Identifiers inside a macro expansion live in a separate namespace from the caller's code. A macro cannot accidentally shadow, capture, or conflict with variables at its call site. Naming collisions are structurally prevented.

A procedural macro is a function from TokenStream to TokenStream — arbitrary Rust code that runs at compile time. But its output is still bound by every invariant the compiler enforces. Full power, zero privilege.

macro_rules! can only match on the syntactic structure of tokens — it cannot inspect types, evaluate expressions, or make semantic decisions. This constraint keeps macro expansion predictable and bounded.

Rust macros generate code at compile time — but every expansion must pass the same type checking, borrow checking, and lifetime analysis as hand-written code. The macro writes; the compiler judges.

Everything in Rust is private by default. Modules enforce encapsulation at the language level — internal implementation stays internal unless you explicitly expose it. This is how Rust makes invalid states unrepresentable from outside your API.

The kernel never trusts you. Every system call crosses a hardware-enforced privilege boundary — and that boundary is the most important invariant in the entire OS.

An operating system is a collection of invariants — promises the kernel makes to every program. This post names them.

Closures capture their environment under the same ownership rules as everything else in Rust. Iterators are lazy, composable, and compile down to the same code as hand-written loops. Functional style, systems performance.

Vec, String, and HashMap are the workhorses of Rust. Each one owns its data on the heap and enforces invariants the compiler alone can't — contiguous memory, valid UTF-8, unique keys.

Lifetimes are the compiler's proof that every reference points to valid data. You don't control how long things live — you help the compiler verify that references never outlive what they point to.