Foreign-function boundaries: carry ownership across the ABI

An application binary interface specifies details such as argument passing and compatible representation. It does not tell the caller whether a pointer is borrowed, retained, or consumed. Match integer widths, signedness, alignment, calling convention, and structure layout using the actual platform and library declaration. A C-compatible representation annotation is useful for appropriate structures, but it does not make an arbitrary language container, trait object, or C++ class a portable C value. Prefer opaque handles and explicit operations when representation should remain private.

For each pointer argument, document readable or writable length, initialization requirements, permitted overlap, null handling, and whether the foreign code may retain the pointer after return. A string contract must distinguish explicit byte length from a terminating zero, and encoding validation from memory bounds. Returning a pointer to a temporary creates a lifetime error even when the ABI types match. A wrapper can turn these obligations into a safer high-level API only if the foreign implementation actually honors the stated contract.

If a native library creates a handle, its documented release function is usually the appropriate partner. Do not reconstruct a Rust Box or vector from arbitrary foreign storage unless the required allocator, layout, ownership, and construction conditions are satisfied. A foreign malloc result and a language-specific owning container are not interchangeable merely because both contain a pointer. Conversely, transferring a Rust-created allocation requires a documented way to return responsibility to the matching owner exactly once. Error paths must state whether partially produced handles require cleanup.

A safe wrapper should validate returned lengths before exposing initialized values, but that check cannot undo an out-of-bounds write that already occurred inside the foreign call. Pre-call capacity guarantees and trust in the callee's memory contract remain necessary. Translate error codes into explicit outcomes and release acquired resources on every supported path. Unwinding and exception propagation across the boundary require a deliberately compatible ABI and runtime contract; do not assume a panic, C++ exception, or long jump is harmless because the normal return path was tested.

A native accelerator or worker may retain a buffer after the initiating call returns. Its final completion or cancellation acknowledgment must establish that no future access can occur before the owner frees or reuses the storage. A timeout on the waiting caller is weaker evidence. In a moving managed runtime, keeping the object reachable may need to be paired with pinning, copying, or an approved handle mechanism so the native address remains meaningful. External threads and callbacks must also follow the host runtime's entry and synchronization rules.

The queue lab illustrates the number of pending operations that may retain buffers. Press Reset, set λ=4 and μ=3, predict backlog grows from four by one operation per second, then Play or Step. For a separate experiment, press Reset before setting λ=2 and μ=3; predict the restored four-job backlog drains in four seconds, then Play or Step. Multiply only by a stated per-pending-operation backing size; executing operations and shared allocations need separate accounting. The model does not represent callbacks, allocator families, pinning, or ABI layouts. Use it to ask who still owns each pending buffer and which real completion event, rather than a visual disappearance or a caller timeout, permits release.