# llfix original-workload framework qualification 2026-10-04. Separate network reference campaign following [the reference plan](PLAN_LLFIX_REFERENCE.md). The Stage 2 llfix 1.0.8 ranking, full-session fixtures and installed physical generations remain pinned. ## Frozen functional profile The framework profile was published at `5bdc0debf`. Its immutable prototype capsule has SHA256 `b8c2310f748717e2cc6bbd8205d9b21c916e390bcfe2d4fec06bddc6049f08f4`. All 16 driver/controller/header/support bytes matched that publication after integration. It uses the comparison archive's unpatched bundled llfix 1.0.7 and the original application order cache and TCP peers. The actual workload and [predeclared targets](../../bench/llfix_reference/PROFILE_FRAMEWORK.md) travel with the profile; the published vendor hardware result is a separate claim. HP's GCC 11.5 sequential TX/RX builds passed. Six actual TCP pairs cover small12 (12 measured, five TX warmup calls) and small100 (100 measured, seven TX warmup calls), each with upstream-clock TX, monotonic-clock TX and one-way RX. Both independent audits pass required values, party order, ownership/counts, real journals, full-width CSV quantiles/extrema and matching HFTBRW samples. Native peers returned zero; no skip or timing qualification applies. The retained HP framework archive contains 125 sealed files, including inputs, build receipts, configuration, logs, native binaries and all six runtime outputs: - Host/local archive: `~/archive/libhft/codex-llfix-reference-20261004/hp-framework1.tar.gz`. - Tar SHA256: `37c62432793f9339cfd2aabfc4a2907b8e7c4c9490d8c376e4eac4d70fe7b874`. - Seal SHA256: `c76bc586f43aa31e8a46935ac5bbd0e92ee0f51617a021595c6f21c8d1fbac9b`. - Independent streaming verification on BEELINK2 matches every file hash, size, mode and membership to the embedded seal. The original reference dependency remains separately sealed in the initial reference archive. Selected receipts are under [evidence/llfix-framework-reference-20261004](evidence/llfix-framework-reference-20261004). ## Original SCAN baseline Original controller/source capsule `4e5506d73` with manager `b5a7094b2` completed quiet2 after retaining its affinity and initial quiet-preflight refusals. Three fresh pairs per workload each executed one million measured orders, plus 1,000 discarded TX warmup calls. The actual Xeon E5-2698 v4 run uses ordinary loopback, server CPU 18/client CPU 19, exclusive shared+isol leases, a 120-second preflight and complete one-second activity review. Every wire/count check passed and no unowned process exceeded the existing 5% threshold during any pair window. | Original summary | Run 1 | Run 2 | Run 3 | Median of three | | --- | ---: | ---: | ---: | ---: | | TX p50, upstream-reported ns |8,127|7,996|8,029|8,029| | TX p99, upstream-reported ns |12,599|12,397|12,359|12,397| | RX memory messages/s |84,447.901109|84,634.232882|87,367.363721|84,634.232882| | Original clock scale, Hz |2,203,000,000|2,204,000,000|2,205,000,000|—| Those TX figures preserve the original first-CPU-MHz scale, which differs even between original pairs. They are not calibrated nanoseconds. The comparator's predeclared identical-scale gate therefore cannot promote raw TX nanosecond parity across this set. RX's first-to-millionth CLOCK_MONOTONIC interval is a throughput measurement, not a per-message latency distribution. ## SCAN framework outcomes and repair Prototype preparation and small100 functional/audit checks passed on SCAN. Framework quiet1 and quiet2 refused during preflight because `udisksd` exceeded 5%, before any timed pair. Quiet3 passed preflight and completed nine fresh million-order pairs. All nine independent wire, count, owner, CSV and HFTBRW checks passed. Continuous activity review **rejected** the attempt: the last pidstat bucket ends at 15:22:17 UTC while the final pair ends at 15:22:18 UTC. Immediate monitor termination omitted tail coverage. Original output and rejection remain retained; this is not a qualified timing reproduction matrix. A fresh generation adds a two-second monitored tail and refuses a monitor that exits during capture/tail. Its frozen 22-input capsule SHA256 is `93655e2dc7f859dd6e9a3610278d3a96b594e149656e76b3abcaa43faff65fdd`. The native workload, SDK, framework header bytes and gates are unchanged. Fresh SCAN preparation and small100 pairs/audit pass. Its quiet1/quiet2 attempts both refused during preflight on other session/editor or housekeeping activity; no timed pairs ran. Every new capture requires a fresh path and the unchanged full quiet/activity gates. Raw records remain intact for final host retention. Twenty-eight focused controller, wire, raw, activity, monitor-tail, comparison and retention checks pass without skips. The tail regression proves that a monitor which dies before coverage cannot pass, and that incomplete activity leaves an explicit rejection receipt. The retainer refuses overlapping/source/symlink selections and independently catches changed replica bytes. Production-store controls also refuse a corrupt commit footer, a changed order owner, a missing order and an open-only SDK supplied for the explicitly pro-mmap profile. ## Separate libhft candidate The [libhft TX candidate policy](../../bench/llfix_reference/PROFILE_LIBHFT.md) uses an explicit pro-mmap SDK, public composed send and the same original order cache/values/receiving peer. It is a functional candidate with a separately pinned Clang 21 C++23 compiler. The SDK input pin is `e6bcaf219c80aa799f29efa750f6fa83f55b3bf4`; later engine sources do not inherit this qualification. Three independent source/output generations are retained: 1. The initial SDK capsule omitted the engine's relative kernel include; compilation failed before execution. 2. The complete SDK capsule compiled. The actual Logon failed because configured sub-ID identity constraints required reciprocal tags absent from the original peer's unmodified Logon. The real original journal and failed capture remain retained. 3. The composer now adds outbound tags 50/57 through public field writers and keeps production inbound identity validation. Its fresh native build and actual socket/cold-audit phases pass through HP's host CPU slots. Both native processes returned zero. The cold auditor independently checked all 107 persisted/received orders, both parties, header/business values, contiguous owners, 108 committed store records and zero store failures. Its 100 measured uint64 samples match the actual native summary; seven warmup calls are excluded. The complete SDK archive SHA256 is `2c3c9cfd5b2ed253048f9f972ed901a102469d2eeca183b9762826786d9a5c7b`. Third-generation harness archive SHA256 is `3df384f7dc1fe20dc000f3459afc2ed8669d966d6ff37c3c8b1f61c7c3f61f9c`. Its retained thirteen-file source map binds the exact controller, native source, support and framework headers. Prepared SDK input hashes and the original failed build/capture logs are included in the selected evidence directory. A separate fifteen-input cold continuation checks the candidate's actual HFTBRW plotting file against every full-width CSV value and checks store counters against the committed-record audit. Its immutable capsule SHA256 is `1a4da7a82ba5f7d2aabf799c4946af7a8a5fac7940ddc38c7cf9957ede50d31c`. The native, controller, preparation and thirteen earlier input bytes stay unchanged. A plotting sample beyond uint32 is explicitly counted as clamped while the CSV remains the primary uint64 series. Corrupt samples, label/count changes, truncation, trailing bytes and duplicate CSV indices are rejected. This additional actual-output check passed under a shared high-priority slot: all 100 binary samples match the primary CSV, with zero clamped values in this generation. No fresh measured process was launched. HP's complete failed/passing TX retention independently verifies 487 file hashes, sizes, modes and archive membership. It contains all three original source and output generations, both SDK input archives/materializations, compiler/runtime logs, configurations, actual journals, binary and full raw output: - Archive: `~/archive/libhft/codex-llfix-reference-20261004/hp-libhft-tx1.tar.gz`. - Tar SHA256: `6c293d878eea4499c0d5e72dc362745ae493a8ecc2a3e9b9baac66a2a484721c`. - Seal SHA256: `8d683f6a4ee5cd39509218ec0abf24feefc214a03793be117ff8b491776b4723`. - Size: 27,456,893 compressed bytes. The independent binary-output continuation is retained as a separate 22-file archive with its original input capsule and receipts: - Archive: `~/archive/libhft/codex-llfix-reference-20261004/hp-libhft-output1.tar.gz`. - Tar SHA256: `3b571f1dd29d35e54a9385e7b3745f5754fe865d7b1395532a772539ebfc0257`. - Seal SHA256: `df654d062fe1e0c27fb3c2c3dd0adc37da05ef3530640625804f80fccc25946c`. Both archives were copied through shared host leases and independently streamed on BEELINK2. All 487 and 22 file hashes, sizes, modes and member sets match their embedded seals; both complete compressed hashes match HP's original receipts. Neither retention nor functional output verification promotes timing. No engine timing or matched-compiler comparison is claimed. Validated RX and final engine-policy/timing gates remain open. In particular, the reference RX has eight configured session identities, mapped sequence counters with message serialization disabled, group validation, and a 60-second wall-clock age check. The selected libhft acceptor has per-connection settings cloned from its listener; its deep timestamp accuracy check compares peer timestamps with a 120-second bound. Neither an eight-slot capacity nor that accuracy check establishes those original RX policies. A future RX profile must retain these differences or supply and independently qualify the missing policy through the public SDK contracts.