# QuickFIX C++ checked public SDK price precision

This is a consumer-source candidate following the
[original threaded CPU investigation](RECORD_2026-10-18_quickfix_cpp_threaded_session.md).
The 10,000/s contract, SDK, full-session clocks, canonical fields and all
physical/report gates retain their scope. It grants no timing admission.

## Implementation and exact-value guard

Canonical price fields remain public `FIX::DoubleField` objects. The helper
calls the original public `FIX::DoubleConvertor::convert(value, 5, 10)` for
finite, nonnegative values below 100,000 that exactly reconstruct from the
five-decimal integer grid. Ten significant digits cover that domain. Every
other value uses the original SDK constructor and default precision.
It never rounds an off-grid input into the domain. It changes no quantity,
group, required-value, owner-sink, wire-envelope or clock check.

The helper applies to order/report Price, AvgPx and snapshot MDEntryPx.
The SDK still converts each numeric input, stores each public typed field,
serializes each message/group and parses the received wire. No wire string
or formatted value is cached or substituted, and no SDK source is patched.

## Initial actual SDK controls

A standalone prototype compares 1,000,018 actual field strings against the
unmodified SDK constructor. Every byte matches; 1,000,011 inputs take the
checked precision path. The expanded native fixture then compares
**1,000,078** original/candidate field values and tags across the complete
domain, all three price tags, boundaries, one-ULP neighbours, off-grid values,
large values, subnormal values and nonfinite legacy inputs.

The actual native fixture passes those checks plus 48 SDK wire cycles,
twelve independent owner vectors, 43 malformed-payload refusals and 660
parsed-message immutability checks. The independent Python checker reproduces
all cold body bytes, owner sinks and folds. All **155 targeted Python
controls pass with zero skips**; older fixture output keeps its original
scope and cannot borrow the new precision marker.

These initial controls run on BEELINK2 using Ubuntu GCC 15.2.0 and the
unchanged pinned static SDK. The prototype's first attempts retain an
external-header `-Werror` failure and the distribution's default PIE link
failure. Treating SDK headers as system includes and explicitly selecting
non-PIE output matches the supplied non-PIC static SDK; no SDK or ABI shim
is introduced. The successful prototype compile takes 0.59 s / 143,900 KiB
maximum RSS. The single expanded fixture compile takes 10.44 s / 659,744 KiB.
Working inputs/output stay under the session build root, outside Git.

## Required next gates

Freeze the complete standalone source, then run fresh portable, compiler,
SDK fixture, native-argument and full socket/threaded TCP/cold qualification
on both hosts under their CPU leases, at high priority on HP. Each frozen
older job keeps its source and evidence. Only a qualified new generation
may run a fresh physical matrix for this changed numeric construction.

Both actual namespace probes, root helpers, original installed artifacts,
source inventories, ten-cycle pre-warmup capture, complete warmup/owner/raw/
admin proof, physical counters and independent cold decisions remain
required. Passing cells alone may be written. No CPU-profile percentage,
local fixture or unchanged failed matrix supplies a latency comparison.

The earlier HP threaded DAC job is still queued at high priority. The
separate lower-rate policy question has no answer at this checkpoint;
existing report jobs continue to require 10,000/s.

## Frozen qualification inputs

The standalone source pin is `b8d7eeb9fea7e4150a94b64ef0744036b97c8196`,
protected at `s/codex-fullbench-qfcpp-precision-20261018`. The actual export
contains 960 files and has zero closure, link or scrub findings. Its sorted
path/byte/mode inventory hashes to
`02ddcde7447425e3cbcc3373134f6db8b8e8cec7437eb488c793b23d9323200b`;
the transmitted source/driver/configuration capsule hashes to
`13be12dab1cc73b7549878352a04c285fad882f8909a2732103b83ac90530715`.

The original SDK source/library inventory remains
`c55deab1d03c19cc696b25757a03ce3fa649a1f1490591e6e4c45f2ac7d429d2`.
Qualification builds five fresh products: socket and threaded session drivers,
canonical fixture, prefix unit and native-generation argument unit. Each model
must independently pass twenty bounded and 23 legacy TCP pairs, the 43-pair
cold replay with 76 refusal controls, and the public bounded replay with
88 refusal controls. Both actual fixture reports must include the exact
1,000,078 precision checks and 660 read-only group checks.

Both jobs enter the shared CPU pool through `host-cpu-slot wait`, explicitly
pinned to HP 0–7 (high priority) and SCAN 0–9 (normal priority). HP uses the
cached Python 3.11 environment in both parent and child commands. Physical
continuations wait for a passing source-specific receipt, then lease isolated
CPUs to prepare and probe the registered generation. Timing requires
`isol-no-shared`; queued foreign jobs and older frozen jobs retain their place.

## Both-host native qualification completes

HP and SCAN each pass **2,571 portable tests plus 279 subtests**
(2,850 JUnit cases), zero failures, errors or skips. Two SDK-source guards
are explicitly deselected. All five fresh native products, 69 native argument
checks and twelve SDK prefix vectors pass. Each implementation separately
passes all 43 actual TCP pairs, 76 independent cold refusal controls and
88 public bounded cold refusal controls: **86 session pairs per host**.
Both socket and threaded fixture reports contain all 1,000,078 exact price/tag
checks and 660 parsed-message immutability checks.

All original SDK source, products and modes remain unchanged. Twenty-one
bounded metadata payloads per host are checked against their exact saved
lengths and hashes; both complete source inventories equal the original
960-file capsule inventory, including file modes. No raw output is imported.
The native builds use the original static SDK and GCC toolset 15.2.1
(`-std=c++17 -O2 -DNDEBUG -rdynamic`), adding only the explicit session-I/O
flag for the threaded driver. Socket and threaded binary hashes match across
hosts; that is an artifact observation, not a timing comparison.

HP qualification receipt SHA-256: `840ad4db133d1e7407317107905310bdd4c39d560a67b0a6b7f4bbeb4de1d10e`.

SCAN qualification receipt SHA-256: `8c623fc0ddd36a692afe8836297d9558896e76f44f42b11d690fe8314c00379d`.

The exact source-inventory JSON SHA-256 is
`f2c9831ffa619c38d89167473054a3a6d22c5a75266bcf0bf0b208c0fac8fa8e`.
The qualified threaded binary SHA-256 is
`6e2a13c0afe9443a8c2b43eb0dc28c35126ad7923a064ed7f9f37fb41f3218fe`.

Both source-specific DAC continuations are queued through the existing
registered helpers. SCAN completes preparation and enters its normal-priority
quiet physical matrix. HP's high-priority preparation waits behind the active
foreign isolated job, preserving the older threaded campaign's earlier queue
position. These qualification results grant no physical or report admission;
the complete 10,000/s timing and independent cold gates remain required.

## SCAN physical outcome

The changed source completes four tiny and twelve report DAC pairs under
its actual normal-priority `isol-no-shared` lease. All 32 process exits are
zero; original bilateral Logons/body bytes, ten-cycle prefix, full measured
owner/folds/live counts, raw/admin observations, fixed normal-user/CPU/namespace
identities and both physical transmit-counter gates pass. Both independent
cold replays reproduce the original decisions, raw quantiles and extrema
without changing the original evidence. The complete report retains 120,000
primary and 120,000 delay samples; the cold reader checks 300 captured
application frames per peer (330,300 live frames). Tiny output retains
80 primary/delay samples and 100 captured frames per peer.

All four flows remain **S5 diag**:

| Flow | Achieved /s, min–max | Retained blockers |
|---|---:|---|
| `nos_er` | 5,824.372–5,867.921 | rate |
| `md` | 3,913.321–3,987.068 | rate, scheduler delay |
| `md_nos_er` | 2,284.019–2,345.451 | rate, percentile stability, scheduler delay |
| `tick_to_trade` | 5,664.977–5,762.371 | rate, scheduler delay |

The compact writer executes against the pre-run provenance and writes
**zero cells**. No diagnostic row replaces an existing good key. These
separate physical runs establish no matched performance improvement over
the original threaded generation; the report gate remains unmet. The
changed numeric construction is byte-equivalent and functionally qualified,
which does not establish a latency benefit.

Twenty-three bounded metadata/log-tail payloads match their original saved
lengths and SHA-256 values. No raw application, primary or scheduler-delay
files are downloaded or imported into Git. Both original source inventories
and root-owned installed products remain unchanged. The actual pre-run
kernel is `5.14.0-687.44.1.el9_8.x86_64`, NIC identity
`pci:0x15b3:0x1015`, firmware `14.32.1912 (MT_2420110034)`.

Installed generation: `e4ee03ae6ac569941c2af03fb9966bd7a8d649c23b0daf89d7f3d08a4c0ecd4f`.

Completed receipt SHA-256: `f4965987b10ca4285210be0526823927be1df7b0a0cbf0ce25d6e7b2cd3bdf1d`.

Prepared receipt SHA-256: `540666437b79bd26342c7342b2c3ee9da9f5d71684c11ec26d364ce8ad9657c2`.

Tiny cold receipt SHA-256: `1f5c991d19c37aa8e3439bdd4913cec713051172eee7b03add69af386ea4dfc3`.

Report cold receipt SHA-256: `ae905151ea6a7cde00b385570cc685c86791ab795f3f777477758948ae07de89`.

The original physical working output stays on SCAN under
`~/build/codex-fullbench/libhft/quickfix-cpp-precision-physical-20261018-v1`;
local bounded review metadata stays under the matching
`qfcpp-precision-review-20261018-v1/scan/physical` build directory. HP's
source-specific high-priority isolated preparation remains queued, after
the earlier frozen HP threaded job. No unchanged SCAN timing is repeated.
The full plan, wider roster and matched language/anchor gates remain open;
the existing 10,000/s contract remains in force.

## HP checked-precision physical outcome

The separate frozen source `b8d7eeb9fea7e4150a94b64ef0744036b97c8196`
completes HP's four tiny and twelve report DAC pairs under its own actual
**high-priority `isol-no-shared` lease**, after the original threaded
generation finishes. All 32 process exits are zero; original bilateral
Logons/body bytes, ten-cycle pre-warmup capture, full measured owner/folds/
live counts, raw/admin, fixed normal-user/CPU/namespace identities and
both physical transmit counters pass. Both independent cold readers
reproduce every decision, quantile and extremum with original bytes/modes
unchanged. The report retains 120,000 primary and 120,000 delay samples,
300 captured application frames per peer and 330,300 live frames; tiny
output retains 80 primary/delay samples and 100 captured frames per peer.

All four flows remain **S5 diag**:

| Flow | Achieved /s, min–max | Retained blockers |
|---|---:|---|
| `nos_er` | 6,999.804–7,003.833 | rate |
| `md` | 5,273.269–5,290.295 | rate |
| `md_nos_er` | 3,390.837–3,398.907 | rate, scheduler delay |
| `tick_to_trade` | 7,013.813–7,046.001 | rate, scheduler delay |

MD passes its delay gate in this run while retaining the rate failure.
The source/provenance-bound compact writer executes and writes **zero cells**.
All good keys are preserved. Twenty-three bounded metadata/log-tail payloads
match their saved lengths and SHA-256 values; no raw application, primary
or scheduler-delay files are downloaded or imported. Installed products
and both namespace probes match their pinned identities. The pre-run kernel
is `5.14.0-687.44.1.el9_8.x86_64`, NIC identity `pci:0x1924:0x0a03`, firmware
`6.4.2.1020 rx1 tx1`.

Installed generation: `20b240aec43d6ade1bad4c1f8e204e6aafb28c8848fb9ec0a486c95bced3d781`.

Completed receipt SHA-256: `632a9685474fc4f3f0ccd9d190c9cea124becb4fe2fede1cd2858a7491e6110e`.

Prepared receipt SHA-256: `5da9444ffb75d80bf4c96b4e1418bba308fdd7cd4ddff2ef3ae484d3a1edb1ee`.

Tiny cold receipt SHA-256: `d219e65c5676326c031f03839716fad8b435a95ab49524e77dad3bd68d706a96`.

Report cold receipt SHA-256: `09f27ac4dbd0cd4b76aea2131aa73e29cf990ca8e97962909f5c406847d1de36`.

The actual working output remains on HP under
`~/build/codex-fullbench/libhft/quickfix-cpp-precision-physical-20261018-v1`;
local bounded review metadata stays under
`qfcpp-precision-review-20261018-v1/hp/physical` in the session build root.

Both original-threaded and checked-precision campaigns are now complete
on both hosts: each frozen source has its own native receipts, registered
generation, actual pre-run host facts, sixteen physical pairs and both
independent cold replays per host. **Every report flow remains diagnostic;
no compact cells or matched timing comparison are admitted.** The numeric
construction has exact-byte and full-session functional proof, but these
runs establish no performance improvement or report-grade promotion.
No unchanged failed matrix is repeated. The full plan remains incomplete,
including the QuickFIX-family and Java/.NET comparison gates, wider roster
and separately coordinated publication/layout work. The unanswered lower-rate
policy question does not change the existing 10,000/s contract.