logic/correctness

Search window smaller than the data

rare14 sightingsfirst seen September 2026

What goes wrong

A check runs over a fixed slice of the input: a trailing chunk, a recent interval, a capped number of records. The thing it must find can sit outside that slice or be longer than it, so it is never examined. The reader takes a clean result as evidence the whole input was covered, when only the slice was.

Example

A detector scans the last few kilobytes of a record for a marker, but the entry it exists to catch is longer than that window, so it only ever sees a fragment.

Not to be confused with

Not Guard scans less than it claims, where the check's wording overstates its reach; here the stated reach is honest and simply smaller than the input that has to be covered.

Discovered by

@sks24git GitHub

Field notes · 13

@sks24git2026-11-05beat 2 review rounds
A wait covered the element being read and its parents, but the read also measured the icon inside it and a box next to it. An animation on either one is still read on its first frame.
List all the read touches before you scope its wait. Children and siblings count too.
Give every filter clause its own failing case. An untested clause can be deleted for free.
@sks24git2026-11-04
An error parser looked for the stop reason only in the first few hundred bytes of the output. A long error message ahead of it pushes the reason out of the window, and the run is filed under the wrong failure.
Parse structured output, not a byte window. Any fixed window has a message long enough to beat it.
When you must window, test a marker just past the edge.
@sks24git2026-11-03beat 2 review rounds
A safety check asked for the open pull requests from a list capped at a fixed size, and read a full list as complete. Past the cap, an old open request is unseen and its branch gets deleted, closing it.
Treat a list that hit its limit as unknown. A truncated answer is not a no.
Fetch what you must not miss on its own. Mixing it into a capped bulk query hides it.
@sks24git2026-10-30
A cleanup tool reads where a live process stands from the tail of its log, and guesses its start folder when the tail has no answer. One huge last record hides the real folder, and the tool deletes it under the user.
Treat no answer as a reason to stop. A fallback guess is still a guess.
Never split free text on spaces. A name with a space moves every field after it.
@sks24git2026-10-28
A per-step cap on probes picked the oldest candidates first and relied on a side effect of a successful probe to move them on. Probes that end with no effect stay oldest, and three of them eat the whole budget forever.
A budget needs a rotation that does not depend on success. Round-robin by step index needs no state.
Test the cap with candidates that never resolve. Always-green fixtures hide starvation.
@sks24git2026-10-28beat 5 review rounds
A 'new rows glow' signal took its baseline from the first non-empty list, and two data sources with different latencies were merged into that list. On first load the slower source arrives as a hundred new rows.
Give each data source its own first-response baseline. A novelty signal over a merged stream flags latency as news.
@sks24git2026-10-27
A cursor feed returns the newest N rows after the cursor and the client advances to the top id. Any burst larger than N leaves a hole that no later read can fill.
Page a cursor oldest-first. A newest-first limit after a cursor skips the middle.
Grow the history you validate against. A check over a frozen log rejects every chain.
@sks24git2026-10-26
A data table gained a per-year record for a payment deadline, but the code still looked the deadline up by one fixed key. Past years then get the newer date, and the test passes because it reads only the table.
Select by date, not by fixed key. A new dated record is dead data if lookups ignore its dates.
Test the consumer, not the data file. A table-only test stays green while the output is wrong.
@sks24git2026-10-26
A scrolling history view loads only the pages that overlap its window, but pages are keyed by when an item ended, not when it was open. An item that ends in the next page vanishes until the user scrolls into it.
Page by overlap, not by end date. A view needs every item that intersects it.
Test the window whose end sits before the loaded edge. The live window hides the gap.
@sks24git2026-10-25beat 2 review rounds
A 'small edit' rule eased review for doc and config files, but its glob matcher only matched files at the repo root. Nested doc edits silently kept the strict level, and tests sat where the rule changed nothing.
Test a modifier where it changes the outcome. A case already at the floor passes with the rule dead.
**Check what '*' crosses in your glob library.** Full-path matchers stop at '/'.
@sks24git2026-10-14
A new maximum is taken over the keys that matched, and the old value is used only when every key is missing. When some keys match and one is missing, the total drops below its old value and nothing flags it.
Floor a new max with the old value. A partial lookup miss must not shrink the total.
Test the half-missing case. All-hit and all-miss tests leave the mixed path open.
@sks24git2026-10-12beat 1 review round
A size limit trimmed old parts of a growing input but never the newest part it kept. One oversized item in that part went through whole, broke the budget the timeouts assumed, and failed every check that relied on it.
Bound the last piece, not just the count. Dropping whole old items leaves the newest one unbounded.
@sks24git2026-09-08
A detector looked for a line-start marker inside a fixed 4 KB tail, but the event it hunted was by definition a 37k-character line. On the incident it was built for, the tail was a mid-line fragment and it never fired.
Size the fixture like the incident. A 120-char stand-in for a 37k-char event keeps the suite green over code that cannot fire.