# HP llfix capture-bounded continuation, 2026-10-16

## Outcome

The [new reference-derived method](../../bench/llfix_reference/PROFILE_CAPTURE.md)
passes two million-order localhost functional pairs on HP, one per clock:

| Check | Observed |
|---|---:|
| Warmup orders per pair | 1,000 |
| Measured orders/samples per pair | 1,000,000 |
| Total checked orders per peer, including capture | 2,002,020 |
| Full-width framework samples checked | 2,000,000 |
| Captured frames per endpoint/pair | 10 |
| Capture file size per endpoint/pair | 2,313 bytes |
| SDK message journals | 0 |
| Actual TCP controls | 9, all expected outcomes |

Both endpoints close and flush capture before warmup. Capture hashes remain
unchanged afterward. Receiver warmup completes before measured release.
Every measured callback reads converted values from the actual llfix message
and group APIs. Independent Python owner/value-fold oracles match all three
partitions: capture, warmup and measured. CSV/HFTBRW counts, values, summaries
and actual maxima agree; cold replay agrees. Both peers exit0 for both full
pairs. This is functional qualification with concurrent shared work allowed.
No latency comparison or timing result is published.

The earlier tiny generation also passes four pairs, 770 samples and846 orders
per peer, with the then-current five wrong-value controls and a valid control.
The final full generation adds precision, party-role and missing-SubID controls.
Four focused Python policy checks and the native bounded-buffer controls pass;
there are no skips.

## Quiet check

At22:15UTC both HP CPU pools were free and irqbalance read
loaded/inactive/dead/PID0. A high-priority `isol-no-shared` readiness job ran the
unchanged120-second host preflight. It refused before any timed native pair:
CodexPID1122920 peaked at5.9% of one CPU. Load1 fell from0.04 to0.02.
The existing5% rule remains unchanged; no process or service was stopped.
Other owners' queued work resumed through the normal lease scheduler.

Preflight source: `b1c2d324d5185585d4deb668dfe4daea5544d24d`, helper SHA-256
`edab16435c02e36ae094114b296c5ee63729769d03c5564109a0af9d997fcf6f`.

## Why a separate method

The original reference and the previously qualified `e94546c8…` framework
sender journal every order through the SDK. The user's current
[`BENCH_RESULTS.md`](../../../docs/bench/BENCH_RESULTS.md) requires capture to
finish before warmup and completeness to be checked in process. The new
`llfix-reference-capture-v1` method selects the public SDK setting
`max_serialised_file_size=0` on both peers and uses its public
`MessagePersistPlugin` for bounded capture/counts. The SDK's small numeric
sequence store remains.

This changes the reference workload's persistence policy and adds an explicit
converted-value consumer. Its performance must carry this method identity.
Earlier original-reference inputs, installed generations and historical grades
remain unchanged. No old timing or functional grade is relabelled as this
generation's proof.

The consumer checks actual owner and FIX sequence, quantity and price,
CompIDs/SubIDs, symbol, side, order type, TIF, timestamp shape and both party
entries. Quantity/price conversion requests four fractional digits; longer
spellings refuse instead of hiding a changed value through rounding.

## Source and products

Final qualified source:
`730ba5e512ce789743aed70439214023e67fa708`, preserved on
`s/codex-llfix-capture-qualified-source-20261016-v5`.
All19 selected source/support/header files are staged and checked before and
after qualification. The unmodified reference archive has204 source files at
upstream `165cc999fa283a4ead17a7b935c5d3f850fec851` (bundled llfix1.0.7).
Eight framework headers and actual compile dependencies are bound in the build
receipt. GCC11.5 uses C++17/O3/native flags; compiler SHA-256 is
`fc1ea664a2a85c301fef71284f5e4906eaeb40a40c5225f9b0ac1aae10b00c2e`.

| Product | SHA-256 |
|---|---|
| Sender | `f3b16bd7bcb2c65561fdd816a013d05fdf37689b53314992cd4beb6a0adfd484` |
| Receiver | `dc918079805e05efafcb0441663ad05e1f250d59a6c7949ace727e46fd2fe530` |
| Native capture controls | `f06296a4504c19123b4261651c7fda4ef3ca01ae4155d24e7aac6fabba6d0cf1` |

Actual ELF identities and all native thread affinities17/16 are checked at
the pre-warmup barrier, with another sender check after warmup. The controller
runs on CPUs0–7. No root installation, shared API, Stage2 adapter, SDK source,
clock or host policy is changed in this continuation. Only HP was contacted.

## Controls and original failures

A valid twelve-order TCP control exits0. Eight separate controls alter price,
fractional precision, missing/nonnumeric quantity, party ID/role, owner or
SubID. Every one reaches twelve SDK callbacks, records one converted-value
error and exits1 with `pass=false`. Their capture prefixes remain valid and
bounded. These controls establish real consumer execution, rather than relying
on counts or a declared SDK validation flag.

Native buffer checks overwrite the caller's borrowed buffer after each
callback, verify the ten copied originals, feed100 further frames without
growing capture, and refuse short or late flushes.

The first receiver compile used an indexed presence query absent from
llfix1.0.7. After switching to its public group-container lookup, the first
functional capture correctly refused: the count tag453 lives in that group
container too. The final adapter reads and converts that actual entry. Both
original failures remain separate working receipts; no SDK patch or historical
grade change was made.

## Remaining boundary

This generation has ordinary localhost functional proof. Its physical Onload
runtime and quiet timing campaign need independent qualification. The result
policy gate refuses the legacy journalling method, missing/false counts,
ungraded values, malformed quiet metadata and noisy/short preflights.
SDK1.0.7 reference work remains separate from Stage2 llfix1.0.8 and canonical
full-session comparisons. No vendor, Stage2, Stage5 or release admission follows.

Only source and compact conclusions are committed. Captures, journals, raw
series, binaries and logs are not added to Git; the removed evidence trees are
not recreated. Functional previews produce no result file or CDF. A later
admitted timing result uses the existing per-key format and bounded CDF.