If your program can have only two legal states, what sense does it make to extend a Boolean type with a third data constructor to account for the possibility of an “illegal program state”? Use a coproduct type with a Boolean type on the right instead. Make illegal program states irrepresentable in your types. I’m baffled by folks that insist on having their three-valued Boolean type.