# No invalid instance can exist

The distance between a `validate()` method and what an interviewer is scoring is one call somebody
has to remember.

Take `remaining` on a rate limiter's answer: how many requests a caller has left. A
check-then-charge with no lock across it means one thread checks at 97 used and charges at 103, so
`limit - used` is -3. In `contrast/a/`, where each consumer checks what it reads, that -3 travels
seven calls and nothing notices. The customer gets a `200`, a header reading
`X-RateLimit-Remaining: -3`, and `103% of quota used`. No exception, no alert, no failing test.

Move the same rule into `Decision`'s compact constructor and the identical bug throws after two
calls, with `remaining cannot be negative, got -3`. The top frame is the type that owns the rule.

That is not a hypothesis. `corpus/rate-limiter/reference/DECISION_LOG.md` records it. While a stress
suite was being proved against a broken variant, several failures arrived as `Decision`'s own
compact constructor throwing that message. Nobody had written a test for it.

The message is part of the invariant. `IllegalArgumentException: -3` names neither the field nor
the value, and you read it at 1am.

Some invariants need no `if`. `Algorithm.FIXED_WINDO` is a build failure reading
`cannot find symbol`, where `"fixed_windo"` is a perfectly good `String`. That is placement by type,
and the compiler does it for nothing.

Refuse rather than repair. `contrast/b-normalising/` clamps the -3 to zero, detects nothing, and
costs 8 lines more than having no invariant at all.
