Tiny quibble: it isn’t entirely “nowhere” because 40.0 is a float64 constant. More, your Go answer isn’t quite right: it should be limit := uint(... — it’s unsigned int in the C code.

Those quibbles only emphasize your point that the C/C++ arithmetic promotion rules (and its type promotion rules in general) are extremely hard to reason about.

It is not the language’s fault — as a profession, we actually had to make all these mistakes in writing C before we understood the problem even existed.

Careful discipline and yes, some extra typing, can pretty well mitigate the issue, but you need to have actually made such mistakes multiple times before you understand what the fuss is — as you say, in a new language, you shouldn’t allow this to happen in the first place.