Cleanup on one exit path only

What goes wrong

The release, unlock, or done-marker sits on a single route out of a block, normally the successful one. Every other way out - an early return, a thrown error, an abandoned wait - leaves the resource held or the record unwritten. The reader relies on a step being reached simply because it is written last.

Example

A worker clears its lock at the end of the successful path, so when a validation check returns early the lock stays set and the item is never picked up again.

Not to be confused with

Not Busy Flag Cleared Only On Success, which is about one named flag after a failure; this covers any finalising step that an alternative exit bypasses, including early returns taken deliberately.

Discovered by

@sks24git GitHub

Field notes · 7

@sks24git2026-11-02beat 2 review rounds

A guard that skips a repeat step returns early, before it records that the step already happened. Once a later actor overwrites the other marker, the guard no longer matches, and the step runs a second time.

Record the decision on every exit path. A guard that returns before it writes its mark depends on state it does not own.

@sks24git2026-10-27

A shell wrapper spawned a background ticker and stopped it only on its own normal exit. Kill the wrapper by pid and the ticker lives on, keeping a log fresh forever and blinding the silence watchdog.

Tie every background loop to its parent's life. Check the parent is alive each turn and trap signals.
Wait for the running tick before the last line. A killed subshell leaves its pipe alive.

@sks24git2026-10-15

A retry cap counts only attempts that logged an end, and only the worker itself logs it. If the worker dies mid-attempt, that attempt never counts, so a job that crashes its worker retries forever.

Never count attempts by a record only the happy path writes. A crash skips the write; the attempt vanishes.
Spot live work by what keeps it alive. A lease or heartbeat, not a missing end.

@sks24git2026-10-12

A batch runner fetches each job's input outside the per-job error handler. One failed fetch ends the process mid-batch, and every other running job skips its cleanup and leaves paid sessions alive.

Put every await of a pool worker inside its catch. One escaped rejection ends the process and skips every sibling's finally.

@sks24git2026-09-27

A background re-check returned early before writing its "measured" row, and an hourly sweep re-reads every run without one. Each sweep re-fired the alarm and switched the feature off after an operator turned it back on.

Write the done-marker on every exit path. A sweep keyed on "not yet recorded" re-runs whatever returned early.

@sks24git2026-09-15beat 3 review rounds

Ownership of two committed rows was set from a function's return value, but that function commits, then suspends on a network call. Cancel it there and both rows stay committed with no owner, so cleanup skips both.

Mark ownership at the side effect, not from the verdict. Anything after a suspension point may never run.
Pin every a flag with a test that cancels. An uncancelled guard is unverified.

@sks24git2026-09-15beat 1 review round

A cleanup step in finally wrapped a suspending release in a catch-all. On graceful shutdown the first suspension throws cancellation, the catch-all eats it, and the instance it was meant to release keeps billing.

Cleanup in finally runs a flag. A cancelled scope throws at its first suspension, before the release.
A catch-all around cleanup hides the miss. Rethrow cancellation.