# Corrected Rust first-CPU physical comparison on both DAC rigs

## Decision

The separately declared first-allowed-CPU profile passes all four Stage 5
flows for both LibHFT Rust and NanoFIX on HP's Solarflare DAC and SCAN's
Mellanox DAC. Both independent cold comparison readers pass. The combined
[two-rig decision](comparisons/rust-callback-first-cpu-20261017.json)
therefore admits a fresh Rust minimum comparison. This admits these exact
products and placement profile; it does not change the retired shortened
clocks, the inherited-placement SCAN failures, or TrueFix's failed rows.

This follows the [96-pair placement qualification](RECORD_2026-10-17_rust_cpu_placement.md).
There is no unchanged timing retry or best-repeat selection. Every scheduled
flow/run in the new profile is retained. The change does not establish which
part of CPU placement caused an observed timing difference.

## Immutable inputs and placement

- Physical source pin: `c8d2be32b1b29446cf6edfc6321f63135549d5df`.
- Complete stripped source: 900 files, inventory SHA-256
  `add6b19a441ceee1f6a5b3861680786258de57b2b3a70eda84bc2d4fec8a5577`.
  No engine tree, private configuration tree or Git metadata is in it.
- LibHFT Rust app SHA-256:
  `7187345453ebfa5c9785be928599899935daf96c830a1872e3cedd2bc4f887f8`.
- NanoFIX app SHA-256:
  `f3a01e0ce1414e684b4bd97850699e54a9bf411715413f58a82842c08da6e3cd`.
- Installed generations, identical on both rigs:
  Rust `48b8b1e6815ac38dbf3a0fbba904231175522716259c63d26c488ba28267e34c`;
  NanoFIX `2f06fe74ae0b81d6026888f15654518e18b9be7d4b14bca00d16b97a3f577557`.
- Both qualified products use Rust 1.92.0 (`ded5c06cf`), LLVM 21.1.8 and
  Cargo 1.92.0. The unchanged SDK, Cargo-lock and original NanoFIX native
  sidecar identities are retained in every compact result's provenance.

Both namespaces keep their existing complete CPU budgets. The foreground
session threads narrow to the first actually inherited allowed CPU, verified
on every endpoint/run: HP server 8 from 8–12 and client 13 from 13–17; SCAN
server 10 from 10–13 and client 14 from 14–17. There is no SDK patch, host
policy change or privileged runtime. Preparation uses `isol`; physical
collection uses `isol-no-shared`, high priority on HP and normal on SCAN.
Host slot/process state and free disk are checked before work. Existing
fixed root helpers install the data-only bundles; applications run as the
benchmark user. Actual host/NIC/firmware probes bind each sitting.

## Actual runs and independent replay

Each of the four engine/host arms completes four tiny functional pairs and
all twelve report pairs. That is 64 actual pairs, including 48 full report
pairs. Every report uses 1,000 warmup cycles, 10,000 measured cycles per run,
three runs per flow and a target of 10,000 cycles/s. Rate, scheduler delay,
full percentile stability, exact body/owner/fold, measured admin, endpoint
exit, entry-point/namespace/CPU admission and physical counters all pass.

The primary RTT endpoint is after final parsing, extraction and checks.
Tick ends at public application callback entry, before later extraction.
Every actual boundary probe is integer zero. Application capture closes
following the first ten pre-warmup cycles; measured capture is zero.

Each independent full arm replay checks 120,000 primary and 120,000 delay
samples and 330,300 application frames per peer. Raw quantiles, true extrema
and original promotion decisions reproduce exactly; all source/report bytes
and file modes stay unchanged. The per-rig comparison additionally checks
the source tar archive, both installed generations, common host provenance,
matching CPU placement and all original three-run owner-clock observations.
No replay or combination opens a socket, compiles an SDK or repeats timing.

The new public `merge_rust_callback_comparisons.py` combines the hash-bound
per-rig cold receipts. It requires distinct rigs and identical frozen source,
products and readers; partial samples, changed hashes, profile/product
mismatches, failed-arm promotion and failed-flow ratios are refused. All 51
focused comparison/combination controls pass without skips. Original reader
receipts stay on their producing hosts. Their exact SHA-256 identities are
included in the combined compact decision.

## Latencies

All entries are **LibHFT Rust / NanoFIX**, in microseconds. Percentiles are
medians of the three run percentiles. Worst is the maximum of all three run
extrema. Read each rig separately; no host aggregation or speed conclusion
is inferred.

| Rig | Flow | p50 | p99 | p99.9 | Worst |
|---|---|---:|---:|---:|---:|
| hp | nos_er | 21.347 / 21.466 | 22.896 / 23.060 | 28.593 / 29.529 | 41.543 / 56.536 |
| hp | md | 30.561 / 29.976 | 31.999 / 31.142 | 39.456 / 38.560 | 52.746 / 62.526 |
| hp | md_nos_er | 51.890 / 47.435 | 53.562 / 49.005 | 63.768 / 58.790 | 72.645 / 112.333 |
| hp | tick_to_trade | 14.874 / 19.988 | 16.312 / 21.353 | 23.107 / 28.146 | 30.614 / 34.026 |
| scan | nos_er | 32.280 / 34.483 | 46.600 / 43.940 | 50.617 / 52.207 | 76.356 / 100.733 |
| scan | md | 44.513 / 45.170 | 59.395 / 54.750 | 63.832 / 63.206 | 85.434 / 98.521 |
| scan | md_nos_er | 76.906 / 68.818 | 94.441 / 91.549 | 103.380 / 97.068 | 116.330 / 143.910 |
| scan | tick_to_trade | 23.770 / 32.197 | 38.220 / 39.382 | 41.050 / 48.067 | 48.390 / 57.741 |

## Compact publication and retention

All sixteen successful cells are copied byte-exactly from producer-written
outputs. They use distinct `+first-cpu` flavour keys with at most 2,000 CDF
points per latency kind. No existing key is overwritten. Failed inherited
SCAN NOS/tick runs and historical retired grades remain unchanged.

On both hosts, source and original producer working files remain at:

- `~/.cache/libhft/fullbench-rust-first-cpu-physical-20261017-v1`
- `~/build/codex-fullbench/libhft/rust-first-cpu-physical-20261017-v1`
- `~/build/codex-fullbench/libhft/rust-first-cpu-comparison-20261017-v1`

Only compact results, the 19 KB combined decisions/source bindings and this
record enter Git/website data. No raw capture, sample stream, runtime log,
source tarball or new evidence archive is imported. Remaining Rust goals
include the QuickFIX-family anchor, TrueFix mixed/MD rate gates and the
physical network-floor/release requirements in the full plan.