# Fresh native report admission — raw, load and stability gates

2026-10-11. The new native controller policy closes the remaining timing
admission gaps before fresh DAC runs. No new physical or report-grade result
is granted. Existing saved output, SDK products and root payloads are unchanged.

## Policy change

The older native controller used a five-percent rate tolerance and a p99-only
run-to-run ratio. Fresh physical rows now require:

- A complete, correctly identified `end_to_end` and `scheduler_delay` raw series
  for every external measured run, with exact sample counts, no drops and no
  apparent u32 ceiling. Missing or failed downloads cannot borrow stale files.
- At least 98% of target rate, preserving the existing 105% upper tolerance.
  Nonfinite or missing rate/count observations fail. Delay p99 must not exceed
  the offered send interval.
- Actual admin audit proof, measured scopes and explicit nonnegative counters
  for both roles. Any measured ResendRequest fails admission. QuickFIX C++ also
  needs the separately audited original Logon proof.
- For server ticks, the prepared-wire start, callback-entry end and full
  prepared sample count; an earlier build/encoding clock is refused.
- Three complete externally paced runs, and the selected host controller's
  inherited shared-plus-isolated quiet lease. A controller on another host
  cannot infer that reservation. Closed-loop, adaptive/inner-run, TX-path or
  server-capacity instrumentation cannot qualify the canonical report profile.
- Raw-derived p50/p99/p99.9 stability, with **sample** standard deviation.
  PASS CV limits are 0.05/0.10/0.25; WARN and FAIL use the shared runner's
  0.10/0.25/0.50 failure thresholds. Missing raw percentiles stay insufficient.

Percentiles use exact rational nearest ranks. The arithmetic mean of the
per-run percentiles, true maximum retained latency, complete scheduler metrics
and all three CVs are retained separately from original SDK stdout summaries.
The admission receipt binds each raw file's SHA-256 and lists every blocker.
CSV/JSON carry both views; fresh physical Markdown selects the raw-derived
statistics when available. Historical summaries and their percentile
conventions remain untouched.

A failed physical run no longer ends the configured matrix early: all runs
retain their original outputs and raw artifacts. A medium DAC command exits
nonzero unless all rows hold `S5 pass`. Functional status and measurement
admission are independent. Comparison-fixture, physical TX counter and full
profile gates remain additional requirements; a passing measurement gate
cannot override a failed or missing fixture.

## Qualification and actual inputs

Frozen controller/source:
`fa958effcf021b099041b2a2b73dc4f505e2823b`, preserved on private branch
`s/codex-fullbench-native-report-qualified-20261011`.
The complete stripped archive contains **780 files** including three templates.
Readiness selects 777 source files and has zero scrub, private-placement,
unresolved-reference and dead-link findings. Sixty-six files still have 88
textual source-root escapes. This partial execution is not a whole-source or
public release build.

The HP execution reused the [qualified Logon generation](RECORD_2026-10-11_quickfix_cpp_logon.md):
production ELF SHA-256
`f725e4ae4c8ba5325d53ae63367e268017504307dcbe1200ea0ef91d97e2c507`,
compiled at `ce4142d37e19d95dd43a95fef728d2ec783781f2`.
Every selected C/C++ source/header input matches that producer archive, both
products match its actual report hashes, and the separately supplied immutable
QuickFIX SDK inventories match before and after. No new adapter or SDK
compilation, cold fixture execution or full timing matrix is claimed here.

Before execution, HP's CPU-slot status, compiler processes and memory were
checked: both pools were free, no listed compiler/managed processes were active,
and 13 GB was available. The outer foreground controller check ran under an
`isol`, **high-priority** lease with a five-minute deadline and an identical
`wait` fallback for busy status. Shared work was allowed. Endpoint processes
inherited that mask; these are localhost functional diagnostics.

- Four actual controller pairs pass their functional original Logon/admin,
  strict body, independent owner-sink and raw-series proofs, one per flow.
  They retain **48 primary and 48 delay samples**, **170 original application
  frames per peer**, and **eight original Logon frames per peer**.
- The new measurement audit recounts every series and the actual role rows.
  At this tiny cold profile, NOS, MD and mixed miss the 98%-rate floor; tick
  passes its individual measurement check. Each single-run summary remains
  diagnostic for missing three-run and quiet-lease proof. These small cases
  have no performance ranking or report grade.
- An older actual 10,000-sample NOS capture is regraded without rewriting it.
  Its complete primary/delay series expose **scheduler saturation**, a rate
  below 98%, and absent original Logon proof. All three blockers are retained;
  it cannot borrow admission from the new generation.
- A separate frozen-archive read-only regrade reproduces all four actual
  controller measurement receipts and the older full-count receipt. Original
  new results, the old capture and extracted source remain byte-identical.
- **226** focused tests pass with zero skips. Independent faults cover 97.99%
  rate, nonfinite observations, missing/short/dropped/clamped/misidentified
  raw series, stale-copy refusal, admin/resend and prepared tick boundaries,
  missing quiet/fixed pacing, and p50/p99.9 variation hidden by a constant p99.
  The matrix continuation control retains all 30,000 synthetic samples after
  rate failure; these fixtures are not physical benchmark results.
- The first broader test invocation retained 225 passes and one failure: an
  old custom-rig positive control omitted the newly required measurement
  proof. Its corrected explicit fixture passes; missing-proof controls still
  refuse admission. Both logs are retained separately.

## Preservation and open work

[Original evidence](evidence/native-report-gates-20261011/) imports **73 files**
including replication proof. The complete archive at
`~/archive/libhft/native-report-gates-20261011` retains **67 named completed
inputs**, plus archive/import seals and replication receipt. Its sole
archive-only item is the complete source tarball; reused ELF products remain
in their original qualified archive. Both HP and SCAN verify all 67 named
input bytes and modes. Archive seal SHA-256:

`6c5c7da2b603bd4ef113f3171458720207601cf6e1b0719780f4ef2cd2c95bb4`.

A supplemental four-file quiet-context packet is separately sealed and verified
on both hosts; it does not change the original 67-input archive seal. An actual
HP `isol-no-shared`, high-priority context admits its HP rig and refuses a
foreign SCAN rig. This check executes no benchmark and grants no timing grade.

Root directories for QuickFIX C++ canonical-v2, NexusFIX canonical-v1,
QuickFIX/J session-v4 and Artio session-v9 remain absent on both hosts after
this check. Their prepared installers pass checks; the pending user sudo
command is the next physical prerequisite. Runtime fixture flags stay false.
Fresh DAC matrices, comparison-fixture admission, throughput/stability fixes,
whole-export verification and driver/linked-product licence release review
remain open. No retained campaign cell is promoted by this policy update.