# CORE pre-warmup capture qualification

## Change

Both public CORE canonical binaries now run ten functional cycles before
the requested warmup and measurement. Each directional capture closes after
the last preflight application frame. The next cycle refuses to begin warmup
unless both streams are closed. The owner verifies its independent
`canonical_spec.py` ten-cycle sink and fold count at that boundary, then
resets its sink and marker; measurement resets them again at the unchanged
warmup boundary.

All subsequent application frames continue to update in-process directional
counts and cycle completion. The final producer checks those counts against
the entire preflight/warmup/measured workload. Full measured sink/fold and
primary/delay samples remain available for independent admission, without
measured application-message I/O. Prepared-send and callback/receive tick
spans remain distinct. Existing full-capture outputs retain their old policy.

The shared auditor accepts the new scope only for its reviewed producers and
keeps JVM placement validation confined to JVM engines. The compact writer
continues to require its own supported-producer set: C++ capture qualification
alone does not enable Java-specific compact publication for native binaries.
The new portable `check_cpp_preflight_canonical.py` cold-replays complete
actual functional matrices and changes copies for refusal controls.

## HP qualification

The complete stripped harness has 885 source/template files and inventory
SHA-256 `8d28739b3ce10bb4cb72c92b42df9c1b8401b993c8e7f58b06d216260d33cb93`.
It contains no engine, internal or Git directory. Its compile and functional
qualification holds HP's high-priority `isol` lease, with concurrent shared
conformance work. This is a functional run with no timing admission.

Both binaries build against the original 971-file public CORE SDK source
inventory, still bound to its prior reviewed content pin
`uncommitted-cpp-canonical-a3849156f2173dacc544386c183a9ced0c72a355d7e573edca7be7088ce98645`.
All SDK and harness bytes/modes remain unchanged. The SDK is unpatched.

| Driver | Binary SHA-256 | Actual pairs | Cold refusals |
|---|---|---:|---:|
| CORE callback clock | `01ce4973137d003b5a7c808e1b067b0d29a1406d66e225e16bb0380a49127f35` | 12 | 73 |
| CORE receive clock | `467e0c91151a049dab528690d6445cdc34c7c61514c48d040909155b8993d260` | 12 | 73 |

Each binary passes all four flows with warmup 5, 0 and 5, twenty measured
samples per pair and ten additional preflight cycles. Independent cold body
and owner vectors also pass. Across both matrices:

- 480 primary samples and 480 scheduler-delay samples;
- 2,000 observed application frames per peer;
- only 600 pre-warmup application frames per peer in capture files;
- 146 altered-input refusals, including valid-checksum body corruption,
  missing/extra capture frames, false closure/grade/count metadata, modified
  independent owner sinks/folds and changed tick clock;
- original pair evidence, SDK and source bytes/modes remain unchanged.

All 353 focused preflight and compact-writer controls pass with zero skips.
The complete export has zero closure and scrub findings. Working outputs are
under `~/build/codex-fullbench/libhft/cpp-preflight-20261016-v1` on HP; no raw
capture, binary, log or source archive is added to Git.

Native compact-result admission, newly pinned physical runs, the peer's
corresponding preflight migration and full matched comparisons remain open.
The existing C++ comparison results are not replaced or regraded. Other
language collectors and the harness release gates remain separate work.

## Native compact-writer follow-up

A subsequent controller change enables the two qualified CORE producers in
the compact writer. Native observations must declare public CORE, kernel TCP
and no store; each tick clock gets a distinct flavour key. Native results
do not read or acquire JVM placement/version facts. JVM results still bind
their actual arguments and version. Every engine retains the same physical,
CPU, original fixture, measured accounting, full rate/delay/stability and
independent cold replay requirements before a result can be written.

The receive-clock producer now has its own generic immutable generation
identity, distinct from the callback producer. This is portable admission in
the controller; it changes no root helper or sudo rule. All 381 focused
preflight, runtime-generation and compact-writer controls pass with zero
skips. Fresh physical runtime staging and report collection remain required;
this follow-up writes no result by itself.