The check ran on a copy and the original was used

# Self-authored for the EML case corpus (no external origin). Every request is
# normalised, then validated, and the validator has never passed a bad value.
# Which value the handler then uses is computed below.
#
# Normalising before validating is correct and it is the order the rules were
# written for. Validating raw input means every rule carries its own trimming,
# case folding and unicode handling, the rules drift apart, and the one that
# forgets is the hole. Normalise once, validate the normal form, and each rule
# states one thing. The normaliser is well tested and the validator is strict.
#
# The normaliser returns a new value rather than editing in place, which is
# also correct: a pure function is testable and cannot corrupt its input on a
# rejection path.
#
# So there are two values. The validator was handed one of them.

240000 => requests_per_day
37 => normalised_differs_per_thousand

int(requests_per_day * normalised_differs_per_thousand / 1000) => requests_where_they_differ
requests_per_day - requests_where_they_differ => requests_where_identical

"requests per day                      : " + str(requests_per_day) ^0
"normal form differs from the input    : " + str(normalised_differs_per_thousand) + " per thousand" ^0
"requests where they differ            : " + str(requests_where_they_differ) ^0
"requests where they are identical     : " + str(requests_where_identical) ^0
"" ^0

# ---- the two values ----

"the pipeline" ^0
"  1  read the request body       -> original" ^0
"  2  normalise(original)         -> normal" ^0
"  3  validate(normal)            -> pass or reject" ^0
"  4  handle(original)" ^0
"" ^0
"  step 3 and step 4 name different variables" ^0
"  and both names are correct for their own line" ^0
"" ^0

# ---- what the validator reports ----

"the validator's record" ^0
"  values validated  : " + str(requests_per_day) ^0
"  values rejected   : 0" ^0
"  pass rate         : 100 percent" ^0
"  false accepts     : 0" ^0
"" ^0
"  every one of those is true about the value it was given" ^0
"  values it was given that reached the handler : " + str(requests_where_identical) ^0
"" ^0

# ---- the requests where the two differ ----

"what normalisation changes, and what the handler then sees" ^0
"  trailing whitespace stripped     handler sees it back" ^0
"  email address lower-cased        handler sees the original case" ^0
"  unicode direction marks removed  handler sees the marks" ^0
"  repeated slashes in a path collapsed  handler sees them repeated" ^0
"" ^0
"  requests affected : " + str(requests_where_they_differ) + " per day" ^0
"  requests where the validator's verdict was about a value" ^0
"  nothing downstream ever reads : " + str(requests_where_they_differ) ^0
"" ^0

# ---- one request ----

"one request, both values" ^0
"  original : a path with two slashes and a trailing space" ^0
"  normal   : the same path, collapsed and trimmed" ^0
"  validate(normal)  : passes, the path is inside the allowed root" ^0
"  handle(original)  : resolves a different path" ^0
"" ^0
"  the validator is correct, the normaliser is correct," ^0
"  and the conclusion does not travel with the value" ^0
"" ^0

# ---- how long this can hold ----
#
# Nothing here degrades. The tests pass because the tests call validate() and
# check its verdict, which is right. An end-to-end test would catch it, if one
# of its inputs were a value whose normal form differs.

12 => end_to_end_tests
0 => e2e_inputs_needing_normalisation

"the test suite" ^0
"  unit tests on the normaliser : pass" ^0
"  unit tests on the validator  : pass" ^0
"  end-to-end tests             : " + str(end_to_end_tests) + ", all passing" ^0
"  of those, inputs whose normal form differs : " + str(e2e_inputs_needing_normalisation) ^0
"" ^0
"  fixtures are written in normal form, because a person writing" ^0
"  one types the tidy version, so the two values coincide in" ^0
"  every test and the bug has no input that can express it" ^0
"" ^0

# ---- the control ----
#
# Both components, against their own contracts. The normaliser produces a
# correct normal form and does not mutate its argument. The validator accepts
# exactly the values it should.

"control - are the two components correct" ^0
"  normaliser output correct  : yes, on all " + str(requests_per_day) ^0
"  normaliser mutates input   : no, by design" ^0
"  validator false accepts    : 0" ^0
"  validator false rejects    : 0" ^0
"  defects in either component : 0" ^0
"" ^0
"  the purity that makes the normaliser safe is what creates" ^0
"  the second value" ^0
"" ^0

# ---- the null control ----
#
# The same normaliser, same validator, same order, where step 4 is handed the
# normal form. Nothing about either component changes and no rule is rewritten.

"null control - the same pipeline handing step 4 the normal form" ^0
"  requests where the values differ : " + str(requests_where_they_differ) ^0
"  requests validated               : " + str(requests_per_day) ^0
"  requests where the verdict applies to what ran : " + str(requests_per_day) ^0
"  one identifier changed on one line" ^0
"" ^0

# ---- the rule ----

"what a passing validation is a statement about" ^0
"  the value passed to it       : yes, completely" ^0
"  the value used afterwards    : only if they are the same object" ^0
"  and a pure normaliser guarantees they are not" ^0
"" ^0
"the check is not too weak and the normaliser is not wrong;" ^0
"the verdict simply does not name the value it will be quoted" ^0
"about, and nothing in either signature says so" ^0
"" ^0

"The normaliser is pure and correct, the validator has 0 false accepts and 0" ^0
"false rejects across " + str(requests_per_day) + " requests a day, and the order they run in is the" ^0
"order that keeps the rules from drifting. On the " + str(requests_where_they_differ) + " requests a day whose" ^0
"normal form differs from their input, the verdict describes a value the" ^0
"handler never sees, and the " + str(end_to_end_tests) + " end-to-end tests cannot show it because " + str(e2e_inputs_needing_normalisation) ^0
"of their inputs are written in a form that needs normalising." ^0

requests_per_day = 240000
normalised_differs_per_thousand = 37
requests_where_they_differ = int(requests_per_day * normalised_differs_per_thousand / 1000)
requests_where_identical = requests_per_day - requests_where_they_differ
print("requests per day                      : " + str(requests_per_day))
print("normal form differs from the input    : " + str(normalised_differs_per_thousand) + " per thousand")
print("requests where they differ            : " + str(requests_where_they_differ))
print("requests where they are identical     : " + str(requests_where_identical))
print("")
print("the pipeline")
print("  1  read the request body       -> original")
print("  2  normalise(original)         -> normal")
print("  3  validate(normal)            -> pass or reject")
print("  4  handle(original)")
print("")
print("  step 3 and step 4 name different variables")
print("  and both names are correct for their own line")
print("")
print("the validator's record")
print("  values validated  : " + str(requests_per_day))
print("  values rejected   : 0")
print("  pass rate         : 100 percent")
print("  false accepts     : 0")
print("")
print("  every one of those is true about the value it was given")
print("  values it was given that reached the handler : " + str(requests_where_identical))
print("")
print("what normalisation changes, and what the handler then sees")
print("  trailing whitespace stripped     handler sees it back")
print("  email address lower-cased        handler sees the original case")
print("  unicode direction marks removed  handler sees the marks")
print("  repeated slashes in a path collapsed  handler sees them repeated")
print("")
print("  requests affected : " + str(requests_where_they_differ) + " per day")
print("  requests where the validator's verdict was about a value")
print("  nothing downstream ever reads : " + str(requests_where_they_differ))
print("")
print("one request, both values")
print("  original : a path with two slashes and a trailing space")
print("  normal   : the same path, collapsed and trimmed")
print("  validate(normal)  : passes, the path is inside the allowed root")
print("  handle(original)  : resolves a different path")
print("")
print("  the validator is correct, the normaliser is correct,")
print("  and the conclusion does not travel with the value")
print("")
end_to_end_tests = 12
e2e_inputs_needing_normalisation = 0
print("the test suite")
print("  unit tests on the normaliser : pass")
print("  unit tests on the validator  : pass")
print("  end-to-end tests             : " + str(end_to_end_tests) + ", all passing")
print("  of those, inputs whose normal form differs : " + str(e2e_inputs_needing_normalisation))
print("")
print("  fixtures are written in normal form, because a person writing")
print("  one types the tidy version, so the two values coincide in")
print("  every test and the bug has no input that can express it")
print("")
print("control - are the two components correct")
print("  normaliser output correct  : yes, on all " + str(requests_per_day))
print("  normaliser mutates input   : no, by design")
print("  validator false accepts    : 0")
print("  validator false rejects    : 0")
print("  defects in either component : 0")
print("")
print("  the purity that makes the normaliser safe is what creates")
print("  the second value")
print("")
print("null control - the same pipeline handing step 4 the normal form")
print("  requests where the values differ : " + str(requests_where_they_differ))
print("  requests validated               : " + str(requests_per_day))
print("  requests where the verdict applies to what ran : " + str(requests_per_day))
print("  one identifier changed on one line")
print("")
print("what a passing validation is a statement about")
print("  the value passed to it       : yes, completely")
print("  the value used afterwards    : only if they are the same object")
print("  and a pure normaliser guarantees they are not")
print("")
print("the check is not too weak and the normaliser is not wrong;")
print("the verdict simply does not name the value it will be quoted")
print("about, and nothing in either signature says so")
print("")
print("The normaliser is pure and correct, the validator has 0 false accepts and 0")
print("false rejects across " + str(requests_per_day) + " requests a day, and the order they run in is the")
print("order that keeps the rules from drifting. On the " + str(requests_where_they_differ) + " requests a day whose")
print("normal form differs from their input, the verdict describes a value the")
print("handler never sees, and the " + str(end_to_end_tests) + " end-to-end tests cannot show it because " + str(e2e_inputs_needing_normalisation))
print("of their inputs are written in a form that needs normalising.")

requests per day                      : 240000
normal form differs from the input    : 37 per thousand
requests where they differ            : 8880
requests where they are identical     : 231120

the pipeline
  1  read the request body       -> original
  2  normalise(original)         -> normal
  3  validate(normal)            -> pass or reject
  4  handle(original)

  step 3 and step 4 name different variables
  and both names are correct for their own line

the validator's record
  values validated  : 240000
  values rejected   : 0
  pass rate         : 100 percent
  false accepts     : 0

  every one of those is true about the value it was given
  values it was given that reached the handler : 231120

what normalisation changes, and what the handler then sees
  trailing whitespace stripped     handler sees it back
  email address lower-cased        handler sees the original case
  unicode direction marks removed  handler sees the marks
  repeated slashes in a path collapsed  handler sees them repeated

  requests affected : 8880 per day
  requests where the validator's verdict was about a value
  nothing downstream ever reads : 8880

one request, both values
  original : a path with two slashes and a trailing space
  normal   : the same path, collapsed and trimmed
  validate(normal)  : passes, the path is inside the allowed root
  handle(original)  : resolves a different path

  the validator is correct, the normaliser is correct,
  and the conclusion does not travel with the value

the test suite
  unit tests on the normaliser : pass
  unit tests on the validator  : pass
  end-to-end tests             : 12, all passing
  of those, inputs whose normal form differs : 0

  fixtures are written in normal form, because a person writing
  one types the tidy version, so the two values coincide in
  every test and the bug has no input that can express it

control - are the two components correct
  normaliser output correct  : yes, on all 240000
  normaliser mutates input   : no, by design
  validator false accepts    : 0
  validator false rejects    : 0
  defects in either component : 0

  the purity that makes the normaliser safe is what creates
  the second value

null control - the same pipeline handing step 4 the normal form
  requests where the values differ : 8880
  requests validated               : 240000
  requests where the verdict applies to what ran : 240000
  one identifier changed on one line

what a passing validation is a statement about
  the value passed to it       : yes, completely
  the value used afterwards    : only if they are the same object
  and a pure normaliser guarantees they are not

the check is not too weak and the normaliser is not wrong;
the verdict simply does not name the value it will be quoted
about, and nothing in either signature says so

The normaliser is pure and correct, the validator has 0 false accepts and 0
false rejects across 240000 requests a day, and the order they run in is the
order that keeps the rules from drifting. On the 8880 requests a day whose
normal form differs from their input, the verdict describes a value the
handler never sees, and the 12 end-to-end tests cannot show it because 0
of their inputs are written in a form that needs normalising.

Trace event types