Design safe collection API with compile-time reference stability in Rust

This is very nice! I haven't seen the invariant lifetime brand pattern used this way before.

Hopefully, one day partial borrows will allow having several lifetimes directly in the self reference (one for structure and one for data), obviating the need for a separate token.