= Solution
<Protected access> makes `size` available to subclasses implementing the set operations, while preventing ordinary outside clients from assigning arbitrary values to it. The implementations need to update the count when membership changes; clients should affect membership only through the public operations. A publicly writable count could make an emptiness query disagree with the stored elements.
\b[Protection supports <encapsulation> but does not prove the <representation invariant>.] Subclasses can still update the field incorrectly and must maintain its relationship to the actual set <cardinality>. In particular, subclass code does not obtain unrestricted access to the protected field of every unrelated set <software object>.
Back to article page
