This is all hypothetical (in Rust), because there's no implementation. However, I would think that per-module enabling would be sticky, disregarding any call/us

This is all hypothetical (in Rust), because there's no implementation. However, I would think that per-module enabling would be sticky, disregarding any call/use-sites: a module defining a hash function would say that overflow is OK/expected, and it would be incorrect for someone else to externally decide it is an error. (This also seems to be the only thing that is consistent: what if it is used from two modules with different options?)