Rust's model, translated almost mechanically — with one real surprise.

Bus wraps a std::shared_ptr<detail::Impl>, mirroring Rust's Arc<Inner> — copies are cheap and share state. Consumer is std::function<bool(Envelope&)>, the direct analogue of Rust's blanket Fn(&mut Envelope) -> bool implementation, so lambdas subscribe directly with no adapter class. A thrown exception from a consumer is caught and treated as a nack, exactly like Rust's catch_unwind. std::shared_mutex guards the channel registry and each stage's consumer list (read far more than written); a plain std::mutex guards the dead-letter and callback maps — matching Rust's RwLock/Mutex split exactly.

The one real design bug this port had, and the fix. Originally, Channel::Offer (push) and Poll (pop) shared a single std::mutex guarding the whole queue — so every producer and every consumer on a stage contended on the same lock, regardless of which end they touched. This was this comparison's worst throughput collapse under 8-way concurrency. A first fix attempt used a textbook two-lock (Michael & Scott) queue over a linked list: it fixed the contention but broke the previously-clean single-producer case, introducing a bimodal cold-stall pattern from 200,000 individual heap allocations where std::deque had amortized growth. The working fix backs the same two-lock algorithm with a pre-allocated circular buffer instead, removing the allocator from the hot path entirely — verified clean under ThreadSanitizer in Docker, 13/13 tests, 75/75 assertions.

(Three unrelated construction-time bugs in ra-common-cpp — re-opened /dev/urandom handles, a JSON serialize-then-reparse route clone, and a process-wide mutex around random byte generation — were found and fixed in an earlier pass of this benchmark. They mattered to anyone constructing envelopes directly, but don't show up in the dispatch-only numbers below, which exclude envelope construction from the timed window.)