# Fixer-rs: complete RTT, phased measurement and original Session shutdown

## Current outcome

Both hosts pass the new configuration's 29 actual SDK Acceptor/Initiator
pairs each. Independent replay checks 825 owner clock records, all 460
measured primary values and 460 scheduler-delay values, and 435 altered-output
refusals on each host. Bounded collection independently replays all 720
canonical preflight application frames per host and every measured owner
checksum. Executables and dependency locks are identical.

This closes the scoped timed functional gate on both hosts. Both separate
quiet DAC collectors also complete all sixteen functional/report pairs each.
HP admits NOS/ER and tick; HP's other flows and every SCAN flow retain report
blockers. See the [complete physical outcome](RECORD_2026-10-23_fixer_rs_physical.md).
Every
native proof has `timing_grade=false`, `stage5_pass=false` and zero exported
cells. The older `fixer_rs` adapter and its diagnostic grades are unchanged.

## Measurement contract

The new public producer is
`oss/benchmarks/cpp/fixbench/tools/open_source_fix_engines/rust/fixer_rs_timed_session.rs`.
It uses the [qualified canonical model](RECORD_2026-10-19_fixer_rs_canonical_session.md)
without changing its function bodies, and the original upstream SDK at
`c1c27c3287d6f275a9c33122cc2af063de7c5a08` (fixer 0.10.3).

- All four flows use original SDK Acceptor/Initiator, MemoryStore, NullLog,
  public Session channels, repeating-group parsing and socket writers.
- Ten preflight cycles precede warmup and measurement. Marker and owner
  state reset between phases; SDK sequence numbers continue. Zero warmup
  skips only the warmup phase. Capture vectors stop at ten cycles per
  direction, or twenty frames for the mixed flow.
- RTT starts before fresh construction and ends after the final business
  extraction, correlation, validation and owner folds. Tick starts at entry
  to the original serialized-buffer channel and ends at the application
  callback before business extraction. Every business field is still
  extracted and validated afterward.
- The server's supported Connect handoff observes actual SDK `FixIn` input
  and prepared output, forwarding the same objects/buffers. It restores the
  SDK registration before Connect, and checks the original channel on Logon.
- `CLOCK_MONOTONIC_RAW` supplies exact differences and joint endpoint
  ordering on the accepted same-host DAC topology. Each phase includes its
  first pacing interval. Later deadlines use the previous actual start;
  saturation never gains fictitious catch-up throughput.
- Only measured primary/delay values enter the two unrounded u64 HFTBRW1
  series. Full phase clocks and raw series remain on the producing host.
- The fixed kernel ABI accepts the launcher's ten arguments. Before Session
  setup, each endpoint records its inherited CPUs and pins to the first one.
  This changes no NUMA policy. HP's native endpoints use CPUs 8 and 13.

The 29 pairs cover baseline zero/nonzero warmup on all four flows, four
separate 2 ms construction/serialization/extraction/post-completion probes
on every flow, the tick prepared-channel probe, and four runs with actual
mid-measurement bilateral TestRequest/Heartbeat exchanges. All Logons retain
HeartBtInt=30 and reset; every final wire Logout and complete SDK sequence
is checked. The source gate passes 195 tests and 24 refusal subtests; public
source scanning has zero findings. The expanded source gate with physical
identity and compact-result refusal controls passes 217 tests and 24 subtests.

## Retained refusals and shutdown correction

The initial HP candidate's old reader reported 21 successful pairs, but the
producer omitted the first pacing interval and some detached input bridges
panicked during concurrent shutdown. It is superseded, with its complete
working output retained. The second candidate repairs those issues and
passes 21 HP pairs, but predates the final wire Logout gate.

The third candidate preserves the actual shutdown traffic and first-CPU
identity. Its fourth pair (MD, warmup 3) exposes a missing client Logout
reply despite both processes returning zero. The fourth candidate's
server-first transport stop still loses that reply in its first pair. Both
failures remain at their original host roots; neither supplies report cells.
Obsolete SCAN jobs were stopped while queued, before any native work.

The fifth candidate requests shutdown through the Initiator Session's public
`AdminEnum::StopReq`, while leaving its original transport alive. The SDK
performs the Logout exchange. Only after the callback and the server's two
observed channels close does the caller stop the transport owners and save
final evidence. All 29 HP pairs then pass, including actual final Logout in
both directions, exact complete sequence counts and zero panic logs. No SDK
file or state machine is patched.

Each pair also refuses fifteen mutations of its actual collected output:
raw corruption/trailing bytes/magic, missing/repeated clocks, wrong clock
differences, phases, marker resets or pacing, changed sample/warmup counts,
owner sink/folds, capture bounds and premature timing promotion.

## Shared pins and host receipts

- Producer/native worker/reader: `ed54fbb0df48726cc7405a606f27a1e6e6ff488c`.
- Capsule: `~/.cache/libhft/fullbench-fixer-rs-timed-20261023-v5`.
- Input manifest: `51bd24fd2e7be5bc10c7353074d70417690008764d9d776b50e616ac3eda8f2b`.
- Executable: `fbe59557a908817f85504ad33a8c9ce2b6f6d4b25eb5a146b00520c5cd4401db`.
- Cargo.lock: `31b8a6a7414332893d645860f29e519402439be9847ee7ef4420a4c35d2d13ca`.
- Native worker: `2fe7ca4e628f0339f1d1cf760e088106b396ed590f80d6d9717b3f21c1070e2e`.
- Cold reader: `fd6fcd8d3a3e58e74f1ab978e02b214706a6586eaacc815fcc6e955abf513e0f`.
- Native receipt: `4dd4bff2b8e0f46025c9833e09295232d08812edbc0e159dd58ed1cc8941ea5b`.
- Bounded 300-file index: `e6f78a2496d837aba84d8c98ba2b909b8873605ac4b28eafb815ce53ef87f6b9`.
- SCAN native receipt: `64047c957dae2a394d4a194109f1f8063e49c2f6b27700074751e2d02a8a1867`.
- SCAN bounded 300-file index: `fde61344438802ec0e93222e5e735112f59c923d80e3e6749e59a6b1532d92a8`.

All 1,256 SDK files retain their exact bytes and mode 0444. Every non-root
dependency package remains identical to the original qualified lock, and
the three sealed writer/Session/prepared-channel executables retain their
original hashes. The new project uses its own binary name and reuses the
existing compiled dependencies. Rust/Cargo remain 1.92.0. Native work runs
under high-priority HP `isol`; the SCAN job uses normal-priority `shared`.

Working output stays below
`~/build/codex-fullbench/libhft/fixer-rs-timed-qualification-20261023-v5`.
The bounded local reviews are below `fixer-rs-timed-review-20261023-v5/{hp,scan}` in
that build root. No full raw/clock series is downloaded or copied into
`~/archive`. The physical collector uses the existing registered generation
helpers, an immutable `fixer-rs-callback-canonical` identity and quiet leases;
HP requests high priority. The original 10,000/s report contract remains.