# Artio original absolute cadence and clock qualification — 2026-10-25

Both hosts pass 35 real original-SDK Session pairs. Each retains 2,112
application frames, 280 administration frames, 14,814 clock events,
840 exact primary differences and 840 exact scheduler-delay differences.
Fourteen actual CLI processes and 24 corruptions of actual output refuse
per host. Independent collected replay agrees with native review. This closes
finite cadence qualification. It grants no warmup/measurement phases, general
backpressure, runtime install or physical timing admission and exports no cells.

## Source and unchanged parents

Published source pin: `97b77771a30b4d8e94b61840a018e426fdba16c1`. Public producer:
`oss/benchmarks/cpp/fixbench/tools/open_source_fix_engines/java/ArtioCanonicalPaced.java`.
Independent readers: `check_artio_canonical_pacing.py` and
`check_artio_pacing_native.py` under
`integration/benchmarks/open_source_fix_engines/`.

The producer combines the independently qualified original numeric business
codecs, public prepared-frame APIs and bounded transport. The actual original
SDK owns Session state, header preparation, serialization/publication and admin
protocol. There is no local SDK patch, reflective extraction or handwritten
production envelope. All 26 original runtime files and all 51 qualified parent
classes remain byte-exact before and after. These comprise 32 codec/fixture,
two functional Session, two finite clock and fifteen bounded transport/control
classes. Both new producer classes match between hosts. Actual class-load
captures bind all loaded codec, original dictionary, SDK, owned transport,
runtime and thread-placement artifacts to their authenticated sources.

The [bounded original transport checkpoint](RECORD_2026-10-25_artio_bounded_transport.md)
and its numeric/Session/clock parents retain their original grades. The new
producer reuses the qualified bounded runtime and ordinary SDK TCP delegate.
Each direction copies only twelve application cycles, twenty-four messages
for mixed. Complete typed owners and SDK admin/sequence authority continue
after copying/parsing stops. No historical v10 timing is rerun or promoted.

## Absolute cadence and exact clock boundaries

Completion schedules the next owner task. Only the library poll loop checks
its deadline and constructs its initial message; callbacks contain no pacing
wait or next-task construction. Due times equal the initial epoch plus
`(cycle - 1) * interval`, using checked arithmetic. Completion time never
replaces the epoch. Actual task start occurs after the deadline and before
construction. Every retained scheduler-delay value equals that start minus
its original deadline, without clipping, omitting or subtracting lateness.

Each of the four flows runs no-pacing, 100 microsecond and one millisecond
cadence. Each also runs separate scheduler, construction, serialization,
extraction and after-completion probes at 100 microseconds. Tick has a further
prepared-publication probe. Changed mixed/tick pairs retain decoded symbol,
price and both quantity-clamp checks. These finite diagnostics do not establish
report-grade offered-rate or latency acceptance.

The scheduler probe stalls the poll owner for at least two milliseconds at
cycle seven, before task start and construction. It lies outside primary
timing and inside exact scheduler delay. Subsequent due times keep the same
epoch, including when the owner is late. Construction/serialization probes
lie within complete request/reply, before prepared tick start. RTT stops only
after complete typed reply reads and folds; tick stops at the first D callback
instruction, before extraction. Prepared tick starts after original SDK
encoding and immediately before the accepted publication path, including
diagnostic trace/probe overhead. Extraction is therefore inside RTT and
outside tick. After-completion probes remain outside both primary spans.
Every primary sample is independently recomputed from its actual clock events.
Both JVMs use one host's monotonic clock; no cross-machine subtraction occurs.

## Startup race found and corrected

The first sealed campaign, at source
`c0f2ebde51423163ff343f052beefc9e0c0ec588`, failed independent replay on
both hosts. The original SDK could publish the first server tick W at sequence
three before answering the peer's initial TestRequest. Its Heartbeat then used
sequence four. The reader required an administration prefix and correctly
refused that unsupported ordering. The original v1 outputs and failed services
remain retained; none is graded or substituted into the corrected campaign.

The corrected producer records an explicit startup event inside the original
administration callback once Logon, incoming TestRequest and echoed Heartbeat
are all validated and both actual SDK sequence counters equal three. Application
scheduling waits for this event. The event is recorded in the callback so a
batch containing the next application cannot skip a transient sequence-three
condition between poll calls. Independent replay requires the original three
admin frames before applications, startup before application delivery and the
owner epoch after startup. No original SDK frame, sequence or validation is
replaced. The revised real SCAN changed-tick/scheduler development control and
77 focused tests pass before the new sealed campaign. The complete revised
source regression passes 369 tests with no selected skips.

## Native and actual-output gates

Each pair retains canonical prefix framing, BodyLength/checksum, exact numeric
presentation/groups/correlation, bilateral capture bytes and complete owner
sinks. Sequence deltas and actual typed admin callbacks retain four outgoing
and four incoming admin messages per role, with bilateral TestRequest echoes
and original Logout. Complete whole-connection byte counters match opposite
peers after capture stops. Role CPU and class-load checks pass for all pairs.

The 24 actual-output refusals cover nine missing clock events, both raw series,
relative deadlines with repaired delays, four scheduler-boundary corruptions,
both moved extraction stops with repaired primary samples, both passive series,
a short prepared probe, duplicate event, altered cadence metadata and a wrong
application sequence after prefix capture has closed. They do not rely on stale
outer hashes. Fourteen malformed CLI processes refuse roles, flow, samples,
variants, port, output, capture budget, interval and probe settings before
runtime startup.

HP uses a high-priority isolated functional lease, CPUs 8–12 / 13–17; SCAN
uses normal priority, CPUs 10–13 / 14–17. CPU-slot status, running processes and
memory are checked first. Library, framer, media-driver and background placement
is verified. Shared work may coexist, so these runs provide no quiet timing
window. Both services finish success, status zero/MainPID zero. Both collected
reviews independently recompute the native review and agree exactly.

## Bounded provenance

Native capsule: `~/.cache/libhft/fullbench-artio-paced-20261025-v2`.
Native output: `~/build/codex-fullbench/libhft/artio-paced-qualification-20261025-v2`.
Collected reviews: sibling `artio-paced-review-20261025-v2/{hp,scan}`.
Service: `codex-fullbench-artio-paced-20261025-v2.service`.
Retained workers: `private/benchmarks/retained/artio_pacing_*_20261025.py`.
The corresponding v1 capsule/output/service retain the failed startup campaign.
Runtime state remains working output on its original host.

| Receipt | HP SHA-256 | SCAN SHA-256 |
|---|---|---|
| Sealed inputs | `fe2db4ef48a4dafec081c7849d66a34cb496f03855985e9ff5846586b0ba094e` | `708049c7453d7a9f2d49e147de8fbf37b669ca31b9bd50d54278886af06ce6f6` |
| Native receipt | `f7a28ddb3f4e88ccbbe1431224ecaa50f03cbee33380ceb2a59c8ab19914c453` | `0db6ebb40c2f3324a2e20e51e492636b8bdbac32e2396b3f549f796b3f290e39` |
| Cold review | `7683dea4f1ebb10c5f9fcc3ef73c88863be17aa278e4c4104d7df46777171bee` | `c835694b89c84223baccf16a7c0c86c24443795eb5434168b0430831e924ebcf` |
| Actual-output refusals | `db3fb851d60a919ad5cfc2c08e993bde389b52a8854453439cbdf2d74f4f5c5c` | `be46615cdcc2c894d689f7fe678214c3108e83dc25fcf718ddd96849dcb3e163` |
| Collected files | `ed4f7523b9cde33880be95afe6ac1de07e716d2086c3fbe7a6bc736ac701395d` | `75cccfc0d8b87b777c00790b2686e71571ec328dc7f821c38caa87e6100f4a88` |
| Independent native reader | `a2aa723f0b1dbf0bd1b38a0ea224aa86fd2233b09efe2180639785e8d6505261` | `a2aa723f0b1dbf0bd1b38a0ea224aa86fd2233b09efe2180639785e8d6505261` |

## Remaining gates

Zero/nonzero warmup, measurement reset and sample separation, per-phase
administration/shutdown and a general original-SDK backpressure policy remain
open. This finite producer deliberately refuses a negative publication offer.
Runtime generation/install and fresh quiet physical DAC collection follow
those gates. Original offered load, report sample count, acceptance thresholds
and good result keys remain unchanged. No completed unchanged campaign is rerun.