# Fixer-rs canonical writer campaign checkpoint — 2026-10-19

Both native jobs and independent reviews are complete. The public custom-order
configuration passes the four-flow message writer/parser prerequisite.
This is benchmark campaign evidence with **zero timing cells**; real Session,
owner/clock and physical-link admission remain open. The full plan is incomplete.

## Source and declared configuration

Upstream fixer-rs `c1c27c3287d6f275a9c33122cc2af063de7c5a08` is version
0.10.3, the source selected read-only from the latest retained microbench
checkout. Original codeload archive SHA-256:
`84b4f37fac8de7d357b6018b50ef1a02c6f5a48d06ca46505f6749b6bbae88a9`.
Its 1,256-file content inventory SHA-256 is
`4522a643689e92d7d340268b4af332c679eb25c3358fb72d014ca627d75d9d19`.
Every extracted source file is read-only. All bytes and modes remain unchanged
across dependency resolution, compilation and every actual execution. Shared
SDK caches and existing adapters are untouched.

The fixture configures `Message.body.field_map.init_with_ordering` with
`TagOrderType::Custom`, using four fixed canonical rank functions for `D`,
`8`, `V` and `W`. It constructs fields and repeating groups through the public
SDK, then calls the SDK's full `Message::build`. Public `parse_message`,
`get_string` and `get_group` check all decoded field strings, group counters
and member associations against the functional inputs.

Each canonical case exercises four independent constructions: default order,
custom order, reversed outer insertion with custom order, and public
`Message::copy_into` into a destination containing stale field `9999`. The
independent cold reader checks every observed frame's exact body, unique
headers, BodyLength, checksum and group associations against the shared
specification. Its complete-field comparison proves the stale field is absent
after copying. Required prices retain five decimal places.

Published producer/worker/checker source:
`b5dd4b77ce148dd29e8646d57a67f74d140ccc75`.
Fixture SHA-256:
`930f4eb2b8b3c50f4cc1c1679d1d92031db99512b7cfa8eb982e59d5ac3aa58a`.
Fixed worker SHA-256:
`f6e93e3a5c1a9be5742aa377ed4c2b53e859d46826fe6a892877597010d8a16f`.
Independent canonical input SHA-256:
`0d4e2cb3c5124e1d70ebb44883c36b23b7ce4b308d525a9031fbfdd3a127c36e`.
The public source scrub reports zero findings.

## Actual native result on both hosts

Both durable host user services finish successfully, UID/GID 1000. HP requests
high priority in the isolated pool on CPUs 8–17; SCAN requests normal priority
in the shared pool on CPUs 0–9. Both wait for registered work before running.
The functional builds allow the other CPU pool to run concurrently and make
no timing claim.

Both use Rust/Cargo 1.92.0, release optimization, `--locked`, two build jobs,
disabled incremental compilation and empty explicit compiler/wrapper overrides.
All projects and outputs are outside the repository. The build dependency
uses `default-features=false`. Both retain identical Cargo.lock bytes and
public dependency metadata; the cold reader checks these against their receipts.

Each host exercises twelve sequences through all four flows: 120 cases,
480 actual full serialized frames and 480 SDK parses.

| Writer configuration | Frames | Exact canonical body | Order mismatch |
|---|---:|---:|---:|
| Default | 120 | 0 | 120 |
| Public custom order | 120 | 120 | 0 |
| Reversed insertion, custom order | 120 | 120 | 0 |
| Public copy into a reused message | 120 | 120 | 0 |

All configurations pass required values and group associations. Only the
public custom-order configuration passes strict canonical body admission.
The legacy full-session adapter is a separate source/configuration and
retains its existing coverage and diagnostic grades.

Both hosts produce executable SHA-256
`dbb34da262425aab9bd56f33e87638684de6a1dbac706833ccf3d7c66968f9e5`,
Cargo.lock SHA-256
`db106d113c4fcd6595606da48871d4714ac86ae2f1e98494c4bd25b414b0b650`,
and identical observed vector SHA-256
`faa29bed11de1add07c167692e62f96576fe6e67640bb005c5606f833437b44a`.

| Host | Native receipt SHA-256 |
|---|---|
| HP | `69e3145b1bfce5689c13bc391316194665a3aeed4aed545251b582cf411f318b` |
| SCAN | `10284a53e6986bb480e022a0f8d1109bedbd8a37003249a92068a9a7cd0a41bc` |

## Refusals, portability and retention

Each native executable rejects fourteen malformed or incomplete fixture
inputs. Each independent cold reader rejects nineteen altered copies of the
actual bounded metadata, including forged admission, owner/CPU/source identity,
changed or shortened source inventory/modes, missing/successful native refusal
claims, changed lock/fixture, duplicate entries and symlinks. Changed envelopes
are rehashed so the semantic controls exercise their corresponding rules.
The focused source suite passes **62 tests**, zero skips: 23 fixer-rs,
20 QuickFIX/Go, 14 DFX and five Go module preparation regressions.

The Go Stage 3/5 module preparer now reads its adapter only from the declared
workload root. Copied-controller checks retain exact CRLF bytes, ignore a stale
controller sibling, quote SDK paths containing spaces, and refuse missing or
symlink inputs before creating output. This repairs source preparation and
grants no Go serialization or timing admission.

The first publication attempt caught a guard's raw-Cargo pattern matching the
checker's metadata dictionary access. The reader now names the observed Cargo
version explicitly; the guard and standing split gate pass. No native job was
launched before that source correction. Both successful native jobs use the
same sealed source bundle. No root helper or sudo rule changes.

Services: `codex-fullbench-fixer-rs-writer-20261019-v1.service` on both hosts.
Original host evidence:
`~/build/codex-fullbench/libhft/fixer-rs-writer-qualification-20261019-v1`.
Independent bounded copies:
`~/build/codex-fullbench/libhft/fixer-rs-writer-review-20261019-v1/{hp,scan}`.
Kept evidence:
`~/archive/libhft/fullbench-20261019/fixer-rs-writer-v1`.
The retained vectors are functional fixture observations, with no measured
latencies, clock traces or CDFs. The next gate is a real SDK production Session
driver with canonical owner extraction, bilateral admin/wire checks, complete
clock qualification and then fresh 10,000/s physical report runs.