# Fixer-rs: original prepared buffers and callback clock

## Qualified scope

| Host | Real SDK pairs | Prepared buffers | Tick observations | Metadata refusals | Actual-trace refusals |
| --- | ---: | ---: | ---: | ---: | ---: |
| HP | 12 | 216 | 96 | 31 | 15 |
| SCAN | 12 | 216 | 96 | 31 | 15 |

Both hosts qualify this configuration's original prepared-byte handoff and
tick callback clock. Report-grade request/reply clocks, warmup/measurement
phases, pacing, measured administration and fresh physical-DAC runs remain
open. Every fixture is ungraded, `stage5_pass=false`, with zero exported
result cells. The [preceding Session gate](RECORD_2026-10-19_fixer_rs_canonical_session.md)
records the canonical business and owner contract.

## Production SDK integration

The caller uses the original SDK's public `SESSIONS`, `SessionRegistration`
and `AdminEnum::Connect` interfaces. During Acceptor setup it temporarily
routes Connect through an observer, replaces its outgoing `Sender<Vec<u8>>`
with the observed channel, and forwards the unchanged Connect to the original
SDK admin channel. Before the SDK processes Connect, the caller restores the
original registration. Actual Logon callbacks assert that its admin sender
is the original sender using Tokio's `same_channel` API.

The original Acceptor, Initiator, parser, state machine and socket writer
continue to run. The observer receives an already serialized SDK `Vec<u8>`
and moves that same buffer into the original writer queue. Each observed
frame matches both the SDK's own outgoing log and the peer's incoming log,
including BodyLength, checksum, sequence, timestamp and complete body. The
comparison excludes shutdown Logout from bilateral equality, as in the
preceding functional gate. Its 168 application and 48 administration buffers
per host remain available as bounded working preflight output.

All 1,256 upstream files retain their original bytes and read-only modes at
fixer-rs 0.10.3 commit `c1c27c3287d6f275a9c33122cc2af063de7c5a08`.
All dependency packages remain unchanged; the qualified original writer and
preceding Session executables retain their hashes. Both new executables are
byte-identical. Only the new application is compiled; SDK artifacts are reused
from the explicitly declared qualified cache.

## Actual clock boundaries

The clock domain is Rust `Instant`, relative to one observer epoch in the
server process. The selected tick sample is exactly:

`Application::from_app entry - observed prepared-channel entry`

The first timestamp precedes forwarding the original serialized buffer to
the native writer queue. The second follows SDK parsing and precedes typed
application extraction, matching the existing canonical Rust callback tick
definition. Every actual source-clock difference is checked on its host.
The owner still extracts, correlates and folds all required reaction fields.

The six baseline pairs cover all four canonical flows and both changed-touch
controls from the preceding gate. Six additional tick pairs cover canonical
and changed-touch data under three independently injected 2 ms delays:

| Injection | Observed position | Selected tick window |
| --- | --- | --- |
| public `to_app`, before SDK serialization | ends before prepared publication | excluded |
| after prepared-channel entry | ends before the original writer and callback | included |
| callback entry, before owner extraction | follows the selected end clock | excluded |

All twelve cycles in every tick pair preserve these event orders, exact clock
differences and original canonical/changed-touch owner sinks. The source suite
passes 75 tests plus 24 refusal subtests; public source scanning has zero
findings. Independent bounded replay passes all 336 application frames per
peer and every prepared-buffer comparison on each host.

## Refusal evidence

Each host's 31 cold metadata controls alter original collected output and
refresh its full hash envelope. Root execution, changed source/SDK/compiler
inputs, rewritten valid-checksum buffers, missing publication, unrestored
registry state, wrong clock scope, missing injected delay and premature
timing/cell promotion are refused semantically.

A separate host reader checks the original four canonical tick traces and
refuses 15 actual-trace mutations in memory: missing/repeated markers,
invalid event order, wrong start/end differences, misplaced extraction and
missing injections. Original trace bytes remain unchanged. Full clock traces
stay on the hosts; only their hashes, extrema and refusal receipts are read
back. No benchmark is rerun by these controls.

## Pins and receipts

- Producer/worker pin: `e9477221cf5fcae4f177b43f11cf0ecc16f475c1`.
- Input capsule `~/.cache/libhft/fullbench-fixer-rs-prepared-channel-20261019-v1`;
  manifest SHA-256 `c8225b8cd3f5d5a6aaf6e0590adc47ea90c4fe8287b30ffec7d3b7caa3c338d4`.
- Identical executable SHA-256:
  `9ab9bac5a5f585532022ca09a53ca612bdae40a009df461bf34b7268c12a9981`.
- Identical Cargo.lock SHA-256:
  `41b14d190d85cb907235326080720acdafb20b3d764b3016ea86c09a53c0f9fb`.
- HP native receipt:
  `cf7a23477b6fedee94b1b6caf247ed484812f70b47319384386ae82d21f60d6d`.
- SCAN native receipt:
  `98c2a2461d8cc85c7a02a66491edea10716a547b6123ccc04bb7044dad3956d7`.
- HP / SCAN bounded inventories:
  `214169273fc0a58b4bfd7d1ab9d7ef46ccd80f2968911ec42cc9c7123c471433` /
  `73c8dd0516b402068617332cffbba478e2f42a6620cc35ea427e8ddb28733b0f`.
- Cold refusal reader pin: `2b7a699e05c9bdb4618ae0cd91fa8cb91ed9ed36`;
  checker SHA-256 `dbf4c6189681a710a524ec28bc60711c1360b2805809f1d4af960ee9d5f2acbd`.
- HP / SCAN metadata-control receipts:
  `28996f412c395f8e685eb35e972a238a42a950081c5ed713b2104dc5fc103b3f` /
  `5c2537b136a3b648f1d2365f588897d46b26f48a20e7e1bf311227f6e516b3f5`.
- Actual-trace control capsule manifest:
  `77bd69931c936a1aa84ecc60fe572d8b3a7c50048dd27bdeb081e95101fbc905`.
- HP / SCAN actual-trace refusal receipts:
  `3f5ffffd84ab7c88ba81d02fb9b71730e9c6fa602358f5b442b99f2d901b0718` /
  `f6b3dacceacf94edb91fe958f3cd5c9767979939c16683984ba62ba7f6b737b6`.

Both native services, `codex-fullbench-fixer-rs-prepared-channel-20261019-v1`,
and the corresponding `prepared-controls` services finish successfully with
no live process. HP uses high-priority `isol` CPUs 8–17; SCAN uses normal
priority shared CPUs 0–9. Rust/Cargo are 1.92.0; workers use Python 3.11.13
on HP and 3.13.14 on SCAN. The release build uses two jobs, cleared external
compiler flags/wrappers and a separate project/runtime directory.

Working output is under the session build root's
`fixer-rs-prepared-channel-qualification-20261019-v1` directory. The bounded
165-file review excludes all `prepared-channel-clock.tsv` files. No output
is copied into `~/archive`, and no run folder is deleted.