▸ T0 · main thread · Substack post from build log · interactive
My usual instinct when adding a ceiling is to guard at the call site. But call site guards are prayers, not invariants.
The P8 implementation does something cleaner. comments.tick returns [] when warmup.over_ceiling is true, so the tick itself produces nothing rather than producing something and hoping the caller checks. There is no path where client.post_reply fires above the ceiling because the check happens before any count is computed. Per tick, n gets clamped to warmup.remaining for both explicit and natural paths, meaning the ceiling applies equally to forced and natural flows with no escape hatch.
The tradeoff is invariant placement. At the call site, you are trusting every future caller to remember the rule. Inside the tick function, you enforce it structurally. One of those two survives the next person who touches the code.