Reflect inbound OnBehalfOfCompID (115) into outbound DeliverToCompID (128) on responses — per-session config flag (OCX US-equity cert)

[seprov]

Summary / request

OCX (OneChronos) has a US-equity certification client — Themis via Flextrade, session CompIDs CGXS / CGXSFC49 — that requires: when the subscriber sends tag 115 OnBehalfOfCompID on orders, our responses must populate tag 128 DeliverToCompID with that value. This is the standard FIX on-behalf-of routing reversal, and it already works in UAT/Prod — it has simply never been exercised in cert, and the cert engine does not reflect it today.

Example from the client's session:

• Order (inbound): 8=FIX.4.2|…|35=D|115=VERT|49=CGXSFC49|56=CGXS|…
• Our ack (outbound, current): 8=FIX.4.2|…|35=8|49=CGXS|56=CGXSFC49|… — no 128
• Desired ack: same, plus 128=VERT

Root cause

The plumbing already exists; only the inbound capture is missing:

• The outbound header builder already emits 128 from engine state — h_deliver_to_comp_id = engine.fe_deliver_to_comp_id (src/fix_engine_utils.iml, create_outbound_fix_msg).
• Business responses (ExecReport 35=8) go through that same builder — src/fix_engine.iml, IncIntMsg_ApplicationData branch.
• But fe_deliver_to_comp_id is statically None (state init; config default), and nothing captures the inbound order's 115 — so we never emit 128.

Proposed change

1. Reflect inbound on-behalf-of routing onto responses. In the inbound application-message handler (src/fix_engine_transitions.iml, run_active_session, Full_FIX_App_Msg branch — where we already read the order header), set:

   fe_deliver_to_comp_id = m.full_msg_header.h_on_behalf_of_comp_id;
   (* and, for full standard reversal: *)
   fe_on_behalf_of_comp_id = m.full_msg_header.h_deliver_to_comp_id;

   Captured per inbound message, so it is correct even if 115 varies per order. The header builder already emits the field — no change needed there. (This is an engine/header concern, not an IPL-model change: the model produces the message body, the engine builds the header.)

2. Gate behind a per-session config flag (extend the existing engine comp-id config, e.g. the on_behalf_id slot).

   Why a flag: it is being added specifically to satisfy this OCX request. It is gated only because we are not yet sure about enabling on-behalf-of reflection for all consumers. If/when we decide to roll it out generally, the flag can be removed and the behavior made the default — the config is a deliberate, removable stopgap, not permanent surface area.

Downstream / deployment (out of scope for the engine PR, tracked elsewhere)

• Rebuild the US-equity cert expected-output message set to include 128 on the relevant acks (the OCX "curated" cert pack). This will be done mechanically as part of the test-runner upgrade process (tracked separately).
• Rebuild the cert engine image and bump the session's sessionImageTag.

Notes

• Behavior matches existing UAT/Prod.
• Requested by OCX via the imandra-onechronos channel for the in-progress US-equity certification.