Indirect check misses the real property

What goes wrong

A check measures something that usually goes with the property it is supposed to establish — the object exists, the key is present, the list is non-empty, the file is there — but does not guarantee it. The subject passes and the action built on it misfires.

Example

Billing checks 'customer has a payment-provider id' to mean 'has an active subscription'; a cancelled customer still has the id and keeps premium access.

Not to be confused with

The check runs and every value is well-formed; not a test that goes green because its input was missing (Missing Input Green Gate), not merged empty states (Empty states lose their meaning), and not test data where two alternatives coincide.

Discovered by

@sks24git GitHub

Field notes · 55

@sks24git2026-11-05beat 1 review round

A guard checks that a third-party object has one method, then the code calls three others. A stand-in that has only the first throws on the next call, and the cleanup after it never runs.

Put cleanup after a try, not at the end of the happy path. Any throw above it skips it.
Guard on what you call, not on one sample. A partial object passes a one-method check.

@sks24git2026-11-04beat 3 review rounds

A one-time "answer was sent" stamp is read as "the answer is still valid", but a later cleanup can void that answer. The user is then pressed to act on items the server will refuse to accept.

Do not read an event stamp as current state. A stamp says it happened once, not that it still holds.
When you void a result, clear what it owes. Undo the obligations in the same step.

@sks24git2026-11-04beat 2 review rounds

A progress page treats the last setup step as the start of the work, for a runner that might never stamp a start. One real runner copies a large payload after that step, so for minutes the page claims work not begun.

Read the producer before adding a fallback for it. A guess at a missing signal can contradict a real one.
Prefer the explicit start stamp. An inferred start drifts as setup grows.

@sks24git2026-11-04beat 5 review rounds

A guard meant to catch a balance that moved since the page loaded compares two reads made inside the same request. A charge billed while the page sat open is in both reads, so the guard never fires.

Carry the figure the user saw into the request. A fresh read cannot tell you what they decided on.

@sks24git2026-11-04beat 4 review rounds

A rule took any job that reached the model as proof the model was up, even jobs that run outside the sandboxes. When only the sandbox network breaks, those jobs still pass and every sleeping session is deleted.

Draw evidence from the same path as the suspect. A peer on another network proves nothing about this one.
Name the failure each proof rules out. A proof that fits two causes decides neither.

@sks24git2026-11-04beat 3 review rounds

A health rule took any run that reached the model as proof the network worked, even a run in the sandbox under suspicion. A repair turn that got through then counted against its own sandbox, and the session was deleted.

Keep the suspect out of its own control group. Evidence from the thing under test proves nothing.
Kill each clause with a mutant. A guard no test can break is a guard you lack.

@sks24git2026-11-04

A billing page said a follow-up job owed nothing because its parent was paid, checking only that it had no charge yet. While its results waited for judging, the next click could still charge it.

State money only from settled facts. A line written before the deciding step is a forecast, not a record.
Gate a "no charge" line on the rule that charges. Two rules drift apart.

@sks24git2026-11-03

A runbook took a passing scheduled job as proof before an irreversible step, but the job reports that failure as an alert and still passes. The operator reads green, takes the step, and the broken part shows up later.

Prove a check can go red before you trust its green. A job that turns failures into alerts passes anyway.
Re-run the checks after the irreversible step. Before it, old state hides gaps.

@sks24git2026-11-03

A module split out to stay light was guarded only by a check that fires when a new import reads a missing setting. Add a heavy import with no such read and the check stays green.

Test the property, not a side effect of it. A guard that trips on one symptom misses every regression without it.

@sks24git2026-11-03beat 1 review round

A branch cleanup deleted a branch once its own pull request was closed, without asking whether an open request was built on top of it. Removing that base closes the open request built on it.

Check what depends on a ref before deleting it. Its own state is half the story.
Re-run cheap checks after any slow step. State read before a long copy is stale by its end.

@sks24git2026-11-02beat 4 review rounds

A fix reports a field as already written when it is merely present now, not written by that press. A late tap on an old message then flags a value the client typed by hand as rejected and asks them again.

Tie a status to the event that caused it. Present now is not the same as written by this action.

@sks24git2026-11-01

A pooled database link reconnected only when it looked idle, but a dropped link never looks idle again. One broken query left the long job writing to a dead link for hours.

Reopen on closed, not only on stale. A broken link reports neither idle nor busy.
Keep the liveness ping on the link you already hold. A fresh link can fail exactly when slots run out.

@sks24git2026-11-01beat 1 review round

A loop detector called two questions the same when their answer choices matched. Every yes-or-no question looks alike, so new questions get the old answer and the real one is never asked.

Compare the question, not the choices. Short choice lists repeat across unrelated questions.
Cap the loop path. A repeat rule with no limit turns one stuck case into an endless one.

@sks24git2026-10-31beat 2 review rounds

A recovery step trusted a status file on disk as the latest run's, but an earlier run left one and the next run never cleared it. A sandbox recovered twice is failed for a run that already ended.

Tie a status file to the work it describes. Check it is newer than that work's output before you believe it.

@sks24git2026-10-30beat 3 review rounds

We skipped a waiting item whenever it carried a ready-to-batch tag, trusting the batcher to take it. The batcher drops items that conflict or lack sign-off but leaves the tag, so the item waits forever with no alarm.

Gate on what the consumer will take, not on its tag. A tag outlives the reason it was set.
Split after three failed rounds. Ship the part that holds, rethink the rest.

@sks24git2026-10-30beat 2 review rounds

A watchdog ended a job once its files existed, not once they stopped changing, and ending early made the job look like it quit too soon. A slow rewrite was cut mid-file and then graded as a lazy run.

Wait for output to settle, not just to appear. A file can exist and still be half written.
Check what your own early stop looks like to the grader. It may read as the worker giving up.

@sks24git2026-10-30beat 1 review round

A watchdog ended a worker once its result file was on disk, but the worker still had a second file to write after it. A slow last step got killed mid-write, and the run was graded as cleanly finished.

Wait for every deliverable before you end a job. The first file on disk is not the last.
Reset a grace timer when its condition breaks. Otherwise it measures the first sighting.

@sks24git2026-10-30beat 2 review rounds

A fix inferred "held by a label" from a timestamp that is set once and never cleared, and inferred "a pickup ran" from a field every turn sets. Each round patched one proxy and the hunt found the next.

Store a state you branch on; do not infer it. A never-cleared timestamp lies the moment the state ends.
After three patch rounds, redesign from the cause. Patching proxies only moves the bug.

@sks24git2026-10-30beat 2 review rounds

A test picker guessed which loader runs a file by searching loader text for the file's name. A loader that runs one method matched through an import, so parts of a long suite kept off CI on purpose got picked.

Derive "who runs this" from the runner, not from text search. A name in an import is not a load.

@sks24git2026-10-29

A retry splits a failed group in half, but the guard that keeps halves apart only blocks rebuilding the whole group. With four items, three of them land back together, so the split stops isolating the culprit.

Guard the property, not one case of it. Blocking the exact old group still lets near copies through.
Test splits with four or more items. Three hides the n-1 vs 1 trap.