# Bounded QuickFIX C++ immutable DAC integration — 2026-10-17

## New runtime interface and physical controller

The [prior frozen consumer](RECORD_2026-10-17_quickfix_cpp_preflight.md)
passes both hosts' original SDK, twenty bounded and twenty-three legacy TCP
pairs and independent cold readers. A new candidate at
`f926d490a32b203cfab278c9e0be68251f95fd54` adds the fixed nine-argument
normal-user generation interface. It maps role/flow/address, bounded decimal
workload counts, a new absolute evidence path and timeout to ten pre-warmup
cycles, one fixed run, the adjacent original dictionary and full warmup/sample
counts. The legacy flag interface remains available.

The new `quickfix-cpp-callback-canonical` controller uses the already
registered immutable data installer and normal-user namespace entry; no new
sudo registration is requested. Before sockets it verifies the original
installed app/dictionary/provenance bytes, generation, root helpers, host,
namespace and CPU admission. Both physical NIC counters must advance with
stable interface/counter identity. All original Logons/body bytes, prefix and
full measured owner grades, live application counts and both complete raw
series remain required. The initiator waits for the exact acceptor listening
marker. Outgoing public SDK Log bytes remain serialized Log observations;
they are never relabelled completed socket writes.

The controller retains every configured run and complete rate, scheduler-delay
and sample-standard-deviation stability decisions. The independent reader
recounts original command/entry/counter proof, captures, owners and raw
quantiles/extrema; it reproduces failed report decisions too. It reads saved
files without compilation, root commands or new sockets. No failed original
timing is rerun under its old key.

## Queued actual qualification

The complete f926 standalone export has **958 actual files** (953 selected
source files plus five template outputs), zero unresolved references, dead
links or scrub findings. Sorted source-inventory SHA-256 is
`ffff3ed57efe34e12ff873327d6deaf3541202676b3bb6baacb175235af81ce1`.
The queued capsule SHA-256 is
`efe59edbeeeaa2b00e1ea0af8982cae05cea2077b3f4a5fa5a1dab07f1c606eb`.
Its original SDK source/library inventory and exact GCC 15 input remain those
in the prior record; qualification must freshly verify them.

Both hosts queue fresh functional builds, original SDK/prefix/argument
checks, twenty bounded and twenty-three legacy pairs, complete cold replay
and immutable installation under `isol`. The separate physical request uses
`isol-no-shared`, four tiny pairs then twelve complete report pairs and
independent cold reproduction. HP uses high priority and CPUs 8–17; SCAN
uses normal priority and CPUs 10–17. Slot/process/memory/disk checks precede
work. These requests wait for existing other-session work; no foreign job is
stopped or bypassed.

Working roots on each host:

- `~/build/codex-fullbench/libhft/quickfix-cpp-dac-qualification-20261017-v1`
- `~/build/codex-fullbench/libhft/quickfix-cpp-bounded-physical-20261017-v1`

At this checkpoint both requests remain queued; **no new native build,
physical pair or timing admission is claimed**. Read-only collectors wait for
final passing qualification before dependent files and collect only bounded
receipts/configuration/manifest metadata. Raw working output stays on its
producer host. The protected source branch retains f926 independently of
subsequent rebases and metadata/export follow-up.

## Separate compact exporter follow-up

The follow-up Python controller accepts paired `--result-root` and
`--result-provenance` only for a full report. It validates the source/kernel/
NIC/sitting facts and destination separation before runtime admission, then
captures UTC start, exact provenance and writer policy sources before the
physical run. Its new compact reader requires those original bindings and
complete independent cold admission. A run without the pre-run provenance
cannot borrow a later snapshot to acquire compact results.

Only passing cells can use the distinct
`quickfix-cpp+callback+complete-rtt` key and the common report contract.
Percentiles use the median of three runs; maxima use the actual largest raw
sample; CDFs pool all 30,000 samples and contain at most 2,000 points per kind.
The compact functional capture is exactly ten original pre-warmup cycles;
measured application capture stays zero. Diagnostics produce no result and
cannot replace a passing sitting. SDK serialized Log counts keep their
original meaning in provenance.

**396 focused Python controls pass, zero skips.** Synthetic complete reports
exercise all four flows, real original-file replay, isolated tail extrema,
pooled CDF bounds, source/provenance/raw corruption refusal, strict boolean
grades, producer pre-job refusal and preservation of existing passing files
after a failed-rate sitting. These are controller/format controls, not actual
SDK, physical, latency or release evidence. The sealed f926 jobs retain their
own source and do not use this later exporter or pre-run metadata interface.
Native qualification, physical outcomes, compact conversion and matched
comparison remain separate required gates.

## SCAN frozen native qualification and installation pass

The complete f926 capsule now passes actual SCAN qualification on CPUs 10–17
under its normal-priority `isol` lease. **2,534 portable controls plus 272
subtests pass** (JUnit 2,806), zero failures/errors/skips; two SDK-source
guards remain explicitly deselected. All four fresh consumer products link
with the original GCC 15/SDK inventory. The added native argument executable
passes **69 checks, zero skips**, and the original SDK prefix executable
passes twelve checks.

All twenty bounded TCP pairs and twenty-three legacy pairs pass through the
same newly built driver. They retain 240/312 primary and delay samples and
500/1,100 original captured application frames per peer respectively. The
independent 43-case cold reader reproduces every original decision and refuses
76 altered copies; the public twenty-case reader refuses all 84 controls.
These TCP cases use the flag interface; the installed nine-argument namespace
execution is still pending its four actual tiny pairs. Source and original
SDK source/library bytes/modes remain unchanged.

The thirteen indexed bounded review payloads match their exact sizes and
SHA-256 values. Final qualification receipt SHA-256:
`5604642970883d441027d0e311fba2a662e2f93e2ce27a5e11395d9cdf3eb3c4`.
Saved source-inventory file SHA-256:
`098098a03c5e719b57d0e40506addcf3d7f51f514e4cdee881d3fd880e6d8e74`.
Public cold receipt SHA-256:
`bf178982a88ae538d471b0ea4f2e84adec35d55d19019269628d879b9cf67d0d`.
The complete 43-case cold receipt remains
`14e4a37c8900e588ae49381e221354418022e1a1fa78bbf4713271f5397d2171`.

The existing registered installer admits the exact root-owned generation
`5d5b5f858eff51d9a5e90395faf3a1bfb0508fb1844405e7c19436ee983b0fdd`;
all helper/app/dictionary/provenance hashes, sizes and modes pass. Its quiet
physical request queues behind other-session work. HP's high-priority fresh
qualification remains queued behind the Stage 2 owner's existing isolated
lease. This supersedes the earlier pending-SCAN functional/preparation status;
there is still no new physical or timing admission.

## Standalone exporter controls and native parser verification

The later complete source export at
`70d28ca70eecf06d10780bbe50c00e0d16830528` has **960 actual files** (955
selected source files plus five template outputs) with zero closure, link or
scrub findings. Sorted byte/mode inventory SHA-256:
`f105badbbc39898eb6ff0f4d1b1d157ffdaea2b646b53424c529a89df86bd751`.
The actual stripped archive independently passes all **396 focused controls,
zero skips**, with deployment overrides and the enclosing source path removed.
This is the focused controller/format scope; the complete follow-up archive
verification and public release are separate gates.

The plain C++17 argument test also builds locally with warnings treated as
errors and passes all 69 checks without an SDK or skips. The single small
compile takes 0.59 seconds with 123,772 KiB maximum RSS after process/memory
inspection; it is distinct from SCAN's actual SDK-linked qualification.
All **84 C++ source/header files** in the frozen f926 export remain byte/mode
identical in this later checkpoint. The exporter follow-up changes Python
metadata/conversion and documentation, with no native clock, SDK or protocol
change. Frozen jobs keep f926 and their own cold reader. They cannot borrow
the later compact interface's required pre-run provenance.

## SCAN physical campaign completes without timing admission

The exact f926 generation above completes all four tiny and twelve report
pairs on SCAN's mlx5 DAC under its quiet lease. All 32 process exits are zero;
every original Logon/body, ten-cycle prefix, full measured owner/folds/live
count, admin, fixed namespace/user/CPU and physical NIC-counter gate passes.
This is actual execution of the installed nine-argument interface, distinct
from the earlier flag-interface qualification.

The complete report retains 30,000 primary and 30,000 scheduler-delay samples
per flow. All four remain **S5 diag**:

| Flow | Achieved /s, min–max | Retained blockers |
|---|---:|---|
| `nos_er` | 5,445.497–5,485.526 | rate |
| `md` | 3,855.978–3,870.257 | rate, scheduler delay |
| `md_nos_er` | 2,170.426–2,201.126 | rate, scheduler delay |
| `tick_to_trade` | 5,379.820–5,475.574 | rate, scheduler delay |

Both independent cold replays pass: four tiny cases / 80 primary and delay
samples, and twelve report cases / 120,000 primary and 120,000 delay samples.
Only 100/300 original application frames per peer are captured across the
tiny/report matrices respectively; live counts cover every prefix, warmup and
measured cycle. Raw quantiles/extrema and all failed promotion decisions
reproduce exactly, with unchanged source and original output bytes/modes.

Seven bounded physical review payloads match their sizes and SHA-256 values.
Complete report cold receipt SHA-256:
`b13eafa82a8f5b157a2ee72668cdddd5e65c85ba635d7c94951c52537c13d0f2`.
Tiny cold receipt SHA-256:
`2fefe8082154537e5e9516d7b16705e0b98c4441eb9506406f30a039b9f94797`.
Final campaign receipt SHA-256:
`38472ef11f34026f1ffe5d328cedb6c2b54ccd23fd19287ec4383f04f78bba16`.

The original working root stays on SCAN; no raw output is imported. This
sealed producer precedes pre-run compact provenance support. It cannot borrow
the later writer's metadata; no compact cell is produced or replaced, and no
QuickFIX-family matched comparison is admitted. These failed timings are
retained without an unchanged rerun.

## HP setup failure and corrected Python environment

HP's f926 request reaches the portable suite, retaining **2,528 passes and
six setup failures**, zero skips and two explicit SDK-source deselections.
Its default Python 3.9 lacks `unittest.TestCase.enterContext` (five shared
Stage 2 lifecycle cases) and `tomllib` (one generated-recipe case). It stops
before any native consumer build, immutable installation or physical pair.
The original failed root and receipt remain separate; no test is excluded and
no SDK or shared Stage 2 source is patched to hide this failure.

The already installed Python 3.11.13 supplies both standard-library APIs.
A user-owned cache environment at
`~/.cache/libhft/toolchains/python311-fullbench-20261017` installs the exact
observed SCAN package versions: pytest 9.1.1, packaging 26.3, pluggy 1.6.0,
iniconfig 2.3.0 and Pygments 2.21.0. Wheel hashes and installation metadata are
retained there. Setup uses a high-priority shared CPU lease on CPUs 0–7,
without sudo or changes to system Python. New comprehensive qualification
uses that interpreter and its child-command PATH.

The subsequent candidate at `114f9113f8334fd77459909436f0eb2c9164139d`
uses the original public SDK `getGroupRef` through const references to remove
harness-created copies of parsed request/book groups. Required fields, folds,
wire checks, SDK inputs and clock spans stay intact. Its actual SDK fixture
adds 660 before/after message-serialization immutability checks, while older
saved vectors retain their original scope. All 401 focused Python controls
pass with zero skips; these are not new native or timing admission.

Fresh full native qualification of this candidate is queued on both hosts
under shared CPU budgets, at high priority on HP. It does not automatically
rerun the unchanged failed socket-mode timing. This supersedes the pending
HP-f926 and SCAN-physical statuses; all original failed/diagnostic evidence
remains retained. Native candidate proof and any new runtime experiment must
pass independently before another physical report or compact result.

## Group-reference qualification completes on both hosts — 2026-10-18

The exact protected `114f9113f8334fd77459909436f0eb2c9164139d` candidate
passes on both hosts. Each standalone archive runs 2,552 portable controls
plus 272 subtests, with zero failures, errors or skips and two explicit
SDK-source deselections. Four fresh native consumers pass: 69 argument
checks, twelve SDK prefix vectors, 660 parsed-message immutability checks,
twenty bounded and twenty-three legacy TCP pairs. Independent cold replay
reproduces all 43 pairs and refuses 76 altered copies; the public bounded
reader reproduces twenty pairs and refuses 84. Full original source/SDK
bytes and modes remain unchanged.

Thirteen bounded metadata payloads per host have their exact sizes and
SHA-256 values reviewed locally; no raw output is downloaded. HP receipt:
`f3530947fdf2dfd005620ff8145fdf82eaf17367bd429cb1d68f38aef3ab98a6`.
SCAN receipt:
`061f75bf81f793667832716af0ef01e341aa85ee1ea34ad43d5f24cd363c1675`.
Their source inventory matches, SHA-256
`bc2eb75793b6d86a563c54f99a1fb565762d57f3062d81cf1b1fa7a245d7fd2e`.
These are functional qualifications, without new socket-mode timing runs.

A subsequent consumer configuration selects the original public SDK
`ThreadedSocketAcceptor` and `ThreadedSocketInitiator` through an explicit
compile flag. Both peers declare the actual I/O implementation; pair and
cold checks can require it, and compact results bind pre-run identity to
every observed role/repetition. Threaded results have their own flavour key.
The SDK, clocks, required fields, extraction and ten-cycle capture budget
retain their existing contract. Native qualification of both configurations
and a separately reserved threaded physical run remain pending. No timing,
compact or matched-comparison admission follows from this code change.