How do you detect an omitted argument when None itself is a legal value?

The `None`-as-default convention works until `None` becomes a value in its own right. A shard-configuration updater is the standard example: `update(name, alias=None)` cannot express both "leave the alias as it is" and "clear the alias", because both spell themselves `None`. Any API with three states - set it, clear it, do not touch it - needs a marker that no caller can produce by accident. **The pattern.** Create one unique object at import time and use it as the default: ```python _MISSING = object() def update(name, alias=_MISSING, replicas=_MISSING): if alias is not _MISSING: ... # caller asked for a change, possibly to None ``` The default expression is evaluated once, when the `def` executes, so every call that omits the argument receives the very same object and `is _MISSING` matches. Creating the marker *inside* the function body instead would produce a fresh object per call and the identity test would never fire. **Why `object()`.** A bare `object` instance is the smallest thing Python can make that is guaranteed distinct from every other object. It inherits identity-based equality and hashing, so `==` against anything else is False; it has no state to collide on; and there is no way for a caller to construct "the same" one. Contrast the usual wrong choices. A magic string such as `'NOT_SET'` is a perfectly ordinary string a caller may legitimately pass, and equality would match a different string object with the same characters. `-1` collides with real numbers. `False` and `0` are falsy and equal to each other. `NotImplemented` and `Ellipsis` are shared built-in singletons that other libraries also use, so they are not yours. **Compare with `is`, never `==`.** The sentinel's whole value is uniqueness of identity. Writing `arg == _MISSING` invites a caller-supplied object with a permissive `__eq__` to claim to be the sentinel, and it also breaks silently for any type whose equality is element-wise rather than boolean. **Naming and visibility.** A leading underscore says "private": callers are not expected to pass it, and code that receives it from outside is misusing the API. Some libraries deliberately publish their sentinel instead, because callers genuinely need to say "restore the default" - that is a design decision, and once published the sentinel is part of your compatibility surface. **Making it readable.** `repr(object())` prints `<object object at 0x...>`, which is noise in a traceback, a log line or a rendered signature. The usual refinement is a one-instance private class: ```python class _MissingType: def __repr__(self): return "MISSING" _MISSING = _MissingType() ``` That costs four lines and makes `update(name, alias=MISSING)` legible in help output and error messages. The standard library uses the same shape for its own markers. **Standard-library markers worth naming in an interview.** `dataclasses.MISSING` is the object a field's `default` and `default_factory` hold when none was given - `None` could not be used because `None` is a perfectly good field default. `inspect.Parameter.empty` (the same object as `inspect.Signature.empty`) marks a parameter with no default and a signature with no return annotation, for exactly the same reason. `argparse.SUPPRESS` marks an argument that should be omitted from the parsed namespace rather than set to `None`. `unittest.mock.DEFAULT` tells a mock's `side_effect` to fall through to the normal return value instead of returning `None`. There is no single blessed sentinel type in the standard library; each module defines its own. **The alternative: keyword-argument presence.** You can drop the parameter from the signature and inspect `**kwargs`: ```python def update(name, **changes): if "alias" in changes: ... ``` This is honest about the three states and needs no sentinel, but it erases the signature - editors, documentation tooling and type checkers can no longer see the parameter, and typos in the keyword become silent no-ops instead of errors. Prefer the sentinel for a fixed set of optional fields, and `**kwargs` only for a genuinely open one. **One caution to carry forward.** A sentinel's guarantee is identity, and identity is local to one interpreter's object graph. The moment the value is pickled to a worker process, deep-copied, or its defining module is imported twice, the `is` check can start failing - which is a separate and very real production failure mode.