# Rust FIX sequence telemetry: full unsigned width

## Source and reproduction

The verified runtime candidate is `d3b4e6434b50f5505339effdfa8928430c134eba`.
The negative test ran at `8cdbb6eb60a0d0a01002be0782da6b383a0c43ca`, with only
the initial public-API regression added. Its journal retained the original payload
and recovered next inbound/outbound sequence `4294967295`; the signed telemetry
array instead returned `4294967294`. This was the old 32-bit projection clamp.
The recorded baseline has one failed test.

Evidence is retained in `~/archive/libhft/rust-telemetry-sequences-20261003`:
baseline source and log, the runtime patch and verified-source bundle, all gate
logs, complete Rust file hashes, reference programs and their nine exact outputs.
`publication.json` identifies the final published commits and `SHA256SUMS`
verifies the archive. The bundle requires the baseline commit above.

## Change and coverage

The Rust snapshot now matches C++ C1a: `in_msg_seq_num`, `out_msg_seq_num`,
`pending_high_seq` and `last_store_failure_seq` are u64. `Session::telemetry`
copies their owner-maintained values directly. The 25-field order, names and
non-sequence counter widths stay unchanged. The standalone metrics probe converts
its seed to the new width explicitly.

JSON and Prometheus retain the unsigned numbers. The signed field-array projection
reports UNKNOWN (-1) for values above i64::MAX, rather than wrapping or clamping.
The first three sequence fields use the u64 UNKNOWN sentinel, including FIXP's
projection into FIX telemetry. As in C++, the failure watermark's text rendering
has no sentinel: even u64::MAX renders literally there.

Four public-API regressions cover:

- Real journal save, close, recovery and session projection at both sides of the
  old 32-bit boundary and near the signed journal limit, with retained payloads.
  The failure watermark is seeded through its public owner field to test projection.
- All four sequence fields at unsigned and signed boundaries, and a checked signed
  array projection without changing the width of ordinary health counters.
- UNKNOWN values in the general snapshot and the real FIXP projection.
- Owner publication, registry capture and a real loopback HTTP metrics scrape,
  including a twenty-digit unsigned number and all 25 series.

An independent C++ program invokes the reference renderers on the same snapshots.
Its combined Prometheus/JSON bytes match Rust at all nine values: 0, 1,
4294967294, 4294967295, 4294967296, 9223372036854775807,
9223372036854775808, 18446744073709551614 and 18446744073709551615.

## Verification

Jobs ran serially on HP with memory checked before each one. Builds used
`LIBHFT_BUILD_ROOT=/home/yann/build/codex-rust-ibv/libhft`, offline Cargo and `-j1`;
suite execution used `--test-threads=1`. BEELINK2's concurrent build was left alone.

| Gate | Result |
|---|---|
| Negative journal/session projection regression | 1 failed at the baseline, as expected |
| Four new integration cases | 4 passed |
| Full default suite, Rust/Cargo 1.92.0 | 1,019 passed, 0 failed, 1 existing ignored builders doctest |
| Full open suite, Rust/Cargo 1.92.0 | 888 passed, 0 failed, the same 1 ignored doctest |
| Strict Clippy 1.93.1, all targets, both editions | Passed with `-D warnings` |
| Real standalone TCP and UDS endpoint probes | 2 passed, 0 failed, 0 skipped; 25 series each |
| C++/Rust reference renderer comparison | 9 byte-identical cases |
| Shared telemetry source contract checker | Passed |
| New integration source rustfmt; six changed Rust files export scan | Passed; 0 scrub findings |

All 334 tracked Rust files were hashed in both the testing and publishing worktrees
and matched. The final publication check records any rebase and source comparison
in the archive; the full suite counts above are pinned to the verified candidate.

## Remaining parity work

This closes the telemetry width gap. The live FIX exhaustion ceiling and parser
remain the coordinated step owned by the flavour owners. The separate six-counter contract is being adopted by its Rust owner.
The classic mmap layout still needs coordinated widening. The rare missing-record
journal observation remains unexplained, and venue/FIXP production certification
still requires actual venue inputs and evidence. No venue or latency campaign was
run for this change.