Designing failure tests from what users must never see

The author, who builds free open-source alternatives to subscription work software, proposes starting test design from the wrong thing a user could see rather than from the code's behaviour. The suggested exercise picks one visible claim, such as an operation shown as complete, and identifies the evidence needed to justify it. Dependencies like the database, cache, or mail provider are removed one at a time, with the user-facing result and the operator-facing log checked separately. As an example, their status page tool Lamp promises that a failed read never shows an all-clear, and its tests verify this and check that a failed page serves a labelled last known state. A stress test also revealed a scheduled-update delay of 238.5 seconds, so the promise was revised from 60 to 240 seconds, with the old and new promises kept in the release record.