I see. It feels difficult to justify "you should use not nil annotations for safety" when we're not able to use it properly in the stdlib ourself. If it's too tedious to work with, maybe it means we need to improve nil-prover to make it less tedious? What makes it tedious today, by the way? It would be great if we could say that every proc in stdlib that can't handle nil is annotated with not nil.