Make illegal states unrepresentable, until you have to explain them

I've hit the same requirement on anything a non-developer edits, where a validator that stops at the first fault gets exactly the reception you'd expect. The rule I'd add to the split is about its own discipline: you note that nothing downstream of validate() runs on an Invalid result, and that constraint lives in prose rather than in the types, so it's the one a later change breaks first. If it can be a lint rule or an architectural test it holds, in my experience a written convention alone doesn't. I argue the stricter version of the type-level side here, with less room than you allow for the reportable case: https://prickles.org/tenet/domain-driven-types/T1