refactor(sigsafe): extract allocator crate

Co-authored-by: GPT-5 Codex <codex@openai.com>

Author: wan9chi

Cargo.lock

@@ -131,6 +131,7 @@ serde_norway = "0.9.42"
 sha2 = "0.11.0"
 shell-escape = "0.1.5"
 sigsafe = { path = "crates/sigsafe" }
+sigsafe_alloc = { path = "crates/sigsafe_alloc" }
 similar = "3.0.0"
 smallvec = { version = "2.0.0-alpha.12", features = ["std"] }
 snapshot_test = { path = "crates/snapshot_test" }

Cargo.toml

@@ -17,7 +17,7 @@ fspy_shared = { workspace = true }
 fspy_shared_unix = { workspace = true }
 libc = { workspace = true }
 nix = { workspace = true, features = ["signal", "fs", "socket", "mman", "time"] }
-sigsafe = { workspace = true }
+sigsafe_alloc = { workspace = true }
 
 [build-dependencies]
 artifact_profile = { workspace = true }

crates/fspy_preload_unix/Cargo.toml

@@ -49,7 +49,7 @@ impl RawExec {
         // execs), where malloc's lock may be held by a thread that no longer
         // exists. A per-call arena has exactly this lifetime, and hands back
         // the memory when the call ends.
-        let arena = sigsafe::alloc::arena();
+        let arena = sigsafe_alloc::arena();
         let mut ptr_vec = allocator_api2::vec::Vec::with_capacity_in(strs.len() + 1, &arena);
         for s in &mut strs {
             s.push(0);

crates/fspy_preload_unix/src/client/raw_exec.rs

@@ -8,8 +8,6 @@ publish = false
 doctest = false
 
 [target.'cfg(unix)'.dependencies]
-allocator-api2 = { workspace = true }
-bump-scope = { workspace = true }
 rustix = { workspace = true }
 
 # On Linux the page size is probed from the kernel directly (see param.rs);
@@ -26,10 +24,5 @@ rustix = { workspace = true, features = ["runtime"] }
 [target.'cfg(target_os = "linux")'.dev-dependencies]
 rustix = { workspace = true, features = ["param"] }
 
-[target.'cfg(unix)'.dev-dependencies]
-# The `alloc` feature provides `Global`, letting tests run the pool against
-# the host allocator (and thus under Miri).
-allocator-api2 = { workspace = true, features = ["alloc"] }
-
 [lints]
 workspace = true

crates/sigsafe/Cargo.toml

@@ -32,7 +32,7 @@ Every function in this crate follows three rules:
    set of atomics, each touched by single complete operations.
 3. **No global allocation.** No function touches a heap behind the caller's
    back. Code that needs memory gets it from an explicit allocator —
-   [`alloc`](src/alloc/mod.rs) provides one built on `mmap`.
+   [`sigsafe_alloc`](../sigsafe_alloc) provides one built on `mmap`.
 
 ## How rule 1 is enforced on Linux
 
@@ -53,8 +53,5 @@ backend check above is what keeps that true.
 
 - `mm` — anonymous memory mappings: `mmap_anonymous`, `munmap`.
 - `param` — `page_size`.
-- `alloc` — allocation without malloc: `alloc::arena()` gives one
-  intercepted call a bump arena that draws 64 KiB chunks from a process-wide
-  lock-free pool and returns them when the call ends. Taking or returning a
-  chunk is one atomic swap; when the pool is empty, chunks come straight
-  from the kernel through `mm`.
+
+Allocation without malloc lives in [`sigsafe_alloc`](../sigsafe_alloc).

crates/sigsafe/README.md

@@ -14,7 +14,6 @@
 #![cfg(unix)]
 #![cfg_attr(not(test), no_std)]
 
-pub mod alloc;
 pub mod mm;
 pub mod param;
 

crates/sigsafe/src/lib.rs

@@ -0,0 +1,21 @@
+[package]
+name = "sigsafe_alloc"
+edition = "2024"
+license.workspace = true
+publish = false
+
+[lib]
+doctest = false
+
+[target.'cfg(unix)'.dependencies]
+allocator-api2 = { workspace = true }
+bump-scope = { workspace = true }
+sigsafe = { workspace = true }
+
+[target.'cfg(unix)'.dev-dependencies]
+# The `alloc` feature provides `Global`, letting tests run the pool against
+# the host allocator (and thus under Miri).
+allocator-api2 = { workspace = true, features = ["alloc"] }
+
+[lints]
+workspace = true

crates/sigsafe_alloc/Cargo.toml

@@ -4,13 +4,16 @@
 //! traced program (see the crate docs), so the preload library allocates
 //! through this module instead. It stacks three layers and exposes only the
 //! top one, [`arena`]. `MmapAllocator` is the bottom: a stateless allocator
-//! where every allocation is a fresh anonymous mapping from [`crate::mm`].
+//! where every allocation is a fresh anonymous mapping from [`sigsafe::mm`].
 //! `ChunkPool` sits on top of it and caches fixed-size chunks, so that
 //! frequent short tracing calls can reuse memory instead of paying two
 //! syscalls per call. [`arena`] creates one `bump_scope::Bump` per
 //! intercepted call, drawing its chunks from the process-wide pool and
 //! returning them on drop.
 
+#![cfg(unix)]
+#![cfg_attr(not(test), no_std)]
+
 mod mmap;
 mod pool;
 

crates/sigsafe/src/alloc/mod.rs crates/sigsafe_alloc/src/lib.rscrates/sigsafe/src/alloc/mod.rs renamed to crates/sigsafe_alloc/src/lib.rs

@@ -6,8 +6,7 @@ use core::{
 };
 
 use allocator_api2::alloc::{AllocError, Allocator};
-
-use crate::{
+use sigsafe::{
     mm::{MapFlags, ProtFlags, mmap_anonymous, munmap},
     param::page_size,
 };
@@ -21,7 +20,7 @@ use crate::{
 /// the kernel does all the bookkeeping. A signal or a `fork()` can never
 /// catch it holding a lock or a half-written structure, because there is
 /// nothing to hold. The mapping calls and the page-size read come from
-/// [`crate::mm`] and [`crate::param`], which carry the same guarantee (see
+/// [`sigsafe::mm`] and [`sigsafe::param`], which carry the same guarantee (see
 /// their docs).
 ///
 /// # What it accepts