Generic Check Fires Before Specific Error

What goes wrong

An earlier, coarser check (a 'nothing to do' early return, an old validation, a blanket 400, a cross-check against defaults) triggers on the same inputs as a later, more specific check or new branch, so the precise error, safe refusal or new path can never be reached for the overlap.

Example

A booking request for a taken slot fails schema validation first with a bare '400 invalid input', so the user never sees the specific 'slot already booked' message the handler would have returned.

Not to be confused with

Both checks exist and their order is the defect; not a temporary refusal hiding a permanent one (Transient Refusal Shadows Permanent), not a live check blocking a replay (Replay Behind Live Gate), and not a lookup done before authorization (Resource lookup precedes authority).

Discovered by

@sks24git GitHub

Field notes · 11

@sks24git2026-11-02beat 3 review rounds

A new path lets a picked button stand in for a typed reply, and it runs before the path that reads numbers. When the reply holds an amount, the button wins and the amount the client gave is lost.

Let the strictest parser run first. A looser path that runs earlier eats the input it cannot read.
Test new branches on the old cases too. The old inputs show what the new branch now swallows.

@sks24git2026-10-30beat 4 review rounds

A new failure mark stood aside for an older reading of the same death, but that reading only writes into a failed run's message. When a later step saves the run, nothing names the death and a broken pass reads complete.

Defer only to a reading that leaves a record on every path. One that speaks only on failure goes silent when the run is saved.

@sks24git2026-10-29

A fast early check answers 'busy, retry later' before the lookup that would say 'already running'. The client waits, retries after the first run ends, and pays for a second identical run.

Run the cheap check after the lookup it can short-circuit. Order matters more than cost.
Put the remedy where the client reads. A body the tool hides is no answer.

@sks24git2026-10-23

A new route with a fixed path segment sat where an older route takes a path parameter. The older route registers first, so every call to the new path lands in the wrong handler and is refused.

Check new paths against parameter routes of the same shape. The router takes the first match.
Spec the rounding rule. Rounded lines rarely sum to the rounded total.

@sks24git2026-10-16

A size check sat behind a lower transport cap, so output past the cap aborted the read before the check could see it. Oversized data then surfaced as a read error instead of the clean over-limit result.

Cut to the limit at the source. A check behind a smaller cap never sees what it must judge.
Pin each pair of limits in one test. Raise one later and nothing else will warn you.

@sks24git2026-10-15

Capping a session at the end of its access grant made both die at the same instant. Every later refusal then came from an earlier check, so the expiry log written by the deeper check never fired.

Trace who refuses first after a limit you just tightened. A side effect hung on a later check goes dead when an earlier one now fails first.

@sks24git2026-10-15

The client shows a clear message for one exact server error, but the session cookie expires the same moment as the access. On natural expiry the server cannot tell who called and sends the old generic reply.

Trace an error text to the request that really carries it. A stub proves the parser, not the path.
Test natural expiry, not only revoke. Often only the edge case works.

@sks24git2026-10-13

One branch of an access check refused requests early, before the step that records why. The request stayed blocked, but it left no reason and no metric, while the docs promised both.

Send every deny through one exit. That exit writes the reason, the metric and the status code the docs promise.

@sks24git2026-09-16beat 6 review rounds

A terminal 'failed' state got its own message, placed after a dispatch that routed the failed case elsewhere first. On the branch the message was written for, the tool still says 'no verdict yet'.

Test terminal states before dispatch. A check placed after the branch point runs only on the branches that reach it.
Fixture every rung, not the one you fixed.

@sks24git2026-09-10beat 1 review round

The input checks compare a computed value against the overridden threshold before the override itself is handled. The documented smoke test dies complaining about a variable the operator never set.

Run your own documented smoke test before shipping the guard. The first person to follow the doc walks into what you skipped.

@sks24git2026-09-10beat 1 review round

A new branch was placed behind a flag, but the old refusal ran three lines earlier. Arming the flag changed nothing for the exact shape the branch was written for, and the money could only be returned by hand.

Trace the guard order, not the guard list. A new path is dead if an older refusal still stands in front of it.