# llfix original/framework reference on HP

2026-10-04. Requested HP trial, separate from the final SCAN campaign, Stage 2
llfix 1.0.8 and all full-session/physical generations. **Functional diagnostics
only: no quiet timing, engine ranking or vendor-latency reproduction admission.**

## Source and actual execution

The original comparison repository pin remains
`165cc999fa283a4ead17a7b935c5d3f850fec851`, unpatched bundled llfix **1.0.7**,
204 original files and the existing four HP original binaries. Preparation is
`generation2/prepare.json`; the actual GCC 11.5 driver SHA256 remains
`fc1ea664a2a85c301fef71284f5e4906eaeb40a40c5225f9b0ac1aae10b00c2e`.
TX keeps its original C++17/O3/NDEBUG/fno-rtti/march-native/mtune-native flags;
RX keeps its original flags without the TX native tuning options.

The separate framework uses the unchanged 22-file monitor-tail capsule
`93655e2dc7f859dd6e9a3610278d3a96b594e149656e76b3abcaa43faff65fdd`.
Both fresh HP builds and three small100 TCP pairs pass independent wire/owner/raw
checks before the full runs. Framework native/controller/header bytes, the
original SDK/peers and all prior prepared generations are unchanged.

HP output root: `~/build/codex-llfix-reference/libhft`. Controllers and monitors
stay on CPUs 0–7, server on 16 and client on 17. All new HP jobs use high priority
through `host-cpu-slot`; each controller is pinned inside its queued command.
Transport is ordinary same-host TCP loopback.

The full diagnostic attempt is `hpdiag3`, in `generation2/captures` and
`framework-generation2/captures`. Original: three TX and three RX fresh-process
pairs. Framework: three TX upstream-clock, three TX CLOCK_MONOTONIC_RAW and
three RX pairs. Every pair completes with both peers returning zero. TX has
1,000 discarded warmup sends and 1,000,000 measured samples; RX has 1,000,000
callbacks, no warmup and no execution-report replies.

These captures deliberately use the existing **functional** phase, which makes
no quiet timing claim and allows concurrent shared work. It does not replace or
weaken the timed phase. Separate immutable wrappers continuously record actual
pidstat output, including two-second startup/tail coverage, and pass the actual
CPU-lease descriptors to the frozen nested controller. Another session's shared
.NET verification was permitted. Native timing summaries are diagnostic data.

## Quiet attempts and original failures

Five timed attempts stopped at the unchanged 120-second preflight, before any
timed native pair:

| Attempt | Recorded rejection |
| --- | --- |
| hpquiet1 | Firefox peak 10.8% of one CPU |
| hpquiet2 | Firefox/desktop activity and package installation; Firefox peak 241.7% |
| hpquiet3 | VS Code activity up to 158.3%, and activity before Firefox closed |
| hpquiet4 | Starting one-minute load 2.73; memory compaction 41.0%; VS Code 29.5% |
| hpquiet5 | VS Code peaks 41.4% and 26.6% |

The user installed system pidstat 12.5.4 and closed Firefox between these attempts.
The load/activity limits remain 1.0 and 5%; no desktop, kernel or controller
process was silently excluded. No foreign process or queued job was stopped.
The two initially queued diagnostic requests were explicitly dequeued by this
session before they entered a lease, then replaced with functional isol requests
that allow shared work. Their original manager failures and queue output remain.

The first diagnostic wrapper did not forward inherited lease descriptors to
its subprocess. The frozen controller correctly refused with bad descriptor
before creating a runtime or launching native peers. A new wrapper validates
the actual lease-file device/inode and forwards its live FDs using `pass_fds`.
Both original failures remain; the next generation completes all 15 pairs.
An earlier framework manager launched before queued staging completed and refused
a missing source file; the separate subsequent manager/build/small audit passes.

## Monitor tool inputs

A private sysstat 12.6.1 pidstat was built before the system package arrived:
source `93c8e59b4cbfc3c848a94784fa1a249ca7c426c0`, original source gzip SHA256
`6f158c79afe43c3de9b860e0d5e351d71e5d113f649476595e403443051fd68e`.
Compiler: actual GCC 11.5, driver SHA256
`a31b06d4dafdcffdc9418b39ffa498e7924e880c3f7610cdbf54e341704f9328`.
`make -j2 pidstat` uses a private prefix, with NLS/sensors/PCP disabled. No
`make install` or system/cron/service installation was performed.

Private cache: `~/.cache/libhft/bench-toolchains/sysstat-12.6.1-93c8e59b/bin/pidstat`,
binary SHA256 `b81fcd8838ba82d0ae978ecdab1177da1bc83771b9b96c684e17bc1fc6393bdb`.
Actual three-second sampling produced 1,728 rows in the expected ten-column UTC
format. The full archive, COPYING, extracted build inputs, configure/build logs,
compiler/version/hash receipt and resulting binary are retained. This binds the
monitor product; it is not whole-toolchain/release attestation.

The first extraction refused the archive's test symlinks. Omitting the whole test
subtree then caused configure to refuse missing `tests/variables.in`. The fresh
third build retains all regular source files and omits only 1,274 test symlinks,
all under `tests/`, unused by `make pidstat`; the complete original gzip remains.
Both failed scripts/receipts/logs are retained unchanged.

## Diagnostic performance and independent review

Both full-count cold audits pass: `functional-wire-count-pass` for the original
and `functional-wire-raw-pass` for the framework. The independent checks cover
24,018,000 persisted successful orders (including discarded TX warmup), required
values, both parties, contiguous owners, BodyLength/CheckSum, callback/sequence
counts, all six million uint64 CSV/HFTBRW transmit samples and their actual
quantiles/extrema. The matrix remains functional diagnostic output.
Values are medians of three fresh process trials, not a pooled distribution:

| Metric | Original | Framework upstream method | Signed difference |
| --- | ---: | ---: | ---: |
| TX p50 | 5,888 ns | 6,032 ns | +2.45% |
| TX p99 | 8,521 ns | 8,598 ns | +0.90% |
| RX throughput | 138,179.56 messages/s | 136,717.52 messages/s | -1.06% |

Framework CLOCK_MONOTONIC_RAW TX diagnostic: median p50 **5,919 ns**, p99
**8,550 ns**. The upstream-clock runs retain their actual first-CPU integer-MHz
frequency: original TX runs use 3,100,000,000 / 3,102,000,000 / 3,099,000,000 Hz;
framework upstream runs each use 3,100,000,000 Hz. Therefore the predeclared
**equal original clock-scale gate also fails**, independently of quietness. No
raw value is rescaled to obtain a pass. This is not invariant-TSC calibration.
Monotonic-arm frequency
metadata is informational and does not scale its samples.

The original reference's published table reports TX p50 573 ns, p99 2,663 ns and
RX 231,060.031247 messages/s at its immutable source pin. Its TX uses different
hardware and Solarflare Onload/TCPDirect infrastructure. These HP diagnostics
do not reproduce that hardware/transport claim. RX throughput's reciprocal is
not a per-message latency distribution.

The [actual RX policy proof](RECORD_2026-10-04_llfix-rx-policy.md) remains applicable:
this original path has dictionary/group validators compiled out, despite enabled
validation flags, and counts callbacks without converted business-field extraction.
The existing framework/private profile prose is retained at its frozen source
pin; the explicit policy correction is not used to patch those frozen inputs.

## Retention and integration

The complete **3,695-file** archive is sealed and independently stream-verified
on HP and BEELINK2: every file hash, mode, size and exact archive membership
matches, including all failures, original SDK/binaries, both source capsules,
all runtime journals/raw samples/configurations, tools/builds and monitors.

- Archive on both hosts: `~/archive/libhft/codex-llfix-reference-20261004/hp-reference-timing1.tar.gz`.
- Compressed bytes: `550621295`.
- Archive SHA256: `6e6b5171eba21742096d60c193f57d1fca628805c95054adb1311db517c325a2`.
- Seal SHA256: `02e0a1e7ed74deb6baeda521d1458325a1552e33de8ad35d7486d1ef15db2b37`.
- [Selected exact evidence](evidence/llfix-hp-timing-20261004/): 55 original
  source/metadata files separately checked against the embedded seal, plus
  independent retention/replication receipts and the retention manager.
- The diagnostic reporter binds both captures, preparation/cold audits and
  actual monitor logs; its `upstream_clock_scale_equal` is false.

The matrix has no engineering-target pass, confidence interval, release, full
fixture or report-grade timing promotion. Future quiet runs require a fresh
passing preflight/activity review; exact upstream clock-scale matching remains
a separate gate. The original RX policy and stronger-policy engine comparisons
remain separate decisions.
All 33 focused reference checks pass with zero skips. All 58 frozen source-map
bindings remain unchanged after integration with concurrent main commits.
No engine, Stage 2, shared helper, canonical wire or SCAN queued runtime changes.