simplexmq/spec/security-invariants.md

Security Invariants

Every security invariant with enforcement and test coverage.

Format

### SI-XX: [Name]
**Statement**: [Precise invariant]
**Threat**: [What attack this prevents]
**Actors**: [Which threat model actors are relevant]
**Enforced by**: [Qualified function names] — [how]
**Tested by**: [test module.function] or [MISSING TEST]
**Product rule**: PR-XX

Invariants