Right, but I think their main complaint is that RefCell is implemented using "unsafe" -- hence my point about "unsafe".

It's API is not `unsafe` though. Otherwise, every safe API depends on some `unsafe` call down the call graph.

I think we're both in agreement, I was phrasing things in a manner which I thought would better reference how GP thinks of unsafe. Obviously the API itself is safe, but the "cheating" GP was referring to was the fact that Rust requires "unsafe" under the hood in order to implement some safe operations (because the memory model doesn't cover all cases). You and I agree that this isn't a problem.