# Design

> UForm for Rust

- __A thin layer over the C ABI.__
  One private module per header, `types`, `model`, `encode` and `train`, re-exported flat; every public name is its C name without `uform_` and `_t` in CamelCase, a verb's argument struct becomes its `*Config`, and every wrapper's documentation names the C symbol it calls.
  Enums mirror the C enums through the C name functions, never strings.
- __The receiver chooses, the verb stays.__
  `&Model` runs a verb on the calling thread, `on(&executor)` blocks on an executor, and `deferred(&executor)` submits it, all with the same arguments.
- __Deferred calls use the language's own idioms.__
  `status` polls through `uform_outcome_status`, `wait` blocks through `uform_outcome_wait`, and a `Deferred` is `IntoFuture`, so `.await` polls the status word, since the library has no wake-up.
- __No life of its own.__
  The binding starts no threads and keeps no queues or caches; releasing a `Deferred` rides `Drop`, which waits for the call first.
- __Arenas are lent and reused, never shared.__
  Every output verb takes an arena and answers views borrowing it, so the borrow checker retires stale views at compile time.
- __Nothing costs anything until it is used.__
  Blocking calls take no deferred-table entry and allocate no box, a surface `Outputs` leaves out is never computed, and an arena allocates only when a call writes into it.
- __A deferred receiver refuses borrowed inputs at compile time.__
  The `Accepts` bound admits only owned inputs, so a borrow the library would read after the verb returns never compiles.
- __Suites run against the stub library__, and against the real one with the tiny checkpoint.