# Complete Java canonical consumer — 2026-10-14

The separate `libhft-java-canonical` consumer uses the unchanged public pure-Java
SDK. Twelve actual localhost pairs pass the complete canonical body, typed owner,
original wire, sample and bilateral administration audit: all four flows with
warmups 5, 0 and 5, each with 20 measured samples. That retains 240 primary samples,
240 scheduler delays and 700 application frames per peer. This is functional
qualification, with no timing grade or Stage 5 award.

`MessageView` and every `GroupIterator` entry consume the full twenty-entry book.
The exact public decimal getters are checked against the original strings; the
canonical owner folds match the independent specification. Replies use the actual
stable acceptor connection ID, never an assumed ID or broadcast. Built-in application
replies, dictionaries, persistence and outbound raw-ring publication are disabled.

`Session.setWireObserver` records complete original inbound and completed outbound
frames. The acceptor's public send veto runs after SDK serialization. Each prepared
tick is copied before the start timestamp and compared byte for byte with the completed
outbound observation. The tick endpoint is the observer entry **after envelope parsing
and before semantic parsing and caller extraction**, not Philadelphia's pre-parser
channel timestamp. No before-parser equivalence or matched Java admission is inferred.
Observer/hook errors abort the driver, including SDK hooks that otherwise fail open.

The standalone builder pins the SDK bytes and preserves all source hashes, compiler
arguments and JVM options. Its 28 borrowed-buffer, prepared-send and numeric controls
pass. SDK compilation is deliberately pure Java, open edition, with no native build;
this is not a claim that the engine's test suite ran. The SDK source revision is
`133e730ab5fff6b0f17bb47ce95c2882dba4f057`; the SDK jar SHA-256 is
`d459e3f66ae7f098b4715d7044636dc22c670c18a3da0b088a2a12affab6d330`.
The SDK exposes unavailable aggregate acceptor frame counts as `-1`; those are retained,
while original observer counts and bilateral bytes independently prove every frame.
Parse errors, command drops, raw-ring drops and TLS failures are explicitly zero.

SDK-free cold replay reproduces all twelve original decisions without recompilation
or sockets, and refuses all 54 changed-evidence controls. A second cold replay uses
the stripped complete harness source selection, without an engine tree or SDK.
The original compile failure, original unavailable-counter refusal and last-group
reader failure remain retained with their partial original socket evidence.

The [immutable seal](evidence/java-canonical-functional-20261014/retention-seal.json)
binds 1,090 inputs / 11,570,519 bytes; SHA-256
`7467b877fd01891ebad495c72ac49f816dbc3ae1e3a6966046cb709bc25be82c`.
The retained complete harness contains 862 selected files and is explicitly a working
source inventory, not a clean Git pin. Native SDK and runtime jars stay in the local
product archive, independently hash-bound by the build receipts.

The new explicit generation identity is admitted by the portable controller. Existing
fixed installed helpers accept immutable data bundles without executing them as root;
no further sudo registration is needed for this adapter. Full quiet local diagnostics,
physical DAC matrices on both accepted rigs and matched Java gates remain open.