gray: safety checks by clang