offset_from, offset: clearly separate safety requirements the user needs to prove from corollaries that automatically follow#127275