# Rust merged validation and feature qualification — 2026-10-14

## Scope and source

The previous descriptor-bound qualification predates the merged legacy FIX
TIME correction (`df11f5251`) and the other engines' validation-on-arrival
changes. This review qualifies the independent Rust engine at the explicit pin below with its
compiled and XML-loaded dictionaries, both editions and the counter-free
profile. It changes no engine or validation policy.

Qualified pin: `e36d7ff0657f34bfef8a69fecd4f7b8a19e2a568`.
The private coordination commit changes no implementation. Path-and-SHA
manifests capture all 386 Rust and 637 shared inputs before and after testing.

## Actual registered stages

| Selection | Default passed | Open passed | Ignored |
| --- | ---: | ---: | --- |
| Complete Rust engine | 2,461 | 2,263 | One existing builders doctest each |
| Opt-in FIX 5.0 SP1/SP2 dictionaries | 3 | 3 | Zero |
| Library with telemetry counters disabled | 1,503 | 1,340 | Zero |

All six actual stage invocations report one run, zero failures and zero skipped
stages; every Cargo process exits zero. The three service-pack cases exercise
exact compiled-table selection, equality with XML-loaded tables, and dictionary
selection across reconnects. Strict all-target Clippy with `-D warnings` and
`fix50-service-packs` enabled passes in both editions. Before/after source
proofs match all 386 Rust and 637 shared paths and hashes at the qualified pin.

The complete default/open stages include the real legacy FIX 4.0/4.1
loopback timestamp dictionary fixture, with compiled tables, ordinary XML and
renamed XML sources; UTCTIMEONLY remains a time of day. The service-pack
stage explicitly enables the generated FIX 5.0 SP1/SP2 tables and compares
them with runtime XML loading. The counters-disabled stage passes
`--no-default-features`: protocol behavior remains tested with hot counter
writes compiled out. These feature selections overlap the complete suites
and their totals must not be added as unique tests.

Each selection uses the actual `tools/run-conformance` stage through a
capture adapter which adds `-j2` and explicitly selects the edition. The
retained command and environment records identify the edition and Cargo
output directory. A selected wrapper's exit 2 / PARTIAL describes a
selected stage rather than a complete monorepo sweep; the actual Cargo
process must exit zero, with one stage run and zero failed or skipped.

Rust tests use installed Cargo/rustc 1.92.0. Strict offline all-target Clippy
uses the retained 1.93.1 toolchain and also enables `fix50-service-packs` in
both editions. The API inventory and coverage matrix match source; all 13
inventory tests pass. Publication retains explicit qualification pins and
checks the tested implementation and shared inputs again. At the publication
rebase, the only captured deltas are Rust's README correction for existing
FileStoreSync/HTTP proxy support and the C++/Java acceptance stages' report
output-directory arguments in `tools/run-conformance`. The diff changes no
Rust stage definition or process execution helper. A later upstream commit isolates a fallback in the separate
`bench/rust/rust-pure/src/canonical.rs` consumer, which the engine crate does
not compile or depend on. The other 385 Rust files and 635 shared inputs remain
byte-identical to qualification. Neither the other engines' report-path
changes nor the benchmark consumer receive a new qualification or performance
claim from this engine review.

## Resource controls and retained evidence

Scan runs one selection at a time under an exclusive `isol-no-shared` lease,
serial `-j2` builds and one test thread. Its guard requires at least 64 GiB
available RAM and 2 GiB disk space to start, stopping only this session's
child processes below 32 GiB RAM / 1 GiB disk or if foreign heavy work appears.
Test/dev debug output is disabled; build products remain under
`/home/yann/build/codex-fixp-ha/libhft`. HP's other session's full conformance
run and BEELINK2's shared memory are left available; this review starts no
heavy build on those hosts.

The packet at `~/archive/libhft/rust-validation-features-20261014` keeps
commands, actual stdout/stderr, stage reports, exact source/input manifests,
parsed counts and a source bundle. Copies are SHA-256 and bundle-verified
on BEELINK2, HP and Scan before hash-matched task scratch is removed.

## Later contract follow-ups

The validation rulings added while this run was active remain separate from
its pinned behavior: answer 14 names the first tag to arrive a second time;
answer 15 uses a FIX 4.2+ BusinessMessageReject for an application's missing
CompID, with the missing tag named in Text rather than RefTagID. Their source
instructions are `fb14b2345`, refined by `d1e35a3bb`. A separate Rust owner
claims the split ranges of AllowUnknownMsgFields and ValidateUserDefinedFields
(`6622c6ef1`), including the dictionary, config and session tests. That owner
also claims answers 14/15 in `bec50b896`. This
qualification precedes that pending implementation and covers neither that
change nor any subsequent answer-14/15 engine correction. The static scores
below do not certify these newer runtime contracts. The claimed source files
are left with their owner, and the source delta is recorded at publication.

## Parity status

Rust remains 82/82 applicable APIs, 27/27 protocol rows and 43 complete,
two partial and one not applicable subsystem. Live production venue and
FIXP endpoint/session/schema certification are still the external partials.
These offline and loopback selections supply no authorised customer Queue,
venue endpoint or certification approval record.