# Corrected Rust/NanoFIX callback clocks: SCAN physical collection

## Source and actual run

The complete 894-file stripped harness is pinned to
`4a5549cc744744ead8ba044d539466271c2f33e9`, inventory SHA-256
`c1eb985e7f8c4cbc70c314b43163af39a7e6349978046d4b98b70d6eb20d0d27`.
Its compiled driver files match the separately qualified products in the
[clock erratum](RECORD_2026-10-17_rust_clock_boundaries.md). Neither SDK nor
clock/profile configuration changes between qualification and collection.
The functional delay probe is zero throughout the physical runs.

SCAN runs both engines' four tiny and twelve full report pairs under an
`isol-no-shared` lease, in its Mellanox DAC namespaces. All endpoint exits,
canonical bodies, complete owner folds, normal-user/CPU/namespace admission
and physical wire-counter gates pass. Each engine's report retains 120,000
primary and 120,000 scheduler-delay samples and 330,300 application frames
per peer. Independent cold replay reproduces every metric and grade exactly
without sockets or a compile and leaves all original bytes/modes unchanged.
Only the ten pre-warmup cycles are captured; measured application capture is
zero. Both frozen source inventories remain unchanged.

| Producer | App SHA-256 | Immutable generation |
|---|---|---|
| LibHFT Rust callback | `54bfdd9b09cad6556d84d990895d889c2fbb29a08400c6de253277bcda4cc4b2` | `6b38cd9e074641ea7e1b27fc00a94915d1061e6dd69e94f76d48168a4ededee5` |
| NanoFIX callback | `3efa665e0686b945c7c7b974a6db9ac1c07b9e1f8352009d452f65e7abc49f50` | `8d9a909338f2960fd46a887607bc8580d91cff81e658ec4cb73fd1f1957cb45c` |

Actual NIC identity is PCI `15b3:1015`, firmware
`14.32.1912 (MT_2420110034)`, kernel `5.14.0-687.44.1.el9_8.x86_64`.
The fixed root helpers are unchanged; both applications execute as the
benchmark user. NanoFIX loads its two original hash-bound Aeron sidecars
from the immutable generation directory.

## Admission

| Flow | LibHFT Rust | NanoFIX | LibHFT p99 sample CV |
|---|---|---|---:|
| NOS/ER | S5 diag: percentile stability | S5 pass | 11.7475% |
| MD | S5 pass | S5 pass | 5.9717% |
| MD + NOS/ER | S5 pass | S5 pass | 3.6102% |
| Tick to trade | S5 diag: percentile stability | S5 pass | 11.3863% |

All report runs exceed the 98%-rate floor. LibHFT's NOS p99s are
48.209/38.570/46.934 microseconds and tick p99s are
31.567/38.440/38.993 microseconds: both fail the unchanged 10% sample-CV
limit. Other rate, scheduler-delay and stability gates pass. The failed
cells create no result file. No unchanged timing retry is performed.

Six new compact cells are copied byte-exactly from SCAN: all four NanoFIX
flows and LibHFT's MD/mixed flows. Their distinct flavours
`rust-pure+callback+complete-rtt` and
`nanofix+kernel+callback+complete-rtt`, under `dac-canonical-preflight-v1`,
retain the actual callback/extraction clock and zero-probe facts. Their
original shortened-clock counterparts are preserved and remain superseded.
No raw samples, captures or logs are copied into Git or the website.

## Actual comparison reader and refusals

The new reader cold-replays both physical arms and independently checks
all twelve owner clock proofs per arm. The SCAN-only result is **blocked**:
NOS and tick emit no ratio; MD and mixed hold separate passing rows. This
is not a four-flow minimum comparison and not a two-rig campaign admission.
HP's newly installed generations remain queued at high priority behind
another session's shared conformance work.

The first output path, inside the producer directory, is correctly refused
before replay. A fresh external output exposes a reader defect: sequential
arms have distinct valid `started_utc` timestamps. The corrected reader
validates each original UTC timestamp and compares every other sitting,
hardware and source field unchanged. Its 57 focused controls pass, including
hardware/source/sitting corruption and invalid UTC refusals. The final
actual replay succeeds and emits the blocked decisions above. Both earlier
failed-reader logs and all original physical inputs remain untouched; no
physical rerun is needed. Final reader SHA-256:
`352a7f862fe54bbf039e64f212f74073306a2b3b7b09569b5d3e115fd39b7b7b`.

Original working output on SCAN:
`~/build/codex-fullbench/libhft/rust-callback-physical-20261017-v1`.
The separate cold comparison is
`~/build/codex-fullbench/libhft/rust-callback-comparison-20261017-v1/scan-v2.json`.

The comparison reader also starts and passes all 56 original controls from
a fresh complete 896-file export with no Git, engine or private tree. Export
readiness has zero scrub findings, unresolved references, private references
and dead documentation links. Its 66 textual references outside the root
remain the declared SDK/development defaults, not whole-release admission.

## HP follow-up completed

The queued high-priority HP matrix now completes under a quiet lease. Its
original source/runtime remains unchanged; actual outcomes, admitted compact
cells and retained failures are in the [HP follow-up](RECORD_2026-10-17_hp_canonical_followup.md).
This appendix supersedes the earlier pending-HP scheduling status, while
preserving the original SCAN outcomes and campaign-specific comparison scope.