This should be made structurally impossible through type safety rather relying on code review.