# TrueFix public callback clocks and bounded preflight

## Qualified inputs and clock work

The complete 897-file stripped harness at
`d19b7a3bddab59244944058f1a5caa6dcd637d0c` has inventory SHA-256
`6b2a5ba1c4aaa1fb0590be7348dadc63fb3f762be728195598a7623f8ea09b88`.
TrueFix stays clean at original SDK pin
`2e1ebb9e36caa853d7f24e14ed8bf08e3c50e92c`. No SDK source is patched.
HP builds both explicit Tokio variants with the cached SDK-required Rust
1.96.0 (`ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96`), LLVM 22.1.2 and Cargo
1.96.0 (`30a34c682`). Actual version output remains in `toolchain.json`.
The resolved Cargo lock SHA-256 is
`7672a4d7a766a07f8b5332fe8efc7b1e974f573cffdf34f6f1449e977640fd3a`.

The new producer `truefix-callback-canonical` takes its first timestamp at
public `Application::from_app` entry and retains the original independent
completed-receive timestamp. Request/reply samples finish after all final
application extraction and checks. Tick samples finish at callback entry,
before benchmark extraction and callback-to-owner channel work. Prepared
SDK send/log timing and original serialization remain unchanged.

Ten preflight cycles close each directional capture file before warmup.
Because the SDK's public send can enqueue work, the driver yields until
actual completed transport writes close both preflight files. Its final
administration window likewise stays open until both directional frame
counts reach the expected total. Neither boundary is inferred from a queued
send returning. Every later application frame and owner fold remains counted.

## Actual qualification

| Runtime | App SHA-256 |
|---|---|
| Multi-thread | `abcbb00dbeb6a58da4b5524ee6cb87b5c55d1279a640062505233e8abc7c300d` |
| Current-thread | `edffb994db41d9cd343f7abcc80f12318f71515584071ef0612e48586d9827bd` |

Both products retain the original explicit parsing dictionary SHA-256
`17c7d7936bdfdab9359dbb6e8602110a1937660bdfccdc464671e098aa18c49a`.
The fixed-entry argument shape resolves that hash-bound sidecar; other
functional pairs exercise the explicit path. SDK parsing groups stay enabled
and dictionary validation stays disabled, as declared by this method.

Each runtime passes twelve ordinary socket pairs, 101 cold corruption
refusals, twelve separate two-millisecond delay-probe pairs and 28 probe
refusals. Across both runtimes that is 48 actual pairs and 258 refusals,
with zero skips. Every ordinary/probe matrix retains 240 primary and 240
scheduler-delay samples and reproduces 1,000 application frames per peer.
The probes verify every raw owner sample against actual receive, callback
and post-extraction checkpoints and cannot acquire timing admission.
Normal runs require integer-zero probe metadata and no probe file.

The common audit and compact writer preserve actual runtime and parsing/
validation facts in distinct callback/complete-RTT keys, including a separate
`+current-thread` variant. Original shortened-clock keys stay retired. The
897-file harness and tracked SDK inventory remain unchanged after all pairs;
both generated compiler projects' five driver files match the frozen inputs
and their source receipt hashes exactly. These are functional/controller
qualifications, not Stage 5 or comparison admission.

## Preserved unsuccessful attempts

1. The first default offline build lacks the `metrics` dependency index in
   HP's system Cargo cache. Dependencies are fetched in a separate generated
   input workspace; no SDK or failed project is modified.
2. An operational output-path replacement fails to select a fresh root;
   the existing-directory guard refuses before any build or socket pair.
3. A fresh system-toolchain attempt is refused because Rust 1.92 is below
   TrueFix's declared minimum. The pre-existing cached 1.96 toolchain/cache
   is then selected explicitly.
4. The actual 1.96 compile catches obsolete `flush()` calls on the now-closed
   optional capture handles. A fresh source generation removes those calls.
5. The next default build passes, but its first actual NOS pair exposes a
   queued-send/preflight-close race. Both failed endpoint exits and their
   partial working capture stay retained. The completed-write waits above
   correct the harness without changing the SDK or body/timing contract.
6. The final frozen generation passes both complete runtime qualifications.

Original working roots on HP are
`~/build/codex-fullbench/libhft/truefix-callback-clocks-20261017-v1`,
`-v3`, `-v4`, `-v5` and `-v6`; the output-guard attempt creates no new root.
The successful capsule is
`~/.cache/libhft/fullbench-truefix-callback-clocks-20261017-v3`.
Source generations and failed logs are preserved. No raw output is copied
into Git, the archive or the website. Fresh immutable physical collection
on both rigs remains required, under quiet CPU leases and HP high priority.