Memory safety

Safe Buraaq should not do use-after-free, double-free, or data races. Enforcement is compile-time GFA, plus runtime bounds checks on indexing.

What the compiler rejects

• Use after move
• Two ref mut to the same value
• ref and ref mut overlapping

Errors explain *where* the conflict started and the smallest fix (ref, split a binding, or unsafe only if you mean it).

What still needs you

• Raw pointers
• Integer-to-pointer casts
• Foreign C that takes *mut

Those are unsafe. Safety is not a slogan that deletes MMIO.

Indexing

tx[i] checks bounds in safe code. A future pass may eliminate proven checks; do not write your own unchecked index to "go faster" until you have a profile that says the check is the problem. Gate B numbers were taken with the safe language: see performance.