I completely agree. The contract of calling any safe function is that it is impossible to cause undefined behavior by calling that function (assuming there are

I completely agree. The contract of calling any safe function is that it is impossible to cause undefined behavior by calling that function (assuming there are no unsoundness bugs). That is the inherent built-in contract in any piece of Rust code.