fix(pubsub): stop running subscriber callbacks on the publishing thread

[YuanYuYuan]

Part of #282 — the defect class, the shared fix shape and the merge order are stated there.

Summary

Publishing from inside a subscriber callback on the same session deadlocked deterministically. This moves session-local delivery off the publishing thread onto a bounded per-subscriber drain queue, and stops declaring zenoh-ext's AdvancedSubscriber for QoS profiles that do not need it.

Role in #282: instance fix. Independent of the keystone (#255): it targets main, uses no tracked lock types, and can merge in any order. Its locks are candidates for conversion in the follow-up that closes #282.

The tip is d11d710c, merge-base ae4f0f8f (origin/main after #260 merged). Of 2,525 changed lines (2,485 added, 40 removed), 1,670 (66%) are the three new test files: crates/hiroz-tests/tests/reentrant_publish.rs (904), crates/hiroz-py/tests/test_reentrant_publish.py (435), crates/hiroz-tests/tests/dispatch_backpressure.rs (331) — 15 new Rust tests and 9 Python cases.

Issue

Fixes #249. There was no error and no traceback. Through the Python bindings it froze the whole interpreter.

What this PR does

Three stacked mechanisms produced the hang. This removes all three.

#	Change	Why
1	Declare zenoh-ext's AdvancedSubscriber only when QoS needs it (qos_needs_advanced, pubsub.rs:527)	Its sample callback invokes user code under a non-reentrant std::sync::Mutex. For Volatile — the ROS 2 default — it declared no liveliness subscriber, heartbeat or detection token, so it was pure overhead plus the fatal lock. TransientLocal keeps it: history replay and miss recovery live there.
2	Move session-local delivery off the publishing thread onto a bounded drain queue (CallbackDispatcher, pubsub.rs:381)	The publishing thread no longer runs the callback, so it cannot re-enter its own lock.
3	Teardown discards the backlog instead of running it inline (impl Drop for CallbackDispatcher, pubsub.rs:492; DispatchQueue::dequeue checks closed before pending, pubsub.rs:251-263)	Draining first meant drop(subscriber) ran a user callback for every queued sample — backlog × callback_duration, with no ceiling.

All four CallbackDispatcher::spawn sites pass dispatch_capacity: pubsub.rs:1417, pubsub.rs:1449, node.rs:684, node.rs:702. DISPATCH_UNBOUNDED survives only as the KeepAll arm of dispatch_capacity itself. (Counted with a context grep — every call spans four lines, so a same-line match reports zero.)

Known defects in this change, disclosed

#	Defect	Where	Consequence
D1	Drop for CallbackDispatcher calls thread.join() on a thread that is running user code, with the only escape being a self-join from inside that callback. Dropping a subscriber is therefore an unbounded callout to user code, made while the dropping thread holds whatever it holds.	pubsub.rs:492-513; reachable synchronously because ZSub owns SubscriberHandle by value and both variants own dispatcher by value	let m = Mutex::new(0); callback body takes m; main thread takes m, then drops the subscriber while one sample is in flight → drop(sub) never returns. No timeout, no log, no panic. On main there is no Drop impl in pubsub.rs and no thread, so drop(sub) always returned. This is #282's own shape relocated to teardown.
D2	CallbackDispatcher::spawn's doc says "the ffi feature is enabled by no crate, so that arm is not compiled on the PR gate at all (#291)". The premise is true; the conclusion is false.	pubsub.rs:401-403, against .github/workflows/test.yml:179-183 (FEATURES="ffi,<distro>,rmw-zenoh", cargo build --no-default-features --features "$FEATURES" --lib, all four distro legs)	A maintainer editing the FFI advanced arm concludes it has no automated coverage of any kind including compilation, and either skips a local --features ffi build or mis-scopes #291. The real reason nothing caught the wrong constant is that a wrong constant is neither a compile error nor a lint.
D3	Two other doc comments contradict the shipped behaviour. SubscriberHandle::Advanced::subscriber's field-order rationale (pubsub.rs:557-559) says the subscriber is undeclared first "before the dispatcher drains and joins" — it does not drain, it discards (breaking change #5). The "Backpressure" section's lead-in (pubsub.rs:329-330) says "The two paths get different answers", and the bullet 15 lines below (:345) says "same bound, and the same expression"; the same paragraph says the queue-mode BoundedQueue is sized "from the same expression" while dispatch_capacity's own doc (:139) says in bold that they are not.	as cited	Documentation only, but the drop-order sentence is the one a reader hits while reasoning about exactly the property it gets wrong.
D4	qos_needs_advanced's summary line says "subscriber/publisher" and closes "only pay for it when the QoS actually asks for it" (pubsub.rs:515-526), but no publisher calls it — ZPubBuilder::build does pub_builder.advanced() unconditionally (pubsub.rs:879). Its only two callers are the subscriber paths (pubsub.rs:1388, node.rs:679).	as cited	No runtime defect: for Volatile the wrapper is inert (Sequencing::None → no seqnum, no cache, no liveliness token). The doc promises a decision the code does not make.
D5	The plain path's bound applies only to locally published samples. local_only_shim enqueues a sample only when a hiroz publish is on this thread; a remote sample runs the callback inline on a zenoh RX worker and never enters the queue.	pubsub.rs:474-490; correctly stated in-code at pubsub.rs:342-349	Breaking change #2 below carries the qualifier. Upstream bounds every arriving sample; hiroz's plain path bounds the local half. Over-warning, not under-warning, but the plain path is not upstream-aligned on this property.
D6	LocalPublishGuard is pub(crate) (pubsub.rs:54), so its own doc's demand — "a fifth publish path added later must do the same" — is unenforceable outside hiroz, and one out-of-crate session.put already exists (hiroz-union/src/plugin/wasm/host/transport.rs:58).	as cited	No reachable failure today: that host's subscribers are raw session.declare_subscriber handles, not hiroz ZSubs, so no dispatcher-backed callback sits on those key expressions, and a callback publishing back does so through ZPub, which is guarded. Enforcement gap, not a live defect.
D7	Pre-existing, but this PR gives it new reach: Reliable maps to CongestionControl::Block on every history policy (pubsub.rs:866-870), where upstream uses Block only for RELIABLE && KEEP_ALL and Drop otherwise (detail/rmw_publisher_data.cpp:179-184).	as cited	A callback that publishes now runs on the drain thread, so a blocked put inside a callback stalls that subscriber's drain loop entirely and its queue then silently drop-oldests, with only the escalating warn! as a signal. Before this PR the same blocked publish stalled the publishing/RX thread, which was at least visible to the caller.
D8	Pre-existing: PyZNode::destroy_subscriber resolves by a per-node id with no node identity (hiroz-py/src/node.rs:144 next_sub_id: 0 per node, :157 Vec<(u64, Box<dyn Any>)>, :428-443).	as cited	Two nodes in one interpreter both mint owned_id == 0; n1.destroy_subscriber(s2) tears down n1's subscription and returns Ok(()). Destroying an id the node does not own also returns Ok(()).

D1 is the one that changes what a reviewer must decide: it is a genuine new hazard on a public API with no disclosure in the Rust docs (build_with_callback's "# Ownership" section tells callers only that dropping undeclares). hiroz-py already patches the two instances it hit — destroy_subscriber (hiroz-py/src/node.rs:434-442) and the new impl Drop for PyZNode (:161-175), both via py.allow_threads — which is direct evidence the hazard is real; every Rust caller is left exposed.

Evidence

Measurement	Commit	How
CI green — 26/26 check runs SUCCESS/SKIPPED, 0 failed, 0 pending; license/cla SUCCESS	d11d710c (the tip)	check rollup on the current head, filtered on __typename == "CheckRun" and status == "COMPLETED"
Reverting the advanced-path queue bound (pubsub.rs:1417 → DISPATCH_UNBOUNDED) makes exactly one test fail: transient_local_keep_last_drops_the_oldest_local_samples	pre-rebase	local run
dispatch_backpressure passes 4/4 with the bound in place	pre-rebase	local run
Merge-base is exactly origin/main (ae4f0f8f) — no unintended reversion in the range	d11d710c	git merge-base origin/main HEAD

keep_last_drops_the_oldest_local_samples (dispatch_backpressure.rs:215) detects unbounded growth and drop-newest, because it asserts values ([0, 46, 47, 48, 49]) rather than counts. Its determinism is structural, not slept-on: the callback sets parked before waiting on the latch and the publisher spins on parked with a deadline, so the drain thread provably cannot pop during the burst.

Established by reading the code, not by executing it:

Claim	Basis
No lost wakeup between enqueue and dequeue	dequeue holds the state mutex continuously from the closed/pending check into Condvar::wait, which releases it atomically; one consumer, so notify_one suffices; Drop uses notify_all
Drop never holds the queue lock across join()	self.queue.lock().closed = true; is a statement-scoped temporary, dropped at the ;
Self-join is handled	thread.thread().id() == current().id() early return (pubsub.rs:499-503); self.thread.take() detaches, so the drain thread exits when the in-flight callback returns
A failed declare_subscriber leaks no thread	dispatcher is a local binding at all four sites and wait()? returns past it, running Drop
Field order undeclares before it joins in both SubscriberHandle variants	subscriber before dispatcher at pubsub.rs:543-546 and :554-562; Rust drops fields in declaration order. Weaker than the comment implies — zenoh undeclares with wait_callbacks: false — but enqueue's early return on closed makes a late sample harmless
A callback that publishes to its own topic iterates rather than recursing, on both paths, with memory bounded at the history depth	plain: guard → local_only_shim enqueues; advanced: always_shim enqueues unconditionally; the queue evicts instead of blocking
The plain path holds no zenoh lock when the callback runs inline	Session::send_push_consume drops the session state lock before callbacks.call; route_data drops rtables before send_push on both branches
No lock-order cycle with zenoh-ext's statesref	RX thread takes statesref then the dispatch state; the drain thread releases the dispatch state before running the callback, so a republishing callback takes statesref holding nothing. One-directional
The queue never blocks its producer	enqueue evicts before inserting and returns unconditionally, so neither the publishing thread nor an RX thread can be parked by a slow callback
A panicking callback cannot wedge the subscriber	catch_unwind at pubsub.rs:439, poison-tolerant lock(); the doc states its own limitation (inert under this workspace's panic = "abort" profile)
KeepLast(usize::MAX) is safe end to end	maps to DISPATCH_UNBOUNDED; cache_depth_from_history forwards it to zenoh-ext, which stores it as a NonZeroUsize and compares rather than preallocating; BoundedQueue::new caps its with_capacity at 1024
The escalating warn counters cannot wrap	saturating_add / saturating_mul; at saturation it warns on every drop — degraded logging, not wrong delivery
No hiroz-py path holds the GIL across a callout	publish/publish_raw release before the put; destroy_subscriber and Drop for PyZNode release before dropping owned callback subscribers; queue-mode PyZSubscribers carry dispatcher: None
The action client's two dispatcher threads cannot hang teardown	feedback_tx is an unbounded mpsc::UnboundedSender and status_tx a watch::Sender, neither of which blocks; watch keeps only the newest value, so a depth-drop cannot lose a terminal GoalStatus

Breaking changes

Seven. Six follow from moving session-local delivery off the publishing thread. The seventh is API surface.

#	What changes	Who is affected	Before → after	Action
1	Session-local delivery is asynchronous	Anyone publishing and then asserting on a same-session side effect	publish() returning meant the subscriber had run → it does not	Synchronise explicitly
2	Same-session samples can be dropped	Callback subscribers with KeepLast(depth)	Inline delivery made loss structurally impossible → the queue is bounded at the history depth and drops oldest, with an escalating warn!	Use KeepAll if losslessness is required
3	Subscriber callbacks are no longer mutually excluded	Callbacks doing a non-atomic read-modify-write	zenoh-ext invoked the callback under its Mutex<State>, so callbacks were serialised by construction → they are not now	Add your own synchronisation
4	Local and remote publications on one topic are no longer ordered relative to each other	Plain (non-TransientLocal) subscribers	Single interleaved order → two independent paths	Do not rely on cross-source ordering
5	Dropping a subscriber discards its undelivered backlog, and blocks on any in-flight callback without bound	Anyone dropping a subscriber; anyone relying on teardown draining	main has no queue and no Drop impl in pubsub.rs; every accepted sample was delivered inline before publish returned, and drop(sub) joined nothing → the backlog is discarded (as destroying an rclcpp subscription does), but Drop now joins the drain thread	Never drop a subscriber while holding a lock, GIL or channel its callback also touches — see D1. Drain before dropping if the backlog matters
6	New public types	ffi consumers	SubscriberHandle and CallbackDispatcher are new public items; RawSubscriber::inner changes from AdvancedSubscriber<()> to SubscriberHandle (ffi/subscriber.rs:13)	Update any direct use of inner
7	Synchronous local delivery is gone as a guarantee	Downstream code only	Nothing in this repo depended on it — rmw-zenoh-rs uses build_with_notifier (rmw.rs:574), and wait_for_subscription reads the graph rather than local delivery (pubsub.rs:945)	—

⚠️ Scope qualifier on #2. It applies to every sample only on the advanced (TransientLocal) path, where always_shim enqueues unconditionally. On the plain path only locally published samples pass through the queue; a remote sample runs the callback inline on an RX worker and is neither queued nor dropped. The capacity constant is the same on both paths; which samples pass through it is not (D5).

⚠️ An earlier revision left the advanced path unbounded on every profile, replacing zenoh's transport backpressure with unbounded in-process growth. c62f3e26 and d11d710c closed that on the typed and FFI arms respectively.

Queue bound versus rmw_zenoh_cpp

Read from source at rmw_zenoh_cpp/src. Upstream's model: the zenoh sample callback does nothing but SubscriptionData::add_new_message, which locks, bounds, enqueues and notifies; user code runs later on the rclcpp executor thread. No user code ever runs on a zenoh delivery thread, on any profile.

Property	rmw_zenoh_cpp	hiroz after this PR	Verdict
bound	adapted_qos_profile.depth (detail/rmw_subscription_data.cpp:1125-1126)	dispatch_capacity: KeepLast(depth).max(1), KeepAll → unbounded	aligned
drop policy	drop oldest, pop_front before emplace_back (:1140-1143, :1167)	pop_front before push_back at len >= capacity	aligned
KEEP_ALL	unbounded (:1125)	DISPATCH_UNBOUNDED	aligned
TransientLocal exemption	none — the check reads history policy only (:1125)	none	aligned
applies to	every arriving sample, remote included (:1110, called from :420, :803)	advanced path yes; plain path local samples only	divergent — D5
advanced-subscriber cache	adv_sub_opts.history->max_samples = qos_.depth (:379, :728)	cache_depth_from_history (pubsub.rs:580-590)	aligned
teardown	is_shutdown_ set, undeclare, queue never drained, takes short-circuit (:843-899, :952, :1062)	closed set, drain loop exits, backlog discarded	aligned
notifier/wake on the delivery thread	trigger_callback() and the wait-set notify run under mutex_ (:1114 guard covers :1170-1175)	DataHandler::handle calls notifier() after push returns, holding nothing (common.rs:44-48)	hiroz-better; upstream has the #282 shape here
loss reporting	MESSAGE_LOST from arrival sequence-number gaps (:1146-1163); depth drops are debug-log only (:1128-1134)	escalating warn!; no MESSAGE_LOST at all	aligned on the narrow claim (a pop_front at depth cannot create an arrival gap upstream either); hiroz-better on visibility; the absent MESSAGE_LOST is pre-existing, #292
publisher backpressure	BLOCK only for RELIABLE && KEEP_ALL, else DROP (detail/rmw_publisher_data.cpp:179-184)	BLOCK for every Reliable	hiroz-worse, pre-existing — D7
advanced subscriber gating	declared unconditionally; the durability if only adds options (:371-387, :427)	plain subscriber for Volatile	divergent by design — the point of change #1

⚠️ The "zero depth" divergence previously claimed here is not reachable and should not be read as a behavioural difference. Upstream replaces a zero depth with 42 (detail/qos.cpp:27, :109-110); dispatch_capacity floors it at 1 (pubsub.rs:132). dispatch_capacity is called at exactly four sites, all with a locally declared entity's QoS, and every constructor of that value already normalises zero away: hiroz::qos::QosHistory::KeepLast holds a NonZeroUsize, QosHistory::from_depth maps 0 → 10 (the rmw path, rmw-zenoh-rs/src/qos.rs:241), the FFI conversion maps history_depth <= 0 → 10, and the unspecified case defaults to KeepLast(10). So depth.max(1) cannot observe a zero and the divergence cannot manifest. hiroz also answers the same question three ways — 10 in QosHistory::from_depth, 42 in cache_depth_from_history, 1 in dispatch_capacity — of which only the 42 matches upstream. Upstream's in-tree comment claiming a floor of 1 in rmw_create_subscription (:1137-1139) has no matching code: rmw_zenoh.cpp does not touch depth at all.

One existing test changed. transient_local_delivery_preserves_order published 500 samples through a KeepLast(10) subscriber and asserted all 500 arrived — a promise no RMW makes. Its stated property is ordering, so it now asserts a strictly increasing subsequence of what was published. Losslessness is still covered on the profile that promises it, by keep_all_delivers_every_local_sample.

Coverage this does not have

⚠️ The headline change has no detector. This is measured, not suspected.

Probe	Result
Force qos_needs_advanced to return true unconditionally — so every subscriber declares an AdvancedSubscriber, exactly what this PR exists to stop — and re-run the suite	the whole suite passed

So change #1, which carries the "pure overhead" argument, is unpinned in both directions. A test asserting matches!(handle, SubscriberHandle::Plain { .. }) for a Volatile subscriber would close it.

Everything else that is unpinned, with the one-line revert that should fail and does not:

Production change	Revert that stays green	Why nothing catches it
Teardown discards the backlog (breaking change #5)	Reorder dequeue (pubsub.rs:251-263) to pop pending before checking closed	The reordered loop still terminates, because enqueue early-returns on closed. No test drops a dispatcher with a non-empty queue: the one drop-under-deadline test publishes once and calls await_deliveries(&seen, 1) first, and all four dispatch_backpressure tests release the latch and wait for delivery to be stable for 500 ms before their subscriber goes out of scope. No test asserts on teardown duration.
destroy_subscriber releasing the GIL before dropping (hiroz-py/src/node.rs:434-442)	Restore the bare swap_remove	The only test that calls it uses lambda _msg: None on freshly-minted topics no publisher writes to, so the drain thread never enters a callback and the join never needs the GIL. The pre-existing basic-pubsub test sleeps 0.3 s after its single publish first.
impl Drop for PyZNode releasing the GIL (hiroz-py/src/node.rs:161-175)	Delete the impl	No Python test deletes a node or forces interpreter shutdown while a callback is in flight. The closest — the self-feeding loop test, which drops its node right after the final callback sets its event — is a rare race in the unfixed build, not a check.
publish_raw releasing the GIL (hiroz-py/src/pubsub.rs:49)	Delete py.allow_threads	No test calls publish_raw at all; it appears only in the type stub and a benchmark. (publish is pinned, by test_interpreter_stays_alive_during_reentrant_publish.)
LocalPublishGuard on publish_serialized (pubsub.rs:1133) and publish_sample (pubsub.rs:1150)	Delete either guard	Neither method is called by any test or example, so #249 remains reachable through two of the five public publish entry points with nothing failing. async_publish got a dedicated detector precisely because it was unpinned; the same argument applies here.
catch_unwind around the user callback (pubsub.rs:439)	Call (*handler)(sample) directly	Nothing in the suite panics inside a subscriber callback. Without the guard the drain thread dies, enqueue keeps accepting into a queue nobody drains, and the subscriber goes silent forever with no log.
Teardown and self-drop on the plain/Volatile path	—	Both teardown tests are transient_local_*. On the advanced path a callback dropping its own subscriber always takes the self-join early return; on the plain path a remote sample runs the callback on an RX worker, so the same user code drops from a thread that is not the drain thread — the join actually runs, concurrently with a possible second callback invocation (breaking change #3). I checked that path and it does not deadlock (zenoh holds no session or routing lock across the callout), but nothing pins it and no test exercises it. Volatile is the ROS 2 default.
Drop-order of SubscriberHandle's fields	Swap the two fields	Swapping does not produce a failure I could construct: enqueue returns early once closed is set, and the plain path's inline branch bypasses the queue. Untested, not defective.
The escalating drop/backlog warn!	Remove either warning	No test asserts any warning is emitted. This is the only user-visible signal for the silent loss introduced by breaking change #2.

Correction to a claim this description previously made: "Nothing detects a regression of d40b5443" is too strong. Inverting either if runs_user_code branch is detected — flipping pubsub.rs:1413 leaves a TransientLocal callback subscriber with dispatcher: None, so it runs under zenoh-ext's state mutex and transient_local_callback_republishing_on_same_topic_does_not_deadlock deadlocks; flipping pubsub.rs:1438 sends a Volatile callback subscriber into the inline queue-mode arm and self_feeding_callback_loop_iterates_without_a_depth_cap dies of stack overflow at 2 000 frames. What is genuinely undetected is the narrower direction: making runs_user_code() also return true for the queue variants adds a needless thread and nothing fails.

Two test-quality gaps worth fixing but not blocking:

Gap	Effect
transient_local_delivery_preserves_order (reentrant_publish.rs:688-700) is vacuous at one delivery — received.windows(2).all(..) yields no windows on a 0- or 1-element slice, and the only floor is !is_empty()	A run that delivered 1 of 500 published samples passes and reports that ordering is preserved, having observed no pair. A received.len() >= 2 floor restores the claim without re-asserting the losslessness this PR correctly removed.
Both new test harnesses use rx.recv_timeout(..).is_err() and then panic with a fixed "deadlocked" message (reentrant_publish.rs:103-108, dispatch_backpressure.rs:87-89)	An assert! failing inside a scenario closure drops the sender, so recv_timeout returns Disconnected immediately and an ordinary assertion failure is reported as a deadlock. #260 fixed exactly this on main by matching RecvTimeoutError::Timeout and Disconnected separately; these two files reintroduce the older form. The test still fails, so no verdict is wrong — only the message.
async_publish_delivers_off_the_publishing_thread asserts assert_ne!(callback_thread, publishing_thread) where the thread name is available and is what the comment claims	If session-local inline delivery stopped entirely and the sample came back on a zenoh RX worker, the assertion still passes. Sending thread::current().name() and asserting Some("hiroz-sub-drain") asserts the value rather than a difference. The revert it exists to catch is caught either way.
The two new queue.rs unit tests pin BoundedQueue, not DispatchQueue	zero_capacity_retains_one_sample's doc says a reorder to insert-then-evict makes it fail — true of BoundedQueue::push, which it constructs, and false of DispatchQueue::enqueue, which is what dispatch_capacity sizes. dispatch_capacity's doc cites it as evidence its zero-depth behaviour is harmless; it is not evidence about that type. They are correct tests of the wrong type for the claim they are cited for.

Filed rather than fixed here:

Gap	Issue
Notifier subscribers skip the dispatcher on an unenforced claim	#290
The ffi feature is built on the PR gate but never linted and never tested, and its re-entrancy detector was deleted in 1dcf3736	#291
hiroz never raises MESSAGE_LOST	#292

Checklist

• Added/updated tests and documentation
• CI green on the tip d11d710c — 26/26 check runs SUCCESS/SKIPPED, 0 failed, 0 pending, license/cla SUCCESS. Verified on the current head SHA, filtering CheckRun and requiring status == "COMPLETED" before reading conclusion.
• The full local suite (fmt + clippy + tests) was last run before the rebase onto ae4f0f8f, on a commit that no longer exists in this range. The test count previously quoted here has been removed rather than restated, because it was not re-measured. CI covers the same gates.
• ./scripts/check-local.sh has not been re-run since the rebase.
• D1 (unbounded teardown callout) and D2/D3/D4 (doc comments that contradict the code) are disclosed above and not fixed in this PR. D1 in particular needs either a documented contract on build_with_callback or a bounded/detaching teardown before this ships to Rust callers; D2's sentence is wrong on a verifiable fact and only the doc comment, not this description, survives the merge.

[Copilot]

Pull request overview

Fixes subscriber callback deadlocks by moving hazardous delivery off publishing threads and updating Python bindings accordingly.

Changes:

• Adds QoS-aware subscriber selection and callback dispatch queues.
• Releases Python’s GIL during publishing and removes a receive-side payload copy.
• Adds Rust and Python regression and backpressure tests.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
crates/hiroz/src/pubsub.rs	Implements dispatching and QoS-aware subscribers.
crates/hiroz/src/node.rs	Applies dispatching to raw subscribers.
crates/hiroz/src/ffi/subscriber.rs	Stores generalized subscriber handles.
crates/hiroz/src/common.rs	Identifies handlers that execute user code.
crates/hiroz-tests/tests/reentrant_publish.rs	Tests reentrant publishing and teardown.
crates/hiroz-tests/tests/dispatch_backpressure.rs	Tests dispatcher queue bounds.
crates/hiroz-py/tests/test_reentrant_publish.py	Tests Python reentrancy and thread cleanup.
crates/hiroz-py/src/pubsub.rs	Releases the GIL while publishing.
crates/hiroz-py/src/node.rs	Uses borrowed sample payloads in callbacks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (4)

crates/hiroz/src/pubsub.rs:1325

• This branch runs before runs_user_code is checked, so every TransientLocal queue/notifier subscriber (including rmw's build_with_notifier path) gets an unbounded dispatcher even though its handler only enqueues. That delays the wait-set notification and permits an unbounded backlog ahead of the already bounded BoundedQueue, contradicting the queue-mode contract below. Split the advanced path on runs_user_code and wire queue handlers directly to the advanced subscriber callback.

        let inner = if qos_needs_advanced(&self.entity.qos) {

crates/hiroz/src/pubsub.rs:1526

• build_internal already performs this encoding validation for every DataHandler at lines 1300–1320. Wrapping the new callback again parses each encoding twice and emits duplicate mismatch/unknown-format logs. Pass the callback directly to build_internal.

        let expected_encoding = self.expected_encoding.clone();
        let callback = Arc::new(move |sample: Sample| {

crates/hiroz-py/tests/test_reentrant_publish.py:132

• This makes the Python suite fail unconditionally on macOS, although macOS Python wheels are supported (docs/bindings/python.md:13-14). /proc/self/task is Linux-only and is needed solely by the drain-thread leak detector; skip that one test on unsupported platforms (a skip is not a false pass) while still running the portable re-entrancy tests.

    # The leak test can only see the Rust drain thread through procfs.
    assert os.path.isdir("/proc/self/task"), (
        "/proc/self/task is unavailable - the drain-thread leak test cannot run "
        "on this platform and must not be reported as passing"
    )

crates/hiroz-py/src/pubsub.rs:38

• The watchdog test does not independently exercise this GIL release: with dispatcher delivery enabled, the seed publish() returns quickly, and the test then sleeps for 300 ms before measuring progress, so reverting only allow_threads still passes. Add a detector that keeps the zenoh publish blocked while another Python thread must make progress; otherwise this regression can return unnoticed.

        py.allow_threads(|| self.inner.publish(zbuf.into()))
            .map_err(|e| e.into_pyerr())