Always-Valid Domain Model