# HP llfix original sender CPU pin correction

2026-10-08. Corrects the [launcher-only placement preparation](RECORD_2026-10-08_llfix-hp-placement.md).

## Failure and cause

The user installed the reviewed launchers and started the comparison. The
first two baseline pairs completed. The third, requesting client/server cores
16/17, completed its native work but the strict affinity check rejected it.
The original sender's upstream `benchmark.cpp` calls
`ThreadUtilities::pin_calling_thread_to_cpu_core(CPU_CORE_INDEX_TO_PIN)` after
Logon. Its existing binary was compiled with that documented parameter set
to 17. The launcher's initial CPU16 assignment was therefore overridden.

The retained snapshots show 61 client observations on CPU16 followed by
160 on CPU17; the server has 221 observations on CPU17. Its native log also
announces CPU17. This is a real placement error: both endpoints share CPU17
during the requested reversed run. The original failed parent receipt is
preserved and that row contributes no valid CPU16/17 timing result.

All three completed pairs pass separate cold wire audits: required converted
fields, FIX envelopes/checksums, contiguous owners and counts remain correct
in 6006000 persisted endpoint order records. The paced baseline also passes
one million primary and one million scheduler raw samples. Successful wire
checks do not change the failed placement grade.

## Corrected generation

Source `980857324225d1c0c49e5213eaea1c5bbc68d28f`, preserved on
`s/codex-llfix-reference-affinity-source-20261008`, adds per-CPU original
sender builds. Only `CPU_CORE_INDEX_TO_PIN` changes from the upstream value
10 to the selected client core. Reversing that substitution proves every
other source byte retained, including the measured loop, warmups, message
values, serialization and RDTSCP conversion. The upstream SDK's complete
source tree remains byte-identical before and after builds. GCC11.5, its
binary hash and original C++17/O3/native compiler flags are retained.

| Client core | Original sender |
| --- | --- |
| 17 | Exact previously qualified binary reused |
| 16 | New CPU-parameter-only build |
| 9 | New CPU-parameter-only build |
| 8 | New CPU-parameter-only build |

All peer, framework and paced sender binaries retain their exact old bytes.
Four new protected payloads keep logical binary names and bind the selected
original sender. Launchers change their payload/manifest bindings and fixed
CPU assignments; the existing privilege drop, environment, namespace and
native argument restrictions stay intact. The fixed installer admits 32
files and refuses any existing destination. Old payloads, launchers, source
capsules and evidence stay unchanged.

The new verifier additionally requires the original sender's own pin
announcement to match the requested client core. The strict single-core
process-status checks remain. Replaying the actual failed third capture
against the new gate rejects its CPU17 announcement.

## Actual functional qualification

Local and HP preparation checks pass thirteen tests with zero skips. The
complete 68-file source capsule is checked before and after qualification.
HP then executes both real senders on kernel loopback at 17/16, 16/17,
9/8 and 8/9 under a high-priority exclusive host lease. All eight fresh pairs
return zero for both endpoints. Live observations prove the selected native
executable and single-core affinity, and the original sender's built-in
announcement agrees in all four original runs.

Each original sender performs its unchanged million measured calls and
1000 warmups. Each paced sender performs 10000 measured calls and three
warmups at a requested 100000 calls/second. Independent cold checks pass
on both endpoints' required values, checksums, owners and counts:
4040000 measured calls and 8088024 persisted endpoint order records.
All 40000 paced primary and 40000 scheduler samples pass CSV/HFTBRW,
rate/clock/quantile/mean/true-maximum and clamping checks. These are functional
kernel-loopback results, with no Onload or physical timing admission.

## Next HP command

Run the corrected wrapper on HP:

```sh
~/run-llfix-cpu-placement-v2.sh
```

It needs one sudo step because the rebuilt senders and their launchers must
be installed as protected root-owned files. The noninteractive attempt was
refused with `sudo: a password is required`; it installed no new payload.
The wrapper verifies the successful functional receipt, source and installer
hashes, then installs and queues sixteen new physical pairs at high priority.
It uses a fresh `cpu-placement2` output; the failed generation is not resumed.

Capsule: `~/.cache/libhft/llfix-reference-hp-placement-v2-980857324225`.
Protected payload prefix:
`/usr/local/libexec/llfix-reference-hp-placement-v2-6d0bcb62466f-c`.
Installer SHA256:
`bc0c568148c59ba2f17685aee3ef21e28ebde25937ed3d0c3901ad4f253a3117`.
Home wrapper SHA256:
`76061b66d634dd5450ef051c3995ad5c7e39b242c6c8bb21558d42986db84e1a`.
Successful functional receipt SHA256:
`d1839907f722adadafead388681275a75a23141676943e5deec52a5d032adc10`.
The functional receipt remains an active input to that wrapper.

The comparison retains the physical SFC9220 DAC, fixed buffers within each
lane, disabled Onload TCP loopback shortcuts, old runtime/clock inputs and
forward/reverse order. The probe is local construction/send-return service
time. RTT and remote per-call delivery are not measured. No OS setting,
Stage 2 adapter, SDK implementation, shared helper API, old ranking or other
session's job is changed. No corrected physical placement timing has run
at this qualification checkpoint.

## Retention and integration

The original [failed parent receipt](evidence/llfix-hp-affinity-20261008/failed-capture/placement.json)
and separate [cold audit](evidence/llfix-hp-affinity-20261008/metadata/failed-cold-audit1.json)
retain their grades. The [functional summary](evidence/llfix-hp-affinity-20261008/metadata/functional-summary1.json)
contains all eight real pairs' independent count/value results and observed
single-core counts. The [source/build proof](evidence/llfix-hp-affinity-20261008/metadata/pinned-source1.json),
[HP test log](evidence/llfix-hp-affinity-20261008/metadata/pinned-hp-tests1.log),
[new preparation](evidence/llfix-hp-affinity-20261008/preparation/prepare.json),
[reviewed installer](evidence/llfix-hp-affinity-20261008/preparation/install-reviewed.py)
and [home wrapper](evidence/llfix-hp-affinity-20261008/metadata/run-llfix-cpu-placement-v2.sh)
retain their exact qualified bytes and modes. The
[noninteractive sudo refusal](evidence/llfix-hp-affinity-20261008/metadata/auto-install1.log)
is also preserved.

Both hosts verify every file in the sealed 294-file, 259182341-byte archive
`~/archive/libhft/codex-llfix-reference-20261008/hp-placement-affinity1.tar.gz`.
It retains the entire source/preparation capsule, native builds, all raw
functional and failed physical outputs and original home-run log. Archive
SHA256: `1ecf4acddc3073a98504410af9239346fa91d2ceb9175130b3ae8694be296d14`.
Seal SHA256: `833d1371e973eeafe70f37002a9f6c8d754257c98446b317fa8a46929a7193f9`.
The [HP](evidence/llfix-hp-affinity-20261008/hp-replica1.json)
and [Beelink](evidence/llfix-hp-affinity-20261008/beelink-replica1.json)
stream-verification receipts agree exactly. Git carries a
[17-file selection](evidence/llfix-hp-affinity-20261008/selection-manifest.json)
of original metadata; it does not replace the full evidence archive.

The [integration verifier](evidence/llfix-hp-affinity-20261008/verify-integration.py)
checks all eight current placement/support source bindings, the selected
evidence, both replicas, failed/non-timing grades, actual functional placement
vectors, local documentation links and thirteen boundary tests with zero
skips. Older source and runtime generations remain independently pinned.
The [initial integration receipt](evidence/llfix-hp-affinity-20261008/integration1.json)
passes all these checks; it starts no native process or timing run.
After a normal rebase over concurrent private-main commits, the
[integrated receipt](evidence/llfix-hp-affinity-20261008/integration2.json)
again passes thirteen tests without skips; qualified source/evidence bytes
are unchanged. The HP capsule stays at its original `980857324225` pin.