# HP llfix storage retained between pairs, 2026-10-12

This functional diagnostic follows the [resource observation](RECORD_2026-10-12_hp-llfix-resource-observation.md).
It tests whether exact lossless evidence can leave the working set after each
completed native pair, while preserving every persistence write inside the run.
The earlier quiet5 matrix and all its literal blockers remain unchanged.

## Method and source

Private source `6ab426a488e1cec557cbadca006a284199b5581a` adds
`--retention-mode bounded` to the private framework controller. The 15-file
capsule SHA256 is `cd6e4f47d760f41eccc0244f7988682f30dcd2610cdc9db255f750d479c9529a`.
All 24 controls pass locally, including corrupt/missing archives, failed second
verification, changed raw/kept files, symlinks, unsafe members and exact mode
restoration. The matrix AST and activity checker are unchanged. Bounded mode is
refused for timed capture, and functional proofs cannot cross retention methods.

Two methods run in declared order: accumulate, then bounded. Each starts the
same three original/framework-upstream/framework-monotonic TX arms, each sending
1,000 warmup and 1,000,000 measured orders. All reuse the same installed llfix 1.0.7
original, framework and receiving-peer ELFs, GCC 11.5 provenance, physical
Solarflare Onload DAC, client CPU 17/server CPU 16 and receiver-only spin/buffer profile.
No SDK, native timing boundary, persistence configuration or fixture changes.
This single ordered functional comparison supplies no causal latency estimate.

Accumulation retains working files as before. Bounded retention waits for both
native exits 0 and the pair's end marker, seals every original byte/mode, then
independently verifies two complete compressed copies. It removes only journal
segments, sequence stores and CSV/HFTBRW samples after both checks and an
unchanged-original inventory check. Configs/logs/receipts remain. Both first
copies are on HP; final whole-generation verification on BEELINK2 is separate.
No sample is downsampled. Cold review rechecks both archives, restores one pair
at a time to a fresh owning temporary directory, runs all original required-value,
group, owner, count, envelope and raw-statistic checks, and removes the restoration.

Resource snapshots label native and retention boundaries separately. Whole-run
counters in bounded mode include compression/verification/cleanup and cannot be
interpreted as native TX cost. Pair snapshots show the actual working footprint;
sampled extrema can miss shorter peaks. Background unleased work is still visible.
Host policy must match within and between both methods. No timing, parity,
vendor, Stage 2, SDK, full-session or release admission is inferred.

## Queue and retention

The high-priority shared source-staging request waited behind the active fullbench
physical lease. Durable worker PID 2596943/start ticks 206300587 launched at 15:11:57 UTC.
Preparation passed 24 controls, zero skips. Six serial functional pairs ran
15:12:53–15:15:06 UTC under isol-no-shared/high, with twelve native exits 0 and matching
host policies within/between methods. Original cold audits began at 15:15:07 UTC under
shared/high; lossless whole-generation sealing completed under shared/high.
The same CPU-slot manager serializes all other owners' jobs. Nothing is stopped
or reprioritized. No SCAN contact, helper pause, service, IRQ, governor, turbo,
sysctl or cache-policy change occurs.

Cold checks completed at 15:26:51 UTC, exit 0 for both methods: 12,012,000 required-value,
group, owner, count and envelope order copies, plus four million framework CSV
samples checked against HFTBRW and independent statistics. Bounded restoration
uses one temporary pair at a time, preserves original bytes/modes and leaves no
restored raw directory. Original failures are retained; no output is overwritten.

HP's complete 188-input archive occupies 214,055,012 compressed bytes, SHA256
`6571ffc3e7af01caf2469df0e4bbe73274426b81226f0b15eb0519260998e0b5`;
seal SHA256 is
`58afae52f070b41cc4f6ab2032ddf7ba12e310824c5eb48b27e0c93caade8f92`.
The second whole archive was transferred under a high-priority shared lease and
stream-verified on BEELINK2: every sealed original byte, size and mode matches.
Both full copies remain under `~/archive/libhft/codex-llfix-reference-20261012/`
as `hp-framework-pair-storage1.tar.gz`.

The [compact selection](evidence/hp-llfix-pair-storage-20261012/selected-files.json)
contains 157 original files totaling 3,020,194 bytes, plus its selection index.
Its Git blobs preserve the original bytes; the index records each original
size and mode, including permission bits Git does not represent. The full
archives preserve those modes. The index names the 39 remaining full-archive
inputs, including large raw journals and the source tar;
those remain in the lossless archive. No journal or raw sample enters Git.

## Observed working footprint

Values below are allocated bytes at recorded native-end and retention-end
checkpoints. Native-end includes the just-completed full persistence workload.
Retention-end includes both compressed copies and all retained metadata.

| Arm | Accumulate native end | Bounded native end | Bounded after retention |
| --- | ---: | ---: | ---: |
| Original | 1,678,520,320 | 1,678,512,128 | 61,071,360 |
| Framework RDTSCP | 3,372,101,632 | 1,756,147,712 | 134,361,088 |
| Framework MONOTONIC_RAW | 5,065,084,928 | 1,827,352,576 | 209,260,544 |

At observer close the accumulating method occupies 5,065,240,576 allocated
bytes versus 209,293,312 for bounded retention. The largest native-end footprint
falls from 5.07 GB to 1.83 GB; after retention the completed working footprint is
about 209 MB. The bounded method removes 31 original raw/store files only after
both lossless copies pass. Original/framework archive sizes per copy are
29,174,904 / 35,268,274 / 35,286,041 bytes, respectively.

Native-window kswapd scan counts for accumulating pairs are 95,733 / 429,195 /
396,842 pages; bounded pairs record 427,811 / 28,654 / 0. Accumulation records 128
direct-reclaim pages, bounded 0. The first bounded pair also records 113 pages of
swap-out. Full native persistence remains: both methods dirty about 0.5 million
pages per pair. These are host-wide window deltas; the ordered methods start
from different cache histories and only one pair per arm. They demonstrate
bounded evidence space and a resource lead, not a causal or latency estimate.

Archive/verification work extends bounded collection and performs additional
reads/writes. Its whole-run counters are separate from native-window counters;
compression does not make native persistence I/O disappear. Full cold proof
passes, and both complete whole archives verify. The earlier quiet5 activity
rejection and clock-divisor mismatch remain unchanged. This generation reuses
the older framework ELF; it does not qualify newer framework preallocation or
Stage 2 llfix 1.0.8. No further native run was needed for replication.