Liskov Substitution, Critically

1void stretch(Rectangle r) {
2    r.setWidth(r.getWidth() * 2);
3    assert r.getHeight() == before;   // never written down, always assumed
4}
5 
6class Square extends Rectangle {
7    @Override void setWidth(int w)  { super.setWidth(w); super.setHeight(w); }
8    @Override void setHeight(int h) { super.setWidth(h); super.setHeight(h); }
9}
10// stretch(new Square(4)) -> height doubled too. Compiles. Ships.
11 
12// The same hierarchy, immutable:
13record Rect(int w, int h) { Rect withWidth(int w) { return new Rect(w, h); } }
14// A Square is now just a Rect where w == h. No override, no violation,
15// nothing to substitute wrongly. The setter was the problem.

Two things worth taking from this and nothing else. First, the violated promise — "setting width leaves height alone" — appears in no signature, no test and no comment, which is the normal state of affairs. Second, mutability created the violation: a design with no setters has no way to express it.

interface UserRepository {
  findById(id: UserId): Promise<User | null>   // no stated contract
}

class CachingUserRepository implements UserRepository {
  async findById(id: UserId) {
    const hit = this.cache.get(id)
    if (hit) return hit                        // up to 60s stale
    ...
  }
}

// Twenty call sites unchanged. Nineteen tolerate staleness.
// The one that renders "your email has been updated to X"
// does not, and there is nothing in the type, the name or
// the tests that distinguishes it.

interface UserRepository {
  /** May be up to `maxStalenessMs` behind the last write.
   *  Never returns a user that never existed. Never throws
   *  for an unknown id — returns null. */
  readonly maxStalenessMs: number
  findById(id: UserId): Promise<User | null>

  /** Bypasses any cache. Use after a write you must reflect. */
  findByIdFresh(id: UserId): Promise<User | null>
}

// Now the confirmation screen calls findByIdFresh, and the
// contract suite has a test for both promises that every
// implementation — including the in-memory fake — must pass.

The right-hand version does not make caching illegal; it makes the weakened promise part of the contract, so the nineteen callers that tolerate staleness keep their performance win and the one that cannot opts out explicitly. The essential move is that the difference between implementations became something a caller can see and a test can check, instead of something a support ticket discovers. Note the direction of the fix: when an implementation cannot keep a promise, the honest options are to weaken the promise for everyone or to give that implementation a different type — never to let one implementation quietly differ (Eventual Consistency in Practice carries the distributed version of this argument).

• Problem it addresses — a caller holding an abstraction cannot reason about behaviour if implementations differ in ways the type does not express, which turns polymorphism from a simplification into a source of remote, hard-to-trace defects.
• Useful example — the caching repository above: a real operational improvement that silently withdrew a promise nineteen callers did not need and one did.
• Misuse — reducing it to Square/Rectangle and concluding "inheritance is bad", which is neither what it says nor a useful design rule (When Inheritance Fits).
• Trade-off — an explicit contract plus a shared suite is real, unglamorous, feature-less work, and it constrains implementations that would otherwise be useful.
• Counterexample — a sealed hierarchy where the "subtypes" are just data variants matched exhaustively, or an interface with exactly one implementation and one test double that is generated from it. There is nothing to substitute and the contract discipline buys nothing (Making Illegal States Unrepresentable).