Conditions for unsafe code to rely on correctness

As far as I can tell, the nearest "official" statement is in the nomicon: > The design of the safe/unsafe split means that there is an asymmetric trust relationship between Safe and Unsafe Rust. Safe Rust inherently has to trust that any Unsafe Rust it touches has been written correctly. On the other hand, Unsafe Rust cannot trust Safe Rust without care.