Invalid State Should Be Difficult to Construct

Sat, 01 Feb 2020 00:00:00 +0000

A wallet reservation held one amount while a booking was in progress. When the booking later reached the billing system, an imported record could contain no price. The reservation knew how much money had been held, but not how that amount divided into net price and VAT.

There was no authoritative way to create the final sale from the hold alone. Inferring a tax rate would turn a guess into accounting data.

Let the Database Reject Impossible State

Sun, 01 Jan 2017 00:00:00 +0000

Two workers asked the same reasonable question: does this owner already have an active record? Both received the same honest answer: no.

Each worker created one.

Nothing in either request was obviously careless. The application checked first. The insert happened inside a transaction. Tests which ran one request at a time stayed green. The defect lived in the interval between the check and the write, where both transactions were allowed to be correct about a state which had already become stale.

Invariants on Brian Faust

Invalid State Should Be Difficult to Construct

Let the Database Reject Impossible State