Private unsafe fields are a poorly motivated feature

ia0:

Not "confident", but otherwise yes.

If you're equally confident about both guarantees, why bother stating a separate weaker guarantee at all? Why not call the regular behavior of NonZero "robust"? It's easier to deal with one specification than with two specifications.