Effect committed before the refusing check

What goes wrong

A step that cannot be taken back - a charge, a send, a published record - runs before a check that is still allowed to refuse the work. The code treats reaching that point as proof the work will succeed, so the refusal arrives after the cost is paid and leaves nothing to show for it.

Example

The page bills the account as soon as the result is ready, then checks whether the link has expired and answers with an error, so the reader pays and sees nothing.

Not to be confused with

Not Release After Call That Can Fail, which is about cleanup running too early on a shared resource; here the committing step itself is ordered ahead of a check that can still say no.

Discovered by

@sks24git GitHub

Field notes · 9

@sks24git2026-11-04

A membership flow is safe only because one function is the sole writer of member rows. Add a second writer, such as an import or an admin tool, and the flow's ordering breaks.

Write down, and test, the invariant you rely on. "Only one writer" is a fact that changes.

@sks24git2026-11-04

An invite banner renders from the link alone, before the invite is checked. An expired or used-up invite still greets the user as if they were about to join.

Validate an invite before you show it. A banner from an unchecked link promises what will fail.

@sks24git2026-11-03beat 1 review round

A web form swapped in its own one-time link before the post was judged, and never put the old one back. Any refused post left the other client holding a dead link, though nothing was published.

Undo a side effect when the step it served is refused. A swap that only pays off on success breaks the next caller on failure.

@sks24git2026-11-03beat 1 review round

A fix moved the file read into the safety check, so every listed file was read before the user's hold-backs were applied. A held-back huge file still got loaded whole, and the run died before sending anything.

Decide what to skip before you read. Moving a read earlier changes which files it touches.
Keep errors loud where they were loud. A swallowed I/O error turns a retry into a silent gap.

@sks24git2026-11-02

An invite asked the user for a story and picked the reward wording before it checked the privacy setting. A user who chose private was told the post goes to the public feed, then told only they would see it.

Decide visibility before any other wording branch. Every branch must say where the text goes.

@sks24git2026-11-02

A restore step wrote a file through a shell redirect, which empties the file before the source command runs. When the source command fails, the file is left blank and the rules it held vanish.

Write to a temp file, then swap it in on success. A redirect empties the target first, so any failure leaves it blank.

@sks24git2026-10-31beat 3 review rounds

A change moved value checks from the save step to a later confirm step, so raw source values were offered to the user unchecked. The user says yes, the save refuses, and the same bad value is offered again.

Validate a value before you ask a user to confirm it. A yes on bad data leads nowhere.
Drive the real chain once in a test. Hand-built events hide a broken link.

@sks24git2026-10-30beat 1 review round

A watcher saves the time of its last good answer and checks it before its first poll after a restart. Restart it late and it gives up on a healthy server without asking once.

Judge a source dead only after you asked it. Stale state is not an answer.
Carry backoff across restarts. A reset per restart is a burst per restart.

@sks24git2026-10-29

A page charged for a result as soon as the result was final, and only then checked whether its link had expired. An old link opened a day later billed the account and showed nothing.

Charge after every check that can refuse the read. A refusal after the charge bills for nothing.
Bill where the result is rendered, not where it is computed.