# Separate .NET Native canonical source generation

HP qualification, 2026-10-12. This advances the fixture blocker in
[the full-bench plan](../../../docs/bench/PLAN_FULL_BENCH.md), with no installed
runtime replacement or physical/report promotion.

## Why a separate generation

The new installed Native physical reports pass timing/admin/physical/stability
on both hosts but remain comparison-fixture blocked. Reading the actual
original tiny frames confirms the gap: D has extra HandlInst/TimeInForce,
V lacks the two entry types, W differs in decimal spelling, ACK field order
differs, and tick W/D still use the older marker/book/reaction values. An
alignment flag alone cannot remove these differences. Those reports and their
original flags remain unchanged.

`bench/dotnet/fixbench/native-canonical/` is a separate public-SDK driver.
It uses the existing raw application API, production transport observer and
typed views; there is no engine patch. The four bodies use the generated
canonical constants, including required OrdType. ACKs echo the actual order;
mixed/tick reactions derive marker, symbol, side, quantity and price from the
actual received book. Warmup resets the measured owner's marker and fold.
Every original warmup/measured frame is streamed with a bulk span write,
alongside actual original administration. The older provider-smoke source
and all nine installed generations stay unchanged.

The tick feed prepares a complete public SDK batch and verifies that no
application write was observed before the clock. It records its UTC start
immediately before the public flush, then requires exactly one completed
write observation. The end uses the original native receive timestamp before
application extraction. The managed start has 100 ns resolution; nonpositive
spans fail. Client request/reply spans include checked extraction. These are
declared functional clocks, not timing or report admission.

## Complete stripped inputs and actual qualification

Base devel revision: `202a92242d3ebb22d2acc003600522eb47a58115`.
The complete stripped harness contains **795 files**, including the five new
uncommitted source files; the independent public SDK contains **738 files**.
Both are bound by full SHA-256/size/mode inventories, rather than borrowing
a Git identity from a parent checkout. The SDK includes the current public
C++ headers and is freshly compiled, not linked to the older installed SO.

- Producer source inventory:
  `uncommitted-functional-source-c8451ce8259bc13ab1191688d5a5e1b084b6e9abf2cdc9ca334e3f9a99ffcb89`.
- Independent SDK inventory:
  `uncommitted-functional-source-26310f12584fd0f392af231da8c2ea10067f50bb337db118cc79a2895da54386`.
- Strict independent reader inventory:
  `uncommitted-independent-reader-a93ebf592a7e383886b16e6af206d58c2734f4cec7fc7832b604958e048e9180`.
- Fresh native SO:
  `ce72aa085cdb01bf99ee7a3a5471bb75dc6aa9b1f57c48932365e9fb66500e12`.

HP's high-priority `isol` lease permits concurrent shared work and therefore
carries no quiet report claim. The fresh SDK builds at `-j2`, and the fresh
managed driver builds with two workers: zero warnings/errors. All twelve
actual localhost process pairs pass, with zero skips: four flows each with
warmup five, warmup zero and a repeated warmup-five case. Disjoint process
masks are `10-13` and `14-17`. The public batch really retains the prepared
tick before flush; no write occurs before its clock.

Independent original-body checks pass every warmup/measured cycle, bilateral
bytes, envelopes/checksums, strictly increasing sender sequences, actual
thirty-second Logons and complete measured owner count/fold. The cold
counterpart verifies **120 bodies and four typed owner vectors**, explicitly
labelled cold body output rather than transport evidence. The real pairs
retain **240 primary and 240 scheduler-delay samples, and 700 application
frames per peer**. Every peer retains original Logon and Logout in both
directions. All source bytes/modes remain unchanged; no build output enters
either stripped source tree.

## Independent replay and refusal controls

A separate frozen reader strengthens type/exit/Logout checks and reproduces
all twelve original fixture receipts exactly. It verifies raw samples and
both peer captures while opening no new sockets and compiling nothing.
Original evidence bytes/modes and all reader source bytes/modes are unchanged.

All **56 malformed-evidence controls** are refused: each flow checks wrong
engine, boolean run identity, false fixture declaration, partial capture scope,
wrong count, wrong owner sink/fold, missing original Logon/Logout, dropped raw
series and a missing frame. Three further controls per flow change a body
price, reorder pinned fields or insert an extra field. Those body controls
recompute the FIX envelope/checksum and mutate matching sent/received copies
on both peers; bilateral equality and valid framing cannot conceal the
independent body mismatch. Sink/fold controls update both observation and
result metadata, so agreement between producer declarations cannot substitute
for the independent owner model.

## Retention and remaining admission

[Import](evidence/dotnet-native-canonical-hp-20261012/import-receipt.json),
[seal](evidence/dotnet-native-canonical-hp-20261012/retention-seal.json),
[functional matrix](evidence/dotnet-native-canonical-hp-20261012/functional/actual/manifest.json)
and [cold proof](evidence/dotnet-native-canonical-hp-20261012/cold-report.json)
keep **208 files / 1,116,374 bytes**, seal SHA-256
`56d980f196ccc9f0480360631b8729826d5555a3085041a73ce532d20937d541`.
The committed import retains 209 originals including the seal plus import
and two-host replication receipts. Every original raw/transport file is
committed; no SDK binary is added. Both hosts independently verify the seal.

SCAN's matching fresh qualification is queued behind other sessions through
the CPU helper. Its results and cold proof must be retained separately.
This generation declares `timing_grade=false` and `stage5_pass=false`; it has
no new immutable physical payload/controller or report admission. Timing-path
qualification, both-host fixture admission, root installation, fresh physical
reports, matched comparisons and whole-harness release remain open. Existing
producer/controller fixtures, cells, SDK pins and first/managed seals are unchanged.

## Both-host replay and receive-buffer follow-up

SCAN now independently builds the same complete sources and passes all twelve
actual pairs, retaining 240 primary/delay samples and 700 original application
frames per peer. Its strict reader reproduces every original receipt and
refuses all 56 controls. The managed apphost bytes match, while each native
library reflects that host's compiler/CPU target. Both complete SDK inventories
stay unchanged. Apphost identity alone does not identify the managed program;
new functional manifests additionally retain every managed runtime file hash,
and physical admission pins the DLLs and whole self-contained tree.

HP's first full local matrix reuses the qualified driver and SDK under a
high-priority `isol-no-shared` lease: all twelve report-sized pairs complete,
with 120,000 primary/delay samples and 330,000 application frames per peer.
All fixture/rate/admin/delay checks pass; MD, mixed and tick also pass full
percentile stability. NOS fails p99.9 stability (38.031, 74.654, 63.597 us).
That original failure and every raw/transport file remain retained.

The driver allocated a 4 KB buffer and copied the received frame on every
receive. A separate source generation reuses one buffer per peer and borrows
only its actual received length. Every view is consumed before the next
receive; no body, extraction fold, sample boundary, SDK or native library
changes. Both hosts build the corrected driver, pass twelve further actual
pairs and reproduce all receipts with the same 56 refusal controls, without
new native compilation. Corrected source inventory:
`uncommitted-buffer-source-c7b713570914f55909f652f42a18ff0a2bdd1c4674aa8cbbf0cbbb5c4d392563`.

HP's separate full corrected local matrix retains another 120,000 primary/
delay samples and 330,000 frames per peer. **All four local timing gates pass**.
NOS achieves 9,900.13–9,900.98/s and p99.9 is 33.333–33.604 us; MD achieves
9,894.02–9,894.18/s, mixed 9,886.51–9,887.96/s, and tick
9,899.57–9,900.55/s. These observations support the correction while preserving
the first matrix; they do not establish physical timing or a general causal
explanation for every tail. Neither local matrix is a Stage 5 result.

## Self-contained runtime and cross-host portability

HP publishes a separately qualified 191-file self-contained .NET 8 runtime
and passes twelve actual pairs through it. Its first native library is
compiled for HP's AVX-512-capable Xeon Gold 6254. The first SCAN clean-environment
entry retains passing cold bodies, then fails acceptor readiness before any
client is started; its original empty logs, null exit metadata and outer
failure remain retained. SCAN's Xeon E5-2698 v4 supports AVX2. A bounded
startup probe is queued to capture a concrete process exit; no signal is
inferred from the first reader's null exit value.

A separate portable candidate keeps the same managed/runtime bytes and uses
SCAN's already freshly qualified stock native library from the identical
738-file public SDK. Its native SHA-256 is
`91bdc88f8cd2d375262daafdc233ce2b16bc49e8fcae0789da12af999c737dc9`.
The 191-file tree is
`59f4b9c5f71ac8fb015af8fba46538c2c4a15d4426cdfa02fb187525efbe72bc`.
HP's clean-environment entry passes all twelve pairs; SCAN's matching check
is queued. The first package is unchanged. Later failed-start metadata records
the actual reaped server return code, rather than losing it as null.

The new physical controller and fixed namespace launcher are separate from
the older observed payload. Complete original fixture proof, positive wire
counters, exact sample counts, successful peer exits, an inherited exclusive
lease and every current report rate/delay/stability gate are required. Tiny
admission also requires its configured rate and scheduler delay. Twenty-eight
classification checks use the complete original corrected local metrics
with explicitly synthetic physical flags; they make no NIC claim. The
complete stripped controller CLI starts without private facts or a runtime.
Readiness has 794 selected files and no scrub/private/unresolved/dead-link
findings; 66 textual source escapes remain declared inputs. The installer
prechecks the entire runtime tree and refuses a different installed prefix.
Both-host exact entry qualification, actual root admission, physical runs and
independent physical replay still govern promotion.

### Portable exact entry completed

SCAN's separate portable clean-environment check now passes all twelve
actual pairs, with the same 191-file runtime tree and native library as HP.
It retains 240 primary/delay samples and 700 application frames per peer;
all sources and runtime bytes/modes remain unchanged. The bounded startup
probe of the first package returns **-4 (SIGILL)**, with zero stdout/stderr.
That confirms an illegal instruction in the original startup without
changing its earlier failed evidence or inferring a timing result.

HP's full matrix through the actual portable self-contained package retains
120,000 primary/delay samples and 330,000 application frames per peer.
All four local rate, delay, admin and full percentile stability gates pass.
The expanded fixed-policy reader reproduces HP's portable entry receipts
and refuses 63 malformed-evidence controls, including result identity and
prepared tick send/end/domain mutations. This is still localhost evidence.
The separately published home installer prechecks the canonical Native and
three Rust bundles on both hosts; their new root installs require the user's
terminal authentication. The previously installed nine runtimes stay intact.

The [new immutable supplement](evidence/canonical-public-qualification-20261012/retention-seal.json)
retains the complete portable follow-up and independent full replay beside
the new C++ baseline, with two-host byte/mode verification. Its 745 original
inputs total 357,744,516 bytes; seal SHA-256 is
`31753514c5190ae31526b984bceef75c44996cc5e4531b9d372ecbc2680de098`.
Earlier snapshots remain immutable, including their then-pending notes.

[Follow-up import](evidence/dotnet-native-canonical-followups-20261012/import-receipt.json),
[seal](evidence/dotnet-native-canonical-followups-20261012/retention-seal.json)
and [replication](evidence/dotnet-native-canonical-followups-20261012/replication-receipt.json)
retain **1,268 files / 357,331,148 bytes**, seal SHA-256
`5dd4ebe34a08fdb3df824e57f8cc66d14f8978219509647cbeb924ff6cf74565`.
The import keeps 1,269 originals including the seal plus import/replication
receipts. Both complete local matrices, every new original capture/raw file,
both-host original/corrected functional and cold proofs, original SCAN
package failure and HP self-contained proofs are committed exactly. No SDK
binary is added. Both hosts independently verify the copy. The earlier HP
seal and all physical seals are unchanged. Later portable-package checks and
the startup diagnostic belong in a further supplement.