A chain rarely halts from nothing. It slows first. The baseline is how you hear the slowing.
Tuesday named the detection layer as a set of tripwires. The height-divergence watch, the equivocation alert, the halt-decision signal: each fires on a discrete event that has already happened. A fork exists or it does not. A validator double-signed or it did not. Those are the right signals for the moment of failure, and they are silent right up until that moment.
A whole category of trouble never trips a tripwire until it is too late. A chain does not usually halt from nothing. It slows first. Block intervals stretch from six seconds toward eight, then nine. A handful of validators start voting a beat late. The gap between the fastest and slowest signer widens week over week as one operator's hardware ages under a growing state. None of that crosses a threshold on any single block. All of it is the chain telling you, in the only language it has, that its margin is thinning.
Today names the layer that reads that language. The move is to stop grading each block pass-or-fail and start grading the shape of the last thousand blocks against the shape of normal. Three constructs carry it: the block-interval baseline learns what healthy timing looks like as a distribution, not a target; the per-validator performance panel ranks signers against each other so one degrading operator surfaces before it drags the set; and the pre-halt degradation signal fires on the slow slide that precedes the discrete break.
Petrov's treatment of distributed systems in Database Internals (Part II, pp. 330–331) draws the line this lesson lives on. A BFT protocol promises safety and liveness only while faulty voting power stays under the threshold, classically one third. That promise is binary at the boundary and says nothing about the approach to it. A network at 30% degraded voting power is still safe and still live. It is also one bad week from the cliff, and the protocol will not warn you, because from inside consensus nothing is wrong yet.
The monitoring cannot be a check against the protocol's own guarantee. The guarantee holds until it shatters. What an operator needs is a read of the approach, and an approach is a trend in a continuous quantity. Here the SRE discipline (Beyer et al., Part III, pp. 330–331) supplies the governing rule: monitor distributions, not averages. An average block time of 6.4 seconds can hide a tail where one block in fifty takes fourteen. The average looks healthy. The tail is the chain gasping. A mean is a single number that has already thrown away the exact information a degradation read depends on.
The founding act of baselining is refusing to compress. A healthy chain does not produce six-second blocks. It produces a distribution of intervals centered near six seconds with a characteristic spread and tail. That distribution is the baseline. Store it as its quantiles: p50, p90, p99. A block-interval baseline that remembers p50 = 6.1s, p90 = 6.9s, p99 = 8.2s over a healthy month carries a claim a threshold never could. It says not merely how fast the chain runs but how reliably it runs that fast, and reliability is precisely what erodes before a halt.
The block-interval baseline is built by collecting block timestamps over a long window, differencing consecutive timestamps to get intervals, and reducing to a quantile summary over a healthy reference period. That summary is frozen. Live monitoring computes the same quantiles over a rolling recent window and compares. The comparison is not point-in-time. A single slow block is noise. The signal is a sustained shift in a quantile: the rolling p90 sitting above the reference p90 long enough that the shift cannot be a run of bad luck.
The per-validator performance panel is the same reduction applied per signer. For each validator over the window, compute its share of signed blocks, its median vote latency, and its latency tail. Rank them worst-first. The value is comparative. Absolute latency depends on geography and hardware the network does not control. Relative position, and change in relative position, is the judgeable thing. A validator that was mid-pack a month ago and sits last today has degraded relative to a set that held steady, and that relative slide is the read.
The pre-halt degradation signal composes these with a deliberately high bar. It fires when the interval baseline shows a sustained upward tail-shift and the panel shows the degradation concentrated or spreading rather than uniform noise. Two shapes matter, and they demand different responses:
The interval tail stretches because a small, identifiable group of validators is slowing. An operator problem. The signal names them; the fix is hardware, peers, or disk. The chain's margin is intact once they recover.
The tail stretches and the whole set drifts slower together. A network problem — growing state, mempool load, propagation bottleneck. No single operator can fix it, and it moves the entire set toward the liveness boundary at once.
Paging one operator about a network-wide slowdown wastes the page and misses the move. The signal must distinguish the shapes — which is exactly what the performance panel exists to reveal.
Take a Cosmos-style chain with a 30-validator active set, six-second target block time, and a month of clean history. The block-interval baseline reads p50 = 6.0s, p90 = 6.8s, p99 = 8.0s. The panel is flat: every signer holds 3–4% of blocks, vote-latency medians clustered 180–340ms by geography, no tail past 900ms. This is the frozen normal.
Three weeks later the rolling read drifts. The rolling window shows p90 = 7.4s and p99 = 10.1s while p50 holds at 6.1s. The median is fine, which is exactly why an average-based dashboard shows green: mean block time moved 6.3s to 6.5s and nobody blinked. The tail tells the real story. One block in ten is now noticeably slow, one in a hundred very slow. The chain is producing, but its worst blocks are getting worse.
The panel resolves the shape. Twenty-eight of thirty validators sit where they did. Two do not: both mid-pack before, both now carrying vote-latency medians that doubled and tails past three seconds, both the last-committed signer on a rising share of the slow blocks. Concentrated degradation. The pre-halt degradation signal fires with the two validators named: the tail is stretching, the cause is these two operators, network margin is intact, recommended action is operator outreach, not a halt.
The two operators check their nodes. Both run disks filled past 80% as state grew; the I/O contention added latency to state reads during block execution. They provision faster storage, re-sync, and rejoin. Over the next week rolling p99 falls back toward 8.2s and the panel re-flattens. No block was ever missed. No tripwire ever fired. The chain never came within sight of a halt, because the degradation was read as a trend and answered while it was still a trend.
Tuesday's 2026-07-07 fork-detection lesson built the discrete tripwires; today builds the continuous read beneath them. Tuesday catches the break the instant it happens. Today catches the erosion that precedes the break, and buys the operator days of warning that a tripwire, by its nature, cannot. The 2026-06-20 liveness lesson made the rule today extends: never grade a validator from its own logs. There it meant reading the chain's record of your uptime; here it means reading the chain's record of the whole set's timing and grading each signer against its peers. And 2026-07-04 sits downstream as the answer of last resort. The pre-halt degradation signal exists precisely so the coordinated genesis restart stays a rehearsal and never becomes a live event.
Every construct here is a distributional computation before it is any operator's dashboard. Today's R and Python lesson writes the pipeline. It takes a table of block timestamps and per-validator vote records, explores the interval and latency distributions in R where the histogram and quantile summary are one line each and the eye can catch a stretching tail, then enforces the frozen baseline and rolling comparison in Python where the same reduction becomes a scheduled check that emits the degradation signal. The Ops lesson tells you normal is a distribution and the tail is where degradation lives; the Dev lesson shows the exact group_by/summarise in R and the pandas quantile reduction in Python that make it a running monitor.
A chain that only watches for the break is watching too late. The break has a runway, and the runway is measured in the shape of the blocks, not in any single block's success. Learn your chain's healthy block-interval distribution and freeze its quantiles. Rank your validators against each other so a single degrading operator surfaces before it costs a missed block. Fire the pre-halt degradation signal on the sustained tail-stretch, and make it tell you whether the cause is concentrated or diffuse, because the two shapes are two different emergencies. Do that and the tripwires become the layer you almost never need.
Look at your own chain's monitoring. If it shows you a mean block time, it is showing you the one number engineered to hide the failure you most need to see. Give it the distribution, and it starts telling you the truth early enough to use.