Module binding 

Safe audited binding from committed active mappings to core capabilities. Safe audited binding from committed active mappings to core capabilities.

This module is the safe, fully audited alternative to the feature-gated raw-pointer escape. It converts a committed ActiveReader or ActiveWriter into the matching native-ipc-core capability owner (ReaderRegion/WriterRegion) by consuming the active mapping into a witness the core boundary trusts. Running the audited core protocol over a session-transferred region needs no consumer unsafe code and no raw-pointer feature on this path.

Witness soundness

An active mapping is uniquely owned and cannot be cloned. Its local native view is released only by the owner’s own Drop; session poison or close gates the safe accessors but never unmaps the view. Moving the consumed active value inside a witness therefore keeps the whole base..base+len extent mapped and initialized — and, for the read side, OS-enforced read-only — for the entire witness lifetime. len is the mapping’s validated logical extent (ActiveReader::len/ActiveWriter::len); the page-rounded tail beyond it is deliberately excluded, matching the range the ValidatedRegionLayout was validated over.

After the peer session ends the peer is gone and the bytes are frozen or stale: read witnesses still observe only hostile, memory-safe bytes, and write witnesses simply publish to nobody. Liveness re-checking is deliberately not part of the witness contract; a consumer that needs it keeps the owning session handle and quiesces before dropping the witness.

Structs

BindRejected

A rejected bind that returns the consumed active mapping to its caller.

BoundReadMapping

Read-only witness that owns its consumed active mapping.

BoundWriteMapping

Sole-writer witness that owns its consumed active mapping.