This will avoid a class of correctness bugs and makes behavior much easier to reason about. We can always lift this limitation later, but for an initial release, it seems reasonable (with good error messages).