Struct OwningAllocation 

pub struct OwningAllocation { /* private fields */ }

Owning responsibility for exactly one BoundAllocation.

This is the Phase-4 owner. It is deliberately not Clone and not Copy: ownership of a physical allocation cannot be duplicated. Aliases are expressed as OwnedViews, which can never release anything.

Release paths

• release_now — synchronous, no queue. This is the CPU/eager path: one mechanism-lock preparation plus one allocator call.
• release_deferred — hand final ownership to a provider/context-owned DeferredReleaseQueue, for GPU allocations whose release must wait for a stream fence.
• prepare_release — take the owned request and route it manually.

All three consume the owner, so there is exactly one final release.

Drop

Dropping an owner without releasing it quarantines the allocation: the live record is retired under the mechanism lock and residual ownership is recorded. Drop never calls the allocator, never enqueues, and never waits. Freeing from Drop is what makes stale-pointer double frees possible, so this type refuses to do it.

Outstanding views block physical release

While any OwnedView (or clone of one) is alive, release is refused with BindingError::OutstandingViews and the owner is handed back untouched.

Implementations

impl OwningAllocation

pub fn new(allocation: BoundAllocation) -> Self

Take ownership of Phase-3 metadata.

This is the migration entry point from BoundAllocation to owning semantics; the generation is still validated at release time.

pub fn identity(&self) -> AllocationIdentity

pub fn binding(&self) -> &MemoryBinding

pub fn bound(&self) -> &BoundAllocation

Borrow the allocation metadata for a bound capability call.

BoundAllocation is not Clone, so a shared borrow can be handed to BoundVirtualBacking commit/decommit/query operations — every one of which re-validates the binding identity and the allocation generation — without giving up owning responsibility. There is no path from this borrow to a release: releasing still needs the owner by value.

pub fn as_ptr(&self) -> NonNull<u8>

The owned address. Never dereferenced by this crate.

pub fn len(&self) -> usize

pub fn is_empty(&self) -> bool

pub fn alignment(&self) -> usize

pub const fn state(&self) -> AllocationReleaseState

Always AllocationReleaseState::Live; any other state means the owner was already consumed.

pub fn view( &self, offset: usize, bytes: usize, ) -> Result<OwnedView, BindingError>

Borrow a sub-range. The returned view never releases anything and keeps this allocation from being physically released while it is alive.

pub fn outstanding_views(&self) -> usize

How many borrowed views and aliases are still alive.

pub fn into_bound(self) -> Result<BoundAllocation, OwningReleaseError>

Give up owning semantics and return to Phase-3 metadata.

Documented migration adapter: the result must be released explicitly through MemoryBinding::release, and dropping it releases nothing.

pub fn prepare_release( self, ) -> Result<PreparedAllocationRelease, OwningReleaseError>

Detach final ownership without calling the allocator.

pub fn release_now(self) -> Result<AllocationReleaseOutcome, OwningReleaseError>

Release immediately and synchronously through the pinned allocator.

No queue is involved and no wait happens, so this is the low-overhead path for CPU/eager mechanisms.

pub fn release_deferred( self, queue: &dyn DeferredReleaseQueue, ) -> Result<DeferredReleaseDisposition, OwningReleaseError>

Hand final ownership to a provider/context-owned queue.

The queue is called after every registry and mechanism lock is dropped. If the queue refuses, the exact prepared request is quarantined rather than freed or lost, and the rejection is reported.

Trait Implementations

impl Debug for OwningAllocation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for OwningAllocation

fn drop(&mut self)

Quarantine an owner that was dropped without an explicit release.

This never frees. It retires the live record under the mechanism lock and records residual ownership, so the bytes stay visible to accounting and block unsafe mechanism removal. When the record can no longer be prepared — device loss, termination, or an already stale generation — the metadata is simply dropped: in the device-loss case the live record is still recorded at the mechanism and is discharged by confirmed context termination.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.