I took some code that was annotated safe, and modified it to use a
buffer internal to the class, and an offset counter. Some of the
routines adjusted the counter. I forgot to remove the "safe" annotation.
It compiled without error. So...
1) The compiler didn't check for safety
2) It counts as safe if you only modify local-to-the-class variables
(and I misunderstood).
3) This error is only detected on execution
(I'm still writing the code, so I can't yet try to execute it, and I
took off the safe annotation because after I read the definition in TDPL
it seemed a mistaken annotation. But perhaps I misunderstand.)