Every value is used exactly once. Open a file — you must close it. Allocate memory — you must free it. No garbage collector needed; the compiler tracks usage statically.

No function can touch the filesystem, network, or hardware without an explicit, unforgeable token in its signature. A function with no capability arguments is provably pure.

Array and buffer sizes are part of the type, not a runtime check. If the compiler can't prove an operation stays in bounds, it rejects the program before anything runs.

Every function declares the exhaustive set of ways it can fail, and the compiler forces every caller to handle every declared case. No silent errors, ever.

One canonical AST with readable views generated from it. Dedicated symbols mean exactly one thing, always — reducing model ambiguity. See the lenses example below.