Extending Module Interfaces without Invalidating Clients