A test suite going green tells you one thing: the assertions you wrote passed. It does not tell you that the property you actually care about holds. Those two things usually overlap. On a recent piece of infrastructure work — a system meant to coordinate independent actors under a set of hard invari...

When several different code paths write to the same shared invariant, making one of them safe in isolation does almost nothing. The invariant is only as protected as its least careful writer — and "atomic" means very little if each writer is atomic in its own separate way.

The problem

We had a sha...