primitive consistency checking to reject bad updates; all tests now pass :D