# HP framework TX idle retry

2026-10-11. HP only; turbo remains deferred. The user requested continuation
after the [earlier strict policy rejection](RECORD_2026-10-11_hp-framework-tx.md).
Both host CPU pools were free at the initial readback, no compiler/VM process
was observed, and `irqbalance` was still active with PID 1325. No pause receipt
was present.

## Unchanged inputs and fresh attempt

This retry reuses source `0a7c09c3f75a9b4696f1bef309c5ad0746b1024c` and its
eleven-file capsule, SHA256
`456b90fac3ab19bb0692043bf2d1d44e6a661fcc926a0213e15ee225113e708c`.
Every source hash/mode is checked before launch. The actual controller verifies
the prepared input binding, installed llfix 1.0.7 original/framework/peer bytes,
source provenance, runtime and protected launchers before and after execution.
The earlier captures and archives remain intact at their own pins.

A fresh `functional2` attempt runs all three full-size physical Solarflare DAC
arms through HP high-priority `isol`, with shared work permitted by the existing
profile. Client/server remain on CPUs 17/16 and observers on 0-7. Every arm retains
the original 1,000 warmup and 1,000,000 measured orders, receiver-only spin/1 MiB
requested buffer, two-party fixture and mapped serialization. No source,
installed binary, service, IRQ, governor, sysctl or turbo setting is changed by
the functional operation.

All six native children exit zero, and all three pairs reach
`executed-unreviewed`. The capture then correctly fails the original before/after
policy equality check:

| IRQ | Requested before | Requested after | Effective before/after |
| --- | ---: | ---: | ---: |
| 167, Mellanox asynchronous event | 3 | 7 | 3 |
| 172, Mellanox asynchronous event | 1 | 7 | 1 |

The other thirty-six IRQ records and every remaining policy field match.
Irqbalance is active before and after; these observations do not prove which
actor wrote either requested mask. Capture SHA256:
`679022d2ed67b05c3c3c718a8ef7ace5063f1968e73f3d634f4b07cc691b160e`.
The three observed clock divisors are each 3,100,000,000 Hz; this is not a passing
timed matrix or a parity grade.

No ordinary audit is created and no quiet timing capture starts. This retry's
journals and raw samples remain unreviewed: the earlier separate cold passes
are not applied to new data. Requested-mask equality, workload, process identity,
functional-proof binding, quiet gates and clock-scale admission are unchanged.

## Service capability

An exclusive high-priority operation attempts only
`sudo -n /usr/bin/systemctl stop irqbalance`. It requires both actual inherited
host-lock descriptors and accepts no password input. Its outcome is retained
separately from the functional capture: the actual command returns 1 with
`sudo: a password is required`. Both service observations remain active, PID
1325. The operation waits for the other owner's shared Rust check to finish;
no other job is stopped. Turbo remains unchanged.

The operator still needs to run, as `yann` on HP without a leading sudo:

```sh
~/pause-irqbalance-for-bench.sh
```

The already tested home helper queues an exclusive high-priority lease and
supplies a controlling terminal for the password prompt.

## Early service guard: a new source generation

Source `09906965356e1eab39b3a593a35c8d2ec50354ef` is frozen on
`s/codex-llfix-reference-hp-framework-service-source-20261011`. Capsule SHA256:
`6cbe8ca7ced30b3e06480c1047fe2ba38c47b502637b733bbf842692e6dbbce1`.
Only this private controller, its profile and its tests change. The eight
support inputs retain their exact previous bytes/modes. All eleven existing
functions except `policy` remain AST-identical, including native pair execution,
clock/summary math, cold audit, proof binding and the quiet capture. No installed
native/framework binary is rebuilt or changed.

The new policy read first requires a loaded, inactive/dead irqbalance service
with PID0. It retains the exact systemctl command, output, return code and binary
hash. Missing, malformed, contradictory and failed readbacks refuse. Service
state becomes part of the before/after policy and functional-proof equality;
IRQ requested/effective-mask equality still remains required. The controller
performs no service action.

Ten focused tests pass locally and from the real eleven-file HP capsule, with
twenty-one rejection subvectors and zero skips. HP preparation verifies all old
native/runtime/source/launcher bindings. The actual new CLI functional invocation
then rejects the active PID1325 service **before starting any native pair**;
its saved capture has an empty pair list. This is an actual negative guard proof,
not a positive inactive-service functional or timing qualification.

The new prepared epoch is retained for a fresh functional attempt after the
operator pauses irqbalance. The old failed captures keep their original
controller and are not regraded under the new service requirement.

## Evidence

Both complete losslessly compressed generations verify on HP and locally:

| Archive under `~/archive/libhft/codex-llfix-reference-20261011/` | Sealed files | Compressed bytes |
| --- | ---: | ---: |
| `hp-framework-tx-idle-retry.tar.gz` | 104 | 99,916,884 |
| `hp-framework-service-guard1.tar.gz` | 25 | 229,799 |

Idle retry archive SHA256:
`7c16a4733254037d49550ffc8f60affc100f08a82e60658ee456c90d7785aa88`;
seal SHA256:
`4e2acc5ebf762855d29745d30daf7a77e56d91eb1f6b7c09aa030175f8eed90f`.

Service guard archive SHA256:
`adf62a9d83a1bf785c72250d3fdda05675653337e151b1ad50a3075e5cd98a27`;
seal SHA256:
`cfe66a984b5fe3dee65169c72ff8f3badcc2996ad2c7cdecf2bb6094177f7b1f`.

[Selected exact inputs and postseal receipts](evidence/hp-framework-tx-idle-20261011/selected-files.json)
retain both controller generations, the actual sudo refusal and zero-native
proof. Large original samples/journals stay in the full archive. The first local
verifier bootstrap lookup refused an absent helper path before verification;
its captured tool-result metadata remains separate from the corrected verifier,
which checks both original helper hashes before streaming every archived member.

Completed old source/snapshot/capture scratch and both verified uncompressed
duplicates are removed after full membership/hash/size/mode checks, readable
consumer checks and all six original native PID/start identities have exited.
Inaccessible same-UID process details are explicitly retained in the cleanup
receipt; this is not a root inspection. Source3, its operations/preparation and
the HP home helper remain active. No other owner's path, cache or root payload
is removed. No SCAN operation occurs in this continuation.