embark ch 4, add lifetime guard utils

.gitignore

···
 !/futures/**
 !/futures-*/
 !/futures-*/**
+!/lifetime-guard/
+!/lifetime-guard/**

Cargo.lock

···
 ]
 
 [[package]]
+name = "lifetime-guard"
+version = "0.1.0"
+
+[[package]]
 name = "proc-macro2"
 version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"

Cargo.toml

···
 [workspace]
 resolver = "3"
-members = [ "futures", "futures-core", "futures-combinators", "futures-compat", "futures-derive", "futures-util"]
+members = [ "futures", "futures-core", "futures-combinators", "futures-compat", "futures-derive", "futures-util", "lifetime-guard"]
 
 [workspace.package]
 version = "0.1.0"

README.md

···
 
 New async primitives that disallow intra-task concurrency, clone of `futures` and `futures-concurrency` for the new primitives.
 
-## TODO:
-- [x] ScopedFuture
-- [ ] static combinators (Join Race etc), see futures-concurrency
-- [ ] `#[bsync]` or some compiler ScopedFuture generation
-- [ ] growable combinators (eg. `FutureGroup`, `FuturesUnordered`) (require alloc?)
-- [ ] unsound (needs `Forget`) multithreading
-- [ ] "rethinking async rust"
-- [ ] all of the above for streams
-- [ ] rfc?
 
 channels: need lifetimed receievers, probably needs `Forget` (arc-like channels would be unsafe)
 
···
 - need tons of interior mutability, since immutable/can't move means `poll` cannot take `&mut self`, cells everywhere
   - nvm lots of unsafe code, but nothing really unsound
 - potentially bad error messages? stuff like `join!` will have to output code that manually sets up the waker self ref
+
+## TODO:
+- [x] ScopedFuture
+- [x] static combinators (Join Race etc), see futures-concurrency
+- [x] `#[async_scoped]` or some compiler ScopedFuture generation
+- [ ] doubly linked list waker registration
+- [ ] repeating static time reactors - eg. make event poll every N seconds
+- [ ] io uring reactors
+- [ ] growable combinators (eg. `FutureGroup`, `FuturesUnordered`) (require alloc?)
+- [ ] unsound (needs `Forget`) multithreading
+- [ ] "rethinking async rust"
+- [ ] all of the above for streams
+- [ ] rfc?
+
+# Chapter 3
+
+man this really sucks
+
+i need better things to do
+
+issues from ch 2
+- works great[*]
+- *: incompatible with event loop - something still has to poll
+  - we're back to doubly linked list of waker registration in event loop
+  - this requires Forget
+- ScopedFuture - Future interop sucks
+
+
+structured concurrency with regular combinators:
+- scope holds tasks
+- scope cancels tasks when dropped
+- tasks are ran by central executor
+
+pure structured concurrency with borrow checker:
+- high level block_on(), any task wake wakes every level up
+- tasks have events
+
+how do the tasks register to an event loop? they don't fuck
+
+
+```rust
+struct Task<F: Future> {
+  inner: F,
+  prev: *const Task,
+  next: *const Task,
+  waker: Waker,
+}
+```
+
+&waker is passed into all sub-tasks, calling wake clone etc panics!!!
+this is pretty jank
+
+also waker doesn't have a lifetime so a safe code could easily register to external source that outlives the task
+this is unsound
+
+we need
+```rust
+struct WakerRegister {
+  prev: *const WakerRegister,
+  next: *const WakerRegister,
+}
+```
+
+# Borrow Checked Structured Concurrency
+
+An async system needs to have the following components:
+
+- event loop : polls events and schedules tasks when they are ready
+- tasks : state machines that progress and can await events from the event loop
+- task combinators : tasks that compose other tasks into useful logic structures
+
+Tasks will register themselves to events on the event loop, which will need to outlive tasks and register pointers to wake the tasks, so that they can again be polled.
+This is incompatible with the borrow checker because the task pointers (wakers) are being stored inside an event loop with a lifetime that may exceed the tasks'.
+
+`Waker` is effectively a `*const dyn Wake`. It is implemented using a custom `RawWakerVTable` rather than a `dyn` ptr to allow for `Wake::wake(self)`, which is not object safe.
+This method is necessary for runtime implementations that rely on the wakers to be effectively `Arc<Task>`, since `wake(self)` consumes `self` and decrements the reference count.
+
+There are two types of sound async runtimes that currently exist in rust:
+
+[tokio](https://github.com/tokio-rs) and [smol](https://github.com/smol-rs) work using the afformentioned reference counting system to ensure wakers aren't dangling pointers to tasks that no longer exist.
+
+[embassy](https://github.com/embassy-rs/embassy) and [rtic](https://github.com/rtic-rs/rtic) work by ensuring tasks are stored in `static` task pools for `N` tasks. Scheduled tasks are represented by an intrusively linked list to avoid allocation, and wakers can't be dangling pointers because completed tasks will refuse to add themselves back to the linked list, or will be replaced by a new task. This is useful in environments where it is desirable to avoid heap allocation, but requires the user annotate the maximum number of a specific task that can exist at one time, and fails to spawn tasks when they exceed that limit.
+
+An async runtime where futures are allocated to the stack cannot be sound under this model because `Future::poll` allows any safe `Future` implementation to store or clone wakers wherever they want, which become dangling pointers after the stack allocated future goes out of scope. In order to prevent this, we must have a circular reference, where the task (`Task<'scope>: Wake`) contains a `&'scope Waker` and the `Waker` contains `*const dyn Wake`. For that to be safe, the `Waker` must never be moved. This cannot be possible because something needs to register the waker:
+
+```rust
+// waker is moved
+poll(self: Pin<&mut Self>, cx: &mut Context<'_> /* '_ is the duration of the poll fn */) -> Poll<Self::Output> {
+  // waker is moved!
+  // can't register &Waker bc we run into the same problem,
+  // and the waker only lives for '_
+  store.register(cx.waker())
+}
+```
+
+Effectively, by saying our waker can't move, we are saying it must be stored by the task, which means it can't be a useful waker. Instead, what we could do is have a waker-register (verb, not noun) that facilitates the binding of an immovable waker to an immovable task, where the waker is guaranteed to outlive the task:
+
+```rust
+pub trait Wake<'task> {
+  fn wake(&self);
+  fn register_waker(&mut self, waker: &'task Waker);
+}
+
+pub struct Waker {
+  task: *const dyn Wake,
+  valid: bool, // task is in charge of invalidating when it goes out of scope
+}
+
+pub struct WakerRegistration<'poll> {
+  task: &'poll mut dyn Wake,
+}
+
+impl<'poll> WakerRegistration<'poll> {
+  pub fn register<'task>(self, slot: &'task Waker)
+  where
+    'task: 'poll,
+    Self: 'task
+  {
+    *slot = Waker::new(self.task as *const dyn Wake);
+    *task.register_waker(slot)
+  }
+}
+```
+
+This system works better because `WakerRegistration` only lives
+
+
+
+Experienced rust programmers might be reading this and thinking I am stupid (true) because `Forget`
+
+An astute (soon to be disappointed) reader might be thinking, as I did when I first learned about this sytem, "what if we ensured that there was only one `Waker` per `Task`, and gave the task a pointer to the waker, so that it could disable the waker when dropped?"
+
+Unfortunately, there are a multitude of issues with this system
+
+- In order to hold a pointer to the Waker from the 
+- Preventing a `Waker` from moving means panicking on the 
+
+Even if it was guaranteed that wakers could not be moved or `cloned` (by panicking on `clone`), and registration occured via `&Waker`, the task would still be unable to 
+
+https://conradludgate.com/posts/async-stack
+
+## Structured Concurrency
+
+https://trio.discourse.group/t/discussion-notes-on-structured-concurrency-or-go-statement-considered-harmful/25
+https://kotlinlang.org/docs/coroutines-basics.html
+
+Notably, the structured concurrency pattern fits very nicely with our hypothetical unsound stack based async runtime.
+
+## WeakCell Pattern & Forget trait
+
+https://github.com/rust-lang/rfcs/pull/3782
+
+
+There are two solutions:
+
+- `Wakers` panic on `clone()`
+
+## Waker allocation problem & intra task concurrency
+
+we can't do intra task concurrency because WeakRegistrations
+
+

futures-compat/src/lib.rs

···
 //! that expects it to live for 'scope, and then the ScopedFutureWrapper is
 //! dropped
 //!
-//!
-//! ## TRIGGER WARNING
-//!
 //! This code is not for the faint of heart. Read at your own risk.
 
 use std::{
···
 /// can transmute between them, but the waker will be completely invalid!
 
 /// wraps an internal ScopedFuture, implements Future
-pub struct ScopedFutureWrapper<'scope, F: ScopedFuture<'scope> + 'scope> {
+pub struct ScopedFutureWrapper<'scope, F: ScopedFuture<'scope>> {
     inner: UnsafeCell<F>,
     marker: PhantomData<&'scope ()>,
 }
···
 {
     type Output = F::Output;
 
-    fn poll(
-        self: std::pin::Pin<&mut Self>,
-        cx: &mut std::task::Context<'_>,
-    ) -> Poll<Self::Output> {
+    fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
         // # Safety
         //
         // Transmutes `Waker` into `&'scope dyn Wake`.
···
     marker: PhantomData<&'scope ()>,
 }
 
-impl<'scope, F: Future> ScopedFuture<'scope>
+impl<'scope, F: Future + 'scope> ScopedFuture<'scope>
     for UnscopedFutureWrapper<'scope, F>
 {
     type Output = F::Output;
···
     }
 }
 
-impl<'scope, F: Future> UnscopedFutureWrapper<'scope, F> {
+impl<'scope, F: Future + 'scope> UnscopedFutureWrapper<'scope, F> {
     pub unsafe fn from_future(f: F) -> Self {
         Self {
             inner: f.into(),

futures-core/src/lib.rs

···
 /// The waker is no longer tied to the actual future's lifetime, making it
 /// unsound to not have either static tasks or reference counting.
 /// To avoid this, we want to use a &'scope waker instead, with 1 waker / task.
+#[must_use = "futures do nothing unless you `.await` or poll them"]
 #[diagnostic::on_unimplemented(
-    message = "The type `{Self}` must implement the `ScopedFuture` trait.",
-    label = "Missing `ScopedFuture` implementation",
+    message = "`{Self}` is not a `ScopedFuture`",
+    label = "`{Self}` is not a `ScopedFuture`",
     note = "If you are trying to await a `task::Future` from within a `ScopedFuture`, note that the systems are incompatible."
 )]
 pub trait ScopedFuture<'scope> {

futures-core/src/task.rs

···
-/// A task that can be woken.
-///
-/// This acts as a handle for a reactor to indicate when a `ScopedFuture` is
-/// once again ready to be polled.
-pub trait Wake<'scope> {
+use std::{mem, ptr::NonNull, sync::atomic::AtomicPtr};
+
+// Task: Wake
+//
+// Wake must not outlive event loop/storage
+pub trait Wake<'events> {
     fn wake(&self);
+    // task can't outlive event loop -> holds &'events
+    fn register_waker(&self, waker: &'events Waker);
+}
+
+// type Waker<'events> = Option<NonNull<dyn Wake<'events>>>;
+
+pub struct Waker<'events> {
+    task: *const dyn Wake<'events>,
+}
+
+// wakers must outlive 'task
+impl<'events> Waker<'events> {
+    pub fn new(task: *const dyn Wake<'events>) -> Self {
+        Self { task: task.into() }
+    }
+
+    pub fn wake(self) {
+        unsafe { self.task.as_ref() }.inspect(|task| task.wake());
+    }
+}
+
+pub struct WakerRegistration<'events> {
+    task: &'events dyn Wake<'events>, // valid for all of 'events
+}
+
+impl<'events> WakerRegistration<'events> {
+    // slot is valid for all 'events
+    pub fn register(self, slot: &'events mut Waker<'events>) {
+        // Cast from 'events to 'static
+        //
+        // # Safety
+        //
+        // This is safe because the drop guard guarantees that the task ptr (which lives for static)
+        // becomes null when the wake is dropped, ensuring the dangling pointer is never dereferenced.
+        let dangling_task = unsafe {
+            mem::transmute::<&'events dyn Wake<'events>, *const dyn Wake<'events>>(
+                self.task,
+            )
+        };
+        slot.task = dangling_task;
+
+        (*self.task).register_waker(slot);
+    }
 }

futures-derive/src/lib.rs

···
 use proc_macro::TokenStream;
 use quote::{ToTokens, quote};
 use syn::{
-    Expr, ExprAwait, FnArg, GenericArgument, ItemFn, Pat, ReturnType,
-    Signature, parse_macro_input, visit_mut::VisitMut,
+    Expr, ExprAwait, FnArg, GenericArgument, ItemFn, ReturnType,
+    parse_macro_input, parse_quote, parse2, visit_mut::VisitMut,
 };
 
+/// Takes async fn that returns anonymous `Future` impl.
+/// Generates fn that returns `UnscopedFutureWrapper` wrapper for the the anonymous `Future` impl.
+///
+/// ```rust
+/// fn my_func<'a, 'b>(a: &'a A, b: &'b B) -> impl ScopedFuture<'a + 'b, Output = T> + 'a + 'b {
+///   let output = async move { [body] } // compilers turns this into -> impl Future<Output = T> + 'a + 'b
+///   unsafe { UnscopedFutureWrapper::from_future(output) }
+/// }
+/// ```
+///
+/// see https://rust-lang.github.io/rfcs/2394-async_await.html#lifetime-capture-in-the-anonymous-future
+/// for more context on lifetime capture
+/// - resulting ScopedFuture needs to be constrained to not outlive the lifetimes of any references
+///
+/// to actually implement this (capture all lifetimes) we use `ScopedFuture<'_> + '_` so the compiler can infer
+/// lifetimes from the anonymous future impl returned by the actual inner async fn
 #[proc_macro_attribute]
 pub fn async_scoped(_: TokenStream, item: TokenStream) -> TokenStream {
-    let mut input = parse_macro_input!(item as ItemFn);
-
+    let mut item_fn = parse_macro_input!(item as ItemFn);
     // Wraps *every* async expression within the function block with
     // `ScopedFutureWrapper`, allowing them to be treated as regular `Future`
     // impls.
···
     // This will cause a compiler error if any expression being awaited is not
     // a `ScopedFuture`, which is intentional because the `Future` and
     // `ScopedFuture` systems are incompatible.
-    ScopedFutureWrappingVisitor.visit_item_fn_mut(&mut input);
+    ScopedFutureWrappingVisitor.visit_item_fn_mut(&mut item_fn);
 
-    // Wrap the function with `UnscopedFutureWrapper` to convert it back into
-    // a `ScopedFuture`.
-    wrap_async_with_scoped(&input).into()
+    // disable async since it is moved to the block
+    item_fn.sig.asyncness = None;
+
+    // wrap block with UnscopedFutureWrapper
+    let block = *item_fn.block;
+    *item_fn.block = parse_quote! {
+        {
+            let future = async move #block;
+            unsafe { futures_compat::UnscopedFutureWrapper::from_future(future) }
+        }
+    };
+
+    let output = match &item_fn.sig.output {
+        ReturnType::Default => quote! { () },
+        ReturnType::Type(_, ty) => quote! { #ty },
+    };
+
+    let has_lifetime_dependency =
+        item_fn.sig.inputs.iter().any(|param| match param {
+            FnArg::Receiver(receiver) => receiver.reference.is_some(),
+            FnArg::Typed(pat) => has_lifetime_dependency(&pat.ty),
+        });
+
+    // set outer fn output to ScopedFuture<'_/'static, Output = #output>
+    item_fn.sig.output = if has_lifetime_dependency {
+        parse_quote! { -> impl futures_core::ScopedFuture<'_, Output = #output> + '_ }
+    } else {
+        parse_quote! { -> impl futures_core::ScopedFuture<'static, Output = #output> }
+    };
+
+    item_fn.to_token_stream().into()
 }
 
+/// This currently is impossible to do the `futures_compat` workarounds not
+/// being compatible with closures.
+///
 /// Takes async fn that returns anonymous `Future` impl.
 /// Generates fn that returns `UnscopedFutureWrapper` wrapper for the the anonymous `Future` impl.
 ///
···
 ///
 /// to actually implement this (capture all lifetimes) we use `ScopedFuture<'_> + '_` so the compiler can infer
 /// lifetimes from the anonymous future impl returned by the actual inner async fn
-fn wrap_async_with_scoped(
-    ItemFn {
-        attrs,
-        vis,
-        sig:
-            Signature {
-                constness,
-                unsafety,
-                ident,
-                generics,
-                inputs,
-                output,
-                ..
-            },
-        block,
-    }: &ItemFn,
-) -> proc_macro2::TokenStream {
-    let output = match output {
-        ReturnType::Default => quote! { () },
-        ReturnType::Type(_, ty) => quote! { #ty },
-    };
+// #[proc_macro]
+// pub fn closure(input: TokenStream) -> TokenStream {
+//     // let ExprClosure {
+//     //     attrs,
+//     //     lifetimes,
+//     //     constness,
+//     //     movability,
+//     //     capture,
+//     //     inputs,
+//     //     output,
+//     //     body,
+//     //     ..
+//     // } = parse_macro_input!(input as ExprClosure);
+//     let mut closure = parse_macro_input!(input as ExprClosure);
+//     // disable async because we move it to inner
+//     closure.asyncness = None;
+//     let body = closure.body;
+
+//     // let output = match closure.output {
+//     //     ReturnType::Default => parse_quote! { () },
+//     //     ReturnType::Type(_, ty) => parse_quote! { #ty },
+//     // };
 
-    let inner_args: Vec<syn::Ident> = inputs
-        .iter()
-        .filter_map(|param| match param {
-            FnArg::Receiver(_) => Some(quote::format_ident!("self")),
-            FnArg::Typed(typed) => {
-                if let Pat::Ident(ident) = &*typed.pat {
-                    Some(ident.ident.to_owned())
-                } else {
-                    None
-                }
-            }
-        })
-        .collect();
+//     // let outer_output =
+//     //     parse_quote! { futures_core::ScopedFuture<'_, Output = #output> + '_ };
 
-    let has_lifetime_dependency = inputs.iter().any(|param| match param {
-        FnArg::Receiver(receiver) => receiver.reference.is_some(),
-        FnArg::Typed(pat) => has_lifetime_dependency(&pat.ty),
-    });
+//     closure.body = parse_quote! {{
+//         let output = async move { #body };
+//         unsafe { futures_compat::UnscopedFutureWrapper::from_future(output) }
+//     }};
+//     // closure.output = outer_output;
+//     closure.to_token_stream().into()
+// }
 
-    let outer_output = if has_lifetime_dependency {
-        quote! { futures_core::ScopedFuture<'_, Output = #output> + '_ }
-    } else {
-        quote! { futures_core::ScopedFuture<'static, Output = #output> }
-    };
+/// Wraps a block of optionally async statements and expressions in an anonymous `ScopedFuture` impl.
+///
+/// This generates a modified block of the form:
+///
+/// ```rust
+/// {
+///   let output = async { <original block, mapped to convert all `ScopedFuture` to `Future`> };
+///   unsafe { futures_compat::UnscopedFutureWrapper::from_future(output) }
+/// }
+/// ```
+#[proc_macro]
+pub fn block(input: TokenStream) -> TokenStream {
+    // block is formed { **expr/stmt }, so we need to surround the inputs in {}
+    let input = proc_macro2::TokenStream::from(input);
+    let block_input = quote! { { #input } };
 
-    quote! {
-        #(#attrs)* #vis #constness #unsafety fn #ident #generics (#inputs) -> impl #outer_output {
-            async #constness #unsafety fn __inner (#inputs) -> #output #block
+    let mut block = parse2(block_input).expect("Failed to parse as block.");
 
-            let future = __inner(#(#inner_args),*);
+    ScopedFutureWrappingVisitor.visit_block_mut(&mut block);
 
-            unsafe { futures_compat::UnscopedFutureWrapper::from_future(future) }
+    quote! {
+        {
+            let output = async #block;
+            unsafe { futures_compat::UnscopedFutureWrapper::from_future(output) }
         }
     }
+    .into()
 }
 
 /// Determines if typed pattern contains a reference or dependency on a

futures/src/lib.rs

···
 #![no_std]
 
 pub use futures_combinators;
-use futures_compat::{ScopedFutureWrapper, UnscopedFutureWrapper};
 pub use futures_core;
 use futures_core::ScopedFuture;
 pub use futures_derive::async_scoped;
···
 }
 
 #[async_scoped]
-fn test(a: i32, b: &i32) -> () {
-    // evil().await;
-    let x = inner(a, &b).await;
-    // async {}.await;
-
-    let test_block = futures_derive::block! { 1 + 1; 2 }.await;
-
-    // let test_closure = futures_derive::closure! { |&ab, &cd| ab + cd };
-
-    // let asdf = futures_derive::closure! { |a: &i32| {
-    //     *a + b
-    // }};
-    // let x = asdf(&a).await;
+fn test(a: i32, b: &i32) -> i32 {
+    futures_derive::block! { 1 + *b; 2 }.await
 }
 
 fn test2<'a>(a: i32) {}

lifetime-guard/Cargo.toml

···
+[package]
+name = "lifetime-guard"
+version.workspace = true
+rust-version.workspace = true
+edition.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+
+[dependencies]

lifetime-guard/src/lib.rs

···
+/// Unsound Drop based guard API
+use std::{
+    cell::Cell,
+    mem,
+    pin::{Pin, pin},
+    ptr::{self, NonNull, dangling},
+};
+
+/// must not outlive strong guard
+///
+/// enforces strong guard doesn't move with ptr
+pub struct WeakGuard<'weak, T> {
+    strong: Option<&'weak StrongGuard<'weak, T>>,
+}
+
+impl<'weak, T> WeakGuard<'weak, T> {
+    pub fn register_strong(&mut self, weak: &'weak T) {
+        self.strong = Some(weak);
+    }
+}
+
+impl<'weak, T> Drop for WeakGuard<'weak, StrongGuard<'weak, T>> {
+    fn drop(&mut self) {
+        // self.weak.
+    }
+}
+
+/// outlives strong guard
+pub struct StrongGuard<'weak, T> {
+    strong: *const WeakGuard<'weak, T>,
+}
+
+// wakers must outlive 'task
+impl<'weak, T> StrongGuard<'weak, T> {
+    pub fn new(strong: *const WeakGuard<'weak, T>) -> Self {
+        Self {
+            strong: task.into(),
+        }
+    }
+}
+
+// pub struct GuardRegistration<'weak, T> {
+//     task: &'weak StrongGuard<'weak, T>, // valid for all of 'weak
+// }
+
+// impl<'weak> GuardRegistration<'weak> {
+//     // slot is valid for all 'weak
+//     pub fn register(self, slot: &'weak mut StrongGuard<'weak>) {
+//         // Cast from 'weak to 'static
+//         //
+//         // # Safety
+//         //
+//         // This is safe because the drop guard guarantees that the task ptr (which lives for static)
+//         // becomes null when the wake is dropped, ensuring the dangling pointer is never dereferenced.
+//         let dangling_task = unsafe {
+//             mem::transmute::<
+//                 &'weak dyn StrongGuard<'weak>,
+//                 *const dyn StrongGuard<'weak>,
+//             >(self.task)
+//         };
+//         slot.strong = dangling_task;
+
+//         (*self.task).register_waker(slot);
+//     }
+// }
+
+pub struct ValueGuard<T> {
+    data: T,
+    ref_guard: Cell<*const RefGuard<T>>,
+}
+
+impl<T> ValueGuard<T> {
+    pub fn new(data: T) -> Self {
+        Self {
+            data,
+            ref_guard: Cell::new(ptr::null()),
+        }
+    }
+
+    pub fn set(&mut self, value: T) {
+        self.data = value;
+    }
+}
+
+impl<T: Copy> ValueGuard<T> {
+    pub fn get(&self) -> T {
+        self.data
+    }
+}
+
+impl<T> Drop for ValueGuard<T> {
+    fn drop(&mut self) {
+        unsafe {
+            self.ref_guard
+                .get()
+                .as_ref()
+                .inspect(|guard| guard.value_guard.set(ptr::null()))
+        };
+    }
+}
+
+pub struct RefGuard<T> {
+    value_guard: Cell<*const ValueGuard<T>>,
+}
+
+impl<T> RefGuard<T> {
+    pub fn new() -> Self {
+        Self {
+            value_guard: Cell::new(ptr::null()),
+        }
+    }
+}
+
+impl<T: Copy> RefGuard<T> {
+    pub fn get(&self) -> Option<T> {
+        unsafe { self.value_guard.get().as_ref().map(|ptr| ptr.data) }
+    }
+}
+
+impl<T> Drop for RefGuard<T> {
+    fn drop(&mut self) {
+        unsafe { self.value_guard.get().as_ref() }
+            .inspect(|guard| guard.ref_guard.set(ptr::null()));
+    }
+}
+
+pub struct GuardRegistration<'a, T> {
+    value_guard: Pin<&'a ValueGuard<T>>,
+}
+
+impl<'a, T> GuardRegistration<'a, T> {
+    pub fn from_guard(value_guard: Pin<&'a ValueGuard<T>>) -> Self {
+        Self { value_guard }
+    }
+
+    pub fn register(self, slot: Pin<&'a mut RefGuard<T>>) {
+        // register new ptrs
+        let old_value_guard = slot
+            .value_guard
+            .replace(self.value_guard.get_ref() as *const ValueGuard<T>);
+
+        let old_ref_guard = self
+            .value_guard
+            .ref_guard
+            .replace(slot.into_ref().get_ref());
+
+        // annul old ptrs
+        unsafe { old_value_guard.as_ref() }
+            .inspect(|guard| guard.ref_guard.set(ptr::null()));
+        unsafe { old_ref_guard.as_ref() }
+            .inspect(|guard| guard.value_guard.set(ptr::null()));
+    }
+}