Removes an unreachable Sensitive-object check after primitive-string validation and moves compile-only assertions into the existing type-contract fixture. Preserves privacy boundaries, timing observations, and the public API. Reviewed in #16; exact main CI passed before publication.