Why do Python libraries use a module-level sentinel object with `is` checks?

The pattern is a module-level marker object, created once, compared only with `is`: ```python _MISSING = object() def render(invoice, rounding=_MISSING): if rounding is _MISSING: rounding = HOUSE_DEFAULT ... ``` It exists to answer a question a default value cannot: **was this argument supplied at all?** **Why `None` is not always enough.** `None` is the usual "nothing here" default, and when `None` is not a meaningful value for the parameter it is the right one — do not reach for a sentinel by reflex. The sentinel earns its place when `None` is itself a legitimate, distinguishable input. In an invoice-PDF renderer, `rounding=None` can reasonably mean "do not round at all, print the raw figure", while *omitting* the argument means "use the house default of two decimal places". Collapse those two cases into one and you get the classic slow failure: a caller who deliberately asked for no rounding silently gets the default, the totals drift by fractions of a cent against the ledger, and because the reports only reconcile at month end, the defect ships and rides an entire three-week release train before anyone traces it back to the argument that was never distinguishable in the first place. The other places the same need appears are caches (a stored `None` result is a real cached value, not a miss), configuration layering (unset versus explicitly cleared), and partial update payloads (a field absent versus a field set to null). **Why `is` and not `==`.** Three reasons, and an interviewer usually wants at least two. First, identity is exact: a bare `object()` instance is equal to nothing but itself, and `is` cannot be overridden — no dunder participates, so no caller can spoof it. Second, `==` runs arbitrary user code: the argument may be an object whose `__eq__` returns `True` for everything, or one that raises, or an array-like value whose `__eq__` returns a non-boolean and blows up in the `if`. Third, identity is a pointer comparison, so the guard costs nothing on a hot path. The corresponding anti-pattern is a mutable default, `def f(x=[])`, used as a "was it supplied" marker: it is shared across calls and mutable by the callee. **Making the sentinel behave in production.** A bare `object()` has an unhelpful repr, so it shows up in tracebacks and help output as `<object object at 0x…>`. Give the marker a small class with a `__repr__` and instantiate it once, so signatures and error messages read as `MISSING`. The standard library does exactly this — `dataclasses.MISSING` is a single instance of a private marker class used to mean "no default was declared". **The failure mode worth knowing: identity does not survive serialisation.** Copying or pickling a sentinel produces a *new* object, so the receiving side's `is` check fails: `copy.deepcopy(_MISSING) is _MISSING` is `False`, and so is a pickle round trip. That matters whenever a call's arguments cross a boundary — a task queued to a worker process, a cached call re-hydrated from disk, a deep-copied configuration tree. Under `multiprocessing`, whose default start method on 3.14 is `forkserver` on Unix other than macOS and `spawn` on macOS and Windows, the child re-imports your module and creates *its own* sentinel object; anything you send to it is pickled. A sentinel that must survive that should be an `enum` member — enum members pickle by name and resolve back to the one canonical instance, so `is` still holds on the other side — or a class implementing `__reduce__` to return its own name. Design decision, not trivia: sentinels are for in-process control flow unless you make them serialisation-aware. **Typing.** A sentinel default is awkward to annotate: the parameter's declared type does not include the marker's type, so type checkers need either a private union, an overload set that distinguishes the supplied and omitted calls, or the marker typed as its own singleton class. There is no accepted language-level sentinel type, so pick one convention and use it everywhere in a codebase rather than inventing a new marker per module. **Alternatives worth naming.** Accepting `**kwargs` and testing key presence avoids the marker entirely, at the cost of a signature nobody can read and no editor can complete. Splitting the API into two functions — one that takes the value, one that does not — is often the cleanest answer for a small surface. And where the parameter is genuinely a three-state flag, an explicit enum with three members says what a sentinel only implies.