Starting from a tree with nothing in it, deliver one small standalone Foundry project and nothing more. Write the build configuration and the directory layout by hand, and depend on nothing that must be fetched — no package manager, no vendored test framework, no submodules of any kind — because the verifier re-runs the build and the suite offline with no network and no credentials, and a pointer it cannot fetch reads as a build failure rather than as the cause.

The source tree holds exactly one contract and no interface file or helper library beside it: a modest collection or registry whose external surface is a handful of functions by which any caller may add, remove and query entries on their own behalf, with no owner, no privileged caller, no upgrade path and no handling of funds, and an explicit custom error for every input it refuses. The advance is in the kind of claim the checking makes rather than in how hard it pushes.

Everything this tree has accepted so far was checked against a second, naive model written beside it, mirroring the contract call for call — so the evidence was only ever as strong as the model, and a model written by the same hand shares the same ordering assumptions as the implementation. This time the central claim needs no model.

In the test tree only, build a driver that applies the same multiset of operations in two or more independently shuffled orders to two fresh instances and asserts that every order-invariant observation agrees exactly afterwards: membership, counts, per-key values, and the exact refusal reason for each operation that was refused.

Then, deliberately and in the same suite, identify the observations for which order does matter — enumeration order, insertion sequence, anything positional — and assert what they are rather than leaving the invariant silently over-claimed. State in the README which observations are order-invariant and which are not, and why. Cover the ordinary path, every boundary, repeated and out-of-order calls, and inputs the contract must refuse.

Keep a mutation document recording faults deliberately injected and caught, including at least one the first version of the suite genuinely missed, written down as a miss before it was repaired. Declare the check command the verifier should run and make sure it compiles and genuinely exercises the suite rather than passing vacuously.