# Public Rust canonical preflight — HP qualification

The standalone public Rust full-session consumer now adds ten functional
cycles before its requested warmup, closes each directional capture at that
limit and verifies the independent owner sink/folds before warmup. Markers
and sink reset at phase boundaries. Complete live message counts, measured
owner folds and primary/delay sample counts remain available without measured
application-message I/O. The SDK source is unchanged.

The capture also ends measured administration at the final completed
application frames, so a following Logout in the same receive cannot acquire
a measured classification. The existing owner/clock policy remains explicit.
The build selects the new independent preflight helper, and a portable cold
controller reuses the actual-pair corruption controls.

## Current verification

All 437 focused preflight, compact-writer and generation-admission controls
pass from the complete stripped 887-file source snapshot, with no engine,
internal or Git directory and zero skips. Its inventory SHA-256 is
`9c485359fe296c6ade5aa8b4e0b878383854fea0e29dafdec44ba2e825a9e9bd`.
HP subsequently builds that exact source against the unchanged public Rust
SDK under a high-priority `isol` lease, with concurrent shared conformance
work. Cargo is offline and capped at eight jobs. All twelve actual pairs
pass across four flows, warmup 5/0/5 and repeated runs, with zero skips.
Independent cold replay agrees with every original receipt and refuses all
73 changed-input controls. The matrix has 240 primary samples, 240 delay
samples and 1,000 application frames per peer. Only 300 preflight frames per
peer enter the capture; measured frame counts and owner folds stay complete.

The qualified executable SHA-256 is
`1e0e96d3e6f322bd0349776b57a269e8c9b69097a8f39711eb9d28f2a3187509`.
Its original SDK content pin is
`uncommitted-rust-canonical-sdk-13cb404bf6160fc58fec0ab85d6f30907d11e17a772dff2d3e0cb2c9c9123e4a`.
Both complete source and SDK byte/mode inventories remain unchanged. The
working output is `~/build/codex-fullbench/libhft/rust-preflight-20261016-v1`
on HP; no raw captures, samples, logs or products enter Git.

The first local fallback correctly refused a source inventory containing
this session's generated pytest cache, before compiling or opening sockets.
Only those new cache files were removed, and the original inventory matched
again. A subsequent idle-window fallback was cancelled while still waiting,
after HP passed; it performed no second build. The original failure remains
in session scratch. Frozen-source Python checks now disable bytecode and
pytest cache output.

The current portable result guide and release paragraphs now agree with the
compact-result policy: raw working output stays outside Git, and release
manifests retain qualified compact results and the graded pre-warmup capture.
Readiness after adding that guide selects 885 files with no private or
unresolved references, dead documentation links or scrub findings. The
documented source-root escapes remain 66; no whole-harness release admission
is inferred.

The compact writer and fixed-generation controller now accept this reviewed
producer under the separate `rust-pure+receive-clock` key. Runtime facts must
identify its public kernel receive/send observer and no store, without JVM
or CORE metadata. All 473 focused admission/result controls pass. This
controller extension does not change either root helper or require another
sudo registration. Fresh source-pinned runtime preparation and complete
physical report/cold replay are still required before it can write a result.

Current readiness selects 885 source files plus three templates, with zero
scrub, closure or documentation-link failures and 66 documented textual
source escapes.

No new Rust timing, physical grade, compact result or matched peer comparison
is claimed. Additional collectors and full release gates remain open.

## Fixed-entry argument qualification — 2026-10-17

Preparation found that the fixed immutable entry supplies nine arguments,
where the shared Rust parser also required an unused dictionary placeholder.
This mismatch was found before physical traffic. The kernel-only canonical
consumer now uses a dedicated parser accepting either form; dictionary-backed
consumers keep their original required-dictionary parser. The functional
matrix exercises the fixed-entry form on all four zero-warmup pairs and the
historical form on all eight repeated warmup pairs.

The complete 889-file source has inventory SHA-256
`eca318a3f011e3c3b21605ef12ecaab2a1e1bb2726fb812b2988c28490a73c10`.
HP builds it under a high-priority `isol` lease against the same unchanged
SDK, passing all twelve pairs, 73 cold refusals and source/SDK inventory
checks. Its executable SHA-256 is
`d4e5476ca2e4d1031dfb4d1321d05c23782dc518b37fb8cf0f61189649286696`.
Sample/frame totals are identical to the first qualification; all 529
integrated controls pass without skips. Working output is
`~/build/codex-fullbench/libhft/rust-preflight-entry-20261017-v2` on HP.

The first operational invocation refused an accidentally reused output root
before compiling or opening sockets. The earlier qualification was untouched;
the corrected invocation uses the separate root above. Its failed log stays
separate. No root entry, SDK, clock or benchmark gate changed, and fresh
physical admission remains required.