 invariants, e.g. about their data, resource
ownership, or protocol states. In Rust, broken invariants cannot produce
segfaults, but they can still lead to wrong answers.</p>

<h3 id='provide-library-level-guarantees-whenever-practical-fixme-needs-rfc' class='section-header'><a href='#provide-library-level-guarantees-whenever-practical-fixme-needs-rfc'>Provide library-level guarantees whenever practical. <strong>[FIXME: needs RFC]</strong></a></h3>
<p>Library-level invariants should be turned into guarantee