How watches work

A watch looks like a sticky note and behaves like a monitor. This page is what’s underneath: what gets compiled from your sentence, when the checks run, and how a watch moves from armed to closed.

What a watch holds

Four things:

Your intent, verbatim. Never paraphrased. It’s what you see quoted back, and what the Investigator reasons about when the watch comes due.
A horizon — the review-by date. Fourteen days if you don’t give one.
Compiled checks, when your words name something measurable. Zero, one, or several.
A scope binding — the exact connection the session was already using. A watch can never reach further than the session that created it, and if that connection stops working, the watch goes Blocked rather than quietly failing.

The two tiers

The tier is decided by what your words gave the Investigator to work with:

deadline-only — nothing measurable. It holds the date and checks in when it arrives. No machine checks, so nothing to re-verify: closing is an acknowledgement.
signal — one or more compiled checks, run on a cadence. Most watches land here.

What it can compile

Three probes today, all read-only:

RDS instance status — fires when an instance enters a listed state (stopped, available, and so on).
EC2 instance state — the same, for an instance.
CloudWatch metric threshold — a metric with dimensions, a statistic (Average, Sum, Maximum, Minimum, p90, p99), a comparator, and a threshold.

If your sentence names nothing it can measure, you get a deadline-only watch. It never invents a metric to look diligent.

How the checks run

A background sweep picks up armed watches whose next check is due or whose horizon has arrived, and runs their probes.

Cadence is six hours by default, and can’t go below fifteen minutes.
The datapoint count is configurable. A metric check fires when that many returned datapoints breach its threshold. The default is one; choose a higher count when the condition must hold across multiple datapoints instead of firing on a single spike.
Missing data is a decision, not a default. Some metrics only report when something happens: a 5XX counter emits nothing at all while a service is healthy. For those, no data means ok. For gauge-style metrics like CPU, no data usually means the probe is pointed at the wrong thing, so it reads unevaluable — which is why you sometimes see “checked 8h ago — unevaluable” instead of a green result.

Each run is recorded. The detail pane shows the last twenty, newest first, with the one that caused a fire marked.

The states a watch moves through

State	What it means
proposed	The Investigator suggested it; waiting for you to accept.
armed	Live. Being checked, or waiting for its horizon.
fired	The horizon arrived or a check tripped. A case is open; it’s in your list.
verifying	You said you fixed it; the checks are re-running right now.
resolved	Verified clear, and closed with a receipt.
blocked	The checks can’t run — usually a connection it can no longer reach.
dismissed	You ended it by hand. No undo.

Only armed watches are swept. A fired watch stays fired until it’s verified, dismissed, or resolved — it will not quietly re-fire or time out underneath you.

Limits

An organization holds up to 50 armed watches at once. That cap is deliberate: watches are meant to be temporary commitments you take on during risky work, not a permanent monitoring layer. If you want something watched forever, it belongs in your alerting stack — and the Investigator can investigate those alerts when they fire.

Next: Security & access