[R6RS] Safe/unsafe mode

[dyb at cs.indiana.edu]

Will,

As I understand your semantics, all bets are off if safe code nested
within unsafe code is run from the unsafe code, so that:

  (define (f)
    (declare unsafe)
    (let ([g (lambda (x)
               (declare safe)
               (car x))])
      (g 'a)))

does not necessarily raise an exception.  Must the following code
raise an exception, assuming there are no declarations other than
the ones shown?

  (define (f)
    (declare unsafe)
    (let ([g (lambda (x)
               (declare safe)
               (car x))])
      g))

  (let ([g (f)]) (g 'a))

If not, is there any other case where safe code nested within unsafe code
must raise an exception?  If not, can the phrase:

  excepting nested bodies that contain a safe or (safe n) declaration,
  where n > 0, at their head

be struck from your definition of unsafe code in both places where it
appears?

Kent