I'm with you on this one.

• Each class should unit test it's own behaviour against it's desgn spec./ contract.

  The example you cited of changing functionality (123,456 => 12,3456) is a re-specification of the design or contract and probably shouldn't be done, or at very least, would require a very clear notation in the upgrade documentation.

  It would almost certainly be best if any such change to the published API would be handled by adding a new method rather than altering the behaviour of the existing one. Alternatively, making the changed behaviour selectable via a configuration or instanciation parameter may be acceptable.

• User's of a class should test their own behaviour and trust the design spec./ contract.

  To do otherwise is to invalidate the whole purpose of the contract. The essence of which is that a module/class/library contracts to return a given set of outputs when provided with a specified range of inputs.

It would also logically lead to a maze of dark twisty tests, where every module would start testing that substr counted from 0 not 1 and that * really knew how to multipy two numbers. Then, what about the CPU? I mean, there was that early pentium math bug, maybe we should all be testing that our math co-processors aren't similarly effected:)