Pointers

C++ RAII, extended across the network.

A remote object's lifetime is managed by the same smart-pointer discipline you already use locally. rpc::shared_ptr keeps a distributed reference count across every zone that holds the object — so a remote object lives exactly as long as something, somewhere, still needs it.

A reference count that spans machines

When zone A shares an object with B, and B passes that reference on to C, the object in A keeps a live count of two. It is reclaimed only when both B and C have released their pointers — even though A has no direct connection to C. The count is maintained across the hops automatically; you never write the bookkeeping.

ZONE A object i_foo live reference count: 2 ZONE B shared_ptr ZONE C shared_ptr holds passed on C still counts against the object in A — two hops away

rpc::shared_ptr<T>

The cross-boundary equivalent of std::shared_ptr. RAII ownership with a distributed reference count: the object stays alive as long as any zone holds a pointer to it, then is destroyed deterministically when the last one is released. This is the default tool for passing objects between zones.

rpc::optimistic_ptr<T>

A callable weak pointer: it keeps the channel to the remote object open but does not own its lifetime. Use it for long-lived services that outlive any one caller — a database, an LLM — and to break the circular dependencies that arise when two peers each hold a reference to the other. A call through it can fail if the object is gone; that is the point.

Zone death

A zone is kept alive by references the same way an object is — references to objects in the zone, from the zone as outbound proxies, and through the zone as passthroughs routing other traffic. When the last of these is released, the zone dies and its objects are reclaimed. Lifetimes compose: releasing a pointer in one process can be what finally tears down a zone several hops away.

Why the standard pointers are not enough

std::shared_ptr / std::weak_ptr Reference-count only within a single address space. They cannot see, let alone coordinate, holders in another process, machine, or enclave.
std::unique_ptr Single-owner semantics with no notion of a remote holder — there is nothing to transfer ownership to across a boundary.
rpc::shared_ptr Distributed reference count with correct multi-hop lifetime; deterministic destruction when the last holder anywhere releases.
rpc::optimistic_ptr Non-owning callable reference for stable long-lived objects; breaks cross-zone cycles without leaking lifetimes.

One rule holds throughout: never mix rpc::shared_ptr with std::shared_ptr for the same object. The RPC pointers own the distributed identity; the standard ones do not know it exists.