should be able to look at a function in isolation and prove it won't
panic. if that's not possible, should cast safely.