# FIX8 original production Session functional qualification — 2026-10-24

Both HP and SCAN pass six real original-SDK Session pairs each for the separately declared
`fix8+generated-canonical+typed-fixed-scale-fields+thread+memory-store`
configuration. The independent cold reader checks all four canonical flows,
changed-symbol/first-touch controls, complete owner sinks, actual transport
bytes, original SDK sequencing and administration on both hosts. SCAN uses
a separately declared isolated functional CPU profile alongside existing
shared work. This checkpoint grants scoped Session functionality only. Callback/prepared clock, warmup/pacing, timing,
physical DAC, matched comparison and public-archive admission remain open.

The preceding [two-host writer/parser gate](RECORD_2026-10-23_fix8_canonical_writer.md)
also completes its SCAN replay and 36 corruption controls. Its original numeric
formatter differences remain explicit, with fixed-scale admission separate.

## Original implementation and causal work

HP source pin: `325a24f923b11d3f0aa534e04927f4525f25ed26`.
SCAN source pin: `2ed86153f14f9bfb337f81bda1c428be4ac0d341`.
All nine selected public driver/model/dictionary/shared-fixture inputs are
byte-identical across capsules. SCAN's worker adds the explicit CPU-pool
declaration and a fresh output root; the SDK and C++ driver are unchanged.
The adapter instantiates the original FIX8 `Session`, `ClientConnection`,
`ServerConnection` and `MemoryPersister`, with original `pm_thread` processing.
Its application overrides the supported Session callbacks; it supplies no
replacement framing, parser, sequencer, heartbeat service or Session loop.
The original SDK's 302 source files and the prior qualified SDK/executable
remain unchanged. The shared fixed-scale field helper is extracted without
changing its arithmetic; a fresh 720-vector native writer replay passes too.

Each new `35=V` carries the cycle marker, symbol and depth. The server extracts
all request fields and group entries from the SDK object, and creates a fresh
snapshot from that request. The client reads every snapshot entry and folds the
complete MD owner contract. Reactive orders use the parsed marker, symbol,
side-selected first touch and clamped size. Each acknowledgement is built from
the parsed incoming order. Client acknowledgement validation and owner folds
read all required fields through the original typed SDK getters. One cycle is
outstanding at a time. Functional callback traces are reconstructed from the
actual received SDK objects and checked against independently decoded bytes.

The two changed-book pairs use symbol `ALT1`, bid/ask `123.45001`/`123.46001`,
and touch sizes 7/6,000,000. Odd-cycle buys must use the ask with quantity
5,000,000; even-cycle sells must use the bid with quantity 100. The mixed pair
traverses all twenty entries as well as deriving the order. The tick pair uses
two entries. These controls exercise causal values, both quantity clamps and
five-place numeric precision; a constant reply cannot satisfy them.

## Transport, administration and lifetime

A public Poco `StreamSocketImpl` subclass delegates scalar sends/receives to
the original Poco implementation. It records the actual bytes passed through
that path. Both peers' entire outgoing streams match the other peer's received
streams byte for byte, including Logon, TestRequest, Heartbeat and Logout.
The original SDK receiver/framer supplies the business callbacks. Each original
SDK send call carries one FIX frame; receiver read counts may vary with TCP
segmentation. These full functional captures are separate from future bounded
preflight capture and timing instrumentation.

The initiator/acceptor explicitly initialise the SDK login parameters:
HeartBtInt=30, ResetSeqNumFlag=Y, checksum verification and comp-ID enforcement
on, permissive mode off, and `always_seqnum_assign=false`. The last value is
explicit because this upstream pin leaves its default member uninitialised.
Both TCP sockets verify `TCP_NODELAY` after original connection startup.
Session/protocol loggers are absent; the public global logger API disables
all levels and gives each process its own runtime path. SDK service threads
and persisters retain their original implementations.

Each peer issues its own TestRequest and requires the matching original SDK
Heartbeat response. Logon, all administration and the final SDK Logout are
independently checked. The pinned SDK's default Logout callback has its reply
commented out. The adapter's supported callback invokes the original handler
and synchronously sends the original generated reply before returning under
`pm_thread`; original `Session::process` then stops the connection. The main
thread uses the original connection join before destroying its owned objects.
No SDK source or shutdown loop is modified.

## Qualification and provenance

| Host | Native pairs | Native / cold result |
|---|---|---|
| HP | 4 canonical + 2 changed, 12 cycles each | all six pairs and 9 actual CLI refusals pass; cold replay and 56 altered-evidence refusals pass |
| SCAN | 4 canonical + 2 changed, 12 cycles each | all six pairs and 9 actual CLI refusals pass; cold replay and 57 altered-evidence refusals pass |

HP's high-priority `isol` foreground lease covers all compiles and child
processes, inherited CPUs 8–17, normal UID/GID 1000. SCAN uses a normal-priority
`isol` lease on CPUs 10–17 while shared work runs concurrently. Its worker
refuses an undeclared CPU mask before compilation. Each host's cold reader
verifies 192 application and 48 admin frames across 72 cycles, all typed callback
identities, and the same six independent owner results:

| Flow / variant | Owner sink | Folds |
|---|---|---:|
| NOS/ER canonical | `99d1f2024751c829` | 144 |
| MD canonical | `754e4f2b37d04e0d` | 756 |
| Mixed canonical | `1ef397c04e9c595a` | 900 |
| Tick canonical | `f0775b91b2ed21d3` | 60 |
| Mixed changed | `8036bc6a64ee276a` | 900 |
| Tick changed | `ed80b91dacd4528b` | 60 |

All selected SDK paths (715 HP / 707 SCAN), 302 original source files and
the previous writer binaries/receipts remain unchanged. Native build/run argument selection, compiler, actual
loaded SDK library, generated sources and executable hashes are checked. The
focused source suite passes 68 tests and five subtests, zero selected skips.

HP executable SHA-256:
`bb06cda9fee97ab22177d9b1f17bff54d871e79a0b7602f85cb7f4146e5eb836`.
Native receipt SHA-256:
`c91ebbdc96f6144df82721e0126c2abd95e2cb47820d1b3b6b9fa0fe3639ac78`.
Bounded review-index SHA-256:
`e63c27957e6a77fc6084879f313434d2d2ce6686e10ccf1c0883d93b7a00e8b0`.
Cold-control receipt SHA-256:
`10809d652592b7c0ff0dad8c847bedbb010e3f1a518cb3ee8c842f36b0f5f992`.
HP input-manifest SHA-256:
`e49d92fb651fd0dd05889a9ae23a8420f36f476ea9d89597ef9488d32688475b`.
SCAN completed v3 input-manifest SHA-256:
`0e5c5523cafa074ba91bf747e26441e63a88b3150cb1426edd022750c7c8af60`.
SCAN executable SHA-256:
`70ce37b9e12f5def2a5439f6a6c7d40750c17a33ccb73714f89ffb789085585e`.
SCAN native receipt SHA-256:
`0565216b1104ec5d919b2b951330cb3a19da3bfde9e1aa7d1f0a79a470d06475`.
SCAN review-index SHA-256:
`a62d53e891629ff9b4fedaf50b2e0600780d72ba20cdb599df43156f8c834064`.
SCAN cold-control receipt SHA-256:
`1280e1631e4bfbd00b9eca988fd75c87527a311c99832ceed9e74c3d67280c9a`.
The independent replay/control source is `2ed86153f1`; the original HP
56-control receipt is preserved. SCAN adds one explicit CPU-pool corruption
refusal to that set.

The 56 HP / 57 SCAN controls alter actual retained files and recompute both the nested native
file receipt and outer review index. They cover well-framed wrong prices,
quantities, depth, group side/size, symbol, acknowledgement status, Reset and
heartbeat correlation; typed callback corruption; owner/configuration claims;
SDK/source/loader/executable identities; command selection; and false timing/
physical claims. Semantic refusal cannot rely on a stale outer file hash.

## Failed candidate, retention and remaining work

HP's first generation preserves a compile-only ambiguous `SessionID` overload
failure before any Session pair. The corrected generation uses explicit public
SDK field types. SCAN's first generation was stopped while queued, before a
build root existed. SCAN v2 is also stopped while queued, before creating a
build root. When its isolated pool becomes available, v3 explicitly selects
that functional CPU profile and leaves other sessions' shared work running.
No failed candidate, old SDK or old writer is overwritten. Both completed
qualified services have exit status zero and MainPID zero.

Native working roots use
`~/build/codex-fullbench/libhft/fix8-session-qualification-20261024-v2` (HP)
and `-v3` (SCAN). Sealed capsules use the corresponding
`~/.cache/libhft/fullbench-fix8-session-20261024-v2` / `-v3` names.
The bounded local HP review contains 103 files, 2,010,750 bytes before its final
native receipt/index. Original normal/failed native outputs remain on HP and
SCAN in this session's build roots. These are functional captures and contain
no timing sample series or empirical CDFs.

Next: qualify actual prepared-buffer/callback and complete RTT boundaries, warmup, pacing and measured admin controls before
any new physical DAC collection. The original 10,000/s report contract remains
unchanged. This gate exports zero result cells and grants no latency ranking,
physical report-grade pass or matched comparison. Legacy shim diagnostics keep
their original source, configuration and grades.