feat(rust): Rust port of DialCache with formal conformance replay

[lan17]

Summary

Add the Rust dialcache crate with the same portable cache behavior and Redis wire format as the TypeScript and Go implementations. All three ports replay the shared Quint-generated histories, fixed scenarios, protocol vectors, and witness evidence.

The crate includes explicit request scopes; request, local, and Redis layers; sparse runtime policy; deterministic rollout; request/process coalescing; tracked invalidation; read/source deadlines; stale recovery; shadow validation; compression; and failure-isolated observability. Optional adapters support Redis standalone and cluster connections, Prometheus, and DogStatsD.

Compatibility and conformance

• Catch both synchronous codec invocation and asynchronous polling failures. Decode failures fall through to the source; encode failures preserve successful source results and local publication. Shadow source panics are classified as source failures and release capacity.
• Use ECMAScript-compatible numeric formatting for secondary key dimensions and floating-point entity IDs, including negative zero, exponents, and shortest-decimal rounding ties. Retain exact-bit rounding regressions in native Rust tests.
• Use the same ID conversion for key construction and invalidation, accept all primitive numeric argument types and borrowed inputs, and allow Operation<T> cloning without requiring the cached value to implement Clone.
• Preserve omitted leaves in typed runtime overlays. A TTL-only update inherits an operation's request memoization and coalescing flags; defaults are applied during policy resolution.
• Allocate local storage as entries arrive, so large valid capacity limits do not reserve their full size at construction.
• Independently check source/write ownership and deadline eligibility after behavior commands. The test runtime propagates invocation identity across detached work; the monitor derives its evidence from actual callbacks, independently of model predictions.
• Require behavioral assertion evidence before counting a mutation as detected. Reject malformed observations, coordinator/witness failures, crashes, and incomplete runs; retain the assertion evidence in reports.
• Exercise real TypeScript-to-Rust and Rust-to-TypeScript reads, writes, and invalidation. Each server lane independently constructs 530 numeric key probes and round-trips 24 JSON/binary payload cases, covering tracked/untracked keys, compression, escaping, timestamps, and the undefined adaptation.

The Rust replay, integration, and mutation lanes are wired into the existing Make targets and CI. The shared inventory now contains 1,477 protocol vectors, 1,736 default Rust conformance cases, and 7,265 full required cases: 5,280 sampled histories, 250 named regressions, 244 fixed scenarios, 1,477 vectors, and 14 witness leaves. The shared Quint models, protocol vectors, witness definitions, and audit ledgers are unchanged by the parity fixes. Shared specification work remains in #188; numeric formatting regressions live in native Rust tests.

Rust API adaptations

Rust uses explicit Scope handles, typed UseCase<Args, T> handles, and Arc<T> values. Sources return Result<T, BoxError>, codecs and remote adapters use traits, and injectable clock/runtime interfaces support deterministic replay. TypeScript undefined decodes as JSON null (None for an optional destination); default shadow comparison uses PartialEq, so NaN differs from itself; Prometheus observers are shared by cloning.

KeySpec::new and DialCache::invalidate use IntoKeyId for strings, integers, floats, and their shared references. Custom displayable IDs must pass .to_string() or implement IntoKeyId. KeySpec::arg accepts every integer primitive without lossy float casts, plus f32/f64 and borrowed inputs. Cross-language users must use matching namespace, identifier text, key dimensions, codecs, and policy. The core crate requires Rust 1.85; the currently locked Redis feature dependency requires Rust 1.88. See rust/README.md for the API and intentional adaptations.

Validation

• make check passed: TypeScript types, full native coverage, build/package checks; Go formatting, vet, and race checks; Rust formatting, Clippy, and native/default tests; documentation and source audits.
• make integration passed for TypeScript, Go, and Rust against Redis 6.2, Redis 7, Valkey 8, and Redis Cluster, including actual bidirectional TypeScript/Rust round trips, 337 invalidation vectors per server, and tracked-read routing to cluster primaries with replicas enabled.
• Quint model checks, complete corpus generation, symbolic checks, and the exact Node 22.15 package floor passed during validation; no shared model changes are part of the fixes.
• On final head 4ef4a07, all 12 focused API regressions and the full Rust native/integration checks passed. The complete Rust replay passed all 7,265 required cases from the unchanged shared corpus. Documentation and source audits passed again after the API changes.
• Hosted CI, formal smoke, documentation build, title validation, and CodeQL are green on 4ef4a07.
• The complete Rust mutation campaign passed on 4ef4a07: 13/13 faults detected by the generated corpus, 12/13 by fixed cases, and 5/13 by ordinary native tests. M09's fixed-case survival is the existing catalogued exception; all required detections passed. Six shards used distinct Cargo target directories and were validated together by make mutations-merge-rust.

[lan17]

The Rust port has broad feature coverage and substantial shared conformance evidence, but it is not yet fully behaviorally equivalent to the TypeScript implementation. I found four implementation gaps and one validation flaw at commit e263903f9af74e11e14964ed5f396d6d696533fa.

Recommendation: address the five findings before accepting the full TypeScript parity claim. The inline comments contain the reproduction details and suggested fixes. All five are P2: they have specific triggers, but affect supported configuration, failure isolation, cross-language identity, or the reliability of the acceptance evidence.

Finding	Consequence	Evidence
Synchronous codec invocation falls outside the panic boundary	A cache decode panic prevents source fallback; an encode panic replaces a successful source result with an error	Two native Tokio regressions reproduced both outcomes
Numeric key formatting differs from JavaScript	Identical IEEE-754 inputs produce different Redis keys and potentially different rollout cohorts	Direct Rust and TypeScript key construction with the same binary float
Typed runtime overlays materialize omitted flags	A TTL-only update disables inherited request memoization and re-enables explicitly disabled coalescing	Rust regression fails; equivalent TypeScript test and Rust raw-JSON control pass
Local capacity is eagerly allocated	A valid large cache limit can cause an enormous allocation or process abort during construction	Rust dependency implementation compared with TypeScript's explicit sparse-allocation regression
Mutation measurement accepts infrastructure failures as detections	A broken replay can satisfy the assertion-strength gate without a behavioral assertion detecting the mutation	Direct call to evaluateRustReport accepted a malformed-observation failure as detected

What appears aligned

The reviewed engine paths closely track TypeScript for explicit enablement and closed-scope pass-through; request, local and remote traversal; request/process coalescing and coalesce: false; source and read deadlines; tracked invalidation and primary reads; retained stale recovery; and dark/served-hit shadow admission, confirmation and publication. The protocol and adapter review also found matching frame-validation precedence, watermark rules, complete-frame native SET writes, invalidation Lua/retry behavior, compression envelopes, and exporter metric schemas.

These findings therefore concern concrete boundaries in a largely implemented port. They do not indicate that entire cache layers or major features are missing.

Validation performed on this head

• make check-rust passed: formatting, Clippy with warnings denied, library/native tests, exporter tests, settlement control, and all 1,736 default conformance cases.
• The targeted TypeScript run of test/dialcache-local.test.ts, test/formal-rust-semantic-runner.test.ts, and test/formal-rust-replay.test.ts passed: 64 tests.
• The Rust protocol-key, protocol-frame, and exporter test targets passed.
• Additional review regressions reproduced the codec, numeric-key, and typed-overlay divergences described inline. These failures are outside the passing committed suite.
• The mutation-classification issue was independently reproduced by passing a completed report containing a malformed-observation failure to evaluateRustReport.
• Temporary regression files were removed after review. No production changes were made.

The complete generated corpus, mutation campaign, and Docker Redis/Valkey/Cluster integrations were not rerun during this review. The successful local default suite should not be interpreted as a replacement for those full gates.

Limits of the parity evidence

1. Cross-profile publication causality is not checked to the same extent as TypeScript. The Rust README explicitly acknowledges the missing monitor. TypeScript independently checks publication causality after behavior commands; the Rust feature replay does not carry the equivalent cross-profile attribution check. This is reduced independent assurance, not evidence that a specific Rust publication is incorrect.
2. The new Redis integration lane does not exercise actual TypeScript-to-Rust and Rust-to-TypeScript round trips. It exercises Rust round trips, invalidation vectors, and cluster routing. Shared vectors are valuable, but the porting acceptance guidance also calls for bidirectional interoperability tests. The numeric-key discrepancy found here is a concrete reason to include cross-port identity and wire round trips in acceptance.

The explicit Scope handle and Arc<T> return values are reasonable Rust API adaptations. Other documented differences—TypeScript undefined decoding as JSON null/an optional value, default shadow equality using PartialEq, and sharing Prometheus observers by cloning—should remain visible in the compatibility documentation. They should be distinguished from the unintended behavior differences above.

Suggested acceptance work

Fix the four implementation boundaries and the mutation-result classifier, retain native regressions for Rust-specific callback/conversion behavior, add the numeric tie to the shared key vectors, and add actual bidirectional interoperability coverage. Run the full required conformance and mutation validation against the resulting head. If the independent publication monitor remains deferred, keep that explicit limitation in the parity claim.