# Artio bounded original TCP and administration callbacks — 2026-10-25

Both hosts pass fourteen real original-SDK Session pairs, with zero, bounded
and full transport capture. Each completes 864 application frames and 112
administration frames. Nine compiled channel controls, eleven actual CLI
refusals and 32 actual-output semantic refusals pass on each host. Collected
independent replay agrees exactly with both native reviews. This closes the
bounded transport and SDK administration gate. It exports no result cells
and grants no pacing, measured-phase or physical timing admission.

## Source, unchanged parents and transport policy

Published source pin: `7c4cd0a3978a5943f63d2c7339c2a13072c0f9ba`. Public sources under
`oss/benchmarks/cpp/fixbench/tools/open_source_fix_engines/java/` are
`ArtioBoundedTcpChannel.java`, `ArtioBoundedTcpSupplier.java`,
`ArtioTimedRuntime.java` and `ArtioBoundedTransportProbe.java`.
The independent readers are `check_artio_bounded_transport.py` and
`check_artio_bounded_native.py` under
`integration/benchmarks/open_source_fix_engines/`.

The new owned runtime/supplier retain the authenticated original owned
runtime/supplier sources with type identifiers changed. Source checks guard
the original default TCP delegate, SDK validation and startup policy.
The original harness sources and adapter JAR are unchanged. Original SDK
Session, dictionary, generated numeric business codecs and administration
decoders remain responsible for production protocol behavior. All 26 original
runtime files and all 36 previously qualified codec, Session and clock classes
remain byte-exact before and after. All fifteen new compiled classes,
including the channel control fixture, match between hosts.

The [numeric codec](RECORD_2026-10-25_artio_canonical_writer.md),
[typed Session](RECORD_2026-10-25_artio_canonical_session.md) and
[prepared/callback clock](RECORD_2026-10-25_artio_original_clocks.md)
qualifications retain their separate scopes and receipts. This probe introduces
no new timing authority and does not grade historical v10 performance.

## Bounded capture and complete Session authority

Each flow runs 24 canonical cycles with capture budgets zero, twelve and 120;
two additional mixed/tick pairs exercise changed books and both quantity
clamps with budget twelve. The per-direction application budget accounts
for mixed's two messages per cycle. Actual stream framing validates FIX
prefix, BodyLength, checksum and message type. Once the application prefix
is complete, the delegate and scalar whole-connection byte count continue,
while buffer duplication, byte copying, framing and consumer calls stop.
Zero budget allocates no capture storage. Copy counters measure bytes actually
read, rather than the size of a surrounding receive buffer.

Zero, prefix and full modes retain identical complete owner sinks and bilateral
whole-connection byte totals for each flow. Full capture independently binds
the totals omitted by prefix/zero capture. Complete typed owner checks cover
all 24 cycles even when only twelve cycles are copied. Captured prefix frames
still pass exact canonical body, numeric presentation, groups, correlation,
sequence, timestamp-window and opposite-peer byte equality checks.

The original full dictionary's actual callbacks validate Logon HeartBtInt=30,
reset mode, bilateral TestRequest/Heartbeat identifiers and Logout.
Original SDK sequence deltas independently count outgoing administration:
last sent sequence minus accepted application messages equals four.
Incoming SDK sequence likewise equals received applications plus four.
The four actual admin callbacks per direction agree with full wire capture.
Server disconnect reason is LOGOUT; the client can observe REMOTE_DISCONNECT,
so disconnect reason alone is not treated as Logout authority. Additional
connections close their rejected delegate and leave a sticky failure.

## Actual native and refusal checks

Nine compiled channel controls exercise zero I/O and zero-budget delegation,
selector/sequence/replay/close forwarding, coalesced prefix capture, a large
receive buffer with only actually received bytes copied, one-byte fragmented
frames, partial writes, sticky checksum/partial-close failures, ignored partial
tails after capture closes and rejected extra connections. These use a
controlled original TcpChannel API delegate and claim no SDK Session pass;
the fourteen separate real pairs establish that pass.

The 32 semantic controls alter actual captured output: sixteen observation,
sequence, owner or grade claims, nine capture statistics, three false budget
claims, three well-framed mirrored prefix bodies and one repaired pair of
uncaptured byte totals. Full-mode comparison refuses the last corruption even
when its zero-capture pair is internally plausible. Semantic controls repair
framing or paired counts where needed and do not rely on a stale outer hash.
Eleven malformed CLI processes refuse before runtime startup. The focused
source suite passes 292 tests with no selected skips.

HP uses a high-priority isolated functional lease on CPUs 8–12 / 13–17;
SCAN uses normal priority on CPUs 10–13 / 14–17. Slot status, running processes
and memory are checked before work. Effective library, framer, media-driver
and background affinity is checked. Concurrent shared work is allowed for
these functional gates. Both services finish success, status zero/MainPID zero.

An initial publication check correctly refused adding a new live Java control
to the fixed 1,600-file historical fixture snapshot. The unpublished fixture
was moved to its own retained directory; the snapshot and required count were
preserved, and publication checks subsequently passed. Development runs
remain ungraded and are not substituted for this sealed source campaign.

## Bounded provenance

Native capsule: `~/.cache/libhft/fullbench-artio-bounded-transport-20261025-v1`.
Native output: `~/build/codex-fullbench/libhft/artio-bounded-qualification-20261025-v1`.
Collected reviews: sibling `artio-bounded-review-20261025-v1/{hp,scan}`.
Service: `codex-fullbench-artio-bounded-20261025-v1.service`.
Retained workers: `private/benchmarks/retained/artio_bounded_*_20261025.py`.
Live Java controls: sibling
`artio-bounded-channel-controls-20261025/ArtioBoundedChannelControls.java`.
Runtime state remains working output on its original host.

| Receipt | HP SHA-256 | SCAN SHA-256 |
|---|---|---|
| Sealed inputs | `3ebc82658e84e12bd9e4147c52838eba3ab18f8c78be389d05386bd966667499` | `e980ba729dd119c3ccf77175089cab83083be9b13af6a1c3a86e729f463f9bf8` |
| Native receipt | `e0242df1cb85d8777fea0cfd0de9ebb7c5b23c8ef513949ff96f26b6f5b6c86e` | `b6c93c353d0497f790905cf24afc092124c1387422b360601ebf9f7272977336` |
| Cold review | `403b12e20604aed5582c4b0b14de6e6c2cc654f878d0d228680fbf33e9d23c0e` | `75c8dc9e3be7630958885d46f9fb41c2e9be2d0885e7b1fb8d9f37cc00656b07` |
| Actual-output refusals | `a577f6f5f8bdc4715fa378c38ff1ac6d3918425fa1920d8a4f6dfd4b44f7e7b8` | `db7280c5bbf5ee7bf652896c84b6b1e00b412b16cef5916acce0f79779f0875c` |
| Collected files | `4abdbf6b021fbb2c8b27f3cce5ad1a7cde7afe2119dc2f8b4ca48f8539f7ed7f` | `7b0623bad2de0f268f429f99e9c9e1f3bddce30394c85bbd4b6d0bd6b8373eca` |
| Independent native reader | `3e9a896762a9eb755973874518169af03542f964187655c89d3415f767e2cf3b` | `3e9a896762a9eb755973874518169af03542f964187655c89d3415f767e2cf3b` |

## Remaining gates

Explicit pacing and scheduler-delay measurement, zero/nonzero warmup with
measurement reset, measured administration/shutdown and a general original-SDK
backpressure policy remain to be qualified. Runtime generation/install and
fresh quiet physical DAC collection follow those gates. Original offered load,
report sample count, thresholds and good result keys stay unchanged. No
unchanged historical Artio, FIX8 or other completed campaign is rerun here.