honest-state

Someone installs a state manager. Now the cart total lives in the store, and the logged-in user lives in the store, and the draft form text lives in the store, and a persisted order lives in the store — all of it "the state," all of it changeable from anywhere. Six months later no one can say how the total reached the number on the screen, because six unrelated pieces of code are allowed to set it. The number of states the program can reach has quietly grown past what any person can hold in their head, which is precisely what makes it impossible to check.

honest-state is the smallest module in the framework, and it exists to say two things and enforce them.

There is no "the state"

There are many *kinds* of state, and each kind deserves its own store and its own handling. Individual-user state lives in the DOM. Login and session state, which every instance in a scaled deployment must see, lives in a shared store. Persisted domain state lives in the database. Conflating these — the mistake every general-purpose state manager makes — is the disease, not the cure. honest-state names each kind, its store, and its mutator, as a table. It ships no store of its own; the mechanics live in each kind's home module.

Every declared piece of state has exactly one mutator

Freely changeable state is the enemy: when anything can change a value from anywhere, the reachable states explode. So the law is one mutator per declared piece of state: one place allowed to change it, one place to look. The unit of ownership is the *declared* piece, not the physical store: a declaration (the DATAOS manifest, say) carves one store into owned regions, so two writers can share a store as long as each owns a disjoint region and hides nothing. Share the store; keep the writer singular.

Why the single mutator is a poka-yoke

"How did this value get into this state?" is unanswerable exactly when more than one piece of code can set it. Constrain each declared piece of state to a single mutator and the question always has one place to look, and the set of changes stays small enough to enumerate. honest-check enforces the count. This is not a rule bolted onto the framework — it is the spine the DOM-as-single-store, the ordinary boundary write, and the closure and global-read rules are each a part of.