some invariants might be hard to guess, eg. that shrink must only return strictly smaller elements. cc @bobot .
