# Libtrading timed Session instrumentation — 2026-10-19

The new canonical text-numeric producer passes twenty actual two-process
local TCP pairs on each of HP and SCAN. Both independently check original
SDK wire, warmup/reset owner sinks, administration, 64-bit raw values and
the observed clock boundaries. This qualifies instrumentation only. Fresh
physical DAC campaigns, offered-rate/stability gates and matched comparisons
remain open. No timing grade, Stage 5 pass or result cell is exported. The
full plan remains incomplete.

## Source and original SDK

The [previous functional qualification](RECORD_2026-10-19_libtrading_canonical.md)
established upstream pin `9cf4dfa58fd7201935f7bf7e9046d78653e041d3`, its
149 original files and the sole declared 48-to-128 capacity patch. This run
reuses that qualified static FIX-component library, SHA-256
`cfc66b7888fc4c51b2adb49c055cf18c8d74bfe10135dad651f321fc5a15cc18`.
It builds no SDK component. All 149 patched source bytes and modes plus the
library hash match before and after qualification. The shared SDK cache and
legacy adapter remain unchanged.

The new public producer is
`oss/benchmarks/cpp/fixbench/tools/open_source_fix_engines/native/libtrading_canonical_timed.cpp`.
It uses the already qualified `libtrading_canonical.h` for public SDK fields,
text-numeric dialect, complete book extraction and correlated orders/reports.
The observed transport is the original public `fix_session_send`, saved
`io_sendmsg`/`sys_sendmsg` delegate and `fix_session_recv`. It supplies no
replacement FIX codec, message writer or socket sender.

The observer saves/restores the public IO pointer. Before invoking the saved
delegate it records `CLOCK_MONOTONIC_RAW`; descriptor, original iovecs, count
and flags remain unchanged. It preserves the IO result/errno even if a later
observer callback fails. A partial/error IO result or invalid/backward clock
fails producer completion. An actual SDK serialization test uses a controlled
public delegate to establish these properties without a socket mock in the
normal producer.

## Explicit clock and reset contract

- RTT owner: client. Start precedes fresh request construction. Stop follows
  final SDK parse, canonical extraction and correlation checks. The mixed
  flow includes full-book extraction, its derived order and final report.
- Tick owner: server. It builds and serializes the SDK book before the start
  timestamp at the public IO delegate. Stop is validated synchronous
  `fix_session_recv` delivery of the response, before benchmark extraction.
  This is not an asynchronous registered SDK callback claim. Server-side
  response extraction still verifies and folds the actual derived order.
- Every process runs ten preflight cycles. Both original application capture
  files close before warmup; each phase resets markers and owner state.
  No measured application frames are wire-captured. Pacing records intended
  schedule and actual launch for every owned sample.
- Original admin events retain direction, wire and clock. The measured flag
  is derived from the process's actual measured window. Initial Logons and
  final Logouts fall outside it. Functional admin probes echo a measured
  `LTS5-PROBE` TestRequest through the original Session.

One-millisecond functional probes delay receive delivery after SDK return
and delay owner extraction. Original trace differences prove that tick stop
includes the former and precedes the latter; RTT includes final extraction.
Raw values equal `stop-start`, and delay values equal `launch-scheduled`.
The cold checker binds its engine, clock, rate and probe policy externally;
producer metadata cannot select a more permissive audit.

## Actual runs and checks

Before builds, both hosts' slot status, processes and memory were checked.
HP used high-priority `isol`, CPUs 8–17, server 8–12/client 13–17. SCAN used
normal-priority `shared`, CPUs 0–9, server 0–4/client 5–9, while another
session held the isolated pool. UID/GID is 1000 throughout. Each outermost
build/test worker ran under `host-cpu-slot wait` and `taskset`. These
functional jobs make no quiet-CPU or physical-link claim.

Both compile two new C++17 products with GCC 15.2.1, `-O2 -DNDEBUG`, using
the verified immutable SDK library. Per host the matrix covers all four flows
at warmup 0, warmup 5, repeated warmup 5, a 1 ms clock probe and an admin
probe. Each pair owns twenty measured samples at the unchanged 10,000/s
target. All twenty pairs complete and are cold-checked:

| Evidence per host | Verified |
|---|---:|
| Separate client/server pairs | 20 |
| Primary / scheduler-delay raw values | 400 / 400 |
| Original captured preflight cycles | 200 |
| Complete live application frames per peer | 1,700 |
| Actual SDK/public IO observer controls | 12 |
| Native production CLI refusals | 11 |
| Altered actual-evidence refusals | 14 |
| Focused source tests | 95 |

Warmup zero/five/repeat owner sinks all match the independent specification.
Counterpart application and administrative bytes agree exactly. The cold
reader checks complete canonical body values/order, sender/target, checksum,
BodyLength, preflight sequence, final complete sequence and exact live counts.
Original process IDs differ and their CPU sets are disjoint.

The observer controls cover unchanged serialized iovecs, successful result
and errno, partial result, IO error, zero/backward clock, before/after callback
failure, nested/orphan observer, malformed/null buffers and restoration. CLI
controls refuse missing arguments, invalid role/flow/port/warmup/sample/rate/
timeout/probe options and existing output. Copied actual mixed-flow evidence
refuses wrong engine/owner/warmup/capture/count/admin/delegate/clock policy,
fabricated rate/grade and changed trace marker/start/return/stop. Originals
are preserved byte-for-byte. Source tests additionally refuse raw-width/value
changes, hidden measured admin, bad echo/checksum, missing sequence and
duplicate JSON keys.

## Reproducibility and retention

Both hosts produce identical executables:

| Product / receipt | HP | SCAN |
|---|---|---|
| Timed executable | `0a6d15f432f1a9ef7401326c4c50636f681b7e0aa2bb7d405717d96a1834e939` | same |
| Observer test | `2f282be1a6f6c45e6be5172f39216eed370b080dc91131a63e91198ac2a98397` | same |
| Native receipt | `aad2f2c66bcf228922b01c87b740bdf4e43fe6054fbf49fea4f5b9947007928b` | `4f40eaf32b4b1f68a7bfc4a51bb56e49bf65594d0d4cd1cc571d5d9466ab7f1b` |

Input manifest SHA-256:
`8d3265713722205a8a7572b18165a1a98dc1bd6ec2293b73e1af6b27ac04e3e4`.
The retained fixed worker is
`private/benchmarks/retained/libtrading_timed_qualification_20261019.py`;
the private cold reader and tests are `check_libtrading_timed.py` and
`test_libtrading_timed.py` in the integration controller root. Public sources
and build instructions live in the benchmark archive; machine execution and
admission stay private.

Each host retains its immutable input capsule at
`~/.cache/libhft/fullbench-libtrading-timed-20261019-v1` and all actual
products, raw samples, clock traces and original evidence at
`~/build/codex-fullbench/libhft/libtrading-timed-qualification-20261019-v1`.
The local review at
`~/build/codex-fullbench/libhft/libtrading-timed-review-20261019-v1/{hp,scan}`
contains 237 bounded payloads per host. It independently checks input/source
hashes, library/SDK identity, product and receipt bindings, and original
bilateral wire/admin/owner evidence. Raw samples and full per-sample traces
remain on the producing hosts. Hash-indexed metadata and preflight evidence
are kept in `~/archive/libhft/fullbench-20261019/libtrading-timed-v1`.

Website synchronization uses this compact record without original samples or
CDF exports. No site deployment is authorized by this checkpoint. Next are
quiet diagnostics and fresh physical DAC admission using the qualified timed
producer. The original 10,000/s contract and independent rate/stability gates
remain in force.