Write down every guarantee before you write any code
Here is every promise a to-do list makes. VARIABLE tasks Init == tasks = [i \in Ids |-> "absent"] Add(i) == tasks[i] = "absent" /\ tasks' = [tasks EXCEPT ![i] = "open"] Complete(i) == tasks[i] = "open" /\ tasks' = [tasks EXCEPT ![i] = "done"] Reopen(i) == tasks[i] = "done" /\ tasks' = [tasks EXCEPT ![i] = "open"] Delete(i) == tasks[i] # "absent" /\ tasks' = [tasks EXCEPT ![i] = "absent"]…
Here is a summary of the story:
Every promise a to-do list makes includes the following guarantees: tasks cannot go directly from absent to done; opening, completing, reopening, deleting and clearing completed items must be done one at a time; and ClearCompleted only works when there are done items to clear. These nine lines of guarantees constitute the complete contract for a to-do list system, but they are not explicitly documented anywhere.
Instead, the guarantees are embedded in a test suite that asserts outcomes, scattered validation, and the memory of senior developers. The author argues that understanding and documenting these guarantees upfront can catch bugs before any code is written, saving time and effort. The article then explains the rules used in the TLA+ specification language to formally define the to-do list behavior.
The key operators define how tasks transition between states and how the Next action can change the state of the system. The Spec line ties the initial state and all possible next state transitions together. The article concludes by noting that while a real to-do list system's guarantees are likely much longer and more complex, the core principles remain the same - write down and enforce the essential guarantees early in the design process.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — it may contain errors, so check the original before relying on it.
