# FIX8 original Session bounded preflight, warmup and measured phases — 2026-10-24

Both HP and SCAN pass the original SDK phase gate. Each host completes 35
real TCP pairs; the corrected independent cold replay accepts all original
wire/owner/clock/phase evidence and rejects 138 corruption controls. The source
suite passes 221 tests and five subtests, with zero selected skips. This is
functional qualification of the timed producer. It creates zero compact result
cells and grants no quiet physical, rate/stability or matched-comparison pass.

The preceding [clock](RECORD_2026-10-24_fix8_original_clocks.md) and
[cadence](RECORD_2026-10-24_fix8_original_pacing.md) gates also finish on HP;
both hosts now pass their original 23-pair matrices. Their old binaries and
receipts remain unchanged.

## Application and phase state

`fix8_canonical_timed.cpp` uses the original FIX8 Session, Connection,
MemoryPersister, generated canonical dictionary and supported callbacks.
`pm_thread`, TCP_NODELAY, ResetSeqNumFlag=Y, HeartBtInt=30, checksum/comp-ID
validation and disabled logging remain explicit. No original SDK source or
binary changes. Fresh original typed D/V/W/8 messages, full group traversal,
first-touch derivation, quantity clamps and the public fixed-scale fields
remain the previously qualified application work.

One uninterrupted original Session carries ten preflight cycles, the configured
warmup and the measured phase. A global task ordinal determines the phase;
logical business markers restart at one within each phase. Each phase has its
own extraction sink and counters. The original SDK send/receive sequence never
resets between phases. Fresh initial construction, parsed reactive work and
all final required reads/folds remain inside complete request RTT. Tick starts
at original encoded W transport entry and stops at the first instruction of
the original server D callback; full D validation/folding still follows.

Pacing uses the previously qualified closed-loop helper at 10,000/s for warmup
and measured work. Each phase includes its first 100 microsecond interval;
later deadlines follow the previous actual construction start. Only one task
is outstanding. Original start, construction, pre-serialization, prepared,
send, callback, read-end, primary-end, deadline, completion and probe clocks
are retained natively. Measured primary and scheduling-delay series must equal
those exact endpoint differences; prefix/warmup rows cannot enter either series.

## Bounded capture and original administration

The public Poco transport observer copies original encoded outgoing buffers
only through the final preflight application send. The original FIXReader
reads a complete frame before its `pm_thread` callback. That callback closes
incoming capture during the final preflight incoming message, before it can
send a response releasing the peer into warmup. Both directions must close at
global ordinal ten and before either subsequent phase begins. Every captured
original byte matches its peer's incoming stream; all ten typed callback bodies
match independently decoded canonical fields. Measured application frames are
not copied or formatted. In particular, acknowledgement extraction invokes
its post-fold timestamp before optional text, and text is disabled after the
prefix. The cold reader requires exact capture cardinality and closure clocks.

Both peers first exchange original TestRequests and matching Heartbeats. Six
separate measured-admin pairs interleave bilateral requests/echoes at the middle
of measured work. The passive peer issues its request through the original SDK
when the owner's measured request arrives; the original SDK emits the Heartbeat.
Actual admin send buffers, typed callback fields, SDK sequences, local completed
task counts and native timestamps must agree. No ResendRequest, Reject or
SequenceReset is permitted. Both original Logout frames and normal shutdown
remain required. Bounded original administration capture stays separate from
application preflight capture.

## Matrix, failure and corrected replay

Each host runs zero warmup, five warmups, an independent repeat and measured
administration on all four flows; four 2 ms clock probes per flow; a prepared
publication tick probe; and changed-book mixed/tick administration controls.
Measured samples are twelve per pair. This yields 925 owner clock rows,
420 exact primary values, 420 exact delay values, 2,326 total application
frames and 304 original admin frames per host. Only the ten-cycle prefix is
captured: 880 application frames over the entire 35-pair matrix. All 720 newly
compiled writer vectors and sixteen actual malformed CLI refusals pass.
The reader also validates every prefix/warmup/measured owner against the
independent common reference, including changed-book values and both clamps.

The first native wrappers finish all 35 child pairs with status zero and seal
their original receipts, then stop on an overly strong cold-reader assertion.
It incorrectly requires the peer's admin callback to precede the next task's
construction at the owner. An already-sent Heartbeat may be processed by the
peer after that construction starts. The valid bounds differ: the owner's
request/echo callbacks finish before its next task starts; the peer's callbacks
finish before that task's reply reaches the owner. Both remain interleaved at
the exact middle task count and original SDK sequence position.

The corrected reader adds four positive delayed-peer controls and eight
impossible late-callback refusals in the source suite. Its 138 altered-native
controls include those causal boundaries, original clock/sample corruption,
phase owners and marker reset, capture closure, well-framed wrong payloads,
SDK admin identifiers, cadence and false admission claims. They invoke the
semantic checker directly over altered actual output, so stale hashes cannot
explain refusal. Separate cold-replay services exit zero on both hosts with
MainPID zero. Neither native binary, native receipt nor original pair output is
rewritten; no native rebuild or pair rerun is performed. The original failed
wrapper statuses/logs remain retained.

## Provenance and limits

Native source: `575ef19936a9b635a18cff9f0d110923ef54a102`.
Corrected replay source: `2775dcc93c80e89d21c094d1e4082bb5d6156109`.
The sealed replay capsules preserve the original reference inputs and bind
the corrected reader/control/worker bytes separately. The cold reader checks
every original generated/build/run argument, selected ELF, actual mapped SDK
library, native receipt and file digest. Original SDK maps (715 HP / 707 SCAN),
all 302 source files and previous writer/Session executables remain unchanged.
HP uses an outer high-priority isolated functional lease on CPUs 8–17; SCAN
uses normal priority on CPUs 10–17 with shared work allowed. Neither is a quiet
physical-report lease. Slot/process/memory snapshots are retained before launch
and after the native lease is acquired, immediately before compilation.

Native roots: `~/build/codex-fullbench/libhft/fix8-timed-qualification-20261024-v1`.
Original capsules: `~/.cache/libhft/fullbench-fix8-timed-20261024-v1`.
Corrected replay capsules: `~/.cache/libhft/fullbench-fix8-timed-cold-20261024-v2`.
Raw owner/prefix clocks, phase anchors, admin clock logs, primary and delay
series stay on the hosts. Bounded wire/configuration proof, hashes and cold
decisions are collected; no raw clock series or empirical CDF is imported.

HP:

Native input manifest SHA-256: `5a7297bfeae038312e24894d8a9f84d85cb8a4ac2aadf1b990ffee5e8a1883dd`.

Native executable SHA-256: `5e492af32ae0dbf5ab77113c6b48b6f4fa95068cdf77a13f87dd4fb725d915a2`.

Native receipt SHA-256: `d4a838221bd075de50a97641000d81f6b6da53ee37a06c8ef8235a03c59c5060`.

Corrected replay input manifest SHA-256: `27eaa610ca42787e9775fd885cd4517ae157919e5c32cf1ba04a17aad8d060cf`.

Cold review SHA-256: `d2086571eaa40599b79ca27f6b74677c7512651524ee2b5f90397d7e6da93f79`.

Control receipt SHA-256: `ae901d123d05c9215d662e7133cacabdda67aef2ad021301169245fd446be912`.

Bounded review index SHA-256: `3fe384f2369535e98c3ba13ab33237b5154d26ea6880667644ab31716ae7e6c8`.

SCAN:

Native input manifest SHA-256: `99026f5615be08ad737977b08b671e29e41120ad284a9e4dca276f2d66e39dac`.

Native executable SHA-256: `32330f90efb68890060eb8c898753eb1a45b400e459423036d046c3014f8c97a`.

Native receipt SHA-256: `b07785a41679e3f82713fb11e1d5603113a139b33c78160e52139b7922902730`.

Corrected replay input manifest SHA-256: `023e3080f484816c00eb59da9f41426fd773bf4ac9ad7c5159e47b7277d76f33`.

Cold review SHA-256: `5da5383758ed91b778386df70a01a98ce7c81524b839ec2da7fa75526aa4bbd0`.

Control receipt SHA-256: `76e33e5d1ed34abf44bac3019f3aeb068f6bb40d44244b9af7311ef23a010549`.

Bounded review index SHA-256: `035a078d88f33540a443719777a39c502f6a240fbfe9e3c410a8d1b389d18f01`.

Next: qualify unchanged FIX8/Poco dependencies in a root-owned installed
runtime, including actual loaded paths; then run the required quiet DAC matrix
and independent physical replay before any compact result cell or comparison
is published. The original report-rate contract stays 10,000/s. The preserved
SDK's user-prefix RPATH requires explicit runtime qualification. Legacy shim
results remain separate and unchanged. Public-archive and release gates remain
independent of this native checkpoint.