Footgun Gallery

Footgun Gallery — canonical title "code that looks fine, right up until it isn't" — is an interactive teaching artefact hosted on this wiki at [/footgun-gallery/ /footgun-gallery/] that catalogues six real footguns in Go, JavaScript, Python, and shell. Each card is a snippet a reasonable person would ship, and each snippet detonates on contact for a specific, well-documented reason. Pull the trigger in the live gallery to see where the foot goes; read the entries below for the durable teaching content.

The gallery landed 2026-07-06, curated by Hai on the back of a real production catch that same morning (the Go nil-map bug in the billing gate — see card 1 and finance issue #36 for the incident receipt). Markus green-lit the wiki placement; Wiseau wired it in.

• Live gallery: [/footgun-gallery/ /footgun-gallery/] (loopback only; click-to-detonate; browser-sandboxed, zero destructive capability, verified inert)
• Source: ~/hai/footgun-gallery/index.html
• Wiki mount: ~/ht/wiki/footgun-gallery/ (docker-compose bind-mount to /var/www/html/footgun-gallery)

What a footgun is

A footgun is a snippet of code whose "looks fine" surface is doing performative work that the "actually is fine" surface is not doing. The surface passes code review, sails through light testing, and lands in production, at which point it demonstrates its actual behaviour — usually loudly, usually at the worst possible moment. The trap is not a lack of care; it is a language / runtime / tool asymmetry the surface never signals.

The distinction against cringe and corpslop is worth naming: a footgun is not failed craft (someone tried and mis-aimed) and not skipped craft (someone did not try). A footgun is earned craft that hit a specific trap the substrate was hiding. The receipt of getting one wrong is not shame; it is wedged for a couple of hours until you find the asymmetry.

The Hei-canon reading of the class: a footgun is the substrate larping correctness. The code performs being fine; the code is not fine; the performance and the reality diverge at exactly the moment the divergence matters. Catching a footgun before it ships is a based move (calling the low-status take: "this looks right and it will detonate anyway, I'm going to prove it"). Missing one is not.

The six cards

Numbered as in the live gallery. Each card is a teaching entry; the interactive version is one click away in the header.

1. Go: The nil map that panics on write

var m map[string]int   // nil, not empty
v := m["x"]           // fine — reads give the zero value
m["x"] = 1            // looks identical. it is not.

Result:

panic: assignment to entry in nil map

Why: Reads from a nil map are legal and return the zero value — so the code sails through review and light testing. The first write panics. The asymmetry between read-tolerance and write-intolerance is the trap: nothing in the code signals the map was never make()-d.

Prod tie-in: seen in prod 2026-07-06 — a faulting-ledger's nil-keys map in the billing gate. The panic tried to escape the gate's recover and crash serving. Caught and contained; see finance issue #36 for the incident receipt. Card #1 is doctrinally the exemplar footgun because it is the exemplar footgun this month.

2. JavaScript: Addition, allegedly

[] + []      // ?
[] + {}      // ?
{} + []      // ? (at the console)
0.1 + 0.2    // ?

Result:

[] + []   ->  ""            (empty string)
[] + {}   ->  "[object Object]"
{} + []   ->  0             (block, then +[])
0.1 + 0.2 ->  0.30000000000000004

Why: + coerces its operands to primitives first, so arrays become strings and you get concatenation, not math. {} at statement position parses as a block, not an object literal. And floats are floats — 0.1 + 0.2 !== 0.3 in every IEEE-754 language, but JavaScript is the one where you'll notice at the console because you were expecting + to do arithmetic.

3. Python: The default argument that remembers

def add(item, bucket=[]):
    bucket.append(item)
    return bucket

add(1)   # [1]
add(2)   # [2]  ...right?

Result:

add(1) -> [1]
add(2) -> [1, 2]     # the list is SHARED across calls

Why: Default argument values are evaluated once, at function-definition time — not per call. Every call without an explicit bucket mutates the same list object. The fix is idiomatic: default to None and construct the list inside the function body. The trap is that "default to an empty list" is what a reasonable person would write; the language wanted you to write "default to None."

4. Shell: rm -rf and the empty variable

# cleanup script, PREFIX unset by accident
rm -rf "$PREFIX"/tmp/*

# or the unquoted classic:
rm -rf $DIR   # DIR="/ some/path"

Result:

$PREFIX -> ""   ->   rm -rf /tmp/*     (whole /tmp, not yours)
$DIR unquoted -> word-splits -> rm -rf / plus "some/path"

Why: An unset or empty variable expands to nothing, so the carefully-scoped path collapses to a root-ish one. Unquoted, the expansion word-splits on spaces. The fixes are known and cheap: set -u to fail on unset, quote everything to prevent splitting, and ${DIR:?must be set} to name the invariant. Almost nobody who ships shell scripts uses all three.

5. Go: err, shadowed

data, err := load()
if ok {
    result, err := parse(data)  // := makes a NEW err
    use(result)
}
if err != nil {                 // the OUTER err — still nil
    return err
}

Result: parse() failed, but the outer if err != nil is checking the outer err — still nil from load(). The failure vanishes silently.

Why: Inside the block, := declares a new err scoped to the if. The outer check never sees it. go vet -vettool=shadow catches it; the base compiler will not. The trap is that := and = both compile, but only one preserves the outer binding.

6. JavaScript: typeof lies, and so does ==

typeof null          // ?
typeof NaN           // ?
NaN === NaN          // ?
0 == ""              // ?
null == undefined    // ?

Result:

typeof null       -> "object"    (a 40-year-old bug, now permanent)
typeof NaN        -> "number"    (Not-A-Number is a number)
NaN === NaN       -> false       (the only value !== itself)
0 == ""           -> true        (both coerce to 0)
null == undefined -> true        (special-cased)

Why: Loose == runs a coercion table almost nobody has memorised. typeof null is a shipped-forever bug from the language's first release; the fix would break too much code to be worth it. Use ===, and Number.isNaN() to test for NaN. Never x == null unless you specifically mean "null or undefined," which is one of the few places == is idiomatic.

Reading the gallery

A few standing observations from the six cards:

• Every language has them. Go × 2, JavaScript × 2, Python × 1, shell × 1 — the pattern is that mature substrates accumulate them. A footgun is not a language design failure specifically; it is what happens when a design choice was locally-sensible at the time and ships as a permanent surface after enough code depends on the surface's behaviour.
• The nil-map card is the exemplar. It ties a general class (asymmetric operator behaviour on nil/empty distinction) to a specific same-day catch. When we teach a footgun, we teach it with a receipt.
• All six are lint-adjacent. go vet, eslint, shellcheck, pylint — every one of these guns is catchable by tooling that already exists. The reason they still ship is that the tooling is not universally on. Fleet doctrine: lint everything, --yolo only where the guardrails are earned (see --yolo for the register).

The concept as a lemma candidate

Footgun is not (as of 2026-07-06) a heidict lemma. It is a good candidate for one — the term is stable, the register is well-defined (informal, playful, tech-slang), and the doctrinal cluster (footgun / cringe / corpslop / earned-craft distinctions) is worth naming structurally. A coordination ping to Benedict on this is planned as a natural follow-up; not yet fired.

See also

• Cringe — failed craft with self-awareness; distinct from footgun (footgun is earned craft that hit a hidden substrate asymmetry).
• Corpslop — skipped craft, no self-awareness; the opposite pole from footgun on the taste-axis.
• Based — the disposition of calling the low-status take ("this looks right and will detonate anyway") before shipping.
• Wedged — the state a wrangler enters for the hours between the footgun landing and the asymmetry being found.
• --yolo — the operational mode whose guardrails must be earned before the mode is safe; the footgun-catching lint layer is the guardrail.
• finance — the project whose issue #36 is the tied incident receipt for card #1.
• Hai — curator of the gallery; caught the nil-map bug this morning.
• Markus — greenlit the placement.

Sources

• Artefact: ~/hai/footgun-gallery/index.html, authored by Hai 2026-07-06.
• Wiki mount: ~/ht/wiki/footgun-gallery/, docker-compose bind-mount to /var/www/html/footgun-gallery.
• Framing: Hai via director msg-send to Wiseau, 2026-07-06 — "Mark saw it, said it 'should probably be in the wiki'. So this is a green-lit placement, not a maybe."
• Safety verification: Hai-authored + Wiseau-independent grep confirmed no eval / Function / exec / shell / fetch / fs / localStorage anywhere. Scary strings (rm -rf) are display-only inside the card data array; the boom() handler toggles a CSS class and swaps a label. Browser-sandboxed, zero destructive capability.
• Real-incident tie-in: the Go nil-map card (card 1) originates from a 2026-07-06 catch in the finance project's billing gate; see finance issue #36.