# Rust canonical clock-boundary correction

## Defect and publication scope

Source review after the bounded-capture functional qualification found that
the legacy public Rust, NanoFIX and TrueFix canonical consumers select a
receive timestamp for request/reply samples. That timestamp precedes SDK
parsing and benchmark extraction. The [normative scenario contract](../../../docs/bench/CONTRACT_SCENARIOS.md#client-request---reply-scenarios)
requires request/reply `t1` after the final parse, required field extraction
and checks. Complete owner folds prove that work happened, but cannot prove
it happened before the selected timestamp.

Their tick endpoint also precedes engine parsing. The contract requires
application callback/handler entry after the engine recognizes/delivers the
order. Matching two shortened spans does not satisfy that boundary.

The older Rust/NanoFIX minimum-comparison admission is therefore withdrawn.
Old result files, raw working originals, frozen readers and historical
receipts keep their original bytes and original grades; current publication
must mark the affected canonical profiles superseded and derive no current
ratio from them. The exact method/flavour selectors are recorded in
`result-retirements.json`. Codec, load-bench and floor methods are outside
this retirement. C++ and the Java callback request/reply drivers already
take their final clock after extraction; their collections are unaffected.

The earlier Rust/NanoFIX build, capture, body, owner, native-library and cold
corruption qualifications remain functional evidence. They supply no new
timing admission. Four waiting physical requests (Rust and NanoFIX on each
host) were dequeued before execution; their prepared immutable runtimes are
unchanged. No Rust/NanoFIX preflight timing result is imported.

## Correction in progress

New source must time request/reply completion after extraction, use a public
application callback for tick completion, declare those boundaries and use
distinct producer/variant identities. Actual delayed-extraction controls
must prove the selected endpoint, followed by cold refusal controls and
fresh physical reports. Existing shortened-span timing must not acquire the
corrected identity. Fresh default controllers refuse timing promotion of
the legacy producer identities while historical frozen readers remain usable.

All 59 report/comparison controls pass without skips. Twelve otherwise
complete synthetic full matrices cannot override retirement, and three
original passing comparison identities emit blocked rows with no ratio.
Original input objects are unchanged. The portable methodology's tick wording
now agrees with the normative callback boundary; its earlier extraction-end
wording was incorrect.

Both hosts continue to queue other qualified physical work through their CPU
leases. HP requests retain high priority; another session's shared conformance
and SCAN's running Java experiment are not interrupted. Full Rust comparison
and full-plan completion remain pending this correction and new collection.

## Corrected source checkpoint

Separate callback producer identities now select post-extraction request/reply
completion and actual public SDK callback entry for tick completion. A
functional-only delay probe inserts two milliseconds before SDK callback
delivery and another two milliseconds in final owner extraction. Its saved
clock checkpoints must agree exactly with every raw sample: request/reply
includes both regions, while tick includes callback delivery and excludes
the later benchmark extraction. Explicit probe metadata prevents timing
promotion, including when original recorded metrics otherwise pass.

All 740 focused SDK-free preflight, identity, result, clock-trace and report
controls pass without skips. Actual fresh builds, ordinary/probe socket
matrices and cold corruption checks remain pending at this checkpoint. The
source stays on a backed-up WIP branch until those gates pass.

### Actual callback qualification: first generation

The complete stripped checkpoint `1022c1dd958f3dc76f4507bfa51e8f6d5b81f141`
contains 894 files, inventory SHA-256
`cecc3354dea7063449a592c5f6d87a35e49ee969dab2e592d16dc41106236eaa`.
SCAN's fresh LibHFT Rust build passes twelve ordinary pairs and twelve
separate two-millisecond boundary-probe pairs. Each matrix retains 240
primary and scheduler-delay samples. Cold replay rejects 89 ordinary
corruptions and 28 probe corruptions, with zero skips. Source and original
SDK inventories are unchanged. The binary SHA-256 is
`54bfdd9b09cad6556d84d990895d889c2fbb29a08400c6de253277bcda4cc4b2`.
This is functional qualification, with no physical or timing admission.

HP's NanoFIX build of that checkpoint stops before any socket pairs: adding
explicit clock facts exceeded the Rust JSON macro's default recursion limit.
The failed compile output remains in the first generation's working root.
The driver now declares a macro expansion limit of 256; it changes no SDK,
clock selection or runtime options. A fresh generation must qualify that
correction before this WIP source can land. Working roots are
`~/build/codex-fullbench/libhft/rust-callback-clocks-20261017-v1/{rust,nanofix}`
on their respective hosts.

### Corrected NanoFIX qualification and current admission

The fresh complete checkpoint `429f3f9bc3772b36def7257e3ac8d8ef12248df5`
has the same 894 files with exactly one exported file changed: NanoFIX's
macro expansion attribute. Its inventory SHA-256 is
`c1eb985e7f8c4cbc70c314b43163af39a7e6349978046d4b98b70d6eb20d0d27`.
HP builds it in 3.39 seconds and passes twelve ordinary and twelve probe
socket pairs, 89 ordinary and 28 probe refusals, with zero skips. The normal
and probe matrices each retain 240 primary and 240 scheduler-delay samples.
Original NanoFIX/Aeron checkouts, the reviewed compatibility overlay, native
libraries and frozen harness inventory are unchanged. The binary SHA-256 is
`3efa665e0686b945c7c7b974a6db9ac1c07b9e1f8352009d452f65e7abc49f50`.

Both original Aeron libraries resolve from the product directory with
`LD_LIBRARY_PATH` and `LD_PRELOAD` cleared; their previously qualified hashes
are unchanged. The new working root is
`~/build/codex-fullbench/libhft/rust-callback-clocks-20261017-v2/nanofix`
on HP. The first failed generation stays untouched.

Across both drivers, 48 actual socket pairs and 234 copied-input refusals
now pass. The probes verify every sample against actual transport, public
callback and final extraction checkpoints. Ordinary runs reject probe files
and require zero probe metadata. LibHFT's five compiled driver files match
the new checkpoint exactly, so its passing SCAN build is retained without
an unrelated rebuild. The source is qualified for fresh physical collection;
this establishes no Stage 5 grade and restores no retired comparison.
Distinct callback producer IDs and compact flavours prevent old shortened
clock results from acquiring the new identity.

## TrueFix correction also qualified

The [separate TrueFix checkpoint](RECORD_2026-10-17_truefix_callback_preflight.md)
now qualifies its public callback and final-extraction clocks, bounded
preflight and both explicit Tokio runtimes. Forty-eight actual ordinary/
probe pairs and 258 corruption refusals pass without skips against the
unchanged SDK. Actual tests exposed queued-send semantics at the capture
and final-administration boundaries; completed-write waits correct those
boundaries. Compiler, preparation and socket failures remain retained.
Fresh physical collection is still required; no retired timing is relabelled
and the earlier Rust minimum remains withdrawn.