# Rust explicit reconnect retires the original connection before writer handoff

## Reproduced baseline

Unchanged engine source at `053a786e1` passes two initial-connect controls and
fails fifteen explicit-replacement regressions. A separate scratch crate uses
the exact checked-out engine as its dependency. All 354 tracked Rust source
inputs are checked against their baseline hashes; its final seventeen-case
fixture is byte-identical to the published integration test. The actual exit
101 and complete failure diagnostics are retained.

`Initiator::connect` previously shut down the old session only after a new dial
succeeded. Refused TCP, name resolution, socket configuration and proxy failures
could release the primary store while the original connection stayed attached
and logged on. Schedule deferral, store admission refusal/standby and an existing
store fault also left the old connection attached. A successful replacement
checked primary admission before retiring that connection. Logout-save and
ResetOnDisconnect failures were discovered only after opening the new socket.

## Contract and implementation

An explicit `connect` replaces an attached connection. Before schedule checking,
store admission or dialing it now calls the existing session shutdown, follows
its disconnected lifecycle state, then releases primary ownership. Shutdown
performs its Logout/checkpoint or configured reset under the old writer fence
and closes the transport before the fence is handed back. The existing terminal
store-fault check then refuses a replacement dial if teardown detected a fault.
Successful attempts reacquire the store and restore promoted sequences normally.

The production change is a five-line conditional on the cold reconnect path,
plus its API documentation. No per-message work, field, dependency or store
implementation is added. The initiator introduction also describes its already
implemented HTTP proxy support. `run` continues to adopt an attached connection;
this change applies to an explicit replacement call. Shutdown still does not
wait for the peer's Logout response; the existing LogoutHandle/run path owns
that graceful exchange.

## Regression coverage

Seventeen integration cases exercise the safe public API, real loopback TCP
sessions and deterministic MessageStore callbacks. Two controls cover a first
successful/refused connect. Fifteen regressions cover refused TCP, resolution,
invalid socket options, refused/silent HTTP proxies, HA standby/admission errors,
schedule deferral, existing store fault, teardown Logout-save/reset faults,
successful sequence continuation/reset and pending-Logon/existing-Logout states.
The last two start from a real logged-on pair and seed the public status field
to isolate shutdown behavior at those states.

The store records checkpoint/reset, release and primary-admission ordering.
Descriptor checks require close before release and new admission; teardown
writes must retain primary ownership. The real old peer must observe EOF.
Teardown-fault cases require no new accepted socket and zero dial attempts.
Successful replacements check actual Logon sequence bytes, replay retention of
the old application or reset of its epoch, and admin markers remaining replay
gaps. Socket fixtures own their descriptors; HTTP reads and fixture waits are
bounded. No new case is ignored.

An initial fixture used a private sequence field and did not compile; it was
corrected to the public accessor before the baseline ran. The initial positive
fixture also incorrectly expected a Logout marker to carry replay bytes. That
assertion was corrected to check an actual application payload and the admin
gap, and both baseline and candidate were rerun with the final identical fixture.
These attempt logs are retained separately and are not reported as passes.

## Verification

| Gate | Result |
|---|---|
| Unchanged baseline, final fixture | 2 controls pass; 15 regressions fail |
| Focused new integration suite | 17 passed, 0 failed, 0 ignored |
| Complete default Rust stage | 1,894 passed, 0 failed; 1 existing ignored builders doctest |
| Complete open Rust stage | 1,707 passed, 0 failed; the same 1 ignored doctest |
| Strict all-target Clippy, -D warnings | Passed in both editions |
| Rustfmt | Complete new test and complete new teardown block match |
| Public-export scan | 2 owned engine files, 0 findings |
| API inventory / generated coverage --check | Passed; scores unchanged |

Each Rust conformance stage reports one ran, zero failed, zero skipped. Each is
the complete Cargo suite for that edition; PARTIAL refers to the other unselected
monorepo stages. The new seventeen cases run in both complete suites.

Tested candidate `37e6fa178` matches all 355 tracked Rust path/hash pairs on HP
and in the publication worktree. Shared fixture/reference-tool and gate inputs
are also checked, with 533 path/hash pairs retained. Publication input checks
retain the exact comparison after rebasing; unrelated upstream edits do not
justify repeating unchanged Cargo suites. The tested candidate and initial
candidate remain recoverable through named bundle refs.

All builds/tests run serially on HP, offline, at Cargo -j1 and one test thread,
with development/test debug symbols disabled and absolute session build roots.
Every stage checks compiler/runtime activity and at least 8 GiB available RAM.
Rust/Cargo 1.92.0 runs tests; the isolated 1.93.1 toolchain runs Clippy. No heavy
build/test runs on BEELINK2 alongside other sessions.

Pins, manifests, source patches, original failures, full stage reports/stdout/
stderr/commands, Clippy logs and the publication bundle are retained under
`~/archive/libhft/rust-initiator-replacement-20261011` on both hosts, checked with
SHA256SUMS. Rust scores stay at 82 supported / 11 n/a API entries, 27/27 session
behaviors and 43 yes / 2 partial / 1 n/a subsystem rows.

## Evidence limits

The new fence/admission/error observations use a deterministic store, not a
new two-host HA deployment, filesystem-fault campaign or physical NIC run.
Existing store, accelerated-owner and lifecycle cases run in the complete
suites. This slice adds no live feed/order, venue or FIXP schema certification
evidence; those subsystem rows remain partial.