소속을 가르는 질문 하나

# PASSES: the module cannot tell which app called it.
def new_id(ts_ms: int | None = None) -> str:
    """Timestamp + randomness, lexicographically sortable."""
    ...

def encrypt_line(text: str, *, key_slot: str) -> str:
    """The app names its own key slot; the algorithm does not care."""
    ...

def claims_ddl(subject_col: str) -> str:
    """The app names what a job is ABOUT. The kernel only knows that
    exactly one claim per subject may be active at a time."""
    ...


# FAILS: a shared module that has learned what applications are.
# Nothing here is wrong on its own line. Read it as a whole and it
# is a framework: every app must now be expressible in this vocabulary.
def render_record_card(record, *, app: str):
    if app == "travel":
        title = record["journey"]["name"]        # domain leaked in
    elif app == "journal":
        title = record["date"]                   # ...and again
    elif app == "health":
        title = f"{record['module']} - {record['reading']}"
    else:
        raise ValueError(f"unknown app: {app}")   # <- the smell:
                                                  # the kit can now be
                                                  # WRONG about an app
    ...


# The rewrite that passes: the app supplies the knowledge, the kit
# supplies the mechanism. Note that the kit can no longer be wrong
# about an app, because it no longer knows any app exists.
def render_record_card_ok(record, *, title_of):
    title = title_of(record)
    ...


# A canary for the shared repo's own tests - and note carefully what
# it does NOT assert. Kit modules legitimately NAME consumers in
# provenance docstrings ("extracted from X, Y and Z"), because a
# comment recording where code came from is not knowledge the code
# acts on. What must never appear is a consumer name that the RUNNING
# CODE branches on.
def test_no_kit_module_branches_on_a_consumer(kit_sources, consumers):
    for path, text in kit_sources.items():
        code = strip_comments_and_docstrings(text)
        for name in consumers:
            assert name.lower() not in code.lower(), (
                f"{path} names {name} in executable code"
            )

# And even that is a floor, not the rule. The rule is the question at
# the top - does this module need to know what the app is about? - and
# a module can fail it without ever spelling an app's name, by taking
# a parameter whose VALUES are the apps.