.. another safety net: module-local instance could be defined only for module-local (non-exported) types. Would this not offer what you are looking for, without breaking instance consistency?