# FIX8 original Session actual-start cadence — 2026-10-24

Both HP and SCAN independently pass the original Session cadence matrix.

The separate `fix8_canonical_pacing.cpp` keeps the original production Session,
Connection, MemoryPersister, typed canonical payloads, public fixed-scale
fields, explicit validation/logging/admin flags and all required owner reads.
It adds `CanonicalClosedLoopPacer.h` around the outer one-outstanding-cycle
loop. The original SDK, generated dictionary behaviour and original wire
sequencing remain unchanged. The preceding qualified clock binary and its
receipt are hash-checked before and after the new worker, alongside the
previous writer and functional Session binary.

The target cadence is exactly 10,000 tasks/s. The first deadline is the native
raw-clock anchor plus 100,000 ns. Each later deadline is the previous actual
construction start plus 100,000 ns. The helper admits no second task until the
preceding task completes, refuses early starts and guards clock arithmetic.
The outer owner loop spins to the deadline, starts fresh construction, waits
for complete original callback work, then marks completion. Actual construction
start is the same timestamp used in the qualified complete-RTT clock; actual
prepared and callback timestamps retain the separately qualified tick span.
The cadence completion includes after-primary work before another task can
start. No phase reset or warmup is claimed by this small functional driver.

The independent reader first replays every original body, typed callback,
owner fold, SDK/admin/configuration value and clock endpoint. It then checks
every actual cadence row against those original construction/read clocks:
first anchor, actual-start deadline recurrence, nonnegative scheduling delay,
exact delay=start−deadline and previous completion no later than the next
start. Elapsed cadence includes the first interval. Construction, serialization,
extraction and after-completion 2 ms probes exercise real overruns without a
catch-up deadline series. The prepared tick probe retains its distinct start.
The native cadence and clock raw series stay on the host.

The fixed matrix contains the same 23 twelve-cycle pairs as the
[clock gate](RECORD_2026-10-24_fix8_original_clocks.md): four canonical flows
across five probe modes, one prepared tick case, and the two changed-book
causality controls. Every completed host checks 276 exact primary values,
276 actual cadence rows, 4,296 clock events, 696 application frames and 184
admin frames. All 720 fresh writer vectors and eleven actual malformed CLI
refusals pass. Seventy-five altered-native-output controls refuse: the existing
51 clock/sample endpoint corruptions plus 24 changes to first intervals,
deadlines, construction starts, completion/overlap and scheduling delays.
The controls call the semantic checker over altered actual output, bypassing
outer file hashes intentionally so hash mismatch cannot explain refusal.

The shared cold reader now has two explicit, closed native families (`clock`
and `pacing`); each requires its exact build/run command, ELF, actual mapped
SDK libraries and manifest identities. The normal clock family is preserved.
The focused source suite passes 149 tests and five subtests, zero selected
skips. Native proof remains separate from those synthetic reader tests.

This is functional cadence qualification with full bounded small-run tracing,
not a rate, delay, stability or latency ranking. It exports zero result cells
and no CDFs. The larger report producer still needs a ten-cycle preflight
whose copies close before warmup, zero/nonzero/repeated warmup state reset,
SDK sequence continuity across phases, measured bilateral administration,
complete raw sample/delay replay and quiet physical DAC repeats. Root-owned
FIX8/Poco dependency packaging and actual loaded paths must also qualify;
the preserved SDK’s absolute user-prefix RPATH cannot be assumed safe for an
installed generation. The report-rate contract remains 10,000/s.

## Native provenance and scheduling

HP: 23 pairs pass, 75 altered-output controls refuse, and the service exits zero with MainPID zero. The outer high-priority isolated lease uses CPUs 8–17.

Source pin: `c5cbdd85b831b2217983125d81f1a8fb991bf7d6`.

Input manifest SHA-256: `97e26173b51863494a340f6ce5d9479c6ab341df029759eed4169165d619b718`.

Executable SHA-256: `faa1b97e45e8fe861640f547a802523e9f8b3fa2c5919b05f019a508b78fc242`.

Native receipt SHA-256: `eb867d26005a6275072e66b1af8df8e43ece973290b452dbb921391f7976ef15`.

Independent cold review SHA-256: `94f8e94347f626fd3a8a8e867bf4b87460c841288df97f46446cb304499ed502`.

Control receipt SHA-256: `27114a1eff447a7036eb6690ae27fe658abe67fc19b48dcbc14a7fa516654a77`.

Bounded review index SHA-256: `f62013c153275fa24f1a2b7871724592a0cf3bf029952b917fdb86d36e17067b`.

SCAN: 23 pairs pass, 75 altered-output controls refuse, and the service exits zero with MainPID zero. The outer normal-priority isolated functional lease uses CPUs 10–17; concurrent shared work is allowed.

Source pin: `c5cbdd85b831b2217983125d81f1a8fb991bf7d6`.

Input manifest SHA-256: `d7344429239e431bee7f573b0e23d7e93596ff193cb9f230e9778b03a12ad842`.

Executable SHA-256: `8a20f5bd15206227b8e43b3152644e8ddaa4946d8dde5bfc8ef4ebe00615edc1`.

Native receipt SHA-256: `25c20bc19af1b16ff5be1353f735e0649c015804ba863d035ef7e98984e6509c`.

Independent cold review SHA-256: `fc82d47644f086ac58f9df715f182f51c9447692eea7186a7660ed4473cf1f47`.

Control receipt SHA-256: `39b27ba5fd07e52a3487976d580145e81340281a5f3de42963a1fe818ee80099`.

Bounded review index SHA-256: `be250ce7fb1f93a680e2efe0d0d114decf69f624959ce852d8cf7515d448766a`.

Native roots: `~/build/codex-fullbench/libhft/fix8-pacing-qualification-20261024-v1`. Sealed capsules: `~/.cache/libhft/fullbench-fix8-pacing-20261024-v1`. SDK roots and every predecessor remain unchanged. No clock, primary or cadence series are imported to the website or local review.