unsafe-rustlisted

# Unsafe Rust `unsafe` is a promise, not a permission: the code inside may break the rules, but the code around it must keep them. `unsafe` means undefined behaviour, not "dangerous" — UB is the compiler being permitted to assume the situation cannot arise, which is why it surfaces as a later, unrelated miscompile. The depth is in `SAFETY-REVIEW.md` under `UB is not a bad outcome at runtime`. This skill governs *soundness* — whether a safe caller can trigger undefined behaviour — and it never treats "the tests pass" as evidence of soundness. ## `unsafe` does not turn off the borrow checker It permits exactly five extra operations: dereferencing a raw pointer, calling an `unsafe fn`, implementing an `unsafe trait`, accessing a `union` field, and mutating a `static mut`. Everything else — lifetimes, ownership, types — still applies inside the block. `unsafe` is a narrow escape hatch — reaching for it to resolve a borrow error is always wrong. That case is `/ownership-not-clone`. ## The justification test `unsafe` is justified for exactly three reasons. Each has a question that must be answered before the block is written — and the reason written down, in the `// SAFETY:` comment or the PR description, not remembered by whoever wrote it. 1. **FFI.** Calling into or out of another language. The checklist: who owns the memory on each side, what happens on a panic crossing the boundary (it must not), whether the foreign function is thread-safe, and what the lifetime of