Struct Permit 

pub struct Permit(/* private fields */);

Exclusive native custody lasts for the process once allocator hooks are installed, even if installation fails; copying or dropping Runtime does not release it.

Arena-backed native handles and allocations must remain exclusively owned by their originating worker until release; raw calls and other wrappers must preserve this custody and Cartel’s admitted execution. Foreign initialization and VFS allocations retain their std allocation family and audited native synchronization.

After allocator hook installation, callers must not reconfigure or replace the allocator, page cache, VFS or callbacks, enable URI interpretation, shared caches or native workers, install unaudited extensions, or publish arena-backed storage into global native state.

Implementations

impl Permit

pub unsafe fn exclusive() -> Self

Safety

SQLite must be uninitialized, and no other thread may call SQLite until this permit is consumed by Runtime::install and that call returns; the caller must uphold Permit’s process-lifetime custody contract. The initial default VFS, mutex methods, logging callbacks and auto-extension registry must belong to the audited native implementation without unaudited callbacks or extensions; allocator and page-cache tables replaced without execution may already be installed.