I&#x27;m curious how this new architecture preserves safety invariants.  The post says MIR contains operations not available in Rust because they are unsafe.  Does this mean every MIR transformation needs to be safety-preserving?  Or is safety-checking the last stage that runs directly before LLVM IR generation?