# Rust FAST presence-map lookup bounds — 2026-10-14

## Observed failure and correction

The public `Pmap` descriptor exposes its `u64` presence bits and `u8` declared
count. A caller can construct counts beyond the storage width. `Pmap::bit`
previously checked only the declared count before shifting. For such a caller
value, indices of 64 or more could panic in an overflow-checked build or read
a lower bit in the measured optimized build.

The helper now checks the `u64` storage width as well as the declared count
before shifting and returns false outside either boundary. Its signature and
const use are preserved. Already representable bits, including index 63 in a
caller-constructed wider descriptor, keep their previous meaning. Ordinary
maps decoded by the shipped FAST reader are already limited to 63 transmitted
bits; they were bounded before this correction. FAST encoding, presence-map
length limits and field/dictionary operators are unchanged.

## Identical fixture and source pins

- Baseline: `eec5fb0a701d21e71785a62ff60661a1a38a7382`, unchanged helper plus
  the identical initially untracked fixture.
- Candidate: `3eda8be70f8f68abfe3b3b0f6d29f8e3abe8a317`.
- Fixture SHA-256: `dbb559541ad76cb9f5636ec5046e9258edc99e35696776b7216763a7a1357400`.

An independent harness imports the actual production FAST module and the
same integration fixture, then compiles it twice with explicit debug/overflow
checks enabled or optimization enabled and both checks disabled. Each baseline
run has **two passes, one failure and zero ignored**. The failed debug case
catches **15 shift-overflow panics**; the optimized case catches no shift panic
but records **seven true results for out-of-storage indices**. Both are
observed runtime failures rather than failed compilation.

The fixed helper passes **all three regression cases in both compiler profiles**,
with zero failures/ignored cases, caught shift panics or invalid true results.
Controls use a real decoded maximal map at a nonzero cursor, its following
empty map, declared-count refusal, stored bit 63 and huge-index refusal. The
malformed caller descriptors use counts 70, 126 and 252 (multiples of seven)
and exercise the storage boundary and lower-bit aliases explicitly.

## Complete qualification

The actual registered optimized FAST stage passes **75 production primitive
and generated-codec tests**, zero failures or ignored cases. The complete
Rust stages pass **2,464 default / 2,266 open** tests, one existing ignored
builders doctest each, zero failed or skipped stages. All three actual stage
processes exit zero; each selected wrapper reports one stage run and zero
failed/skipped. Its exit 2 / PARTIAL denotes stage selection rather than a
complete monorepo sweep.

Strict offline all-target Clippy with `-D warnings` passes both editions.
Rust tests and both standalone compiler profiles use installed 1.92.0;
Clippy uses the retained 1.93.1 toolchain. Source proofs match every path and
SHA across **387 Rust / 637 shared inputs** before and after qualification.
The new fixture's rustfmt check, both changed public-source scans (zero
findings), API inventory and coverage checks, all 13 inventory tests and
`git diff --check` pass. The publication source proof checks these inputs
again after integrating upstream work.

A first capture attempt assumed every selected stage supplied an environment
mapping; the optimized FAST stage passes None. The adapter was corrected to
inherit the surrounding build environment in that case. This preparation
failure occurred before the stage process started and is retained only as
diagnostics. The already passing regression runs remain at their exact pin.

## Resource controls and evidence

The baseline and qualification run on HP under exclusive `isol-no-shared`
leases. Cargo builds use `-j1`, one test thread and test/dev debug output disabled,
with an 8 GiB start / 5 GiB stop available-RAM guard that stops only this
session's child processes if memory or foreign heavy work requires it. Outputs
remain under `/home/yann/build/codex-rust-ibv/libhft`. This session starts no
heavy build on BEELINK2 or Scan; their other sessions' work is left alone.

The packet at `~/archive/libhft/rust-fast-pmap-bounds-20261014` retains the
original helper, exact fixture, baseline/candidate commands and raw output,
actual stage reports, source/input proofs and source bundles. Complete copies
are checksum- and bundle-verified on BEELINK2, HP and Scan before hash-matched
task scratch is removed. Preparation diagnostics are excluded from pass counts.

## Parity status

Scores remain 82/82 applicable APIs, 27/27 protocol rows and 43 complete,
two partial and one not applicable subsystem. The newer validation key/rule
changes and FIXP terminal/view changes are claimed by their existing owners;
this correction edits none of those sources. Live venue/FIXP pilot and
certification evidence remain external partials.