One boolean answering two questions

The platform had a column on the workspace table called is_demo. It had picked up two meanings, and for years nothing revealed that they were two.

The first meaning was the data here is disposable — checked before an automated run was allowed to write anything, so that a test could never create and delete records inside somebody's real workspace.

The second was do not touch the outside world — enforced over every function that sends an email, a text message, a webhook or a legally binding electronic invoice, and the reason a demo workspace withholds its outbound integrations.

For a workspace shown to prospects, both are true at once, so the overload never showed. It showed the day I needed a bench: a workspace inside the production database that end-to-end runs could be driven against, because a run on a laptop proves the code and not the deployment.

The bench needs opposite answers

It exists precisely to be written to and thrown away — the first meaning, true. And the set of behaviours it could not prove was exactly the set the second meaning blocks: outbound mail, messaging, webhook dispatch, invoice transmission. Everything I most needed evidence for.

The obvious fix would have unblocked ten surfaces and, in the same statement, broken every test that had already earned its label.

Clearing the flag was one UPDATE. It would also have made the workspace resolver refuse the bench, because that resolver reads the same column to decide what may be written to — so every process test that had earned a maturity label would have stopped being re-runnable. One statement, one surface unblocked, all the evidence invalidated.

So it is a split, not an update

The migration separated the column into is_disposable and is_demo, and then set them independently: the prospect-facing workspace keeps both, the real one has neither, the bench is disposable and not a demo. Two questions, two columns, and each guard now reads the one it actually meant.

The general shape is worth more than the instance. A boolean that has quietly accumulated a second meaning is invisible while every case agrees, and the case that disagrees is usually the one you built on purpose to test something. When a flag starts gating behaviour that has nothing to do with its name, that is not a naming problem to be fixed with a rename. It is two columns wearing one hat.

One postscript, because it cost more than the migration did. A branch that had forked before this landed rewrote the surrounding documentation wholesale and merged cleanly, so for ninety minutes the written record described the old, safer-sounding arrangement while the schema had already moved. A merge that resolves without conflict is not a merge that kept what the other branch said — and the half that survived was the false one.