# Libtrading observed-provenance report admission — 2026-10-19

Both the HP Solarflare and SCAN Mellanox DAC campaigns admit all four flows as
numeric-only compact results. Before/after observed host/NIC facts, all
original wire/owner/clock evidence and every raw value pass independent
replay. The unchanged 10,000/s report contract passes rate, scheduler-delay
and repetition-stability gates. Eight cells total **39,004 bytes**, with no
CDF arrays or original wire payloads. Original samples and traces stay on their producing hosts.

Both durable host user services complete with successful exits after their
CPU queues clear. Each host independently admits four report cells.
This is the separately declared `canonical_text_numbers_v1` configuration;
it does not change the legacy libtrading adapter's historical coverage row.
No matched cross-engine comparison is claimed. The full plan is incomplete.

## New admission requirements

The [earlier HP physical diagnostic](RECORD_2026-10-19_libtrading_physical.md)
passed timing gates but did not capture complete host/NIC provenance before
the run. It remains unchanged and diagnostic. The new campaign adds that
required evidence rather than backfilling its historical provenance.

`libtrading_result_file.py` calls the independent physical replay, then
requires original observations of both endpoint namespaces before and after
measurement. Each record binds UID/GID 1000, actual namespace inode, CPU
budget, kernel, driver, PCI NIC identity and firmware to the original sealed
collector. The observations bracket the recorded sitting and must agree
across both ports and both phases. Changed firmware/kernel/CPU/namespace,
late or missing observations, and supplied labels inconsistent with observed
facts are refused. The captured provenance digest binds the completed run.

Only a report row whose independent gates all pass can create a result.
The result format preserves median-of-run percentiles, the largest observed
maximum, exact sample counts, rates, hashes and observed provenance. The new
flavour is `libtrading+text-numbers+session-delivery+complete-rtt`. It labels
the actual synchronous delivery endpoint rather than an asynchronous SDK
callback. No full CDF, raw array, trace or original wire capture is put in
these compact results. Writing refuses existing cells, duplicate keys,
symlink destinations, failed grades and measured/open capture scopes.

The focused source suites pass **174 tests**. New controls cover both
provenance timing/identity and numeric result write refusals. Actual execution on both hosts also qualifies the new admission path against its complete fresh
evidence; it does not substitute synthetic fixtures for a physical pass.

## Execution and source identity

The same native executable from the
[two-host timed qualification](RECORD_2026-10-19_libtrading_timed.md) is reused:

- Producer source: `a1958712151b35705284f151c8473239b74a4f86`.
- Executable SHA-256: `0a6d15f432f1a9ef7401326c4c50636f681b7e0aa2bb7d405717d96a1834e939`.
- Report worker/writer source: `a27c0256d63d611ee8eb12de9cdcf4e9041a973f`.

The original SDK, its qualified library and the native producer are not
rebuilt. The existing registered root helpers retain their pinned hashes and
fixed namespace/CPU/user policy. The host fact collector is a sealed ordinary
user payload installed by that existing helper. No additional sudo rule or
password is required.

Each host's immutable capsule contains 209 declared inputs. HP's manifest is
`eb892cf5108e6c73a04d363d424869438e7c0609cd4cf889066409d672b08e5f`;
SCAN's is `4036522f8b65c4e51032588a7012f3d4279399baa1082d1241483f4b8b51b8eb`.
The manifests separately identify the original qualified producer, the
report controller revision and the sealed base inputs.

Before launch, both hosts' slot status, processes and memory were checked.
Both jobs run their outermost foreground worker under `host-cpu-slot wait`
with `isol-no-shared`; HP requests high priority and SCAN normal priority.
The registered entry keeps HP server CPUs 8–12/client 13–17 and SCAN server
10–13/client 14–17, each with its physical DAC namespaces. Waiting never
preempts another session's job.

## Admitted measurements on both hosts

Tiny: warmup 5, twenty samples, one repeat per flow, 100/s. Report: warmup
1,000, 10,000 samples and three repeats per flow, 10,000/s. All sixteen pairs
complete, both process exits are zero, and original physical counters increase
on both ports for every pair. Replay checks **120,080 primary and 120,080
delay values**, including tiny runs, plus all 160 complete preflight cycles.
Every independent owner sink/fold count and every bilateral capture agrees.

Each host independently replays these counts and all gates. The percentiles
below are medians of the three per-run percentiles. Rate is
total measured cycles divided by the sum of measured run durations.

| Host / flow | Achieved cycles/s | p50 µs | p99 µs | p99.9 µs | Result bytes |
|---|---:|---:|---:|---:|---:|
| HP NOS/ER | 9,994.476 | 23.181 | 25.335 | 29.583 | 4,862 |
| HP MD | 9,994.408 | 34.037 | 36.658 | 42.850 | 4,864 |
| HP MD/NOS/ER | 9,994.181 | 53.401 | 56.434 | 64.026 | 4,869 |
| HP Tick-to-trade | 9,994.209 | 19.963 | 22.017 | 27.481 | 4,866 |
| SCAN NOS/ER | 9,992.073 | 36.825 | 46.563 | 56.360 | 4,876 |
| SCAN MD | 9,991.470 | 51.231 | 65.185 | 74.302 | 4,883 |
| SCAN MD/NOS/ER | 9,981.222 | 76.221 | 95.318 | 125.943 | 4,899 |
| SCAN Tick-to-trade | 9,990.748 | 31.983 | 41.534 | 50.528 | 4,885 |

The source and clock contracts remain unchanged: RTT includes fresh request
construction through final checked extraction; tick starts after original SDK
serialization at the saved public IO delegate and stops at validated Session
delivery before benchmark extraction. These cells grant no comparison to a
different clock policy or a different sitting.

HP receipts:

| Artifact | SHA-256 |
|---|---|
| Completed physical run | `1965ea963226cdeb59e9f4da32c7bcee2ad0d6aedebee5b9d72d9239b75ff7c7` |
| Original-value replay | `e0e0bedcb7e1d63627036febecd4d50f17c0c99c9a5e2a88835d646ae57d29f1` |
| Numeric result admission | `fc3862f91169b74f7c468a054152a0f4b01a539789b786eda2d9ea2b89e550c9` |

SCAN receipts:

| Artifact | SHA-256 |
|---|---|
| Completed physical run | `530bf9d3fd964fba1937e3b61ce8a5371d28376ed5733f64e7f1aeae4a1f15fc` |
| Original-value replay | `8ee44df3b4487032d337a780cb6868781b111842bb4ad546b1d42193ee540a2a` |
| Numeric result admission | `eb1ef20c09267738f33e0544d24a3b70465420c3b4217825b18d0ce6f9044f0d` |

## Durable execution and retained interruptions

The former SCAN SSH controller stopped after its first successful tiny
NOS/ER pair. The pair's original metadata and preflight wire are retained;
its measured raw and trace stay on SCAN. It supplies no complete campaign.
The local collection watcher also no longer existed when continuation began.

New jobs are user services named
`codex-fullbench-libtrading-report-20261019-v2.service` on each host. Their
outer foreground CPU helper and worker survive the staging SSH connection.
Both services reach `active/exited`, `Result=success`, exit status zero,
with four admitted results each. Status is read from the host service rather
than a stale local PID.

The first service launch exposed a user-manager PATH difference and failed
on SCAN before any benchmark started. The failed preparation and log are
retained. HP's still-queued first service was stopped before a benchmark.
The corrected service explicitly supplies the ordinary user's helper PATH;
the sealed worker and native executable are unchanged. Existing root helper
environments remain unchanged. This correction did not rerun a completed
campaign.

Retained source under `private/benchmarks/retained/` consists of the report
qualification worker, sealed staging script and durable job launcher.
Each host keeps inputs at `~/.cache/libhft/fullbench-libtrading-report-20261019-v1`,
full evidence at `~/build/codex-fullbench/libhft/libtrading-report-qualification-20261019-v1`,
and numeric results at `~/build/codex-fullbench/libhft/libtrading-report-results-20261019-v1`.
Service requests and logs are in
`~/build/codex-fullbench/libhft/jobs/libtrading-report-20261019-v2`.
The local review contains 333 bounded HP payloads and 323 SCAN payloads under
`~/build/codex-fullbench/libhft/libtrading-report-review-20261019-v1/{hp,scan}`.
It independently checks observed provenance, original wire/owner/admin
evidence, compact result hashes and numeric percentile/rate decisions.
No raw or clock-trace download occurs. Metadata is hash-indexed under
`~/archive/libhft/fullbench-20261019/libtrading-report-v1`.

Both host result sets are independently reviewed and retained. Synchronize
only these admitted numeric cells and this checkpoint to the website. Public
archive extraction freezes and the remaining roster/Java/.NET comparison
gates are independent open work. No live site deployment is performed.