# Philadelphia bounded wire observer — 2026-10-17

## Implementation and qualification

The Philadelphia observer now retains application wire bytes only for the
ten graded pre-warmup cycles. Later original channel frames retain their
kind, completed-frame accounting and first-byte timestamp, without copying
their bodies. Original administration bytes remain complete throughout.
Outgoing inspection reads the SDK's prepared buffers without advancing them;
partial writes retain one prepared-frame identity and one tick-send stamp.
The public SDK still parses every application message, and every original
payload check, complete book extraction, typed owner fold, pacer and callback
clock endpoint remains unchanged. No upstream SDK source or binary changes.

Actual counters require exactly the preflight copy count in each direction
and one metadata record per later inbound application frame. A read-only policy
checks those declarations; partial/untyped/altered counts fail. Sealed older
producers without this new diagnostic declaration retain their own original
scope. Fresh cold controls mutate copies of actual observations and refuse
six new corruptions per flow. The policy travels with grading sources.

Source: `ffa4ca875a487d2343f793dd401fca1fed10528b`. The complete stripped
927-file archive has inventory SHA-256
`edda4874671ecb1989983fe43fd0f7129a042b418c727385126174ffdce7c669`.
Its Python export gate passes 2,157 tests and 58 separately reported subtests,
with zero skips/failures and two explicit SDK source deselections. Each actual
Java build passes 5,441 compiled fragmentation/buffer/numeric checks with zero
skips. The 21 focused copy-policy controls pass. Original body/owner vectors
and the pinned Philadelphia 2.0.0 SDK JAR remain unchanged:
`396136037b0f41e635e3aea233c3f31f4a388318b445f4afe1609b9a6d28a7b7`.

Both hosts independently build and qualify two declared profiles: existing
Epsilon/split and Epsilon/eager-compilation/split, always with the public
application callback endpoint. Every profile passes twelve actual TCP pairs
including zero warmup and a repeated run. Across both hosts/profiles this is
48 functional pairs, 452 cold refusals and 96 checked endpoint copy-counter
observations. Every frozen source inventory remains unchanged. These
functional checks use `isol` leases, HP at high priority, and grant no timing
grade. Runtime flags and actual CPU/collector readbacks retain distinct keys.

## Accepted physical collection

Preparation checks pool status, processes and disk, then uses the existing
registered generation installer. Both timing campaigns enter outer quiet
`isol-no-shared` leases; HP requests high priority. The original DAC namespace,
CPU, entry, host-probe and wire-counter policies remain in force. Four tiny and
twelve report pairs per host/profile complete: 64 physical pairs total.
Independent tiny/report replay on each reproduces the original raw metrics,
extrema and every admission decision, with no new sockets or altered originals.
The physical collection retains 480,320 primary and 480,320 delay samples,
and 1,322,600 application frames per peer across the four matrices. Application
files still contain only the ten pre-warmup cycles.

### Epsilon with eager compilation

Every flow remains diagnostic because its achieved rate misses 9,800/s.
The observer change alone does not resolve that configuration's rate failures.
SCAN MD also fails full percentile stability. No cell is written.

| Flow | HP achieved /s, min–max | SCAN achieved /s, min–max |
|---|---:|---:|
| NOS/ER | 9,302.714–9,304.381 | 8,570.536–8,592.521 |
| MD | 9,234.569–9,248.323 | 8,859.821–8,875.769 |
| MD + NOS/ER | 9,178.097–9,190.417 | 8,510.374–8,524.321 |
| Tick to trade | 8,677.324–8,679.911 | 7,579.788–7,583.934 |

### Epsilon without eager compilation

HP passes all four Stage 5 flows. SCAN passes NOS, MD and tick; mixed flow
misses the rate gate in at least one repeat and remains diagnostic. All
canonical body, owner, administration, physical, entry and copy-count proofs
pass. The following are observed configuration outcomes; they do not isolate
the observer's causal contribution or establish a whole-language comparison.

| Flow | HP achieved /s, min–max | HP grade | SCAN achieved /s, min–max | SCAN grade |
|---|---:|---|---:|---|
| NOS/ER | 9,991.637–9,992.153 | S5 pass | 9,981.097–9,983.244 | S5 pass |
| MD | 9,988.737–9,992.644 | S5 pass | 9,981.276–9,986.002 | S5 pass |
| MD + NOS/ER | 9,983.297–9,987.892 | S5 pass | 9,743.187–9,830.052 | S5 diag: rate |
| Tick to trade | 9,991.567–9,992.369 | S5 pass | 9,960.671–9,986.441 | S5 pass |

Seven byte-exact compact writes add two MD keys and replace five successful
cells with their newest passing generation. The catalogue becomes 655 cells.
All unselected result bytes remain identical; failed eager or mixed-flow
attempts replace nothing. Each retained CDF stays within 2,000 points per kind.
No raw captures, samples, logs, runtime archives or JUnit files enter Git.

## Retained identities and outstanding work

| Profile | Host | Immutable generation |
|---|---|---|
| Epsilon/eager/split | HP | `686f33c9fecaf5ae9b02aaef4f52c350233c2ffde4f8cd7be79d8d1903b74fac` |
| Epsilon/eager/split | SCAN | `98602cca2b2a70c940a5dd544d2038969ba8abf012289eac7c8b140446896bfb` |
| Epsilon/split | HP | `5b7f865541862eeddadd6ee9e80fd22bc2335ac432122349765fc3ddf470e942` |
| Epsilon/split | SCAN | `92da4de5f80f22626e5e00460001f04841ad4780d79dabc7d1a7fdebac2f4188` |

Original working roots, on both hosts, are under
`~/build/codex-fullbench/libhft/philadelphia-bounded-observer-`:
qualification and physical roots end in `qualification-20261017-v1` /
`physical-20261017-v1` for eager, and `qualification-epsilon-20261017-v1` /
`physical-epsilon-20261017-v1` for Epsilon-only. All consume the frozen
`~/.cache/libhft/fullbench-philadelphia-bounded-observer-20261017-v1` archive.
Products and original decisions remain separately pinned per profile/host.

SCAN mixed-flow admission, the current matched LibHFT Java baseline and
whole-language/anchor, whole-SDK/licence and coordinated release gates remain
open. Existing Rust/.NET decisions and historical archive seals are unchanged.