Rust Unsafe and FFI

Use this when the code must uphold invariants the compiler cannot check.

Working stance

• Safe wrapper first; unsafe is the narrow implementation detail.
• Write the invariant list before writing the block.
• Every unsafe block should justify itself in plain language.
• FFI boundaries must define ownership, lifetime, layout, and panic policy.
• If a safe design is available and fast enough, prefer it.

Decision surface