Each function should have on average, at least two assertions that cannot be checked statically, and the calling code must try to recover from the failure.

So much for writing code that doesn’t suffer from the halting problem, or that has high branch coverage!