Lessons

One of two view modes applied the style that gives the inner container a height and the other did not, so in that mode the scroll view had zero height to lay out within; it rendered nothing at all, while the data behind it was present and correct.

An image error callback set a terminal failure flag on every error, including a platform cache eviction that fires an error and then succeeds moments later, so a recoverable condition became a permanently blank element.

Feature gates computed the current calendar day from a UTC instant rather than the device's local date, so from late afternoon onward in western zones the code believed it was already tomorrow and hid controls whose last valid day was still in progress locally.

A client sent both type flags to widen its offline cache; the server treated the presence of both as a distinct mode that skipped a scoping rule, so the widened request returned a differently-filtered set rather than a superset. A second variant composes filter dimensions with a union rather than an intersection — each populated filter is appended to one OR clause — so selecting a second facet returns MORE rows, and a multi-select control implies narrowing while broadening.

A shared lookup gained an unconditional filter to stop one consumer showing in-progress data as if it were final; a second consumer existed specifically to preview that in-progress data, and the filter silently emptied its result.

The same user-facing concern was implemented independently in several sibling dialogs instead of in one shared source, so each bug report fixed one copy and left the others carrying the identical gap.

A backend widened a date range by one day so timezone conversion could not drop boundary records; the frontend grouped everything it received without re-applying the requested range, so the safety buffer surfaced as extra rows in the report.

Two roles exposed navigation items carrying identical page identifiers and differing only in display label; a single shared identifier-to-route table mapped both to the first role's routes, so the second role's clicks navigated into the wrong context and lost its state.

A stakeholder's complaint was read as specifying one axis of a change when it specified another, and the resulting architecture decision was implemented for several days before feedback reversed it.

Multi-megabyte model files were kept out of the build output and served as separate static assets loaded lazily, then cached in a store offering programmatic versioning — so asset size stopped inflating initial load and cache invalidation became an explicit decision rather than a side effect of deployment.

Adding a member to an enum reads as a one-line change because the validator is one line. But every consumer downstream already decides what to do with a value it does not recognise, and it decided silently, at different times, for different reasons: one throws, one returns without acting, one has no branch at all and lets the value fall into arithmetic against an undefined field. None of those policies is written down and none is wrong on its own. So widening the validator does not fail — it HALF-lands. The stores that refuse raise an error the author fixes; the stores that drop quietly keep accepting writes that go nowhere, and the two halves of one event disagree forever with nothing raised. The defaults are what make it durable: the permissive ones are invisible by construction, and the flattering direction is always "this looked fine".

A verification dialog read a certificate object out of the payload already loaded for the list, while the reference implementation fetched the record fresh from a per-record endpoint on open — so the dialog rendered a stale, differently-shaped copy and displayed values that were simply wrong.

A tag reference was modelled as either a single id or a list of ids depending on the record; the lookup returned one match, so records carrying several tags displayed exactly one and the remainder vanished with no error anywhere.

A log field held a plain string on most records and a structured object on some; the view rendered it directly, and the object reached the renderer as a child it could not display, throwing at runtime for exactly the records that used the richer shape.

List rows were keyed on the parent record's id while the list rendered one row per child of that parent, so every row of a multi-child parent shared a key and the framework misreconciled them — leaving stale rows behind when the list switched between grouped and ungrouped modes.

A rewritten screen computed a visibility condition with an extra clause the original implementation did not have, so an affordance the reference showed was permanently hidden for a whole category of record.

An onboarding timestamp was set in exactly one place — the page an invited user lands on to set a password — while a second, self-service signup route created accounts without ever passing through it, so those users kept a null timestamp permanently and every report derived from it counted them as pending forever.

A screen rendered the service ids stored on a facility directly as the displayed options, while the reference implementation resolved each id against the owner-wide catalogue and dropped the ones absent from it — so the screen showed entries the authoritative source no longer offered.

A widget was compared against the reference implementation, which showed an empty state; the difference was investigated as a data or filter mismatch for some time before a network capture showed the reference's own endpoint was returning a server error — its empty state was a failure, not an answer.

A list marked non-editable rows with a distinct icon but passed no view-only flag when opening the editor, so the editor opened fully editable — the constraint existed as a rendering decision in one component rather than as state both components could read.

A detail view was opened by setting local component state rather than pushing a route, so the navigation system had no record of it — and every affordance the router owns (tab re-press, back, deep links, history) silently stopped applying to that view.

A base URL was configured as a bare path rather than an absolute URL; the HTTP client accepted it and resolved every call relative to it, so a configuration error surfaced as a network error at request time with no indication that config was the cause.

A lesson template rendered a fixed sequence of block types with no slot for warm-ups or labs, so authors expressed those by stuffing prose into a free-text field meant for something else — and the renderer's fixed order then silently dictated what the content could mean.

A card-flip effect built from CSS 3D transforms depends on a preserved 3D context between the parent and its faces; placing that structure inside another element that is itself transformed flattens the context, and the effect degrades or disappears with no error.

A native build failed while the compiler's dependency scanner analysed a third-party module in isolation, because a toolchain release regressed how it resolved standard library headers during that scan — a phase that runs independently of any project-level build setting, so nothing in the project could have caused or fixed it.

A summary screen filtered out every organisation whose totals came to zero and replaced a legitimately-computed zero total with a 'no data' caption — so a query that correctly returned zero activity for a period rendered as though the query had failed or returned nothing.

Two upload buttons rendered correctly, were styled as interactive, and had no handler attached at all — while the implementation plan recorded both features as complete, because the plan tracked what had been built to look right rather than what had been wired.

A generated artifact was built for a local, trusted consumer and therefore deliberately contained restricted content; a later feature shipped that same artifact to an untrusted audience, and the redaction rules that had guarded every existing surface were attached to those surfaces rather than to the data, so none of them applied.

A plan is written in the future tense about artifacts that do not exist yet. Any document later derived from it — notes, a study guide, a README, an onboarding page, a status summary — restates those lines in the present tense, because that is what prose does to a list of intentions. The tense change is the whole defect: nothing in the derivation consults the filesystem, and a named artifact that was merely planned becomes a claim that it exists. The claim is then unusually durable, because derived documents are read as descriptions of the system rather than as assertions needing evidence, and because the one reader best placed to falsify it is the author, who remembers writing the plan.

A redirect is a successful response. A fetch not told to follow one does not fail, warn or return nothing - it returns the redirect's own body, which on most hosting platforms is a short placeholder. Every downstream layer then does exactly what it was written to do, against the wrong bytes. The direction is what makes it dangerous: verification steps built on a fetch are usually looking for the ABSENCE of something - an empty diff, a grep with no hits, a checksum comparison - and a placeholder body satisfies every one of those tests.

A record's renter field always requires a person's identifier, with the organisation held in a separate companion field; a dialog let the user pick an organisation and submitted that organisation's id into the person field, which failed only at the driver when it tried to parse an identifier of the wrong shape.

A link was given flex-grow so every row's text would start at a shared column position; when icon buttons were later added after it in the same row, the stretched link consumed all remaining width and pushed them to the far edge, far from the content they acted on.

A correctness guard written for a scheduled or automatic caller is implemented inside the shared query rather than at that caller, so every other caller inherits it — and the manual preview path, whose entire purpose is to show the state the guard exists to exclude, is left showing nothing or showing stale data; the preview still runs and still renders, so the defeat is invisible until someone notices they are previewing the wrong thing.

A policy check subscribed to an enumerated list of actor names — the tools, commands or handlers that normally perform an action — rather than to the effect it cares about. Any other route to the same effect is invisible to it, so a caller preference, a configuration mode, or a convention change silently reduces the guard's coverage to zero without changing a line of its code, without failing a test, and without emitting anything that reads as a fault.

A shared screen scaffold applied padding to everything it wrapped, and individual screens applied their own container padding inside it, so each affected screen rendered with the two combined — visibly narrower content, with neither component doing anything wrong on its own.

A context object was built by explicitly mapping a chosen list of fields from the stored record; a field added afterwards was never added to that list, so every consumer read it as the empty default and treated the absence as a legitimate value rather than a missing mapping.

A retrieval entrypoint recorded one usage event per returned document on every call, with an opt-out flag that callers had to pass explicitly; a diagnostic script written to inspect ranking output called it with default options, so five inspection calls silently appended twenty-five usage events to a committed feedback store, and because that store feeds the ranking boost the quality benchmark regressed with no change to any ranked content.

A text scanner segments prose into sentences with a boundary class holding both sentence punctuation and a newline, then requires two things to co-occur inside one segment — a subject and its predicate, a grant verb and its negation; hard-wrapped prose puts them in different segments, so the co-occurrence test is evaluated on fragments and the scanner silently reports the opposite of the truth on every wrapped document while passing every unwrapped example it was developed against.

Every row's action button read the shared mutation's pending flag directly, which is true for the whole table while any single row's request is in flight — so acting on one row disabled the same control on every other row.

An owner identifier used to match certificates was computed once at the first resolution hop and then never reassigned, while the code below it continued walking the ownership chain — so the matching ran against an intermediate value while the rest of the routine had moved on.

A dialog gained a toggle, but the payload type it submitted had no field for that value — so the control worked, the state updated, and the value was discarded before the request left the client, with nothing anywhere reporting a problem.

An agent's context is assembled once at session start and then held constant, so any environment description in it — version-control status, branch, open files, directory listings, service health — states what was true at assembly time and is never revised as the session runs. Because it reads as present tense and sits alongside genuinely current instructions, it is consumed as live state. Any operation whose safety depends on that state being current is then performed against a stale premise, and the destructive ones in this class fail silently: they succeed, report success, and the loss is invisible until something unrelated contradicts it.

A view rendered a persisted, multi-period collection that grows as the user navigates, without filtering it to the period currently selected — so a screen showing one month displayed entries from several months either side of it.

Route-level auth middleware written to protect pages also matches the metadata routes that browsers and operating systems fetch out-of-band — manifest, icons, well-known paths — and those fetches carry no session, so they receive a redirect to the login page instead of the asset; nothing errors, no request fails visibly, and the platform silently falls back to a default, so the missing asset is investigated as a content or configuration problem rather than as an auth problem.

A source file contained a literal NUL byte, so the standard search tools classified it as binary and skipped it silently; every search across the tree returned no matches from that file, and the absence of results was indistinguishable from the absence of the thing being searched for.

A list was sorted at render by a numeric attribute, on the strength of a code comment claiming this matched the reference; the reference applies no sort at render at all — its order comes from the array being sorted once, alphabetically, at the moment the record is created.

An owner identifier was read through a single property path, but records belonging to a parent organisation nest that identifier one level deeper; for those records the value was undefined, a downstream lookup returned nothing, a derived list stayed empty, and the visible symptom was a submit button that never enabled.

A widget was implemented faithfully from an internal screen specification that described it in one line; the reference implementation it was meant to match contained several controls the spec never mentioned, so a correct implementation of the spec was a materially incomplete implementation of the feature.

A section was missing a bulk-selection affordance the reference offered; unlike the surrounding gaps found the same day, nothing was misconfigured or hidden — the capability had simply never been built for that screen, so every investigation technique aimed at finding what suppressed it was pointed at nothing.

A live filter tested a hand-written list of fields that omitted one which was nonetheless rendered inside a column's cell — so typing a value plainly visible on screen returned no results, and the row containing it disappeared.

Filter chips laid out in an unconstrained flex row had no minimum width, so on a narrow viewport the row kept shrinking them to fit rather than moving any to the next line — producing overlapping, unreadable controls instead of a wrapped grid.

The three viewport height units fail in three different ways, so choosing by habit rather than by behaviour picks a failure rather than avoiding one. The full unit measures as if browser chrome were hidden, so bottom content sits behind it. The dynamic unit re-measures when chrome collapses or expands, and the browser defers that resize to the end of a scroll gesture, so a locked layout visibly shifts. The small unit is always the chrome-visible height, costing an unused strip that is invisible when the background matches.

A guided flow unlocked each step only when the previous one reported completion, and the interactive steps reported completion only on a correct answer — so a user who could not solve one step could not reach any step after it, with no way forward that did not require someone else's help.

Two branches independently added a byte-for-byte identical block to the same file; because three-way merge only reports a conflict when the two sides differ, it auto-resolved cleanly and committed both copies, producing a duplicate definition that no merge marker announced.

A helper concatenated a hardcoded origin in front of a stored path field, but that field already held a complete absolute URL to the storage host — so every link came out as two origins glued together and resolved to nothing.

A dialog built as a mobile bottom sheet — pinned to the bottom edge, full width, rounded on its top corners only — was reused unmodified on a desktop screen, where those same rules rendered it as a full-bleed panel welded to the edge of a wide viewport rather than a centred dialog.

A seed script wrote a record with a null token and a flag indicating the value was unencrypted; a separate system read that record and unconditionally ran an encryption call on the field, with no null guard — so seeded data crashed a page that had nothing to do with the feature being seeded.

A responsiveness audit reported that an entire grid had no mobile adaptation; a live screenshot from the affected device showed the default view already rendered correctly and only one alternate view was broken — the finding had generalised from one observed case to the whole component.

An endpoint read certificates from a standalone assignments collection filtered by document type; the records users actually upload are stored embedded in the parent document, so the query was well-formed, ran without error, and returned nothing because it was pointed at a table that this flow never writes to.

A count displayed in a table came from one endpoint while the list behind it came from another; a refresh gesture re-fetched only the first, so after a change the count and the list it summarised showed different numbers, each internally correct.

The client's 401 handler destroyed the session and redirected to login on the first occurrence, while the sibling 403 handler first probed whether the service was actually reachable — so a momentary 401 from any endpoint was indistinguishable from a genuinely expired session and could not be recovered from.

Two memoised selectors were computed in parallel from the same API payload: one mapped services into typed objects carrying their work-order data, the other re-parsed the same slots into plain strings — and the display consumed the string version, so the richer derivation's output was computed and thrown away.

A list query uses an explicit column list that omits an expensive column to stay lean. Records loaded through that path therefore carry the field as undefined rather than as missing, so a caller reading it gets a falsy value instead of an error and cannot tell not selected from empty. The fix is a separate on-demand fetch, because adding the column back restores the cost the projection existed to avoid.

A seed script designed to be re-runnable deletes and reinserts its table rows, but the user-creation step calls an API that throws when the email already exists. So the script is idempotent everywhere except one step, and that step fails the whole run on the second execution - which reads as the seed being broken rather than as one non-idempotent call inside an otherwise re-runnable script.

A hard redirect wipes JavaScript memory, so an SDK client configured not to persist its session has no session after the navigation. Authenticated calls then resolve to a null user and every write fails authorization, which presents as a permissions problem rather than as a lost session. Persisting the session to storage survives the reload, but existing users must re-authenticate once to populate it.

When rows from several sources are pooled, a total and a per-category breakdown are usually computed in separate loops. The total counts rows; the breakdown reads the field that names the category. If one source records its category under a different field (an outcome instead of a label, a status instead of a type), the breakdown loop skips every row from that source without an error, because a missing field reads as "no category", not as a failure. An exclusion applied to the total (suspect rows, duplicates) is also easy to leave out of the breakdown loop. The two figures then describe different populations while sitting side by side, and every check derived from the breakdown (smallest class, majority baseline, balance) is computed on the wrong population.

A development server adds its own overhead to every measurement - hot-reload middleware, unminified bundles, an unoptimized transform pipeline - and that overhead is not a constant offset that cancels when two variants are compared. It varies run to run by more than a modest real effect, so the noise can exceed the signal or invert which variant looks faster. The trace still renders, the numbers still look like measurements, and nothing marks them as unusable, so a keep-or-revert decision gets made on a figure whose error bar is larger than the difference it claims to show.

A threshold check with a single branch — fail above the limit, pass otherwise — cannot express proximity, so a value at 100% of its ceiling and a value at 40% produce the identical success word. The state that taxes every future edit is therefore indistinguishable, in the checker's own output, from the state with the most room. The tax is paid in unrelated content: once a file is at its limit, any addition must be funded by a deletion, and the deletion gets chosen for being cuttable rather than for being wrong.

A build toolchain that reads whole directories as input decides which ones it recognises before it does any work, and a directory whose name it does not accept is skipped rather than rejected — no diagnostic names it, and the build continues. Nothing is missing from the toolchain's point of view; there is simply less input than before. The failure therefore appears only later, at compile or link time, as every reference to the skipped directory's contents failing to resolve. Those references live in files the change never touched, so the error points at stable code and away from the edit that caused it, and the natural first theory becomes a stale cache, because the symptom followed a rename.

A development server hands out bundled assets over HTTP, so the asset layer caches each one to a real file and reports a local file path, while a release build compiles the same asset into a platform resource and the identical call returns a bare resource name with no scheme and no path — so any consumer that needs an openable file works in every development run and fails only in the shipped build.

A screenshot pipeline shares one browser context across all its frames so a single sign-in covers the whole run, but a browser context is also the store for everything the application persists per user; a frame that clicks a UI control writing such a setting — a theme, a display density, a language, a dismissed banner — mutates that shared store, and every frame captured afterwards inherits the mutation, producing images that are of the right route and internally plausible while showing a state no default visitor would ever see.

A build script that drives a headless browser against a development server captures whatever that server injects into the page, and modern frameworks inject dev-only UI — a devtools badge, an error overlay, a route announcer, a rebuild indicator — outside the application's own component tree, so nothing in the captured route can hide it; the injected element lands in the generated asset, and because the asset is checked in and consumed later, every cheap verification (file exists, non-zero size, one layer inspected alone) passes while the defect rides along invisibly until the layers are composited or the page ships.

In Kotlin coroutines, cancellation is delivered by throwing CancellationException from the next suspension point, and CancellationException extends IllegalStateException — an ordinary Exception. So every `catch (e: Exception)` or `catch (e: Throwable)` between a suspension point and the coroutine boundary catches the cancellation as if it were an error, logs or retries or returns a fallback, and continues the loop; the job reports itself cancelled, its parent moves on, and the work keeps running detached — writing files, holding sockets, updating state the UI no longer shows. Nothing fails loudly, because the handler was written to make failures quiet.

A long-poll or subscribe call has two exits: the notifier wakes it when new data lands, or its timer runs out. Many implementations recompute the answer on BOTH exits (they re-query "what is newer than what you had" rather than carry the item that triggered the wake). So when the wake is broken, the timeout exit still returns the new item, just late. A check that sends a write while a waiter is parked and asserts only that the waiter received that write passes either way. Its test timeout is usually generous enough to cover the waiter's own timeout, so nothing slows it down enough to fail, and the only signature of the defect is a delay nobody asserted.

Two related defects in material written on someone's behalf for a reader who already holds earlier messages from them. First, prep built from the newest artifacts — a CV, a submitted exercise — silently omits anything that only exists in an earlier sent message, so it can list as a gap something the reader has already read the opposite of. Second, every restatement of a sent claim is an opportunity for the verb to strengthen: "reported an issue with a proposed patch" becomes "patched", then "fixed", because the restater is summarising and completion verbs are shorter. Neither step consults the sent text, and the reader will, so the drift surfaces as a follow-up question the candidate cannot answer.

A version-control status is only meaningful relative to a repository root, and a status query run from a path that is not inside one reports no changes rather than reporting an error. That empty answer renders identically to nothing is modified. Nested layouts make this routine: a workspace directory holding several sibling repositories is itself untracked, so tooling that probes the wrong level inherits a clean report it never earned - immediately before whatever command was going to discard uncommitted work.

A command-line tool parses a flag, lists it in --help with an example, and implements it by enabling a capability somewhere else in its own runtime — a tool it injects, a plugin it loads, a mode it switches on. When that wiring is missing or is suppressed by another option, the flag still parses, the run still completes, and the process still exits zero, because nothing in the exit path knows the flag was supposed to change the output. The caller reads the exit status as confirmation and builds on a contract that was never honoured.

When a component was deliberately relocated in the past, the person who did it often leaves a comment at the new site explaining why — the reasoning that made the old placement wrong. That comment is frequently the only surviving record of the decision; it is not linked from anywhere a new request would surface, and nothing prompts a reader to go looking for it before making the opposite change. A later instruction to move the same content back arrives with none of that context attached, so acting on the instruction alone silently discards reasoning nobody was asked to reconsider.

A telemetry contract is two calls — one on the entry path recording that the component ran, one on the acting branch recording that it fired — and only the first is on the path every invocation takes. A component wired to the first alone keeps working, keeps its own private record of what it did, and contributes nothing to the shared log, so every audit built on that log shows it as a zero. The zero is read as a quiet component rather than an unwired one, because a component that correctly had nothing to do produces the identical value, and every rate computed over that log then divides by a population missing the un-recorded channel entirely.

A config key documented as multi-valued accumulates every value set for it across all scopes rather than letting the narrowest scope replace the others, so an inline per-command value is appended to the system-wide one instead of overriding it, and the pre-existing entry — still first in the list — is consulted first and answers, leaving the explicitly passed value silently unused.

An installer that writes configuration and then verifies an unrelated prerequisite performs those steps in that order, so a failure at the later step exits non-zero with the earlier writes already committed to disk. The non-zero exit reads as "the command did nothing", which is the one interpretation the tool never promises; re-running or hand-writing the same configuration then duplicates it, and abandoning the command leaves an unrecorded global change nobody knows landed.

Bindings declared with const and let are hoisted but not initialised, so reading one before its declaration throws at RUNTIME rather than at compile time. The typechecker does catch the direct case, where the use and the declaration sit in the same straight-line scope and it can order them. It cannot catch the same read THROUGH A CLOSURE: once the reference is inside a function the checker no longer knows when that function runs, so a closure invoked during render reads the binding in its temporal dead zone and throws, with nothing flagged at build time.

Asking whether A contains B or B contains A is a fine question for deciding whether two paths sit on one branch of a tree. It is the wrong question for deciding WHICH SCOPE OWNS THE WORK, because containment upward is unbounded: every ancestor contains you and the filesystem root contains everything. The symmetric form usually appears for a good reason, which is what makes it durable - it is correct for the question it was written for and silently over-broad for the one it gets reused for.

The continue statement does not resume at the bottom of the loop body, it jumps to the next iteration and skips everything between itself and the closing brace. A finally block still runs, because unwinding past it is what finally is for - and that is what makes this misleading, since the one construct visibly executing on the way out is the one that would have reassured you the tail runs too. Moving a statement from inside the try to below it therefore stops it running on exactly the iterations that took the continue.

A collection of ordered stages was exported from a pure model module, which computed progression bounds from the collection's own length; the view layer consuming it hardcoded the same count in a clamp, a displayed total and a progress caption. Growing the collection left the trailing entries permanently unreachable, and the test suite stayed green because the tests imported the model, where every use of the count was already derived.

A view capped with head, tail or a page limit returns a well-formed list of rows, so counting it produces a well-formed number — the window's size, not the population's — and nothing in the output says rows were cut.

A write helper keeps several counters on one record and maintains one of them as a derived roll-up of the others — set to the max or the sum of its siblings so that a caller reporting only the specific event still increments the general one. The derivation lives in the writer. Every reader sees a flat object of same-shaped integer fields with same-shaped names, and nothing in the field name, the type or the stored value says one of them is not independent. Summing the fields to get a total therefore counts the rolled-up events twice, and the result is not obviously wrong: it is a plausible integer, larger than any part, that moves in the right direction when real activity moves. The error surfaces only against an external bound — a total that exceeds a parent count it must be a subset of — and even then it reads as contamination in the data rather than as a mistake in the arithmetic.

Postgres's CREATE TABLE, CREATE INDEX, and CREATE EXTENSION all accept IF NOT EXISTS, but CREATE POLICY does not, so a migration file that guards every other statement that way still throws "policy already exists" (42710) the moment it is applied a second time — which happens whenever a deploy is retried after failing partway through, run once locally and once again by CI, or replayed to recover from an unrelated error.

A CSS filter makes its element the root of a filtered subtree that must be re-rasterized whenever anything inside it changes, so an ancestor's decorative shadow costs exactly as much per animation frame as one on the moving element itself — and moving the filter from child to parent, the intuitive fix, changes nothing because the animating element is still inside the filtered subtree.

A demo surface ships curated inputs — preset queries, seed data, a 'try this' chip — chosen because they produced a good result on the day they were written. Each is an untested fixture pinned to the engine's behaviour at authoring time: when the engine later gains or tightens a threshold (a relevance floor, a minimum-coverage cutoff), the curated input can fall below it while real usage still passes, and nothing fails — the page renders the engine's honest empty state as the product's first impression, and every build stays green because no check asserts that the demo inputs still demonstrate anything.

A finding is recorded together with metadata asserting that it is machine-checkable — a boolean flag, a rule id, a written pattern, a policy naming its enforcement mechanism. Implementing the check is a separate act in a separate file, and nothing links the two. The declaration is the artifact everyone reads afterwards, so the system is understood to be covered from the moment the flag is set. The gap is invisible in exactly the direction that matters: reading the finding tells you a check exists, and only reading the checking tool tells you it does not.

An enforcement mechanism decides by a WINDOWED predicate - a counter since the last compliance, a rate over a rolling interval, a streak - but its message to the person or agent it stops is written as an ABSOLUTE condition, because the absolute phrasing is shorter and reads as more urgent. Both are true at the moment of firing, so nothing looks wrong. They diverge for a reader who HAS just complied: the counter reset and counted back up, while the sentence says the thing was never done at all. Anyone grading that firing reads the sentence, not the predicate, so a correct firing is recorded as a false one - and the grade lands in whatever column exists to decide whether the mechanism is worth keeping.

A scripted edit touching several files in one command has ONE exit status for all of them, so a permission gate refusing that command refuses every edit at once. That is fine while the refusal is read. The trap is the next command: it carries its own edits, prints its own ok, and that ok is read as covering everything before it. The batch was not partially applied - it was entirely refused - but the transcript afterwards looks like a run that succeeded.

A screen whose output depends on the current date is only comparable across two implementations if BOTH SIDES WERE OBSERVED AT THE SAME MOMENT. Otherwise the comparison carries an extra variable nobody wrote down, and that variable's effect is exactly one unit. One unit is also what a genuine timezone or rounding fault produces, so a stale observation and a real defect present identically - and the stale one is the more likely of the two.

A tool decides "this is a version-controlled project" by testing whether a .git path exists, while the version-control tool itself decides it by reading a valid HEAD inside that path; a .git directory left holding only empty scaffolding satisfies the first test and fails the second, so the environment description asserts a repository that no command can operate on.

A discovery function keyed to one platform's structural marker file finds nothing for a differently-shaped build of the same thing on another platform, and its caller's "nothing to check" message cannot distinguish that from a genuinely empty result — so a whole platform's output goes permanently unscanned.

A dispersion statistic describes the population it is GIVEN, not the population its name implies. A filter or minimum-length guard sitting immediately before the computation silently redefines that population, so any edit that adds samples inside the excluded band moves the score the OPPOSITE way from the intuition the metric's name sells. The guard is usually there to drop noise, which is why it survives review and why nobody re-reads it when the number moves.

A counter kept for display increments on every attempt, while the algorithm consuming it needs only successful ones, so the substitution behaves correctly for every user who never fails and inverts the algorithm's intent for exactly the users it exists to help.

A "project details" table gives public identifiers and secret credentials the same visual and structural treatment, so the credential inherits the identifiers' handling — pasted in for convenience, copied and shared freely — while sitting outside every protection built for secrets.

A build-time checker that verifies local content still matches a live externally-hosted page works by pattern-matching that page's exact wording and DOM structure. Those anchors are a dependency on an upstream system nobody here controls. When the page is redesigned the checker does not report drift in the CONTENT it exists to protect - it fails on its own anchors, or silently matches nothing, and the check that was meant to catch drift becomes the thing that drifted.

A fail-fast tool stops at its first complaint, so a probe exercising N variables in one invocation yields exactly one datum no matter how many things it changed, and the reader — who already has a hypothesis about one specific variable — reads that single failure as a verdict on the variable they cared about, when it is only a verdict on whichever variable the tool happened to reach first.

A field recording WHETHER SOMETHING FAILED is not a property of the record, it is a property of an observation somebody made, and the writer is the only party who was there. Every later reader, migration and audit query sees the stored value and cannot distinguish the caller asserted this from nobody said so the code picked. That removes the usual tiebreaker: both defaults invent a fact nobody observed, one manufacturing failures that never happened and the other erasing ones that did.

An element carrying a CSS animation with a fill mode that touches transform in any keyframe keeps a COMPUTED transform after the animation finishes - a resolved identity matrix, never the literal none keyword - even when the final keyframe writes transform none. Per spec any computed transform other than literal none makes that element a containing block for fixed-position descendants, so a finished, visually inert animation silently re-parents fixed children and they scroll with it.

A completeness figure is built by summing a per-item counter into a total, summing a second per-item counter into another total, subtracting, and flooring the result at zero so it cannot go negative. The floor is applied once, to the difference of the aggregates, instead of once per item before they are added. Items where the second counter exceeds the first then contribute a negative amount that silently pays down the deficit of items where it falls short, and the alarm figure settles at or near zero while genuine shortfalls remain. Nothing errors, no threshold is crossed, and the aggregate is arithmetically correct — it is answering a question nobody asked. The paired ratio built from the same two totals is the only visible symptom, because excess in the numerator has nowhere to hide there and pushes it past 100%.

A full-page screenshot mode resizes the viewport to the full document height before capturing, which breaks any fixed-position element sized in viewport units — it only covers the top slice of the artificially tall capture, so the rest of the page appears to fall through to bare background exactly as a real "content outgrew the backdrop" bug would look.

Mobile browsers retract the URL toolbar as the page scrolls but deliberately defer the matching layout-viewport resize until the touch gesture ends, so for the whole duration of a drag a fixed element pinned to all four insets is still sized to the pre-retraction viewport while the screen already shows the post-retraction area, leaving a toolbar-high uncovered strip that the page background shows through and that vanishes on release.

A check wired to a run terminal event - a session-end hook, an exit handler, a finally block, an unload listener - is written as though that event always arrives. It does not. A run that is abandoned mid-step, killed, replaced by a newer one or simply closed ends without firing it, and from the outside that is indistinguishable from a run where the check executed and found nothing to say. The gap is not randomly distributed. The longer and more eventful a run is, the likelier it is to end abruptly, so the check is quietest over precisely the population it was built for and loudest over the short tidy runs that needed it least. Its own records agree with it, because a check that never executed writes no complaint, so the absence of findings reads as a clean bill of health rather than as an absence of checking.

Error handling sorts failures into transient and permanent by HTTP status, taking the meanings from convention: slow down, try again, and the thing you named does not exist. That last one is the weak link, because the identifier in question is frequently not a URL path segment but a FIELD IN THE REQUEST BODY - a model name, a plan id, a region. A gateway reporting an unknown body field with the status its own error vocabulary reserves for a missing route is then sorted as permanent by a client that should have retried, or as retryable by one that should have stopped.

A query variant derived from context - the file being edited, an expanded phrasing, a hypothetical document - is about ITS SOURCE, not about the user's question. Rank fusion treats it as a second opinion on the same question, which holds only while the two really are about the same thing. When the user's query goes somewhere the corpus does not cover, the assumption breaks silently: fusion has no notion of agreement, it merges ranked lists, and a list that is the only non-empty one wins by default.

A generated file that is committed rather than ignored has two states that must agree — the one in version control and the one the generator would produce now. When the build's pre-step runs that generator in WRITE mode, every local build silently reconciles them in the working tree, so the developer never sees a difference and never commits the repair. The tracked copy then drifts arbitrarily far behind its source while every local signal stays green, and the only artifact built from the stale copy is the deployed one, produced by a pipeline that also regenerates it — meaning the deployment is correct and the repository is wrong, which is the opposite of the direction anyone checks.

A plain `git checkout` switches which branch HEAD points at, but the working directory — every file on disk — is the same directory both before and after. Uncommitted changes are not attached to a branch; they are attached to the working directory. So checking out branch B while branch A's edits are still uncommitted does not leave those edits behind on A — they simply continue existing in the one shared directory, now read as if they belonged to B, with nothing in the checkout's output naming what just carried over.

A self-healing guard owns one entry in a multi-valued configuration key and treats that entry as the whole key. Its coverage test asks whether its own value is present, not whether the configuration is correct, so any additional entry another owner added is invisible to it. Its repair path then writes the key from a single constant in code, so the moment the file is lost or reset the repair restores one entry and drops every other, reports the restoration as a success, and passes its own coverage test on every run afterwards. Both halves read as correct in isolation: the check is satisfied, the repair is idempotent, and the narrowing leaves no error, no diff anyone reviews, and no symptom except the quiet return of whatever the dropped entry was preventing.

An outer layer classifies outcomes by catching a sentinel error (a stub's "not implemented", a cancellation, a retry-me signal) and treating it differently from a real failure; an intermediate helper written for convenience catches every error and returns its code or message as an ordinary value, so the sentinel never reaches the layer that knows what it means, and arrives instead as data that the caller compares against an expected result and reports as a mismatch — the stage the sentinel exists to excuse is charged with a failure, and nothing in the helper looks wrong because error-to-value is its whole job.

A screen registered as a tab-navigator route (even one hidden from the visible tab bar via an option like href:null, used purely to keep it out of the tab UI) is still a tab-navigator singleton under the hood — the framework keeps exactly one persistent instance mounted for the navigator's lifetime, by design, so that switching tabs preserves scroll position and state. Navigating to it again with new parameters re-focuses that same instance and updates its params in place; it does not unmount and remount. Any state seeded with a lazy initializer that reads navigation params once (a bare useState(param ?? default), or a useState lazy-initializer function) captures only the very first navigation's values and never re-derives them on a later visit, so the screen keeps showing its original content indefinitely while the navigation state itself has already moved on.

A hook that makes an overlay close on the back gesture works by pushing one history entry per mount, so keying that overlay by the id of the item it displays makes every prev/next step a remount and pushes a new entry each time; adding in-place stepping to a component whose identity is its item silently converts one back press into as many as the user has stepped, and the fix — a stable key — moves the burden to per-item state that must now be reset explicitly at render.

Hosting providers branch their DNS instructions on whether a hostname is an apex domain or a subdomain, and they decide which branch applies using the Public Suffix List rather than by counting dots. Any name registered under a listed suffix is an apex domain to them however deep it looks, because community subdomain services add themselves to that list deliberately to stop one user's site setting cookies readable by another's. The provider's subdomain instructions therefore do not apply, and following them produces a configuration that looks right and does not resolve.

An automated layout check reads bounding boxes and scroll widths, so it can only prove that no element exceeds its box. Whether a boundary READS as a boundary is perceptual - edge clarity, contrast, visual separation - and lives in the decorative layer of glows, shadows, gradients and blurs that the box model does not describe. A page therefore passes every overflow assertion while looking broken, and re-running that same tooling against a report of something looking merged or cramped answers a question nobody asked, while presenting as evidence that the complaint was unfounded.

Unused-symbol rules are almost always scoped to local declarations, because a genuinely exported symbol has callers the analyser cannot see. A file with no import and no export is not a module — every top-level declaration in it is a global, which the same rule therefore declines to judge. So the rule is not disabled, not misconfigured, and not failing: it is applying exactly as documented to a file where its precondition is absent. The check reports the file clean, and dead code accumulates in precisely the files nobody gave a scope to.

A log line records the name of the thing that ran - a model id, an image tag, a plan name - and not the configuration that run was granted, because capabilities granted out of band leave no trace in the identifier. Two runs with byte-identical ids can operate under materially different limits. Any enrichment table keyed on the identifier is therefore not reading the configuration, it is asserting one, and the assertion is indistinguishable from a measurement once it is rendered beside real data.

A scorer that filters before it aggregates is not measuring the artifact, it is measuring whatever survived the filter. An edit aimed at the number but landing inside the discarded range moves nothing, and a number that did not move reads as "my change was too small" instead of "my change was never counted". The natural response is to repeat the same edit harder, which is more work inside the same blind spot, and each attempt still alters the artifact for a reader while buying nothing from the check.

A mirroring scale and a transform-origin only compose into a flip-in-place when the origin is the element's centre. About an edge origin the mirror reflects the element to the far side of that edge, which is a mirror plus a translation of the element's full width. When the element is also pinned to that same edge of its container, the translation is exactly enough to carry it outside the visible area. Nothing errors: the element renders, has a real size and participates in layout - it is simply somewhere nobody looks.

A verdict built from several conditions checked in order returns on the first one that fails, so a negative test only exercises the condition that rejects it FIRST. A plant written to prove a later guard (usually the newest, added because the earlier ones passed something they should not have) is typically generic bad input, and generic bad input fails the oldest and cheapest condition, so the suite stays green with the new guard deleted. The input the new guard exists for is by construction one that passes every earlier condition, which is exactly the shape a generic plant does not have.

A contract like this runs once per session is a uniqueness claim over some identity. If the function performing the action never RECEIVES that identity, the contract cannot be enforced by code and can only be narrated beside it. The narration fails characteristically: each call site documents itself as the one legitimate caller, each comment is locally plausible, and nothing compares the claims to each other or to the actual call count - so the contract reads as enforced everywhere and holds nowhere.

Library code survives review and reuse precisely because its specifics are parameterized out — paths, names, and identifiers arrive as arguments or config. A one-time script inverts that economy; written to run once against one known target, it earns nothing by taking parameters, so the private specifics — client names, internal hostnames, vault paths — are written directly into its string literals. A later "code-only" copy or publish then treats every source file as equally generic, because the sensitive/generic boundary is assumed to follow the data/code boundary, and the one-time script crosses it silently.

A dependency can ship a compiled artifact alongside the source it was compiled from, and declare in its own build metadata that consumers should resolve the artifact. The build system then honours that declaration and never compiles the source, so a patch applied at the package-manager layer edits a file that is not an input to anything — the patch applies cleanly, the build succeeds, every tool reports success, and the shipped binary contains none of the change.

A parity defect claims two implementations reach a different DESTINATION for the same action, and the evidence that decides it is the endpoint each submit handler calls and the payload it sends. What is usually on screen when the report gets written is one side's handler read fully, plus a plausible-looking label from elsewhere in the reference file - a type name, an enum value, a comment. Filing from those two is a claim about an endpoint nobody read.

A tool enforcing policy by statically scanning command or configuration TEXT for file paths will occasionally extract a token that looks like a path but was never going to resolve to one: an unexpanded shell variable, an un-rendered template placeholder, or a token truncated by a line continuation. Because that token carries no root marker, ordinary path-resolution treats it as relative and joins it to the current directory, fabricating a plausible absolute path that names nowhere - and the policy decision is then made about a file that does not exist.

A fixed per-item budget enforced by timeout-and-discard, whose miss branch keeps the previous output and emits nothing, produces zero output when the budget sits below the typical cost — and reads, to the owner and in the log, as "slow" rather than "broken".

A generator renders one source file into a small set of named variants, each hardcoded to its own output path. The variant names model the axis someone anticipated (audience, format, locale), and a second axis usually shows up later that was never modelled: a per-recipient or per-occasion tweak, often documented in a comment as normal practice. Because that axis has no slot, the only way to apply it is to edit the shared source and re-render, which lands on the same fixed path as every other use of that variant. If any standing consumer reads that path — a published page, a deploy artifact, a link in a profile — the one-off edit silently becomes that consumer's permanent content. Nothing errors, the render succeeds, and the generator's own gates still pass, because a customized document is a valid document. The defect is only visible to someone who knows what else reads the path, and the file that names the consumer is usually in a different directory from the file that names the output.

A performance fix scoped behind a coarse-pointer device-class media query silently asserts that the excluded class has headroom to spare, and because the symptom was only ever reported on the included class that assertion is never tested; the real cost — a per-frame transform invalidating expensive paint work — is device-independent, so the excluded class keeps the regression and the narrower gate makes it look already handled.

A gate that asks "did the person authorise this?" has to search their words for the grant, and the obvious vocabulary to search for is the name of the thing being gated. But people authorise at the level of the outcome they want rather than the step that produces it, and the outcome usually entails several gated steps it never names. So the grant arrives in a sentence the scan cannot see, the gate denies a genuinely authorised action, and its compliance path — ask the person — is one the agent has already completed. Every fixture written for the gate passes, because a fixture author writing "the user asked for X" naturally writes the word X.

A plant built with a normalising constructor — a path joiner that collapses dot-dot, a URL class that percent-encodes, a serialisation round-trip that drops undefined — is canonicalised by the helper before the code under test sees it, so a plant meant to exercise a normalisation defect arrives already clean and passes on the unfixed code; a second masking form is shared per-session state, where a once-per-key trigger already consumed by an earlier plant silences the next one by order rather than by the fix.

A page states a hard precondition for its own instructions (an access gate, a required env var, a version floor) below those instructions rather than above them, so a reader reaches copy-pasteable commands, runs or copies one, and only then reaches the sentence explaining why it doesn't work — the ordering makes the explanation load-bearing text that is read after the point it was needed.

Writes to a pipe are asynchronous in the runtime and a process exit does not wait for them, so a large payload printed immediately before exiting arrives cut at exactly the pipe buffer size; the same code is synchronous to a terminal or a file, which is why every manual run looks correct and only the consumer downstream of a pipe sees truncated, unparseable output.

A supervised child can fail in two ways that look identical from outside and arrive on different channels. Starting and then dying emits an EXIT event; never starting at all - a missing executable, a working directory that does not exist, a permissions refusal - emits an ERROR event and no exit event ever follows. A readiness loop watching only exit therefore polls its full deadline for a process that never existed, and reports a timeout, which describes the clock rather than the failure.

A queue library gives every job a progress field that is OPT-IN: it holds whatever the worker last wrote, and if no worker writes it holds the initialiser for the job's whole life. The endpoint keeps answering with a well-formed body, so a client polling until progress reaches completion is not waiting for the job, it is waiting for a value that cannot change. The second half of the same handler is what makes it durable - a job record that can no longer be found is reported in a way that is not distinguishable from one still running.

A paper reports a method's gain over a specific baseline, and the gain is largely the size of something that baseline never does. If your system's existing objective already does that thing directly, the method's contribution is already present and adding it changes nothing, or it overfits once tuned hard enough to move. The paper is correct, but it measures a deficit your system lacks, so its headline number predicts nothing about yours.

Every floor protecting a retrieval system was calibrated against human queries, and accepting machine-generated variants silently invalidates at least one of them. The share-style floor fails first and is hardest to notice: it works on human input because a person asking an off-domain question uses off-domain words. A query generated from source code is built from the corpus vocabulary by construction, so it can never be off-domain by vocabulary, and the floor that separates covered from uncovered questions stops separating anything.

A complement rate such as 1 - distinct/total needs a value for an empty denominator, and the conventional guard returns 0. That zero is not neutral. It is a verdict, and for a ceiling check it is a pass. A floor computed beside it over the same empty population fails forever. So the reader sees one red row they cannot move and one green row nobody questions, and both describe nothing. Moving both onto a real population can flip the green row red and reveal that its threshold was never reachable at that granularity.

A check that validates a submission by comparing its output to a reference implementation's output can only detect requirements that change the output on the fixture in use. When the fixture already satisfies the requirement incidentally — rows that happen to be stored in the order a sort would produce, records that all happen to match a filter, a set with no duplicates for a de-duplication step — the compliant and non-compliant outputs are byte-identical and the comparison passes both. The requirement is unenforced, and nothing in the authoring or test surface distinguishes the enforced cases from the hollow ones.

A ranking score is built as match quality times one or more behavioural multipliers — popularity, click history, recency, personalisation — and the composed value is the only score the pipeline keeps; a set-level threshold that decides whether the query found anything at all then reads that composed value, so a document's own usage history can push it below the threshold or out of the leading position, and the system reports "nothing matched" for a query whose best match, on match quality alone, is unambiguous.

A field rendered with escaping only is a field in which no character means anything. Swapping that call for a markdown or rich-text renderer does not add formatting to future content — it retroactively reparses every value already stored, under syntax rules no author of those values was writing against. Incidental punctuation that was inert becomes markup: a pair of asterisks, underscores or brackets that happened to fall in one record now opens and closes a span, and the renderer consumes the delimiters rather than printing them. Nothing throws, the new records look exactly as intended, and the corrupted ones are old rows the diff never mentions, so both the change and its review show only the improvement.

A protocol pairs a call block with a result block by id. A repair pass drops unsupportable pairs, and scans for the pair inside one message's block list — a reasonable reading, because the two blocks are adjacent in the stream and the fixture they were written against held both. The producer, however, closes a message after the call and opens a new one for the result. The pairing therefore never matches: the pass removes every result it judges unsupportable and leaves each call behind, unpaired. The validator on the far side rejects an unpaired call, so the sanitiser manufactures exactly the rejection it exists to prevent — and does it while logging that it fired and removed blocks, which reads as the repair working. Because the input is a persisted transcript replayed on every turn, the damage is redone on each retry and the failure looks permanent rather than transient.

A flag named for one direction of a hierarchical lookup disables the hierarchy traversal itself, and because the resulting unreachable packages report with the same message as uninstalled ones, the fix that looks obvious is to install them one at a time, which never terminates.

A long-running process resolves and caches its modules when it starts. Editing a source file after that changes the file and not the process, so a verdict read off disk describes code that is not executing. The obvious repair — restart it — introduces the second half: on a machine running several instances of the same program, the newest one is not necessarily the one serving this session, so a start-time check can confirm 'a fresh process exists' while the stale one is still the one answering.

An agent is sandboxed away from a repository with a path-shaped deny rule, while hooks from that same repository still run inside its session. Those hooks end by telling the agent to run a command that records its verdict, and that command names the repository by path. The deny matches it. In agent permission systems deny outranks allow, so no allow rule can carve the recording command back out. The gate looks answered, because the agent tried or printed the command in prose, but the store the harness exists to fill stays empty, and nothing reports the loss.

A discovery step that builds its search set — mapping a fixed list of known roots through a path-encoding function — is not a scan of the store, it is a lookup of two guesses. It cannot report an absence, because everything outside the constructed list is indistinguishable from an empty store, and the resulting display is confidently wrong rather than blank.

An audit that measures how widely an optional field is used by testing key PRESENCE — `'x' in record`, a `for...in` accumulator, `Object.keys().length` — counts declarations rather than values. Scaffolding emits the whole field set on every record it creates, optional entries included and left empty, so the resulting count equals the number of records the generator touched and moves not at all with whether anyone ever filled the field in. Nothing errors and no read fails: the data returned is truthful, and the predicate simply measures a different property than the one being reported. On a relationship field the effect is a population of edges that do not exist, and comparing it against its reciprocal field then produces an asymmetry that reads exactly like a data-integrity defect.

A CLI-style module ends by calling its own entry function at module scope, so the work is done by the act of loading the file rather than by running it as a program; any importer — a diagnostic, a test, a script reaching in for one exported helper — executes the whole thing as a side effect of resolving the import, and when that work records something (a counter, a ledger row, a usage event) the inspection becomes a write to data that was accumulated from real use and cannot be regenerated from source.

Injected script that calls element.click() on a page it does not own produces a real DOM click event — capture listeners see it, on the label and on the input it forwards to — so every instrument that watches events reports success. Whether the page changes state is decided by the component framework's own handlers, which can ignore untrusted events, listen to a different event (pointerdown, change on a separate element), or be bound to a sibling control with the same text. Separately, pages that toggle between views often keep both views mounted and hide the inactive one with visibility:hidden, so a "find the element" query succeeds, with a real non-zero size, against the view that is not showing. Together they let a script act on a hidden element after a click that did nothing, and the result is a blank screen with every log line saying it worked.

A counter is created by one subsystem, for one event, and read by consumers that weight or penalise on it. Later a second subsystem starts incrementing the same counter, because the same verb fits the new event and the recording API already exists. Nothing in the counter's name, type or call signature carries provenance, so every existing consumer keeps applying the original meaning to what is now a mixture. Nothing fails: both producers are correct, every consumer is correct against its own assumption, and the value stays a plausible number throughout. The damage lands on whichever consumer the second producer's events are least relevant to, and it scales with how well the second subsystem works.

A filter chain holds two rejections of different arity — a set-level one that can return nothing at all, and a per-item one that removes individual candidates — and the set-level test runs first, reading a property of the ranked list's head; so the head is whatever won the score race, including candidates the per-item filter is about to delete, and any tie-break-sized difference in score silently decides whether the caller is told the collection has an answer or has nothing.

A wall-clock timeout wrapped around a sequential test runner signals the process when the clock expires, and the runner's synchronous child-process call reports that signal as a failure of whichever spawn was in flight at that instant. The stack trace names a real test case, the error object carries a signal and a null exit status, and stdout and stderr are empty — so the report reads as "this case hangs" when the only fact it records is "this case was executing when time ran out". A suite that legitimately takes longer than the timeout produces this at a different case each run.

A test suite keeps its sandboxes under one fixed directory and, at module load, recursively removes that directory so a previously killed run leaves nothing behind. That is correct while the suite is the only process using the directory. The moment the suite is sharded across processes, every shard's load-time sweep deletes the fixtures its siblings have already created and are mid-assertion on; the victim reads a missing file and fails, and which shard is the victim depends on start order, so the failure moves from run to run. Every shard passes alone and the serial run passes, so the only failing configuration is the one that was just introduced, and it reads as flakiness rather than as a deterministic race on the sweep.

A small JSON state file is updated by read-modify-write, and the write is an ordinary whole-file write, which truncates the file before writing the new contents. The reader is written to be forgiving: a file it cannot parse is treated as absent, and absent means a fresh default state. Each half is reasonable alone. Together, any reader that arrives inside another process truncate-then-write window gets an empty or partial file, silently starts from defaults, and its own write-back then makes the reset permanent. It only happens when two processes touch the file at once, which a hook never does until the host runs several tool calls in parallel, and then it happens routinely. The symptom is the loss of whatever the file remembered, so it reads as the event that set that state never having happened, and gets blamed on whatever delivered that event.

A checker that decides something by matching a pattern against text is handed a CONTAINER, and containers carry cargo: a command line carries heredoc bodies, quoted literals and paths of files it is merely writing; a source file carries comments, fixtures and prose about the checker itself. A pattern applied to the whole container cannot separate an instruction from a mention of one, and the error runs in the direction of matching its own subject matter.

Joining separately encoded files by copying their streams preserves each packet's original timestamps and merely offsets them by the running duration of everything before it. That is sound only where the packet grid divides evenly at the boundary. Video divides — a join lands on a keyframe, which is a frame boundary. Compressed audio does not: its frames carry a fixed sample count unrelated to the video frame rate, so the final audio frame of one input almost always overhangs the boundary, and the next input's first audio packet is offset to a timestamp that falls before the previous one ended. The muxer sees a decode timestamp moving backwards, rejects the packet, and the job stops at the first join. Because the output was streamed, a valid-looking prefix has already been written and flushed, so there is nothing to roll back and the container is closed as it stands: a well-formed file holding the first input alone, whose header parses and whose only wrong property is its duration.

Git exports GIT_DIR (and, from a linked worktree, index and common-dir variables) into every hook it runs, and every git command honours those variables over its working directory — so a test run by the hook that builds a throwaway repository with `git init` and commits into it is silently committing into, reconfiguring and writing objects into the repository being pushed.

An executable fixture usually ships with a hand-written account of what running it produces — a caption, an expected-output note, an explanation shown after the step. A suite over that corpus almost always asserts the cheap half: the fixture parses, runs, and does not error. That assertion is real and the suite is green, and the green then reads as coverage of the whole fixture, including the sentence. Nothing ever compares the run's actual result to the prose, so a claim about which row came back, how many there were, or which earlier fixture it matches can be false from the day it was authored. It is not drift — no state changed. The claim was simply never in scope, and the passing suite is what stops anyone from putting it in scope.

Component toolkits following a tonal-elevation model do not paint a raised surface with the configured surface colour - they blend the theme's primary over it in proportion to elevation, on the theory that higher should read as more tinted. With the toolkit's soft default primary the blend is barely visible. Override the primary with a saturated brand accent and every elevated surface inherits that tint, so a single token change discolours dialogs, sheets and menus that nobody edited.

A deadline built as Promise.race(work, timer) assumes the timer gets a turn, but a timer callback is a macrotask and runs only when the event loop regains control. A loop of awaits whose promises all settle as microtasks — in-process inference, a cache hit, any async API that resolves without real I/O — never hands control back, so the whole loop is one uninterrupted turn and the timer fires after the work ends, not at the deadline. The race resolves with the work, which looks like the deadline was simply never reached. Its companion trap: a delay above 2^31-1 ms, Infinity included, is clamped to 1 ms with only a warning, so an "unbounded" option passed through the same race gives up at once.

One tool marks the region it owns with a start and end comment, then treats everything between those markers as its block — reading it, replacing it, and on uninstall deleting it. A second tool manages the same file by parsing it and writing the whole thing back, which is correct for the data and silently lossy for anything the format treats as insignificant: comments, key order, and redundant literals. So the first tool's boundary is not stored in the file's structure at all, it is stored in exactly the bytes the second tool is free to discard. Two failures follow, and the worse one is silent. If the start marker is dropped the block becomes unowned, and a careful tool refuses to manage its own entry from then on. If instead the file is reordered so the end marker drifts, the block quietly grows to include every table appended after it — and the delete path that was written to remove one entry now removes all of them, reporting success.

A transform keyed on file type ends with a few tests for the families it knows and then returns the input for everything else. That last line reads as nothing to do here. It actually means I do not know what this is, so I am handing it on unprotected - opposite claims the code has no way to distinguish. The failure is silent in exactly the place you would look for it, because skipping the transform produces output that is well-formed and merely untreated.

A conversation record labels each turn with a role, and a check that wants to know what the person asked for filters on that label. But the role is a transport slot, not an authorship claim: a harness injects standing instructions, memory indexes, editor state and tool output into the same slot. Those injections are frequently the very text that states the policy the check enforces, so a scan looking for evidence that an action was requested finds the sentence forbidding it, matches on the verb, and treats a prohibition as consent — inverting the guardrail while every fixture-based test passes.

A UI automation driver resolves a selector to an element, dispatches a touch at that element's bounds, and reports the step as completed when the dispatch succeeded. Nothing in that path checks that the touch changed anything. A disabled button, a target that moved under a rising keyboard between resolution and dispatch, and a different element that the selector also matched all yield a completed step with no state change, and every later step runs against a screen the flow never reached.

A custom property referenced inside @keyframes must be substituted at style-recalc time, so the browser runs the animation on the main thread — one style recalculation per element per frame for the animation's whole life — and the same reference disqualifies the compositor fast path that a literal-valued transform/opacity keyframe would take; multiplied across a standing population of decorative elements this silently consumes most of a CPU core while the page sits idle.

Adding a verifying stage to the end of a pipeline changes where trust lands, not how much of it is earned. That stage sees every earlier finding, speaks last, and is the only component whose role is checking - so its output reads as adjudication rather than as one more claim needing support. The asymmetry is structural: earlier stages are cross-examined by design and the stage doing the cross-examining is not, so an error introduced there inherits the authority of the position rather than of any evidence.

A container sized by subtracting a fixed amount from the viewport height encodes an assumption that everything above and around it always adds up to exactly that amount. If any part of that overhead is responsive - a parent's breakpoint-dependent padding, a header that changes height - the subtraction is correct at exactly one breakpoint and wrong at every other. The error is silent: nothing overflows and nothing clips, the container is simply too short, leaving a dead band of background that is typically worst where padding is smallest.

A regex word boundary sits only between a word character and a non-word character, and the underscore is a word character. A rename anchored as `\bold_name` therefore cannot match where the old token is glued to a preceding underscore — every namespaced compound identifier such as `prefix__old__old_name` — nor where it follows an escape sequence written in source, as in a string literal starting `\nold_name`, because the `n` of the escape is a word character too. The pass reports a healthy count of replacements from the free-standing occurrences, so it reads as complete while the densest class of occurrences, the fully-qualified ids, is untouched.

Word-boundary matching is the standard fix for a short denylist token producing substring noise, and it is sound only about TEXT. A word boundary is not a claim about words, it is a transition between a word character and a non-word character. In prose that transition is rare and meaningful, which is what makes the anchor selective. In arbitrary bytes most byte values are non-word characters, so nearly every position is a boundary and the anchor stops excluding anything - the match becomes weaker than the plain substring it replaced, in the direction of firing more.

A slow suite gets a fast path, and the subset is chosen by a correctness predicate — which steps could plausibly be affected by the kind of change being made. That predicate is about eligibility, and it is uncorrelated with cost. Because runtime across steps is usually distributed like a power law rather than evenly, a handful of steps hold nearly all the wall clock, and those heavy steps are typically the integration-flavoured ones that touch the most shared state — precisely the ones any correctness predicate keeps. So the subset drops most of the step COUNT and almost none of the DURATION. The reasoning that produced it is sound and the artifact is inert, and nothing reveals this because the subset was validated by argument (does it skip anything that could break?) and never by a stopwatch.

Installing a shared convention is additive and undoable by deleting a file, while folding pre-existing content onto that convention rewrites originals; bundling them into one step forces the reversible operation to inherit the irreversible one's risk.

Importing a server-side agent module directly into a client component pulls it into the client bundle, which breaks the key isolation the server boundary exists to provide. The import resolves, the build succeeds, and the secret ships to the browser - so the failure is a disclosure rather than an error. Reaching the same capability through an HTTP route keeps the module on the server side of the boundary.

Opening or navigating a tab returns as soon as the BROWSER has a document, which is not the moment the APPLICATION has finished mounting interactive state. A single-page app commonly renders a loading shell for a beat before form fields, sidebars and auth-dependent chrome exist. An automation step acting in that gap does not error: it fills a field that silently accepts no visible text, or clicks a control that is about to be replaced, and the failure surfaces later as data that never arrived.

A hit-reaction animation was reported as "not moving". The animation was wired correctly and the computed animation-name on the element confirmed it, which closed the wiring question and pointed the investigation at event plumbing. The real cause was magnitude — the movement was a few percent of the element's own width, at its peak for about a tenth of a second, and it began in the same frame as the effect it was meant to cause, so no interval existed in which a viewer could attribute one to the other.

An installer that must not clobber a file it shares with others is written to append only, and its idempotence comes from skipping any entry whose identifying field already matches what it is about to write. That field is usually also configuration — a matcher, a route pattern, a selector, a topic, a version — so the day it is widened or corrected, the lookup finds nothing to skip, appends a second registration, and leaves the first one live. Both now fire. Nothing errors, no file is overwritten, and the installer reports a clean addition.

A comma at the end of a selector line promises another selector, so an `@media` block written on the next line is parsed as a malformed selector rather than a nested at-rule, and the parser discards the entire declaration block with no error — the override is absent at runtime while looking present in the source.

In an MP4 track with B-frames, each sample carries a composition offset, so the last frame is presented after the last decode timestamp. The latest presentation end is the maximum of decode time plus offset plus duration, and it passes the end of the decode timeline by the reorder delay. An edit list whose segment is computed as media duration minus its start offset therefore ends early, and players silently drop the frames that fall outside it. Container metadata still reports the full frame count and a plausible duration, and audio, which has no composition offsets, is correct under the same formula, so every summary check passes.

An escape affordance (a hint offered after repeated failure) was rendered conditionally on an optional per-item content field, so it silently ceased to exist for any item whose authors omitted that field; a separate and independently-correct authoring convention then deliberately omitted the field from the hardest items in each sequence, deleting the last self-serve exit from precisely the items most likely to need it, with no code change and no test failure.

A classifier receives one primary input plus alternate phrasings of it, and a note it attaches has an exclusion so that some framings (reviewing, prose authoring) never trigger it. The exclusion is implemented inside the per-phrasing predicate, and the caller reduces over the whole set with an any-of — so the exclusion is tested phrasing by phrasing, and a single alternate that lacks the excluded vocabulary passes on its own and attaches the note over a primary the exclusion had cleared. The same module already ruled, for a different decision, that the primary framing governs and alternates only widen retrieval; the second decision reimplemented the reduction without that rule. The result is a false positive on exactly the sessions the exclusion was written for, and it arrives as a denied action rather than an error.

A guard that over-fires gets an exemption, and the exemption is written against whatever attribute is cheapest to observe at the moment the guard runs — usually a path or a location — standing in for the attribute actually meant, which is typically about lifetime, intent, or authorship; the substitution holds for the easy cases that motivated it and breaks for the hard ones, because the very thing that makes a case hard often forces the proxy and the real attribute apart, so the exemption is reliably absent precisely where it was needed and each new failure looks like one more missing prefix rather than the wrong axis.

A presence check built as "list things, hide errors, count the lines that match" has two ways to produce zero — the thing is absent, or the listing never ran — and discarding stderr removes the only output that tells them apart, so an invalid flag, an auth failure or an unresolved project reads as a confident "not present". A second trap sits beside it — a listing that masks sensitive values prints a non-empty placeholder, so a "value is set and non-empty" check passes on the mask itself.

iOS Safari's file-input accept attribute only recognizes MIME-type-format entries (e.g. image/png, text/*); extension-format entries (e.g. .sql, .csv) are silently unimplemented, so a file matched only by extension never appears as selectable in the OS picker, while the same accept value behaves correctly on desktop browsers and Android Chrome

A scripted edit guards against double application by testing whether a token the edit would introduce is already present in the file. Presence of a token is a claim about the whole file, not about the edit site: if the same token occurs anywhere else for an unrelated reason, the guard reports "already applied", the edit is skipped, and the skip is printed in the vocabulary of success. Nothing downstream re-checks an "already done", so the omission surfaces only when some later count comes up short.

Version control reads ignore rules from three places — the committed ignore file, a per-clone exclude file inside the repository metadata, and a per-user global excludes file — and answers "is this ignored" identically for all three. Only the first is part of the repository. The other two live on the machine, so a file that has been ignored for months on the machine where the work happens is simply untracked on a fresh clone, and the first tool that writes it there leaves it one careless add away from being committed. Nothing on the original machine can reveal this: status is clean, the file never appears, and every check run there passes.

A setup script documented as idempotent was safe to re-run within one checkout, but it also wrote machine-global pointers — entries in a shared configuration directory and a tool registration holding an absolute path — that have exactly one slot per machine, so running it from a second copy of the same repository did not create a second install, it silently re-pointed those single slots away from the copy holding all the uncommitted derived state.

A library offers a flag requesting the cheap path — copy the encoded data rather than decode and re-encode it. The flag is a request, not an instruction: the library applies it only when it can prove the inputs are interchangeable, and when it cannot it does the expensive thing instead. That fallback raises nothing. The output is correct, the return value is success, the callback fires normally, and the only observable difference is that the work took orders of magnitude longer than moving those bytes should. Meanwhile the caller's own compatibility check was made against whatever metadata was cheaply available — a catalogue's declared dimensions and codec name — which does not cover the fields the library actually compares, such as encoding profile and level. So the caller believes the precondition holds, the library disagrees silently, and the disagreement is visible only as a duration nobody has an expectation for.

preserveAspectRatio="none" is the standard way to make an SVG's viewBox stretch to fill a container of arbitrary aspect ratio rather than letterboxing, and a chart component that has to fit both a wide-short card and a taller panel needs exactly that. But stretching to fill an arbitrary box means the viewBox's x-axis and y-axis are scaled by different factors whenever the container's aspect ratio differs from the viewBox's own — and any geometric primitive drawn in that coordinate space that is meant to look uniform (a circle marking a data point, a square icon) is stretched by those same two different factors, becoming an ellipse or rectangle whose eccentricity tracks the container's current width-to-height ratio rather than being a fixed, correctable distortion. The natural first fix is adding vectorEffect="non-scaling-stroke" to the shape, because that attribute is the usual answer to "this shape looks wrong under a transform" — but it only cancels scaling of stroke *width*, not the geometry of the shape's path, so a circle with that attribute is still an ellipse, just with an even-width outline traced around an elliptical path.

A recursive glob inside an npm script string is expanded by the shell before the glob-aware tool ever receives it, and npm runs scripts through sh -c where globstar recursion is off by default. The pattern silently degrades to matching a single directory level - not zero, which is what makes it invisible, because everything already sitting at the shallow level still matches and the script still appears to work. Files added deeper afterwards are never selected, with no error and no warning. Quoting the pattern keeps the shell from touching it, so the tool's own resolver does the matching.

A handful of captured network requests all showed one parameter holding the same value regardless of which other control was changed, which was read as "this parameter is a fixed no-op" rather than as "this control's own range was never exercised by whoever was driving the UI during capture" — the true shape (an independent, adjustable field) only surfaced once the frontend's own source was read directly.

An upload client's content-type option can be dead code for exactly the case it appears to exist for. Some libraries honour it only when the body is a string, buffer or stream; when the body is a Blob or File the library hands it to a multipart part with no filename and no per-part type override, and the browser's own serialisation derives the part's type from the object instead. The option is accepted, ignored, and reported nowhere, so the stored object carries a type nobody chose.

An upsert is a single statement with two branches — INSERT and, on key collision, UPDATE — and the database authorizes whichever branch runs against the policy class matching that branch. A table whose policy set was designed around the verbs the feature appeared to need (read, create, remove) therefore has no UPDATE policy, so the collision branch is refused with a permission error while the insert branch keeps working. Because the branch taken depends on whether a row already exists for that key, the first write per key succeeds and every subsequent write for the same key fails — so the feature passes any check that exercises it once against clean state, and fails only on the repeat path.

An authentication error message that distinguishes a wrong password from an unknown account is an account-enumeration oracle: each distinct message is a bit of information about whether an address is registered. The messages are written for helpfulness one at a time, and no single one looks like a disclosure - the leak exists only across the set, which is why it survives review and why the safe wording has to be a fixed list rather than a judgement made per message.

A shared store exposes one loading flag intended for a hydration path that only some routes run. On a route where the hydrate call never executes, that flag keeps its initial true value forever, so any component reading it disables its controls and renders a spinner on mount with nothing pending. The flag is correct for the path it was designed for, and a page reusing it inherits a state machine that has no way to advance.

A probe that fails open returns one value for two different facts - I checked and it is fine, and I could not check. Collapsing them is correct for the return value, since a guard that alarms when the thing it watches is merely absent gets ignored. It becomes a defect the moment that value is cached. A cache stores a verdict, and the fail-open branch never produced one; writing it anyway records a confirmation for a moment when nothing was observed. Because the cache exists precisely to skip future work, one transient inability to look disables the check for as long as the cache is honoured. Nothing fails - the check stops running, and its new silence is byte-identical to the silence it produced while working.

Contrast in a themed UI is a relationship between two specific values, but it is written down as two independent constants: nothing records that a control is tinted the way it is BECAUSE its page is tinted the way it is. Changing a container's background token therefore silently re-evaluates every contrast relationship that crossed it, and produces two separate failures - the child disappearing into its page, and the child's own selected and unselected states collapsing into each other.

Several checks that each derive an expected value from one shared artifact — a generated index, a corpus count, a benchmark score quoted in prose — are not independent failures, because a single authoring write to that artifact invalidates every one of them at the same instant; a fail-fast runner then surfaces them one per run, so a batch of N simultaneous breakages presents as one defect that appears to keep coming back after each fix, and enumerating the batch costs N full-length runs instead of one.

Hardcoding a featured example makes it go stale when the record changes, so the standard fix is to select it from the data — highest-scoring, most recent, top of a ranking. That fix is correct for the example and moves the failure next door. The caption, callout or alt text written beside it was authored about the record that happened to win at authoring time, and it keeps asserting that record's specifics after the ranking hands the slot to a different one. Nothing breaks: both halves stay individually valid, the selector still returns a real record, the prose is still grammatical, and the page renders. The claim is simply now attached to the wrong subject, and the only reader who could notice is one who knows the featured record well enough to see that the story does not fit it.

an upload flow validates the file by extension, then still forwards the browser/OS's own file.type guess as the object's storage content-type, and that guess is not standardized across OS/browser combinations for the same extension, so a device the allowlist was never tuned against gets rejected

A file that generates text in another language usually holds that text in a template literal, which makes the embedded material a STRING to the host parser. Two consequences follow and they point in opposite directions. The host's syntax check descends into the file but not into the string, so any error in the embedded code — unbalanced parentheses, a bad assignment, a truncated call — is not a syntax error at all and the check passes; the defect surfaces only when something executes or renders the generated text, which for a served page means a blank screen rather than a stack trace. And because the literal's own delimiter is an ordinary character inside the embedded language, writing that character in the embedded material — most easily in a prose comment, where nobody is thinking about the host language — terminates the literal early, turning the remaining generated text into host code and producing an error that names an identifier from a sentence.

An agent harness caps how much text a hook may inject into the model's context. Output above the cap is not rejected and raises no error: the harness writes it to a file and injects a short preview plus the file path in its place. A hook that emits a document just over the cap therefore exits cleanly, its budget gate measures the emitted text and passes, and a fallback that asks 'is the hook wired?' concludes the document is already in context. Every layer that checks the sender's side agrees; only the receiver's side shows the loss.

A dialog declared after an early return in a component never mounts in the branch that returned early. The declaration reads as belonging to the component rather than to a branch, so it looks unconditional at the point of definition, and the branch that skips it is usually the loading, empty or error path - exactly the states where the dialog is least likely to be exercised in review.

Reciprocal-rank fusion scores a document by summing 1/(k + rank) over the lists it appears in. With the customary k = 60 and results cut to a handful, that term barely changes between rank 1 and rank 3, so fusion degenerates into counting how many lists contain each document and then interleaving the rest by position. Each auxiliary list's #1 therefore outranks the primary list's #2. With two auxiliary phrasings and three result slots, the primary query keeps one slot, and the answer the extra phrasings were meant to widen is replaced by their own top hits.

Some web frameworks generate type files into their build-output directory — one per route, plus a validator that imports every route module — and the project's typecheck config includes that directory so route contracts are checked. The generated files are written by the build or dev server, never by the typecheck, and nothing deletes them when the source changes. Delete a route, or switch to a branch that never had it, and the generated validator still imports the missing module. The standalone typecheck then fails with a module-not-found error naming a file that no longer exists, on a source tree that is correct, and the error points at the route instead of at the stale output directory that holds the dangling import.

A build-time font loader that fetches its files from a network service turns a build into a network-dependent operation. In an isolated or offline environment the fetch fails and the build fails with it, for a reason that has nothing to do with the code being built. A local system font stack removes the dependency entirely, which is why re-adding the loader reintroduces a failure whose cause is invisible from the error.

A fallback path that retries against a secondary provider can throw the SAME error class that triggered the fallback. If that retry is not wrapped, the error escapes past the handler that was supposed to contain it and surfaces as though no fallback existed. The bug only appears when the fallback is configured, differs from the primary, and also fails - a conjunction rare enough that the unwrapped call looks correct for a long time.

Multiple-choice questions authored as a choices array plus a correct index inherit the writing motion that produced them: the right answer is written first and distractors are invented afterwards, so the correct index converges on zero. Every individual question is well-formed, so no per-question check can see it; the defect exists only across the corpus. The assessment silently stops measuring knowledge and starts measuring position, and anyone pressing the first button clears every check without reading.

A plain anchor inside HTML injected as raw markup performs a full document navigation rather than a client-side route change, so all in-memory application state is discarded. The link is correct HTML and renders identically to a routed one; the difference is only observable as state that silently disappears after the navigation, which reads as a state-management bug rather than a link.

A development environment can inject a broken browser API into a server runtime, so code that correctly guards for the API's ABSENCE still fails - the object exists and misbehaves, which is a different condition from undefined. Guards written as presence checks therefore pass and the call fails anyway, and the fix has to replace the implementation rather than detect its absence.

An append-only file written by several processes is durable under concurrency for a reason that is easy to lose: an O_APPEND write is atomic, so writers never overwrite each other. Adding a size cap introduces a second operation of a completely different kind - read the whole file, drop the old lines, write it back - and that one is not atomic, so a reader can see a half-written file. The standard repair is write-a-sibling-then-rename. It does close the torn-read window, and it silently replaces the mechanism that made concurrent appends safe: rename swaps the inode, so every append that landed on the old inode between the read and the rename is discarded along with it. Atomicity and durability move in opposite directions here, and only the first one is what the fix was reasoned about. Nothing errors, the file stays well-formed and correctly capped, and the loss is invisible to every test that does not run writers concurrently.

Fixture data that hardcodes calendar dates feeds any streak, heatmap or days-until calculation a value that is correct on the day it was written and decays afterwards. Nothing errors as real time passes the fixture date - the computation keeps returning a well-formed answer, it is just wrong, and it degrades gradually so there is no moment where the demo obviously breaks. Dates expressed relative to now cannot go stale by construction.

A utility-CSS framework's theme namespace is a set of named steps that together generate matching utility classes. Overriding SOME of those steps does not reset the namespace: every step not named keeps the framework's built-in default, silently, with no warning that the scale is now a mix of two authors' numbers. The result is internally inconsistent in a way that renders perfectly and only shows up at the breakpoints nobody overrode.

A client-side route change issued immediately after a cookie write races the browser's cookie store. The write returns synchronously but the cookie is not yet visible to the next request, so server middleware sees no session and redirects back - which presents as an authentication failure rather than as a timing one. A full document navigation serialises the two, at the cost of discarding in-memory state.

A type checker does not narrow a union through an INTERMEDIATE BOOLEAN. Testing a property and storing the result in a variable, then branching on that variable, discards the narrowing: the check is correct, the branch is correct, and the value is still typed as the full union inside it. Extracting the property to its own binding first keeps the narrowing attached to the thing being narrowed.

A component library published as many small packages installs only what has been explicitly depended on, so a primitive that is imported but never added resolves at type level and crashes at runtime. The failure appears when the component is first rendered rather than at build, so it looks like a bug in the component instead of a missing dependency.

A cleanup classifies each candidate by what its contents are — cache, build output, downloadable — and 'regenerable' is a true statement about the bytes. It says nothing about who is reading them right now. When a long-running local service keeps its working set in a generic-looking cache directory, the listing shows only a size and a tool-agnostic name, so the proposal describes the item as free to delete and the approver consents to a cost they were never shown: the service loses its data mid-run and the rebuild happens on its time, not the cleaner's.

A timestamp computed at render time from the current clock produces a different value on the server than on the client, so server-rendered markup and the first client render disagree and the framework reports a hydration mismatch. Suppressing the warning broadly hides real mismatches elsewhere; the suppression has to sit on the specific element whose content is legitimately time-dependent.

Mutations that hardcode a placeholder owner id instead of reading the authenticated user's id fail row-level security silently: the write is rejected at the database, the optimistic in-memory store still shows the record, and the data appears to exist until the session ends. The UI is correct, the store is correct, and the only observable symptom is that nothing survives a logout.

In a structured-concurrency scope, one child throwing cancels every sibling immediately, and that cancellation is delivered to the others as an exception indistinguishable, to a generic catch block, from an ordinary failure of their own — so a sibling that had already produced real, salvageable output discards it as if its own work had gone wrong, when the only thing that actually failed was an unrelated task in the group.

A storage SDK's public-URL helper returns a URL that carries no authentication, so it resolves only if the bucket is configured public in the provider's dashboard. The helper succeeds and returns a well-formed URL regardless, so a private bucket produces links that look right and fail at fetch time - the configuration lives outside the codebase and nothing in the code can detect it.

A client library that rejects with a PLAIN OBJECT rather than an Error instance breaks every downstream handler that assumes the standard shape. Rethrowing it propagates a non-Error, so accessing a message property yields undefined and the runtime renders it as an object placeholder - the real code and details are present on the object but nothing reads them, so the diagnostic information exists and is discarded.

Instrumentation is written for one project, so the record carries what varies WITHIN that project — a timestamp, a component, a session — and not which project it came from, because at the time there was only one. Later the same instrumentation is installed into other projects, and every one of them resolves the store path to the same shared location. Nothing fails and nothing looks wrong: rows keep arriving, the volume grows, every field is populated and correct. But the pooled data now answers only questions that do not mention the source, and the per-source questions are not merely unanswered — they are unanswerable retroactively, because the discriminating field was never written. The absence is invisible precisely because the sample size looks healthy.

An API hands back several addresses for one file because they are mirrors with different hosts and different acceptance rules; a client that hardcodes index 0 inherits whichever host the server listed first, and when that host gates on a request header the client does not send, the refusal lands on an arbitrary subset of items and reads as a content-dependent bug.

A platform that runs author-supplied content — exercises, examples, fixtures, templates — names the language it accepts after a real one, but implements only the subset its own engine needed, and the authoring surface gives no signal about where that subset ends. Content written against the real language is therefore accepted, reviewed, and committed while containing constructs the engine cannot execute, and the gap appears only at run time, per construct, as a syntax error or a silently wrong result for the specific feature used.

A command-line tool presents its subcommands as one interface, so the paths they print and the paths they accept are assumed to share a base. They often do not: one resolves a path argument against the current working directory and echoes results back the same way, while another emits paths relative to the project root regardless of where it was invoked. Run from the root the two agree and the difference is invisible. Run from a subdirectory and a path taken from the second and handed to the first addresses a location that does not exist — so the call succeeds, matches nothing, and the caller records an empty result as a real one.

An HTML-to-PDF pipeline emits two artifacts from one source: the visual page, and a text layer of glyphs with positions. Extractors do not receive words; they reconstruct word boundaries by comparing each inter-glyph gap against the font's space width. Any CSS that widens glyph advance — letter-spacing above roughly 15–20% of font size — pushes every gap in a run past that threshold, so the extractor inserts a space between every character and the run becomes unsearchable. Multi-column and table layouts fail the same way in a different axis: the extractor walks the text layer in emission order, which for a grid is column-major, so labels arrive as one block and their values as another. In both cases the rendered page is not merely acceptable but better-looking than the version that extracts correctly, because tracking and column grids are applied precisely for their appearance. Every human reviewer therefore passes the artifact, and the damage concentrates on headings and labels — the highest-weighted content — because those are exactly where the treatments get used.

A service manager's restart-on-exit guarantee is a property of the registration, not of the process. Unregistering removes the guarantee before it stops the process, so the interval between unregister and re-register is the only period in the service's life with no automatic recovery — and it is exactly the interval in which the re-register can fail. When it does, the service is not stopped but absent, and nothing will bring it back. The pair is typed as one line and reads atomic, but it is delete-then-create with no rollback: a failure does not return the previous state, it returns nothing.