The SLO is green while users report failed reservations

Understand the likely causes

• The SLI may observe only server completions, exclude valid rejected work, mix incompatible numerator and denominator sources, aggregate away the affected population, or treat missing telemetry as zero errors. A long-window objective can also pass during a genuine short current outage without any query defect.

Freeze the claim and its definition

Record the exact dashboard time range, timezone, SLI definition revision, target, source, eligibility policy, and freshness. Gather a few sanitized examples of the reported failure with approximate times and journey type. Do not copy private customer payloads into the diagnostic record. Ask whether the complaint concerns availability, latency, correctness, or all three. A missing reservation after a 200 response can expose a correctness gap that an HTTP-only indicator was never designed to detect.

Reconstruct a tiny event population

Classify known synthetic attempts against the written contract. The offline fixture shows that ignoring missing completions reports perfect success, while counting the eligible timed-out attempts reports eighty percent. This does not establish the correct production policy automatically; it exposes the effect of one explicit choice. Check where an attempt first becomes observable and how a completion deadline is represented. A counter that starts only after success cannot measure attempts that never reached that stage.

events = ["good", "good", "good", "good", "missing"]
completed = [event for event in events if event != "missing"]
good = events.count("good")
print(f"completion_only={good / len(completed):.0%}")
print(f"eligible_attempts={good / len(events):.0%}")

completion_only=100%
eligible_attempts=80%

Compare scope before changing thresholds

Inspect bounded route-family, region, and outcome slices with eligible counts. Compare the same window and definition so the analysis does not create another population mismatch. Separate read and write journeys when their promises differ. If the aggregate hides a small harmed group, decide whether that group needs a distinct objective or diagnostic view. Do not create unbounded per-user metric labels to solve the problem; use approved privacy-aware event evidence where individual investigation is necessary.

Repair the failed measurement contract

Correct eligibility, boundary coverage, late-data handling, or collection health according to the diagnosed mismatch. Keep historical reports interpretable by versioning semantic changes. If the long window is simply masking urgent recent harm, retain it for accounting and improve current-impact alerting rather than weakening the target. Reconcile missing confirmations independently of the chart repair. A trustworthy metric helps decide what to do; it does not itself repair the user’s reservation.

Keep it from recurring

• Own and version the SLI contract, retain semantic fixtures, and review exclusions with product and service owners. Display freshness, counts, units, and scope beside ratios. Recheck instrumentation after routing or business changes, and keep correctness evidence distinct when the user promise requires durable state.