# Portable bounded Rust TCP floor — 2026-10-12

This qualifies a portable controller and a separately pinned bounded runtime.
It retains **six actual localhost pairs and 120 original RTT samples**, with
no physical pair, FIX comparator pass, quiet timing or release promotion.

## Inputs and real consumer checks

| Input | Qualified identity |
|---|---|
| Complete build archive | `2c857b293e26543573a6e65b569d9cecd3966094`, 789 selected files |
| Latest consumer archive | `e83ed6a028cffc044ffc6cc5cd5c1249e606e993`, 789 selected files |
| Unchanged Rust floor source | `3173d27f6583e32f3a15bf4a9d0e41b05d17c7bc4362de14bdba9c68a464c726` |
| Independently compiled binary, both hosts | `214fd5da7cc9cef29837c8886ba14ac278bd71e81e22e85219efd22a8a7f9275` |

HP and SCAN compile the actual archive source with their installed Rust
1.92 compiler, edition 2021 and explicit optimization level 3, outside the
source tree. Each retains the full compiler identity and actual argv. The
independent builds produce identical binary bytes. Both entire source archives
retain their original bytes and modes; no Git or engine tree is borrowed.

Each host runs three unprivileged local pairs: 64-byte no-touch, 64-byte touch,
and 128-byte touch, with five excluded warmups and 20 measured exchanges per
pair. Every bounded server exits successfully after its one client disconnects.
The actual clients retain complete original HFTBRW1 samples and CSV counts;
independent parsing leaves every raw file unchanged. These clocks have a
functional diagnostic grade only.

HP uses a high-priority shared lease. SCAN's initial normal shared request
waits behind a long-running owner; only this session's verified wait PID 422303
is cancelled. Its build and functional checks then use an isolated lease with
shared work allowed, waiting behind existing isolated jobs. All original
queue/process observations are retained; no other owner's job is changed.

The original archive passes 34 focused checks on both hosts. The latest
complete consumer archive passes **37 checks, zero skips**, including actual
status-process controls. Its CLI imports and prints help without a Git or
engine directory. Source and runtime identity remain separate: the archive
still declares `source-archive-unqualified`.

## Controller gates and retained corrections

`bench/rust/ping-pong/run_dac.py` consumes an explicit physical-rig declaration,
separate endpoint cores and hash-pinned executable/source/build provenance.
The installed executable and provenance, including every ancestor directory,
must be root-owned and not user-writable. A missing, changed, linked or
unbounded executable is refused before a pair starts.

Every actual physical pair will need successful process exits, exact original
raw/CSV identity, counts and payload, and positive counters from both declared
physical ports. The shared bounded polling preserves every actual TX read
without probe traffic. The controller reaps the bounded server instead of
terminating only sudo. Original CSV statistics and independently derived raw
statistics remain distinguishable. Output must lie outside the harness source.

Retained initial failures do not change an earlier grade:

- The first raw-truncation test expected a `RuntimeError`; the common reader
  already refused that malformed file with `ValueError`. The correction accepts
  both refusal types. The original failure and passing rerun are retained.
- The first outer build wrapper exited after a busy `host-cpu-slot status`
  because of shell `set -e`; neither host started a build or pair. The corrected
  wrapper proceeds to the helper's actual run/wait queue.
- Status also returns 1 while this controller holds its own lease. The latest
  controller retains that expected status, accepts only 0/1 for status, and
  refuses other failures. Actual-process controls cover both valid states and
  an error. This was corrected before any physical attempt.

## Immutable installation and remaining physical runs

The existing HP `rust_ping_pong` is a different, unbounded generation at
`2e6050ad7254f0a87f6e2ff7ead718efa4c65f788fa83789b02eec706fe35327`;
SCAN has no copy at that original path. Neither is replaced or relabelled.
The new private fixed installer creates
`/usr/local/libexec/libhft-bench/fullbench-rust-tcp-floor-v2/` containing the
three hash-pinned runtime/source/provenance files. It preserves every older
runtime and refuses a differing existing v2 destination.

Both hosts' clean main checkouts now contain the fixed installer; its real
readonly staged checks pass. The atomically updated home script
`~/install-fullbench-stage5-next.sh` now covers all six pending runtime
installations, checking both hosts before the first root operation. Its full
readonly checks pass on both hosts. It requests sudo authentication after
acquiring a shared CPU lease, with high priority on HP, and confirms all six
root directories after installation. Exact script bytes and readiness outputs
are retained separately from the original cold proof.

The user must authenticate the root installation. Both physical runs remain
pending that action and the required CPU leases, with high priority on HP.
Defaults are three separate physical pairs, 1,000 warmups and 10,000 RTT
samples each at 128 bytes with touch enabled. This physical network floor
will remain distinct from all four-flow FIX comparisons.

The [cold proof](evidence/portable-tcp-floor-20261012/cold-proof.json) binds the
unchanged original build, functional and failure receipts. Compiled binaries
remain archive-only under
`~/archive/libhft/tcp-floor-v2-qualification-20261012-2c857b293e26/`; their exact
hashes are recorded. No engine, microbench row, Stage 2 contract, host service
or historical result changes. Whole-harness standalone/release gates remain
open.