[playbook-phase-11] Unsafe, FFI, and platform-specific code

[githubrobbi]

Playbook section: docs/dev/architecture/code_clean/world_class_rust_workspace_refactor_playbook.md § Phase 11.

Baseline anchor: Phase-0 final report docs/dev/baseline/2026-05-12/phase_0_final_report.md (local-only per .gitignore:135). Workspace commit at baseline: 710ca6044 (cast-cleanup, PR #186).

Goals (from playbook)

Per-block review of every unsafe { } site. Verify SAFETY: paragraphs are per-block (current ratios suggest some span multiple blocks). Cross-check against Phase-5 error-model work so unsafe-FFI error handling is consistent.

Current state (from Phase-0 baseline § 7 entry-point map)

Estimated cost: 2-3 days

Recommended entry points: uffs-mft (151 blocks) · uffs-client (57, 0.81 coverage) · uffs-security (30) · uffs-daemon (25) · uffs-broker (23)

Acceptance criteria

• Read playbook § Phase 11 Check / Refactor / Validate subsections
• Open a tracking branch (refactor/phase-11-...) and a draft PR
• Land work in surgical commits — preserve behavior and contracts (workspace rules: no suppression hacks, no relaxing tests, signed commits)
• Update tests where the refactor changes invariants
• Re-run just baseline-snapshot after merge and compare deltas against docs/dev/baseline/2026-05-12/
• Close this issue with a one-line summary of the LOC / API / risk-marker delta

Workspace policy reminders

1. No suppression hacks (#[allow] blankets, disabled lints, commented-out tests, cfg(any()) hiding)
2. Surgical correct fixes (root cause, not workaround)
3. Preserve behavior & contracts (public API stable unless CI proves it wrong)
4. Improve tests, do not dodge them