Always-valid domain model

The stance that an object should enforce its invariants at construction and at every mutation, so an instance in a bad state cannot exist. It removes defensive checking everywhere downstream and makes an invalid state a construction-time error rather than a runtime discovery. The usual objection is form validation, where you need to collect several errors at once rather than fail on the first — which is an argument for validating input separately, not for letting the model be invalid.