# Rust opt-in native binding discovery — 2026-10-04

## Scope and preserved inputs

The two opt-in C ABI consumers, `fx-ffi-floor` and the parked `rust-fix`,
share native artifact discovery inside their owning harness. Development
defaults to its .NET output; an archive defaults to sibling `libhft-dotnet`.
Owning workload/support markers prevent borrowing an unrelated enclosing
checkout's SDK or support file.

The existing precedence remains `LIBHFTNET_DIR`, then a nonempty
`LIBHFT_BUILD_ROOT`, then `LIBHFT_DOTNET_SOURCE` or the owning default.
Whitespace-only build roots retain their original unset behaviour; trimmed
build-root values, home expansion and paths with spaces work. Configured
missing, empty or relative artifact/source inputs refuse without falling
back to lower-priority values. A nonempty build root must be absolute.
The selected directory must contain the native library before emitting flags.

All original link and environment-watch directives remain byte-identical.
The helper additionally watches its source and selected library. All nine
original runtime/measurement files retain their bytes: there is no change
to structs, wire, calibration, loops, statistics or result grammar. No SDK,
Stage 2, measurement-clock contract, root payload or old result changes.

## Reproduced original behaviour

Both original build scripts are compiled and executed, at baseline
`8fe535985e83ebc2edd0a92ad61a2a4effdbda88`. With no configured inputs and no
owning default library, both accept the native output in an unrelated
parent's `engine/dotnet`. The parent contains an unrelated Git repository;
its native output points at the actual supplied library. The corrected
scripts refuse that same setup. These original successful borrowing
receipts remain retained as evidence of the defect, without a timing claim.

## Complete archive qualification

Source pin `db5b86083365970438e9ead2b9e56d5e3ef36993` supplies the complete
**747-file flat manifest archive**. A development-layout materialization uses
the same whole harness. The explicitly supplied open .NET SDK has **670
source files** at `28f276e2ed6c58b7e99478ebf34b563ce09a9dfc`.

The native artifact comes from the retained, actually built provider runtime
at that same SDK pin, rather than a current host installation or fabricated
library. Its SHA-256 is
`1d6aea36dc8b1ae02a7f18893e026c2f2b87a7e652b42373bd9643e597039252`.
The entire eleven-file runtime archive retains its paths; declared SDK-output
links point to its native directory. No native binary is rebuilt or moved
with alternative flags in this pass. Its original compiler/build receipt and
213-test provider qualification stay attached to the original source pin.

Under an HP high-priority shared CPU lease:

- Six actual Rust compilations build both corrected scripts, both unchanged
  original scripts and one native load probe using each consumer's emitted
  flags. Compiler version/output and exact argv are retained.
- **46 actual build-script invocations** pass expected outcomes: four
  original controls and **42 corrected lookup checks**. They cover explicit
  artifact/source/build roots, precedence, blank/trimmed build roots, home
  expansion, spaces, development/standalone defaults and missing, empty,
  relative or missing-own-support/workload refusals. No case is skipped.
- Each corrected explicit-input output retains the entire original seven
  directive lines as an exact prefix, including the existing linker rpath.
- Both linked probes actually load the supplied native library. Direct and
  `dlsym` calls agree at **ABI 69**; each process's actual memory map contains
  the declared file. Inherited loader overrides are removed for these checks.
- All 747 harness files in both layouts, all 670 SDK sources in each of
  three declared layouts, and all eleven runtime files retain bytes/modes.
  No compiler product is written to a source tree. Both owned materializations
  and their temporary artifact links are removed.

Evidence lives under `evidence/rust-native-inputs-20261004/`; original
scripts, source/runtime tarballs and controller scripts remain under
`~/archive/libhft/rust-native-inputs-20261004/`, outside website downloads.

## Admission limits

This qualifies source/artifact lookup and actual native loading. It does not
build the whole Cargo workspace, requalify the current SDK, exercise the
legacy FFI struct/session contract, run calibration/latency loops or revive
the parked Rust flavour. No physical Stage 5, report or public release grade
is added.

Readiness selects **744 sources**, with zero scrub findings, private or
unresolved references and dead documentation links. Its **69 textual root
escapes** remain an input worklist; the new helper's explicit development
default is one such textual reference. Whole consumer, licence, physical and
coordinated-release gates remain open.

## Concurrent integration

The normal rebase retains other sessions' work. At integrated pin
`2658b1fb70db28c7cd6c2e33c4f88da15ef0a815`, all 747 qualified harness Git
blobs and modes match the tested source. The SDK and native runtime remain
explicit inputs at their original `28f276e2ed6c` pin. No current SDK
rebuild or inherited performance grade is inferred from this integration.