Safe by construction
Values have one owner. Borrows follow the one-writer-or-many-readers rule, checked at compile time with almost no annotations. Overflow, bounds and allocation failure are checked in every build.
Ownership and borrowing with C#-style syntax, deterministic destruction, explicit allocation, and readable C11 that runs anywhere C runs, including inside an operating system kernel.