Unearned Completion Report

What goes wrong

A 'saved', 'done', or 'deploy complete' message is printed because the code reached the end of the function, because an earlier step succeeded, or because a summary step always runs — not because the final result was checked. Operators and users are told something happened when it did not.

Example

A deploy script ends with echo 'Migration applied' after the migrate command failed and its error was swallowed.

Not to be confused with

Only the false status message; the underlying failure itself, and a durable state flag flipped too early (Marked Done Before Work Saved), are separate bugs, and static promises in docs are not this.

Discovered by

@sks24git GitHub

Field notes · 20

@sks24git2026-11-04

A deploy summary printed Released in its headline while the same run went red for machines that never started. Someone who reads only the headline walks away believing the whole fleet is on the new build.

Derive the headline from the same verdict that colours the run. Two sources of truth will disagree.
Put the worst state first in any summary.

@sks24git2026-11-01

A notice told every automatic job with any result that it had been charged, but the charge only runs when a serious result comes in. Jobs with only minor results showed a payment that never happened.

Say "charged" only after reading the charge record. The rule that bills decides it; copy must not assume it.

@sks24git2026-10-28

A workflow kept the log line and comment from the old fallback after the matrix stopped reading the selector's verdict. On a big change the step runs nothing and prints that the full set ran.

Rewrite the log line when you rewrite the branch. A message that describes the previous behaviour is a lie the operator will trust.

@sks24git2026-10-21beat 2 review rounds

A status panel listed every note from the data layer as an alarm, including a plain freshness timestamp. A healthy system showed one alarm all day, and equal error texts from several blocks collided as list keys.

Build an alarm list from an allow-list of alarm kinds. A new info field turns into a false alarm.
Test the calm state too. A panel that is never empty on good data hides real alarms.

@sks24git2026-09-13beat 2 review rounds

One line said a worker had finished; three lines below, the element that reads that worker's own record said it stopped after one step of six. The two sentences were computed from different sources.

A sentence may claim only what its own source knows. An end does not tell you the work was complete.
A fixture the system cannot produce proves nothing.

@sks24git2026-09-12beat 1 review round

Making a tool install non-fatal let a half-populated directory be saved under a fixed cache key. Every later run restored it, skipped the install, and reported the missing verification as a runner quirk.

Never cache the output of a step allowed to fail. The failure becomes permanent and invisible.
Key a cache by what it contains. A static key cannot be repaired.

@sks24git2026-09-11

A retry stripped per-attempt facts from a job's metadata by naming them, and a new feature added two facts without touching the list. The retry then told the user the sandbox was destroyed while its own held their code.

Strip per-attempt state by an allow-list of what travels. A deny-list breaks the day a field is added.
Test the sentence, not the word. Pinned in three layers, rendered in none, it flips.

@sks24git2026-09-11beat 2 review rounds

A counter meant to prove a request shape reached the upstream was recorded before the send, from the builder's intent. The transport's kill switch threw first, and the metric counted traffic that never left the process.

Count at the wire, not at the intent. A metric used as evidence must record what shipped.
Every flag that decides an outcome gates every seam. One left out turns rollback into a half-feature.

@sks24git2026-09-10beat 1 review round

The input checks compare a computed value against the overridden threshold before the override itself is handled. The documented smoke test dies complaining about a variable the operator never set.

Run your own documented smoke test before shipping the guard. The first person to follow the doc walks into what you skipped.

@sks24git2026-09-10

A disk watchdog compared usage against a threshold copied straight from a variable. Type '80%' instead of 80 and the comparison errors out, the trip flag stays unset, and the step prints all-clear.

Validate a threshold before comparing against it, and fail closed. An arithmetic error must never resolve to 'nothing is wrong'.

@sks24git2026-09-10beat 2 review rounds

An audit row logged the owner the code intended to write, taken from the request. When the compare-and-swap was refused the row kept its old owner, so the trail records a change that never happened.

Audit what the row holds after the write, never what you passed in. A refused swap still writes a confident log line.

@sks24git2026-09-10beat 2 review rounds

A round reported a text fix as done, but the script making the edit aborted on a later assertion before writing the file. The next round found the sentence unchanged and the earlier verdict false.

Re-read the file after any script that edits it exits non-zero. A failed run can leave every earlier step unapplied.
Verify a fix by its diff, never by the intent to make it.

@sks24git2026-09-10

A settings form guarded six fields against a server that omits them; the seventh shipped without a guard. During a rolling deploy an old pod drops it, the form clears itself and still shows a green 'saved'.

Add the new field to the guard, not just to the form. A per-field defence with one hole reports success exactly where it fails.

@sks24git2026-09-10beat 1 review round

A table check demanded eleven cursor columns be all set or all null, but no test ever gave one of them a value. Drop that column from the constraint and every test stays green while production refuses the write.

A constraint needs a test that fills every column it names. A column no fixture sets is unconstrained.
Mutate the constraint, not its writer. Green suites hide the row the database rejects.

@sks24git2026-09-09

The 'served from unproven source' log was built from what was fetched, not from what the budget let the writer write. A delivery whose every write was skipped logged 'served' and 'never attempted' about one file.

Log what happened, not what you held. Build reports from the write set, not the fetch set.

@sks24git2026-09-09

A client ask that threw was caught and logged, and the catch also skipped the ref fallback that ran after it. Files the client was asked for were lost entirely, though the ref held them.

A catch decides what happens next, not only what gets logged. Trace the path after the catch as carefully as the happy one.

@sks24git2026-09-09

Files a client-sent diff changed were withheld from the server and routed to the client; when the client never answered there was no fallback. The reviewer got nothing and the run was retracted.

Every withheld resource needs a last resort. Starving the consumer beats an unproven source only if you log it.
Strip a prefix only where the format adds it.

@sks24git2026-09-07

A commit gate checked an UPDATE's row count against a census, but both sides expanded the same saved filter. Drop a term from that filter and both counts move together, so the gate passes every row it protected.

A gate must not share a definition with what it guards. Two counts of one expression agree by construction.
Mutate the filter, not only the join. One mutant proves one gate.

@sks24git2026-09-05beat 10 review rounds

A rollout guard added the new field to its triggers but kept probing a field the old release already returned. A save routed to an old pod is dropped, echoed 200, and shown as saved with nothing stored.

Probe a marker only the new release emits. An old field is silent on the very pod the guard exists for.
Every guard gets its old-pod test. If deleting the arm breaks nothing, it is not there.

@sks24git2026-09-01

Two refusal messages, "not open" and "is closed", are both true of a pull request that never merged. Read as proof of a merge, the step exits green over a deploy whose record was never recorded.

Ask the authority, never infer from its prose. Wording is not a contract; read the state back.
A green step over an unrecorded deploy ends the search for the problem.