# FIX8: immutable original-SDK runtime and physical DAC result admission

## Outcome

Both new FIX8 campaigns are complete. HP passes all four report flows; SCAN
passes NOS/ER and tick-to-trade. SCAN MD remains diagnostic because every
repeat misses 9,800/s; its mixed flow also exceeds the 100 µs scheduling-delay
p99 bound. These results preserve the original 10,000/s contract. No unchanged
runtime or physical campaign is pending, and no complete two-host FIX8 matched
comparison is admitted.

Each host finishes sixteen physical pairs: four twenty-sample functional
runs and three 10,000-sample runs per flow, with 1,000 warmup cycles and ten
captured preflight cycles. Both independent cold readers replay all 120,080
primary and 120,080 delay values per host. All original Session, body, phase,
owner-fold, clock, normal-user, namespace, actual thread affinity, loaded-library,
process-exit and physical-wire gates pass. Report failures never fill result
keys. The values below are median run percentiles and aggregate achieved rate.

| Host | Flow | p50 µs | p99 µs | Achieved cycles/s | Admission |
| --- | --- | ---: | ---: | ---: | --- |
| HP | nos_er | 40.140 | 45.838 | 9,904.99 | S5 pass |
| HP | md | 56.328 | 65.261 | 9,910.92 | S5 pass |
| HP | md_nos_er | 89.110 | 103.603 | 9,907.28 | S5 pass |
| HP | tick_to_trade | 34.381 | 40.250 | 9,934.71 | S5 pass |
| SCAN | nos_er | 63.428 | 80.647 | 9,991.15 | S5 pass |
| SCAN | md | 95.771 | 113.796 | 9,055.87 | achieved_rate_below_98pct |
| SCAN | md_nos_er | 176.148 | 212.516 | 5,219.66 | achieved_rate_below_98pct; scheduler_delay_above_interval |
| SCAN | tick_to_trade | 54.440 | 70.438 | 9,857.14 | S5 pass |

## Runtime configuration qualified before measurement

The [preceding bounded-phase producer](RECORD_2026-10-24_fix8_original_timed_phases.md)
is preserved unchanged. A separately compiled candidate adds the fixed root
entry's DAC argument interface and explicit first-CPU placement; the old
qualification argument interface remains available. Neither the SDK nor the
previous qualified executables are rebuilt or patched.

The fresh app links all six original SDK SONAMEs directly under
`--no-as-needed`, with transitive `DT_RPATH=$ORIGIN` and no `DT_RUNPATH`.
`libfix8.so.1`, `libPocoFoundation.so.112`, `libPocoNet.so.112`,
`libPocoUtil.so.112`, `libPocoXML.so.112` and `libPocoJSON.so.112` are copied
byte-for-byte beside it. Actual ELF dependencies, loaded mappings and build
IDs are retained. Both clean-environment relocated runs and the root-owned
installed entry map all six copies from that generation, while the original
user SDK prefixes remain present. The legacy indirect SDK RPATH resolves no
mapped SDK library outside the admitted generation.

Each host repeats the complete 35-pair clock/phase matrix on this new ELF,
then runs eight real root-entry DAC pairs: all four flows with zero and five
warmup cycles. Both finish 43 pairs, 516 measured primary and 516 delay values,
and 1,121 owner rows, with every phase sink and prefix replayed. All 138
altered-phase controls and 720 fresh writer vectors pass per host. Twelve
actual registered-root-reader missing/wrong-DSO bundle refusals and eight
malformed DAC CLI refusals pass. The installer validates data without running
payload code as root. The new candidate and all six payload copies are installed
through the existing one-time registered helper; app mode is 0755 and every
DSO mode 0644. No helper, sudo policy, registration input or deployed operation
snapshot changes.

The fixed DAC interface requires canonical business input, no injected delay,
10,000/s and the existing 90-second idle-bound token. It creates a fresh
normal-user `evidence` directory. Application waits remain bounded by 30
seconds, within that token, and the unchanged outer root launcher bounds the
whole command at 120 seconds. The independent qualification interface still
exercises all construction, serialization, extraction, prepared and post-end
clock delays plus measured SDK administration.

## Physical placement and provenance

HP uses Solarflare sfcB/server and sfcA/client, inherited masks 8–12 and
13–17, actual first CPUs 8 and 13. SCAN uses mlx5 mlxB/server and mlxA/client,
inherited masks 10–13 and 14–17, actual first CPUs 10 and 14. Every SDK thread
is observed on the selected first CPU. Actual namespace inode, executable path,
UID/GID/EUID and runtime maps are checked against the root-selected entry.

Both report campaigns hold `isol-no-shared`; HP requests high priority.
Slot status, processes and memory are checked first. Original physical port
counter snapshots and all asynchronous polling attempts are retained, and
both counters advance. The normal-user host observer records kernel, PCI NIC
and firmware before and after; both endpoints and phases agree. Raw series,
phase/admin rows and full clocks stay on the producing hosts. No host policy,
NIC setup or benchmark data is fabricated or changed.

## Independent compact admission and limits

A separately pinned admission process replays the original physical files,
recomputes percentiles/rates/dispersion, and refuses altered evidence without
stale-hash shortcuts: seven actual metadata mutations plus 72 actual body,
phase, owner, raw-value, clock, mapping and placement mutations per host. It
also rejects a well-formed but false empirical CDF point for each admitted
cell: 83 total refusals on HP and 81 on SCAN. The two initial physical readers
and both independent admission services finish successfully with MainPID zero.
No native or physical pair is repeated to repair the independent-reader binding
of preparation metadata.

Six committed cells use method `dac-canonical-preflight-v1`, flavour
`fix8+fixed-scale+memory-store+callback-tick+complete-rtt+first-cpu`, paced
kernel TCP at 10,000/s. They total 754,212 bytes. Each retains median-of-runs
summaries, an empirical pooled CDF bounded to 2,000 points per latency kind,
actual bounded preflight text and source/runtime/host/wire evidence hashes.
The full series is replayed where it was produced. Website generation exports
summaries and excludes these per-result CDF arrays from hosting.

The original upstream pin is `fd6a550685ed9addbdccb27e605eb11e5ff949e0`.
All 302 upstream source files, selected SDK bytes/modes and original qualified
binaries stay unchanged. The public fixed-scale field extension delegates
numeric conversion to the original SDK; its original maximum-precision format
disposition and the explicitly retained SCAN SDK preparation details remain
recorded in the [writer checkpoint](RECORD_2026-10-23_fix8_canonical_writer.md).
No extension-free writer, legacy configuration, other engine or language is
promoted. Wider-roster, every-flavour, QuickFIX anchors, llfix interoperability,
matched language and public archive/release gates keep their separate scope.

The focused source suite passes 303 tests with zero selected skips. The initial
unconfigured Python test invocation lacked the explicit benchmark input root;
the declared-input run and the complete focused suite pass. Physical/native
workers use immutable published source capsules and do not consume that local
invocation. No full CDF/raw series is uploaded to the website or OVH.

## Exact pins

| Item | Commit or SHA-256 |
| --- | --- |
| Runtime producer, independent gate and native worker | `4cc2e97387af29898dbf9480178ac0fd5acbeefc` |
| Physical producer and initial cold gate | `31d46d4053` |
| Independent physical admission, compact writer and preparation binding | `44caa9edba` |
| HP runtime input manifest | `4ff1fc1115c47b12131bd619db93fbf95a2fb55925027f6d10b4fa19a1ac3d71` |
| HP candidate executable | `d9b4cdb5d5047c314055b55802164b497d14218cf056a36f49f2b5728e7eb026` |
| HP installed generation | `183bc0310fc96c755333bc47888447d3bcfe9c30eae8fa44e9e88ae5f5e066ab` |
| HP runtime native receipt | `4ab2d45706c29dfd0810c5b5a93be588c337e675c20108202d8c738b2c95a0df` |
| HP runtime cold review | `19dcfb4c506ccbf1ca300f03e1126f5e94175226ec671551296f7a991e6d4645` |
| HP physical input manifest | `1937935cc770f1d8e6a5ea99144f74b0fbc33f90a50b12329e59ae37ff7819a6` |
| HP completed campaign | `978836623cc652256a794cfe4515da76fb27d1031ae613ce6e8d5b690ad21960` |
| HP admission input manifest | `5774852664365297785c34bd0aa3c9a08d699e7a7b0f441400a00173d91d658b` |
| HP independent physical replay | `f54d3d6bacaf2c7ed97652739ff5ab22db8d3b8f386ad967cc6a4208d55c39c9` |
| HP result admission | `6ad050624c72d11caf85d78304b93d3b62f022695f357a283da64fca559518de` |
| SCAN runtime input manifest | `4e8d2aff380e12e6fdeb97e23f67daa79cb6e26ffc78d589b500a0600b482c3b` |
| SCAN candidate executable | `58a0906206e7ac339f7ee4c6200a1085d11257da75d9ff495dfe788300d7c8f0` |
| SCAN installed generation | `64d6cced174c69bc1cb08b895b8d3c69e7f74cefd258915facf5b76c5d7535c2` |
| SCAN runtime native receipt | `58b60be1690c6120432f282a49c94297276a458f30eacd227efaf84841854723` |
| SCAN runtime cold review | `1a575d0547fed545b25ab2c2d6b89cfffad5771411fc981b25cf2bd82da0b9cc` |
| SCAN physical input manifest | `9bbe6ba2529c461c9ca2b621d42b2f5a0485ddf1154106662175ed26cefe5d34` |
| SCAN completed campaign | `8e9ac8576ca1fd71190793923dad9337fd4283998207e4769e612e72ee810063` |
| SCAN admission input manifest | `b9e051936a63f4f5ab44ca4e315edcafa7c42fedf7631a9e19038209b0d4ce6e` |
| SCAN independent physical replay | `2e05bc8982ff751670245e2d537981eade11db9e9064fdf9d903252cb782f922` |
| SCAN result admission | `d4efcf63c4ded8e7261e44ff1f408388d52fc9ecf3af04924f556a4009e31c79` |

Runtime working roots are `~/build/codex-fullbench/libhft/fix8-runtime-qualification-20261024-v1`;
physical roots use `fix8-physical-qualification-20261024-v1`. Bounded collected
reviews are `fix8-{runtime,physical}-review-20261024-v1/{hp,scan}`. Services
are `codex-fullbench-fix8-{runtime,physical,admission}-20261024-v1`. All finish
successfully. No evidence is copied to `~/archive`; no run folder is deleted.