The invariant is checked at file load