# The borrow checker The rule is one line: **aliasing XOR mutability**. At any point in the program, a place has either any number of shared borrows, or exactly one exclusive borrow, never both. ```cplus var v: vec::Vec[i32] = vec::new::[i32](); v.push(1); let n: usize = v.len(); // shared borrow — fine let p: i32 = vec::at_copy::[i32](v, 0 as usize); // shared borrow — fine v.push(2); // exclusive — but no live shared borrow now; fine ``` Because shared borrows can read but not mutate, and the single exclusive borrow is the only one allowed to mutate, two threads or two code paths can never hold a writer and a reader of the same place at once. That is why data races do not compile. ## The common diagnostics - **E0372**: move out of a borrowed value (including moving a `Vec` while a slice of it is live). - **E0381**: exclusive use of a place that is already borrowed (a field write, a `ref` argument, or a mutating method while a view or loan is live). - **E0383**: read while exclusively borrowed. - **E0370** family: overlapping incompatible borrows. - **E0513**: a view of a dying owner escapes the function (returned directly, or inside a returned aggregate). - **E0514**: a value dies while a scope or promoted raw pointer still holds a view of it. - **E0516**: a view stored through a raw pointer (`*p = v`, or `(*p).f = v`) is undeclared flow at the raw seam. ## Views are tracked by shape A `str` or `T[]` is a borrow written as a value. The checker follows the *shape*, not a method-name allowlist, through every form it can leak: - Returning `t.view()`, `as_str` / `as_slice`, or any user method that returns `str` / `T[]` from a borrowing receiver is **E0513** when the owner is a local. - A `take` parameter or `take this` is a dying root: a returned view of it is **E0513**. - `return head(local)` where `head(x) -> str` returns a view of its parameter is rooted at `local`. - `let s = mk().view();` (a view of a statement-scoped temporary) is rejected; passing such a view as a direct call argument stays legal. - Storing a view of a frame-dying owner into a `static` or a `ref` out-parameter is rejected. - A view written into a field or index, produced by an `if` / block / `match` expression, or moved out by a struct destructure pins its owner (**E0372** / **E0381**). - A slice of a `Vec[T]` (or any generic Drop type) pins it: moving it is **E0372**, `append` while the slice is live is **E0381**. A read-only method alongside a live view stays legal. - A raw-pointer-returning function whose computed return flow carries a view-capable parameter has that flow promoted to a return borrow, so the caller ties the pointer to the argument's owner. `#[keeps(nothing)]` opts a declared boundary out. A mutating method call on a borrowed place was already refused; a plain field write, and passing the place as a `ref` argument, now are too. ## The fix is almost always a scope boundary When two borrows conflict, the fix is usually to end one before the other begins, by introducing a scope so they do not co-exist: ```cplus { let r: i32 = vec::at_copy::[i32](v, 0 as usize); #println(r); } // shared borrow ends here v.push(99); // exclusive borrow now fine ``` The borrow checker reasons within a function boundary. For the full picture of what it enforces versus what it trusts you to uphold (views and raw pointers), see [Ownership](/docs/ownership). ## Next Continue with [error handling](/docs/error-handling).