code: func (c *Compiler) checkSafetyRuleHeads() {
  
  	for _, name := range c.sorted {
  		m := c.Modules[name]
  		WalkRules(m, func(r *Rule) bool {
  			safe := r.Body.Vars(safetyCheckVarVisitorParams)
  			safe.Update(r.Head.Args.Vars())
  			unsafe := r.Head.Vars().Diff(safe)
  			for v := range unsafe {
  				if !v.IsGenerated() {
  					c.err(NewError(UnsafeVarErr, r.Loc(), "var %v is unsafe", v))
  				}
  			}
  			return false
  		})
  	}
  }
docs: // checkSafetyRuleHeads ensures that variables appearing in the head of a
  // rule also appear in the body.