The Rust ownership system was built to be compositional - an architecture or algorithm must not just be "safe" in isolation, it must also preserve that safety w

The Rust ownership system was built to be compositional - an architecture or algorithm must not just be "safe" in isolation, it must also preserve that safety when interacting with the rest of the system, even as either part gets modified or evolves further. Practically speaking, this is where many proposed architectures that may indeed appear "safe" run into issues. (If you can't provide these guarantees, the idiomatic approach in Rust is to isolate that part within an unsafe module, and document the expectations that said module imposes wrt. the rest of the system.)