# HP original/framework physical TX continuation

2026-10-11. HP only; the user deferred enabling turbo. This generation reuses
the original llfix **1.0.7** benchmark, our framework TX wrapper and the same
receiving peer. It does not change the separately qualified Stage 2 1.0.8
microbench, SDK sources, installed binaries, shared clock/build APIs or earlier
measurements.

## Source and workload

Original controller source `11feebeb9592b3ba0b4754d34d44a13c95a4019f` is retained
on `s/codex-llfix-reference-hp-framework-source-20261011`. Its first full-size
functional attempt observed the native entrypoint before the Onload stack/socket
was ready and correctly refused the missing proof. The original attempt is kept.

Source `0a7c09c3f75a9b4696f1bef309c5ad0746b1024c` adds a bounded ten-second
readiness retry for the same owned process, socket, namespace and library proof.
Each refused observation is retained; an exited client refuses immediately.
Its eleven-file capsule SHA256 is
`456b90fac3ab19bb0692043bf2d1d44e6a661fcc926a0213e15ee225113e708c`.
Both commits are integrated on private main at `2e2a26f57`; all eleven frozen
source bytes and modes match after rebase. The older source refs remain intact.

HP high-priority shared preparation passes seven focused tests, including nine
malformed matrix vectors and two readiness/early-exit controls, with zero
skips. Preparation verifies the original 204-file source map, compiler, old
sealed helper archive, Onload runtime and every protected installed payload
file. No native build or root installation is performed in this continuation.

The [fixed profile](../../bench/llfix_reference/diagnostics/framework_controls/PROFILE.md)
uses physical Solarflare DAC, client CPU 17/server CPU 16, and observers on 0-7.
Every fresh pair sends 1,000 warmup and 1,000,000 measured orders with the original
fixture, two parties, millisecond timestamps and mapped serialization. Receiver
only: spin and requested `EF_TCP_RCVBUF=1048576`; client: unchanged plain
launcher. Three arms are original RDTSCP, framework upstream RDTSCP and framework
`CLOCK_MONOTONIC_RAW`. This is local construction/send cost, not RTT or remote
arrival latency.

## Original policy rejection

The second source's actual high-priority isolated functional attempt completes
all three full-size pairs; all six native children exit 0. Owned physical Onload
socket observations and actual affinity/privilege-drop checks complete. The
capture nevertheless remains **failed** because its before/after requested IRQ
targets differ:

| IRQ | Requested before | Requested after | Effective before/after |
| --- | ---: | ---: | ---: |
| 167, Mellanox asynchronous event | 2 | 4 | 2 |
| 172, Mellanox asynchronous event | 2 | 6 | 2 |

All thirty-eight IRQ identities/effective placements remain unchanged and all
targets stay within housekeeping CPUs 0-7. The remaining machine-policy fields,
including boot, kernel, isolation, busy-read/poll 50, governors and turbo, match.
Active `irqbalance` is observed; this does not identify the writer of each mask.
Requested-mask equality is not relaxed and the failed capture is not rewritten.

A separate cold continuation extracts the original audit's native/wire/raw
check statements verbatim. It can establish those checks independently while
keeping `hardware_policy_status=rejected`, `eligible_functional_proof=false`,
`timing_admission=false` and a distinct status/file name. It cannot satisfy the
ordinary passing-functional proof needed by the timing controller.

That continuation passes all three arms: each role retains 1,001,000 successful
orders, zero failed sends and no execution-report replies. All **6,006,000**
journaled order copies pass FIX framing/BodyLength/CheckSum, required converted
values, both party groups and contiguous numeric ownership. Both million-sample
framework CSV/HFTBRW series agree exactly and their recomputed summary statistics
match. All actual socket proofs retain client receive buffer 426,320 bytes and
server 2,098,020 bytes; those are observed allocations, distinct from the receiver's
requested 1,048,576 setting. Actual placement and physical packet deltas also pass.
The native audit body is copied verbatim from the frozen controller; its SHA256
is `9eb0118d91d423afbdd2ad7919b58acd98fdb58a28fdc1af18928bd7b7b4e470`.

Three actual unchanged admission calls refuse this evidence: ordinary audit,
quiet functional-proof binding and timing matrix. The original `capture.json`
hash is unchanged, no ordinary `audit.json` is created, and the separate cold
result explicitly remains ineligible for a quiet capture. Helper syntax and
invalid-argument controls pass on HP; a local wrong-host control also refuses.
No control executes a service action.

The first cold attempt hits its queue's four-minute limit after reaching the
last arm. Its original operations and timeout log are kept; a separate unchanged
native-check continuation receives a longer runtime allowance and rereads the
original data. No native workload is rerun for that operational correction.

## Operator service action

The syntax-checked HP home helper `~/pause-irqbalance-for-bench.sh` waits for an
exclusive high-priority host lease and then uses sudo to stop only `irqbalance`.
Run it as `yann`, without putting `sudo` before the script. It verifies the actual
shared/isol lock descriptors and retains a dated receipt. Because the queue
starts a new session, the helper supplies a controlling terminal for sudo inside
the inherited lease. No input transcript is enabled; password input is not
recorded by the helper.
The action needs the operator's password because the installed passwordless
rules do not cover `systemctl`. `resume` starts the service through the same
queue. It does not disable the service, reboot, or write turbo/governor/sysctl/IRQ
settings. Current helper SHA256:
`e47448f0ccf90a875c7dfb2298dbbbf9f40449f072a7565643b3419a741bccda`.

An actual HP `check` completes through an isolated high-priority lease permitting
shared work: its inherited isolated lock descriptor and controlling terminal
both pass, with no service action. Both service observations still show
`ActiveState=active`, `MainPID=1325`. Pause/resume retain the stronger requirement
for both host pools; the check does not claim that an exclusive service action
has executed. Invalid action, wrong home and missing lease controls all refuse
before any service action. The original helper remains among the sealed inputs;
all three later versions are retained as separate postseal inputs. Two own queued exclusive terminal checks
were dequeued before execution while another owner's build held the shared
pool; their logs remain retained and are not passing checks.

At this checkpoint the pause action has not been applied. No quiet capture has
started and no new performance comparison is admitted. A fresh unchanged-policy
functional proof, cold audit and exclusive 120-second/5%/load-1 preflight are still
required. Different original/framework CPU-MHz divisors continue to reject
raw-nanosecond parity; no original or vendor number is normalized to fit.
The functional original/framework TSC divisors are 3099000000/3100000000 Hz;
even that small observed difference is retained without loosening this gate.

## Evidence

[Exact selected review inputs and postseal receipts](evidence/hp-framework-tx-20261011/selected-files.json)
retain both original failures, the timeout, all cold/control operations and their
actual results. Full original journals, both uint64 CSV/HFTBRW sample series,
source capsules, configs and logs are retained losslessly on HP and locally:

- `~/archive/libhft/codex-llfix-reference-20261011/hp-framework-tx1.tar.gz`
- 155 sealed files; 129,412,292 compressed bytes.
- Archive SHA256: `34e616ac629eed263ee3e393c5e0d90fb79e6a31106ed7035a527ba46ccf6046`.
- Seal SHA256: `15adff03800a2bab3c7a6c7a3adc0641dfdf5c288e30d51faffd32442f21136b`.
- Both streaming replicas verify full membership, hashes, sizes and modes.

Cleanup completes for the two old completed capture directories, the first
source/operations directories and the verified uncompressed archival duplicate,
after exact membership/hash/size/mode and both compressed-replica checks. The
first two cleanup operations refuse unreadable PAM/SSH-agent process details
before deletion; their original scripts and failures remain retained. The final
operation records every inaccessible process, checks all same-UID readable
arguments/cwd/executable/file descriptors for consumers, and independently
requires every original native PID/start identity to have exited. This is not a
root inspection of all processes.

The current eleven-file source capsule, preparation and operations remain active
for the operator-dependent fresh proof. Both complete compressed archives remain
verified. No other session's path, installed payload, old archive or SCAN tree is
touched.