Start with the strike counter, because that is what turns one bad reading into a permanent one. The sweep will not convict an owner on a single look, since every session looks idle between turns; conviction requires `MESH_CLAIM_IDLE_STRIKES` separate spaced sweeps with the claimed artifact untouched, default 2 [7]. The catch-all runs `_strike_reset "$key"` before it echoes LIVE [6]. That is a write in a branch whose only advertised job is a verdict. Each sweep guessed healthy and destroyed the evidence the next sweep would have inherited, so the count never survived to 1 and 2 was unreachable [8].
Now the coverage. The tool's own legend lists seven exit codes: 0, 4, 5, 6, 7, 8 and 9 [4]. The `case` carried explicit arms for 4, 5, 7, 8 and 9 [2]. That leaves two codes falling to `*)`, and the branch was written for one of them, code 0, the WORKING/IDLE/UNKNOWN bucket [3]. Code 6 is RATE-LIMITED [4]. A session behind a quota wall prints a banner and stops taking turns, the banner does not contain the string IDLE, and the only question the branch knows how to ask is whether that string is present [5][3]. Verdict: LIVE.
The bill is worth arithmetic. The incident report counted 38 renewal reminders sent to that owner, of which 15 are still readable in the surviving log [10]. So 23 of them now exist only as a number in a report [1]. If all 38 landed inside the five-hour-plus stretch the claim spent reading as merely expired [9], the nag reflex was firing about once every eight minutes at a session that could not read one of them [2].
Then there is the git history, which is the part I would bring to a review. According to the dev.to write-up, the RATE-LIMITED arm was the third repair to this same fall-through, after DEAD-SHELL on 2026-07-07 and AUTH-DEAD on 2026-07-10 [11]. Both earlier commits carry comments that state the mechanism in general terms: the state text never contains the word IDLE, so without an arm the claim reads LIVE forever [12]. The author diffed all three commits and reports the `*)` body comes out byte-identical on both sides [13]. The comments understood the bug better than the patches did.
For this to be your bug you need three properties at once: a status enumeration owned by a dependency that can grow, a catch-all whose default verdict is the permissive one, and a side effect inside that branch. A shell `case` hands you all three without asking, but nothing here is shell-specific, and the author's own framing is that the side effect might be caching, acking or advancing a cursor rather than clearing a counter [14].
The repair that would hold is to make `*)` inert: return UNKNOWN and write nothing. UNKNOWN neither reaps nor resets, so a claim still ages out on its own timer while the classifier stays ignorant of the code it just met. The cost is that 0 is normal operation by the tool's own legend [4], so 0 has to be split into its own arm before the default can be made harmless. That is the work the three patches walked past.
