# Explicit foreground CPU placement for Rust canonical consumers

## Hypothesis and separate profile

The [corrected inherited-placement SCAN report](RECORD_2026-10-17_rust_callback_physical.md)
retains LibHFT NOS/tick p99 sample-CV failures (11.7475% and 11.3863%). A
separate explicit profile tests whether fixing the foreground thread to the
first allowed CPU reduces variation between runs. Improvement is a hypothesis;
functional qualification establishes no timing result.

Both canonical Rust/NanoFIX builders accept `--cpu-placement inherit|first-cpu`.
The default preserves the inherited mask. The new Cargo feature affects only
the consumer crate, narrowing its own foreground affinity before session
setup. OS reads retain both inherited and effective CPU masks. The audit
requires sorted, unique, integer, nonempty masks; physical inherited masks
must equal the fixed namespace entry's CPU budget. The first profile must
select exactly its minimum CPU. No SDK, capture boundary, clock span, field
work, counts, pacing or report threshold changes.

Compact keys append `+first-cpu` only for the explicitly observed first-CPU
profile. Runtime facts retain placement and every run/endpoint's two actual
masks. A matcher refuses different or mixed foreground profiles even when
each arm independently has a valid report grade. Original inherited and
retired result keys/bytes remain intact. TrueFix and Stage 2 are outside this
placement change.

## Actual qualification

Complete 900-file stripped source checkpoint
`ad72b02fce352dc017584197f0429f916a628087`, inventory SHA-256
`19ae36dc0556a2311ae7f82a5be5754b8c30db8d11f8404f5443f4ed8bab104d`:

| Consumer / host | Profile | App SHA-256 |
|---|---|---|
| LibHFT Rust / SCAN | Inherit | `22f4a82ec524abe877911bf9ee626b6e9fd5e5554e4732301ec0045a2e9a69ae` |
| LibHFT Rust / SCAN | First allowed CPU | `7187345453ebfa5c9785be928599899935daf96c830a1872e3cedd2bc4f887f8` |
| NanoFIX / HP | Inherit | `193325f363e5a1f7e54b4664498a20b1f682edc032c61ee722cab4c227710a35` |
| NanoFIX / HP | First allowed CPU | `f3a01e0ce1414e684b4bd97850699e54a9bf411715413f58a82842c08da6e3cd` |

Every product passes twelve ordinary pairs, 101 independent cold refusals,
twelve separate delayed-boundary pairs and 28 probe refusals, with zero skips:
96 actual pairs and 516 refusals across both consumers/profiles. Each normal
or probe matrix retains 240 primary and 240 scheduler-delay samples. The
inherited tests use full disjoint endpoint masks, exercising preservation;
first-CPU tests prove narrowing from those same masks (SCAN 10–13 → 10 and
14–17 → 14; HP 8–12 → 8 and 13–17 → 13). Both normal and probe originals
are checked for actual placement on every endpoint of every pair.

All original SDK, reviewed NanoFIX compatibility-overlay and Aeron-library
inventories remain unchanged. NanoFIX resolves both original sidecars with
LD override variables cleared. Every compiler project's six source files
match its frozen inventory and receipt. Both build receipts now retain actual
Rust/Cargo versions (1.92.0 on these builds). The Rust builder's optional
external target cache rejects source-tree paths; fresh source copy times
prevent an epoch-dated export from borrowing a stale cached consumer.

All 903 focused controller, placement, identity, probe and report controls
pass without skips. The preceding source's 893 controls also pass from a
complete stripped archive without Git, an engine tree or private files.
Actual first-CPU physical runs remain required; no new timing or matched
admission is claimed at this qualification checkpoint.

The HP capsule is streamed and unpacked only after its high-priority `isol`
lease grants a readiness marker, following all waiting quiet physical work.
Its transfer/unpack/build does not run during those quiet reports. Normal
source and SDK verification wraps the entire foreground qualification.
Working roots are
`~/build/codex-fullbench/libhft/rust-first-cpu-20261017-v1/{rust,nanofix}`
on their respective qualification hosts. Source capsule:
`~/.cache/libhft/fullbench-rust-first-cpu-20261017-v1`.