# Rust private HA lifecycle qualification — 2026-10-19

## Scope

Reconnect four extracted private classic-store qualification groups to Cargo
targets in `private/rust/libhft-rust-pro-store`. The extracted files remain as
historical sources; runnable adaptations use companion types and existing OSS
store/session contracts. This closes a coverage gap left by the physical split,
without changing production store or session implementations.

The initial configured-lifecycle claim was superseded when a fetch showed the
Rust owner's concurrent claim on `oss/rust/src/config.rs`. That owner retains
the additive registry entry points and post-split probe repairs. This slice
reserves no OSS production source or conformance runner.

## Restored contracts

| Target | Test nodes | Contract |
| --- | ---: | --- |
| `private_store_lock_inheritance` | 4 | Mapped store drop, HA release, learned release and failed recovery release their writer fence while another thread's child is still between fork and exec. A successor's fence stays held after the child exits. |
| `private_offline_reset_admission` | 18 | Real reset writes fail under a subprocess file-size limit; direct reconnect and initiator dial remain fenced until explicit repair. Nine nodes use HA stores, nine provide ordinary-store controls. |
| `private_store_control` | 4 | Live reset refusal, durable fresh epoch after restart, primary-only reset with fence handback, and unbound learned-store refusal. |
| `private_store_telemetry` | 1 | HA role knowledge follows actual arbitration; bare-session and initiator endpoint projections retain their contracts. |
| **Additional nodes** | **27** | |

Each reset-admission node runs three exact subprocess cases, beginning with no
error, an I/O error or a store error. Per feature configuration this executes
54 child cases: 36 physical failure cases and 18 healthy controls. Child output
must show the exact selected test. No store result is substituted. The lock
fixture holds its fork/exec window with a socket handshake, releases/reaps its
child on unwind, and checks actual kernel lock contention. Runtime fixtures
use the session build root when provided and clean up at exit.

The archived reconstruction/review scripts reproduce the four adaptations
from the extracted sources and portable lock/control fixtures. After rustfmt
and removal of source-anchor comments, their code must match the runnable
targets. Imports, obsolete edition gates and fixture path/cleanup are adapted;
the original behavior assertions are retained. No public test hook is added.

## Counter feature

The companion now forwards `telemetry-counters` to its engine input and enables
it by default. The engine dependency disables implicit default features, so
`--no-default-features` on the companion really compiles out the engine's hot
counter writes. The default still selects the engine's existing counter
feature. The restored telemetry assertion checks that the engine's public
`hot_counters_enabled()` answer matches the selected companion feature.

## Qualification

Qualified source: `6c32dc3e8410efdf53b0725b4bff159551994988`, based on published
claim `2280553b5`. The earlier companion qualification counted 273 passing
tests; these four groups add 27 previously uncompiled/control nodes.

| Complete companion command | Default counters | Counters compiled out |
| --- | ---: | ---: |
| Cargo tests passed | 300 | 300 |
| Failed / ignored / filtered | 0 / 0 / 0 | 0 / 0 / 0 |
| Strict all-target Clippy | pass | pass |
| Warnings-denied Rustdoc | pass | pass |

All six commands return 0. All 284 selected source/configuration/documentation
hashes match before and after qualification. Targeted rustfmt and whitespace
checks pass. Scan runs the commands serially with one Cargo job/test thread,
the explicit development Cargo config, a session target directory, shared CPU
lease, memory/process guard and command deadline. No heavy build runs on
BEELINK2. The two companion READMEs are updated after qualification; publication
compares all executable inputs with the qualified source.

## Retained evidence and limits

`~/archive/libhft/rust-ha-lifecycle-20261019/` retains the source snapshot and
bundle, reconstruction/review scripts, per-command logs and toolchain,
before/after hashes, test counts and publication mapping. SHA256SUMS covers
the retained files; copies are verified on Scan and HP before scratch cleanup.

These results cover the companion's existing manual store/session contracts.
They do not qualify the other owner's configured lifecycle entry points or
conformance-probe repairs. Other extracted classic-store groups, including
fixtures that require dependency-private counters/flusher gates, remain
outside Cargo targets. This is functional qualification, not a new power-loss
proof, hardware benchmark or declaration of full Rust parity.