anchor.diff:  
   toc::[]
   
  +== Preface: On undefined behavior and operations
  +
  +The C++11 standard defines undefined behavior as
  +
  +[quote]
  +behavior for which this International Standard imposes no requirements +
  +[ __Note__: Undefined behavior may be expected when this International Standard
  +omits any explicit definition of behavior or when a program uses an erroneous
  +construct or erroneous data. [...] -- end note ]
  +
  +And furthermore it says with regards to the execution of programs containing
  +undefined operations:
  +
  +[quote]
  +[This] International Standard places no requirement on the implementation
  +executing that program [...] (not even with regard to operations preceding the
  +first undefined operation).
  +
  +Hence, the behavior of programs that execute undefined operations at any point
  +is undefined at every point.
  +
  +One of the goals of rust is to ensure programmatically that, if a piece of code
  +compiles, then it contains no undefined operations. But since there are many
  +valid programs for which the compiler is unable to verify this, rust contains
  +the `unsafe` keyword.
  +
   == What `unsafe` is
   
   This section discusses the `unsafe` keyword in the following two contexts:
  
positive.code: 
  === `unsafe` as a block delimiter
  
  In ordinary lrs code, the compiler is tasked to ensure that the execution of the
  compiled code is not undefined behavior. If the compiler is unable to make this
  guarantee, the compilation will fail. In this case, the user is able to override
  the compiler's decision by using the `unsafe` keyword on a block of code.
  Consider the following example:
  
  ----
  pub struct X(*const u8);
  
  
negative.code: }
  ----
  
  The compiler does not know whether dereferencing the pointer is a defined
  operation. And indeed, if `self.0` is a null pointer, the behavior is undefined.
  For this reason, the user has to wrap the offending section in an `unsafe` block
  to get it to compile:
  
  [source]
  ----
      pub fn f(&self) -> u8 {
          unsafe {
  