# Artio production-session observations — 2026-10-02

The new `ARSessionBench` drives four split-role flows through pinned Artio 0.182
(`5d1bb3b2deed9c5865e8584d23bb37c48fde048a`). It uses the actual `FixEngine`,
`FixLibrary`, production `Session.trySend` raw-frame publication and public
`SessionHandler` callback. Its channel supplier extends Artio's default supplier,
retaining the normal connect, bind, selector and socket configuration.

`ARObservedTcpChannel` observes completed transport bytes in each direction.
Independent bounded streams reassemble fragmented reads, partial writes and
batches. Complete frame lengths and checksums are verified before reporting;
zero and failed operations cannot create observations. Observer failures are
retained and fail evidence admission, without replacing the engine's completed
write result or changing its buffer positions. The observed runtime enables
sender/target CompID strategies and strict session-header time checks in the
engine and library. Existing callers use the default channel supplier.

The driver prepares full FIX bytes before `Session.trySend`. Its server-owned
tick clock is immediately before that publication; its end is the library
callback entry before benchmark extraction. This clock includes Artio IPC and
transport processing. Both primary and scheduler-delay HFTBRW1 series are
written from actual owner measurements. Admin events come from original
complete TCP frames, including both Logon directions. A bounded midpoint probe
uses `112=ARTIO-S5-PROBE`; injected runs cannot be report-grade.

Each application cycle validates required order, request, ACK and book fields.
NOS uses six price/quantity cases and alternating sides. MD extracts every
entry in the ten-level bid/ask book. Reactive orders use the received touch;
server extraction checks the expected touch price and clipped quantity, and
ACK extraction checks the actual sent order's price/quantity. Malformed numeric
fields, incomplete groups, duplicate singleton fields and missing required
fields are refused. Twelve original received/sent cycles are retained for the
independent wire auditor. Comparison-fixture alignment remains explicitly
false; no comparison grade is inferred from this implementation.

## Verification retained so far

[Evidence](evidence/artio-session-observed-20261002/) seals the original eight
and later eleven/fourteen compiled source snapshots, upstream JAR hashes, exact source
pin and compiler/unit logs.
The build uses Java 17.0.20.1 with `--release 8` and out-of-tree outputs under
SCAN's shared CPU lease.

- Ten JUnit tests pass, including seven transport observer checks and the
  extraction-check wrapper and two thread-placement checks. The latter verify
  independent Linux worker affinities using the public thread factories. The transport checks cover every fragment size,
  partial/batched writes, lifecycle forwarding, zero/failed operations,
  callback failures, bad checksums and actual localhost production TCP channels.
- The extraction wrapper passes 52 full-book, required-field and correlated
  semantic checks, with **zero skips**. Changing the final non-touch level
  changes the sink; malformed inputs cannot borrow a valid sample.
- Twelve fresh functional pairs pass under SCAN's `isol-no-shared` lease:
  all four flows with five warmups, no warmup and the matching midpoint probe.
  Each owner retains twenty primary and twenty delay samples. Twelve complete
  bilateral received cycles per pair pass the independent canonical auditor;
  sent captures exactly match the peer's received captures. Ordinary windows
  record explicit zero admin counts. Each probe records one inbound and one
  outbound matching admin event on both roles, with zero ResendRequests.
- The first prototype uses the upstream default backoff framer idle strategy.
  A busy-spin repeat retains an actual startup race: the zero-warmup server
  tick window classified its queued outgoing Logon as measured. It is refused,
  and retained unchanged. The driver now waits for both completed TCP Logons,
  as well as session activation, before opening the measurement window.
- All twelve corrected busy-spin functional pairs pass. Its 1,000-warmup,
  200-sample checks remain throughput-limited. A thread snapshot shows the
  library, framer and media driver running on the same first isolated CPU,
  despite each process having a four-CPU mask.
- Explicit placement through public Artio/Aeron thread factories assigns the
  library, framer, shared media driver and background workers separate CPUs.
  Every affinity change is verified through Linux thread status before work
  starts, and actual worker IDs/cores are logged. No upstream code is changed.
  All twelve placed functional pairs pass, including zero warmup and probes.
  Warm checks retain 200 primary/delay samples per flow after 1,000 warmups:
  NOS 1,918/s, MD 1,915/s, mixed 1,374/s and tick-to-trade 1,810/s.
  These short diagnostics do not satisfy the report rate or sample count.
- Forty-six Python admission checks pass using actual completed and failed
  transport evidence. Altered clocks, original Logon checksums, admin events,
  raw counts, sent/received bytes and incomplete cycles are rejected. Runtime
  state is removed even when a child fails.

The portable evidence copy omits 2.1 GB of Aeron runtime state, retaining the
original checksum list and checking every retained original file against it.
The complete original remains on SCAN. New controller runs put their temporary
runtime state under the session build root and remove it after preserving
observations, wire frames and raw samples.

## Exact runtime and full local report

The 24-file runtime is staged on SCAN and HP at
`~/.cache/libhft/fullbench-artio-session-observed-v6-20261002`.
Its complete tree SHA-256 is
`907bcd08da544aec73c8be32784d5806fc98aab36def1f8e62575a5f5ecb316f`.
It contains the exact adapter/JAR and dependency classpath used by the verified
prototype, with source provenance pinned to `b4d09716a352`. Both hosts use
OpenJDK 17.0.20.1. The fixed entry point enables busy-spin framer/media-driver
strategies and verifies independent Linux worker affinities.

SCAN's exact entry point passes all twelve functional pairs under a quiet
lease. Its full local matrix retains three 10,000-sample primary and delay
series per flow, with complete bilateral application/admin observations and
all twelve canonical wire cycles passing.

| Flow | Achieved cycles/s across three runs | Local report gates still failing |
|---|---|---|
| NOS | 4,716–4,834 | rate, scheduler delay |
| MD | 4,237–4,392 | rate, scheduler delay |
| Mixed | 2,843–2,924 | rate, scheduler delay |
| Tick-to-trade | 4,657–5,006 | rate, scheduler delay, percentile stability |

HP's matching exact-runtime matrix completed under its **high-priority** quiet
lease. All twelve functional pairs pass. It also retains three 10,000-sample
primary and delay series per flow, with complete bilateral wire/admin proof.

| Flow | HP achieved cycles/s across three runs | Local report gates still failing |
|---|---|---|
| NOS | 7,041–7,299 | rate, scheduler delay |
| MD | 5,849–6,442 | rate, scheduler delay, percentile stability |
| Mixed | 4,485–4,591 | rate, scheduler delay, percentile stability |
| Tick-to-trade | 7,316–7,470 | rate, scheduler delay |

All rows retain explicit localhost and comparison-fixture blockers. Neither
host's 1,000-warmup matrix qualifies for promotion.

## Longer excluded warmup

A separate 50,000-warmup NOS diagnostic on SCAN reaches 9,809 cycles/s with
200 measured samples. The matching full matrix then retains three 10,000-sample
primary and delay series per flow under a quiet lease. Every actual wire/admin
and worker-placement audit passes. The immutable adapter/runtime are unchanged;
the captured Python controller and commands record the larger excluded warmup.

| Flow | SCAN achieved cycles/s across three full runs | Local report gates still failing |
|---|---|---|
| NOS | 9,776–9,783 | rate |
| MD | 9,619–9,746 | rate, percentile stability |
| Mixed | 7,274–7,421 | rate, scheduler delay |
| Tick-to-trade | 9,778–9,826 | rate (first repeat) |

The short NOS rate does not establish a report pass: all full NOS repeats remain
below the 9,800/s gate. The full tick-to-trade matrix also remains blocked by
its first repeat. Localhost and fixture alignment block every row. HP's matching
50,000-warmup matrix has now completed under its high-priority quiet lease:

| Flow | HP achieved cycles/s across three full runs | Local report gates still failing |
|---|---|---|
| NOS | 9,890–9,896 | percentile stability |
| MD | 9,838–9,852 | none |
| Mixed | 9,613–9,664 | rate, percentile stability |
| Tick-to-trade | 9,894–9,934 | none |

This original v6 run still uses ten-second Logons. Its original grading sources,
samples and failed gates are retained; it cannot satisfy the new heartbeat gate.

The local checker now accepts a bounded `--warmup` override for warm/medium
diagnostics and records it in provenance. The DAC matrix accepts
`--report-warmup`, forwards it to the physical controller and records it in its
command metadata. Functional admission keeps its separate zero/five-warmup
checks. Five additional CLI checks reject invalid counts and functional-profile
overrides before runtime or namespace access.

## Checked numeric/frame correction

The next source generation removes decimal-object construction from checked
book/order extraction and writes the three checksum digits directly into the
prepared FIX frame. Tests compare every generated book price against the
original decimal bytes and cover all 256 checksum values against the original
formatter. The original full-book extraction sink is unchanged. Malformed,
fractional and overflowing numeric fields are refused.

The compiled generation passes **13 Java unit tests**, **53 semantic checks**
and all twelve quiet SCAN functional pairs. Its full 50,000-warmup local matrix
retains every primary/delay sample and all actual wire/admin observations:

| Flow | SCAN achieved cycles/s across three full runs | Local report gates still failing |
|---|---|---|
| NOS | 9,799–9,812 | rate (third repeat) |
| MD | 9,768–9,787 | rate |
| Mixed | 8,295–8,800 | rate |
| Tick-to-trade | 9,823–9,867 | none |

All four pass scheduler-delay and full percentile-stability checks. The single
NOS repeat at 9,799.06/s is below 9,800/s and remains failed. Every row still has
localhost and fixture-alignment blockers. The adapter JAR is
`61dba56de7700e21369498993980a5dfed028c123284bab767f194dd9c28e9d9`;
this matrix invokes it directly with the retained dependency classpath. It does
not imply an upgrade to the previously staged v6 fixed physical payload. HP's
matching build and quiet matrix have completed at high priority. All twelve
functional pairs pass. Its full report retains all primary/delay samples:

| Flow | HP achieved cycles/s across three full runs | Local report gates still failing |
|---|---|---|
| NOS | 9,905–9,906 | none |
| MD | 9,867–9,903 | none |
| Mixed | 9,745–9,778 | rate |
| Tick-to-trade | 9,904–9,907 | none |

All four pass scheduler-delay and full percentile-stability checks, with the
same localhost and fixture-alignment blockers. HP's independently built JAR
hash is retained in its original manifest and compiler log.

The original v6 TCP Logons use Artio's default ten-second heartbeat, which
differs from the thirty-second contract. The new observed engine/library
configuration explicitly sets thirty seconds and records it. Both original
completed TCP Logons now advertise `108=30` and `141=Y`; the controller verifies
the declared interval, original frame checksums and bilateral fields. Fresh
Artio report admission requires this proof. The previously sealed results and
their original grading sources remain unchanged.

## Field scanner

The latest source generation scans tag boundaries directly instead of splitting
the complete message and creating a temporary string for every whole field.
It preserves field values, repeated group fields and the original full-book
extraction sink. Tests cover leading-zero tags, embedded equals signs, missing
trailing SOH, malformed/overflowing tags and duplicate singleton fields.

Both hosts pass **14 Java unit tests**, **53 semantic checks** and all twelve
quiet functional pairs with zero skips. Each full matrix excludes 50,000 warmup
cycles and retains three 10,000-sample primary and delay series per flow. The
original wire/admin observations and thirty-second Logons pass on both hosts.

| Flow | SCAN cycles/s | SCAN local gates still failing | HP cycles/s | HP local gates still failing |
|---|---|---|---|---|
| NOS | 9,803–9,824 | none | 9,897–9,907 | none |
| MD | 9,816–9,833 | none | 9,900–9,904 | none |
| Mixed | 8,807–8,871 | rate | 9,806–9,829 | none |
| Tick-to-trade | 9,869–9,872 | none | 9,942–9,946 | none |

All four pass delay and full percentile-stability gates on both hosts. HP's
matrix ran under its high-priority quiet lease. Every row still carries
localhost and comparison-fixture blockers. The tested JAR hashes are
`e2b8a4eb6e1087c9555148b154e2dfc8290f178be16fe1b5a3d8ee6f4d385992`
on SCAN and
`8017a75ae2bffe111695fd9bcf9afd5862f4e2d3d7ea63380e59478c219131c4`
on HP. These direct-JAR runs leave the fixed v6 physical payload unchanged.

The SCAN-built v8 JAR now has a separate 24-file immutable runtime on both
hosts at `~/.cache/libhft/fullbench-artio-session-observed-v8-20261002`.
Its full tree SHA-256 is
`d1a72b106dbb6a8367ce51ff97ac94d9fe3184ae88add09c031951769f5c316b`.
The v8 launcher, installed payload, result directories and installer marker
have distinct names from v6. The matrix selects it with `--generation v8`;
the default remains v6 for existing callers. Exact fixed-entry functional
checks pass all twelve quiet SCAN pairs and remain queued at high priority on
HP. Root installation
and physical runs are still pending. Its retained provenance names every
compiled source and the actual JAR; all pins match that inventory.

## Shared canonical owner extraction

The next source generation imports the shared `CanonicalWire` and
`ExtractionSink` classes. It uses `LCOM1`, numeric one-based markers, the shared
price/quantity tables and bid/ask book constants, and the common ACK identifiers.
The measured marker restarts at one after excluded warmup. Reactive marker,
symbol, side, price and quantity come from the actual received snapshot. Every
book level is checked against the shared fixture before a sample is accepted.

The owner folds typed values in the shared `sink * 31 + value` order. Its NOS,
MD, mixed and tick owner sequences have 12, 63, 75 and 5 folds per measured cycle.
The sink resets before measurement and is retained with its fold count in
observations and the owner summary. Twelve independent golden vectors from
`bench/load/canonical_spec.py` cover all four flows at 1, 20 and 100 cycles.

HP compiles fourteen source snapshots and passes **16 Java tests** and **53
semantic checks**, with zero skips. The tested JAR SHA-256 is
`a0c31f8628cf7a30b7c02cdabb2dde3dd0089398e43cea0d42e73532cb91cda1`.
All twelve actual functional pairs also pass, including zero/five warmup and
the matching admin probe. Every 20-sample owner sink matches the independent
Python contract, with the exact fold count. The controller retains its
reference specification and refuses altered sinks, counts and owner roles.

These HP compile/unit and functional checks use high-priority `isol` leases
with concurrent shared conformance work. Their manifest explicitly records
`quiet_cpu_lease=false`; no report timing is inferred. SCAN also passes all
16 Java tests and 53 semantic checks with zero skips. Its tested JAR is
`db3dcb9c39c216dd80d87d9f01e05dabb7d60e0d2b28cf5595b0ea35f90540f3`.
Its quiet full matrix completes all twelve functional pairs and three
10,000-sample primary/delay series per flow after 50,000 excluded warmups.
Every actual owner sink matches the independent reference. NOS reaches
9,876–9,887/s and tick-to-trade 9,827–9,857/s, passing local rate, delay and
stability. MD reaches 9,719–9,793/s and misses rate; mixed reaches
8,310–8,564/s and misses rate and scheduler delay. All four pass percentile
stability. All 628 files under its original checksum lists were verified
before import into `canonical-scan/`. HP's quiet matrix also completes all
twelve functional pairs and three 10,000-sample primary/delay pairs per flow.
NOS reaches 9,973–9,976/s, MD 9,856–9,895/s and tick-to-trade 9,931–9,939/s;
these three pass local rate, delay and full percentile stability gates. Mixed
reaches 9,714–9,758/s and misses rate, while passing delay and stability.
All actual owner sinks and fold counts match the independent reference.
The 628 original sealed files are verified and retained in `canonical-hp/`.
The fixed v6/v8 physical payloads remain
unchanged, and full comparison-fixture/physical admission remains blocked.

The tested SCAN canonical JAR also has a separate 24-file v9 runtime on both
hosts at `~/.cache/libhft/fullbench-artio-session-observed-v9-20261002`. Its
tree SHA-256 is
`2675f8ca16407ba9998b4758c88a9cb660e447e571dfe552686d7a7ff3d8af18`.
The v9 launcher, installer marker and result directories coexist with v6/v8;
`run_dac_artio_session_matrix.py --generation v9` selects its explicit payload.
The controller requires both fixture declarations and checks the independent
owner sink and exact fold count. It rejects removed declarations, changed
sinks/counts and an unsupported alignment claim. A v6/v8 observation cannot
borrow canonical admission. Grading retains the actual reference specification
and its helper alongside the payload pins and controllers.

Exact wrapped-entry functional checks pass all twelve quiet pairs on both
hosts, including zero/five warmup and matching admin probes. The 314 original
sealed files per host are verified and retained in `entrypoint-v9-hp/` and
`entrypoint-v9-scan/`. The earlier v8 wrapped entry also passes twelve quiet
HP pairs; its 312 original sealed files are retained in `entrypoint-v8-hp/`.
Physical jobs
wait for twelve passing quiet pairs and the corresponding root install marker,
then acquire their quiet lease; HP jobs use high priority. Root installation,
physical runs, full fixture admission and report promotion remain pending.

## Physical admission

The separate fixed DAC launcher, 24-file hash-pinned installer and physical
controller support SCAN mlx5 and HP Solarflare. They require the original
complete TCP observations, exact worker placement, physical counter deltas,
full raw sample counts, quiet lease descriptors inherited by child controllers,
and all report gates. Injected probe runs cannot qualify. The root launcher
removes only its newly allocated Aeron runtime state after the foreground
process exits; observations, captures and raw samples remain in its output.

The combined Artio admission, QuickFIX/J/FIX Antenna integration and report-gate
suite passes **342 Python checks**, including warmup, actual heartbeat proof,
v8 runtime admission and actual canonical owner sink checks. A dry controller launch also found missing
support modules in the frozen host packages. Those modules are now copied from
each package's recorded source revision; all eight controller CLI/import checks
pass on the two hosts. Physical root installation and fresh DAC runs remain
pending. Two payload-pin filenames incorrectly named bundled QuickFIX/J
JARs as Artio JARs; the names now match the original 24-file inventory. A
regression check compares every declared pin against that retained inventory.

These are Stage 4 diagnostics. Physical-link and comparison admission remain
pending. The earlier FIXP interoperability
transcript remains a separate result; this FIX 4.4 driver does not replace it.