A subscription names a number of seats. Before that number means anything, three separate statements have to be true at once — and they are not one statement wearing three hats. Every write that makes a person seat-counted has to ask permission first. The asking has to be atomic, so that two people arriving at the same moment cannot both be admitted at the cap. And the number being enforced has to be the number the licence names, set by somebody other than the party it limits.
This week the third of those was repaired in VARGATES Medical, and the first was made enforceable. The middle one was never in doubt, and it is worth saying so first, because the work below reads like a story about a broken lock and it is not one.
The lock was never the doubtful part
The seat gate takes a per-organisation lock, counts and refuses in one step, and its behaviour is proved against a real database rather than a stand-in: a pool admits people up to the cap, refuses the next one, and returns the seat when somebody is removed. A second test puts two invitations at the same instant on an organisation one seat below its cap, and exactly one of them wins. None of what follows doubts any of that.
The census answered a neighbouring question
What nothing held was the set. There was already a census — a test that walks the source and fails when a write is not declared — but it keys on the construction of an account. That is a different set from the writes that spend a seat, and the difference is not academic: three of the paths that make a person seat-counted mint no account at all. Attaching an existing person to an organisation is one of them, and it is also the supported way to bring back somebody who was removed.
Walking the module for the row the seat count actually counts returns twelve functions. Nine claim a seat. Three are exempt, and each exemption is written out with its own reason, because an exemption is a claim about whose cap applies rather than a permission to skip one. If self-registration ever landed somebody in a customer's organisation, one of those three sentences would become false in a place a reader can see it — and a write cannot be declared exempt and claiming at once, so the two halves cannot quietly agree with each other.
What a census does that a list of names cannot
Two-sided. An undeclared write fails, and so does a declaration whose function has gone. One-sided, it rots in the direction that reads as success: a path missing from a hand-typed list makes the suite greener, not redder.
Ordering, not presence. A claim made after the write is not a claim — the row is already in the session, and the count either includes it or races it. The mutation for this moves the call without deleting it, so a test that merely counts calls stays green through it.
The condition, not the line number. Inverting the guard above one of the claims disables the cap for every net-new member while leaving the gate's line above the row's. So each declaration pins the source of the condition it sits under, exactly as written.
One claim reserves one seat. A write producing two seat-counted rows behind a single claim has an unimpeachable ordering and spends double, so how many rows a door writes is part of its declaration.
The bulk shape declared rather than normalised away. A bulk import must not re-count per row: it resolves the limit once under the same lock and compares a running total. Naming that call proves nothing by itself, so that door additionally has to show the refusal and the lock that actually stop it.
Duplicate keys fail instead of merging. Two same-named functions collapsed into one entry, one claim went unread, and the census still balanced.
A premise we had to withdraw
The first version of this work asserted that one door's gate was read by no test at all — delete it, and everything stays green. That was false. Deleting it goes red: the test asserting that an organisation can take a removed person back on is the only thing that exercises that refusal, and it fails.
Where the claim came from is the part worth keeping. It came from a mutation that exercised the new file and went red there. A red mutant is persuasive about the link it tests and silent about every other one. So the honest case for this census is not that today's doors are unguarded. It is that the set is: a path added tomorrow is covered by nothing, an existing claim can be neutered without moving the line it sits on, and a seat can be spent by a write the old census could not see.
The number reported, and the number enforced
The second half of the work sits above the count entirely, where two other questions live: who may set the number, and whether the number in the answer is the number being enforced.
The check guarding licence writing read as a platform-level gate and was not one. It was satisfied by an organisation's own owner — because an owner holds every permission inside their own organisation, and creating an organisation is self-serve. The party a licence constrains could issue it. Authority now means holding an owner or admin role inside the organisation that operates the platform — which no customer-side account can grant itself, because changing a membership role requires that permission in the organisation being changed. The endpoints that mint an entitlement share that one check instead of each holding its own opinion about what authority is.
The other question was quieter and worse. The ceiling actually enforced came from the plan tier, while a number stored beside it was echoed back in every response and honoured by nothing. Both directions of disagreement were reachable, and the dangerous one is the second: a record that reads as a smaller subscription while admitting far more people than it names. A figure the plan will not honour is now refused on both doors onto that column, and changing a plan carries its cap with it rather than leaving the record reporting the tier it used to be on. That repair is forward-only and says so in the code: it refuses new disagreements and does not silently rewrite old records, so anything written before it keeps reporting what it reported until a separate, still-open piece of work reconciles it.
There is a second correction on the record. The first diagnosis named the stored number as the lever an owner pulled. It was not — the tier was, and the stored number never mattered to enforcement. Finding that out is what turned up the defect above, and the correction sits on the issue rather than having been quietly dropped.
How we know
Every guard was then removed, inverted or moved, one at a time, and the suite had to go red for each — with the file restored from a copy and the baseline re-asserted after every pass. Two of those mutations are worth naming.
Pointing the walker at a directory that is not there is the found nothing failure: an empty walk satisfies every “no undeclared door” assertion perfectly. So there are liveness fixtures, one per way the walk can fail — missing a claim, inventing one, missing a late claim, reading an inverted guard as the declared one, undercounting rows, and merging a shared key.
And one mutation survived the first pass: the branch that grants authority to somebody who holds no membership row yet. Every account the fixtures build has already signed up, so that branch was never entered — the tests were green about code they never ran. It is not dead code either: an account created by provisioning or by a bulk import lands in a customer's organisation and never touches the platform's own, which is exactly the account somebody grants authority to on a fresh environment. A test that can only reach the branch its fixtures happen to produce is a test of the fixtures.
Both changes went out behind the full backend suite — more than twenty-one thousand tests across eight shards — and the run itself produced a defect worth its own issue: at full width the runner exhausted the host's memory and printed no total at all. A run that reports nothing looks like a run that found nothing, which is the failure mode this whole piece is about.
Why this is published
A buyer can read the number on a licence. What a buyer cannot read is whether anything inside the software is obliged to honour it — and that obligation is not one lock, it is an enumeration that has to stay complete as the product grows. For the lineage of VARGATES Medical that carries a subscription, the answer today is that the enumeration is rebuilt from the source on every test run rather than remembered, that it fails in both directions, and that from this change onward the number enforced is the number we issued. The product's older lineage still keeps its list by hand, and it is being retired rather than guarded.