# Rust accepted connection ownership

## Reproduced failures

The retained public-API factory audit at
`be58a5c9bbef622595b511b50eae08d6f142ff87` uses real loopback TCP and ordinary
`File::open("/dev/null")` descriptor reuse. One control passes: an error before
session construction closes the accepted connection. Two regressions fail:

- A factory explicitly closes its session, opens a file at the freed descriptor
  and returns an error. The acceptor closes the file; `metadata()` reports
  EBADF (9).
- A factory unwinds before constructing its session. Catching that unwind
  leaves the accepted socket open; its peer's timed read reports WouldBlock
  (11), rather than EOF.

The audit exits 101 (one passed, two failed). Its source, manifest, command
outcome and diagnostics are retained in the preceding simulator qualification
packet and copied into this packet. It is a focused unchanged-engine
reproduction, not a baseline full-suite qualification. It does not use `dup2`
or forced replacement. Invalidated file owners are consumed before assertions
so a failure does not produce an unrelated I/O-safety abort.

`Session` has no destructor. Dropping a session over raw Kernel/Zf/Sx does not
close those handles; explicit `Session::close` is what demonstrates descriptor
reuse in the first failure. TLS already has shared, idempotent closure.

## Ownership and compatibility

An accepted connection is wrapped in `Io::Owned`, with one reference-counted
owner and a shared closed flag. A factory guard retains that owner until the
session is registered. Error, unwind, role/schedule/HA refusal and later
admission failure close it once and invalidate retained owning clones. A
returned session must retain the original open owner; closed or unrelated
connections and reconstructed raw aliases are refused. A raw alias of the
accepted handle is detached before refusal so the guard frees it once.

Receive, send, parking, socket configuration, transport checks and TLS
telemetry inspect the current borrowed transport. Closed owners cannot read,
write or poll a reused descriptor. TLS handles closed directly through the
borrowed diagnostic view also report Closed. Reconnect closes the old owner
and reflects whether its replacement is actually connected.
Reading a closed view returns E_CLOSED through the existing terminal error
helper, which already publishes DISCONNECTED. Retained-session assertions and
the TLS factory test require both results. Review removed a redundant status
assignment so terminal errors and lifecycle callbacks keep their existing
ordering. An interrupted verification of that redundant assignment and the
earlier full default result are preliminary evidence, not the final gate.

This adds a public enum variant: downstream exhaustive Io matches need an
Owned arm, or callers can inspect `io.transport()`. Factories must pass the
original owning Io into session construction, without cloning its raw view.
Callers outside acceptors can opt in with `into_owned`; independently wrapping
raw aliases does not establish valid ownership. Raw Kernel/Zf/Sx retain their
legacy explicit-close contract. No Session destructor is added and dropping
an owning handle does not itself checkpoint the store. Normal explicit
session/acceptor teardown retains its existing store handling.

There is one ownership allocation per accepted connection, no per-message
allocation or reference-count operation. This record makes no latency or
throughput claim.

## Regression coverage

Twenty-two public integration tests cover error before construction, explicit
close followed by error or panic with real descriptor reuse, unwind before
construction, escaped owning handles and sessions on error/unwind, successful
transfer, closed and unrelated returned sessions, raw reconstruction, wrong
role, final owning drop, retained clones, rewrapping, early and post-construction
configuration errors, initial/reconnected closed state, replacement ownership,
and the unchanged raw-session-drop contract. The new TLS factory test exercises
closure through the underlying established TLS connection. Existing admission,
TLS and fake TCPDirect/SocketXtreme suites cover normal transport lifecycles.

The initial focused run passed twenty cases but failed the late-error fixture:
a nonexistent timezone alone is ignored for a non-stop schedule. The corrected
fixture requests a missing dictionary, which really fails after session
construction. Both focused editions then pass all twenty-two cases. This was
a fixture precondition correction, not a relaxation of the ownership assertion.

The line-oriented API inventory matcher was adjusted to recognise a formatted
Io declaration and independently require its Kernel(i32) variant. Inventory
and generated coverage checks pass without a capability-status change.
The eight changed Rust/bench sources scan without findings. Scanning the
development inventory additionally reports one unchanged commercial-vendor
description at its batching capability. It is present in the baseline, and
`publish/libhft-java.manifest` excludes this tool. The finding and its baseline
line comparison are retained; it is not reported as a clean nine-file scan.

## Verification and publication

| Gate | Result |
|---|---|
| Public factory audit against unchanged engine | 1 control passed, 2 regressions failed |
| New ownership integration fixture, preliminary focused editions | 22 passed in each |
| Complete default Rust stage | 1,995 passed, 0 failed, 1 existing ignored builders doctest |
| Complete open Rust stage | 1,808 passed, 0 failed, the same 1 ignored doctest |
| Strict all-target Clippy, `-D warnings` | Passed in both editions |
| Established TLS factory closure, focused `--nocapture` | 1 passed in each edition; no resource skip |
| `rust-pure` benchmark consumer, offline `cargo check` | Passed in both editions |

Final verification uses `2906be565a2096dc67b5dc80ce7ad0cc8a2b633a`, after
integrating the upstream TLS/configuration changes and imported-admin replay
tests. All 362 tracked Rust and 627 shared fixture/reference/gate/consumer
input path-keyset and hash pairs match before and after verification. The
publication proof repeats these checks. Each selected conformance stage
reports 1 ran, 0 failed, 0 skipped and PARTIAL for unselected monorepo stages.
This is a complete Rust-stage result, not a full-monorepo qualification.

Tests use Rust/Cargo 1.92.0. Strict Clippy uses the retained 1.93.1 sysroot,
without changing the installed toolchain. The open benchmark consumer emits
eight warnings in its existing private-driver branches in `engine.rs` and
`server.rs`; both files are byte-identical to the upstream base. These are
retained diagnostics, not a warning-free benchmark claim. Engine Clippy is
strict in both editions.

Preliminary local and remote guarded attempts yielded to competing work;
their interrupted results are retained separately and are not passes. The
first full default result passed 1,987 tests on HP before the later upstream
integration and final status assertions. Final gates run serially at `-j8`,
with one test thread, on Scan's isolated CPUs 10–19. Its 125 GiB physical
memory allows a separately leased shared runtime: the Scan-specific guard
requires at least 64 GiB available, limits foreign runtime RSS to 16 GiB and
yields to a foreign compiler. The guard refuses smaller or WSL hosts. Local
and HP attempts retain the stricter one-heavy-job guard. Initial queued
requests, deliberate stops, corrected fixtures and the redundant status
assignment removed during review are preserved in the packet.

Pins, source snapshots, actual commands, baseline failures, preliminary and
interrupted runs, complete final stdout/stderr/reports, input proofs and the
named candidate/publication bundle are retained under
`~/archive/libhft/rust-acceptor-owned-io-20261011` with verified SHA256SUMS on
BEELINK2, Scan and HP. The local packet gathers both remote packets. The new
integration file and complete owning-Io declaration match rustfmt; unrelated
legacy formatting is preserved. API inventory, generated coverage and the
eight-file export scan pass. Inventory scores are unchanged.

Functional testing does not qualify kernel-bypass hardware, production
feed/order traffic, venue certification or a customer pilot.