C.W.K.
Stream
More →
Lesson 03 of 04 · published

Two Owners and a Projection

~11 min · scopes, privacy, computed-state, data-model

Level 0Open Gate
0 XP0/36 lessons0/12 achievements
0/100 XP to next level100 XP to go0% complete
"Two people really own things. The third view is math — and math you can't edit can't leak the wrong way."

Three scopes, but only two are real

Keep opens on the Family scope, and you can switch among Dad, Mom, and Family without touching any underlying record. But those three are not equals. Dad and Mom are writable owners — each has real, editable holdings, a seed amount, and a stored cash balance. Family is a projection: it is computed from the two owner portfolios every time it's read, and it is never a third writable account. You cannot "edit the Family portfolio," because there is nothing there to edit — it's a sum, not a store.

Why the projection matters more than it looks

Making Family a computed read-only view instead of a stored third account removes an entire class of bug: drift. If Family were a real account you had to keep in sync, then every edit to Dad's or Mom's holdings would need a matching update to Family, and the moment one update was missed, the totals would lie. By computing Family on read, the family view is always exactly the sum of its parts — it literally cannot disagree with them, because it has no independent existence.

Derive what you can; store only what you must. A value that must always equal a function of other values should be that function, evaluated on read — not a copy you promise to keep in sync. Every stored copy of a derivable value is a future inconsistency waiting for a missed update.

The privacy edge — this is the careful part

Because Keep holds two different people's real finances, scope isn't just a UI convenience — it's a confidentiality boundary. When you're looking at the Dad scope, Mom's detailed holdings must not be silently folded into whatever context is active. That rule reaches all the way into the Pippa Sidekick you'll meet later: when you ask Pippa a question in one scope, the portfolio truth Pippa reads is the selected scope, not a quietly-widened everything. Mom's data is never broadened into another context just because it was technically available.

"Technically available" is not "allowed to appear." Two people's data living in one database does not mean either person's data may surface in the other's view or context. The default must be the narrow scope, and widening must be an explicit, owner-consented act — never an accident of how the query was written.
Stored cash is authoritative. Each owner has a stored cash balance that is ground truth — it is not silently reconstructed from seed minus cost. That's a Track 3 idea, but it's why an owner is a real, writable thing and Family is not: cash and positions are held, totals are computed.

Code

Family is a function, not a table (illustrative — synthetic numbers)·python
# Dad and Mom are writable owners with real stored rows.
# Family is NEVER stored — it is recomputed on every read.
def family_total(as_of_date):
    dad = owner_total("dad", as_of_date)   # reads Dad's stored rows
    mom = owner_total("mom", as_of_date)   # reads Mom's stored rows
    return dad + mom                        # a projection, not a record

# There is deliberately no `save_family_total()`.
# You cannot write to a view. That is the whole point:
# the sum can never drift out of step with its parts.

External links

Exercise

In any system you've built with a 'total' or 'summary' number, decide: is that number STORED (a column you update) or COMPUTED (derived on read)? If stored, name the update you could forget that would make it lie. Separately: if your system holds more than one person's data, write the one query mistake that would leak person B's data into person A's view — and the default that prevents it.
Hint
The leak is almost never malicious — it's a forgotten WHERE clause. 'SELECT everything' feels harmless in dev with one user; with two owners it's a confidentiality breach. Scope belongs in the default, not in the caller's discipline.

Progress

Progress is local-only — sign in to sync across devices.
← PreviousRemake, Not RemasterNext →Low-Trigger by Design
Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)
Sign in — Please sign in to comment.

No comments yet — be the first.