Make pointer Read witnesses unsafe

The public Read witness is trusted by pointer conversions to prove that
unsynchronized reads are permitted, but downstream code could previously
implement it without taking responsibility for that invariant.

Make Read an unsafe trait, document its implementor obligation, and justify
the two built-in implementations. Add a compile-fail regression showing that
the original safe witness implementations now require unsafe impls.

Closes #3613

*Authored by an AI agent acting on Josh Liebow-Feeser's behalf.*

gherrit-pr-id: Gugofjuaaownqfvbulg6lh72eul7phdgb

Author: joshlf

zerocopy/src/pointer/invariant.rs

@@ -253,16 +253,20 @@ unsafe impl<ST: ?Sized, DT: ?Sized> CastableFrom<ST, Initialized, Initialized> f
 ///
 /// # Safety
 ///
-/// `T: Read<A, R>` if either of the following conditions holds:
+/// Implementors must ensure that either of the following conditions holds:
 /// - `A` is [`Exclusive`]
-/// - `T` implements [`Immutable`](crate::Immutable)
+/// - `Self` implements [`Immutable`](crate::Immutable)
 ///
 /// As a consequence, if `T: Read<A, R>`, then any `Ptr<T, (A, ...)>` is
 /// permitted to perform unsynchronized reads from its referent.
-pub trait Read<A: Aliasing, R> {}
+pub unsafe trait Read<A: Aliasing, R> {}
 
-impl<A: Aliasing, T: ?Sized + crate::Immutable> Read<A, BecauseImmutable> for T {}
-impl<T: ?Sized> Read<Exclusive, BecauseExclusive> for T {}
+// SAFETY: `T: Immutable`, satisfying the second condition of `Read`'s safety
+// contract.
+unsafe impl<A: Aliasing, T: ?Sized + crate::Immutable> Read<A, BecauseImmutable> for T {}
+// SAFETY: The aliasing argument is `Exclusive`, satisfying the first condition
+// of `Read`'s safety contract.
+unsafe impl<T: ?Sized> Read<Exclusive, BecauseExclusive> for T {}
 
 /// Unsynchronized reads are permitted because only one live [`Ptr`](crate::Ptr)
 /// or reference may exist to the referent bytes at a time.

zerocopy/tests/ui/read-requires-unsafe-impl.msrv.stderr

@@ -0,0 +1,15 @@
+error[E0200]: the trait `zerocopy::pointer::Read<Shared, CallerReason>` requires an `unsafe impl` declaration
+  --> $DIR/read-requires-unsafe-impl.rs:19:1
+   |
+19 | impl Read<Shared, CallerReason> for Cell<Vec<u8>> {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+error[E0200]: the trait `zerocopy::pointer::Read<Shared, CallerReason>` requires an `unsafe impl` declaration
+  --> $DIR/read-requires-unsafe-impl.rs:22:1
+   |
+22 | impl Read<Shared, CallerReason> for Vec<u8> {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+error: aborting due to 2 previous errors
+
+For more information about this error, try `rustc --explain E0200`.

zerocopy/tests/ui/read-requires-unsafe-impl.nightly.stderr

@@ -0,0 +1,27 @@
+error[E0200]: the trait `zerocopy::invariant::Read<Shared, CallerReason>` requires an `unsafe impl` declaration
+  --> $DIR/read-requires-unsafe-impl.rs:19:1
+   |
+19 | impl Read<Shared, CallerReason> for Cell<Vec<u8>> {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: the trait `zerocopy::invariant::Read<Shared, CallerReason>` enforces invariants that the compiler can't check. Review the trait documentation and make sure this implementation upholds those invariants before adding the `unsafe` keyword
+help: add `unsafe` to this trait implementation
+   |
+19 | unsafe impl Read<Shared, CallerReason> for Cell<Vec<u8>> {}
+   | ++++++
+
+error[E0200]: the trait `zerocopy::invariant::Read<Shared, CallerReason>` requires an `unsafe impl` declaration
+  --> $DIR/read-requires-unsafe-impl.rs:22:1
+   |
+22 | impl Read<Shared, CallerReason> for Vec<u8> {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: the trait `zerocopy::invariant::Read<Shared, CallerReason>` enforces invariants that the compiler can't check. Review the trait documentation and make sure this implementation upholds those invariants before adding the `unsafe` keyword
+help: add `unsafe` to this trait implementation
+   |
+22 | unsafe impl Read<Shared, CallerReason> for Vec<u8> {}
+   | ++++++
+
+error: aborting due to 2 previous errors
+
+For more information about this error, try `rustc --explain E0200`.

zerocopy/tests/ui/read-requires-unsafe-impl.rs

@@ -0,0 +1,25 @@
+// Copyright 2026 The Fuchsia Authors
+//
+// Licensed under a BSD-style license <LICENSE-BSD>, Apache License, Version 2.0
+// <LICENSE-APACHE or https://www.apache.org/licenses/LICENSE-2.0>, or the MIT
+// license <LICENSE-MIT or https://opensource.org/licenses/MIT>, at your option.
+// This file may not be copied, modified, or distributed except according to
+// those terms.
+
+#![forbid(unsafe_code)]
+
+include!("../include.rs");
+
+use std::{cell::Cell, vec::Vec};
+
+use zerocopy::pointer::invariant::{Read, Shared};
+
+struct CallerReason;
+
+impl Read<Shared, CallerReason> for Cell<Vec<u8>> {}
+//~[msrv, stable, nightly]^ ERROR: requires an `unsafe impl` declaration
+
+impl Read<Shared, CallerReason> for Vec<u8> {}
+//~[msrv, stable, nightly]^ ERROR: requires an `unsafe impl` declaration
+
+fn main() {}

zerocopy/tests/ui/read-requires-unsafe-impl.stable.stderr

@@ -0,0 +1,27 @@
+error[E0200]: the trait `zerocopy::invariant::Read<Shared, CallerReason>` requires an `unsafe impl` declaration
+  --> $DIR/read-requires-unsafe-impl.rs:19:1
+   |
+19 | impl Read<Shared, CallerReason> for Cell<Vec<u8>> {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: the trait `zerocopy::invariant::Read<Shared, CallerReason>` enforces invariants that the compiler can't check. Review the trait documentation and make sure this implementation upholds those invariants before adding the `unsafe` keyword
+help: add `unsafe` to this trait implementation
+   |
+19 | unsafe impl Read<Shared, CallerReason> for Cell<Vec<u8>> {}
+   | ++++++
+
+error[E0200]: the trait `zerocopy::invariant::Read<Shared, CallerReason>` requires an `unsafe impl` declaration
+  --> $DIR/read-requires-unsafe-impl.rs:22:1
+   |
+22 | impl Read<Shared, CallerReason> for Vec<u8> {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: the trait `zerocopy::invariant::Read<Shared, CallerReason>` enforces invariants that the compiler can't check. Review the trait documentation and make sure this implementation upholds those invariants before adding the `unsafe` keyword
+help: add `unsafe` to this trait implementation
+   |
+22 | unsafe impl Read<Shared, CallerReason> for Vec<u8> {}
+   | ++++++
+
+error: aborting due to 2 previous errors
+
+For more information about this error, try `rustc --explain E0200`.