# Artio original SDK publication backpressure and prepared retry — 2026-10-25

Both hosts pass the sealed original Session/Aeron backpressure control and
independent collected replay. Each produces two genuine SDK publication
refusals, processes a real peer TestRequest and original automatic Heartbeat,
then re-prepares and accepts the same pending order at the next SDK sequence.
All 24 corruptions of actual output refuse per host. The complete Artio source
regression passes 416 tests with no selected skips. This qualifies the retry
primitive under an explicit diagnostic pressure configuration. It exports no
result cells and grants no measured-phase or physical timing admission.

## Published source and preserved parents

Source pin: `4696aec7b1a96d83e3a28e238d6ef005adb8269c`. New public Java tools under
`oss/benchmarks/cpp/fixbench/tools/open_source_fix_engines/java/`:
`ArtioPreparedOffer.java`, `ArtioPressureRuntime.java`,
`ArtioPressureTcpChannel.java`, `ArtioPressureTcpSupplier.java` and
`ArtioBackpressureProbe.java`. Independent readers:
`check_artio_backpressure.py` and `check_artio_pressure_native.py` under
`integration/benchmarks/open_source_fix_engines/`.

All 26 authenticated original SDK/runtime files and all 53 qualified parent
classes remain byte-exact before and after. The latter include the 32 numeric
codec/fixture classes, two typed Session, two finite clock, fifteen bounded
transport/control and two absolute-cadence classes. All ten new compiled
classes match between hosts. Original qualified runtime and producer sources
remain unchanged. The numeric/Session/clock/transport parents and
[absolute cadence gate](RECORD_2026-10-25_artio_original_cadence.md) retain
their separate receipts and grades.

Actual class-load captures bind the original Session, GatewayPublication,
default engine scheduler, default TCP supplier, dictionary, decimal and
Aeron Publication/Agent classes to their authenticated SDK JARs. Generated
business encoders/decoders bind to the qualified numeric classes. The new
helper/runtime/control classes bind to this campaign's separately compiled
output. No SDK implementation, private field, reflective extraction or
handwritten production frame is substituted.

## Explicit diagnostic pressure

The owned diagnostic runtime sets a 65,536-byte IPC term and a 4,096-byte IPC
publication window. It keeps the original sender-buffer limit and validation
policy. A public original-TCP wrapper temporarily returns zero writes; its
counter is treated only as a harness stall. After that stall is observed, the
public engine scheduler temporarily pauses the original Framer Agent while
retaining its original startup, work, role and close methods through the
default SDK scheduler. Original Session/Aeron publication still executes.

The controller requires actual `Publication.BACK_PRESSURED` (minus two) from
the original public Session buffer API, unchanged SDK sent sequence for every
negative offer, at least two milliseconds of sustained refusal and observed
paused Framer polls. Harness zero writes or deferred work are never counted
as SDK refusals. Capture is bounded at 240 applications per direction, with
the controller refusing more than 200 accepted orders. Every frame of these
small controls is therefore retained, including complete administration and
shutdown. This full capture and the fault controls are diagnostic overhead;
the runtime is not a performance profile.

The first development configuration stalled TCP only and reached the
application bound without sustained publication pressure. A later experimental
1,024-byte sender limit produced real refusals but prevented recovery. Both
failures remain retained. Restoring the original sender-buffer policy and
using the explicit public Framer scheduling control supplies the successful
configuration. No SDK or admission threshold is weakened to accept those
failed runs. An HP development transfer initially targeted SCAN; its original
development worker was restored byte-for-byte, with captures and SDK/class
files unchanged. Published-source staging uses an explicit host parameter.

## Real administration between refusal and retry

The original full dictionary validates startup Logon and bilateral
TestRequest/Heartbeat. Both actual SDK sequence counters reach three before
application work; the controller also waits for the original three-frame TCP
prefix to flush before closing the diagnostic write gate.

The client prepares and encodes canonical D messages through original public
APIs until publication refuses. After recording the unchanged sent sequence,
the server sends a real original TestRequest. The client releases both
diagnostic gates and polls until the original Session has accepted its
automatic Heartbeat and delivered the valid typed TestRequest callback.
The pending application's body and identity are unchanged.

`ArtioPreparedOffer` calls original `Session.prepare(header)`, generated
`Encoder.encode` and original buffer `Session.trySend` on every attempt. It
stamps `System.nanoTime` after serialization, immediately before publication.
It never reuses a serialized header across a poll. The real automatic
Heartbeat occupies the previously refused sequence; the same application
then appears once at the next prepared sequence. Failed offers leave the
SDK sequence unchanged. A future tick producer must use the accepted
attempt's prepared timestamp; a complete RTT must retain its task start
through retries. Those measured-phase integrations remain separate work.

| Host | Accepted D | Real refused offers | Refused sequence | Re-prepared retry sequence | Complete owner folds |
|---|---:|---:|---:|---:|---:|
| HP | 33 | 2 | 36 | 37 | 198 |
| SCAN | 28 | 2 | 31 | 32 | 168 |

Accepted counts depend on actual queue progress and are not cross-host
performance comparisons. Independent replay consumes every accepted/refused
attempt and every original TCP frame. It checks canonical D bodies, unique
identities, all six typed owner fields, contiguous original sequences, exact
admin identifiers, bilateral bytes, copy totals and original Logout. The
receiver sends no application response; this is neither a NOS/ER latency run
nor a new tick/RTT result. Deliberately induced slow-status transitions remain
visible and grant no future report-grade exemption.

## Native and independent refusal gates

HP uses high-priority isolated functional CPUs 8–12 / 13–17; SCAN uses normal
priority on 10–13 / 14–17. Slot status, running processes and memory are checked
first. Actual library, Framer, media-driver and background placement is
verified. Concurrent shared work is allowed, so neither run establishes a quiet
timing window. Both services finish success, status zero/MainPID zero.

The 24 actual-output controls reject false pressure counters, missing admin
advance, stale retry sequence, incomplete owners, grade/cell promotion, a fake
negative code, sequence advancement on refusal, duplicate identity, reordered
attempt clocks and passive offers. The final control repairs both peers'
captured final D plus FIX framing/checksum and byte receipts; replay still
rejects the duplicate identity. Forty-seven focused tests cover the cold
model and actual class-source/placement requirements; all 416 Artio source
tests pass. Separate fresh collectors bind each completed native receipt and
recompute its cold review exactly. No development run substitutes for this
sealed published-source campaign.

## Bounded provenance

Native capsule: `~/.cache/libhft/fullbench-artio-pressure-qualification-20261025-v1`.
Native output: `~/build/codex-fullbench/libhft/artio-pressure-qualification-20261025-v1`.
Collected reviews: sibling `artio-pressure-review-20261025-v1/{hp,scan}`.
Service: `codex-fullbench-artio-pressure-20261025-v1.service`.
Retained workers: `private/benchmarks/retained/artio_pressure_*_20261025.py`.
Runtime state remains working output on the original host.

| Receipt | HP SHA-256 | SCAN SHA-256 |
|---|---|---|
| Sealed inputs | `677275027811dca30b07c4a16fe81fdbc39e9865feeedfdae913ad154944816f` | `e9a282ddc3df3ab71ab37a4aa7b7c42aacefaa021a3a3b129cc4011c62e04fd6` |
| Native receipt | `7051a6ef7f3713f92ab8c14ad7eb73396fdb8e7e65e80d28e57abefae116e7bb` | `e2f21f32a461801ff027d763b558dadd966dfe88eab877eb2689b3dc76ccbe86` |
| Cold review | `00abc9a675f2b5ee9d783813c39ae034c0e580b8e501482c8f8604a440def8f0` | `2e2c45612b112a2c79982bb421b0fa27c3a349370a9e8347cedf8fc317f4c25e` |
| Actual-output refusals | `33a0fe1c33bcc2cdc11a6c32ea3106cead377546a25c751f0c015000442a5043` | `33a0fe1c33bcc2cdc11a6c32ea3106cead377546a25c751f0c015000442a5043` |
| Collected files | `91db65111814604a68d4d5c7d684db5d86b26d1d0979c3fb67a1e9eecdec8335` | `2352aa0fdad2b348cbb8c50baa016e68f963f485411dbe1ecfe9f56287521ea8` |
| Independent native reader | `4ca0f2b61471400fee371eb95874950d483433503655743d5d117b9b439e9e31` | `4ca0f2b61471400fee371eb95874950d483433503655743d5d117b9b439e9e31` |

## Remaining gates

A new phased producer must integrate this exact retry helper with bounded
preflight, zero/nonzero warmup, measured marker/owner/cadence reset, per-phase
administration, sample separation and shutdown. Diagnostic trace on/off and
the normal runtime configuration require their own controls. Runtime
generation/install qualification and fresh quiet physical DAC runs follow.
Original offered load, full report sample count, acceptance thresholds and
good result keys remain unchanged. No completed unchanged campaign is rerun.