[UltraSane]

C's memory model requires shared invisible invariants that can't be encoded in the type system or signatures. This makes C code incredibly fragile.