Language vision regarding safety guarantees

alice:

Of course, there's also another way in which it's not wrong: When we fixed the bug, the unsafe code did not change. If it did not change and is now correct, it must have been correct all along?

I’d say that there is a narrow, pedantic sense in which the unsafe code should change, when viewed at package granularity: its dependency on the library with the bug should be changed to require the fixed version as the minimum version.