> The reference type encodes the only pointer-validity precondition, so `safe fn` discharges the link-time proof.

just reading this gives me a headache