# HP llfix bounded timing capture3, 2026-10-13

This fresh attempt follows the retained
[capture2 preflight refusal](RECORD_2026-10-12_hp-llfix-bounded-timing2.md)
and [verified staging cleanup](RECORD_2026-10-12_hp-llfix-staging-cleanup.md).
It uses the unchanged `35d637a1a335148ab08ec07f91a22db6b83cc8c6`
source generation and 15-file capsule SHA256
`48ab8b13dda133931c0c197566265c03b0f2e1c067df20272755cef1a85c97fc`.
No native binary, SDK or timing controller is rebuilt or modified.

## Readiness and declared execution

At 07:57 UTC both HP pools were free and irqbalance was inactive. A fresh
30.015-second high-priority `isol-no-shared` readiness observation found no
process at or above the unchanged 5% threshold. It verifies all frozen source
inputs and retains the original activity rows. It is not a timing admission
or a substitute for the controller's complete 120-second quiet preflight.

Operations18 preserve all old capture roots and create a new `capture3`.
Worker PID 2885009/start ticks 212354121 launched at 08:00:52 UTC. Verification
uses shared/high, timing uses isol-no-shared/high, and cold proof/retention use
shared/high. The owning controller and observers stay on housekeeping CPUs 0–7;
native client/server stay on 17/16. No other owner's job or process is changed.

The declared matrix is three fresh pairs per arm, in forward/reverse/forward
order: original, framework upstream clock, framework monotonic clock. Every
pair has 1,000 warmup and 1,000,000 measured orders, native persistence, the
full 120-second preflight, a three-second monitored tail, and two verified
lossless pair archives before working raw pruning. All gates repeat before
each pair. The installed llfix 1.0.7/GCC 11.5 generation, Solarflare Onload DAC,
receiver-only spin and 1 MiB receiver buffer remain exactly pinned.

Verification reuses the original three-pair bounded functional proof only
after matching source/runtime/prepared inputs and current host policy.
Functional capture SHA256:
`1b3260edcd38c2d4ca2a2fdaf7137190f350c7eca273bb403d28b07d5bbec58a`.
Cold audit SHA256:
`96d69f0e33b2d4ad14b9f8bd54249a6275b70e917517abd36e7672a23cad705f`.
Its complete original archives remain verified on HP and BEELINK2 at their
previous pins. This new archive retains those proof bindings rather than
making another staged duplicate of the full reused proof.

No SCAN contact, helper pause, threshold relaxation, service/IRQ/turbo/sysctl/
cache write, shared framework/clock/helper, Stage 2, released SDK or full-session
source edit occurs. Current framework preallocation and Stage 2 llfix 1.0.8
remain separate generations. Native summary agreement alone cannot promote
quiet timing, clock parity or reproduction of the vendor's different setup.

## Original outcome and preservation

Frozen source, installed runtime, preparation, functional-proof binding and
current host-policy verification all pass. The full 120.01-second preflight
ends at 08:02:53 UTC and refuses VS Code (`code`, PID 221861/start ticks
172200699), observed at 22.7% of one CPU at 08:01:49 UTC. It is the sole
retained process above the unchanged 5% threshold. Load1 moves from 0.01 to
0.02 and is not the blocker. The process context preserves its parent PID,
session/process group and observed cwd; it is not permission to stop it.

**Zero native pairs started.** Capture and worker failure receipts retain
the original preflight refusal. Cold capture grading does not run without
a completed capture, and no new numerical comparison exists. The reused
three-pair functional proof remains valid only at its original pin.
Retention returns zero and the durable worker exits. The 30-second readiness
observation again did not establish continued quietness. Closing VS Code would
remove the observed application blocker; the next attempt still needs a
whole-host quiet window. The threshold and observed identity remain unchanged.

## Complete archive and exact committed selection

The complete archive `hp-framework-bounded-timing3.tar.gz` contains 36 sealed
inputs and occupies 277,477 bytes. Both HP and BEELINK2 full streaming
verifications agree on every file's bytes, size and mode. Archive SHA256:
`21b942f2ea7e99a16b2c2cceb3027345723a161dad1685120783388c5f5740ee`.
Seal SHA256:
`24a64e1c4c51b76ef9d900e2e90efb98c229108f3257bc64104d890615d8f714`.
Both archives live under `~/archive/libhft/codex-llfix-reference-20261013/`.
The unchanged full verifier SHA256 is
`86f05bac518be7662b7b3f506880bf443f4bb09100bf9f099a64df5c0eb3b56a`.

The [selection index](evidence/hp-llfix-bounded-timing3-20261013/selected-files.json)
binds 45 files/580,940 bytes plus its index, including original source files,
readiness/preflight rows, failed receipts and separately identified post-seal
worker/replica/transfer logs. The only excluded container is the full source
tar, preserved in both lossless archives. No journal or sample is downsampled.
Git retains the exact selected bytes and executable flags; original full modes
remain in the metadata and archive. Original SSH carriage-return bytes stay
unchanged, including any whitespace-check findings on those log lines.

After normal rebase, the first local verifier incorrectly compared every
checkout's full POSIX mode. It refused on Git's expected `0664` to `0644`
conversion for 15 source files. The corrected Git check verifies exact bytes
and executable flags; both full archives still verify the original complete
modes. Cold checks reproduce all 45 Git blobs, all 15 frozen source hashes,
the original 120-second refusal/Code identity, successful verification and
retention, and zero native pairs. No archived byte, mode or grade is rewritten.

This is a retained quiet-preflight failure. It changes no old grade, timing,
clock-parity, vendor, SDK or report admission. The next timing run requires
the same complete functional binding and full per-pair activity gates.