Language vision regarding safety guarantees

dlight:

I think it's best to ignore the logic thing and suppose that, even though currently it does not actually trigger UB, in the future, new semver-compatible versions of this API hold the right to trigger UB "as promised". So the API is allowed to trigger UB when misused (and allowed to do anything else, including having a safe logic bug), but not required to do so at any given moment.

This is UB (library UB). It's the same situation as for builtin (language) UB: language UB is not required to do anything particularly bad but it is allowed to do anything it wants. Same thing for library UB. Being allowed (but not required) to do arbitrary bad things is the very definition of UB.