# HP llfix preallocation control: functional qualification

2026-10-09. Implements the next control from the retained
[paced-stall analysis](RECORD_2026-10-09_llfix-hp-paced-stalls.md).
Four fresh binaries separate application order-pool growth from framework
sample-buffer growth. **Functional qualification passes; the physical timing
campaign has not started.** Installation requires an HP sudo password.

## Declared experiment

The [profile](../../bench/llfix_reference/diagnostics/preallocation_controls/README.md)
was committed at `d4957837fd2b0c364da5e3a8bfd3f9f1c4b74695` before inspecting
any new native result. Its fixed roster is baseline/orders/samples/both followed
by the reverse, one million measured calls and 1000 warmups per pair, target
100000 calls/s, original upstream clock, HP client/server CPU17/16, receiver-only
spin and default receive buffer over the physical Solarflare DAC.

| Variant | Application order pool | Primary and scheduler sample buffers |
| --- | --- | --- |
| baseline | Original 2048-object start, then growth | Original growth |
| orders | Construct warmup + measured objects before connection | Original growth |
| samples | Original growing pool | Reserve measured count after warmup |
| both | Preallocate | Reserve |

The compiler is the exact original GCC11.5 executable. SDK1.0.7, peer, send path,
required values, persistence and every primary timed-loop source byte remain
pinned. A private header copy adds one reversible, nonvirtual reserve method;
forced inclusion selects it before the original runner's quoted include. No
shared header/API, SDK, Stage2 or old preparation/runtime is edited. Allocation
metadata records capacities and counts; its bounded final observations occur
inside measured wall but outside the primary timer in all four variants.
Reservations do not promise fault-free memory access.

## Actual HP qualification

Thirteen focused checks pass locally and on HP, zero skips. All four GCC builds
pass. Each retains **522 actual compiler dependency hashes**, generated source,
header overlay, compiler identity, command, log and binary hash. Preparation
also verifies the old 68-file capsule and original SDK source seal before and
after building. The fresh generation identity is `28f4ccd4a65f`.

Eight actual kernel TCP pairs pass independent bilateral envelope, required
value, repeating-group, owner and count checks. Each variant runs upstream-clock
128/3 and monotonic-clock 10000/1000 measured/warmup cases at target100000.
Totals: **40512 measured calls, 4012 warmup calls, 89048 persisted endpoint order
records**. Complete CSV and HFTBRW samples, statistics and allocation sidecars
pass. Both native executables are observed on their declared single CPUs; no
Onload library is inherited in these kernel controls.

In the 10000/1000 case, growing primary/scheduler buffers end at 16384 entries;
reserved buffers start and end at 10000. Original primary warmup capacity is
1024, scheduler capacity zero. Orders/both start with 11000 application objects;
baseline/samples retain 2048. Small 128/3 cases preserve the original minimum
pool capacity of 2048. Every reserved buffer retains its capacity through
measurement. All **12 actual native refusal cases** pass: unknown rate, zero
measured count and an existing allocation sidecar, for each variant. Refused
runtimes retain their exact original files.

Preparation uses high-priority shared leases. The actual kernel pairs hold
high-priority shared+isol leases through `isol-no-shared`, with the controller
on CPUs0–7. No functional latency figure is promoted to physical, vendor,
quiet-window or release admission.

## Installation and physical capture

HP's [home script](evidence/llfix-hp-preallocation-20261009/operations/run-llfix-preallocation.sh)
is installed as `~/run-llfix-preallocation.sh`. It verifies all six frozen source
files, preparation, reviewed installer and passing functional-proof hashes.
The installer binds 20 protected files: four separate payloads containing
sender/peer/manifest and eight plain/spin namespace launchers. It verifies the
old installed bytes, rejects existing destinations and imports only system
modules as root. Launcher executable AST changes only its fixed settings.

The [noninteractive attempt](evidence/llfix-hp-preallocation-20261009/operations/hp-install-attempt.log)
received `sudo: a password is required`; no new protected payload was installed.
Run on HP:

```sh
bash ~/run-llfix-preallocation.sh
```

After installation the script queues the eight physical pairs at high priority
with shared+isol leases, then releases them and separately queues the complete
cold audit with a high-priority shared lease. Each fresh pair retains full raw
series, allocation metadata, bilateral journals, actual native affinity,
Onload socket/stack evidence and physical port counters. Old samples are neither
removed nor rescaled. Median-of-two run statistics and actual maximum are
diagnostic summaries, with no confidence interval or vendor equivalence claim.
Original primary-clock conversion and scheduler/wall clocks remain distinct.
The reanchored workload retains its coordinated-omission limitation.

## Retained evidence

- [Preparation](evidence/llfix-hp-preallocation-20261009/preparation/prepare.json).
- [Eight pairs and twelve refusals](evidence/llfix-hp-preallocation-20261009/functional/functional.json).
- [Reviewed fixed installer](evidence/llfix-hp-preallocation-20261009/preparation/install-reviewed.py).
- [Selected metadata manifest](evidence/llfix-hp-preallocation-20261009/selection-manifest.json).
- [HP verification](evidence/llfix-hp-preallocation-20261009/hp-replica.json) and
  [BEELINK2 verification](evidence/llfix-hp-preallocation-20261009/beelink-replica.json).

Both hosts verify every content hash, size, mode and member in the same 182-file
archive: 11818853444 raw bytes, 54798250 compressed bytes. Both retain
`~/archive/libhft/codex-llfix-reference-20261009/preallocation-preparation1/evidence.tar.gz`.
Archive SHA256:
`d174ecc6c0ebdc5b66b0b60b290c4ada147fc5ea2fca0e3c9e6e96f1e902e7a4`.
Seal SHA256:
`3341d927aafbd50844bb4b075a0830936fbe5c3f51179809df1bef24f9b9c154`.

The original local retention verifier tried reading a streaming tar member
twice and failed before qualification. Its script/log remain as supplements;
a separate continuation reads each member once and passes all original byte
checks. No primary archive, native input or functional outcome changed.

Active source, preparation, native dependency files and functional proof remain
available for the home script and next physical campaign. No other session's
jobs, installed generation, OS policy or old archive is changed. The
[integration verifier](evidence/llfix-hp-preallocation-20261009/verify-integration.py)
binds qualified source and selected evidence to their seals and checks the
eight-pair/twelve-refusal contract before publication.

After normal fetch/rebase over the concurrent Rust kernel evidence and header
optimization commits, all six qualified control source files and 60 selected
sealed evidence files retain their bytes/modes. The
[post-rebase check](evidence/llfix-hp-preallocation-20261009/integration2.json)
and thirteen [focused checks](evidence/llfix-hp-preallocation-20261009/local-unit-after-rebase.log)
pass, zero skips. The four generated compiler dependency receipts are explicitly
retained as evidence despite the usual build-output ignore rule.