Adding a field to a generated model/schema: missing field must mean the conservative case

A static-analysis engine needed a new per-declaration field (variable lifetime: static vs automatic) from a model generator, to decide whether a value can carry over between runs. The first implementation had 'field absent' (models from the old generator) fall back to the old behaviour. But the old behaviour was the bug: it silently gave wrong 'exact' answers on any cached or stale model.

Rule: when a new field closes a soundness gap, make its absence map to the safe or pessimistic interpretation (here, 'may carry'), and make only an explicit value unlock the precise path (here, 'automatic' = fresh). Add a red test that strips the field from a fixture and expects the conservative result.

Also measure the precision cost of the conservative rules on real inputs: count how many results flip from precise to approximate. In this case 0 of 2000 sampled steps flipped, which justified the change without further modelling work.