# NanoFIX independent SCAN cold replay complete — 2026-10-13

SCAN's queued SDK-free reader now reproduces all twelve original functional
receipts from the exact portable NanoFIX executable. It refuses all 83
malformed controls. Original input bytes/modes and frozen reader sources stay
unchanged. It performs no compilation and creates no new socket pairs.

The originals were already imported in
[the exact SCAN peer qualification](RECORD_2026-10-13_rust_peer_scan_complete.md).
The replay covers all four flows with warmup 5, zero warmup, and repeated
warmup 5: 240 existing primary samples, 240 scheduler-delay samples, and 700
existing original application frames per peer. The executable remains
`ccf04379ff5ccbcf5d55f2e5e5bc196660674deb1c4c381eda21495c5bc110b9`.
Producer and reader use the same frozen harness source pin
`uncommitted-nanofix-canonical-harness-3c3e9f3291a894b672a21ff523eedd4f8b783ac700cea333d3bb7f8c6a4af487`.

Immutable `evidence/nanofix-scan-cold-complete-20261013` retains the original
SCAN report, the original reader script, and the original queue log: three
files, 17,919 bytes, seal
`42c53fbbc035eb5e50d113e4c2a9fa36dc3632b22743ce6206731477c8bb20b9`.
Both host replicas verify every retained byte and mode. Four original Git
files include that retention seal; the import and replication receipts are
separate. Previous seals and their then-pending declarations are preserved.
The queue log records its earlier wait; the completed report supplies the
final result. These are functional localhost originals; both timing grade
and Stage 5 remain false.

## Installation follow-up

The preceding records' repeated password-required bundle installation is
superseded by [one-time named installer registration](../../ops/README_STAGE5_INSTALLERS.md),
published as `35905fc0a`. It freezes all fifteen reviewed campaign installers
as root-owned scripts, adds exact named sudo grants, and keeps every original
runtime/launcher hash and existing host rule. Thirteen boundary checks and
both hosts' source-pin/sudoers syntax checks pass. The home registration script
authenticates once on each host; the six-bundle installer then uses `sudo -n`.
The user has agreed to run registration; registration and physical results
are not inferred from that acknowledgement.

Actual physical DAC runs, independent physical replay, current matched Rust
comparison and release admission remain open. This replay adds no new
application samples, changes no rate gate, and does not promote a localhost
result. Its retained data belongs in the website source archive.