DefaultViewInstance is not actually unsafe

[techninja1008]

buffa/buffa/src/view.rs

Lines 200 to 226 in 3f80d56

	/// Provides access to a lazily-initialized default view instance.
	///
	/// View types implement this trait so that [`MessageFieldView`] can
	/// dereference to a default when unset, just as [`MessageField`](crate::MessageField)
	/// does for owned types via [`DefaultInstance`](crate::DefaultInstance).
	///
	/// Generated view types like `FooView<'a>` contain only covariant borrows
	/// (`&'a str`, `&'a [u8]`, etc.). A default view contains only `'static`
	/// data (`""`, `&[]`, `0`), so a `&'static FooView<'static>` can be safely
	/// reinterpreted as `&'static FooView<'a>` for any `'a` via covariance.
	///
	/// This trait is implemented for the `'static` instantiation (e.g.,
	/// `FooView<'static>`) and the [`MessageFieldView`] `Deref` impl uses
	/// a lifetime transmute to serve it for any `'a`.
	///
	/// # Safety
	///
	/// Implementors must ensure:
	/// 1. The returned reference points to a validly-initialized default
	/// instance in a `'static` location that is never mutated.
	/// 2. The type is **covariant** in all lifetime parameters — the default
	/// `'static` instance must be safely reinterpretable at any shorter
	/// lifetime.
	pub unsafe trait DefaultViewInstance: Default + 'static {
	/// Return a reference to the single default view instance.
	fn default_view_instance() -> &'static Self;
	}

Similar to #68, the DefaultViewInstance trait is not actually unsafe. Both safety invariants that it tries to protect from are already handled by rust's type system.

[techninja1008]

To elaborate on the second invariant: the type doesn't actually need to be covariant in any contained lifetime parameters for the &'static Self to be shortened to another lifetime. The only requirement is that the 'static lifetime in &'static Self is covariant, which it is definitionally (see the variance table on https://doc.rust-lang.org/nomicon/subtyping.html).

[iainmcgin]

[claude code]

Agreed — same root cause as #68 (vestigial unsafe from the pre-OnceBox era; both invariants are already enforced by -> &'static Self). See #68 (comment) for the full history and plan.

One scoping note: the adjacent HasDefaultViewInstance trait will stay unsafe — its layout-identity + covariance contract is relied on by a real unsafe pointer cast in Deref for MessageFieldView, so a safe-but-wrong impl there is genuinely UB-inducing.

We'll fix this together with #68 as part of the v0.4.0 breaking-change batch.

[iainmcgin]

[claude code] Fixed by #70 (drop unsafe from DefaultViewInstance) and #71 (remove HasDefaultViewInstance entirely — covariance is now compiler-checked at the impl site). Will ship in v0.4.0.