Guard scope exceeds the operation's scope

What goes wrong

The guard inspects a wider span of records than the computation it protects, such as every period when the result covers one, or the whole input when only some rows are kept. It then blocks or fails on data that could not change the outcome, usually because one side was narrowed and the other was not.

Example

A totals check still sums every row in the file after the reader began skipping rows outside the period, so a valid mixed file fails as mismatched.

Not to be confused with

Not Guard scans less than it claims, which under-covers; here the scan is too wide, and the surplus coverage produces refusals rather than misses.

Discovered by

@sks24git GitHub

Field notes · 14

@sks24git2026-11-04

Giving a page an access-checked section hides it from every role that lacks it, including roles that used it to view their own data. Those users now get an access-denied stub instead of their own profile.

List who opens a page before gating it. A blanket role check can remove a self-service view nobody meant to remove.

@sks24git2026-11-04beat 1 review round

A new filter keeps only items the user was shown, and it runs over every kind of job, including jobs that owe nothing by design. Those jobs drop out of the score that padded it, and a good account can tip under the line.

Scope a new filter to the rows the rule is about. Rows another rule already settles must pass it untouched.
Test the account the old rule protected. That is the one a broad filter breaks.

@sks24git2026-10-31

A settings save re-checked the stored values it was not changing against a new rule. One old row that broke the rule then made every unrelated save fail until someone found and cleared it.

Validate what the caller sends, not what it left alone. A new rule over stored data turns every save into a hostage.

@sks24git2026-10-30beat 5 review rounds

A feature was turned off by a switch, but one of its guards sat outside the switch and still fired. With the feature off, large inputs lost context they had before, the very regression the switch was meant to prevent.

Diff the off path against the old code. A switch hides the new path, not the shared lines you edited for it.
Freeze a mode once per run. Two passes that each read it can disagree.

@sks24git2026-10-30beat 2 review rounds

A time cutoff added for the rare oversized path also guarded the common one. When setup ran slow, the normal review sent nothing at all, though minutes were left on the clock.

Scope a new guard to the path it was built for. A shared loop applies it everywhere.

@sks24git2026-10-29beat 1 review round

Test files built for one runner went to another that collects every test class in scope, imported ones too. Each changed helper file reran whole suites it only imports, and their failures landed on the change.

Check what a runner collects before you switch runners. Two runners can read the same file and pick different tests.

@sks24git2026-10-27beat 1 review round

A parser started skipping rows outside the target period, but the file's own summary line still counted every row. Any file with a summary row and an old row now fails as "totals don't match" instead of naming the row.

When you drop input rows, recheck every total built from the whole input. Footer sums and balances still describe the full file.

@sks24git2026-10-26beat 2 review rounds

A periodic scan fetched every page of a search before it could notice the result cap, then split the range and fetched again. Each pass costs twice the documented figure, and the range only grows from a fixed start date.

Check the count before you paginate. One cheap query decides the split; paging first throws the pages away.
Bound work per pass, not per page. A scan from a fixed start grows with history.

@sks24git2026-10-18beat 2 review rounds

A sweep looked up each item's closer on a remote service before it checked whether the item was already handled. Every loop re-queried the whole window and drained the rate budget that another job needed to merge work.

Check your own records before you call out. A dedupe after the remote call saves nothing.
Count calls per loop, not per new item. Old items stay in the window and keep costing.

@sks24git2026-10-17beat 2 review rounds

Two sibling tasks lose the gate that held them when the plan moves their setup step to later. Nothing stops the queue, so an agent picks one up and its change fails a check it cannot fix.

Give every early-filed task an explicit hold. A sibling's gate does not cover it.
Stop after three rounds and split. Each rewrite of the same text adds a new gap.

@sks24git2026-09-10beat 2 review rounds

An admin range floored its ceiling against the deploy default but not against the saved list. Lower that default after saving a wide ladder and the page shows a list its own save refuses.

A bound computed from the default contradicts stored data. Take the ceiling from the effective row at the moment of the write.
A form that displays what it will reject is a defect.

@sks24git2026-09-10beat 2 review rounds

A liveness check was hung on the whole repair command instead of on the credit it protects. When the retry finds the money already at the target, it still refuses with "settle by hand" for a company that owes nothing.

Attach a precondition to the effect it guards, not to the entry point. A guard one level too high refuses work that is already done.

@sks24git2026-09-07beat 1 review round

A reader was narrowed to one half of a log, but the completeness gate still failed the read when the other half was cut. The gate could no longer change the score; it only switched a safety rule off.

A completeness gate covers exactly what its readers score. A gate over unread bytes only disables rules.
Update both ends of a cross-reference. The stale side invites the wrong fix.

@sks24git2026-09-06beat 7 review rounds

Submit was gated on live validity against the current scope's bounds while the body replayed was frozen from another scope. Refusal codes the server treats as pre-money were being kept as retryable.

Gate the replay on the frozen body. Validating live input for a request that will not send it checks the wrong thing.