# Rust FIXP C2: finalized session ID retention — 2026-10-03

Rust C2 is implemented for both acceptor owners and both durable replay stores.
This is engineering verification with synthetic session IDs. External two-host
FIXP HA proof and production venue certification remain outstanding.

## Behaviour

- IDs finalized in either handshake direction remain invalid for the owner object's
  lifetime, through child/slot reuse, close/listen, reconfiguration and store-path changes.
  Recovered IDs are copied into owner memory; no replay-window eviction removes them.
- Establish for a retired ID sends EstablishmentReject(Unnegotiated), preserving the
  request ID and timestamp, before establishment or sequence state can advance.
- File and mmap stores keep an append-only `<store>.finalized` companion. Each 28-byte
  record contains LHFF, little-endian u16 version 1 and size 28, the 16 ID bytes and
  little-endian IEEE CRC-32 over the first 24 bytes. No replay sequence is consumed.
  Payload resets preserve finalization; store copies must include the companion.
- Finalization syncs replay, the record and its directory before a terminal response
  or fence release. Corrupt or torn metadata refuses the open without repair.
  A failed record returns StoreError and retires the affected owner/peer; a failed
  terminal write still retires the logical session. An HA mmap writer must hold its
  primary lock. Other peers remain usable.
- Handshake participation stays opt-in. Ordinary disconnects and an unfinished
  handshake do not retire IDs. An already retired ID cannot be revived by disabling
  the handshake switch. Custom durable stores must implement finalization recording,
  lookup and enumeration of recovered IDs; the default recording hook refuses them.

## Verification

Heavy jobs were queued until the host was idle, then run with one Cargo job and
one test thread on HP. No heavy build was started on BEELINK2. A local waiting
Clippy job was cancelled before it started, then verified on HP's isolated
Rust/Clippy 1.93.1 toolchain. Cargo outputs stayed under the session build roots.

- Full venue-enabled crate: **1,203 passed**, zero failures; one existing ignored
  builders doctest. Rust 1.92.0.
- Open-edition crate: **861 passed**, zero failures; the same ignored doctest.
  Rust 1.93.1.
- Strict offline all-target Clippy: development and open editions, `-D warnings`.
- The integrated code candidate is `6e19f6827d4a47f1eeec1c2f82059305debe1980`,
  Rust tree `c3eb7b00e5908db467c15187f4d1f86ae1d40325`. All 333 tracked Rust files
  on the test host matched that candidate by SHA256. The final CLI/TCP run tested
  `2dd491c770663f7ff354cc1ed9bd279e0ff3d7f3`, before the unrelated upstream
  QuickFIX C++ profile recovery correction; C2 and FIXP runner sources are unchanged.
- Twenty-four C2 test functions include a child-process helper. Coverage includes
  both SOFH forms, both handshake directions, file/mmap restart, process exit
  without orderly close, reset preservation, 60 damaged-metadata shapes per store,
  writer failure, primary/standby ownership, terminal-write failure, slot isolation,
  recovered-ID retention after store changes, history larger than a replay window,
  and rejection before sequence resume for a finalized exhausted mmap flow.
- The original reuse regressions failed with Established instead of Rejected on
  both owners. The later recovered-history regressions separately failed on both
  durable stores before owner retention was added. A third baseline failed before
  the exhausted finalized flow could reach its required Unnegotiated rejection.
- The 14 command-line tests and eight physical TCP scenarios pass. Results are
  retained in the archive's final
  CLI/TCP logs and publication manifest, including restart with `--reset-store`,
  rejection by the same owner, and successful establishment for a different ID.
- Targeted rustfmt and the export scan pass; twelve edited engine files have no
  private-name findings. The four coverage/documentation/inventory stages pass
  without skips. Their selected-stage result is PARTIAL, not a full-suite pass.

## Inventory and privacy maintenance

Upstream ad1f2b2b5 changed Java's session to the bounded six-argument FileStore
constructor, while its evidence rule still expected three arguments. The updated
rule recognises the real assignment and both constructor shapes. Its 12 tests
pass, including a regression that fails on the former rule and rejects a
commented constructor or MemoryStore substitution.

7ebb97bfb corrected FileStoreSync prose in the generated matrix but left its
generator claiming refusal. The generator now produces the committed matrix
and HTML unchanged. Its three machine-specific evidence literals moved to
`internal/engine/java/tools/coverage-private-evidence.json`; the generator is
already excluded from the public Java manifest.

Evidence, source pins, patches, bundles and SHA256 manifests are kept in
`~/archive/libhft/rust-fixp-c2-20261003`. The publication manifest identifies
which revision/tree each run tested and the final main commit.