[lxsaah]

Brings both FFI spikes onto main: the pyo3 door, the C ABI door, the review fixes that came out of them, and the design-050 migration that stops either one installing its host application's global tracing subscriber.

Dependency on aimdb — resolved

This needed aimdb-core's log feature, which was not on aimdb's main when this PR was opened. It is now, as aimdb#237 (878486b). .github/workflows/ci.yml checks out aimdb-dev/aimdb with no ref:, so CI picks it up automatically — the first run here predated the merge and failed with aimdb-core does not have that feature; it has been re-run against the merged base.

What design 050 changes, and why

Both doors had arrived at the same unhappy answer to "how does a non-Rust application receive aimdb's reporting?": add tracing-subscriber, write a Layer, and install the host process's global subscriber on its behalf. That is the one thing a library loaded into somebody else's process must not do — and for the Python door it was the same trespass that removing init_tracing was meant to end, committed one layer further down where it was harder to see.

aimdb-core grew a second, optional destination for its log_* facade, so a door can hand aimdb a destination it owns instead. Both doors now install a log::Log; neither carries tracing-subscriber any more.

It deletes two real defects in the C++ header

A tracing::Layer has nowhere to put a void *user_data, so weather_station.hpp kept a detail::SinkHolder static beside the callback. Everything wrong with it followed from that:

• it was assigned on every call, before asking whether the install would be accepted — last-wins over a first-wins C layer, so a second init_logging replaced the first caller's sink and returned false to say it had not;
• it was assigned from the calling thread while the trampoline read it from aimdb's runtime thread.

A log::Log impl is the context, so the static has no reason to exist. ws_init_logging forwards to log::set_boxed_logger, which makes the first-wins decision once and in Rust for every binding; the header allocates the (sink, user_data) pair the C ABI cannot carry in one void *, hands it over as user_data, and releases it if the install is refused.

Measured by compiling the current spike against the previous header: 86,890 events went to the sink that had just been told it was not installed, and the first caller's sink stopped receiving entirely — taking the reentrancy and target-routing rounds down with it. Against this header, zero. Two new spike rounds assert both halves, and the second is written so it cannot pass vacuously.

The trampoline itself stays. It does two jobs — carry user_data, and catch a C++ exception that would otherwise unwind into Rust — and only the first is obsolete. It now holds no state.

Feature layout

weather-station gains a log feature mirroring its tracing one. This is required rather than cosmetic: the log_* macros are #[macro_export]ed, so #[cfg(feature = "log")] inside them resolves against the expanding crate. Without it, that crate's call sites are silently unrouted — and, since Cargo's check-cfg, also warn once per call site.

init_tracing and tracing-subscriber move out of tokio-runtime into a new init-tracing feature that default carries. Station binaries and templates are unchanged; a library build can now have the Tokio station without a subscriber, which is what makes "no tracing-subscriber in cargo tree" reachable at all.

One judgement call worth a reviewer's eye

weather-station-py takes weather-station with default-features = false. On its own branch that was harmless, because a TLS backend was not yet selectable — rumqttc named use-native-tls directly. Merged with CR-11's backend selection, it means no backend is selected at all, and mqtts:// would have failed at run time with nothing failing at build time. A clean auto-merge of two correct sides producing a broken result.

Resolved by naming rustls explicitly, for the reason CR-11 itself gives and which describes this crate exactly — a build that must not hand its host process a second OpenSSL, "an FFI layer shipped as a shared library, above all". The C door made the same call. cargo tree -p weather-station-py links no OpenSSL; the one openssl-probe in the graph is rustls-native-certs' cert-store locator.

native-tls is a one-word change if the wheel should keep it.

Known regression, named rather than left to be discovered

Filtering is coarser on both doors. EnvFilter came free with tracing-subscriber and went with it; span, field and regex directives are gone. What remains is level and target=level, comma-separated, longest matching prefix first.

It costs little at the Python door, where filter is only the floor that keeps events from acquiring the GIL and Python's own per-logger levels do the fine-grained work above it. It costs more at the C door, where it is the only filter there is. Both READMEs say so. No Rust consumer is affected — they keep tracing and EnvFilter exactly as today.

Verification

Re-run locally against aimdb main at 878486b (not the feature branch), with a live broker:

• make clippy, make test, make fmt-check, make lockfile — clean
• make spike — all checks passed, including "the module does not install a global tracing subscriber" (now true by construction rather than by convention) and "one subsystem can be silenced without silencing the others"
• make spike-cpp — all checks passed, including the two new rounds above, and the sink still reports aimdb_core::builder / aimdb_core::session::pump targets

cargo tree for both doors contains neither tracing nor tracing-subscriber.

Note on the branch

weather-station-py is fully contained in this branch and can be deleted once this merges.

[lxsaah]

Closing in favour of #12, which continues this branch: bf4514e is an ancestor of its head, so every commit here is included there, plus a station template in each language and the cleanup that followed.

Nothing is lost by closing this one.

---

Generated by Claude Code