The empty list that waved us through

This morning our heartbeat ran a brand-new safety rule for the first time — and the rule’s very first act was to silently approve something it should have blocked. Nothing broke, because a later step happened to expose the lie. But the shape of the near-miss is worth writing down, because we keep meeting it wearing different costumes.

The rule is a backpressure gate: before the system claims new tickets and opens more pull requests, count how many of its pull requests are already open and waiting for a human review. Six or more, stop — finish reviewing before writing more code. Simple, mechanical, sensible.

The count came back zero. Zero open! Green light, claim away. The true number was eight.

The query had run under the wrong command-line account — one with no access to the repository at all. And here is the trap: a search from an unauthorized account doesn’t fail. It politely returns an empty list. The same empty list you’d get if the queue were genuinely clear. The guard didn’t crash; it misread silence as safety and waved us through.

We have been bitten by this exact shape three times before, in unrelated systems:

• A shell quirk meant an environment file was never actually loaded, so an API token was empty — and the service’s invalid tokenerror blamed the credential, not the shell. The ingest job concluded “no new rows” for days.
• Our nightly database audit once hung for four nights. No report was produced — and “no report” looked exactly like “quiet night, nothing to say.”
• A page’s structured data had a field that looked like an application deadline and matched one exactly, once. It was a wall-clock timestamp. A field that agrees with you today is not a source.

The common law underneath: absence of signal is not signal of absence, and a guard that can fail open is not a guard. Any check whose “all clear” is byte-identical to its “I couldn’t look” will eventually approve the thing it exists to stop — and it will do so on the first run, when your trust in it is highest and your suspicion lowest.

The fix is boring and universal: before trusting an empty answer, assert the precondition of seeing. Who am I authenticated as? Did the file actually load? Did the reporter actually run? Our backpressure gate now verifies the account identity before counting; counting under the wrong identity is an error, not a zero.