# Actual canonical QuickFIX/n production-session functional qualification

The [cold original-SDK fixture](RECORD_2026-10-17_quickfix_n_canonical_fixture.md)
now has a separate actual two-process TCP session mode. **All 24 functional
pairs and 240 independent artifact-corruption controls pass** across HP and
SCAN, without skips. This closes canonical SDK/session functional capability;
there is no measurement clock, delay/raw sample stream, rate/stability grade,
physical admission or current .NET peer comparison in this profile.

## Public production API and retained setup failure

The public acceptor constructor creates the actual SDK Session without starting
its threaded transport. A public AbstractInitiator subclass creates the actual
initiator Session and leaves I/O to its supported foreground extension points;
its temporary start thread returns. No internal SessionFactory, reflection into
the SDK or custom FIX session implementation is used. Public IResponder sends
fully serialized SDK frames through the socket; public Parser frames complete
received bytes before Session.Next performs SDK parsing, dictionary/sequence
validation and IApplication callbacks. The SDK owns Logon, headers, sequence,
serialization and bilateral Logout. Callback exceptions are retained as fatal
application failures instead of being silently swallowed by SDK error handling.

The original v1 fails before listening on both hosts: NonStopSession conflicts
with explicit StartTime/EndTime. Those original failed roots/logs remain. The
corrected v2 keeps NonStopSession and removes the incompatible daily times.
It builds fresh products and passes all pairs; no unchanged failed session or
timing run is repeated. Exact SDK binaries/dictionary stay unmodified. The
public session dictionary applies only the already qualified D tag-60 required
flag relaxation; all other header/body/group validation stays active. A memory
store and `PersistMessages=N` are explicit. No LibHFT engine is loaded.

## Actual two-host qualification

Each host builds the complete 916-file stripped source with no enclosing Git,
engine or private tree. SDK 10.0.112 / runtime .NET 10.0.12, two MSBuild jobs and
no build server/shared compilation produce zero warnings/errors. Existing
root-owned pinned SDK artifacts are referenced explicitly; their code is not
rebuilt. A missing foreign SDK still fails its artifact guard, and no library
engine source is required. Shared microbench APIs and all other SDK checks stay
unchanged. HP uses high-priority `isol`, SCAN normal `isol`, after checking
slots/processes and free disk. Outputs stay under the session build root.

Each host executes three repeats of all four flows, twelve cycles per pair,
on two actual processes through alternate loopback 127.0.0.2. Both SDK roles
honour their declared endpoints. HP masks are server 8–12/client 13–17; SCAN
10–13/14–17. Every actual foreground mask matches its full declared budget.
There are no isolated-first-CPU or timing claims for this fixture.

Every pair proves exactly one actual SDK Logon/Logout callback per endpoint,
all SDK incoming/ToApp callbacks equal actual application frames, complete
twelve-cycle owner sink/folds and exact bilateral administration. Root SDK,
factory, dictionary/dependency and driver bytes remain bound to the original
qualification manifest and unchanged. Every original Logon has EncryptMethod 0
and HeartBtInt 30. No resend, reject, duplicate or unobserved application frame
can satisfy the checks. .NET 10 runtime and the actual SDK core match on both
roles; a library engine/decoder cannot supply the peer's work.

Only the first ten unmeasured functional cycles are captured, then each stream
closes. The final two cycles use complete actual callback/count/owner proof.
NOS/MD/tick retain 20 original application frames per peer per pair; mixed
retains 40. Per host, this is 300 original captured frames per peer and 360
actual application frames per peer. Across both hosts, 600 captured and 720
actual application frames per peer are independently accounted for. All four
complete owner vectors match the canonical model through the twelfth cycle.

The rebuilt cold modes also pass all 120 original SDK frame/body and four typed
owner vectors per host, including exact independent checksum/length/header/body
proof. These unmeasured SDK vectors remain separate from actual TCP captures.

## Independent cold reader and corruption proof

A separately exported public reader replays all twelve actual pairs per host
without a new compile, SDK execution or socket. It checks source artifact
bytes/modes, exact original bilateral frames, every canonical body/value/order,
all twenty MD entries, complete owner and callback counts, exact original
Logons/Logout sequence, .NET runtime/core SDK identity and declared CPU budgets.
It consumes the caller's pinned core identity; full SDK/factory/dictionary/
dependency/target binding additionally comes from the consuming build manifest.
Functional replay alone cannot establish release or timing admission.

Ten independent controls per pair refuse a raw-peer provider substitution,
changed CPU budget, false owner sink, incomplete callback count, SDK/runtime
substitution, relaxed required OrdType, measured capture and borrowed timing.
The final control changes an original order price or deepest book price on
both corresponding peers and repairs BodyLength/checksum. Thus bilateral byte
equality and valid FIX framing cannot substitute for canonical semantic proof.
All **240 controls** pass; every original artifact and source byte/mode stays
unchanged. Temporary Python corruption copies are removed at exit. There is
no new source capture/archive or raw evidence import into Git.

## Immutable inputs and next work

- Qualified session source: `2dbd36ec37e9a60bd7c3c43c4077131f9c42628d`.
- Session source inventory SHA-256: `8a43f8a9eade45b0d871665aba9798301df27baaf556a7147773ff8c5f73cef8`.
- Qualified driver DLL, identical on both hosts: `448bd4b14bf0197547d954e912e5b4b9ea3bf63234572e0822a8bda3ff23b793`.
- Reader source: `8d64427813895b43723a8287408f9c0a57d31a8c`.
- Reader source inventory SHA-256: `1f15bc57b645d4be2e4e5f7efbde1e9015887a6c1a2a14d528ac951ec9f3aa0a`.
- Upstream SDK source pin: `274b491d76f7755be85452dbefead08b2a6d62bd`.
- QuickFix.dll: `c5eb951904c4254f4292c7a9fc797d76c9c310294dd8896e753291a372a9b680`.
- QuickFix.FIX44.dll: `2075a0ac710cead239e357e7835ef3353c7ec12a3964e749143062b5edce20f0`.
- FIX44.xml: `a8111ec59d33053b45be975bbb7d6d1e9f2b6f4a160d832853fa0d8c627ea434`.
- Microsoft.Extensions.Logging.Abstractions.dll: `bb853130f5afaf335be7858d661f8212ec653835100f5a4e3aa2c66a4d4f685d`.
- Microsoft.Extensions.DependencyInjection.Abstractions.dll: `67fa4325000db017dc0c35829b416f024f042d24efb868bcf17a895ee6500a93`.
- provenance.json: `54ea06378f659e7e7ad53b3f270e3b6a4fb2bad7a866d6d8dfd4c5709ea9224a`.

Both exports have zero closure/scrub findings, without whole-harness release
admission. Both hosts retain:

- `~/.cache/libhft/fullbench-quickfix-n-canonical-session-20261017-v{1,2}`
- `~/build/codex-fullbench/libhft/quickfix-n-canonical-session-20261017-v{1,2}`
- `~/.cache/libhft/fullbench-quickfix-n-canonical-replay-20261017-v1`
- `~/build/codex-fullbench/libhft/quickfix-n-canonical-replay-20261017-v1`

Only this summary enters Git/website records. Full measurement boundary and
scheduler-delay proof, phase/owner reset across warmup, SDK/callback controls,
physical matrices and rate/stability remain required. A matched .NET 10 LibHFT
configuration also needs its own source/runtime identity, qualification and
collection; the existing .NET 8 first-CPU passes cannot supply that admission.
Earlier QuickFIX/n diagnostic grades and successful LibHFT results stay intact.