Invariants

• A balance is never negative. A claim about one row, checked against a value in the same row. Cheap to enforce in storage, and the concurrency question is the whole difficulty (Shared-State Coupling).
• A username identifies exactly one account. A claim across all rows of a table. Only enforceable where all rows are visible at once, which in practice means a unique index — application code cannot do this correctly under concurrency, ever (Concurrency & Parallelism shows the same shape as a race).
• An order is never shipped before it is paid. A claim about the *ordering of two state changes* in different aggregates. Not expressible as a constraint on a row; needs a state machine and a guard (State Machines).
• A tenant's data is never returned to another tenant. A claim about every read, not every write — which makes it the odd one out and the reason it is so often missed (Trust Boundaries).
• The balance equals the sum of the ledger. A claim relating two representations of the same fact, which is a consistency boundary and forces them into one transaction, or forces you to accept a window and reconcile (Consistency Boundaries).

1// ── A belief ────────────────────────────────────────────────
2async function debit(walletId: string, amount: number) {
3  const w = await db.wallets.find(walletId)
4  if (w.balance < amount) throw new InsufficientFunds()   // correct!
5  await db.wallets.update(walletId, { balance: w.balance - amount })
6}
7// Correct on this path. Silent about: the renewal job, the admin
8// tool, the migration, and two requests arriving together.
9 
10// ── A property ──────────────────────────────────────────────
11-- migration: the rule, where every writer passes through it
12ALTER TABLE wallets ADD CONSTRAINT balance_non_negative
13  CHECK (balance >= 0);
14 
15-- and the atomicity, in one statement rather than three steps
16UPDATE wallets SET balance = balance - $2
17 WHERE id = $1 AND balance >= $2
18RETURNING balance;
19-- 0 rows affected == insufficient funds. No read-check-write gap.
20 
21// The application check stays — for the error message. It is now
22// a convenience, and the code should say so.

The RETURNING line is doing the work that the application-level if only appeared to do: the decision and the write are one operation, so there is no window between them. The constraint is the belt — it covers the admin tool and the migration, which the conditional update does not. Neither alone is the answer, and choosing between them is Where Invariants Live.