# HP llfix bounded-retention timing diagnostic, 2026-10-12

This separate diagnostic follows the passing
[pair-storage functional experiment](RECORD_2026-10-12_hp-llfix-pair-storage.md).
It asks whether bounded working evidence permits a fresh original/framework
comparison under the existing quiet rules. The earlier quiet5 data and grades
remain at their original pins.

## Declared source and method

Private source `35d637a1a335148ab08ec07f91a22db6b83cc8c6` is preserved on
`s/codex-llfix-reference-hp-bounded-timing-source-20261012`.
The 15-input capsule SHA256 is
`48ab8b13dda133931c0c197566265c03b0f2e1c067df20272755cef1a85c97fc`.
All 29 local controls pass, zero skips, before and after normal main integration.
The matrix function AST and original activity auditor are unchanged. A rejected
normal push was resolved by fetch/rebase/reverification/retry, with no force.

The explicit `--bounded-timing-experiment` opts into the separate method. A fresh
three-pair bounded functional capture and complete cold proof from the same
source and host policy must pass first. Three timed pairs per arm then run in
forward/reverse/forward order: original, framework upstream RDTSCP, framework
MONOTONIC_RAW. Every fresh pair sends 1,000 warmup and 1,000,000 measured orders.
The unchanged protected llfix 1.0.7 original/framework/receiving-peer ELFs, original
GCC 11.5/native provenance, full mapped persistence and fixture remain pinned.
The physical Solarflare Onload DAC uses client CPU 17/server CPU 16; observers
stay on 0–7. Receiver-only spin and 1 MiB buffer use the existing rx16 launcher.
No SDK build or root payload change occurs.

Before every timed pair, the existing 120-second quiet preflight runs with its
original 5% activity/load/placement gates. After both native processes exit, a
three-second monitored tail precedes lossless archiving. Two independently
verified complete per-pair archives precede working raw pruning. Before the next
pair, the full quiet preflight repeats and host policy must match. Continuous
pidstat/resource observations cover native, tail, retention and preflight work;
those intervals remain separately labelled. The activity auditor's expanded
native sampling windows and unowned kernel/controller scope are unchanged.
Cold review verifies every actual preflight receipt, the complete pair roster,
monitored tails, journals, required values/groups/owners/counts/envelopes, all
CSV/HFTBRW samples and actual statistics.

Bounded capture without the explicit switch is refused. Accumulating proofs
cannot substitute for bounded proofs. No result is rescaled to a different
clock divisor, and monotonic remains a separate diagnostic. Full native
persistence stays inside each measured run. Archive work takes place between
native pairs; this is a declared new storage-retention method, not a retrospective
regrade or causal latency experiment. Current framework preallocation and
Stage 2 llfix 1.0.8 remain separate source/runtime epochs.

## Execution and original outcomes

HP alone stages and executes through high-priority CPU slots. Preparation,
cold audits and lossless retention use shared slots; native work uses
isol-no-shared. Fresh read-only status found irqbalance inactive/dead with PID 0.
Source staging queued behind another session's exclusive .NET lease, then
launched durable worker PID 2661874/start ticks 207269374 at 17:53:25 UTC. No other owner's job is stopped or reprioritized; no SCAN contact,
service, IRQ, turbo, governor, sysctl or cache-policy write occurs.

Immutable operations live under
`~/build/codex-llfix-reference/libhft/hp-framework-bounded-timing-20261012-ops15`;
the runtime root is
`onload-load-generation1/captures/hp-framework-bounded-timing-20261012-1`.
Some CPU-slot reason strings retain the previous pair-storage label; exact
source/operations paths, hashes and worker identity identify this generation.

Preparation completed 17:53:26 UTC. All three fresh functional pairs ran
17:53:26–17:55:23 UTC, with six native exits zero. Their cold review completed
18:01:36 UTC: 6,006,000 complete order copies and two million framework samples
pass the original checks. The timing phase acquired its exclusive lease after
waiting behind the fullbench owner's canonical C++ qualification, then began
its initial quiet preflight. That preflight rejected at 18:03:38 UTC after
120.01 seconds: another process used at least 5% of one CPU. PID 221861
(`code`, start ticks 172200699) peaked at 22.7%; PID 892412 (`codex`, start ticks
182386193) peaked at 5.9%. Load1 fell from 1.00 to 0.18; load and placement
were not the stated blockers. **Zero timed pairs started.**

The failed capture, preflight originals and worker failures remain intact.
Capture cold grading was not run because there was no completed timed capture.
The worker retained the complete generation, then exited with its original
failed status. No timing matrix or improvement is claimed. A quiet HP window
is required before a separately named fresh attempt; the worker does not
automatically repeat the rejection. Native summaries alone supply no
quiet timing, parity, vendor, SDK, Stage 2 or full-session admission.


## Complete retention

The complete 105-input generation verifies on HP and BEELINK2. Its lossless
archive is `~/archive/libhft/codex-llfix-reference-20261012/hp-framework-bounded-timing1.tar.gz`,
113,794,254 bytes, SHA256
`f359966c862c904706b405e333df52c20ec89a8924cfbc86b1c0696520ae2510`.
The seal SHA256 is
`c42d910546444d84adb80a096e07b2fe84a04efd2fda06cd07b8a6207ade2cbf`.
The unchanged full streaming verifier SHA256 is
`86f05bac518be7662b7b3f506880bf443f4bb09100bf9f099a64df5c0eb3b56a`.
Every original byte, size and mode matches; no source or raw sample is downsampled.

The [compact selection](evidence/hp-llfix-bounded-timing-20261012/selected-files.json)
contains 105 original files/1,840,024 bytes plus the index. It records the eight
remaining complete archive inputs, including source and pair archive containers.
Large native journals/raw samples remain inside the verified lossless pair
archives, not Git. Git preserves selected original bytes and executable flags;
original full modes remain recorded and preserved in the complete archives.

This source generation passes preparation, native functional work and full cold
proof. Its timing attempt remains a zero-pair quiet-preflight rejection.
The three-second timed retention tails, per-pair timing preflights and final
nine-pair numeric comparison still require an actual quiet continuation.
Earlier quiet5 observations, clock-divisor differences and vendor claims are
unchanged. No Stage 2, full-session or current SDK/runtime grade is inferred.