Rust unsafe marks code the compiler cannot fully protect. Musi uses the same warning shape: declare foreign symbols, then keep calls inside unsafe { ... }.
extern "C" { fn clock_ms() -> i64; }
let now = unsafe { clock_ms() };foreign "c" (
let clock_ms () : Int;
);
export let nativeClockMs () : Int := unsafe {
clock_ms();
};Reading Unsafe and FFI from Rust
On the Musi side, Musi foreign declarations use foreign "c" let ... or a parenthesized foreign group, and unsafe calls stay inside unsafe { ... }. Read the shared example through Rust eyes: keep the useful instinct, then let Musi name shape, behavior, absence, and outside work in separate places.
False friend
Do not invent a C-like foreign block or spread unsafe assumptions through ordinary Musi code. For a Rust reader, the trap is expecting Musi syntax to mirror Rust even when the ideas are separated differently; Musi class is closest to a Rust trait plus law text; instances play the role of implementations for behavior.
When this pays off
Use this shape when a clock, driver, C library, host VM, or platform handle must cross into Musi. The Rust instinct still helps here: Keep the Rust habit of asking which type carries the invariant.