Merge pull request #523 from ia0/unsafe

Clarify when safety may rely on correctness