Verifying the invariant

Motivation

"This class enforces its invariant" is a claim until we verify it. Tests validate invariants directly, covering expected and unexpected behaviours. Tests document invariants as checkable contracts, supporting trust now and evolvability later, when the implementation changes but the contract should not. Testability serves as a feedback loop into prior design choices.