This was found via a Coverity static analysis pass. There's no
indication this was being used incorrectly in practice, but there are
public interfaces which require `BR` to be non-null and valid, and `BR`
was not being initialized by the constructor.
This adds an in-class initializer for `BR` and some asserts, to be safe.