I wrote some very rough, brain-dumpy, incomplete notes on safe reachability for a notion of legal unsafe code.
The rough idea is that unsafe code can do what it likes to the heap which isn’t reachable by safe code, but it should maintain the Rust memory safety invariants in the safely reachable subset of the heap.