Well I got into an interesting discussion today.

If the API of some library has some pre-conditions, where failure to meet the pre-conditions causes the library to Not Work (but doesn't cause UB), and those pre-conditions cannot be checked by the type system, or at run-time, but are in fact properties of a wider system that Rust cannot see, should the API be unsafe or not?

I recall Oreste Bernardi having similar questions (where it was posed as "Should a function which can program the voltage regulator in a way that can set the machine on fire be `unsafe`", or similar).

Did we ever get to a consensus on that?