# Independent CODE review — unimem raw Block access (candidate overlay over `7b148906`)
## VERDICT: APPROVE
Conditional on finding **F1** landing in the same commit/session. The eight Safety sections, receiver changes, test initialization, preflight ABI and ordering duties all hold under independent re-derivation. No soundness defect found in the changed source.
---
## Verified duties (independently re-derived, not inherited)
**`mut_from_ref` removal / exclusive receivers.** `block.rs` has no `#[allow(clippy::mut_from_ref)]`; `as_bytes_mut`/`as_f32_mut`/`as_u16_mut` take `&mut self`. The Block→memory boundary is now closed inside unimem: `Block` otherwise exposes only `address()`/`handle()` (raw), `Tape::block() -> &Block` cannot yield a mutable view, `Layout` reaches memory only through `&Tape`, `Cell::bytes` was already unsafe. No `Deref`/`AsRef`/`Index` leak — `Drop` is Block's only trait impl.
**Eight `# Safety` sections, read for content (the lint only checks presence).** All six views state full-extent initialization *including padding* with explicit typed extents (`size()/4*4`, `size()/2*2`), the "even to inspect len/pointer" clause, shared-vs-exclusive exclusion, cross-thread/raw/retained-import scope, and prior device completion/visibility. `Tape::warm` adds "no live typed value may be invalidated" and states the stride does not initialize the allocation. `Gpu::wrap` carries runtime-page + single-VM-region, "Block creation alone does not prove compatibility", owner retention through Buffer lifetime and all encoded/in-flight uses, and bidirectional shared-storage ordering. `buffer_wrap` is expanded with "Never round beyond backing." Substantive, not boilerplate.
**Fixed-stride warm.** Body unchanged except the receiver; `#[mutants::skip]` retained; the `16384` comment now says "Fixed warming stride, not a queried VM page size." `start_warm`'s internal proof is genuine (fresh unpublished local, no takes issued). I checked the new oracle against the actual loop for `actual` ∈ {<16K, 16K, 16K+13, 32K, 32K+1}: the `pages = total/page` loop plus the `!is_multiple_of` tail write zero exactly the offsets the test expects in every case, so the test is robust to the native extent and would catch a stride change, a tail off-by-one, a whole-buffer memset, or cursor mutation.
**Preflight ABI.** I recomputed the SDK layout under `pragma pack(4)`: `protection@0, max_protection@4, inheritance@8, offset@12, user_tag@20, ref_count@24, shadow_depth@28, external_pager@30, share_mode@31, is_submap@32, behavior@36, object_id@40, user_wired_count@44, flags@46` → 48 bytes / 12 `natural_t`. The Rust mirror matches field-for-field and asserts size 48, align 4, `offset_of(is_submap) == 32`. All six FFI parameter types match `mach_vm.h:299–313` (`vm_map_read_t`=u32, addresses/sizes u64, `natural_t`/`mach_msg_type_number_t`=u32, `int*` info, `kern_return_t`=int); no `object_name` out-param, so no send right. `&info.is_submap` / `&info.protection` are legal despite `packed(4)` because both are 4-aligned at 4-multiple offsets (a reference to `offset: u64` would be E0793 — it is never taken). Containment uses the kernel-returned `start`/`size` against the full actual extent with checked arithmetic, so it can only over-reject; `depth=u32::MAX` + `is_submap==0` is the leaf condition from the pinned XNU body, and the purgeable fake-region path returns `vm_map_last_entry→vme_end`, which containment rejects. Rounding is correct ceil-to-page, and alignment is then **asserted on the actual** `address()`/`size()`, never inferred from the request.
**Owner retention and submit/wait/status ordering.** Declaration order in both GPU fixtures puts Blocks first, so reverse-drop releases Buffers (and Commands/Encoder) before the mapping. `wrap_block_vecadd` has no `?` between `submit()` and `wait()`, and `wait()` precedes both assertions — so a `status`/`error` panic unwinds with no work in flight. A failure in the middle of the three-`wrap` tuple drops the already-built Buffer before the Blocks. `gpu_buffer_wrap` replaces the manual `std::alloc` + uninitialized `from_raw_parts_mut::<f32>` with an owning page-sized Block, removing both the uninitialized-reference construction and the fallible `dealloc`, and asserts returned-size equality. ANE: the `as_u16_mut` borrow ends before `run_direct`; owners stay live; the inherited private-API synchronous-completion assumption is recorded in-place rather than laundered into a proof.
**Named nightly witnesses.** 12 new `compile_fail` cases: E0133 ×8 (six views + `warm` + `wrap`), E0596 ×2 (`&Block`, `&Tape`), E0499, E0502. The borrow-check cases wrap calls in `unsafe` so E0133 cannot pre-empt the intended code, and use both borrows afterward so NLL cannot discard the witness. 12 + 2 pre-existing `BlockPlan` cases = the 14 the nightly receipt reports.
**Native tests.** Initialization covers the *actual* extent everywhere a typed view is formed; endpoint-only raw tests (`block_large`, `large_extent_equality…`) stay endpoint-only, avoiding a 256 MiB memset. `native_alignment_extent_and_raw_row_boundaries` keeps its `vec![0xA5; allocation]` oracle. `awkward_extents…` exercises 1/13/5 with lane-order round-trips; `chunks_exact(2)`/`(4)` correctly cover exactly the typed-view bytes even for odd extents. The thread test does scoped concurrent reads under no-writer, then exclusive write after joins — and is explicitly not a publication claim.
**Evidence discipline.** Emitted-lint sets are kept distinct from target coverage: the candidate `-W` run emitting 1 error vs the parent's 36 is attributed to masking, not repair, and the 6 new warnings are traced to the complete parent fixture gate. The strict `-D` set is byte-identical to parent `clippy-pinned` after stripping progress lines; the first mislabelled comparison is retained alongside its correction. Consumer results are split causally: xena = unsafe-call only (receiver already `&mut`), erga/bita = receiver/ownership redesign, mir/bbg/evy/nika/trisha/cyb = reproduced pre-existing or incomplete-closure. No external `unsafe` was applied. Semver detects 7 unsafe additions + 4 receiver changes in unimem and `Gpu::wrap` in aruminium; the tag baseline failure yields no verdict.
---
## Findings
**F1 (blocking before commit) — moved historical claims live in no repo file, and the spec link dangles.** `unimem/specs/README.md` now points at `../../audit/2026-10-10-unimem-block-access/README.md#historical-iosurface-claims`, which is absent from the 16-path overlay. The §Layer 1 table, the `:460` verified-experiments row and the NEON/AMX projection sentence are deleted from the spec and currently exist only in `/tmp` artifacts. I confirmed the preserved bytes are exact (snippets `table_verbatim`/`row_verbatim` match the diff removals character-for-character; the draft section reproduces both with the correct missing-provenance disclaimer and substitutes no fresh number), so this is sequencing, not loss — but until the audit file lands, a packaged spec ships a broken link and the evidence has no system of record. Land it in the same session.
**F2 — `source-v1.json` records the superseded snippets hash.** `historical_snippets_json_sha256 = 053e2ef5…` while the shipped artifact is `53a92d8f…`. Disclosed and intentional, but a future reader checking the manifest against the included file will see a mismatch. State the supersession inside `source-v1.json` (or in the audit) rather than only in the review brief.
**F3 — erga `rtable-bench` and xena GPU/bench obligations are masked, not enumerated.** Compilation stops at `blake-bench` and `xena-hash`, so `RTable::build_parallel`/`cpu_checksum` (`as_bytes_mut(&self)`, `as_bytes(&self)`) and the xena-gpu/xena-bench `wrap` sites never emit. The receipts say "earlier failures are masked" generically; add the per-path note so the consumer migration scope is not understated.
**F4 — source/spec asymmetry on Tape.** `api-sketch.md` and `specs/README.md` carry the new Tape duty wording, but `tape.rs`'s `// Block is Send+Sync, head is atomic.` above the `unsafe impl`s was left at base while `block.rs`'s equivalent comment was rewritten. Cosmetic, but it is the only place a reader of the source alone gets the old framing.
**F5 — nits.** `Cell::bytes` still lacks an inner `unsafe` block, inconsistent with the new house style (grid.rs was scoped documentation-only, so this is deliberate, not a regression). In `block_access.rs` the `block_cross_view_f32_bytes` SAFETY comment is swallowed into a rustfmt trailing-comment continuation and reads poorly. `import_memory` asserts `page > 0` where `block_creation.rs` asserts `page > 1`. `contents_ptr` remains a safe fn carrying a `# Safety` heading (pre-existing shape; content correctly replaced).
---
## Explicit non-certifications
No global unimem/Buffer/Grid safety. Left open and named as **pre-existing**: `Grid::give`/`take` foreign-index arithmetic (a `Cell` from `Grid<64,100>` given to `Grid<64,2>` yields an out-of-bounds pointer from *safe* `take`/`address`), `Grid::new`'s unchecked `CELL_SIZE * CELLS`, `Tape` raw-take retention, and `Buffer::write`/`as_bytes`/`read_f32` — which still provide a **safe** path to an aliasing `&mut [u8]` over an imported Block's memory. This unit closes unimem's own boundary and marks the import boundary; it does not repair the GPU wrapper's safe APIs, and nothing here asserts otherwise. No physical-address or universal IOSurface single-region geometry claim — the fixture preflight proves only its current mapping. No all-green rings: workspace `fmt` (1) and `-D warnings` (101) stay red and attributed to pre-existing aruminium/acpu code; full-workspace lint coverage and the v0.2.0 tag comparison are unresolved; cyb/nika/trisha/evy closures were unavailable. No Kadek row-6 closure, no compatibility approval, and no version/release/tag/publish action — the intentional unsafe/receiver breaks reach all pinned path consumers and require reviewed per-consumer migrations.