# Fixer-rs: canonical flows through production Sessions

## Current qualification

| Host | Real SDK Session pairs | Independent replay | Semantic refusal controls |
| --- | ---: | --- | ---: |
| HP | 6 passed | passed | 31 passed |
| SCAN | 6 passed | passed | 31 passed |

Both hosts close this configuration's functional Session and canonical owner gate.
Clock qualification, sustained-rate runs and physical-DAC admission remain
open. The driver emits no latency samples; `timing_grade` and `stage5_pass`
are false, with zero exported cells. Historical fixer-rs adapter coverage is
a separate configuration.

The original upstream SDK is fixer-rs 0.10.3 at
`c1c27c3287d6f275a9c33122cc2af063de7c5a08`. All 1,256 original files retain
their bytes and read-only modes. The
[writer/parser prerequisite](RECORD_2026-10-19_fixer_rs_canonical_writer.md)
qualified public custom ordering before this Session work.

## What actually ran

Each pair uses the SDK's `Acceptor`, `Initiator`, `MemoryStoreFactory`,
`FileLogFactory`, public `Application` callbacks and
`send_to_target_owned`. There is one current-thread Tokio runtime per
endpoint. The SDK owns framing, parsing, session sequencing and sockets.
The explicit configuration omits a data dictionary because the shared
canonical minimal bodies exclude dictionary-required venue extras.

Four canonical pairs each complete twelve cycles, exercising the six-value
quantity and price tables twice. Both endpoint logs contain identical
application bytes, with complete canonical bodies, repeating-group ordering
and associations, valid BodyLength/checksum, real SendingTime values within
the recorded run window, and contiguous SDK sequence numbers. Both peers
exchange Logon with EncryptMethod=0, HeartBtInt=30 and ResetSeqNumFlag=Y;
each sends an actual TestRequest and receives the matching SDK Heartbeat.

| Flow | Application frames per peer | Owner | Owner folds | Decimal sink |
| --- | ---: | --- | ---: | --- |
| NOS/ER | 24 | client | 144 | `11083906249535899689` |
| MD | 24 | client | 756 | `8452780597659586061` |
| Mixed MD/NOS/ER | 48 | client | 900 | `2230293092686911834` |
| Tick-to-trade | 24 | server | 60 | `17327418772661543379` |

All four sinks match the separate cross-language canonical model. Nonowners
have zero folds and a zero sink. Market data has twenty entries; ticks have
two. Mixed and tick reactions derive their symbol, quantity and price from
the SDK-decoded snapshot, selecting the first entry of the required side.

Two more actual Session pairs change the snapshot symbol to `LCOM2` and its
first bid/ask to `9000.25000` / `11000.75000`, with size 1,377. Deeper entries
in the mixed book have better prices, so selecting a best-price entry would
fail the first-touch rule. All 72 changed application frames match the
independent model. Owner sinks change to `8181595306908958522` (mixed) and
`13667612898658532915` (tick), with 900 and 60 folds respectively.

The cold controls alter collected native metadata, dependencies, source,
SDK inventory, capture dates and owner/admin observations, then recompute
the whole file-hash envelope. All 31 are refused by semantic checks. The
source gate also passes 51 tests and 24 refusal subtests, including validly
reframed body/group/order/correlation/admin corruptions.

## Reproducible inputs

- Driver/native-worker source pin:
  `a7f3d826814a8fadcdefff1fda32fc0e9dd39068`.
- Capsule `~/.cache/libhft/fullbench-fixer-rs-session-20261019-v2`;
  manifest SHA-256
  `bf71711c1409a7520f9c8f012ac375707517e58d3167b70c72b44ae182c2a67f`.
- Driver SHA-256:
  `8272d586060f9bad3b1681f5eec5e801389adb419444eaa87a04f320edb0868a`.
- Worker SHA-256:
  `aa510514089b6e4db030ba0acf025bbaaf950e2b893b9171fff5c9509f475449`.
- Identical HP/SCAN executable SHA-256:
  `1ed3ddd9e02e12388bccab9eaabc7aa6373a6720af22b497d654eeb2940c2fff`.
- Cargo.lock SHA-256:
  `31a1f8709385a5fdefb5043139f9f1379881d251083b76cb65b15024b3e01eeb`.
- HP native receipt SHA-256:
  `a0b734b7b0c0ae6280268318cb9110b26085a9963ae4ed72624c328837a0c88c`.
- HP review inventory SHA-256:
  `cd5dd6c65df5076fd3f961f26bb9ae55ae1ab491765e261152a7184915402b7a`.
- SCAN native receipt SHA-256:
  `031ffd63b73ca261c7ee5c409eac2ddc5406a5e426c228c29d580f50c2ae9f89`.
- SCAN review inventory SHA-256:
  `c6b2c03b9b1ac3b95fa41f28736ae5572be759362e1da6e06d3b377050d3fada`.
- HP cold-control receipt SHA-256:
  `97124ef566b5d85107b3bd1ff8f7090db8baea7edff3707d44ad04e24fb6ad7d`.
- SCAN cold-control receipt SHA-256:
  `ebe8c17f6b6589856cdd691a8ab74910d0912f18a67cf3ece78ca0195ec3c4ea`.
- Independent checker SHA-256:
  `7949344e5fef47dc8245d1360c34decf7a05199ce48d46af986826f9587198b3`.

The native worker reuses the previously qualified SDK and dependency cache
through an explicit input. It creates a separate Session project and runtime
state. Every dependency package in Cargo.lock is unchanged, and the original
writer fixture executable and project lock retain their hashes. The only
new release compilation is the Session application. Rust/Cargo are 1.92.0;
HP's worker uses Python 3.11.13; SCAN's uses Python 3.13.14. The build uses two jobs and clears external
compiler flags and wrappers.

HP runs under a high-priority `isol` CPU lease on CPUs 8–17. Shared host work
may run concurrently because this is functional qualification. The durable
service is `codex-fullbench-fixer-rs-session-20261019-v4.service`. SCAN's
normal-priority shared request uses CPUs 0–9 and service suffix `v3`. Both
services finish successfully with no live process. Both executable, driver,
worker, dependency-lock and Cargo-manifest digests are identical.

The initial SCAN launcher selected Python 3.9 and failed to import `tomllib`
before touching the SDK. A later preparation refused a path-order difference
in the inventory digest, also before building. The corrected worker uses the
same POSIX-relative inventory ordering as the qualified predecessor. Those
job logs remain working output; neither attempt is counted as a Session run.

Native working outputs remain under the session build root's
`fixer-rs-session-qualification-20261019-v1` directory. Bounded local replay
has 68 indexed files per host and no measured sample arrays or clock traces.
No benchmark output is copied into `~/archive`.