The code changes. The frameworks change. The invariants don’t.
Systems, Rust, and the properties that make software worth trusting.
Sixty processes want the CPU. Four cores exist. The scheduler decides who runs, for how long, and what happens when everyone wants more. This post names the invariant it must keep.
The OS has a page cache. The database ignores it and builds its own. This post explains why — and how the buffer pool decides what stays in RAM.
A process is not a program. It's the kernel's most fundamental illusion — a private machine that never existed. This post opens the box.
Databases don't read bytes. They read pages — fixed-size blocks that turn random I/O into something the disk can handle. This post explains why.
A database is not a spreadsheet with an API. It's a system that makes promises about your data — and spends extraordinary effort keeping them.
Identifiers inside a macro expansion live in a separate namespace from the caller's code. A macro cannot accidentally shadow, capture, or conflict with variables at its call site. Naming collisions are struc...
A procedural macro is a function from TokenStream to TokenStream — arbitrary Rust code that runs at compile time. But its output is still bound by every invariant the compiler enforces. Full power, zero priv...
macro_rules! can only match on the syntactic structure of tokens — it cannot inspect types, evaluate expressions, or make semantic decisions. This constraint keeps macro expansion predictable and bounded.
Rust macros generate code at compile time — but every expansion must pass the same type checking, borrow checking, and lifetime analysis as hand-written code. The macro writes; the compiler judges.
Everything in Rust is private by default. Modules enforce encapsulation at the language level — internal implementation stays internal unless you explicitly expose it. This is how Rust makes invalid states u...
The kernel never trusts you. Every system call crosses a hardware-enforced privilege boundary — and that boundary is the most important invariant in the entire OS.
An operating system is a collection of invariants — promises the kernel makes to every program. This post names them.
Closures capture their environment under the same ownership rules as everything else in Rust. Iterators are lazy, composable, and compile down to the same code as hand-written loops. Functional style, system...
Vec, String, and HashMap are the workhorses of Rust. Each one owns its data on the heap and enforces invariants the compiler alone can't — contiguous memory, valid UTF-8, unique keys.
Lifetimes are the compiler's proof that every reference points to valid data. You don't control how long things live — you help the compiler verify that references never outlive what they point to.
Generics let you write code that works for many types without sacrificing type safety or performance. The compiler generates specialized code for each concrete type — zero cost, full safety.
Traits define shared behavior across types — and the compiler guarantees every type that claims to implement a trait actually does. This is polymorphism with compile-time proof, not runtime hope.
Rust splits errors into two categories: unrecoverable (panic) and recoverable (Result). The compiler forces you to handle the recoverable ones. You cannot ignore a Result — the type system won't let you.
Enums let you define a type by listing its possible variants. match forces you to handle every single one. The compiler guarantees you never forget a case — and Option guarantees you never forget about absence.
Invariants aren't just for distributed systems. They're in every parser, every format, every function boundary. Here's where I found them while implementing TOON in Rust.
Instantiate, Execute, Query — three message types, three classes of invariants. How CosmWasm contracts enforce valid state transitions through typed messages and ownership checks.
Smart contracts don't have main(). They have entry points — and each one enforces a different invariant about how the outside world can interact with on-chain state.
Every .unwrap() is an invariant you haven't enforced. Proper error handling transforms silent crashes into explicit contracts about what can go wrong and how the program responds.
The decrypt command closes the loop. The round-trip invariant — decrypt(encrypt(plaintext, key), key) == plaintext — is the single property that proves the entire system works. If it fails, nothing else matt...
Encryption is an invariant transformation: given a key K and plaintext P, the ciphertext C must be deterministic, reversible with K, and indistinguishable from random data without K. The encrypt command must...
A cryptographic key that is too short, predictable, or improperly encoded is worse than no key at all. The generate command must uphold a strict invariant: the output is always a correctly-sized, random, pro...
Every CLI application is a contract between the program and the user. Clap helps us encode that contract as invariants — required arguments, valid subcommands, and structured input — enforced before a single...
Structs let you define your own types — and your own invariants. By controlling construction, field access, and method behavior, you decide what 'valid' means for your data.
Rust's borrowing rules encode a fundamental invariant: you can have many readers or one writer, but never both. This single rule eliminates data races at compile time.
Ownership is not a feature of Rust. It IS Rust. Three rules, enforced at compile time, that eliminate use-after-free, double-free, and data races — without a garbage collector.
Every function in Rust is a boundary — and every boundary is a place where invariants are declared. Parameter types, return types, and the expression system all enforce contracts the compiler checks.
In Rust, every branch of a conditional must agree on its type. Every loop has explicit termination semantics. Control flow isn't just syntax — it's a set of invariants the compiler enforces.
Rust is statically typed — every value has a type known at compile time. This isn't a convenience feature. It's an invariant that eliminates entire categories of runtime failures.
Every Cargo command upholds a specific contract. Build guarantees compilation. Test guarantees verification. Publish guarantees distribution. Here's the full reference.
Cargo isn't just a convenience tool. It enforces a set of invariants about how Rust projects are structured, built, and distributed — so you can't accidentally break the build.
Rust isn't just another systems language. It's a language that encodes invariants — memory safety, thread safety, type correctness — directly into the compiler. Here's where it starts.
A block cipher encrypts fixed-size blocks. Modes of operation define how to encrypt messages longer than one block — and each mode upholds (or fails to uphold) different invariants.
AES is built from four operations, each preserving a specific invariant. Remove any one of them and the cipher breaks in a distinct, predictable way.
Block ciphers are the workhorses of modern encryption. They trade the mathematical perfection of the One-Time Pad for practical invariants that can actually be maintained at scale.
The One-Time Pad is the only encryption scheme with a mathematical proof of perfect secrecy. Its invariants are simple but brutally strict — violate any one of them and the guarantee vanishes entirely.
Cryptography is the discipline of preserving invariants over untrusted channels. Confidentiality, integrity, authenticity — these are guarantees that must hold no matter what.
On the one principle that separates resilient systems from fragile ones.
No entries here yet. Try another collection or search.