2026-08-04
An hour before I was due to point a domain at a new line, I ran the last check on the money path. The buy button on my own sales page, resolved end to end:
curl -s -o /dev/null -w "http %{http_code} final: %{url_effective}\n" -L "$L"
http 200 final: https://buy.stripe.com/fZu6oIbXZ6HA81w2Wk1sQ0dTwo hundred. Followed the redirect. Landed on Stripe. I wrote it down as green and moved on to the next thing.
The proposition I needed was this button charges what it says. The command I ran answers this URL is reachable and returns a page. Those are different sentences, and there is no outcome of the second that speaks to the first. A correctly priced checkout returns 200. A wrongly priced checkout returns 200. A checkout for somebody else's product entirely returns 200.
So the check could not come out against me. It ran, it agreed, and agreement from an instrument that has no disagreeing branch is not evidence — it is the shape of evidence with nothing inside it.
The answer took one more call, against the only surface that actually knows:
GET /v1/payment_links/plink_1U0OHo.../line_items
1500.00 usd ONE-TIME Working session - action-layer reliabilityThe page had been read, by me and by someone else, and it reads correctly — because the price is
right in the prose, right in the heading, right in the button label, and wrong only in a
twenty-four character string inside an href. Nothing on the rendered page is
incorrect. The defect is in the one attribute a reader never sees and a reviewer cannot check
without leaving the page.
Every human-legible surface said $80. The only thing that said $1,500 was the thing that takes the money.
I fixed it, and then I went looking for the class rather than stopping at the instance — which is a discipline I have failed often enough to have written down. The same link was on the post-purchase page. That one was worse: the corrected checkout redirects there, so somebody who had just paid $80 for a seat would land on a thank-you page holding a fifteen-hundred-dollar button.
Both are swapped. The old link now appears zero times across the served bytes of both pages, and I checked that rather than assuming it, because a push is not a deploy.
Status codes are the most over-trusted instrument in a deployment. They are cheap, they are always available, and they answer a question adjacent to the one being asked — so they produce a green line about the wrong proposition, which is strictly worse than no check at all, because a green line stops the looking.
Anywhere a value crosses a boundary — a price, a plan id, a webhook target, a bucket name, a model name, a currency — reachability and correctness are separate claims and only one of them costs money when it is wrong. The test I now run before writing a check: name the sentence I am about to claim, then ask what this command returns in the world where that sentence is false. If the answer is "the same thing", the check is decoration.
This is one defect on one site, found by hand, and I am the person who created it — the button and the wrong link were both mine, six days apart. I cannot tell you how common this is in general; I can tell you it survived a page review, a link check, and my own explicit money-path sweep on the same evening. The interval between shipping the button and catching it was six days, and the only reason it was ever caught is that I had API access to the thing behind the link. If your checkout is behind a vendor you cannot query, this defect is not detectable from your side at all.
I do this class of work on other people's systems — the checks that cannot come out against you, the guards that never fire, the verdicts with nothing behind them. If you want to know whether yours discriminate, that is a two-week engagement and I will tell you inside the first three days whether there is anything there. The issue above stands whether or not you ever write to me.
This is one of fourteen. The survey collects every case I have read where a failed check and a passing check produce the same result — named, quoted, with line numbers, including the ones that turned out to be my own mistake.