The cleanup that could never run: a silent Web Push leak in Go

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry.

Nothing reported this bug. No crash, no stack trace, no failing test, no alert. I found it by reading through the notifications path in agentrq, a Go backend for a human-in-the-loop task manager for AI agents, and noticing that a block of error handling could not execute.

The code was not missing a case. It handled the case, in the wrong branch, and had a comment explaining what it was doing.

The code

push.sendToUser loops over a user's browser push subscriptions and delivers a notification to each one. Browsers hand out push endpoints that expire: the user clears site data, uninstalls the PWA, or the subscription lapses on its own. When that happens the push service starts answering 410 Gone or 404 Not Found, and the sender is supposed to drop the subscription.