# Rust audit log: safe producer ownership and ring slot references

## Reproduction

The source baseline is `78b18f906`. A small admission probe includes the actual
baseline `audit.rs` and uses a formatter stub which is never called: the log
stays disabled throughout. Safe scoped threads both borrow the same `FileLog`
and call `record`. This compiles and exits successfully at the baseline. No
racing writes are executed. With the candidate audit module, the same probe is
rejected with E0277 because `Cell<()>` prevents `&FileLog` from being sent to
another thread. The engine also has a compile-fail doctest for this admission.

The original ring wraps whole boxed byte/metadata slices in `UnsafeCell` and
forms mutable/shared references over their complete allocations before selecting
slots. Those references can overlap storage currently owned by the other thread.
The ownership admission is reproduced by compilation; the aggregate-reference
issue is a source review finding, not a runtime undefined-behaviour experiment.
Rust requires exclusive mutable references even inside `UnsafeCell`, and the
abstraction must prevent data races. See the primary
[UnsafeCell contract](https://doc.rust-lang.org/std/cell/struct.UnsafeCell.html)
and [Send/Sync contract](https://doc.rust-lang.org/nomicon/send-and-sync.html).

## Repair and contract

`FileLog` now carries a zero-size `PhantomData<Cell<()>>` owner marker. It remains
`Send`, so an enabled producer can move between owners, but becomes `!Sync`, so
safe callers cannot share it across producer threads. `record(&self)` retains
its signature. Callers which previously required `FileLog: Sync` must keep the
log with one owner or serialize access through an appropriate owner boundary.
The built-in session already records through its owner.

The byte slab and metadata storage are boxed slices of per-slot `UnsafeCell`s.
The producer only references an unpublished slot; the consumer only references
published slots. Acquire/release index handoffs keep each slot exclusive until
its bytes have been copied into the writer buffer. The redundant unsafe `Send`
implementation on the private shared ring is removed; its fields derive `Send`.
The private `Sync` implementation states the producer/consumer and reference
invariants explicitly. Producer operations add no allocation, lock or syscall.

Three external public-API regressions cover an enabled owner transfer and return,
append after reopening, draining on owner drop, empty/full/truncated frames, and
4,096 offers at each of three small ring capacities (2, 3 and 127). Expected
lines are independently assembled from fixed epoch timestamps and original
frame bytes. File progress between batches forces repeated slot recycling.
Dropped records are excluded from the expected byte stream using the observable
producer drop count; offered = accepted + dropped, with zero write failures.
New fixtures own unique directories and remove them on drop.

## Verification

The full-gate candidate is `18c4c0149`, based on `78b18f906`. All 338 tracked
Rust file hashes match between the publishing worktree and the HP verification
worktree. Own heavy stages run sequentially, offline, at `-j1` and
`--test-threads=1`, with the absolute session `LIBHFT_BUILD_ROOT` and Cargo target
directory set. Test/debug profiles omit debug symbols to reduce memory; normal
optimization and debug-assertion settings are unchanged.

BEELINK2 attempts were stopped by the guard when other sessions started heavy
builds/suites. Verification moved to HP; interrupted attempts are retained and
are not green gates. The HP guard checks active compiler/suite processes and
available memory, yielding to other jobs. Counts below come only from the last
completed run in each log, after its final guard start marker.

| Gate | Result |
|---|---|
| Original shared-producer admission probe | Compiled and exited successfully; log disabled |
| Repaired shared-producer admission probe | Rejected with E0277 for `Cell<()>` / `FileLog: !Sync` |
| Full default Cargo suite, Rust/Cargo 1.92.0 | 1,057 passed, 0 failed, 1 existing ignored builders doctest |
| Full open Cargo suite, Rust/Cargo 1.92.0 | 924 passed, 0 failed, the same 1 ignored doctest |
| Strict Clippy 1.93.1, all targets, both editions | Passed with `-D warnings` |
| New external regressions, both editions | 3 passed in each (included above) |
| New ownership compile-fail doctest, both editions | Passed in each (included above) |
| Rustfmt on the new integration test | Passed |
| Public-export scrub on the audit files and two interposer tests | 0 findings |

The integration candidate is `687f0c37e`. Rebase adds only four Rust paths:
the independently published classic/FIXP mmap fence/flush changes, their new
flush-frontier integration file, and expanded inherited-lock regressions. Both
owned audit files remain byte-identical. All 339 integrated Rust file hashes
match HP. The integrated library plus audit/mmap/lock selections pass 1,034
default and 895 open tests, with zero failures and zero ignored tests in these
selections. Strict integration Clippy found missing Safety sections on the
released, newly added test-only `flock` and `msync` interposers. Their eleven-line
documentation fix is separately claimed and committed; no test or runtime logic
changes. Both failures are retained. The final candidate is `9f24b0e98`. Its
339 Rust file hashes match HP; compared with the integrated test source, only
those two tests' documentation differs. Strict Clippy 1.93.1 passes all targets in both editions with `-D warnings` again.

The publication integration is `235864098`. A subsequent rebase includes the
independently tested append-journal positioning repair and its new six-case
public integration file. That same upstream commit documents both mmap
interposers, so the equivalent prospective eleven-line documentation patch is
dropped from publication, preserving the upstream contracts without duplicate
headings. The bundled candidate retains the original documentation and green
lint source. No owned audit file changes at any rebase.

All 340 publication Rust file hashes match HP. The final audit/journal selection
passes nine tests in each edition (three audit, six journal), with zero failures
and zero ignored tests. Strict Clippy 1.93.1 passes all targets in both editions
on this publication integration. The publication record is later amended only
to include these results; archive metadata records the final main pins.

The exact candidate patch, baseline/fixed admission probes, source hashes and
logs are retained in `~/archive/libhft/rust-audit-ownership-20261004` after
publication. `publication.json` records the final pins; `SHA256SUMS` verifies the
archive.

This is a Rust memory-safety repair. Production endpoint and venue/FIXP
certification evidence remains separate, and parity inventory scores do not change.