A check that could not see the question

The day after we built a check to find endpoints with no caller, the check told us four endpoints had no caller. They are called on the guest ordering page every time somebody opens a menu.

Worse than the wrong answer was what we did with it. Each of those four got a written explanation of why nothing calls it. One read opened rather than fetched. It is fetched, on a line we could have gone and looked at.

The address in the code is not the address on the wire

The check worked by searching our front end for each endpoint's own spelling. That works for the back office, where a call names the whole path. It does not work for the guest page, which calls a small helper with just the last part of the address and lets the helper add the front of it.

So the guest page asks for a status endpoint by a name that never appears in the file as the check was searching for it. The path in the source is not the path that goes out.

Counting them up, we have five of these helpers and every one is different. Two add different prefixes. One takes the whole address and works out the verb from whether you gave it a body. One serves a single family of endpoints. And two places build the address in a variable — one picks between two paths depending on how many kitchens are involved — which no amount of reading the source can resolve.

Confidently wrong is the expensive kind

A check blind to a whole convention does not report less. It reports confidently wrong, in the same tone it uses when it is right. And because the output of a check is trusted by definition, the wrong answer got written down as fact, where the next person would have believed it.

Both halves matter. The four reasons were deleted. But the more useful change is that the five conventions are now declared in one place, with a test that fails the moment a sixth appears. A new helper is not a bug. A new helper that nothing told the check about turns the check into a liar.

Knowing when to stop

We then tried the same census on the endpoints that change things rather than read them. It returned thirty-nine with no caller, six of which we disproved by hand within minutes.

That one is not being fixed; it is being abandoned, and written down as abandoned. A check that cries wolf six times out of thirty-nine is a check people learn to skip, and a skipped check is worse than no check because it still looks like coverage. Those endpoints get checked by hand, one at a time, against controls that prove the search works. Slower, and actually true.