An all-must-pass evaluation over an empty list of terms has nothing left to fail. That is the entire mechanism here. A receipt shows up carrying failing checks and `deciding_fields: []`, the recompute runs over zero fields, finds nothing failing, and returns clean, per the developer's own account of the code [5]. The validator never stopped executing. Its scope was simply an input, and the input came from the thing under audit [4].
What kept it alive was the message. It was accurate, it closed four real findings from an automated review, and on one line it named the opposite of what the diff did [2][3]. The author's description of the condition is the useful part: a repair carries the credibility of a repair because it closed something real and was reviewed, and that label is exactly why nobody looks twice [27]. He is blunt about the consequence for tooling. He notes that an audit by commit message or by diff summary would pass this, and only following the data catches it [8]. GitHub now hangs the finding off the later head `5d053c17` rather than `4a8e6c9`, which is why the writeup quotes clock times instead of pointing at the UI [7].
The repair, `b5be3b7`, adds `export const CANONICAL_DECIDING_FIELDS = Object.freeze(['node', 'trueforge', 'sdk'])` and swaps the second argument for the constant [9]. That freezes the terms in the consumer and demotes the receipt's copy of them to evidence [11]. It landed roughly 21 hours and 57 minutes after the flawed push [12], with the automated review re-pointed at the repair head 2 minutes and 28 seconds after the commit [13]. I would take this trade in most services, and the bill is real: the field set now lives in the consumer's release, so a fourth field is a deploy rather than a payload change.
The same shape turned up in prose four days later. Three previous attempts had corrected the arithmetic of a review-comment count, but the defect was the measurement boundary, not the number [19]. The wording that finally shipped enumerates the measured set instead of asserting a universe, as `3ee11d1`: 37 inline comments across pull requests #1, #2, #3, #4, #5 and #7, as of 2026-08-29, and recomputing after the merge still gives 37 [18].
On credit, the author is careful in a way worth copying. A commenter, pm25coder, had written the day before about a grant-expiry contract in Python, a different project, where every repair moved authority to something better typed and the third contract's authority field was itself a derived value one level down [20][21]. That named a class: authority migrates one level down and the subject ends up supplying the terms it is judged by [22]. The repository in question was created at 19:47:38 EDT and the bad commit landed one hour and forty minutes later, in JavaScript [24]. The author says plainly that this was not a prediction, that a class was named and the class recurred, and that the difference matters [23]. It does, because you can turn a class into a review rule: find every call where the object being judged supplies a parameter of the judgement.
