Expand description
Compile-proven borrow-guard constraint.
The type system proves that no raw &T / &mut T can escape an
account access path.
Every runtime surface already returns a Ref, RefMut,
SegRef, or SegRefMut, but that guarantee is embedded in the
function return types alone. HopperRefOnly is the nominal
version of that promise: a sealed marker trait implemented only by
Hopper’s four borrow guards.
API authors can now write fn f<G: HopperRefOnly>(g: G) and rely
on the compiler to reject a naked &mut U at the call site. The
sealed trait pattern means no downstream crate can stamp the marker
onto arbitrary types, which enforces the no-raw-reference
gate at compile time instead of by convention.
The implementations are explicit for Hopper’s four guard types; macros do not generate additional implementations.
Traits§
- Hopper
RefOnly - Marker trait implemented exclusively by Hopper’s four account-data
borrow guards:
Ref,RefMut,SegRef,SegRefMut.