Probe Failure Reads As No

What goes wrong

A check that asks a yes or no question ('any new migrations?', 'is biometrics available?', 'is the slot free?') has its own failure made to look like the answer 'no' — a discarded exit code, a shell command that ignores its own failure, an empty output read as 'nothing found', an exception caught and returned as false — so a decision is taken on a 'no' never obtained.

Example

The permission check calls the server, the request times out, the catch block returns false, and the user is told they have no access.

Not to be confused with

The consumer is a decision or a record, not a display; not a policy file that opens the gate when unreadable (Unreadable policy opens the gate), not a missing metric shown as zero (Unknown measurement becomes certainty), and not the reverse case where a check that is supposed to fail cannot be told apart from one that never ran.

Discovered by

@sks24git GitHub

Field notes · 11

@sks24git2026-11-06beat 2 review rounds

A sync job read a live page with a fetch piped through text filters, and the pipe hid the fetch's failure. An outage then read as "the page is stale", and the job republished the site every ten minutes.

Fail the pipe when any stage fails. Without that, the last filter's success hides a dead fetch.
Treat an empty read as unknown, never as a mismatch. Acting on it turns outages into writes.

@sks24git2026-11-06beat 1 review round

A scheduled check piped a fetch into a runtime the build host does not have, and every error fell back to an empty value. The job exited clean on each run, so the page never updated and nothing turned red.

Make a failed probe fail the job. A fallback that turns errors into "nothing to do" hides a dead check.
Install the tools a job uses in that job. Never trust the bare host.

@sks24git2026-11-04

A test asserted a path is not ignored by checking that a version-control command said no, and a failed call also reads as no. The negative cases pass even when the tool is broken, so they prove nothing on their own.

Make a negative check tell "no" apart from "could not ask". Assert the tool ran first.
Isolate tests from the developer's global config. Local excludes flip results.

@sks24git2026-11-04

A lookup that fails on a network blip returns the same empty answer as "nothing there". The script then skips the check that stops it opening a second copy of work that already landed.

Keep "lookup failed" apart from "found nothing". Merge them and every guard behind the lookup turns off on a blip.
Never hide a pipe's exit code. Piping into a command drops the failure.

@sks24git2026-11-01beat 1 review round

A hook reads any failure of its version-control lookup as no repository at all, and tells the agent nothing more is needed. In a checkout the tool refuses to read, the agent trusts that and the merge gate blocks later.

Word a fallback by what you know, not what you guess. A failed lookup has several causes; name them or the reader acts on the wrong one.

@sks24git2026-10-30beat 3 review rounds

A pre-merge check read files with errors ignored, so any failed read looked like a missing file. A flaky mirror then blames the author for a fault in the build system, and a commented-out import counts as real.

Tell "absent" from "failed" on every read. A swallowed error turns infra faults into user blame.
Parse imports, never grep them. Comments and dead branches pass a text match.

@sks24git2026-10-25beat 1 review round

A list check ran one slow remote call per item, in a row, under one short deadline, and a timed-out check read as "no access". Big lists lost the very items the user could open, and the page called itself complete.

Keep "said no" apart from "did not answer". Folding a timeout into a refusal hides data and lies about it.
Price the loop against its deadline. Serial calls times items must fit the budget.

@sks24git2026-10-23

A reader folds a stored enum into a set, trusting a write path that checks keys but never values. One list stored by hand makes every later read throw, and the record is append-only, so it never heals.

Validate on read what the write path does not. An append-only log keeps one bad row forever.
Map unknown values to the closed state. A crash is not a fail-closed answer.

@sks24git2026-09-29beat 2 review rounds

A CI guard called the permission-check CLI with three positional args, which the CLI rejects before any access review, and its stderr was discarded. The guard reported "no permission" on every run, whatever RBAC said.

Prove a guard can pass, not only fail. Run it once with permission granted and read the exit code.
Never silence stderr on a check that gates a step. A usage error then reads as a denial.

@sks24git2026-09-15

Mutation fixtures piped into the checker ran it in a subshell, so every failure it counted died there. The run printed FAIL for a mutant and then, one line below, that the whole suite passed.

Never pipe into a function that counts failures. The subshell keeps the count and the caller reads zero.
Read the verdict, not the loudest line. A FAIL above an "ok" means the ok is lying.

@sks24git2026-09-12

A runbook step pipes a listing through a search tool and records the exit code as its result. A failed read and an empty listing print the same line, so the record says the state is clean when nothing was read.

Record the reader's exit status, not the filter's. A pipeline reports its last command, and a search tool cannot tell a miss from no read.
A count outside the shown output is a guess.