# NexusFIX — complete production workload and owner proof 2026-10-11. Functional controller qualification. **No new Stage 5, report latency, comparison-fixture or public release admission.** Existing runtime pins, SDK sources, original failures and their grades remain unchanged. ## Change The controller previously checked actual admin journals, bilateral application bytes, envelope/checksum and increasing session sequences, then used one cycle for its body verdict. It now requires the complete declared warmup and measured capture, with no missing or surplus cycles. Every original D/V/W/8 body is checked against the independent shared scenario model: fields, values, ordering, exact price spelling, full repeating groups and the causal mixed-flow order/ACK. A correct first cycle cannot admit a later difference. The actual owner must match engine, role, flow, fixed run/sample counts, zero deficit and the independent last-measured-run sink/fold reference. Tick owners also prove the prepared-send count and prepared-wire-send to application-callback-entry boundary. Both role rows must pass and their actual admin journals must validate. Missing observations and failed downloads cannot borrow valid stale files. The complete observation receipt now supplies the controller's wire verdict on both local and remote paths. NexusFIX's passive peers print business/admin counters without the owner's capture declaration. Their original SDK admin journal and byte-identical complete application bytes corroborate the owner's production capture source. A contradictory peer declaration fails. Payload markers restart for each measured run. First warmup starts at one; subsequent discarded warmups continue after the preceding measured run's final marker. The receipt declares that policy separately from the increasing FIX session sequence numbers. Process `required-values-diagnostic` and `fixture_pass=false` remain literal. Passing observation receipts keep fixture/Stage 5 flags false. No raw line or old controller report is rewritten, and no single-run or localhost result is promoted. Stage 2 and shared build/clock APIs are unchanged. ## Frozen source and runtime | Input | Identity | |---|---| | Qualified controller and full stripped archive | `95316980beb763a74bbd86c073e20db8f81be77c` | | Preserved private branch | `s/codex-fullbench-nexus-complete-final-qualified-20261011` | | Previously compiled production source | `ce5ae1074a25242cb4197f8e063105e01569d4f0` | | Unpatched SDK source | `ffa8b0a014b5cb4020ec8a99fe22fa3a24bfc494` | | Reused ELF SHA-256 | `68cc831af7f0a9790ffa2783e714c8c9b7591db83b306a6b8a538c0fe71398cc` | | Original producer source archive SHA-256 | `60877109d052c2f8bf488198fc5d82473a24415bef9e420dbac13433e5193db4` | The complete selected archive contains **780 files**, including three export templates. It is extracted without engine/internal sources, inside an unrelated Git repository. The real controller retains `source-archive-unqualified` identity rather than borrowing that repository's revision. All source bytes and modes are checked before and after execution. No adapter or SDK is freshly compiled. All 91 supplied SDK headers match their committed upstream blob declaration. The reused ELF, fixed launcher and provenance match the staged immutable payload pins. The producer's complete 755-file source extraction matches its original archive, including modes. Seven adapter/fixture inputs and six framework headers match the current archive. Two newer framework headers add preallocation and `PrepareMeasuredRun`; the older frozen ELF does not contain those changes. Their separate current/producer hashes and the actual compiled input map are retained. This qualification establishes the current controller consuming the original runtime, **not a build or timing qualification of current framework sources**. The SDK, producer sources and runtime remain unchanged. ## Executed checks Before each HP execution, host slots, running processes and memory were inspected. The outer foreground check used `host-cpu-slot run --pool isol --priority high`, with the same `wait` command for busy exit 75. Each acquired its lease directly; shared work was permitted. Endpoint processes inherited the lease's CPU mask. No quiet host, disjoint endpoint masks or physical link is inferred. No host policy, turbo setting or IRQ service was changed. The final frozen runtime self-test passes. **Eight actual local TCP pairs** pass: all four flows with warmup 0 / one inner run, then warmup 5 / two inner runs, each with twelve measured iterations per run. They retain: - **144 primary and 144 scheduler-delay samples**, without drops or clamping; - **460 original application frames per peer**, byte-identical between peers; - complete independent body/owner/tick and actual admin-window proofs. A separate process reads the same frozen archive and retained observations, reproduces **all eight receipts**, and refuses **eight failed-copy controls** even though valid files exist. Original result, raw and source bytes/modes stay unchanged. Its temporary extraction is removed. No physical or timing run is performed by that regrade. **348 focused tests pass with zero skips.** These include incomplete/extra captures, a valid first cycle followed by bad original values/order/OrdType, last-level errors in the final snapshot, owner/fold/count/scope failures, wrong tick boundaries, failed or contradictory peers, workload mismatch, adaptive runs and stale remote copies. A Java boundary source guard is corrected for the current mutable `int action` declaration; arrival must still precede both action selection and dispatch. Java engine source is unchanged here. ## Original failures All original files and verdicts remain sealed alongside the final generation. 1. An initial negative test hardcoded the wrong symbol in its order mutation, leaving the frame unchanged: 44 tests passed, one failed. The mutation now swaps body fields independently of symbol and verifies it changed the frame. 2. The broad focused run had 343 passes and one stale Java source-guard failure on `const int action`. The timestamp order remains correct in landed engine source. The corrected guard retains every boundary assertion. 3. The first HP setup asserted all fifteen compiled inputs equalled current sources. It refused before any SDK pair because two framework headers now add preallocation. The continuation verifies the exact original producer archive and separately retains both differences; it does not rebuild or attest current framework timing. 4. At controller source `ebb79dcf5f7f88a2e0029be48b7c53744ce79295`, an actual NOS pair completed both processes and retained twelve primary/delay samples, but the new controller wrongly required capture metadata from the passive peer's stdout. Its `KeyError` and failed audit remain original evidence. 5. At source `3fb28ba6d61fd5bbb974002aa0e032158684db94`, the four zero-warmup pairs pass. A fifth NOS pair retains all 24 primary/delay samples but the audit wrongly expects later warmup markers to restart. Its `tag 11` failure remains unchanged. The final source checks the actual declared marker policy and completes all eight fresh pairs. The fourteen actual pairs across these generations retain **228 primary and 228 delay samples**, with **672 application frames per peer**. Only the final eight pairs supply the qualification above; the original failures keep their original grades. These totals do not combine runs into a timing comparison. ## Retention and next gates [Committed evidence](evidence/nexus-complete-controller-20261011/) contains the exact original logs, captures, raw files, controllers, source inventories and receipts. `~/archive/libhft/nexus-complete-controller-20261011` seals **170 named completed inputs**; four full source tarballs stay archive-only. Its SHA-256 seal is `af36ac543288373eb93810a89be61d0f0c9d08354f704cf4b75c43ee5d99230a`. Both hosts verify all 170 named input hashes, sizes and modes and the seal itself. The [replication receipt](evidence/nexus-complete-controller-20261011/replication-receipt.json) retains those checks. The original SDK/producer build evidence remains in the separately preserved [full-order generation](RECORD_2026-10-04_nexusfix_orders.md). HP and SCAN still need the pending immutable native v2 root install, which includes unchanged NexusFIX canonical-v1. This controller correction requires no different runtime pin. Fresh physical runs must verify installed hashes, actual CPU/process state, topology/counters, complete original captures and all rate/delay/stability gates. Comparison-fixture binding, fresh physical report admission, current standalone builds and driver release review remain open. The website archive retains the failed and qualified diagnostics without turning them into S5 passes.