# HP llfix registered-generation functional qualification, 2026-10-16

## Status

The approved immutable-generation installer successfully installed all four
llfix data bundles with `sudo -n`. No additional terminal authentication was
needed. The earlier fixed v2 payload remains absent; its installer refusal and
historical grades remain separate.

Nine focused checks pass locally and on HP, zero skips. Four tiny physical
Onload pairs pass, followed by exact cold replay: **806 orders per peer and
770 framework samples**. Both clocks use measured/warmup counts 128/1 and
257/17. Every original body, required converted value, party group, contiguous
owner, framework raw sample and reported statistic is checked.

The first full-workload original and upstream-clock pairs also pass their
million-order native and cold checks. The monotonic client then refused its
initial connection before sending orders. Its original failure is retained.
The next controller requires the receiver's actual owned Onload LISTEN socket
before launching any client; its interactive prompt alone is insufficient.

The fresh listener-readiness cohort **passes all three full-workload physical
pairs and final cold replay**: original, framework upstream and framework
monotonic, each with 1000 warmup and 1000000 measured orders. This checks
**3,003,000 original orders per peer**, six clean native exits, three actual
owned listeners and six established physical Onload sockets. Both framework
arms also pass all **2,000,000 full-width raw samples** against their HFTBRW
series and summary statistics. The original's million-sample count is checked
from its unmodified statistics output; no original raw exporter is invented.
The complete worker, source-input recheck, installed-generation recheck and
before/after inactive irqbalance checks pass. No timing result is claimed.

## Source and immutable inputs

The [private adapter](../../bench/llfix_reference/diagnostics/generation_controls/README.md)
uses the existing `libhft-stage5-generation` and `dac-generation` interfaces.
Runtime code executes as UID/GID1000 and refuses root before reading inputs or
creating files. Root helpers are unchanged. Source preservation references:

- Initial app/preparation: `dd0bf0a52e4abfd639f9b2c7ef897505a7bec2a8`,
  `s/codex-llfix-generation-source-20261016`.
- Passing tiny controller: `75ac2625990d15609c5879b16a08985bfa53e9c7`,
  `s/codex-llfix-generation-counter-20261016`.
- First full-workload controller: `b44fa8fc652abcb5c1ea2566776d694650ff3b21`,
  `s/codex-llfix-generation-full-source-20261016`.
- Listener-readiness controller: `0d4fe43522a8b1118fe0fc93ed80ff2084864d73`,
  `s/codex-llfix-generation-listener-source-20261016`.

Each queued capsule contains the exact controller, user app, preparation,
auditor/observer and helper-contract inputs. Source bytes are validated before
materialization and checked again at completion. Controller-only continuations
reuse the original installed app only after verifying its bytes.

Native SHA-256 identities:

| Input | SHA-256 |
|---|---|
| Original sender | `8003c3734c257c5e76f9a226f542c42d544ca52c83ef1401bec78ff4f09fabd5` |
| October 14 framework sender | `e94546c82dd0d0792d129c6ac2aa63b05ad6437454ca8d413ac1dd7db49686bd` |
| Original receiver | `9f7a2379b99da6c7df7216f276bde074c30b72de0d27fcae902cb278677f1cf4` |

The existing verifier rechecks 522 compile dependencies, eight framework headers
and 204 upstream source files, plus the original build/functional records. This
is the separately qualified October 14 ELF, not a claim about later engine SDK
sources. Bundled llfix1.0.7 at upstream
`165cc999fa283a4ead17a7b935c5d3f850fec851` stays separate from Stage2 llfix1.0.8.

Installed generation identities:

| Bundle | Canonical manifest SHA-256 |
|---|---|
| original | `e8cc138e41a07d40bac5a411000ff4858e238ed6b9fc3ce7b411538228851403` |
| framework upstream | `e4b8a11f917079e8c4f11fc1e1fabe94802b9f68c65f1ad50513796754ed87b1` |
| framework monotonic | `ec4dae6b5b59eacc0e6f8a19a837190cf0c942400ecdd543716ef39999bdc19b` |
| receiver | `2a6e9bbcc7bf5ea1c632f190d02fe88ed6a9212a1fe49b858480718f6983a517` |

## Physical and process proof

HP only, high-priority `isol` leases with concurrent shared work permitted.
Controller/observers stay on CPUs0–7; actual native threads are client17/server16.
PID/start time, executable bytes, user identity, namespace inode, configuration
and actual process environment are checked independently. The fixed root entry's
foreground timeout bounds its subtree; no controller process-group equality is
invented for `runuser` or `timeout`.

Both real established Onload sockets and the selected mapped library are
observed. Client uses plain settings; only the receiver spins and requests
`EF_TCP_RCVBUF=1048576`. Framework clients use their existing ready barrier
before measurement for these observations. The unmodified original has no
barrier. Positive TX/RX packet deltas are required on both Solarflare ports.

The tiny cohort needed two actual device snapshots for two pairs and one for
the others. Polling reads counters for up to five seconds, sends no probe
traffic, retains each snapshot and rejects resets/changed rig identity or no
positive update. Packet counts are not equated with application frame counts.

Installed irqbalance reads loaded/inactive/dead/PID0 before and after. No
service, IRQ, turbo, sysctl, clock, SDK, shared framework, Stage2 or existing
runtime is changed.

## Original failures

The first user app started the receiver successfully, but the controller's
start-of-file receipt pattern missed the root entry's preceding routing header.
That run timed out and the owned receiver exited0. A multiline parser and a
real-protocol regression fix this; duplicate receipts still refuse.

The next cohort passed two pairs, then correctly refused the third when an
immediate cached NIC TX counter did not advance. The bounded polling generation
reruns fresh pairs; it does not regrade that failed observation. Reset, changed
interface and no-update negative controls pass. Original working failures remain
separate and are not copied into Git.

The first full cohort's monotonic connection failure also remains separate.
The listener-readiness cohort uses fresh processes/output paths for all three
arms; it does not combine the earlier passing subsets into its final verdict.

## Admission and output

This is one-way reference TX construction/send, not canonical NOS/ER or a round
trip. The namespace entry's `nos_er` argument is only a routing token. No
performance comparison, quiet timing, vendor reproduction, Stage2, Stage5 or
release grade follows from these functional checks. The original sender's
reported sample count is distinguished from the framework's exported raw series.

Only this compact record and source are committed. SDK journals, logs and raw
samples are working outputs under the session build root. They do not recreate
either removed evidence tree. A later admitted timing campaign must follow
[`BENCH_RESULTS.md`](../../../docs/bench/BENCH_RESULTS.md), including its bounded
CDF and per-key result format. Historical quiet-window and clock-divisor
blockers remain unchanged.