Best-Effort Step Aborts Required Work

What goes wrong

An optional side step — analytics, an audit-log write, a cleanup, a notification — has no error handling of its own inside a sequence that must complete, so when it throws (or, in a shell script set to stop on the first failing command, exits non-zero) it aborts the main work that never depended on it.

Example

The analytics call at the end of checkout throws because the tracking host is down, and the order that was already valid is never created.

Not to be confused with

The failure happens inside the protected sequence; not setup failing before any cleanup exists (Setup Cleanup Gap), not a cancellation treated as failure (Swallowed Cancellation), and not a lost failure count that leaves a run falsely green (Failure Count Lost In Subshell).

Discovered by

@sks24git GitHub

Field notes · 19

@sks24git2026-11-06

A reward was granted inside the same transaction that records the event earning it. Any error in the reward check rolled back the record itself and stopped the job that writes them.

Keep side rewards out of the core write. Grant after commit, so a reward bug costs a reward, not the record.

@sks24git2026-11-04beat 2 review rounds

A side task was moved into the same transaction as an important write so the two would commit together. Now one bad record makes the side task throw, rolls back the important write, and stops the whole loop every hour.

Never let a best-effort step veto the main write. Catch it inside, or run it after.
Give each row its own error handling in a batch. One bad row must not stall the rest.

@sks24git2026-11-04

A logging helper reads its threshold on the caller's open transaction and swallows any error. The database still marks that transaction failed, so the next real query breaks the job the logging was meant to watch.

Wrap optional reads on a shared transaction in a savepoint. A caught error still poisons the transaction.
Test the guard, not a stub of it. A stubbed helper hides its own failure path.

@sks24git2026-11-03beat 1 review round

A test-wide log wrapper turns every argument into a string before it logs. One log of an object with no prototype then throws inside the wrapper and breaks tests that never asked for it.

Never let a global wrapper throw. Guard its own work, then always call the original.
Bound every blocking child process. A sync spawn with no timeout hangs past every test limit.

@sks24git2026-11-03beat 4 review rounds

A form builder now refuses when one input is missing, and the caller turns any refusal into a failure of the whole bundle. One missing number stops every file, not just the one form that needs it.

Scope a refusal to the output that needs the data. A shared failure path turns one gap into a full outage.

@sks24git2026-11-03beat 1 review round

A data repair added to the boot sequence ran without the error guard its neighbours carry. One failed write during a database failover and the whole service would refuse to start, over a fix it did not need yet.

Match the guard of the step beside you. A boot step that can throw can keep the service down.
Keep the promise the form showed. Send what the page said, not what a reread says now.

@sks24git2026-11-02beat 1 review round

An optional cleanup step ran right after results were collected and could throw. One failed cleanup turned a finished run into an error and skipped the safety check that came next.

Make optional cleanup best-effort. A tidy-up step must never decide whether finished work counts.

@sks24git2026-11-01beat 1 review round

A page wraps a new list and an old action form in one section, and a failed read of the list empties the whole section. The form never needed that read, yet the user loses the one button that starts work.

Fail only the part whose read failed. Keep every block that does not depend on it on the page.

@sks24git2026-11-01beat 1 review round

A new database read was added after the charge had already committed, with no fallback. One timeout there reports the paid call as failed, so the client retries and gets a confusing no-op.

Guard every await after money moves. A failure there should drop a note, never turn a paid call into an error.

@sks24git2026-10-30

A new optional measure was written in the same transaction as the import it rides on. When that one statement failed, the import rolled back and its batch was replayed forever.

Write a derived cache after the source commits, never inside it. Its failure should leave a backfill job, not block the data it derives from.

@sks24git2026-10-30

A client builds an optional upload inside a fallback that is meant to make it harmless, but the build step itself sits outside the guard. When the build fails, the whole run aborts instead of going on without it.

Guard the whole optional step, not only its network call. Preparing the data fails too.

@sks24git2026-09-15beat 1 review round

A cleanup step added to the boot sequence was the only one there with no error handling, though the rule was written in a comment eight lines below it. One locked row and the process refuses to start.

Prove the path production takes, not the one you designed. Ask what your new step does when it throws, before asking what it does when it works.

@sks24git2026-09-15beat 1 review round

A guard read its anchor line with a pipeline assignment under strict mode. Delete the line it exists to police and the script dies right there: no message, no summary, and every later check silently skipped.

Make a guard survive the edit it polices. A check that dies before printing is indistinguishable from one that passed.
Grade the deletion, not only the rewording.

@sks24git2026-09-14beat 2 review rounds

A heartbeat coroutine refreshes a work claim inside the same scope as the job it guards. Drop the guard around its one call and one transient database blip cancels the job mid-flight, leaking a paid resource.

A helper coroutine must never kill its parent. Isolate its failures or the helper becomes the outage.
Pin that isolation with a test. A guard nobody exercises is not protected by green tests.

@sks24git2026-09-14

A check wraps the command in a || list to read its exit code. That suspends a script option inside, so the command it guards can no longer abort anything — the check passes whether the guard is there or not.

Run each check on a correct tree AND a broken one. A check can fail never, or always; both look fine.
Reproduce the caller, do not model it. A harness that rewrites context rewrites the test.

@sks24git2026-09-10

A journal write was wrapped so a storage error could never fail the client's request; the lookup it needed was added one line above the wrapper. When that lookup timed out the request answered 500 to a merge gate.

Everything a side effect needs goes inside its guard. A helper that swallows its own errors protects nothing you fetch for it outside.

@sks24git2026-09-10

A cleanup step measured the daemon list before stopping them, and the measurement pipeline ran unguarded under an option. One failed probe exits the step, so the stop never runs and the cleanup reports red.

Never let a diagnostic decide whether cleanup runs. Guard the measurement, not the action.
Do the work first, report second.

@sks24git2026-09-10

A stale-work scanner ordered its batch by a timestamp that only success paths write. A row that always fails keeps the oldest stamp, holds the head of every batch forever, and nothing behind it is ever swept.

Order a work queue by attempt time, not by success time. A row that never succeeds never moves, and it starves everything queued behind it.

@sks24git2026-09-09

A client ask that threw was caught and logged, and the catch also skipped the ref fallback that ran after it. Files the client was asked for were lost entirely, though the ref held them.

A catch decides what happens next, not only what gets logged. Trace the path after the catch as carefully as the happy one.