# Canonical .NET body formatter qualification

## Declared change and limits

The public managed consumer's [first complete DAC collection](RECORD_2026-10-17_dotnet_managed_physical.md)
retains mixed-flow rate failures on both rigs. The Native consumer also has
separate inherited-placement and first-CPU blockers. This generation reduces
benchmark fixture formatting allocations before a fresh declared physical
experiment. It does not infer that allocation caused a prior failure, and
functional checks admit no timing improvement.

Both production SDK consumers share `CanonicalBodies.cs`. It previously boxed
numeric fields and joined per-field strings, including all twenty snapshot
entries, then encoded the whole body. The new private writer uses a bounded
2,048-byte stack span, invariant ASCII integer formatting and exactly five
fractional price digits. It creates one final body array for the public SDK
builder. Reactive ID/symbol bytes copy directly from their borrowed typed
views during the call. Generated constants, field order, required values,
SDK/public send APIs, clock boundaries, extraction/folding and phase/capture
rules are unchanged. No native library or SDK source is patched. The fixed
positive canonical price domain is unchanged; negative formatter inputs refuse.

## Actual standalone qualification

Both hosts build the complete 909-file stripped harness, with no enclosing
Git/engine/private source tree. Both Native and Managed builds succeed with
zero warnings/errors, SDK 10.0.112 targeting net8.0, runtime 8.0.31, two
MSBuild jobs and no build server/shared compilation. Outputs use the session
build root. HP holds high-priority `isol`, SCAN normal `isol`; both host slot,
process and free-disk states are checked first.

| Configuration | Actual pairs per host | Independent cold refusals per host |
|---|---:|---:|
| Native legacy receive | 12 | 73 |
| Native handler / inherited mask | 12 | 109 |
| Native handler / inherited / 2 ms probe | 12 | 28 |
| Native handler / first CPU | 12 | 109 |
| Native handler / first CPU / 2 ms probe | 12 | 28 |
| Managed public callback / inherited mask | 12 | 133 |
| Managed public callback / inherited / 2 ms probe | 12 | 28 |

All **168 actual TCP pairs and 1,016 refusal controls pass**, without skips.
Every configuration covers all four flows with warmups 5, 0 and 5. Each
retains 240 primary/240 delay samples and 1,000 application frames per peer
per host. Managed pairs use alternate loopback 127.0.0.2, checking the corrected
explicit bind. They confirm the native engine is unloaded and SDK callbacks
equal all incoming application frames. Native first-CPU masks are HP 8/13 and
SCAN 10/14 within unchanged full endpoint budgets. Other masks remain inherited.

Every profile's complete 120-body/four-owner cold output is **byte-identical
to the preceding separately qualified formatter**, then independently matches
the canonical specification. Actual bilateral pre-warmup captures also pass
body/framing/session checks; measured capture remains zero. Owner counts/sinks,
actual admin observations and original monotonic handler/extraction spans all
pass. Delayed probes prove both selected boundaries and remain ungraded.
All 1,018 focused SDK-free clock, affinity, preflight, writer, runtime, matcher,
report and lease/status checks pass without skips. Export closure/scrub findings
are zero; this does not establish whole-harness release admission.

## Immutable inputs and declared next experiment

- Qualified source: `14aa83064f09afa05fe0972c76418fb47aba29a4`.
- Source inventory SHA-256:
  `7095ab90b0c15126a2ed2780bbefd445823b25c0266e2f171f4c030dcfe66e99`.
- Native driver DLL, identical on both hosts:
  `b730a18e484b833c664a587f2e88b919ea444cffe9e3d72c5398f7b38155050a`.
- Managed driver DLL, identical on both hosts:
  `47133bbce59459b5769ae46e6fc6a59d0546f24999adef176e972be06daa3770`.
- Unchanged native library:
  `91bdc88f8cd2d375262daafdc233ce2b16bc49e8fcae0789da12af999c737dc9`.
- Unpatched SDK pin:
  `uncommitted-functional-source-26310f12584fd0f392af231da8c2ea10067f50bb337db118cc79a2895da54386`.

Source/SDK bytes and modes, native bytes and compiled runtime products remain
unchanged throughout qualification. Both hosts retain:

- `~/.cache/libhft/fullbench-dotnet-byte-bodies-20261017-v1`
- `~/build/codex-fullbench/libhft/dotnet-byte-bodies-20261017-v1`

Fresh complete four-flow tiny/report matrices will run once for each of Native
inherited, Native first-CPU and Managed inherited, on each physical rig, with
separate immutable bundles and disjoint ports. Timing uses `isol-no-shared`,
high priority on HP. Each profile needs its own original physical and cold
proof. No configuration union, unchanged failed timing retry, retrospective
promotion or .NET peer comparison is admitted. Old successful compact cells
and all failed records stay retained. Raw working output stays on the hosts;
only qualified compact results and summary records enter Git/website data.