Is it correct to say that that requirement extends to "Composite Values", like structs, that have invariants that must be maintained between the fields? For example, say a struct that represents a date that has 3 fields for year, month, and date where the invariants are that it always represent a valid date. By invariants, I mean that other code, including "unsafe", should be able to depend upon it representing a valid date. So, any code, when updating such a struct, must do so in a way that prevents any other code, including concurrent threads, from seeing an invalid "value"? If "unsafe" code were updating the private fields, it would have to ensure that at the end of the function AND BEFORE CALLING ANY OTHER FUNCTION THAT TAKES THE COMPOSITE VALUE AS AN INPUT, that the invariants were met? Is that correct? Or is that taking the requirement too far?