Design by Contract & Invariants

public final class BankAccount {
    private long balanceCents;
 
    public BankAccount(long openingBalanceCents) {
        // PRECONDITION check (caller's promise)
        if (openingBalanceCents < 0) {
            throw new IllegalArgumentException("Opening balance cannot be negative");
        }
        this.balanceCents = openingBalanceCents;
        assertInvariant();
    }
 
    public void withdraw(long amountCents) {
        // PRECONDITION: caller must request a positive amount they can afford
        if (amountCents <= 0) {
            throw new IllegalArgumentException("Withdrawal amount must be positive");
        }
        if (amountCents > balanceCents) {
            throw new InsufficientFundsException(amountCents, balanceCents);
        }
 
        long before = balanceCents;
        balanceCents -= amountCents;
 
        // POSTCONDITION: this method's own promise about its effect
        assert balanceCents == before - amountCents : "withdraw postcondition violated";
        assertInvariant();
    }
 
    // INVARIANT: must hold before and after every public method call
    private void assertInvariant() {
        assert balanceCents >= 0 : "balance invariant violated: " + balanceCents;
    }
}

// Boundary: full validation — this is untrusted external input
@PostMapping("/accounts/{id}/withdraw")
public ResponseEntity<?> withdraw(@PathVariable String id, @RequestBody WithdrawRequest req) {
    if (req.amountCents() <= 0) {
        return ResponseEntity.badRequest().body("amount must be positive");
    }
    accountService.withdraw(new AccountId(id), req.amountCents());
    return ResponseEntity.ok().build();
}
 
// Internal: trusts that the boundary already validated. No redundant re-checking
// of "is amountCents positive" three layers deep — that would be noise.
class AccountService {
    void withdraw(AccountId id, long amountCents) {
        Account account = repository.find(id);
        account.withdraw(amountCents); // Account's own precondition check is the real safety net
    }
}

// Optional: forces the CALLER to explicitly decide how to handle absence
interface CustomerRepository {
    Optional<Customer> findById(CustomerId id);
}
 
Optional<Customer> customer = repository.findById(id);
String name = customer.map(Customer::name).orElse("Unknown Customer"); // handled explicitly
 
// Null Object: the CALLEE returns a real, harmless instance —
// callers don't need to branch on absence at all, because "absence"
// behaves like a valid, inert case of the same interface.
interface Logger {
    void log(String message);
}
 
class NoOpLogger implements Logger {
    public void log(String message) { /* intentionally does nothing */ }
}
 
class Service {
    private final Logger logger; // never null — defaults to NoOpLogger
    Service(Logger logger) { this.logger = logger != null ? logger : new NoOpLogger(); }
    void doWork() {
        logger.log("working"); // no null-check needed anywhere, ever
    }
}

public final class DateRange {
    private final LocalDate start;
    private final LocalDate end;
 
    public DateRange(LocalDate start, LocalDate end) {
        if (start.isAfter(end)) {
            throw new IllegalArgumentException("start must not be after end");
        }
        this.start = start;
        this.end = end;
        // invariant (start <= end) is now guaranteed FOREVER —
        // there is no setter that could ever violate it later.
    }
 
    public boolean overlaps(DateRange other) {
        return !start.isAfter(other.end) && !other.start.isAfter(end);
    }
}