# QuickFIX/J callback clocks and bounded preflight — 2026-10-17

The canonical public QuickFIX/J driver now declares the separate engine
`quickfixj-callback-canonical`. Its server tick ends at the first operation
in `Application.fromApp`, using `System.nanoTime`, before original-wire
binding, application checks or extraction. The prepared start remains after
SDK serialization and before the public responder hands the same String
to the transport. Request/reply starts before logical message construction
and ends after final SDK field extraction, checks and owner folding.
The original `quickfixj-canonical` predecoder policy remains available for
its historical frozen results. No SDK source or JAR changes are made.

Ten independent functional cycles now precede the entire configured warmup
and measured profile. Each direction closes its capture stream after its
tenth complete cycle; mixed traffic captures twenty frames per direction.
Before warmup, both streams must be closed and the actual sample owner's
typed sink/fold count must match the independent canonical vector. Phase
markers restart separately for preflight, warmup and measurement. Original
transport counters, public callback binding, administration, complete raw
primary/delay samples and all original field/group checks remain required.
Every prepared tick must match its completed production write exactly.

The callback binding retains only a bounded set of undispatched original
frames in memory. Measured application bodies are never written to disk.
Observations declare the actual JVM collector, heap and existing placement
profile, along with preflight grade, callback counts, prepared/completed
frame counts and explicit clocks. The fixed new Python policy refuses full
capture, missing or substituted counters, another store/dictionary mode and
incomplete RTT boundaries. Existing shared build/clock helper APIs are used
unchanged.

## Bounded local verification

Against the unchanged original QuickFIX/J 2.3.1 SDK, the nine-class Java
build passes **567 checks, zero skips** (compiler/test heaps 128/64 MiB).
The tests exercise the public MINA observer/filter/write-future seams across
all four flows, both roles and zero/nonzero warmup. Closed capture bytes
remain identical through all subsequent warmup/measured work. Early grading,
early measurement, bad owner vectors, duplicate/unmatched callback bindings
and substituted completed tick frames are refused. Fixtures use
`TestTempFiles` and are removed at JVM exit.

The actual QuickFIX/J `fromApp` tick owner additionally executes its ten
canonical preflight orders. For the first measured callback, an injected
five-millisecond delay between original transport arrival and callback entry
must be included, while another five-millisecond delay in original-wire
binding after entry must be excluded. This distinguishes the required
callback boundary from the earlier predecoder boundary.

**871 focused Python controls pass, zero skips**, including the new policy
and complete existing bounded-preflight refusal matrix. The first local
test helper emitted an extra frame delimiter; the actual SDK correctly
refused it. That failed output remains in the session build root; correcting
the helper adds no production exception or relaxed gate.

Pinned public runtime products include core SHA-256
`d063713127ae8fe86989065d183d1b0db43b5aa0d41c377770020681ea3a4593`,
FIX 4.4 classes
`235bd33802e2cad6a573a88f964c9601b7143cfcd024217fb3b4e1d154b9f14e`
and MINA
`974518e8388a973682323388f35b9a3ccf567d958addde837de1e69b74602952`.
Fresh exported builds, twelve actual session pairs per host, independent
cold refusals and physical timing remain required. This local checkpoint
supplies no Stage 5 or current QuickFIX-family anchor admission.

## Frozen exported qualification queued

Source `cf43a31f8bc8cdebdecf4a2460d1d4c05b1e62f1` exports 938 benchmark
files with zero closure, documentation-link or scrub findings. Inventory
SHA-256 is `84dd9cef263fe83d0b33477f01afc360c7b7212d9f65da37ccc237a9a32018ed`.
Both hosts queue the complete portable control suite, an independent SDK
consumer build, all 567 Java checks and twelve actual four-flow pairs
(zero warmup, nonzero warmup and a repeat), followed by 46 cold corruption
refusals against copies of the actual output. Both original output and
source inventories must remain exact. High-priority HP and normal-priority
SCAN jobs use their outer `isol` leases and snapshot slot/process/memory/disk
status before heavy work.

The actual sessions declare a 512 MiB Epsilon heap and inherited endpoint
CPU budgets, with normal public dictionary parsing and memory stores.
These functional jobs request no timing or physical report admission.
Their immutable source/product capsule is
`~/.cache/libhft/fullbench-quickfixj-callback-preflight-20261017-v1`, and
working output is
`~/build/codex-fullbench/libhft/quickfixj-callback-preflight-qualification-20261017-v1`.
Bounded read-only collectors retain final receipts and log tails locally;
raw application captures and sample arrays stay on the producing hosts.

## Qualification runner refusal and immutable production builder

The first HP exported portable run preserves **2,281 passing controls and
49 failures**, with two explicit SDK-source deselections. All failures use
the absent configured build root. This is a runner setup failure before
compilation/session execution; no functional or timing grade is inferred.
The original receipt, JUnit and logs remain intact. The corrected v2 runner
creates its build/class directories and uses the same 938-file source and
SDK inventory. Both hosts queue that replacement. The unstarted SCAN v1
reservation is explicitly dequeued before capsule creation. Other sessions'
jobs remain untouched.

The production builder independently pins all five original JARs and the
original FIX 4.4 dictionary, rejects changed/missing/symlinked inputs, and
builds the seven production sources separately from two test sources. Its
local bounded build passes all **567 Java checks, zero skips**; inspection
confirms neither test class enters the production JAR. It retains complete
source, SDK, wrapper and compiled-product hashes and actual commands.
Production launch uses the shipped dictionary; the explicit functional
checker argument must name that same dictionary. No endpoint property is
invented: this class has a fixed callback endpoint.

Compact output now has the distinct flavour `quickfixj+callback+complete-rtt`
with explicit collector/compilation/placement suffixes. The writer requires
actual JVM arguments, observed public MINA binding, memory store, parsing
dictionary, callback/prepared/completed counts and complete RTT clocks.
The normal immutable-generation reader accepts only the new callback
identity; its separately captured fixed policy must equal the independent
reader's source before replay. The generic root entry already accepts
hash-bound normal-user generations, so these changes require no sudo-rule
extension or replacement of the root helper.

All **252 focused portable checks pass, zero skips**, including corrupted
SDK products, an external dictionary, altered runtime profiles, shortened
RTT clocks and generation identity. Shared Stage 2 build/clock APIs stay
unchanged. A fresh standalone export and actual production-wrapper session
qualification remain required before physical preparation/timing.

## Production export and dependent physical campaign queued

Source `686932eeee636e0fe89f8eec9dd9ff413b1e3e82` exports **940 files**,
with zero closure, link or scrub findings. Full inventory SHA-256 is
`02925843b06a8959488e7545eab68208865c6384233622fd5426fec970e21f14`.
Verification is deferred to the queued host jobs, never inferred from the
export checks. The unstarted v2 runner reservations are superseded before
capsule creation by this complete production qualification; their queue
logs remain. The failed original v1 HP portable attempt remains unchanged.

The new jobs use the exported production builder, all 567 compiled checks
and twelve actual SDK pairs under the split/Epsilon profile. Each pair is
independently replayed; both endpoints must also pass the compact writer's
actual JVM/runtime check (24 observations). All 46 cold corruptions must
be refused. Complete source, SDK, compiled-product and original output
inventories must remain identical. This qualifies the same wrapper, JARs
and dictionary later installed for DAC work, with no diagnostic JVM flags.

Both host continuations wait for that exact successful receipt before
requesting installation and host provenance under `isol`. They then queue
the separate `isol-no-shared` tiny/report campaign (sixteen physical pairs)
and independent complete cold replay. The installed normal-user generations
retain exact hashes and the existing fixed namespace/CPU entry. HP requests
high priority; SCAN requests normal priority. Current other-session leases
and queue order are respected. Passing compact cells, if any, stay outside
Git for review; a failed run cannot replace a good result. No timing result
has been admitted at this scheduling checkpoint.

Persistent capsule:
`~/.cache/libhft/fullbench-quickfixj-production-20261017-v1`.
Qualification/physical outputs:
`~/build/codex-fullbench/libhft/quickfixj-production-{qualification,physical}-20261017-v1`.
Session scratch keeps the bounded read-only collectors, dependency
controller and exact source-pinned private campaign scripts. No new raw
benchmark capture or sample array is downloaded or committed.

## Original production outcomes and transport read-ahead correction

SCAN passes all **2,447 exported portable controls**, zero failures/skips and
two explicit SDK-source deselections, all 567 original Java checks, twelve
actual SDK pairs, 24 strict runtime observations and 46 cold refusals. The
complete source, SDK, compiled-product and original session inventories stay
unchanged. This establishes the original split/Epsilon functional scope only.
The registered normal-user generation installs successfully. All four tiny
physical pairs complete and independently replay; mixed retains a tiny rate
failure. The report's NOS, MD and tick runs complete 30,000 samples each but
fail rate and scheduler-delay gates. Mixed has three failed process pairs:
two Epsilon server heap exhaustions and one preflight transport race. No
compact cell or full report cold admission is produced. Original manifests,
process exits, log hashes and installed generation remain intact.

HP's original production worker creates its output directory, then refuses
to reuse the earlier temporary-directory name before any test or compiler
starts. Its earlier network interruption also stops the waiting local
continuation. Neither event supplies a functional or timing grade. Fresh
qualified work uses new output and temporary directories; original outputs
are not reset or overwritten.

The actual mixed failure exposes asynchronous MINA read-ahead: after the
tenth completed exchange, the IO observer can receive the peer's next frame
before the application's wait for its own final write completion returns.
The old equality check incorrectly treated that queued original frame as
completed warmup application work. A deterministic public MINA seam test
reproduces the exact refusal against the unchanged production code.

The correction retains exactly ten closed captures and now requires exactly
the preflight semantic-callback and prepared-send counts, with exactly the
completed outgoing prefix. Original incoming counters may include the queued
frame; subsequent callback binding still consumes that original exactly
once. Application warmup callbacks dispatched before grading are explicitly
refused. No count, sink, frame binding, field/group, clock or measured-capture
requirement is removed. All 32 new combinations cover four flows, two roles,
zero/nonzero warmup and queued/dispatched look-ahead. Original capture bytes
remain identical. The corrected builder passes **647 Java checks, zero skips**;
all **252 focused Python controls** pass unchanged. The failed reproduction
and passing build stay separate in the session build root.

A fresh campaign selects the existing explicit default GC / 128 MiB heap /
split placement profile, whose distinct compact flavour omits `+epsilon-gc`.
This avoids treating a no-GC heap exhaustion as a valid timing result; the
failed Epsilon experiment remains separately recorded. The SDK JARs, parsing
dictionary, memory store, complete profile and all report gates are unchanged.
Actual qualification and fresh physical collection remain required.

## Corrected default-GC source frozen and HP dependency refusal retained

The new source `2e564f0e819379d0a66afa7f2191d00af67c92a4` exports 940 files
with zero closure, link or scrub findings. Inventory SHA-256 is
`b4e45a0bfd672eee8b064dac5cf224fceb6cc738e2527338c6b4d6cf852d86db`.
Both hosts queue the default-GC / split production qualification and
dependency-gated physical campaign. The new temporary directory is unique
per execution, with an initial receipt before the first test command.

HP's first portable execution retains 2,373 passes, one failure and two
explicit SDK-source deselections. Its only failure is the documented GNU
`patch` dependency missing from PATH in the real Fix8 terminal-patch control.
No control is deselected or replaced. The installed SCAN package
`patch-2.7.6-16.el9.x86_64` passes RPM verification; its original 199,696-byte
binary SHA-256 is
`821048159f28fb3e247ceb417b8b5bcde2680ed76c6ec88205d6a936f2df99c5`.
Both hosts use glibc 2.34 and HP has all three required shared libraries.
The unchanged binary is staged only in the owning user's persistent tool
cache and executes `GNU patch 2.7.6` successfully. Its package/hash/version
provenance is retained; no system file or sudo rule changes.

The HP retry preserves the failed root and reruns the whole suite and all
actual production qualification under a new root, prepending only that
verified tool directory. It retains the same source, SDK and profile pins.
Its high-priority dependency controller waits for the successful retry
receipt before requesting physical preparation/timing; the original SCAN
source qualification remains under its normal queue. Physical report
admission remains pending.

## Corrected HP default-GC functional and installation gates pass

The HP retry passes all **2,374 portable controls**, with zero failures,
errors or skips and the same two explicit SDK-source deselections. Its
actual default-GC production builder passes **647 Java checks**, followed
by twelve real four-flow pairs (zero/nonzero warmup and repeat), 24 strict
actual runtime observations and all 46 independent cold corruptions refused.
Source, SDK, compiled-product and original output inventories stay unchanged.
The exact variant is `quickfixj+callback+complete-rtt+split`: default GC,
128 MiB heap, memory store and the original parsing dictionary. There are
no diagnostic JVM arguments or SDK source/JAR patches.

The final exact functional receipt SHA-256 is
`190916bc9f15d8514782c4b7d89746da18ee962b4aa14e0deefe0f1c4f35b379`.
It explicitly records the package-backed GNU patch path/version/hash used
by the portable control. Both the original missing-tool failure and this
passing retry remain separate.

The existing normal-user root installer accepts the exact qualified product.
Both endpoint host/NIC/namespace/CPU probes pass and source inventory remains
unchanged after installation. HP's full tiny/report campaign queues with
high priority under `isol-no-shared`, waiting for the existing other-session
shared conformance lease. SCAN's same-source default-GC qualification stays
queued behind its existing isolated build. No new default-GC timing metric
or compact cell is admitted at this checkpoint.

## Corrected default-GC qualification passes on SCAN too

SCAN now passes the same frozen production qualification: 2,374 portable
controls plus 73 subtests (JUnit 2447 tests), zero failures/errors/skips and
two explicit SDK-source deselections; all 647 compiled Java checks; twelve
actual SDK pairs; 24 strict runtime observations; and all 46 cold corruptions
refused. The exact default-GC/split variant and the complete source, SDK,
compiled-product and original output byte/mode inventories remain unchanged.
Its exact final functional receipt SHA-256 is
`3f087d9f29274ecc983583ddc4d6a1f62300e259750c751a05265ea53a8b0267`.

The source/product qualifier is therefore complete on both accepted hosts.
SCAN's normal-priority installation/provenance step queues behind another
session's already queued quiet A/B campaign. Its quiet physical request
follows only successful installation. HP's installed generation waits under
its high-priority quiet timing request. Neither pending report supplies a
Stage 5 timing or compact-cell admission. Both original failed Epsilon and
setup attempts remain separate and unchanged.


## Corrected default-GC SCAN physical campaign completes

The installed generation
`a4739864725b57f24ca04aae001394e5226a4616238b2c4bae451d94f9669df8`
completes four tiny and twelve report pairs under the normal-priority quiet
lease on SCAN's physical mlx5 DAC. Its exact source remains `2e564f0e8193`
with the 940-file inventory above. Both processes execute as the benchmark
user in the fixed namespaces/CPU budgets; every exit, original Logon/body,
owner, callback/prepared/completed frame, administration and physical wire
counter gate passes. Mixed now completes all three runs without the earlier
Epsilon exhaustion or preflight read-ahead failure.

Each report flow retains **30,000 primary and scheduler-delay samples**:
1,000 warmup cycles and 10,000 measured cycles per run, three runs, target
10,000/s. Actual timing gates remain diagnostic:

| Flow | Achieved /s, min–max | Retained blockers |
|---|---:|---|
| `nos_er` | 2,041.360–2,089.247 | rate, percentile stability, scheduler delay |
| `md` | 1,842.202–1,907.995 | rate, scheduler delay |
| `md_nos_er` | 1,103.811–1,171.106 | rate, scheduler delay |
| `tick_to_trade` | 2,100.975–2,208.405 | rate, scheduler delay |

Both independent cold readers pass. The tiny replay retains 80 primary/delay
samples and 350 application frames per peer. The complete report replay
retains **120,000 primary and 120,000 delay samples**, 330,300 application
frames per peer, exact raw quantiles/extrema and exactly reproduced promotion
decisions. Original output bytes/modes and the frozen source inventory remain
unchanged. Captures contain only the ten graded cycles before warmup; no
measured application body is written to disk.

No flow earns report admission, no compact result is written, and no
existing passing key is replaced. The full working output stays on SCAN at
`~/build/codex-fullbench/libhft/quickfixj-default-gc-physical-20261017-v1`;
only bounded original receipts/manifest metadata are collected for review.
Report cold-receipt SHA-256:
`2b62951aec6083ac9d3d5452d1d144f76e00fe1698a2e8e92314c69cb20540a1`.
Tiny cold-receipt SHA-256:
`bf027dfe77057d0bcc357d974159acd40210de690bd2556af43d6aee4dec4248`.

This supersedes the pending-SCAN physical status above while preserving its
original failed attempts. HP's matching corrected default-GC physical job
remains queued at high priority behind another session's shared conformance
lease. No complete QuickFIX/J comparison or new timing ratio is inferred.

## Corrected default-GC HP physical campaign completes

HP now completes all four tiny and twelve report pairs on its physical
Solarflare DAC under the queued high-priority quiet lease. Its generation is
`0e53e32e03982e704e5a54d04b3c7e28979955d7432b860ccdf3582059f3b6de`;
the frozen source remains `2e564f0e819379d0a66afa7f2191d00af67c92a4`,
940 inventoried files, default GC/split placement. All 32 physical process
exits are zero. Every original Logon/body, owner, callback/prepared/completed
frame, administration, fixed namespace/user/CPU and physical counter gate
passes. All mixed runs complete without the earlier Epsilon or preflight
race failure.

Every full flow retains 30,000 primary and 30,000 scheduler-delay samples.
All four remain **S5 diag**, each failing the achieved-rate and scheduler-delay
gates; none fails percentile stability:

| Flow | Achieved /s, min–max | Scheduler-delay p99, min–max ms |
|---|---:|---:|
| `nos_er` | 2,917.932–3,060.349 | 5.205–5.616 |
| `md` | 2,613.628–2,667.064 | 4.931–5.013 |
| `md_nos_er` | 1,652.707–1,706.950 | 7.617–8.360 |
| `tick_to_trade` | 2,978.559–3,046.673 | 4.983–5.738 |

The tiny independent replay passes four cases / 80 primary and delay
samples. The full replay passes twelve cases / 120,000 primary and 120,000
delay samples, with 330,300 live application frames per peer, exact raw
quantiles/extrema and exactly reproduced failed promotion decisions. Captures
stay bounded to the ten cycles before full warmup; live frame counters are
not additional disk capture. Original output bytes/modes and the source
inventory remain unchanged.

Report cold-receipt SHA-256:
`cd928f783f6e97d92f8370d568b2ef1eb15091d1894c744dfa6d942e65945561`.
Tiny cold-receipt SHA-256:
`8479d7d33f1450c8809a27252b2487e314c94bfc9caa6ad7fa642872f93a112b`.
Original working output stays under
`~/build/codex-fullbench/libhft/quickfixj-default-gc-physical-20261017-v1`
on HP. Only bounded receipts/configuration/manifest metadata are collected.

This supersedes the pending-HP status. Both corrected default-GC physical
campaigns and independent cold reproductions are complete, with zero promoted
cells. Existing Java/Philadelphia passing keys remain unchanged. Whole Java
comparison admission stays blocked; no unchanged failed timing is rerun.