Safe C++ Extensions proposal