# NanoFIX complete canonical public transport — 2026-10-13

## Result and scope

A separate driver uses the public NanoFIX FixEngine, Session, application,
serializer, MessageView/repeating-group and kernel TCP transport APIs. It
uses clean upstream `0f79bae0ad141653c80cf01c60c807649a6adf7b` with only the
previously reviewed Aeron compatibility overlay. It adds no SDK engine/admin
callback patch. Clean Aeron input remains
`920c266acc79f0bab642b83aeddd720875faa0b5` and the reviewed aeron_c.rs SHA is
`2a9525103f12946065df299c2e3847f4941b3079f633a7a3abb8d47a4060aa08`.
Every other tracked overlay file must equal the clean NanoFIX input.

HP's twelve corrected functional pairs pass every original warmup/measured
body, exact order/spelling, bilateral original bytes, typed owner/count,
original Logons/Logouts and complete primary/delay series, with no skips.
Independent cold replay reproduces their receipts and refuses 83 malformed
controls. The exact portable executable's separate SCAN twelve-pair check
is queued behind existing host jobs; its completion is not claimed.

All four quiet, high-priority HP full localhost flows pass the current rate,
scheduler-delay and p50/p99/p99.9 sample-CV stability gates. Twelve actual
pairs retain 120,000 primary samples, 120,000 delay samples and 330,000 original
application frames per peer. Independent full cold replay reproduces every
fixture receipt, raw quantile, true extremum and timing decision exactly.
No localhost result is Stage 5 or a publishable matched Rust comparison.

| Flow | Achieved cycles/s across three runs | Local gates |
|---|---:|---|
| NOS/ER | 9,992.66–9,992.74 | pass |
| Market data | 9,992.57–9,992.88 | pass |
| Mixed | 9,992.26–9,992.30 | pass |
| Tick-to-trade | 9,992.30–9,992.94 | pass |

## Original bytes, clocks and owner

A public Transport decorator forwards all operations to StdTcpTransport.
Successful sends are captured only after completion and must equal the
prepared public SDK serializer frames. Completed receive bytes are framed
across partial/coalesced input and compared with the production decoded
MessageView's original frame, bounded by its parsed checksum offset. No
application re-encoding supplies received evidence.

The receive timestamp is taken immediately after transport receive and
before capture, SDK parsing or extraction. The server W start is recorded
after SDK serialization/preparation and before public transport send. Both
use std::time::Instant in the same server process. Entire measured rate
includes pacing and extraction. No Aeron driver is created; the final ELF
needs only libgcc_s, libc and the system loader, despite the pinned SDK's
build-time native Aeron link inputs.

All warmup and measured D/V/W/8 frames, original admin frames and complete
raw series are retained. Measured markers restart at one and typed sinks
reset after warmup. The owner consumes every book level, full ACK or causal
server D through public decoded fields. The original-byte observer closes
the admin window after both directions' final application frames complete,
so a coalesced final D/Logout does not become a measured Logout.

## Preserved failure and build qualification

The first actual NOS pair completes its application cycles but fails shutdown:
this SDK's request_stop marks LogoutPending without sending a frame. The
failed server timeout, client missing-Logout assertion, original captured
frames and executable are retained. The corrected consumer sends a real
Logout through the public serializer/EngineContext before request_stop,
as required by this pin; the SDK is unchanged. All twelve subsequent pairs
pass. Both builds have four unused shared-helper warnings, no skips.

The builder verifies both clean Git pins, every reviewed overlay file and
native libraries/source CMake cache before building. Outputs/compiler caches
must be outside source trees; source contents receive fresh timestamps to
avoid stale Cargo reuse from epoch-dated archives. It records actual driver,
lock, overlay, library and executable hashes and rechecks immutable inputs.
The correction reuses only the external compiler cache and preserves the
original failed executable separately.

Corrected standalone source: 828 files, pin
`uncommitted-nanofix-canonical-harness-3c3e9f3291a894b672a21ff523eedd4f8b783ac700cea333d3bb7f8c6a4af487`.
Portable executable SHA:
`ccf04379ff5ccbcf5d55f2e5e5bc196660674deb1c4c381eda21495c5bc110b9`.
Provenance SHA:
`3417a9e981415240a11929eb5aee8479fd0e2d1bcd456edba583714d1c70403b`.
Two-file portable tree SHA:
`6d2cff328dc26616c6d681e2b71eb946e2558ed720575f40d11423193b756e7e`.

## Retention and remaining work

Immutable `evidence/nanofix-complete-canonical-20261013` contains 2,043 files,
202,385,875 bytes, seal
`d5a2901bf52c28be9eeb39f5819885ae9def246dbb492f0f1435bd4878d70218`.
Both host replicas verify original bytes/modes. It retains 25 actual pairs,
including the failed original, 120,240 retained primary/delay samples and
330,750 original application frames per peer. The failed original has no
saved raw series; its in-memory timing values are not counted as evidence.

SCAN exact portable execution remains queued. Root packaging/admission,
full physical runs, independent physical replay, matched current Rust
comparison and release/linked-product licensing qualification remain open.
Old NanoFIX adapters and their additional SDK observer overlay are preserved
as their own diagnostic generations. The 10k/s contract is unchanged.