From 1cee9f567cb9f15facbdd77c5182dc129c018856 Mon Sep 17 00:00:00 2001
From: widberg <widberg@widberg.me>
Date: Sun, 5 Jul 2026 14:24:06 -0400
Subject: [PATCH] deny unsafe_code

---
 Cargo.toml             | 3 +++
 bff/src/names/scope.rs | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/Cargo.toml b/Cargo.toml
index 48a87c2..21ccbbc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,6 +10,9 @@ repository = "https://github.com/widberg/bff"
 edition = "2024"
 rust-version = "1.88.0"
 
+[workspace.lints.rust]
+unsafe_code = "deny"
+
 [workspace.lints.clippy]
 allow_attributes = "warn"
 assigning_clones = "warn"
diff --git a/bff/src/names/scope.rs b/bff/src/names/scope.rs
index f20c574..36f03a7 100644
--- a/bff/src/names/scope.rs
+++ b/bff/src/names/scope.rs
@@ -1,3 +1,9 @@
+#![expect(
+    unsafe_code,
+    reason = "ambient NameContext requires storing lifetime-erased borrows in a thread-local; \
+              guarded by runtime borrow-state + LIFO Drop discipline. See module tests."
+)]
+
 use std::cell::{Cell, RefCell};
 use std::ptr::NonNull;