* Short term: add explicit runtime checks for every step that may panic. With the way jump prediction works in modern processors, the runtime cost may be smaller than one may naively assume it is. Some of us would take, say, a 10% perf. degradation instead of chasing prod panics in the middle of the night.
* Long term: plug-in a richer type (logic) system, so one can safely prove the most costly runtime invariants at compile time.
