Tensions in Practice: A next-step guarantee in tension with a lifecycle guarantee¶
A three-state publication workflow
The declared workflow is Draft → Approved → Released. A document is editable in Draft and Approved, but frozen in Released. Starting in Draft, it is necessarily editable after the next transition. It is not necessarily editable at every reachable later state. The second statement does not reveal a malfunction: release is meant to freeze the document. It asks a stronger question about the same workflow.
Check the immediate handoff
Establish what remains possible after the next transition.
State a lifecycle guarantee
Check a property across every later state reachable from here.
Why these aims pull against each other
A short-horizon guarantee can be sufficient for the next action but cannot be promoted into an all-future promise without examining later transitions.
Choose an arrangement to see what changes and what remains difficult.
Rows are the same reachable future states. Steps count transitions from Draft; editability stays fixed. Only whether the claim ranges over that state changes.
What this choice protects
What it costs
When it fits
Compare the arrangements
Check the next transition
Admit only the immediate successor of Draft: Approved.
| Steps | Editable | In claim | |
|---|---|---|---|
| Approved | 1 | Yes | YesIncluded |
| Released | 2 | No | NoExcluded |
- What it protects
- The next reviewer can be promised an editable document under this workflow.
- What it costs
- The promise does not extend through later release.
- When it fits
- Fits a contract explicitly limited to the next handoff.
Illustration note: The property holds in every admitted successor; “necessary” is relative to this one-step relation.
Check all later reachable states
Admit Approved and Released, reached in one and two transitions respectively.
| Steps | Editable | In claim | |
|---|---|---|---|
| Approved | 1 | Yes | YesIncluded |
| Released | 2 | No | YesIncluded |
- What it protects
- The analysis prevents a false promise that editability lasts throughout the lifecycle.
- What it costs
- More transitions and reachable states must be considered; larger workflows can make closure expensive.
- When it fits
- Fits a question about every later state, not merely the next handoff.
Illustration note: Release makes the broader editability guarantee false without invalidating the narrower next-step guarantee.
What this illustration does—and does not—establish
The source supplies the tension. The invented setting, alternatives and any numbers illustrate a limited comparison; each arrangement retains its stated costs and conditions.
- The transition chain and editability rules are stipulated; there are no hidden branches or failures in this toy.
- The property is not a probability, and no likelihood is assigned to reaching release.
- This is a comparison of exact claim horizons, not prototype test coverage or evidence that a real implementation follows its model.
Source entries
Modal Reasoning
This source passage supplies the contextual tension. The concrete arrangements and schematic examples are editorial illustrations, not measured findings.
Tightening the accessibility relation buys tractability but risks vacuous verdicts
Restricting which alternatives count as live shrinks the search space and makes more claims come out necessary, which is exactly what makes verification and planning tractable. But the same restriction can certify "necessarily safe" or "impossible" by quietly excluding the very alternatives that matter.
The source operation
A claim is *necessary* when its inner proposition holds across all accessible alternatives, *possible* when it holds in at least one, and *impossible* when it holds in none.