# FIX8 original Session prepared/callback/RTT clocks — 2026-10-24

Both HP and SCAN independently pass the complete original Session clock matrix. This closes only the scoped native clock gate on each successful host.

The original SDK clock driver retains the previously qualified Session,
Connection, typed payloads, fixed-scale field extension, MemoryPersister,
`pm_thread`, validation, disabled logging and explicit administration policy.
It observes the original complete encoded buffer at entry to the public Poco
`StreamSocketImpl::sendBytes` hook, before the original TCP send. The first
instruction of the original business callback takes the native
`CLOCK_MONOTONIC_RAW` timestamp before locking or extracting application data.
No original SDK source, original SDK binary, preceding writer or preceding
functional Session binary is changed.

For NOS/ER, MD and mixed flows, the primary clock starts before fresh initial
construction and ends after every required final typed read and owner fold.
The mixed task includes initial request construction, full twenty-entry book
traversal, parsed first-touch derivation and final acknowledgement extraction.
The tick clock spans original encoded W publication to original server D
callback entry. Tick still performs every required order read/check/fold after
the stop timestamp. A separately observed read-end timestamp distinguishes
that work from the tick endpoint. Report text formatting follows the new
optional post-fold callback in the shared model; default functional behaviour
and every original typed callback value remain checked.

The fixed matrix uses 23 fresh real Session pairs, twelve cycles each: all four flows
with no injected delay and with construction, pre-serialization, extraction
and after-completion delay probes; a prepared-send tick delay; and the two
changed-book causal controls. Each 2 ms probe records its own actual begin/end.
The independent reader validates exact event association with original SDK
sequence numbers, actual original frames and typed callbacks. Every primary
sample must equal its original process-local endpoint difference. Construction
and pre-serialization work precede the prepared tick start; injected prepared
publication work lies inside the tick clock; final business extraction lies
inside complete request RTT and after the tick callback stop. After-completion
work lies beyond the primary endpoint. Missing, duplicate, reordered or
unconsumed events and falsely declared clock/physical grades are refused.

Per host this covers 276 exact primary values, 4,296 clock events,
696 application frames and 184 admin frames. The native process refuses eleven
invalid CLI selections. Fifty-one semantic controls alter the actual native
clock/sample outputs in memory and call the endpoint/body/owner checker
directly, so a stale file hash cannot explain refusal. They include shortened
RTT, late tick end, wrong sequence, changed prepared/publication endpoints,
raw values inconsistent with clock differences, and shortened/misplaced actual
probe intervals. Source tests separately cover wire/configuration/owner
corruption. Every successful new worker also passes all 720 freshly compiled writer vectors.

Native receipts seal every generated/build/configuration/wire/callback/clock
file; the cold reader checks the source/capsule/receipt chain, build/run argv,
compiler and ELF hashes, actual process maps, all 302 original SDK source files
and all selected installed SDK paths. Raw clock and primary sample series stay
on the hosts. Only bounded wire/configuration proof, hashes and cold decisions
are collected for review. This checkpoint creates zero result cells and no
empirical CDFs or ranking. Full tracing and functional leases preclude report
grade; warmup reset, bounded ten-cycle preflight, measured administration,
quiet physical DAC repeats and matched comparisons remain separate gates.

## Native provenance and scheduling

HP: 23 pairs pass, 51 altered-output controls refuse, and the service exits zero with MainPID zero. The outer high-priority isolated lease uses CPUs 8–17.

Source pin: `f8b9f7b393d63ca34721f221e22f0daba16f3d47`.

Input manifest SHA-256: `a6777b7fe40c1585269e774ee1e19ce868cbf3157f5d989ecae24b3bc99a1a34`.

Executable SHA-256: `19269bdbfcd7ac5450655857ff6634381f8430b743d2e39e42309f6ad755c4a4`.

Native receipt SHA-256: `06f2a72d9f1b1c3c02f6f180861221c10bd0046fff09f0ad38ef19c06f5abe5d`.

Independent cold review SHA-256: `77bd9a295ed27d6af72012fbbf76d5d8e7048e77beb3362f58f33105580a0dfa`.

Control receipt SHA-256: `bf382a95609c69f628b9c65728c934733b9970033f21c7edd704fff597fc261b`.

Bounded review index SHA-256: `63779cf4a5148dcfc0aa11f89c921ea0aca0640f2a4a0ee4c7f55fee84cf1345`.

SCAN: 23 pairs pass, 51 altered-output controls refuse, and the service exits zero with MainPID zero. The outer normal-priority isolated functional lease uses CPUs 10–17; concurrent shared work is allowed.

Source pin: `f8b9f7b393d63ca34721f221e22f0daba16f3d47`.

Input manifest SHA-256: `f2a7bdeca0e01f3e1b7dbe53419fb6eed3d6767ba871c5849289f74428372ea3`.

Executable SHA-256: `a9d2402f768f922e23e38d2d104122d38ee6dd795bce71d4583e7534627a210b`.

Native receipt SHA-256: `3bee83107db50ebcb47ad32777505191fa54f9be993d49efd3977e77491834f9`.

Independent cold review SHA-256: `5ae5951ea5dcc9a876ec09a45d241bd44e74d662471b8488647d8bc1593dfc39`.

Control receipt SHA-256: `e454ff9634ebd0c88f3b2c6b4a132f134a0aae1b81ee65d3955493535e22683c`.

Bounded review index SHA-256: `9049756349fe421eab2e1a64689a002cc13ba608762076bd6ff407e12f8bf7ea`.

Native roots: `~/build/codex-fullbench/libhft/fix8-clocks-qualification-20261024-v1`. Sealed capsules: `~/.cache/libhft/fullbench-fix8-clocks-20261024-v1`. SDK roots and every predecessor remain unchanged. No clock, primary or cadence series are imported to the website or local review.

The [separate actual cadence gate](RECORD_2026-10-24_fix8_original_pacing.md) builds on this clock profile. It does not replace the still-required warmup, bounded capture and measured administration qualification.