# Rust decimal parser build-profile consistency — 2026-10-17

## Change

The low-level `kernel::parse_decimal5` / `wire::to_price5` helpers retain five
fractional digits and compose an unsigned 64-bit mantissa. Whole-part accumulation
already wrapped explicitly. Final scaling and fractional addition used ordinary
arithmetic: overflow panicked with overflow checks and wrapped without them.
The portable loop and tuned split kernel now wrap explicitly at those three
expressions. API documentation states modulo-2^64 arithmetic and the absence of
text validation. Checked typed-view accessors retain their existing behavior.

`engine/rust/tests/decimal_kernel_bounds.rs` tests both public entry points with
17 literal vectors: ordinary precision, the largest fitting mantissa, addition
and scaling overflow, and a whole part wider than u64. Python unbounded-integer
arithmetic independently checks every expected mantissa. Baseline and fixed
fixture SHA-256 are identical. The fixture and fix are combined into one passing
source commit for publication.

## Pins and actual baseline

- New fixture with unchanged production parser: `dd0512ad4bd386a0f0ca832632230ddb0635c0bd`.
- Complete-suite / feature qualification: `126e47c867212c151ae5b14f6d916937ffda0b16`.
- Post-rebase combined candidate: `7b80d0dc33f5c5d058b671f53effce69f646cd3b`.

`split-swar8` enables `tuned-decimal-parse-split,tuned-int-parse-swar8` together.
Baseline is the development edition. Release uses Cargo's optimized profile.

| Selection / profile | Passed | Failed | Ignored | Cargo exit |
|---|---:|---:|---:|---:|
| portable-debug | 1 | 3 | 0 | 101 |
| portable-release | 4 | 0 | 0 | 0 |
| split-swar8-debug | 1 | 3 | 0 | 101 |
| split-swar8-release | 4 | 0 | 0 | 0 |

Each debug run has two multiplication panics and one addition panic, with its
ordinary control passing. Both optimized baselines pass all four functions with
the literal unsigned results. These are baseline failures, excluded from fixed
qualification counts.

## Fixed qualification at the complete-suite pin

| Check | Result |
|---|---|
| Focused regressions, 2 editions × 2 kernel selections × debug/release | 4 tests each; 32 passes; zero failed/ignored |
| Existing kernel unit selections, both editions and selections | 7 tests each; 28 passes; zero failed/ignored |
| Actual `rust-engine-tests` | 2,773 passed; zero failed/ignored; 69 test programs |
| Actual `rust-open-edition-tests` | 2,566 passed; zero failed/ignored; 69 test programs |
| Strict all-target Clippy, both editions and selections | Four passes with `-D warnings` |
| Development library Rustdoc | Passes with warnings denied |
| Fixture rustfmt and three changed Rust files' export scan | Pass |
| API inventory, binding coverage, documentation facts/links | Pass |

Both actual Cargo subprocesses exit zero; each selected conformance result
reports one stage run, zero failed and zero skipped. The development wrapper's
PARTIAL / exit 2 denotes selected-stage scope. The open wrapper's final exit is
unavailable after the parent lease timeout described below; its actual Cargo
exit, output and successful stage JSON are retained. Counts cover these Rust
stages and specified feature combinations. All 400 Rust / 638 shared inputs
match before and after; lint has separate matching before/after proofs.

## Rebase verification

The final fetch adds only `engine/rust/src/pro/zf.rs` to the Rust input delta:
TCPDirect attribute/stack ownership cleanup and its tests. The other 399 Rust
and all 638 shared inputs remain identical. Its bytes match the transport owner's
qualified snapshot `dfe2dbf378edc8a6fb0deb6affb9d5342d325989`, retained in
[the transport record](RECORD_2026-10-17_transport-buffer-resource-review.md).
The open edition excludes this private source.

At the combined candidate, fresh development checks pass **7 `zf::` tests,
2 `tcpdirect` session tests, and 4 decimal regressions in each portable and
split/swar8 selection**, zero failed/ignored: 17 passes. Fresh development all-target Clippy also passes with warnings denied,
checking the merged API across integration targets. The SDK callbacks are
injected; this is resource-lifetime correctness, without NIC qualification.
The complete-suite counts above remain attached to their earlier explicit pin.
All 400 Rust / 638 shared post-rebase inputs match before and after these checks.

## Supervision and resources

Baseline and initial runtime qualification use Scan CPU leases, one Cargo job,
one test thread, debug symbols disabled and 64/32 GiB available-memory plus
2/1 GiB disk guards. Strict Clippy/Rustdoc use BEELINK2's serial shared lease,
one Cargo job and 24/16 GiB memory guard. That guard stops and retries four
compiler attempts for foreign work (3 development portable, 1 open portable);
all four final lint commands exit zero.

The initial runtime lease reaches its 2,400-second limit during the open stage.
The historical scratch guard starts a separate child group without relaying
outer signals or forwarding lease descriptors. Its Cargo stage completes after
the lease expires; its successful per-command files and source proof are retained.
These are functional results, with no CPU isolation or timing claim for that tail.
The unnecessary queued resume is cancelled before execution.

Future guard variants preserve inherited lease descriptors and relay outer
signals with descendant cleanup. Three live process/lock checks pass: outer TERM,
resource-stop cancellation, and a leader exiting before its child. Historical
executed guards remain unchanged in the archive; corrected variants have distinct
names. The post-rebase BEELINK2 gate uses the corrected guard, a serial shared CPU
lease, one Cargo job and 24/16 GiB memory bounds. Its unstarted HP request was
cancelled when a long conformance run occupied that host; HP starts no heavy job
for this slice.

Other retained attempts: an unstarted request dequeued to integrate Logout tests;
a Scan preflight with no installed Clippy, before candidate tests ran; and an
unstarted pool-change request cancelled when the original lease had already
started. The latter truncated a shared launcher-log prefix; independent actual
per-command outputs/JSON remain intact. These attempts add no test passes.

## Retention and remaining work

Correctness archive on BEELINK2, Scan and HP:
`~/archive/libhft/rust-decimal-kernels-20261017/`.
It contains raw commands/results, source proofs, the independent decimal oracle,
process-supervision checks, source bundle and SHA-256 manifest. Raw output stays
outside Git. Build products remain under the prescribed session build roots.

Static scores stay 82/82 applicable APIs, 27/27 protocol rows, and
43 complete / two partial / one not applicable subsystem. Configured acceptor
startup and early admin delivery remain with their claimed owners. Authorised
live venue and FIXP endpoint/schema/certification evidence remain external.