Module tx_context_restrictions_verifier 

Enforces a signature-level rule on system packages at publish time:

If a function has an &mut TxContext parameter and any &mut _ in its return list, its parameter list must also contain at least one &mut U for some U != TxContext.

Gated on VerifierConfig::framework_tx_context_mut_restrictions, populated from ProtocolConfig::framework_tx_context_mut_restrictions(). Activates at protocol version 131.

The rule applies only to system packages: it is a checksum on our own implementations, ensuring no framework function can hand back a mutable reference rooted in the auto-injected TxContext. It cannot be enforced generally because user packages can always express the same shape through generic instantiation; for user code, PTB argument arity and auto-injection checks are the actual safety mechanism. User-published modules are exempt (their addresses are freshly generated, never system addresses).

Within a system package, functions that do not take &mut TxContext are out of scope: they cannot use TxContext as a mutable root because they never hold one. The rule covers natives too (framework natives are declared as native fun in Move source and appear here as function defs with None code). No safelist: any function violating the rule must be reworked, not grandfathered.

Functions

verify_module