A person has a name in parts, a gender and an address

The shape

Two households, two records

The first version of this built a table of its own — one row per human, shared across every household they belong to, so several logins could name one person and a name could be edited in one place. It was written, migrated, and its rules proved against four cases. Then it was thrown away.

Every other table in this schema belongs to one household: one column, one comparison, one rule. A row shared between houses cannot be. Its rule has to reach through a join in both directions, a household has to be able to read a name it must not write, and a seat with no login needs a third arm so that anybody can maintain it. That is three new places for an isolation bug to hide, in the one part of this product where an isolation bug means one family reading another’s.

On the household’s own row all of it is already true. The isolation rule covers the new columns the day they exist, the history covers them, and the erasure walk clears them beside the name that was there before.

The cost is that the same human in two households is two records, and they can drift. For a product whose unit is a house that is the right trade, and it is the grain everything else is already on. Bobby calls the same man Dad in one house and Rob in another.

Forgetting

Fourteen fields, one statement

Being forgotten had to be extended by hand, and it has a test that fails if it stops being true: a forgotten person cannot still be holding an address. The erasure clears all fourteen fields in one statement rather than failing halfway through.

The view the rest of the code reads through names its columns rather than selecting everything. A column added to the table and not to the view is a column no reader ever sees, which had already happened here once.