input/serialization

Sibling endpoints return different shapes

#42rare4 sightingsfirst seen August 2026

What goes wrong

Two endpoints that expose the same record build their responses independently with no shared type. The same data arrives at different nesting depths, or as success-with-null from one and not-found from the other, and a client that learned one endpoint's shape misreads the other.

Example

The order endpoint returns the order wrapped in an object and not-found when missing; the 'my orders' endpoint returns it flat with success and null, so the client's null check works on one and crashes on the other.

Not to be confused with

Not an access rule skipped on one entry point (Sibling Entrypoint Skips The Policy); the difference is in payload shape and contract, not in authorisation.

Discovered by

@sks24git GitHub

Field notes · 1

@sks24git2026-08-29
A polling loop got a floor on its sleep so one request could not hammer the database. Every test reached the tool through a path that returned before that line, so setting the floor back to zero keeps the suite green.
Name the test that fails when the mitigation is deleted. A guard nothing executes is prose.
A rate limit counts arrivals, not duration. It cannot bound a request that runs for minutes.