Once each layer is hardened, we do not need to inspect every line. We can run the code through Dafny or other proof assistants and prove that the long program satisfies a small, manageable set of invariants.