Language vision regarding safety guarantees

ia0:

They may decide to use Box and Vec in unsafe code (thus use/trust the safety contract of those APIs), but use BTreeMap in safe code only (thus its logic contract), since a dependency of safe code being incorrect is not that bad, it can't cause undefined behavior.

That's perfectly fine, that matches what I'm saying. You are free not to trust BTreeMap enough to use it for soundness purposes, so just don't use it for soundness purposes. You can do that today, no need to change anything in std. There is no need for BTreeMap's interface or documentation to say anything about this. You can already not use it if you don't want to trust it.

BTW, you seem to be confusing "using BTreeMap in your own unsafe code" vs "using unsafe APIs of BTreeMap". These are two separate choices. It's possible to use safe BTreeMap APIs in your own unsafe code.

But either way, you are already free to have any policy you want regarding whether you use BTreeMap for unsafe purposes in your own code. There is no need to change anything in BTreeMap to enable that.