From 44fce6585c4dc4a70743e9c127d12b3eeaef4859 Mon Sep 17 00:00:00 2001
From: Georg Bauer <gb@rfc1437.de>
Date: Sat, 25 Jul 2026 13:02:13 +0200
Subject: [PATCH] Document Metal buffer view ownership

---
 src/engine/metal/gpu.rs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/engine/metal/gpu.rs b/src/engine/metal/gpu.rs
index a473659..3c2b0e8 100644
--- a/src/engine/metal/gpu.rs
+++ b/src/engine/metal/gpu.rs
@@ -846,6 +846,10 @@ impl Buffer {
     }
 
     pub(super) fn view(&self, offset: u64, bytes: u64) -> Result<Self, String> {
+        // SAFETY: native/metal/ds4_metal.m:7916-7940 bounds-checks the view,
+        // ARC-retains base_obj.buffer at :7926, and marks the view non-owning at
+        // :7929, so it may outlive and be freed independently of this wrapper.
+        // Recheck those guarantees whenever the vendored Metal file is re-synced.
         NonNull::new(unsafe { ds4_gpu_tensor_view(self.raw(), offset, bytes) })
             .map(Self)
             .ok_or_else(|| "Metal could not create a tensor view".to_owned())