o3 0.12.0

shared-nothing primitives
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160

# Compile-time contracts

These examples are expected to be rejected by the compiler. They protect the
ownership and capability boundaries without depending on rustc's diagnostic
wording.

Pinned values require the pin-aware branded borrow:

```compile_fail,E0277
use std::marker::PhantomPinned;
use o3::cell::branded::{Brand, BrandToken};

struct Pinned(PhantomPinned);

BrandToken::scope(|mut token| {
    let cell = Brand::new(Pinned(PhantomPinned));
    let _ = cell.borrow_mut(&mut token);
});
```

A checked mutable borrow cannot escape its callback:

```compile_fail
use o3::cell::Checked;

fn escape(cell: &Checked<u8>) -> &mut u8 {
    cell.with_mut(|value| value)
}
```

Slab keys cannot be fabricated from public parts:

```compile_fail,E0624
use o3::collections::slab::key::{Key, Parts};

let parts = Parts::new(0, 1).unwrap();
let _ = Key::<()>::from_parts(parts);
```

Keys from distinct tag domains cannot be mixed:

```compile_fail,E0308
use o3::collections::slab::{Slab, key::Key};

struct Read;
struct Write;

fn remove(slab: &mut Slab<u8, Write>, key: Key<Read>) {
    slab.remove(key);
}
```

A lease cannot outlive its slab:

```compile_fail,E0515
use o3::collections::slab::{Capacity, lease};

fn escape() -> lease::Lease<'static, u8> {
    let slab = lease::Pool::with_capacity(Capacity::new(1));
    slab.vacant_entry().unwrap().insert(1)
}
```

Initialized pool storage cannot expose an uninitialized writer:

```compile_fail,E0599
use o3::buffer;

let pool = buffer::pool::Pool::<buffer::pool::state::Initialized>::try_new(1, 8).unwrap();
let mut lease = pool.try_acquire().unwrap();
let _ = lease.spare_writer();
```

Uninitialized pool storage cannot expose initialized spare bytes:

```compile_fail,E0599
use o3::buffer;

let pool = buffer::pool::Pool::<buffer::pool::state::Uninitialized>::try_new(1, 8).unwrap();
let mut lease = pool.try_acquire().unwrap();
let _ = lease.spare_mut();
```

Runtime-exact and compile-time-fixed owners remain distinct policy types:

```compile_fail,E0308
use o3::buffer::{BLOCK_CAPACITY, storage::Owned};

let exact = Owned::try_with_capacity(16).unwrap();
let _: Owned<BLOCK_CAPACITY> = exact;
```

A validated prefix keeps its target exclusively borrowed until commit:

```compile_fail,E0506
use o3::buffer::{PrefixConsumer, PrefixLength, PrefixProof};

struct Cursor { len: usize }

impl PrefixLength for Cursor {
    fn prefix_len(&self) -> usize { self.len }
}

impl PrefixConsumer for Cursor {
    fn consume_validated_prefix(&mut self, proof: PrefixProof) {
        self.len -= proof.amount();
    }
}

let mut cursor = Cursor { len: 8 };
let prefix = cursor.try_consume_prefix(4).unwrap();
cursor.len = 2;
prefix.commit();
```

Brand and region permissions are distinct domains:

```compile_fail,E0308
use o3::cell::branded::{BrandToken, Region};

BrandToken::scope(|mut token| {
    let cell = Region::new(0_u8);
    *cell.borrow_mut(&mut token) = 1;
});
```

Cells from one generative brand cannot be accessed through another:

```compile_fail,E0521
use o3::cell::branded::{Brand, BrandToken};

BrandToken::scope(|mut first| {
    BrandToken::scope(|mut second| {
        let cell = Brand::new(0_u8);
        let _ = cell.borrow_mut(&mut first);
        let _ = cell.borrow_mut(&mut second);
    });
});
```

Generation limits must be nonzero:

```compile_fail,E0080
use o3::collections::slab::key::Generation;

const _: Generation<0> = Generation::MIN;
```

Pinned slab keys retain their tag domain:

```compile_fail,E0308
use o3::collections::slab::{key::Key, pin};

struct Read;
struct Write;

fn remove(pool: &mut pin::Pool<u8, Write>, key: Key<Read>) {
    pool.remove(key);
}
```