# Rust TCP and TLS timeout bounds — 2026-10-16

## Behavior

TCP connection setup and blocking TLS client/server handshakes added arbitrary
caller-supplied timeouts to Instant with an overflowing addition. They now use
checked_add and return an explicit failure when the deadline is not representable.
TCP records one failed dial, releases the primary writer fence exactly once,
rotates the endpoint and leaves the session unattached before attempting TCP.
TLS closes its consumed socket and frees the SSL state through the existing
Handshake owner, before sending handshake bytes. Public signatures, ordinary
timeout behavior and callback-unwind ownership are unchanged.

The three existing extreme-timeout cases now expect controlled errors. The TCP
case additionally checks attempt/success/failure counters, no accepted socket,
and a successful retry that writes a Logon. Both TLS cases check peer EOF with
no handshake bytes. Original descriptor identity/closure and exact-once writer
release/standby-promotion helpers remain. All 18 tests in the two fixture files
remain; the other 15 tests and helper prefixes are byte-identical.

## Baseline and qualification

Baseline `08768c0f677552a505cf13d54e6644276692c7df` contains the revised expectations and unchanged
production code. The primary-ownership fixture reports 10 passes / one failure;
the TLS fixture reports five passes / two failures. Both actual Cargo processes
exit 101, and the output includes the standard library's deadline-overflow panic.
Neither run contains an optional TLS SKIP, so the OpenSSL controls execute.

Qualified source: `d5dcbd13a177791fb38decd8e06449980c4a58a6`.

| Check | Result |
|---|---:|
| Actual rust-engine-tests stage | 2690 passed, 0 ignored |
| Actual rust-open-edition-tests stage | 2483 passed, 0 ignored |
| Focused ownership fixtures, development / open | 18 / 17 passed, no TLS SKIP |
| Strict all-target Clippy, development and open | passed, -D warnings |
| Rust documentation generation | passed, -D warnings |
| Fixture formatting and four engine-file export scans | passed, zero findings |
| API inventory, generated coverage and 206 documentation facts | passed |

The open primary fixture excludes the unchanged private file-store case, so it
runs 10 primary tests. An initial capture script wrongly expects 11 and stops
after that Cargo process passes; this harness-only attempt is retained.

Both selected stages report one run, zero failed/skipped stages and actual Cargo
exit zero. Counts include unit, integration and doctest results (64
programs per edition). The wrapper's PARTIAL/exit 2 means selected stages; this
is not a complete monorepo conformance sweep.

All 395 Rust / 637 shared input files match before and after qualification.
BEELINK2 runs the fixed source under a shared-pool CPU lease (all WSL CPUs are
in that pool), one Cargo job, one test thread, no debug symbols, a 24/16 GiB
available-memory guard, a foreign-heavy-job guard and a 2/1 GiB disk guard.
Its compiler/Cargo are 1.93.1; strict Clippy is 0.1.93. An initial isolated-pool
launcher exits before starting any build because WSL has no isolated CPUs.
Scan runs only the baseline, under an exclusive lease, one Cargo job and a
64/32 GiB RAM guard. HP starts no heavy job for this slice. Exact versions,
commands, source hashes and real process results are retained with the logs.

## Retention and remaining scope

Raw correctness output, baseline failures, commands, compatibility proof, input
manifests and a source bundle are retained outside Git at
~/archive/libhft/rust-connect-tls-timeout-20261016 on all three development hosts.
No numeric performance claim is made. These tests use loopback sockets and the
repository's synthetic TLS fixtures; no customer input or credentials are used.

Static Rust scores remain 82/82 applicable APIs, 27/27 protocol rows, 43 complete,
two partial and one not-applicable subsystem. Authorized live venue endpoint /
certification and FIXP venue session/schema certification remain external partials.
FIXP recovery and diagnostic changes through 0283b48da were integrated before
qualification; this slice edits no FIXP source. Other owners' pending validation
changes remain outside this source slice.