirectory identified the administrator, held roles and the object relationships a console needed to find a service in the first place, and that was the whole of its job here, exactly as it had been every time this question had come up before. The actual event stream — traps, log lines, status changes by the thousand — belonged in ManageWise’s own database and its own retention policy. Pouring all of that into a replicated identity service would have turned it into a warehouse nobody had ever designed it to be.
Eric answered the question the same way he’d answered some version of it in nearly every architecture review this platform had ever held, patiently, as though it deserved to keep being asked. “A directory tells you what something is and who’s allowed to touch it. It was never built to tell you what happened to it forty thousand times a day. Those are different jobs, and giving them the same address doesn’t make them the same job.”
The first full lab test produced forty alarms out of one fault, and everyone in the room had more or less expected it to.
A storage path was cut on the certified Compaq cluster. The controller reported the loss. UnixWare logged an I/O delay. NSS paused and resumed its own requests. Cluster Services noted a resource-monitor delay while it checked whether anything actually needed to move. GroupWise reported slower access than usual. And the console, dutifully, received every single one of those reports as its own separate event, because every one of them was, technically, true.
The stack itself had behaved exactly right. Compaq’s redundant path carried the load without complaint, NSS never left the node it was already mounted on, and Cluster Services correctly refused to touch a resource whose ownership had never actually been threatened. The screen, meanwhile, made all of that competence look like forty unrelated emergencies happening at once.
Lillian’s team built correlation rules to group the related entries into a single incident while leaving every original record reachable underneath it — the summary line could read probable initiating condition: loss of one certified storage path, but it was not allowed to claim more certainty than the order and topology actually supported.
Marcus drew the harder line before anyone got comfortable with the correlation working as well as it did. “Grouping the alarms is fine. Grouping them into one button that moves the resource is not,” he said. “A screen that sees my resource pause doesn’t get to decide whether membership changed, whether fencing succeeded, or whether a destination node is actually allowed to take storage. That’s still ours.” Diane said the same thing for GroupWise in her own words — only GroupWise could judge whether its own queues and databases were actually ready to stop or restart — and Priya said it a third time for print, protecting the same unresolved physical-outcome category she’d been guarding since the queue project.
The argument that actually made it into the room, though, wasn’t between reasonable people and an unreasonable idea. Lillian’s own team wanted a prominent button that simply said Fix, because every customer who’d ever called a help desk wanted exactly that button to exist. Nobody around the table thought the desire was foolish. What they rejected was the shortcut underneath it — control without an owner.
Lillian didn’t fight the rejection nearly as hard as some of her own engineers expected her to. She’d already sat through the split-brain demonstration Marcus’s team had run the year before, and she said as much out loud: a button that could move a resource without knowing whether the resource could safely be moved was the exact failure the clustering group had spent two years designing against, and she wasn’t going to reintroduce it one layer up just because a screen made it easier to reach.
What came out of that argument, eventually, was a delegated-action model rather than a single fix-everything command.
An authorized administrator could request an operation from the console — place a node into maintenance, move a cluster resource, restart a GroupWise agent, pause a print queue, acknowledge a hardware alarm — and the console would pass that request along to whichever product actually owned the resource, through that product’s own documented administrative interface. From there, the owning product had to recheck the administrator’s eDirectory identity and current rights, verify its own current state, apply its own safety rules without exception, accept or refuse the request entirely in its own terms, hand back a specific result, and write an audit record naming who asked, which product decided, and what actually happened as a consequence.
The console itself kept none of the power that made a shortcut tempting. No universal hidden administrator password. No impersonating a product owner. No writing directly into someone else’s data files. No softening a refusal into a vague, generic failure that told an operator nothing.
Three lab demonstrations proved the boundary held rather than just describing it. A help-desk operator could see the GroupWise incident clearly on the console and still couldn’t move the post office — Cluster Services itself refused the request because the operator held no cluster authority, and the console displayed the refusal exactly as it was given, not softened into an unexplained gray icon. A cluster administrator requested that same kind of planned resource move, and Cluster Services accepted it only after the current owner quiesced correctly and the destination proved it could legitimately take ownership. And in the third test, a request arrived during a deliberately ambiguous partition, and the console simply showed Cluster Services’ own answer — exclusive ownership cannot be established — with no bypass offered anywhere in the interface, because none existed to offer.
The help-desk demonstration was the one that stuck with Lillian afterward, she told Sarah, precisely because it was the least dramatic of the three. Nothing failed. Nobody’s data was at risk. A person without the right simply couldn’t do the thing, and the screen said so in plain words instead of leaving them to guess whether the button itself was broken.
Ellen’s contribution to the design came from a place none of the engineers had started from. Fewer consoles, she pointed out, could just as easily mean fewer accountable people rather than fewer accidents — one careless or dishonest operator now had a wider reach than ever, purely because the view had gotten wider. Delegated rights, named actions, and durable records weren’t features she was asking for as a courtesy. They were her actual condition for letting the product anywhere near the bank at all.
She’d said something close to this before, years earlier, about a bank employee who’d needed four separate accounts just to do one job. It had taken Novell the better part of five years to answer that problem honestly. She wasn’t interested in watching the same institution build its opposite by accident — one account with too much reach, simply because reach was easier to sell than restraint.
Avery came to the vendor-integration review already knowing which of his own engineers would end up staffing this work permanently, which told Sarah more about how seriously Compaq was taking the console than anything written in the certification documents themselves.
To read the complete story you need to be logged in:
Log In or
Register for a Free account
(Why register?)
* Allows you 3 stories to read in 24 hours.