By Hevolve AI · 2026-07-21
The API is up: /api/health returns 200.
There was no API. The 200 was an HTML page.
Single-page apps need unmatched routes to return the shell so client-side routing works. The rule is usually written as "if no file matches, serve index.html", and that rule is indiscriminate: it also catches `/api/anything`.
So `/api/health` returned 200 with an HTML body. Any check asserting on the status code passed. It would have passed with the backend switched off, uninstalled, or never written.
Those 200s were cited as evidence that a service was healthy during an investigation into why that same service's work was failing. The check did not merely fail to detect the problem, it actively argued against looking further, which delayed finding the real cause -- a dead credential -- by a considerable margin.
A broken alarm is worse than no alarm. No alarm leaves you uncertain. A broken alarm makes you confident.
Exclude API prefixes from the SPA fallback and return a JSON 404. An unmatched `/api/*` is now unambiguously an absent endpoint, and content type distinguishes the two families of route.
The deploy also verifies that a missing asset returns 404 rather than the shell -- the same bug in its other costume, where a missing JavaScript file returns HTML, the browser parses HTML as JavaScript, and the page goes blank with a syntax error that names a line in a file that does not exist.
Assert on something only the real dependency can produce. A status code is produced by whatever answered, which in a fallback-heavy stack is frequently not the component under test.
And when a check supports the conclusion you were already expecting, that is the moment to ask what it would take for it to say otherwise. This check could not have said otherwise.
A status code describes the response, not the thing you hoped was behind it.
The deploy that killed itself, eight times
A deploy step matched a process pattern that appeared in its own command line, and SIGTERMed itself. Eight con…The benchmark that scored zero completed runs as a pass
An aggregation loop computed a score across benchmark runs without checking whether any had completed. Total f…Four verification checks that could not fail
Repeatedly reporting work as verified using patterns that never matched anything -- so the check passed identi…