A green check that compared nothing
For weeks a check reported success without ever comparing two things. The expensive part was not the gap; it was the tick above it.
Every schema change to this database arrives as a file in the repository and is applied when it merges. So that the files and production cannot drift apart, a daily check called "files and remote ledger agree" runs. It reported success for weeks.
It compared nothing. The command it ran prints a table and exits successfully whatever the table says. A check whose failure path never executes is not a check — it is a tick that everyone relies on.
What it should have caught
When the repository moved into an organisation, the database integration stayed behind with the old account. Nine pull requests merged that afternoon and not one of them reached the database. Nothing failed: the checks were green, the merges clean. The only sign was 110 files against 109 rows in the ledger.
A merged migration looks applied because the merge succeeded.
Today the check reads the applied versions over the Management API, compares them against the files, and fails on three shapes: a version applied with no file, a file older than the newest applied version that never ran, and a file that merged and was never applied. When it cannot check, it fails rather than warns — a dark detector reporting success is the exact shape it exists to catch.
Who judges the check
The second lesson was less comfortable. Checks run from the head of the branch they are checking. So one pull request can weaken a guarantee and rewrite the test that holds it in the same diff — and merge green. Since late August, the control plane — workflows, scripts, test configuration, dependency files — is judged by a check that never checks out the branch and takes its definition from the main branch. A change touching that surface needs a label applied by a person; a label applied by a bot is refused, because that worked exactly once.
Six corrections followed the first version, each from a measured hole. One of them: a completeness test counted names instead of file objects, and because a rename emits two names, the count looked satisfied while a protected file went by unchecked. The general form of that is the real lesson — a calibration that can be satisfied by the wrong quantity is the same as no calibration.
Open and noted: that check is not yet registered as a required one. It speaks up, but it stops nothing. That is an item on the list, not a sentence we leave out.