An invariant is what others rely on. You author only half of it

In a previous post I said judgement runs the whole line, and you keep it while the machine takes only the running. It holds downward: the check faithful to the invariant, the invariant to the decision.

Judgement runs up too. That I missed.

An invariant is what others rely on. You author only half of it.

A data team commits to an SLA: the extract is ready by 06:00. For years it lands by 02:00, so a downstream job runs at 02:30. Everyone is inside the SLA.

Then the team re-platforms it. It now finishes at 05:30, still inside the SLA, every check green. The 02:30 job reads a stale file and breaks, silently.

Two promises on one fact. The one that broke was the one nobody wrote down.

This is Hyrum’s Law: with enough consumers, every observable behaviour becomes something someone depends on. Your consumers write some for you.

A check cannot find this. It enforces the invariant you declared. The one you did not declare lives in someone else’s code, found only by exploration: who relies on you, for what?

So you face a human choice. Promote the hidden invariant: declare it, own it, check it. Or disown it for real: hold the file until 06:00, so no one can depend on it.

That discovery is the explored half of the invariant. The check runs itself; deciding what you owe does not.