# Original DFX canonical writer capability — 2026-10-19

This is an original-SDK serialization capability investigation, not a session,
latency or physical-link result. It exports zero cells. The historical DFX
diagnostic rows remain unchanged. The full-bench plan is incomplete.

## Source and independent inputs

The roster's DFX pin resolves to upstream
`546c86f788fc739d7df33707365ba64743ef546f`, tree
`e3b16be19f8ecd8f53cd8ea16b00c7709451b969`. The downloaded original archive is
443,522 bytes, SHA-256
`3319a707263f338f9bfcedcbbd4ceec39682e35c139021de38339cf8313513e9`.
All 587 regular source files match the existing source cache byte for byte,
with no extra or missing files. Its sorted content inventory is
`790107e5fe60db4c1d4f7270f53294bc870ffd75388bf31f831359f8e5a50beb`.
The original source declares MPL-2.0 in `dfx-base/Cargo.toml` and includes
`LICENCE.txt`. No SDK patch or dictionary overlay is used.

The new public Rust fixture constructs fresh SDK `Message`, `FieldMap` and
`Group` objects. Its inputs come from the existing independent
`oss/benchmarks/load/canonical_spec.py` model, including the mixed flow's
snapshot-derived order and acknowledgement. Twelve markers cover all six
price/quantity variations twice and all four flows: 120 messages total.

Each message exercises:

- `FieldMap::from_field_order(canonical_order)` and the normal
  `Message::to_string_mut()` writer;
- reversed stored order and reversed flat-field insertion, through that same
  normal writer;
- the public body-only `calculate_string(Some(canonical_order))` override as
  an explicit positive control. This override is not a production Session send.

The private cold reader checks all 240 actual frames' FIX version, unique
header fields, BodyLength, checksum, complete required values, group counters,
member order and associations. It checks all 120 explicit controls byte for
byte. A correctly ordered independent reference passes the capability checker;
valid framing with a field permutation gets a failed capability decision.
Missing, duplicate, unknown and changed evidence is refused. The focused
checker/reference suites pass **53 tests**, with no skips.

Fixture SHA-256:
`0d555ed67a71df316be97a65f39c1cbe6eb7d70950d6a33cae50cee57586df9e`.
Corrected fixed qualification worker SHA-256:
`aae898925668f957e22e93700e5508830c5c04f3c28ef295fc326e6f63b38869`.
The independently generated input SHA-256 is
`0d4e2cb3c5124e1d70ebb44883c36b23b7ce4b308d525a9031fbfdd3a127c36e`.
The public source scrub reports zero findings.

## SCAN native and cold qualification

The corrected v2 job completed under `host-cpu-slot wait --pool shared
--priority normal`, CPUs 0–9, UID/GID 1000. It compiles the original
`dfx-base` dependency with Rust/Cargo 1.92.0, release mode, `--locked`, `-j2`.
The generated project and all products are outside the repository. SDK files
are made read-only before the baseline inventory; all 587 file bytes and modes
remain unchanged across resolution, build, actual execution and ten real
refusal executions. Cargo.lock is retained separately with SHA-256
`0edfcc0e5b61d2852614be13c76bba9aeada02552edeb070b6064c7094286433`.

| Actual writer output | Frames | Canonical order | Order mismatch |
|---|---:|---:|---:|
| `D` | 72 | 0 | 72 |
| `8` | 48 | 0 | 48 |
| `V` | 48 | 22 | 26 |
| `W` | 72 | 0 | 72 |
| Total | 240 | 22 | 218 |

The stored-order mode matches 12/120 frames; reversed order/insertion matches
10/120. All 120 explicit body controls pass. All required values, complete
books and group associations pass. Every flow has a normal-writer order
failure. The partial `V` matches are observations, not a deterministic success
claim: its multiple group families iterate through the SDK's hash map.

Native receipt:
`181c5f361bdc0e91db78f3d86bd4f6ca3497914310e1bee0b7b7472e1b9e266c`.
Actual vector output:
`35bd71cf58672ff6a6773b90c70a8d9ff2bbb5deef2c34c76595fb2e3a6ee9e6`.
The 19 bounded native payloads are independently collected and hash checked
under `~/build/codex-fullbench/libhft/dfx-writer-review-20261019-v2/scan`.
They contain capability vectors and build metadata, with no timing samples.

## HP native and cold qualification

HP's corrected qualification completes at **high** priority under
`host-cpu-slot wait --pool isol`, CPUs 8–17, UID/GID 1000. The same Rust/Cargo
1.92.0, original SDK, lock file and build recipe produce the same executable
SHA-256 as SCAN:
`2cf3b9e836c8b96ff00fc8c715bf94a8df4e6f35ec081a062ae99931928a69a3`.
All 587 SDK files' bytes and modes remain unchanged. Its ten actual malformed
input executions are refused. All complete values, group associations and
120 explicit body controls pass independent cold review.

| Actual writer output | Frames | Canonical order | Order mismatch |
|---|---:|---:|---:|
| `D` | 72 | 0 | 72 |
| `8` | 48 | 0 | 48 |
| `V` | 48 | 26 | 22 |
| `W` | 72 | 0 | 72 |
| Total | 240 | 26 | 214 |

Stored order matches 11/120 and reversed order/insertion 15/120. Every flow
has an order failure. As on SCAN, these hash-map-dependent partial `V` matches
are not deterministic admission. HP native receipt:
`565696f7fa6e996b3bbd4e57126597ffa3b368a413849dff2972e3a5be61867e`.
Actual vectors:
`d8375bac3ca29f3a09f49777dfca2d5ae34f7974a5105152d2ac4a7d35438974`.
Its 19 bounded payloads are independently reviewed under the same local
review root's `hp` directory. Both corrected jobs are complete; no timing
matrix is queued for this known serialization blocker.

## Retained preparation failure

The initial v1 worker sorted `Path` components, while the pinned inventory
sorts relative path strings. SCAN correctly refused that inventory comparison
before compilation or fixture execution. Both hosts' immutable input bundles,
logs and failed statuses are retained. The v2 worker uses the reference's exact string
ordering; a local check against all 587 original cached files passes. HP's
already queued v1 job also refuses before compilation, separately from v2.
This is a qualification-worker preparation defect, not an SDK capability or
benchmark result.

## Consequence for the plan

At this upstream pin, `FieldMap::from_field_order` stores `_field_order`, but
`calculate_string(None)` uses numeric flat-field order followed by group-map
iteration. `Message::to_string_mut()` calls that default writer, and the
production `Session::send_raw` uses `Message::to_string_mut()` after its
application callback. The explicit body-order API succeeds in isolation but
does not establish a production Session serialization override.

A fresh DFX strict canonical producer therefore remains blocked at this
original public writer path. Do not bypass the engine with a custom socket
writer, relabel the explicit body control as a session pass, weaken the body
contract, or run an unchanged physical matrix to fill that gap. A supported
production customization or a separately admitted upstream source change needs
new original-SDK and full-session qualification first. Rate, owner extraction,
clocks, scheduler observations and physical evidence remain separate gates.