# Rust metrics endpoint: bounded accept retries and truthful worker state

## Reproduced baseline

The actual unchanged baseline is `0524dd51105fd239f37da7d8383e40e690b530e4`
(the published coordination claim). A separate scratch crate calls
the public classic and FIXP metrics APIs against that checkout. Four finite
recovery controls pass and fourteen persistent-error/worker-state cases fail.
The Unix descriptor-pressure case records 912,032 failed accept attempts in
120 ms. Repeated EINTR prevents stop from returning until a fixture watchdog
releases the fault two seconds later. Invalid-listener failures and panicking
capture callbacks leave running() true. Exact baseline input and output remain
retained, including all compiler metadata and unmodified production source pin.

The isolated integration executable interposes libc accept4 only for its named
metrics worker and selected listener descriptor. Failed calls return -1 with
thread-local errno; healthy calls reach the real libc symbol through RTLD_NEXT.
The fixture never closes the listener behind Rust's descriptor owner. Kernel
failure conditions are injected return values, not actual memory exhaustion,
firewall changes, descriptor corruption or external signal storms. Accepted
connections, response I/O, close-on-exec flags and descriptor cleanup are real.
No production test hook or direct-syscall bypass of acceleration libraries is
added. The real baseline executable reaches every fault used for its verdicts.

## Contract and implementation

The nonblocking listener now makes one libc accept4 attempt per loop iteration,
with null peer-address output and SOCK_CLOEXEC. An OwnedFd takes each successful
descriptor, then transfers it to the appropriate TCP/Unix stream. Existing
blocking client I/O, shared deadline and complete-response scrape accounting
remain unchanged. The helper uses the existing crate syscall declaration and
therefore retains libc symbol interposition.

Using std's accept() would keep EINTR retries inside its cvt_r loop, where the
endpoint cannot inspect its running flag or pace repeated interruptions. This
is visible in the [tested Rust 1.92 implementation](https://github.com/rust-lang/rust/blob/1.92.0/library/std/src/sys/net/connection/socket/unix.rs).
The single-attempt helper lets every interruption return to the endpoint loop.

Retryable failures, including WouldBlock, Interrupted, resource shortages,
aborted/pending network connections, policy failures and unknown errors, wait
the existing 50 ms accept poll before retry. Progress cannot create a tight
failure loop. Stop is observed before the next attempt, within a poll plus
scheduler delay. Resource pressure does not automatically stop an endpoint;
later accepts recover when the condition clears.

Linux EBADF, EINVAL and ENOTSOCK establish an unusable listener interface and
stop the worker. EOPNOTSUPP remains retryable because Linux can report it as
a pending TCP connection error. These categories follow the
[Linux accept documentation](https://man7.org/linux/man-pages/man2/accept.2.html).
No errno is promoted to a session protocol fault or a scrape count.

A worker-scope guard clears the shared running flag with release ordering on
normal exit and unwinding. The public running() docs now describe invalid
listeners and unwinding capture callbacks. False also continues to mean a stop
request is pending; stop() joins the worker and completes listener/pathname
cleanup. It does not cancel arbitrary callback code, suppress callback panic
hooks, automatically restart an endpoint, or report a detailed terminal cause.
With panic=abort the process terminates instead of unwinding a worker guard.

TCP/Unix and classic/FIXP metrics share the implementation. Snapshot schemas,
renderer behavior, client I/O budgets, Unix inode ownership and session hot paths
are unchanged. The new guard has no per-frame work or lock.

## Regression coverage

Eighteen public cases cover all four transport/schema combinations. Four finite
scripts each inject nineteen retryable Linux errnos, then require an actual
complete HTTP 200 response, one scrape, a close-on-exec accepted descriptor and
its eventual close. Four persistent cases cover six errnos each (EINTR, ENOMEM,
ENFILE, EMFILE, ENOBUFS and EIO), requiring paced attempts, prompt stop, zero
scrapes and empty fixture directories. Two separate EMFILE cases prove bounded
pressure retries followed by a healthy scrape after release.

Four terminal cases each cover EBADF, EINVAL and ENOTSOCK: running becomes false,
only one failed attempt occurs, stop joins and a valid replacement endpoint can
bind the same TCP port/Unix pathname. Four capture-panic cases require EOF without
response bytes, false running state, zero scrapes and complete joined cleanup.
The candidate's rebind fixture adds a valid source after the baseline verdict's
earlier state assertion; that baseline never reaches the rebind code.

Fault state stores at most 64 timestamps even when the old worker spins. Parents
serialize within the executable, fixture directories delete on teardown, and
fault guards disarm before endpoint drop on every exit. A watchdog releases only
an injected EINTR condition so the unchanged baseline's join remains bounded.
No new test is ignored and no privilege or native SDK is required.

## Verification

Initial candidate `3a4e3d5b7df28f530e877468bacf83e409925746` passes the 52-case
metrics selection, 16 telemetry cases and complete default suite (1,247 tests,
one existing ignored doctest). Main then publishes replay-header fixes in
session.rs. The combined candidate `8f3a9491c6d561991ab259aa333e8d8e83c8beca`
passes 1,248 default / 1,078 open tests and strict Clippy in both editions, with
one existing ignored builders doctest per edition. Main then publishes the
lifecycle observer, LogoutSent observation and replay-field follow-up in four
Rust files. Publication candidate `e76e3f091549e6582e255e3dec999812223738ef`
repeats both complete Rust stages and strict Clippy. All new accept, prior HTTP
and Unix ownership cases run again within those full suites. Both owned metrics
files remain byte-identical across both integrations. The initial open stage is
deliberately interrupted for integration; it is not counted as a pass. All 348 tracked Rust inputs match the build host.
Cargo/Rust 1.92.0 runs offline at one job and one test thread, with absolute session build/target
roots and disabled development/test debug symbols. Strict Clippy uses the
isolated Rust 1.93.1 toolchain, all targets and -D warnings in each edition.

| Gate | Result |
|---|---|
| Actual unchanged baseline | 4 recovery controls pass; 14 regressions fail |
| TCP/Unix and classic/FIXP metrics selection | 52 passed, 0 failed, 0 ignored on replay-integrated candidate |
| Telemetry contracts/rendering/endpoint/scripted I/O selection | 16 passed, 0 failed, 0 ignored |
| Final rust-engine-tests: complete default Rust Cargo suite | 1,250 passed, 0 failed, 1 existing ignored builders doctest |
| Final rust-open-edition-tests: complete open Rust Cargo suite | 1,080 passed, 0 failed, the same 1 ignored doctest |
| Final strict all-target Clippy | Passed in both editions |
| Rustfmt on changed production blocks and integration test | Passed |
| Public-export scan on both owned files | 2 files, 0 findings |
| API inventory and generated coverage --check | Both passed; 82 supported / 11 n/a inventory entries |

Both final selected stages report 1 ran, 0 failed and 0 skipped, selecting one of
360 monorepo stages each. All 52 focused metrics cases run within both final
complete suites, without new ignores. All 348 final Rust hashes match HP. The
subsequent main benchmark changes leave those Rust inputs byte-identical, so no
unchanged Rust suite is repeated for them. Original/replay-integration evidence
is retained separately from the final candidate's completed reports.

Each selected conformance stage retains its real command, stdout/stderr and exit
metadata. PARTIAL describes unselected monorepo stages; it is not a full-monorepo
pass. The existing ignored doctest is in builders.rs. The wrapper preserves
normal stage/process-group cleanup and does not reinterpret a failed test as a
passing stage.

Owned builds and suites run serially on HP at one Cargo job, after an available
memory/process check. An 8 GiB available-memory floor and foreign compiler/suite
guard stop only an owned stage if another heavy job appears, then retry when the
host clears. No heavy job runs locally beside BEELINK2's other sessions.

Exact baseline input, diagnostics, completed gate logs and JSON reports, source
manifests and named candidate/publication Git bundles are retained under
~/archive/libhft/rust-metrics-accept-errors-20261004 on both hosts. SHA256SUMS
verifies kept evidence. API inventory and generated coverage checks retain their
scores; no external customer/venue evidence is generated by these fault cases.

## Boundaries

Pacing does not repair the cause of an unknown/resource/network accept error.
Such an endpoint stays running and retries until it recovers or a caller stops
it. Fatal listener codes are an explicit Linux classification, not a guess from
ErrorKind; acceleration providers must preserve compatible accept4 semantics.
Tests use injected errno results rather than a real acceleration deployment or
physical host resource exhaustion. Active callback code still has to return.
Other runtimes were not fault-tested or edited in this slice. Live production
feed/order endpoints and venue/FIXP schema certification remain partial.