# Rust two-process session preflights on HP

These are localhost kernel-TCP diagnostics from 2026-10-01 UTC, reviewed
2026-10-02. The outer jobs used `host-cpu-slot wait --pool isol --priority high`.
That pool permits concurrent shared work; a conformance campaign was active
on shared CPUs. **No row is report-grade or a physical Stage 5 result.**

The [complete evidence tree](evidence/rust-session-stage4-hp-20261002/SHA256SUMS)
retains the initial and corrected runs, both process logs, raw sample files,
first-cycle incoming/outgoing bytes, canonical audits, Cargo locks, dictionary,
manifests and matching adapter/controller source snapshots. Every original
manifest file hash was checked before retention.

## TrueFix

The clean source remains pinned to `2e1ebb9e36caa853d7f24e14ed8bf08e3c50e92c`,
using Rust 1.96.0 and the same scoped V/W dictionary overlay admitted at
Stage 3. Each role uses the public production transport, default dictionary
validation and an application callback channel. Two Tokio workers serve
each process. Both roles complete real logon and logout.

The tiny profile passes all four flows: five excluded warmups, 20 measured
cycles, offered 100/s. The corrected
[medium profile](evidence/rust-session-stage4-hp-20261002/truefix/medium-affinity/summary.csv)
uses three fresh process pairs per flow, 1,000 paced warmups and 10,000
measured cycles per pair. Both roles pass the field/extraction and session
checks in every run, with exactly 30,000 owner-clock samples per flow.

| Flow | Achieved rate /s | Mean run p99, us | Stability | Local gate |
|---|---|---:|---|---|
| `nos_er` | 9,959–9,963 | 105.710 | PASS | pass |
| `md` | 8,615–8,681 | 126.832 | PASS | rate fails |
| `md_nos_er` | 4,572–4,600 | 240.463 | PASS | rate fails |
| `tick_to_trade` | 9,985–9,988 | 97.466 | PASS | pass |

The adapter keeps one cycle outstanding and schedules the next at the
requested rate. Backpressure therefore reduces achieved rate; these rows
do not establish the engine's capacity with pipelined requests. Market-data
rate and physical integration remain open.

## LibHFT Rust Pure

The new adapter uses public `Session<NullStore, Capture>` with `Io::Kernel`,
production logon, checksum and sequence checks, application send hooks and
the public wire parser/builder. It does not link hftnet. The manifest pins
the engine revision and every tracked Rust engine file; the default
`telemetry-counters` feature is enabled.

The corrected
[tiny preflight](evidence/rust-session-stage4-hp-20261002/libhft-rust-pure/tiny/summary.csv)
passes all four flows with 20 samples each and achieved rates 99.975–99.989/s.
Both roles complete logon/logout. Every incoming cycle is decoded and
checked, including all 20 standard book entries, the best-ask-derived order,
and the new-order ACK fields. Tick-to-trade emits only W → D; its raw
samples belong to the server. Both admitted Rust adapters start that diagnostic
span before snapshot construction and finish after reactive-order decoding and
extraction. The tighter prepared-wire-send boundary remains pending.

The later [medium run](evidence/rust-session-stage4-hp-20261002/libhft-rust-pure/medium/summary.csv)
retains 30,000 samples per flow across three fresh process pairs. All four
flows pass functional, canonical-wire, exact-sample and 10,000/s rate gates.
The achieved range is 9,990–9,993/s. Market data and tick-to-trade have
aggregate stability warnings, so this bundle exits 1 and remains diagnostic.

| Flow | Mean run p99, us | p99 CV | Stability | Local gate |
|---|---:|---:|---|---|
| `nos_er` | 28.061 | 0.022685 | PASS | pass |
| `md` | 23.402 | 0.116022 | WARN | stability fails |
| `md_nos_er` | 47.266 | 0.047789 | PASS | pass |
| `tick_to_trade` | 22.920 | 0.149922 | WARN | stability fails |

The tick-to-trade p99.9 CV is 0.444197, also a warning. A physical report run
must use an `isol-no-shared` lease and pass all stability gates; these localhost
diagnostics ran alongside shared conformance work.

## Process masks and retained failures

The initial controller let both roles inherit HP's complete isolated mask
8–17. The first Rust Pure tiny run completed the protocol but measured only
17–36/s, with millisecond scheduling delays. Both processes were busy
polling and could share a CPU. The corrected controller assigns disjoint
halves: server 8–12, client 13–17. Its per-run commands retain those exact
masks. The observed corrected runs pass the tiny rate gates; the initial
failure remains in `libhft-rust-pure/before-affinity/`.

TrueFix's initial medium results also remain in `truefix/medium/` beside
the corrected `medium-affinity/` run. The first-cycle wire auditor compares
each original emitted frame with the peer's received bytes and checks
BodyLength, CheckSum and the canonical message sequence. Full incoming field
extraction continues throughout measurement; capture retains only the first
cycle to bound diagnostic overhead.

## Physical follow-up

`run_dac_rust_sessions.py` now drives both accepted DAC rigs using these
byte-identical HP-tested binaries. The pinned installer carries each binary,
dictionary and build provenance; the fixed root-owned launcher enforces the
selected namespace, bounded lifetime and disjoint process masks. The physical
controller shares the local raw/completion/wire/rate grader, checks physical
TX deltas for every fresh process pair and requires the CPU helper's inherited
shared and isolated leases. Its report gate excludes tiny/smoke profiles,
incomplete samples, failed rates, nonpassing stability and missing physical
proof. The current scenario contract additionally requires scheduler-delay
samples, admin-message counts, no measured resend request, at least 98% of
offered rate and a prepared-wire tick-send boundary. The admitted local
binaries do not yet emit that instrumentation; the DAC controller records
those omissions as report blockers and keeps their physical rows diagnostic.
Root installation, instrumentation and the actual Stage 5 runs remain pending.