Capstone: One System, Both Disciplines

15.1 The Shape of the System

The system has five regions, and the whole architecture is the order in which a request passes through them. Read the diagram top to bottom; it is the life of one order.

   untrusted request
         │
   ┌─────▼─────┐   BOUNDARY — parse, don't validate            (Ch 4)
   │  parser   │   request ──► Result[Draft, String]
   └─────┬─────┘
         │  a trustworthy Draft
   ┌─────▼───────────────  OPEN EDGE  ───────────────────  (Ch 9–13) ┐
   │  pricing DSL / engine ──► quote        fulfillment search        │
   └─────┬────────────────────────────────────────────────────────────┘
         │  quote  (the core has not vouched for this)
   ┌─────▼─────┐   THE MEMBRANE — admit_quote            (Ch 2, Ch 9)
   │  contract │   require currency · non-negative · above floor
   └─────┬─────┘
         │  an admitted quote
   ┌─────▼───────────────  CONSTRAINED CORE  ─────────────  (Ch 3–6) ┐
   │  Draft ──► Placed ──► Shipped   ·   total functions, invariants  │
   │  returns  Placed + [Effect]     ·   decisions as data            │
   └─────┬────────────────────────────────────────────────────────────┘
         │  effects to perform
   ┌─────▼─────┐   IMPERATIVE SHELL + layers            (Ch 6, Ch 8)
   │   shell   │   charge · reserve · confirm · record
   └───────────┘

The two disciplines are visible as regions. The core is a sealed world of precise types and total functions where the compiler carries the argument. The edge is an open world of tables, languages, networks, and search where new rules and routes arrive without editing anything. They never touch directly. Between them sits a single narrow band — the membrane — and everything the open edge produces enters the closed core only by passing through it. That band is one routine, and it is where the book's whole thesis is leaning.

15.2 Two Worlds, Recalled

The core we built in Part II. An Order is a sealed sum of Draft, Placed, and Shipped (Chapter 3); its transitions are total functions whose argument types forbid the illegal ones (Chapter 5); a Quantity cannot be non-positive and a placed order cannot be malformed, because their invariants forbid it. Nothing untrusted reaches this world, because the boundary parses it away first (Chapter 4), and nothing effectful happens inside it, because effects are returned as data for the shell to perform (Chapter 6). It is the part of the system we are least afraid of.

The edge we built in Parts IV and V. Pricing is a table of handlers and a small language of rules-as-data, open to any new promotion (Chapters 9–10); a quote can converge from many partial sources through a propagator network (Chapter 12); fulfillment finds a warehouse and carrier by unifying the order against an open set of route patterns and searching (Chapter 13). No part of this is sealed, and none of it can be, because the whole point of the edge is to grow in directions no one has enumerated.

One important reconciliation belongs here. In Chapter 3, a placed order's invariant was the simplest true thing — its total equalled the sum of its lines — because pricing did not yet exist. Now that the open edge computes discounted quotes, that invariant becomes the membrane's: a placed order's total is a quote the core admitted — in the right currency, non-negative, above the floor. The simplification was a scaffold; the capstone replaces it with the real thing. The core is still sealed; its invariant now names what a legitimate price is, rather than assuming there is only one.

15.3 The Membrane, Made Concrete

Here is the seam the entire book has pointed at — the one routine through which every price, from every rule that will ever exist, must pass to become part of an order. It is written from the core's side. It does not know or ask how the quote was computed; it states the terms and admits only what meets them.

-- The membrane: the open edge proposes a quote; the closed core admits it, or not.
function admit_quote(draft: Draft, quote: Money): Result[Placed, String]
  require
    same_currency: quote.currency = draft.currency
  do
    if quote < Money.zero then
      result := create Err[Placed, String].make("quote is negative")
    elseif quote < draft.floor_price then
      result := create Err[Placed, String].make("quote below floor")
    else
      -- on success, Placed's own invariant guarantees a consistent order
      result := create Ok[Placed, String].make(create Placed.make(draft.items, quote))
    end
  end

Read what this one function does for the whole system. On its open side, anything at all may have produced quote — a percentage rule, a loyalty tier, a propagator network settling three services' worth of partial knowledge, a promotion invented next quarter by someone who never saw this code. On its closed side, a Placed emerges that the core's invariants fully trust. The transformation from "some number the edge computed" to "a price the core believes" happens here and nowhere else. Delete every pricing rule and write new ones; this routine does not change. That is what a membrane is: the fixed contract that lets both sides vary independently.

15.4 One Order, End to End

Now the whole placement, as one pure function that threads the request through every region. Each line is a chapter; the comments name them.

function place_order(request: Order_Request, rule: Price_Expr,
                     routes: Array[Term], now: Instant): Result[Placement, String]
  do
    match parse_order(request) of                       -- 1. boundary: parse (Ch 4)
      when Err as bad then
        result := create Err[Placement, String].make(bad.error)
      when Ok as parsed then
        let draft: Draft := parsed.value
        let quote: Money := rule.eval_for(draft)        -- 2. open edge: price it (Ch 10)
        match admit_quote(draft, quote) of              -- 3. membrane: admit it (Ch 2, 9)
          when Err as rejected then
            result := create Err[Placement, String].make(rejected.error)
          when Ok as ok then
            result := plan_fulfillment(ok.value, routes, now)   -- 4. core decides (Ch 5,6,13)
        end
    end
  end

function plan_fulfillment(placed: Placed, routes: Array[Term],
                          now: Instant): Result[Placement, String]
  do
    match route(order_term(placed), routes) of          -- 4a. routing by search (Ch 13)
      when Err as e then
        result := create Err[Placement, String].make("unfulfillable: " + e.error)
      when Ok as sol then
        let fx: Array[Effect] := []                     -- 4b. effects as data (Ch 6)
        fx.add(create Charge_Payment.make(placed.total))
        fx.add(create Reserve_Stock.make(warehouse_of(sol.value), placed.items))
        fx.add(create Send_Confirmation.make(placed.customer_email))
        fx.add(create Record_Order.make(placed))
        result := create Ok[Placement, String].make(create Placement.make(placed, fx))
    end
  end

Trace one order through it. An untrusted request enters and is parsed into a Draft or rejected — the last place distrust is allowed. The Draft is priced by an open-ended rule, producing a number the core has not vouched for. That number meets the membrane, which admits it as a Placed only on the core's terms. The Placed is routed by search to a warehouse and carrier, and the core decides what must happen — charge, reserve, confirm, record — and returns those as data. Not one effect has fired; place_order is pure, testable by inspecting its result, deterministic given now. The whole span from constraint to flexibility and back is one readable function, and every technique in the book appears in it exactly once, exactly where it belongs.

The shell finishes the story. It calls place_order, takes the returned effects, and performs them against the real world — wrapped in the layers of Chapter 8, so logging, metrics, and idempotency surround the placement without touching it. The impure part stays thin, mechanical, and outermost; the interesting part stays pure and within.

15.5 Both Disciplines, One Codebase

Look at what did not happen. The open pricing edge did not force a single compromise on the core's types — no field went nullable, no state went unsealed, no invariant weakened to accommodate a rule the core could not foresee. And the sealed core did not cost the edge any of its openness — a new promotion is still a new rule in a table, a new route still a new pattern, added without reopening anything. The two disciplines that Chapter 1 said pull in opposite directions are both here, each fully itself, and they do not fight — because they never meet except through the membrane, and the membrane is a contract that asks nothing of either side but that it keep its promise.

That is the resolution the book set out to earn. Constraint and flexibility are not a spectrum you pick a point on, nor rivals you choose between. They are two tools for two different jobs, and a real system needs both at once: a core that must be correct, an edge that must be free to grow, and — this is the whole of it — a contract on the seam between them, so that the correctness of the one and the freedom of the other are held apart and held together at the same time.

15.6 The Last Word

Software gets hard two ways: you model it wrong, or you build it so you cannot change it. The whole of this book has been a single answer to both at once. Fight the first with constraint, where the domain is knowable — make the illegal unrepresentable, parse at the boundary, keep the core pure, let the compiler carry the argument. Fight the second with flexibility, where the domain must grow — open the vocabulary, make rules into data, let the network settle and the search run. And wherever the two regions meet, put a contract, so the tightened core can accept work from the opened edge without either becoming the other.

You will not always draw the line in the same place; the signs shift, the business changes, and a seam that wanted sealing last year may want opening now. But you will always be drawing the same kind of line — deciding, for the decision in front of you, how much the types should say and where the contract takes over. Do that well, seam by seam, and you get the thing this book was named for and built toward: software that is correct where it must be and flexible where it must be, in one codebase, without contradiction. A tight core. An open edge. And a contract holding the two in a single, consistent whole.