oh-my-opencode 5.0.0-beta.9 → 5.0.0

package/packages/shared-skills/skills/programming/references/rust/one-liners.md

@@ -124,9 +124,9 @@ rust-script --build-only --base-path . ./script.rs
 
 This drops a `target/` next to the script with the prebuilt binary.
 
-## `cargo-script` (RFC 3424, stable since Rust 1.85)
+## `cargo-script` (RFC 3424, nightly-only)
 
-The official replacement that landed in cargo proper. Same idea, slightly different syntax:
+The official replacement being built into cargo. Same idea, slightly different syntax:
 
 ```rust
 #!/usr/bin/env -S cargo +nightly -Zscript
@@ -140,6 +140,8 @@ dependencies:
   reqwest = { version = "0.12", features = ["blocking"] }
 ---
 
+use anyhow::Context as _;
+
 fn main() -> anyhow::Result<()> {
     let url = std::env::args().nth(1).context("url required")?;
     println!("{}", reqwest::blocking::get(&url)?.text()?.len());
@@ -147,7 +149,7 @@ fn main() -> anyhow::Result<()> {
 }
 ```
 
-Status as of 2026-05: stabilization in progress. Use `rust-script` for production now, migrate when `cargo script` is stable everywhere your tools live.
+Stable cargo (1.97) still rejects `-Zscript` and refuses to run a `.rs` file directly. Use `rust-script` now; migrate once `cargo script` reaches the stable channel of every toolchain your scripts run on.
 
 ## Strict mode for scripts
 

package/packages/shared-skills/skills/programming/references/rust/proptest-insta.md

@@ -15,6 +15,14 @@ Two test types every Rust project should have alongside unit tests. Proptest hun
 
 Use all three. They cover different bug classes.
 
+## Where tests live
+
+- **Unit tests of private behavior**: `#[cfg(test)] mod tests { use super::*; ... }` at the bottom of the module they test.
+- **Public-API behavior**: `tests/*.rs`. Each file is a separate crate that sees only `pub` items, so it fails when the public contract breaks, not when an internal changes.
+- **Examples in rustdoc**: doctests. They compile and run, so a documented example that drifts from the API fails the build. `cargo nextest run` skips them; the gate runs `cargo test --doc` too. Write examples with `?` and hide setup behind `# ` lines ([api-design.md](api-design.md#rustdoc-sections)).
+- **Panics**: `#[should_panic(expected = "...")]` only when panicking is the documented contract (an out-of-bounds index on a slice-like type). An invalid input that returns `Err` is asserted as that `Err` value.
+- **Environment and globals**: `std::env::set_var` is `unsafe` in the 2024 edition because another thread may read the environment at the same moment, and tests run in parallel threads. Inject configuration as a parameter instead of mutating process state; a test that must touch the real environment runs in its own process (`tests/` binary, or nextest's process-per-test).
+
 ## Proptest — setup
 
 `Cargo.toml`:

package/packages/shared-skills/skills/programming/references/rust/type-state.md

@@ -92,9 +92,8 @@ Now:
 ```rust
 let distance: Quantity<Meters> = Quantity::new(100.0);
 let height: Quantity<Feet> = Quantity::new(50.0);
-let combined = distance + height; // ❌ compile error
-let combined = distance + height.to_feet().to_meters_oops(); // ❌ no such method
-let combined = distance + distance; // ✅
+let combined = distance + height;   // compile error: Quantity<Meters> + Quantity<Feet>
+let combined = distance + distance; // compiles
 ```
 
 The agent cannot accidentally mix units. Refactors that change a quantity's underlying unit are caught at compile time everywhere the type flows.
@@ -109,12 +108,13 @@ pub struct ByteOffset(pub u32);
 pub struct CharOffset(pub u32);
 
 impl ByteOffset {
-    pub fn add(self, delta: u32) -> Self { Self(self.0 + delta) }
+    pub fn checked_add(self, delta: u32) -> Option<Self> { self.0.checked_add(delta).map(Self) }
 }
 
 // Converting between them is a function on the actual text.
 pub fn byte_to_char(text: &str, byte: ByteOffset) -> Option<CharOffset> {
-    text.get(..byte.0 as usize).map(|prefix| CharOffset(prefix.chars().count() as u32))
+    let prefix = text.get(..usize::try_from(byte.0).ok()?)?;
+    u32::try_from(prefix.chars().count()).ok().map(CharOffset)
 }
 ```
 
@@ -193,6 +193,41 @@ impl ProjectRel {
 
 The agent's path-handling code now distinguishes between project-relative and home-relative paths at the type level. A function taking `ProjectRel` cannot be called with a `HomeRel`.
 
+### Validated Newtypes — Parse Once, Every Path
+
+A newtype that carries an invariant has exactly one way in: a fallible constructor over a private field. Every other entry point (`FromStr`, serde, `TryFrom`) routes through it, so no path can build an unchecked value.
+
+```rust
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(try_from = "String", into = "String")]
+pub struct Email(String); // private field: no `Email(raw)` from outside
+
+#[derive(Debug, thiserror::Error)]
+#[error("not an email address: {0:?}")]
+pub struct InvalidEmail(String);
+
+impl TryFrom<String> for Email {
+    type Error = InvalidEmail;
+    fn try_from(raw: String) -> Result<Self, Self::Error> {
+        match raw.split_once('@') {
+            Some((user, host)) if !user.is_empty() && host.contains('.') => Ok(Self(raw)),
+            _ => Err(InvalidEmail(raw)),
+        }
+    }
+}
+
+impl std::str::FromStr for Email {
+    type Err = InvalidEmail;
+    fn from_str(raw: &str) -> Result<Self, Self::Err> { Self::try_from(raw.to_owned()) }
+}
+
+impl From<Email> for String {
+    fn from(email: Email) -> Self { email.0 }
+}
+```
+
+`#[serde(try_from = "String")]` makes deserialization run the same check, so JSON cannot smuggle in an invalid `Email`. Never add `impl From<String> for Email`: an infallible conversion into an invariant-bearing type is a bypass.
+
 ## Type-State State Machines
 
 Encode the lifecycle of a value as a sequence of types. Each transition consumes the previous state and returns the next.
@@ -313,6 +348,7 @@ Downstream code cannot add new `impl Renderer for Whatever` because they cannot
 ## NonEmpty Collections
 
 ```rust
+#[derive(Debug)]
 pub struct NonEmptyVec<T> {
     head: T,
     tail: Vec<T>,
@@ -322,16 +358,16 @@ pub struct NonEmptyVec<T> {
 #[error("vector was empty")]
 pub struct Empty;
 
+#[expect(clippy::len_without_is_empty, reason = "never empty by construction")]
 impl<T> NonEmptyVec<T> {
-    pub fn try_from_vec(mut v: Vec<T>) -> Result<Self, Empty> {
-        if v.is_empty() { return Err(Empty); }
-        let tail = v.split_off(1);
-        let head = v.into_iter().next().expect("checked non-empty");
-        Ok(Self { head, tail })
+    pub fn try_from_vec(v: Vec<T>) -> Result<Self, Empty> {
+        let mut items = v.into_iter();
+        let Some(head) = items.next() else { return Err(Empty) };
+        Ok(Self { head, tail: items.collect() })
     }
 
-    pub fn first(&self) -> &T { &self.head }
-    pub fn len(&self) -> usize { self.tail.len() + 1 }
+    pub const fn first(&self) -> &T { &self.head }
+    pub fn len(&self) -> usize { self.tail.len().saturating_add(1) }
 }
 ```
 
@@ -343,6 +379,8 @@ Functions taking `NonEmptyVec<T>` cannot receive an empty vector. The `first()`
 - When the wrapper does not change behavior or invariants vs. the underlying type (e.g., a `struct Count(u32)` that is only ever used in one struct).
 - When `From`/`Into` conversions would be ergonomic but would defeat the purpose (if you find yourself wanting `impl From<UserId> for Uuid`, you do not want a newtype - you want a type alias).
 
+A domain newtype never implements `Deref` to its inner type: that re-exposes every method the wrapper exists to fence off, and method resolution silently picks the inner one. `Deref` is for pointer-like wrappers (`Box`, guards, smart handles); a newtype exposes the operations it means to allow.
+
 The cost of a newtype is one tuple struct + the impls you need. The break-even is around three uses across different functions, or any use that crosses an API boundary.
 
 ## When NOT to Use Type-State

package/packages/shared-skills/skills/programming/references/rust/unsafe-discipline.md

@@ -146,7 +146,7 @@ impl Arena {
         // bump. `aligned` is aligned to `layout.align()` by `align_up`. No
         // other writer can have observed this offset because the CAS above
         // returned `Ok`.
-        let ptr = unsafe { self.map.as_mut_ptr().add(aligned) as *mut T };
+        let ptr = unsafe { self.map.as_mut_ptr().add(aligned) }.cast::<T>();
         // SAFETY: `ptr` is non-null (mmap base + offset), aligned (above),
         // exclusively owned (CAS), and we are about to initialize it.
         unsafe { ptr::write(ptr, value) };
@@ -187,7 +187,35 @@ What miri catches that the borrow checker cannot:
 - Stacked borrows / Tree borrows aliasing violations
 - Data races (single-threaded model, but catches concurrent access through `UnsafeCell` misuse)
 - Atomic ordering bugs in some patterns
-- Memory leaks (with `-Zmiri-track-pointer-tag`)
+- Memory leaks (reported by default at exit; `-Zmiri-ignore-leaks` turns it off)
+
+## FFI Declarations (Rust 2024)
+
+The 2024 edition makes the unsafety of FFI items visible at the declaration:
+
+```rust
+use core::ffi::{c_char, c_int};
+
+// SAFETY: these signatures match <string.h>/<stdlib.h> for every target we build.
+unsafe extern "C" {
+    /// No preconditions: callable from safe code.
+    pub safe fn abs(x: c_int) -> c_int;
+    /// Caller must pass a valid NUL-terminated string.
+    pub unsafe fn strlen(s: *const c_char) -> usize;
+}
+
+// Exported symbol: the attribute itself is unsafe because a name clash is UB.
+#[unsafe(no_mangle)]
+pub extern "C" fn mylib_version() -> u32 { 3 }
+```
+
+- A bare `extern "C" { ... }` block is a hard error in the 2024 edition; write `unsafe extern` and mark each item `safe fn` (no caller obligations) or `unsafe fn`. Marking an item `safe` is a promise you make for every caller; when in doubt, it is `unsafe`.
+- `#[no_mangle]`, `#[export_name]`, and `#[link_section]` are written `#[unsafe(...)]`.
+- A panic that unwinds out of an `extern "C"` function aborts the process (1.81+). Catch it with `std::panic::catch_unwind` at the boundary and return an error code; use `extern "C-unwind"` only when the foreign side is built to unwind.
+
+## Uninitialized Memory
+
+`MaybeUninit<T>` is the only way to hold memory that is not yet a valid `T`. `mem::uninitialized()` is always wrong, and `mem::zeroed()` is UB for any type whose all-zero bit pattern is invalid (references, `NonZero*`, `bool`-bearing enums, most `repr(Rust)` structs). An uninitialized array is `[const { MaybeUninit::<T>::uninit() }; N]`; write every element through `MaybeUninit::write`, then convert once, with a SAFETY comment stating that all `N` elements were written.
 
 ## When Miri Cannot Run
 
@@ -218,8 +246,8 @@ mod tests {
     fn concurrent_push_pop() {
         loom::model(|| {
             let queue = std::sync::Arc::new(MyQueue::new());
-            let q1 = queue.clone();
-            let q2 = queue.clone();
+            let q1 = std::sync::Arc::clone(&queue);
+            let q2 = std::sync::Arc::clone(&queue);
             let h1 = loom::thread::spawn(move || q1.push(1));
             let h2 = loom::thread::spawn(move || q2.pop());
             h1.join().unwrap();
@@ -229,7 +257,7 @@ mod tests {
 }
 ```
 
-Run: `RUSTFLAGS="--cfg loom" cargo test --release`. Loom exhaustively explores thread interleavings for the test scope. Combined with miri on the single-thread paths, you have machine-checked soundness over the full state space.
+Run: `RUSTFLAGS="--cfg loom" cargo test --release`. Loom systematically explores the interleavings its bounded model allows for the test scope; combined with miri on the single-thread paths, that is strong machine-checked evidence, not a proof over every execution.
 
 ## The Forbidden List
 
@@ -241,7 +269,7 @@ Reject in code review, automatic CI fail:
 - `std::mem::transmute` for anything but lifetime extension on the same layout (and that should usually be `core::mem::transmute_copy` or `bytemuck::cast` if the relayout is well-defined).
 - `std::ptr::read_unaligned` / `write_unaligned` without a comment explaining why aligned access is impossible.
 - `from_raw_parts` / `from_raw_parts_mut` without proving the source pointer's provenance covers the entire slice.
-- `Arc::get_mut_unchecked`, `Box::leak` to bypass ownership, `MaybeUninit::assume_init` on partially-initialized data.
+- `Arc::get_mut_unchecked`, `Box::leak` to bypass ownership, `MaybeUninit::assume_init` on partially-initialized data, `mem::uninitialized`, `mem::zeroed` for a type whose all-zero pattern is not valid.
 - `unsafe impl Send`, `unsafe impl Sync` on types containing raw pointers, without a comment naming exactly which interior-mutability rule is upheld.
 - Any `unsafe` block whose justification depends on "in practice this never happens".
 

package/packages/shared-skills/skills/programming/references/rust/zero-cost-safety.md

@@ -100,18 +100,20 @@ const fn fibonacci(n: usize) -> usize {
 const FIB_20: usize = fibonacci(20); // computed at compile time: 6765
 
 // Use in array sizes
+#[expect(clippy::indexing_slicing, reason = "const evaluation: an out-of-bounds index is a compile error")]
 const LOOKUP: [u8; 256] = {
     let mut table = [0u8; 256];
-    let mut i = 0;
-    while i < 256 {
-        table[i] = (i as u8).wrapping_mul(7);
+    let mut i: u8 = 0;
+    loop {
+        table[i as usize] = i.wrapping_mul(7); // u8 -> usize widens: lossless
+        if i == u8::MAX { break; }
         i += 1;
     }
     table
 };
 ```
 
-**Stable since Rust 1.82:** `const fn` supports `match`, loops, `if`, references, mutable locals — nearly full Rust. Use `const { }` blocks (Rust 1.79+) for inline compile-time assertions.
+`const fn` bodies may use `if`, `match`, `loop`/`while`, and mutable locals; trait methods (`From`, `TryFrom`, `Iterator`) are not callable in `const` on stable. That makes a **lossless widening `as` inside `const`** the one accepted numeric cast: iterate in the narrow type and widen to index, as above, so no value can truncate. Use `const { }` blocks (Rust 1.79+) for inline compile-time assertions.
 
 ```rust
 fn process<const N: usize>(data: &[u8; N]) {
@@ -123,6 +125,7 @@ fn process<const N: usize>(data: &[u8; N]) {
 ### const generics — Type-Level Values
 
 ```rust
+#[derive(Debug)]
 struct Buffer<const N: usize> {
     data: [u8; N],
     len: usize,
@@ -134,13 +137,17 @@ impl<const N: usize> Buffer<N> {
     }
 
     fn push(&mut self, byte: u8) -> Result<(), BufferFullError> {
-        if self.len >= N { return Err(BufferFullError); }
-        self.data[self.len] = byte;
-        self.len += 1;
+        let slot = self.data.get_mut(self.len).ok_or(BufferFullError)?;
+        *slot = byte;
+        self.len = self.len.saturating_add(1); // < N after the get_mut above
         Ok(())
     }
 }
 
+impl<const N: usize> Default for Buffer<N> {
+    fn default() -> Self { Self::new() }
+}
+
 // Compiler enforces: Buffer<16> and Buffer<32> are distinct types.
 let small: Buffer<16> = Buffer::new();
 let large: Buffer<1024> = Buffer::new();
@@ -148,26 +155,7 @@ let large: Buffer<1024> = Buffer::new();
 
 ### proc macros — Code Generation (Zig comptime type creation)
 
-When `const fn` is not enough (generating struct fields, impl blocks, or derive logic), proc macros fill the gap.
-
-```rust
-// In a proc-macro crate:
-use proc_macro::TokenStream;
-use quote::quote;
-use syn::{parse_macro_input, DeriveInput};
-
-#[proc_macro_derive(Builder)]
-pub fn derive_builder(input: TokenStream) -> TokenStream {
-    let input = parse_macro_input!(input as DeriveInput);
-    let name = &input.ident;
-    // ... generate builder struct and impl
-    TokenStream::from(quote! {
-        impl #name {
-            pub fn builder() -> #name##Builder { /* ... */ }
-        }
-    })
-}
-```
+When `const fn` is not enough (generating struct fields, impl blocks, or derive logic), proc macros fill the gap. Crate layout, `syn`/`quote`, identifier construction, and spanned errors → [macros.md](macros.md).
 
 **Decision tree:**
 
@@ -195,15 +183,14 @@ fn process(input: &str) -> String {
 
 // GOOD: caller provides output buffer, zero allocation
 fn process(input: &[u8], output: &mut [u8]) -> usize {
-    let len = input.len().min(output.len());
-    for i in 0..len {
-        output[i] = input[i].to_ascii_uppercase();
+    for (dst, src) in output.iter_mut().zip(input) {
+        *dst = src.to_ascii_uppercase();
     }
-    len // returns bytes written
+    input.len().min(output.len()) // bytes written; zip stopped at the shorter slice
 }
 
 // GOOD: return borrowed data when possible
-fn find_token<'a>(input: &'a str) -> Option<&'a str> {
+fn find_token(input: &str) -> Option<&str> {
     input.split_whitespace().next() // no allocation — borrows from input
 }
 ```
@@ -231,9 +218,28 @@ tags.push(1); // on stack if <= 8 elements
 
 // ArrayVec: purely stack, fixed capacity, no heap ever
 let mut buf: ArrayVec<u8, 64> = ArrayVec::new();
-buf.try_push(42).map_err(|_| "full")?; // returns error instead of panic
+buf.try_push(42).map_err(|_| BufferFullError)?; // typed error instead of panic
+```
+
+### Move Out of `&mut` Without Cloning
+
+```rust
+// Take the value, leave Default behind: no clone, no Option dance.
+let pending = std::mem::take(&mut self.pending);      // Vec/String/HashMap
+let old = std::mem::replace(&mut self.state, State::Idle);
+let conn = self.conn.take();                          // Option<T> field
 ```
 
+A `.clone()` whose only purpose is to satisfy the borrow checker behind `&mut self` is almost always one of these three.
+
+### Reuse and Pre-Size
+
+- Reserve from a known size: `Vec::with_capacity(n)` / `String::with_capacity(n)`, or `reserve(n)` before a batch `extend`.
+- In a loop, hoist a scratch buffer and `clear()` it each iteration instead of allocating a fresh one; `clear` keeps the capacity. Drop or `shrink_to` it when one outlier would pin a huge allocation.
+- Format into an existing buffer with `write!(buf, ...)` (`use std::fmt::Write as _`) instead of building intermediate `format!` strings, and pass `&str` literals where no formatting happens.
+
+Apply these on paths a profile or benchmark shows to be hot; elsewhere the clearer allocation wins.
+
 ### Cow — Defer Allocation Until Mutation
 
 ```rust
@@ -264,15 +270,7 @@ Even in `std` code, the *mindset* applies: prefer `&[T]` over `Vec<T>` in functi
 
 ### Clippy Lints for Hidden Allocations
 
-```toml
-# Cargo.toml — catch accidental allocations
-[lints.clippy]
-# These warn on patterns that allocate when a borrow would suffice:
-unnecessary_to_owned = "warn"       # .to_string() / .to_vec() when borrow works
-redundant_clone = "warn"            # .clone() that's immediately consumed
-large_stack_arrays = "warn"         # accidental large stack usage
-vec_init_then_push = "warn"         # Vec::new() + push instead of vec![]
-```
+The groups in [cargo-strict.md](cargo-strict.md) already enable the allocation lints: `unnecessary_to_owned` and `vec_init_then_push` (in `all`, denied), `redundant_clone` (nursery), `large_stack_arrays` (pedantic). Do not re-list them in `[lints.clippy]`: a per-lint `"warn"` entry overrides the group and silently downgrades a deny.
 
 ---
 
@@ -408,22 +406,24 @@ Zig's `errdefer` runs cleanup only on error paths. Rust's `Drop` always runs, bu
 ### scopeguard — The errdefer Equivalent
 
 ```rust
-use scopeguard::{defer, guard};
+use scopeguard::{guard, ScopeGuard};
 use std::fs;
 
 fn create_and_process(path: &str) -> std::io::Result<()> {
     let file = fs::File::create(path)?;
     // If anything below fails, clean up the file.
     // This is exactly Zig's errdefer.
-    let _cleanup = guard((), |_| {
-        let _ = fs::remove_file(path);
+    let cleanup = guard((), |()| {
+        if let Err(error) = fs::remove_file(path) {
+            tracing::warn!(%error, path, "cleanup after failed write");
+        }
     });
 
     write_data(&file)?;
     validate_data(path)?;
 
     // Success: defuse the guard so it does NOT run cleanup.
-    std::mem::forget(_cleanup);
+    ScopeGuard::into_inner(cleanup);
     Ok(())
 }
 ```
@@ -437,7 +437,7 @@ fn with_temp_dir() -> anyhow::Result<()> {
     let dir = tempfile::tempdir()?;
     defer! {
         // Runs when scope exits, success or failure.
-        println!("Cleaning up {}", dir.path().display());
+        tracing::debug!(path = %dir.path().display(), "leaving temp dir scope");
         // dir's Drop also cleans up, but this shows the pattern.
     }
 
@@ -449,6 +449,7 @@ fn with_temp_dir() -> anyhow::Result<()> {
 ### Drop as RAII Cleanup
 
 ```rust
+#[derive(Debug)]
 struct TempFile { path: std::path::PathBuf }
 
 impl TempFile {
@@ -461,7 +462,10 @@ impl TempFile {
 
 impl Drop for TempFile {
     fn drop(&mut self) {
-        let _ = std::fs::remove_file(&self.path);
+        // Drop cannot return an error; report it instead of discarding it.
+        if let Err(error) = std::fs::remove_file(&self.path) {
+            tracing::warn!(%error, path = %self.path.display(), "temp file not removed");
+        }
     }
 }
 
@@ -469,19 +473,25 @@ impl Drop for TempFile {
 let tmp = TempFile::new("/tmp/scratch.dat")?;
 ```
 
+### Drop Order Is Part of the Contract
+
+Locals drop in reverse declaration order; struct fields drop in declaration order (first field first). When one resource must outlive another (a transaction before its connection, a worker handle before the channel it drains), encode it: declare the dependent field first, or call `drop(x)` at the exact point the dependency ends. Never rely on an order the code does not state.
+
 ### The errdefer Pattern — Defuse on Success
 
 The key insight from Zig's `errdefer`: you want cleanup on error but NOT on success. In Rust:
 
 ```rust
-use scopeguard::ScopeGuard;
+use scopeguard::{guard, ScopeGuard};
 
 fn deploy(artifact: &Path) -> Result<(), DeployError> {
     let backup = backup_current()?;
 
     // errdefer: restore backup if anything fails
-    let rollback = guard(backup.clone(), |b| {
-        let _ = restore_from_backup(&b);
+    let rollback = guard(backup, |b| {
+        if let Err(error) = restore_from_backup(&b) {
+            tracing::error!(%error, "rollback failed; manual restore needed");
+        }
     });
 
     upload(artifact)?;
@@ -522,6 +532,6 @@ All achievable within Rust's single toolchain. You get Zig's explicitness **plus
 - **Zero-alloc APIs** hurt readability when the function naturally produces owned data. Don't force `&mut [u8]` output buffers on a function that logically returns `String`.
 - **`#[repr(packed)]`** only for wire formats and FFI. Never for regular domain types.
 - **Scope guards** unnecessary when `Drop` on the value itself handles cleanup (e.g., `tempfile::NamedTempFile` already does this).
-- **`const fn`** everything? No — only when the value is genuinely needed at compile time or the function is trivially const-eligible. Don't contort logic just to be const.
+- **`const fn`** everything? No — only when a `const` context needs the function or it is trivially const-eligible. Don't contort logic just to be const.
 
 The goal is **visible costs and explicit control**, not asceticism. Use `String` and `Vec` freely when they're the right tool. Reach for these patterns when allocation behavior matters for correctness or performance.

package/packages/shared-skills/skills/programming/references/rust-ub/miri-sanitizers-loom.md

@@ -66,7 +66,7 @@ cargo +nightly miri test
 MIRIFLAGS="-Zmiri-tree-borrows" cargo +nightly miri test
 ```
 
-**Protocol:** Run Stacked Borrows first. If it fails, fix it. Then run Tree Borrows to confirm. Code that passes Stacked Borrows is sound under both models.
+**Protocol:** Run Stacked Borrows first. If it fails, fix it. Then run Tree Borrows as a separate pass. The models are not nested: Stacked Borrows is stricter about most reborrow patterns, but Tree Borrows rejects some code Stacked Borrows accepts. Ship only when both are clean.
 
 #### Strict Provenance
 

package/packages/shared-skills/skills/programming/references/rust-ub/ub-taxonomy.md

@@ -140,7 +140,7 @@ MIRIFLAGS="-Zmiri-strict-provenance" cargo +nightly miri test
 - Passing a Rust `enum` to C without `#[repr(C)]` or `#[repr(i32)]`.
 - Null pointer passed where C expects non-null (and Rust wraps it in `&T`).
 - C code writing to Rust-owned memory through a pointer Rust considers immutable.
-- Forgetting to mark FFI functions as `unsafe extern "C"`.
+- Declaring a foreign function `safe fn` inside `unsafe extern` when it has caller preconditions (null, length, lifetime), so safe code can violate them.
 - longjmp/setjmp across Rust frames (unwinding UB).
 
 **Miri detection:** LIMITED — Miri cannot execute foreign code. It detects UB in the Rust-side handling of FFI return values.
@@ -236,12 +236,15 @@ MIRIFLAGS="-Zmiri-strict-provenance" cargo +nightly miri test
 **Root cause:** A Rust panic unwinding through a frame that uses the C calling convention.
 
 **Canonical triggers:**
-- `panic!()` inside a `#[no_mangle] extern "C" fn` callback passed to C code.
+- `panic!()` inside a `#[unsafe(no_mangle)] extern "C" fn` callback passed to C code.
 - `unwrap()` inside FFI callbacks.
+- Foreign code unwinding (C++ exceptions, `longjmp`) through a Rust frame declared `extern "C"`.
+
+Since Rust 1.81 a Rust panic that reaches an `extern "C"` boundary aborts the process instead of unwinding into foreign frames: no longer UB, but still a crash.
 
 **Miri detection:** PARTIAL — Miri does not model foreign unwinding, but it can detect the immediate UB if the panic reaches the FFI boundary.
 
-**Fix pattern:** Use `std::panic::catch_unwind` at every FFI entry point. Mark FFI callbacks as `extern "C-unwind"` when panic propagation is intentional (nightly). Prefer returning `Result`-like error codes from FFI callbacks.
+**Fix pattern:** Use `std::panic::catch_unwind` at every FFI entry point and return an error code. Declare the ABI `extern "C-unwind"` (stable since 1.71) only when both sides are built to let unwinding cross.
 
 ---