# QuickFIX C++ single-CPU-per-role physical investigation

The [group-order source](RECORD_2026-10-19_quickfix_cpp_group_order.md) passes
both hosts' actual complete private portable controls and native SDK checks.
Its HP original-placement report still misses the 10,000/s rate on all flows.
The earlier localhost CPU profile reaches the requested rate. A separate
placement experiment investigates scheduling overhead; these different runs
do not establish its cause or an improvement.

## Fixed executable, explicit effective placement

The application source remains `a2485d8cb0b0c1457ba2d083c01b8f14566dd4d4`.
The unchanged original threaded SDK consumer is
`9e4bafb0a35d6e4250f7cbaab54833790830780640443f625ddd8a70cb364ffb`.
The private fixed worker is
`private/benchmarks/retained/quickfix_cpp_first_cpu_physical_20261019.py`.

The registered entry keeps its fixed role envelope: HP server 8–12/client
13–17, SCAN server 10–13/client 14–17. A separately sealed normal-user launcher
narrows the inherited set to its first allowed CPU before SDK execution:
HP server 8/client 13; SCAN server 10/client 14. It records its original/effective
set, UID/GID, PID, namespace inode, launcher hash and executed payload hash.
All SDK threads inherit this setting through exec and thread creation; the
explicit observation scope is before SDK exec. No live-thread sampling is
claimed. The host-provenance collector uses the same launcher policy and
records the actual effective placement separately from the entry envelope.

The installer stores non-`app` files as read-only data. The normal-user launcher
compares its sealed binary/dictionary copies with the independently qualified
immutable original generation, then executes that original executable. The
original registered entry and installer remain unchanged. The wrapped host
probe is executed with the fixed isolated system Python interpreter. Every
payload, original reference and profile binding is checked; the original
SDK/application is neither rebuilt nor modified.

Ten actual unprivileged local exec controls cover both roles/all four flows,
an already-singleton affinity set, interpreter dispatch of a read-only probe,
exact original argument preservation and unchanged parent affinity. Six actual
refusals cover missing arguments, an invalid role, missing/linked payloads,
changed sealed binary bytes and a changed dictionary. The same controls must
run under the host lease before deployment. These controls supply no native
SDK, timing or physical grade by themselves.

## Required physical evidence and publication scope

Each host waits for its actual original-placement physical completion and
independent review. The worker binds that exact receipt/review to its source,
native receipt, original binary and immutable generation. If every baseline
flow passes, the extra placement run is unnecessary. Preparation queues with
an isolated lease, then timing requires a quiet `isol-no-shared` lease;
HP uses high priority. Host status/processes are checked before heavy work.

All four tiny/twelve report pairs retain the original bodies, SDK parser and
serializer, complete extraction/owner folds, admin/capture observations,
1,000 warmups, 10,000 measured cycles, three reports and 10,000/s rate. Existing
independent cold replay must reproduce every original raw quantile/extremum,
physical-counter observation, fixed entry/normal user and grade. Thirty-two
launcher observations must match their actual role CPU/namespace and the
sealed launcher/SDK hashes. No original runtime generation is replaced.

This new profile has no compact-cell exporter or matched comparison binding.
Only bounded metadata and numeric report summaries may be collected; all raw
samples and captures stay on the producing hosts. Its own grading outcomes
and effective CPU policy must remain visible. The original-placement rows,
other flavours, public-archive gate and full-plan completion stay independent.
At this checkpoint the launcher controls pass locally; actual deployments and
physical runs are pending. The unanswered lower-rate policy question does not
change the original report contract.

## First preparation fails before physical pairs; separate v2 correction

Both v1 preparations pass their actual launcher controls and install a distinct
normal-user SDK launcher generation. They then stop before the host probe or
any physical benchmark pair: `generation_runtime.canonical_manifest` correctly
refuses the separate `fullbench-host-provenance` family. The invocation used
the session-only manifest validator for that observer. This is a preparation
failure, with no physical/timing result. Original logs, staged files, immutable
generations and v1 build roots remain retained.

The corrected worker uses fresh v2 build/stage names and the observer's original
canonical JSON encoding for that exact private engine family. SDK admission
continues through the original session validator. Both families still require
the registered installer check, root-owned exact file set, complete marker,
all original hashes/sizes and exact executable/read-only modes. The observer's
separate family is not added to the session catalogue, and no shared API or
root helper changes. The original executable/dictionary, workload and all
actual hardware/clock/owner/sample gates remain unchanged. Actual v2 host
preparation and report outcomes are pending at this checkpoint.

## Corrected physical matrices complete on both hosts

Both v2 preparations pass their own ten real exec cases and six refusal
controls, then install the distinct launcher and observer bundles using the
registered helper. HP runs with high priority. Each host's separate quiet
lease completes four tiny and twelve report pairs, with all 32 process exits
zero. Original UID/GID 1000, entry/namespace, full fixture/owner, admin/capture,
physical counters and source bytes/modes pass. Thirty-two actual per-role
launcher observations match their namespace, broad entry envelope, single
effective CPU, executed original SDK hash and sealed launcher hash.

Both independent cold readers reproduce 80 tiny and 120,000 report primary
samples, the same delay counts, exact quantiles/extrema and every original
decision. They retain 100/300 pre-warmup application frames per peer, with
no measured application capture. Twenty-seven bounded metadata/code payloads
per host are collected and independently checked, including exact installed
launcher bytes, sealed profile, original native/baseline/review bindings,
actual CPU/hardware facts and all 32 placement observations. No measured raw
samples or captures are downloaded.

The application remains the original qualified threaded executable. The
corrected worker source is `f3fe970df851187318b28a5856432e332b2df049`, with
SHA-256 `ffda11b20cd899f2a23bd545d0a6a47cc30a93ad4fd91e693d05afcfdc71f9a9`.
The source pin of the actual SDK consumer stays
`a2485d8cb0b0c1457ba2d083c01b8f14566dd4d4`.

Every flow remains diagnostic under the original 10,000/s contract. The
following are ranges across the three original report runs, not a matched
comparison or confidence interval:

| Rig | Flow | Achieved/s | p50 us | Failed gates |
| --- | --- | ---: | ---: | --- |
| HP | nos_er | 7,091.270–7,107.930 | 140.223–140.931 | rate |
| HP | md | 5,846.261–5,867.375 | 170.035–170.818 | rate |
| HP | md_nos_er | 3,670.250–3,685.851 | 270.987–272.015 | rate, delay |
| HP | tick_to_trade | 7,049.890–7,057.554 | 77.270–77.684 | rate, delay |
| SCAN | nos_er | 5,879.714–5,910.755 | 168.581–169.386 | rate |
| SCAN | md | 4,590.950–4,618.577 | 215.633–216.944 | rate, delay |
| SCAN | md_nos_er | 2,555.912–2,575.087 | 387.576–390.308 | rate, stability, delay |
| SCAN | tick_to_trade | 5,686.882–5,741.901 | 99.341–101.174 | rate, delay |

HP's generation is
`58ae40b3dedfaff8902a0bbadb0a0e85c3a4aaf11a7d68d05f870eeac3c995f8`;
completed receipt `4065eeebbe4f2ef31dc25a6b08a06204637f3627c7f556354f0000bdfba13f35`.
SCAN's generation is
`366c893d83d51e31b83294fb6580ce25b1354312687b4421440d78b5b06c91cf`;
completed receipt `f0e0ecbe000218fb64b6c45a972a22888b0c3bcecde24197c6046edc1662db58`.

This placement does not resolve the achieved-rate gate. It exports zero cells
and admits no improvement or matched comparison. The v1 preparation failures,
original-placement diagnostics and every retained good key keep their original
grades. All producer/collector jobs are complete. Bounded metadata is retained
under `~/archive/libhft/fullbench-20261019`; original samples and captures stay
on their producing hosts. The separate 1,000/s common-profile proposal is an
unanswered policy question; no lower report rate is adopted. Wider roster,
current matched-language, public-archive and full-plan gates remain open.

## Bounded diagnostic latency summaries

These remain diagnostics under the failed original report gates. p50, p99 and
p99.9 are medians of the three run percentiles; worst is the maximum original
run extremum. Each flow retains 30,000 measured cycles after 1,000 discarded
warmups per run. CV uses sample standard deviation across the three run
percentiles, divided by their mean. Original rate/delay/stability failures
remain authoritative; these summaries grant no matched speed claim.

| Rig | Flow | p50 us | p99 us | p99.9 us | Worst us | CV p50 / p99 / p99.9 |
| --- | --- | ---: | ---: | ---: | ---: | --- |
| HP | md | 170.733 | 174.963 | 186.101 | 297.688 | 0.252% / 0.300% / 2.404% |
| HP | md_nos_er | 271.829 | 283.393 | 313.240 | 367.931 | 0.202% / 0.319% / 5.810% |
| HP | nos_er | 140.230 | 144.333 | 153.531 | 206.452 | 0.290% / 1.572% / 0.424% |
| HP | tick_to_trade | 77.568 | 80.957 | 84.422 | 143.422 | 0.276% / 0.325% / 0.856% |
| SCAN | md | 216.856 | 225.828 | 268.506 | 449.432 | 0.339% / 0.373% / 5.857% |
| SCAN | md_nos_er | 389.274 | 416.181 | 531.934 | 573.840 | 0.355% / 13.394% / 3.140% |
| SCAN | nos_er | 169.112 | 177.599 | 193.760 | 242.838 | 0.242% / 0.390% / 2.299% |
| SCAN | tick_to_trade | 100.452 | 106.320 | 111.814 | 124.714 | 0.920% / 1.039% / 0.894% |