# NexusFIX public SDK admin observations and failure retention

The full-session driver now observes incoming complete frames at the public
`TcpSocket`/`StreamParser` boundary before `SessionManager` dispatch. Successful
outgoing sends retain the corresponding serialized span. The benchmark's
single-connection initiator wrapper installs callbacks before the initial
Logon; the SDK's existing initiator/bridge exposes no incoming admin observer.
Session handling and all 91 SDK headers remain unchanged.

`--admin-observations` writes actual admin bytes as hexadecimal, direction,
local steady-clock timestamps, TestReqID and Logon HeartBtInt, plus measured
windows and counts. Owner windows cover each measured harness run. Peer windows
cover its first measured application callback through the final reply. Ordinary
Logon/Logout and warmup events stay outside complete measured windows.
Counters are observed even when no output file is requested. Missing output
paths fail with the established exception exit code 99.

The opt-in `test_request` probe requires a correlated heartbeat in the current
measured run; an earlier run's reply cannot satisfy it. The `resend_request`
probe is an invalidation control. Both roles fail on measured ResendRequest.
Missing final replies retain an explicitly incomplete peer window and an
observation error. They cannot produce a successful measurement boundary.
The SDK build receipt now binds the observer header, and remote source staging
includes it. A changed observer invalidates cached-binary reuse.

## Qualified source and functional checks

Final tested source is **`6a9a409e67854368be0b742e6b0309f2caa8faa8`**, retained on
`s/codex-fullbench-nexusfix-admin3-source-20261003`. Its immutable capsule contains
**723 selected source files** and the **91 upstream headers** pinned to
`ffa8b0a014b5cb4020ec8a99fe22fa3a24bfc494`. HP status, running processes and memory
are checked before work. The outer foreground jobs queue under high-priority
`isol` leases on CPUs 8–17, allowing concurrent shared work. This is functional
qualification, with no quiet timing grade. Clang 21.1.8/C++23/O2/DNDEBUG/AVX2
builds the driver and cold fixture without SDK patches. Both builds, the adapter
self-test, **48 cold cycles** and **51 malformed-payload checks** pass.

The final generation has **20 actual TCP pairs**:

| Cases for every flow | Result |
|---|---|
| Ordinary `(warmup,runs,n,rate)` = `(0,1,12,closed)`, `(5,2,12,2000)`, `(3,3,20,1000)` | 12 pairs pass |
| Correlated TestRequest `(5,2,12,1000)` | 4 pairs pass; each peer retains one request/reply per measured run |
| Deliberate ResendRequest `(5,1,12,closed)` | 4 pairs correctly invalidate both roles |

The sixteen successful pairs retain **480 primary samples**, **432 scheduler
delay samples** and **1,490 byte-identical application frames per peer**.
Independent owner sinks/folds, framing/checksums/session sequences, required
numeric values, warmup exclusion, delay quantiles and actual retained maxima
pass. Every role retains original bilateral Logon bytes proving a thirty-second
heartbeat, rather than accepting a printed configuration declaration.
The successful tick arms retain exactly one prepared send per measured tick.

The resend arms retain sample deficits of **1/1/1/7** for
NOS/MD/mixed/tick respectively. The tick owner retains five samples and six
successful prepared sends; these are failed diagnostic counts. Mixed and
tick retain incomplete peer windows and an unmatched outgoing Logout in their
failure evidence. Original admin bytes, actual counts, sinks, folds, raw samples
and warnings remain preserved; failed arms are not assigned full owner parity.

Four missing-output controls verify both client-owned NOS and server-owned tick
raw/admin output rejection: owner exit 99, peer exit 0, absent requested file.
Two further actual socket pairs test split Logon/application writes and
coalesced application/admin writes against each observed role. Both pass,
including real correlated heartbeat responses, complete admin boundaries and
the client's independent four-sample owner sink. Peer I/O bytes are retained.
No tests or checks are skipped.

Driver SHA256:
`1378479d5cf0eba0dc4a807b6093d2d81efeda47f2f658e59cf411f17e2f4b78`.
Cold fixture SHA256:
`fc31c761874cd54318a7c0454ec3abdc6b554ea3fc441523b1114138769cbc94`.

## Original failures and final audit

All original failed receipts remain unchanged and retain their failed grades:

- `363984310b5a`: compilation rejects `operator->` absent from the existing
  compatibility result. A separate source uses the supported dereference API.
- `a44321c047e6`: the first outer checker wrongly requires a full sample count
  after deliberate resend. Its continuation exposes the actual mixed-flow
  bug: an incomplete peer window prevents JSON retention and returns 99.
- `6a9a409e6785`: the source fixes incomplete-window retention. All twenty pairs
  finish; the outer checker incorrectly requires twelve prepared sends in the
  already invalidated tick arm. Its first continuation retains the correct
  raw/admin output rejection, but expects the wrong admin error text. A further
  read-only audit stops on a local variable collision before any new pair.

The final audit regrades all twenty completed pair receipts and the three
completed output controls without rerunning them. It finishes the remaining
server admin-output control and the two transport checks. Its passing receipt
verifies unchanged original/previous receipts, all 723 source files and all
91 SDK headers. The original reports are never rewritten. Local source/SDK/admin
checks pass **94 checks**, with zero skips; the source comprehensiveness gate
passes. After integrating current main, all 94 checks pass again.
The qualified driver/observer/SDK/checker and harness bytes are unchanged;
720 selected files match exactly. The three documented differences are the
updated SDK guide and two concurrent build-root source-guard comments.

[Sealed original builds, failed receipts, passing audit, transport peer I/O,
actual admin/application bytes and raw samples](evidence/nexusfix-admin-20261003/SHA256SUMS).
Compiled products remain in the byte-sealed HP archive:
`~/archive/libhft/nexusfix-admin-hp-20261003-6a9a409e6785`.
The repository retains their original hashes and omits only those executables.

## Remaining gates

These checks establish functional administration observation and invalidation.
They do not establish full canonical body alignment, the common OrdType/
dictionary decision, physical DAC operation, report rate/stability or standalone
release admission. Every owner retains `fixture_pass=false`. Existing installed
payloads, frozen queues, common workload and shared clock/build APIs are unchanged.
The generic controller still needs fresh admin-artifact forwarding/qualification
before this source can supply physical campaign evidence.