I believe you said > any nontrivial program will have unsafe somewhere, and unsafe can cause failures arbitrarily far away from the incorrect code But the poi

I believe you said > any nontrivial program will have unsafe somewhere, and unsafe can cause failures arbitrarily far away from the incorrect code But the point I was trying to make is that this claim is facially true but misses the critical context: in idiomatic Rust, the unsafe keyword is not the barrier that enforces integrity of the system. The integrity of the system is enforced by the type checker, the same way it always is. The unsafe annotation alerts the reader that there exists an invariant the compiler can't check. Idiomatic code will have a SAFETY comment above describing the invariant. It should be locally possible to reason about how the type abstraction used to encapaulate truly enforces that invariant. This is what Rust people are talking about when we say wrap unsafe code in a safe abstraction. If we do it right, it's no longer possible for spooky action at a distance. Now you might go and point out the fallibility of humans and all that, and you'd be right, but that's in fact what makes it so valuable to try.