“If the design, or some central part of it, does not map to the domain model, that model is of little value, and the correctness of the software is suspect.”