`GhostCell` and `GhostToken`, as per https://plv.mpi-sws.org/rustbelt/ghostcell/.

これからRustを学ぶなら、手を動かして何作ってみる？――yuki氏が提案するのは「連結リスト」。BoxやRc、さらにunsafeやGhostCellまで駆使してRust特有のメモリ管理の壁を突破する、サンプルコード付き解説記事。

Below is the same solution as @kpreid, just different words. So I'll put the unique part here at the top, even though it may not matter to you. One can borrow as many `Stuff`s as they want with a single piece of `Gold`, so long as it's one at a time. One can reborrow the same `Stuff` in the closure. There's also no way in the OP to pair a particular `Stuff` with a particular `Gold`. How much any of this matters, I can't tell from the OP. You may be interested in `GhostCell` and the branded types discussion in the paper. * * * Here starts the "same solution" portion of my reply. First, you have an unnecessary `&mut _` here for some reason: *self = cell.borrow_mut(&mut gold); That's creating a temporary `&mut &mut Gold` which can't outlive the function body (because `gold` goes out of scope at the end of the function body if not moved), and reborrowing through the temporary. This makes it impossible to get back a long enough lifetime for the assignment to `*self`. Let's just fix that first to avoid problems later. - *self = cell.borrow_mut(&mut gold); + *self = cell.borrow_mut(gold); Now you're moving `gold` in the call to `borrow_mut`,[1] instead of trying to reborrow through a temporary `&mut &mut Gold`. Playground, which still errors for other reasons. beholdnec: > It seems to think the gold is still held by the closure, but that isn't my intention. Neither the closure nor its result value should hold a reference to the gold after the closure has completed execution. Here's where we're at now: let result = f(gold); // same as: f(&mut *gold); *self = cell.borrow_mut(gold); You need to first reborrow the `Gold` (`*gold`) for some lifetime that expires by the time `f` returns, or else you can't move `gold`2] in the call to `cell.borrow_mut`. But the generic parameters of functions are chosen by the caller, and the caller here is free to choose any lifetime less than or equal to `'a` -- including `'a`.[[3] Which means the function body must assume the reborrow is valid for as long as the original `&'a mut Gold` was valid. Which is longer than the function body. Which means you can't use `gold` again after calling `f(gold)`. You want the function body to "choose" (infer) the lifetime of the reborrow, not the caller. The only way to convey that in the bound is to require the closure `F` to accept any `&mut Gold` (with any lifetime), not just a `&'b mut Gold` with a lifetime `'b` of their choosing. We type that like so: fn unborrow_then<F, T>(&mut self, f: F) -> T where F: for<'b> FnOnce(&'b mut Gold) -> T Or with elision fn unborrow_then<F, T>(&mut self, f: F) -> T where F: FnOnce(&mut Gold) -> T And now when you call `f(&mut *gold)`, you can pass in a reborrowed `&mut Gold` with a lifetime that ends immediately after the call, which allows `gold` to be usable on the next line. Compiling playground. * * * 1. or perhaps technically reborrowing `*gold` for the same lifetime, but they amount to the same thing ↩︎ 2. or reborrow `*gold` ↩︎ 3. There's actually a lower bound -- they can't choose a lifetime shorter than the function body. ↩︎

Easier said than done. Unless you have _actually_ proven it via Coq or similar, I find the code terrifying. There is precedent in proving the aliasing rules have not been violated, but good luck with that. @RalfJung is a professor at ETH Zürich, so it's not surprising he and company could formally prove GhostCell is correct. For most mortals though, such an undertaking is out of our league.