# Complete canonical Rust open session generation

2026-10-12. This separate generation advances the
[full-bench plan](../../../docs/bench/PLAN_FULL_BENCH.md) while preserving all
older Rust adapters, physical diagnostics and immutable packages.

## Production SDK and original boundaries

The new driver uses the unchanged public Rust open engine, its production
kernel TCP session and `NullStore`. It builds against an independent 303-file
export selection, not a sibling development checkout. The complete 814-file
benchmark selection and SDK are independently inventoried before and after
qualification:

- Harness: `uncommitted-rust-canonical-harness-baa91ed77699e96d969a0bc04277e356ea3ca8dfb7b1f71c17ae44e0d90d2a02`.
- SDK: `uncommitted-rust-canonical-sdk-13cb404bf6160fc58fec0ab85d6f30907d11e17a772dff2d3e0cb2c9c9123e4a`.

Executable-local linker wrappers forward `recv` and `send` unchanged to
libc and observe only the registered session socket. Completed accepted bytes
are reconstructed across partial/coalesced operations and streamed to original
capture files. Actual original Logons and bilateral Logouts are retained.
This changes no SDK source or protocol response.

All four bodies follow the independent canonical model, including ten-level
bid/ask order, varied table values, causal mixed/tick orders and exact ACK
spelling/order. The owner folds actual received fields with the common typed
checksum. Warmup resets both marker and sink. Tick starts after serialization
in the public before-send callback; its same-process `Instant` end is recorded
immediately after the receiving socket call, before capture, parsing and
extraction. Both original raw series use unrounded nanoseconds.

## Fresh and portable qualification

HP and SCAN each freshly build the SDK and driver and pass twelve real pairs
with zero/repeated warmup. Their executables are byte-identical:
`c906c072560e9259892e9a5447ba21c23beb63d292d9ef8f864013c69af8b210`.
The exact HP portable package passes another twelve SCAN pairs with all runtime
bytes unchanged and no new compile. Each functional cohort retains 240
primary/delay samples and 700 original application frames per peer.
The SDK has no compile error; four warnings identify unused helpers in the
shared benchmark options/measurement module.

Independent cold audits on both hosts reproduce all twelve original fixture
receipts and reject **75 altered proofs each**, including observer, transport,
store, clock, full-body order/value, full capture, owner fold and raw
declarations. They create no new sockets or compilation.

## HP full local timing matrix

A high-priority exclusive CPU lease completes three runs per flow, with 1,000
excluded warmups, 10,000 measured cycles and a 10,000/s offer. All complete
fixtures and owners pass. All four flows pass rate, delay and full percentile
stability gates, retaining **120,000 primary/delay samples and 330,000 original
application frames per peer**.

| Flow | Achieved cycles/s across three runs | Local timing gates |
|---|---:|---|
| NOS/ER | 9,992.17–9,992.88 | pass |
| MD | 9,992.52–9,992.70 | pass |
| Mixed | 9,992.25–9,992.30 | pass |
| Tick | 9,991.97–9,992.73 | pass |

The first full replay helper mistakenly passed the QuickFIX/J engine identity
to the common rate/raw gate. The reader refused that mismatch. The original
failed log/helper remain intact; a separate corrected replay reproduces all
twelve receipts, raw quantiles/extrema and passing decisions exactly, without
changing any original sample or source.

These are localhost measurements. They award no physical Stage 5 admission.

## Separate physical preparation

The pinned two-file portable runtime tree is
`c0d4efb98df7de270826cd73a20582fffca7ab52e5b3033fe5a836463398a31b`.
A separate fixed Rust installer, namespace launcher and generic controller
coexist with the three older instrumented Rust adapters. The complete
816-file controller selection is
`uncommitted-rust-physical-controller-9cc23211bd4932319b98673ac4ce298521ce0a5ddc60c0a213dc36d5f15e0e7b`.

HP admits the stripped CLI and refuses the absent root runtime before output
creation or sockets. The offline physical reader now supports an explicit
fixed Rust policy. Twelve retained SDK cases across C++, Native and Rust pass
with **explicitly synthetic** commands/counters/runtime declarations; 42
altered controls are refused. Twelve focused counter tests also pass.
These controls prove reader decisions, not actual NIC traffic or root installs.

Root admission, actual accepted DAC matrices, independent physical replay and
matched Rust comparator results remain required. Earlier missing-fixture
declarations cannot borrow this generation's proof.

Both hosts now pass the exact fixed installer staged-input checks. The original
home filename, `~/install-fullbench-stage5.sh`, includes this separately qualified
fourth bundle alongside canonical Native, older instrumented Rust and canonical
C++ CORE. Shell syntax and both-host four-bundle preflight pass. All four new
prefixes remain absent at this checkpoint; input checks do not claim installation.
Separate Rust physical jobs wait for root admission without CPU leases, then
request exclusive slots with HP high priority and SCAN normal priority. The
[preflight checkpoint](evidence/rust-canonical-root-preflight-20261012/checkpoint.json)
preserves the exact controller/configuration, input checks and waiting logs.

## Immutable retention

[Import](evidence/rust-complete-canonical-20261012/import-receipt.json)
and [seal](evidence/rust-complete-canonical-20261012/retention-seal.json)
retain **4,520 files / 197,133,418 bytes**, seal SHA-256
`bcd417887562c43e9517efe1cc1ee8e75e23ed62ceb2a26eb06761f9ebc58d9f`.
Both host replicas verify original bytes/modes. The supplement retains all
48 actual pairs, 120,720 primary/delay samples, 332,100 original frames per
peer, both cold cohorts, exact portable products, full replay, source/runtime
inventories and every failed helper log. Synthetic reader copies add no SDK
pairs or physical measurements.