# Complete C++ CORE canonical baseline

2026-10-12. This supplies a separate current C++ baseline for the
[full-bench plan](../../../docs/bench/PLAN_FULL_BENCH.md). The older installed
roundtrip binaries and retained grades remain unchanged.

## Public session path and complete evidence

`bench/cpp/fixbench/src/libhft/canonical_core.cpp` uses the public CORE
`CoreSession`, `CoreEngine`, `CoreApplication`, `MessageBuilder`, parsed
`Field` descriptors and stock kernel `FixSocket`. It declares the CORE tier,
kernel TCP and no store. It adds no engine patch or hidden response path.
Outgoing original frames are streamed only after a complete stock transport
write. Incoming original frames are streamed in the parser callback.
The callback preserves the original bytes in one reusable fixed buffer and
rebases the SDK's actual field descriptors before the session consumes or
compacts its parser buffer; extraction uses those descriptors without a
second parser. Every warmup and measured cycle is retained, as are actual
administrative frames and measured administrative counters.

Every ordered application body uses the common generated fixture, including
limit OrdType. ACKs echo the actual order. Reactions use the received book's
marker, symbol, side, touch price and quantity. Warmup is excluded and the
measured marker and owner fold reset. Both unrounded raw series use 64-bit
nanoseconds. Request/reply samples include checked extraction. The tick
server serializes its complete frame before its monotonic start immediately
before public `SendMessage`; its end is sampled on the same process after
receive and before parser dispatch/extraction. Stock administrative timers
and SendingTime retain their UTC domain.

The independent Python checker selects a fixed C++ API/observer/clock
policy. Evidence cannot select its own policy. It checks complete original
bytes, checksums, sender sequence numbers, exact ordered bodies, thirty-second
Logons, bilateral Logout, raw identities/counts, and the common measured
owner sink/fold count. The Native checker retains its explicit Native default;
the C++ policy also requires the declared CORE/kernel/no-store configuration.

## Frozen inputs and HP qualification

The stripped harness contains **800 files**; the independent public C++ SDK
contains **971 files**. Both have complete SHA-256/size/mode inventories,
based on devel `eaf474cc09ac95aba3a076c8d1ea49ca721a37ca` plus the new
explicitly inventoried driver and checker source. Actual inputs use the
inventories rather than borrowing the parent Git identity.

- Harness inventory:
  `uncommitted-cpp-canonical-9c9c31ac0f3136ce94bdf8cbe2cb2f46962c32a6dc18a8d605ceb7cf17bc6589`.
- Independent SDK inventory:
  `uncommitted-cpp-canonical-a3849156f2173dacc544386c183a9ced0c72a355d7e573edca7be7088ce98645`.
- HP executable SHA-256:
  `dd23d9ad5447dbbc4e0d662f040797372421cec6c03c3b68bb4667ded0357e5f`.

HP freshly builds the selected public source with GCC 14, `-O3 -march=native`,
the open include policy and `-j2`, writing all products out of tree. The build
has zero warnings/errors. A high-priority `isol` lease permits shared work
and makes no quiet timing claim. All twelve actual localhost pairs pass:
four flows with warmup five, zero and repeated five. They retain **240
primary/delay samples and 700 application frames per peer**, with disjoint
process masks `10-13` and `14-17`. All original fixtures and common owner
folds match. Cold vectors independently check **120 bodies and four owner
vectors**, explicitly without a transport claim.

A separate cold replay reproduces all twelve receipts exactly and refuses
**75 malformed-evidence controls**. These include valid-envelope bilateral
body price/order/extra-field mutations, metadata/result identity, wrong
owner count/fold, missing original admin/raw/frame data, undeclared tier,
transport/store and wrong prepared tick boundaries/domain. Original evidence
and reader source bytes/modes remain unchanged; no new socket is opened.
The same reader's explicit Native policy reproduces HP's portable Native
entry and refuses all **63 controls**, preserving the Native policy behavior.

## HP full local matrix

Under a high-priority `isol-no-shared` lease, twelve report-sized pairs run
with 1,000 excluded warmup cycles, 10,000 measured cycles and a 10,000/s
offer. All four local rate, scheduler delay, measured admin and full percentile
stability gates pass. Every original body and measured owner fold passes;
the matrix retains **120,000 primary/delay samples and 330,000 application
frames per peer**. This is localhost evidence, with no Stage 5 promotion.
Independent cold replay reproduces every fixture receipt, raw quantile,
extremum and full gate decision exactly, with original bytes/modes unchanged
and no new compile or socket pair.

## Retained failures and remaining admission

The first qualification refusal after missing source inventory, two compile failures for missing
namespace qualification and a cold failure from an omitted builder delimiter
are preserved. Separate corrected source inventories leave those original
failures intact. No failed cohort is silently replaced.

SCAN's matching fresh build and functional matrix are queued behind the
other session's exclusive CPU work. Both-host portable runtime qualification,
immutable root payload/controller, fresh physical matrices and independent
physical replay remain required before matching the NexusFIX comparison.
Endpoints always declare `timing_grade=false` and `stage5_pass=false`.
The complete harness release and other languages' remaining fixture/rate
gates remain open.

## Immutable retention

[Import](evidence/canonical-public-qualification-20261012/import-receipt.json)
and [seal](evidence/canonical-public-qualification-20261012/retention-seal.json)
retain **745 files / 357,744,516 bytes**, seal SHA-256
`31753514c5190ae31526b984bceef75c44996cc5e4531b9d372ecbc2680de098`.
The import contains 746 originals including the seal, plus import and
two-host replication receipts. Both hosts verify every original byte/mode.
This supplement also retains SCAN's portable Native entry, its first-package
SIGILL probe, HP's actual portable Native full matrix and both exact full
cold replays. It advances 48 actual process pairs, 240,480 primary/delay
samples and 661,400 application frames per peer without replacing an earlier
seal or adding an SDK binary to Git.

## Portable runtime and physical entry follow-up

SCAN independently builds the same complete source/SDK inventories and
passes twelve actual pairs with zero warnings/errors. Its native executable
SHA-256 is `099b30921897b3ff1c612b1a5dcc43e2563f89dfd0c742bf12416e2bd8282cda`.
HP separately builds the unchanged driver with the explicit Broadwell target
and passes twelve clean-environment pairs through the staged package. The
two independently compiled binaries are **byte-identical**. Each cohort
retains 240 primary/delay samples and 700 original application frames per
peer. Source bytes/modes stay unchanged; neither cohort grants physical grade.

The two-file portable runtime tree is
`83855e2c36cfbc9f2c60f355a933e37bc97566d1e178b69841e27a91c4366a0f`.
The fixed installer and namespace launcher use a new immutable prefix,
`fullbench-libhft-cpp-canonical`. Staged installer checks pass on both hosts
through an explicitly recorded launcher-location substitution; the installed
code keeps its maintained main-checkout path. The Root prefix remains absent.

The new public physical controller retains complete fixture/owner/raw/admin
proof, exact peer exits, positive original port counters and inherited
exclusive CPU leases before any report promotion. Its 28 classification
checks use actual complete HP local metrics and explicitly synthetic wire
flags. These checks make no physical claim. HP's complete 802-file stripped
controller archive starts its CLI and refuses missing root admission before
creating output or opening sockets; every source byte/mode remains unchanged.
Readiness selects 799 source files plus templates, with zero scrub/private/
unresolved/dead-link findings and the same 66 declared textual source escapes.

SCAN's separate portable clean-environment entry and independent cold replay
remain queued. Root install, actual physical matrices and independent physical
replay remain required. A separately maintained terminal-preserving home
installer is prepared for this new C++ prefix. The earlier Native/Rust home
installer and all previously installed generations remain unchanged.

[Portable admission import](evidence/cpp-canonical-portable-admission-20261012/import-receipt.json)
and [seal](evidence/cpp-canonical-portable-admission-20261012/retention-seal.json)
retain another **382 files / 1,279,304 bytes**, seal SHA-256
`1a2d76510b89db3da725de0381d5f33b8c6023cf84c220ffddb494a6ca0a2b48`.
All 383 originals including the seal are committed beside import and
two-host verification receipts. The earlier 745-file seal remains unchanged.

## Completed SCAN entry and cold follow-up

The queued portable clean-environment entry now passes twelve actual SCAN
pairs through the exact two-file package, with 240 primary/delay samples and
700 complete application frames per peer. No new compile runs; every source
and runtime byte/mode remains unchanged. The executable is identical to the
independent fresh SCAN build. SCAN's independent reader also reproduces all
twelve C++ and Native receipts, refusing 75 C++ and 63 Native malformed-evidence
controls. These completions are retained in the separate
[QuickFIX/J and SCAN follow-up record](RECORD_2026-10-12_quickfixj_complete_canonical.md),
without modifying the earlier pending-checkpoint seal.

Frozen C++ physical jobs are prepared on both hosts. They wait for the new
root prefix without taking CPU leases, then request an exclusive lease
(HP high priority) for four tiny pairs and twelve full report pairs. Actual
root admission, physical counters, independent physical replay and the
matched NexusFIX comparison remain required.