# Explicit durability conflicts and Rust HA test isolation

C++ and Rust now refuse contradictory `FileStoreSync` and
`LibhftStoreDurability` settings in either order, matching Java and .NET.
A separate test-isolation correction moves the QuickFIX HA child-process test
out of Rust's parallel library test executable. Neither correction adds locks
or changes the engine send path.

## Durability configuration

Both parsers previously let the last explicit key overwrite the other policy.
For example, a sync-before-send request followed by a checkpoint request could
produce a valid checkpoint-only configuration instead of reporting a conflict.
That parser result is reproduced; an end-to-end lost-write event is not claimed.

C++ already tracked which key supplied the policy, but checked conflicts only
against the `sync-file` / `async-file` mode aliases. It now also checks the other
explicit durability key before replacing its value. Rust retains both requested
values and now compares them during configuration finalization.

Each engine's regression covers 16 combinations: the two policy values,
matching and contradictory settings, both key orders, and defaults/session
inheritance. C++ exercises direct application and real config-file loading;
Rust exercises the actual text parser. Matching policies remain accepted.
Both unchanged baselines fail the new contradiction checks. The baseline
source pin is `801051435`; archived before files include the added Rust test but
not its production correction.

## Rust child-process test isolation

The initial full parallel library run reported 883 passes and five failures in
HA lock release/handoff. All 89 store tests passed serially. The only library
test spawning a command was the QuickFIX cross-process HA test. Between spawn
and exec, its child can retain the open file descriptions of unrelated tests;
an inherited `flock` can therefore outlive the parent's descriptor close.
The TLS certificate helper and separate FIXP HA test already document this
failure mode.

The QuickFIX test now has its own integration-test executable, using the same
pattern as `tests/fixp_ha_cross_process.rs`. It still launches real children,
proves exclusion while the ordinary writer owns the store, then proves promotion
and recovery of outbound/inbound sequences after handoff, for both physical
QuickFIX layouts. No store locking implementation changed.

## Verification

At the pre-rebase source pin above plus the archived patch:

- C++ store-selection and file-store runner suites passed in the development and
  open editions, compiled with GCC 14 and C++11.
- Rust configuration tests passed: 26 development, 19 open, none ignored.
- After test isolation, ordinary `cargo test --offline` passed 892 runtime tests:
  887 library, two probe-unit, two FIXP process, and one QuickFIX process tests.
  One pre-existing illustrative builder doctest remains ignored; it contains
  caller-supplied `s` and `now`, not a complete runnable program.
- Export scans of all five changed engine files reported zero findings.

Logs, before files and final source hashes are retained under
`~/archive/libhft/store-durability-conflicts-20261003/`. Post-rebase logs are kept
separately so these counts are not represented as evidence for a different source
pin. This is functional coverage, not NIC or latency evidence.