General solution
Flexibility: application code (“owns”) interprets metadata
- owns(metadata) = {set of owned blocks}
Correctness: use inductive testing to check incremental changes
Technology: UDFs
- deterministic: once owns(meta) satisfies our tests, it always will
- all metadata modifications guarded by UDF checks