I'm not sure I understand what you're saying. It sounds like you're claiming that a static guarantee that you can't cause memory unsafety is insufficient for a

I'm not sure I understand what you're saying. It sounds like you're claiming that a static guarantee that you can't cause memory unsafety is insufficient for a memory model to be memory safe, but I suspect I've misunderstood.