Branch guarded by an impossible condition

What goes wrong

A branch is guarded by a condition that the surrounding code can never produce, so the work behind it never runs. Reviewers read the branch as live coverage for the case it names and stop looking for another handler. Silence is taken as proof the case does not arise, when in fact nothing is handling it.

Example

A recovery path runs only when the save step reports a duplicate, but the save step was changed to accept duplicates quietly, so the recovery has not run since and no one noticed.

Not to be confused with

Not Dead Guard By Construction, where the check always passes and lets everything through; here the check can never pass, so the code behind it is the part that is dead.

Discovered by

@sks24git GitHub

Field notes · 9

@sks24git2026-11-05

A placeholder rule said a token of one repeated character is safe, but the checked part also held the token's fixed version digit. Every placeholder then had two distinct characters and was blocked as a live secret.

Strip fixed parts before testing randomness. A version or kind tag makes any value look varied.
Pin each branch with a row only it decides. Otherwise a dead branch looks covered.

@sks24git2026-11-02beat 1 review round

An error handler asked the same database connection that had just failed to decide which fallback to take. When the first error is a dropped connection, the handler throws again and the safe fallback never runs.

Never let a fallback depend on the thing that just failed. Guard the lookup and pick the safer path when it fails.

@sks24git2026-10-31beat 1 review round

A fix refused an ambiguous name on a manual path, but that path had no other way to name the target. The one case the fix sent there became a case nobody could handle.

Give every refusal a way through. A guard that says no with no exact-id path turns a risk into a dead end.

@sks24git2026-10-30beat 1 review round

Two limits guarded one batch job: one checked up front and marked final, the other checked only after the job started. A job over the second limit failed as a plain error and was retried, refusing again each time.

Put every refusal rule for a job in one place. Split limits drift; only one gets the no-retry path.
Count only the work that costs. Free parts inflate the estimate and refuse jobs that fit.

@sks24git2026-10-30

A watcher stops counting a throttled answer as a failure, but never counts it as a sign of life either. A short outage, then a throttle burst, and the watch retires on a server that was answering all along.

Give every answer one meaning. A reply that is neither alive nor dead lets two rules disagree.
Bound a watcher by time, not by count. Counts shrink when the poll gets faster.

@sks24git2026-10-29

A filter reused by name alone was given a size of zero, so its rule for large data files never fired. A change that rewrites a hundred config files is counted as a hundred code files and gets the wrong advice.

Reuse a filter only with every input it reads. A dummy value for one argument quietly turns off the rules keyed on it.

@sks24git2026-10-29

A new gate pauses all merges while the main branch is red, with no exception for the change that repairs it. The fix waits behind its own gate, so main stays red until a human steps in.

Let the repair pass every stop you add. A gate on red must not block what turns it green.
Test the gate with its own fix queued. Deadlocks hide in the happy path.

@sks24git2026-10-21

A layer that rewrites errors into a common format mapped a code the client treats as final onto a generic retryable one. The client then keeps resending a request that can never succeed.

Test the client's verdict, not just the wording. When you rewrite an error, check that "final" stays final and "retry" stays retry.

@sks24git2026-10-06beat 3 review rounds

A pre-delete safety check required two helper objects to exist, but the delete itself removed them. Any retry after a half-finished run was blocked for good until someone changed the code.

Make sure a guard can pass on a rerun. A gate that needs what the action destroys turns a partial failure into a stuck state.