# Original llfix RX policy: actual TCP controls

2026-10-04, Codex microbench/reference session. Functional policy observation only.
There is no timing, engine ranking, full-session fixture or released-SDK grade.
The Stage 2 llfix 1.0.8 decoder campaign and frozen SCAN timing generations are
unchanged.

## Inputs and execution

Original benchmark repository pin:
`165cc999fa283a4ead17a7b935c5d3f850fec851`, bundled llfix **1.0.7**,
204 unchanged original files and four retained original binary hashes. The
source archive SHA256 remains
`447688cf811dfdedf56bdc71e9ddbac7587418278feafb334ce099b751c7023e`.
The probe uses the actual original RX settings and registered party group, with
the original atomic-count callback and all eight configured session identities.
Its count-observation command and summary run outside the callback; there are
no timer samples.

The new source was published at `75ea61bf0` and preserved on
`s/codex-llfix-reference-rx-policy-source-20261004`. The eight-file capsule SHA256
is `e6769e564965f7db5842d358dc3c85195d171ef0bb3675891bf545d734761ba9`.
Its actual GCC 11.5 driver SHA256 is
`fc1ea664a2a85c301fef71284f5e4906eaeb40a40c5225f9b0ac1aae10b00c2e`;
the RX flags remain C++17, `-DNDEBUG -O3 -fno-rtti -pthread`, without TX's
`-march=native -mtune=native`. This is input binding, not whole-toolchain release
attestation. The native probe binary SHA256 is
`993c54baae85b63cf90e8fea937ed08f34d23fbd081837115566d0bf6c75f867`.

HP build/cold checks/audit used high-priority shared leases; the actual socket
controls used a high-priority isol lease with concurrent shared work permitted.
Controller CPUs were 0–7, receiver CPU 16. One fresh server/port/runtime was used
per case. Thirteen Logons and 26 positive-control orders passed, followed by 13
independent third-order probes. Every receiver returned zero. All 33 focused
reference tests pass with zero skips; the frozen HP subset passes 12 cold tests
with zero skips.

## Observed results

Each delivered probe produced callback count 3 and active incoming sequence 4;
each nondelivered probe left count 2 and sequence 3. All seven inactive-session
sequence counters stayed zero. No execution-report replies were observed.

| Third-order case | Reached callback | Captured reply after Logon |
| --- | --- | --- |
| Valid original order | Yes | None |
| Wrong CheckSum | No | None within the observation window |
| SendingTime 120 seconds old | No | Session Reject (`35=3`) |
| SendingTime one hour in future | Yes | None |
| Wrong established-session SenderCompID | No | Session Reject |
| Wrong established-session TargetCompID | No | Session Reject |
| Declared three parties, supplied two | Yes | None |
| Both PartyIDSource fields omitted | Yes | None |
| PartyRole 999 | Yes | None |
| OrderQty `garbage` | Yes | None |
| OrderQty omitted | Yes | None |
| Custom tag 5000 | Yes | None |
| Reused business ClOrdID, fresh MsgSeqNum | Yes | None |

The native summaries report `dictionary_macro=false` in every case while both
validation flags are true and maximum age is 60 seconds. This agrees with the
original SDK's `#ifdef LLFIX_ENABLE_DICTIONARY` around dictionary and group
validators. Group registration alone does not enforce the tested group count or
value rules. Unknown-field and business-ID behavior are policy observations;
business deduplication is not provided by this counter-only application.

The independent cold audit passes `functional-policy-observed`: it checks actual
request bytes against each case recipe, positive-control required values, every
received frame's BodyLength/CheckSum, native counts/metadata and exact retained
capture/summary bindings. Absence within the 0.6-second probe window does not
establish an explicit Reject/Logout; that claim requires an actual reply frame.
The wrong-checksum result remains nondelivery with no observed admin rejection.

## Benchmark interpretation

The original benchmark is useful for its actual configured lightweight RX
consumer. Its flags do not establish dictionary-validating receive performance.
A comparison against an engine doing required-field, numeric-format and group
validation must expose that difference. The callback also performs no converted
business-field extraction. This proof makes no inference about llfix 1.0.8,
other llfix build configurations, or the cost of enabling its dictionary.

The original TX clock uses CPU-MHz conversion and the original RX measures an
aggregate callback window; neither issue is changed here. A future libhft RX arm
must qualify its actual validation, timestamp and persistence policy before a
matched engine ranking. The pinned libhft SDK has a different timestamp rule;
no matching RX policy is claimed. Full-session OrdType corrections are separate;
these original/reference fixtures already contain `40=2`.

## Preserved failures and evidence

An initial staging `run` request returned busy/75 before entering its lease; its
operational note is retained. The next staging command started its manager in the
supervised process group, leaving a nested queue waiting for the staging lease.
The actual 120-second supervisor timeout killed only this owned process group,
before an engine test ran. Its original log and incomplete manager receipt remain
unchanged. The next manager was launched separately with `setsid`, outside the
staging lease, and all four phases completed. No other-session job was stopped.

The full 407-file archive retains both managers, all original failures, the
capsule/source/native build and binary, every runtime/configuration/sequence
store/capture/summary, and the original source/binary preparation dependencies:

- HP and BEELINK2: `~/archive/libhft/codex-llfix-reference-20261004/hp-llfix-rx-policy1.tar.gz`.
- Archive SHA256: `f75097fe811c30b7b9f4cdd2c0b213a8889c5625c027472e7273af1921bb80a6`.
- Seal SHA256: `772db260adb51f2136ec232fbc616cdccef32cb39743d1c0b2840258ec560e60`.
- Both replicas independently verify all 407 file hashes, modes, sizes and exact
  membership; compressed archive size is 1,645,365 bytes.
- Selected exact receipts: [evidence](evidence/llfix-rx-policy-20261004/).

The source/controller remain unchanged after the source publication. The frozen
SCAN tail 22, TX 13 and extra-output-auditor 15 input maps also remain unchanged.
SCAN's original queued quiet3 campaign retains its existing source, runtime,
activity gates and queue priority.