Begin without a name

A notification function says: security alerts come first; direct mentions come next unless muted; team messages come next during work hours; everything else waits. The code is a ladder of conditionals repeated in the badge, delivery, and inbox paths.

Do not begin by saying “rules engine.” First inventory:

1. states: muted or audible, work or quiet hours;
2. operations: classify, enqueue, suppress;
3. owners: user policy owns mute; scheduler owns hours;
4. observations: selected priority and suppression reason;
5. contradictions: two paths rank the same message differently.

Compare structures, not fashions

A sorted table of rules and a decision diagram can both represent the policy. The table uses only a total priority order and predicates. The decision diagram adds canonical sharing and efficient equivalence checks under a fixed variable order.

Apply the adequacy tiebreak in order.

First, reachability: does the larger structure eliminate a mistake the table can reach? If all consumers evaluate one small policy, no. Second, law count: does behavior use canonical identity or shared residual decisions? Not yet. Third, second consumer: do two honest call sites need the general mechanism, or are three paths simply duplicating the same local policy? A shared ordered table is adequate; the decision diagram is unearned.

The recovered primitive is a pure classifier returning priority and a typed reason. Effect handlers decide whether to badge, notify, or enqueue. A differential test runs old and new implementations across the finite policy space and compares the declared observations.

Try to break the laws

Candidate law: adding a lower-priority matching rule cannot displace a higher one. Counterexample: an implementation returns the last match rather than the maximum. Candidate law: delivery adapters do not reinterpret classification. Counterexample: one adapter silently promotes team messages.

The minimized counterexamples explain why the abstraction exists. Keep them as fixtures.

Transfer and refusal

Run the same procedure on a household schedule: people, rooms, time windows, and conflicts. The vocabulary changes; inventory, contradiction, laws, and adequacy do not.

Refuse extraction when the conditional is short, local, scheduled for deletion, or lacks a second consumer. Recognition may still improve the test: name the invariant locally and preserve the counterexample without creating a public framework.

Lessons

• Recovery starts with observations and contradictions, not vocabulary.
• Candidate laws need concrete counterexamples.
• Reachability, used laws, and a second consumer choose among adequate models.
• Refusal is part of the procedure.

Practice

1. Reconstruct the eight items on the recovery card from memory.
2. Compare a two-state machine with a workflow engine for a confirmation button.
3. Apply the pipeline to cache-eviction conditionals without naming a structure until step six.

Part II begins with a program whose callbacks settle out of order. Which result is allowed to publish?

References

1. “George Pólya, /How to Solve It/.” — the problem-solving questions adapted for faded recovery prompts.
2. “Robert Floyd, “Assigning Meanings to Programs”.” — foundational use of assertions to make program meaning explicit.