Private unsafe fields are a poorly motivated feature

tczajka:

Or should val be an unsafe field here, even though the module doesn't use it for memory safety?

As author of the module, you choose the safety invariant of the type. If "not zero" is part of the safety invariant, then the field should be unsafe. If it is just a "logic invariant" (like Ord contract), then it should not.