The schema allowed it and every consumer assumed otherwise

# Self-authored for the EML case corpus (no external origin). The field is an
# array. How many consumers read anything but the first element is computed
# below.
#
# Declaring it as an array was the right call and the reviewers who asked for
# it were right too. The domain genuinely allows several, a scalar would have
# to be widened later at a breaking cost, and the schema is an accurate
# statement of what the producer may send.
#
# Every consumer was written against traffic in which the array had one
# element, because that is what the producer emitted for two years. Their code
# is correct for every message they have seen, and the schema is correct about
# messages nobody has sent yet.
#
# Both the schema's domain and the consumers' assumptions are counted.

# [consumer, elements it reads, behaviour when there are more]
[["billing", 1, "silently uses the first"], ["search index", 1, "silently uses the first"], ["audit log", 0, "stores the whole array"], ["notifier", 1, "silently uses the first"], ["export", 0, "stores the whole array"], ["fraud check", 1, "silently uses the first"], ["dashboard", 1, "silently uses the first"]] => consumers

len(consumers) => n

0 => first_only
0 => handles_many
for c in consumers:
    if c[1] == 1:
        first_only + 1 => first_only
    else:
        handles_many + 1 => handles_many

"consumers : " + str(n) ^0
"  read only the first element : " + str(first_only) ^0
"  handle the whole array      : " + str(handles_many) ^0
"" ^0

"consumer        reads        on a longer array" ^0
for c in consumers:
    "" => r
    if c[1] == 1:
        r + "first only  " => r
    else:
        r + "all elements" => r
    "  " + c[0] + "   " + r + " " + c[2] ^0
"" ^0

# ---- what the traffic has contained ----

# array lengths seen over two years, as counts
[["length 0", 0], ["length 1", 480000], ["length 2", 0], ["length 3 or more", 0]] => seen

0 => total_msgs
0 => nonstandard
for s in seen:
    total_msgs + s[1] => total_msgs
    if not (s[0] == "length 1"):
        nonstandard + s[1] => nonstandard
"messages observed : " + str(total_msgs) ^0
"  with exactly one element : " + str(total_msgs - nonstandard) ^0
"  with any other length    : " + str(nonstandard) ^0
if nonstandard == 0:
    "  the producer has never once sent a length the consumers cannot handle" ^0
"" ^0

# ---- what the schema permits ----

"what the schema allows" ^0
"  minimum length : 0" ^0
"  maximum length : unbounded" ^0
"  lengths the consumers are correct for : exactly 1" ^0
if first_only > 0:
    "  so " + str(first_only) + " consumers are correct on one length out of the permitted set," ^0
    "  and that length is the only one that has ever arrived" ^0
"" ^0

# ---- the day the producer sends two ----

"if the producer starts sending two elements tomorrow" ^0
"  consumers that error       : 0" ^0
"  consumers that change answer silently : " + str(first_only) ^0
"  consumers that are unaffected         : " + str(handles_many) ^0
if first_only > handles_many:
    "  the failure is " + str(first_only) + " wrong answers and no alert, because reading" ^0
    "  the first element of a two-element array is a legal operation" ^0
"" ^0

# ---- and the day it sends none ----

"if the producer sends an empty array" ^0
"  consumers that error : " + str(first_only) + ", on an index that is not there" ^0
"  that failure is loud, and it is the one the schema's minimum of 0 predicts" ^0
if first_only > 0:
    "  the empty case fails safely and the many case fails silently, which is" ^0
    "  the opposite of how the two are usually ranked in a review" ^0
"" ^0

# ---- what would have made the assumption visible ----

"where the assumption is written down" ^0
"  in the schema     : no, it permits any length" ^0
"  in the consumers  : no, indexing the first element is not a statement" ^0
"  in the fixtures   : yes, every one has exactly one element" ^0
"  the fixtures are the only artefact that records what anybody assumed," ^0
"  and they record it by example rather than by saying it" ^0
"" ^0

# ---- the control: a field the schema pins to one ----
#
# Where the schema says exactly one, the consumers' assumption and the
# declaration are the same statement and there is nothing to diverge.

"control - the same field declared as a single value" ^0
"  lengths permitted : 1" ^0
"  consumers correct for : 1" ^0
"  the two sets are equal, so no traffic can arrive that the consumers are" ^0
"  wrong about, and widening it later is a visible breaking change instead" ^0
"  of a silent one" ^0
"" ^0

"The array declaration is the accurate description of the domain and the" ^0
"consumers are correct for every message ever sent. The set the schema" ^0
"permits and the set the traffic contains have been the same size for two" ^0
"years, and only one of them is a promise." ^0

consumers = [["billing", 1, "silently uses the first"], ["search index", 1, "silently uses the first"], ["audit log", 0, "stores the whole array"], ["notifier", 1, "silently uses the first"], ["export", 0, "stores the whole array"], ["fraud check", 1, "silently uses the first"], ["dashboard", 1, "silently uses the first"]]
n = len(consumers)
first_only = 0
handles_many = 0
for c in consumers:
    if c[1] == 1:
        first_only = first_only + 1
    else:
        handles_many = handles_many + 1
print("consumers : " + str(n))
print("  read only the first element : " + str(first_only))
print("  handle the whole array      : " + str(handles_many))
print("")
print("consumer        reads        on a longer array")
for c in consumers:
    r = ""
    if c[1] == 1:
        r = r + "first only  "
    else:
        r = r + "all elements"
    print("  " + c[0] + "   " + r + " " + c[2])
print("")
seen = [["length 0", 0], ["length 1", 480000], ["length 2", 0], ["length 3 or more", 0]]
total_msgs = 0
nonstandard = 0
for s in seen:
    total_msgs = total_msgs + s[1]
    if not s[0] == "length 1":
        nonstandard = nonstandard + s[1]
print("messages observed : " + str(total_msgs))
print("  with exactly one element : " + str(total_msgs - nonstandard))
print("  with any other length    : " + str(nonstandard))
if nonstandard == 0:
    print("  the producer has never once sent a length the consumers cannot handle")
print("")
print("what the schema allows")
print("  minimum length : 0")
print("  maximum length : unbounded")
print("  lengths the consumers are correct for : exactly 1")
if first_only > 0:
    print("  so " + str(first_only) + " consumers are correct on one length out of the permitted set,")
    print("  and that length is the only one that has ever arrived")
print("")
print("if the producer starts sending two elements tomorrow")
print("  consumers that error       : 0")
print("  consumers that change answer silently : " + str(first_only))
print("  consumers that are unaffected         : " + str(handles_many))
if first_only > handles_many:
    print("  the failure is " + str(first_only) + " wrong answers and no alert, because reading")
    print("  the first element of a two-element array is a legal operation")
print("")
print("if the producer sends an empty array")
print("  consumers that error : " + str(first_only) + ", on an index that is not there")
print("  that failure is loud, and it is the one the schema's minimum of 0 predicts")
if first_only > 0:
    print("  the empty case fails safely and the many case fails silently, which is")
    print("  the opposite of how the two are usually ranked in a review")
print("")
print("where the assumption is written down")
print("  in the schema     : no, it permits any length")
print("  in the consumers  : no, indexing the first element is not a statement")
print("  in the fixtures   : yes, every one has exactly one element")
print("  the fixtures are the only artefact that records what anybody assumed,")
print("  and they record it by example rather than by saying it")
print("")
print("control - the same field declared as a single value")
print("  lengths permitted : 1")
print("  consumers correct for : 1")
print("  the two sets are equal, so no traffic can arrive that the consumers are")
print("  wrong about, and widening it later is a visible breaking change instead")
print("  of a silent one")
print("")
print("The array declaration is the accurate description of the domain and the")
print("consumers are correct for every message ever sent. The set the schema")
print("permits and the set the traffic contains have been the same size for two")
print("years, and only one of them is a promise.")

consumers : 7
  read only the first element : 5
  handle the whole array      : 2

consumer        reads        on a longer array
  billing   first only   silently uses the first
  search index   first only   silently uses the first
  audit log   all elements stores the whole array
  notifier   first only   silently uses the first
  export   all elements stores the whole array
  fraud check   first only   silently uses the first
  dashboard   first only   silently uses the first

messages observed : 480000
  with exactly one element : 480000
  with any other length    : 0
  the producer has never once sent a length the consumers cannot handle

what the schema allows
  minimum length : 0
  maximum length : unbounded
  lengths the consumers are correct for : exactly 1
  so 5 consumers are correct on one length out of the permitted set,
  and that length is the only one that has ever arrived

if the producer starts sending two elements tomorrow
  consumers that error       : 0
  consumers that change answer silently : 5
  consumers that are unaffected         : 2
  the failure is 5 wrong answers and no alert, because reading
  the first element of a two-element array is a legal operation

if the producer sends an empty array
  consumers that error : 5, on an index that is not there
  that failure is loud, and it is the one the schema's minimum of 0 predicts
  the empty case fails safely and the many case fails silently, which is
  the opposite of how the two are usually ranked in a review

where the assumption is written down
  in the schema     : no, it permits any length
  in the consumers  : no, indexing the first element is not a statement
  in the fixtures   : yes, every one has exactly one element
  the fixtures are the only artefact that records what anybody assumed,
  and they record it by example rather than by saying it

control - the same field declared as a single value
  lengths permitted : 1
  consumers correct for : 1
  the two sets are equal, so no traffic can arrive that the consumers are
  wrong about, and widening it later is a visible breaking change instead
  of a silent one

The array declaration is the accurate description of the domain and the
consumers are correct for every message ever sent. The set the schema
permits and the set the traffic contains have been the same size for two
years, and only one of them is a promise.

Trace event types