Presence is not a relation

A control in our build fails when a record could be published before the transaction it describes has committed. Here is the whole check.

if !publisher.contains("AFTER the authoritative transaction has committed")
    && !publisher.contains("post-commit")
{
    violations.push(ForbiddenSetViolationV1::PostCommitOrderingChanged);
}

The first phrase is not in that file, so the check is one substring search for post-commit. That appears twice, both times in documentation, one of them the module header. Reword the comment and correct code fails the build. Invert the ordering and the check stays green.

The finding is not that someone wrote a bad line. A check’s name states a claim. Its body is a predicate. Nothing in the toolchain compares the two, so a predicate that cannot express its claim reads exactly like one that can.

And a substring search cannot reach most claims worth making. It answers whether a string is present. Ordering is a question about which operation runs first, and no choice of search string turns the second question into the first. The same holds for uniqueness, exclusivity, dominance, and exactness.

Nine checks live in that control. The two that work look for a constant declaration together with its value, like MAX_RECORDED_COMMITS_PER_SESSION: usize = 4_096; change the number and the check fails. The other six assert relations, and all six are substring searches. One establishes that a frozen payload has exactly four members by finding four member names, so a fifth member leaves all four in place. That one is called CommitPayloadShapeChanged and is documented as firing when the payload gains, loses, or renames a member. It cannot detect a gain.

The implementation is correct. I read it after the review, and nothing shipped broken. The evidence was wrong rather than the code, and every green that control produced was worth less than it read.

An independent reviewer found it, because it was asked what each body asserts rather than what its name claims. The producer had never asked that about its own work.

Ask it of any check you rely on. Can the predicate express the claim in the name? If the claim is a relation and the predicate is membership, a pass tells you nothing, and the test suite will not say so.

Both shapes are runnable in six commands in the field guide starter kit, with the same claim, the same code, and a check that catches the inverted order: starter-kit/predicates/.