aggregates enforce domain invariants

The domain can never have an invalid state change.