# HP capture-bounded llfix: physical Onload functional qualification

2026-10-17. Method: `llfix-reference-capture-v1`. HP only.

## Outcome

The [separate capture-bounded profile](../../bench/llfix_reference/PROFILE_CAPTURE.md)
passes its first physical Solarflare/Onload functional qualification:

| Cohort | Actual pairs | Framework samples | Checked orders per peer |
|---|---:|---:|---:|
| Tiny: both clocks, measured/warmup128/1 and257/17 | 4 | 770 | 846 |
| Full: both clocks, measured/warmup1000000/1000 | 2 | 2,000,000 | 2,002,020 |

All twelve native exits are zero. Every actual endpoint capture contains ten
frames/2,313 bytes and stays unchanged after warmup. No SDK message journal is
created. Independent converted-value/owner folds agree for capture, warmup and
measured partitions. CSV/HFTBRW samples, counts, summaries and actual extrema
agree. Final cold replay reproduces all six grades after both peers exit.

These are functional checks under high-priority `isol`, with concurrent shared
work allowed. They publish no latency number, timing result or CDF. The prior
quiet refusal remains; no new quiet attempt was made in this sitting.

## Physical and process proof

The new [controller](../../bench/llfix_reference/capture_physical_controls/physical.py)
requires the actual owned Onload LISTEN socket before starting the client.
Both peers pause after their ten captures. Before releasing warmup, the
controller observes their actual established physical sockets and selected
mapped Onload library, PID/start time, unprivileged owner, ELF, namespace and
all thread affinities. Sender17/receiver16 also agree after receiver warmup
completion. All stack dumps finish before warmup and measurement.

The peers run in `sfcA`/`sfcB`, with Onload same-host loopback disabled.
Receiver-only `EF_POLL_USEC=-1` and `EF_TCP_RCVBUF=1048576` remain explicit.
Both actual ports show positive TX and RX increments for every pair. In the
two full pairs, client TX/server RX increments are150185 and160954;
client RX/server TX increments are4729 and5109. Counter polling retains actual
snapshots, rejects changed identities/resets and sends no probes.

Both cohorts read irqbalance as loaded/inactive/dead/PID0 before and after.
No service, turbo, IRQ, sysctl or other host policy is changed.

## Source and immutable data

Physical source: `e23df0bd8b2923e302e918d291287016233f9b2e`, preserved on
`s/codex-llfix-capture-physical-source-20261017-v1`.
All14 selected controller/support inputs retain their exact bytes/modes before
and after the HP job. Six focused launch/refusal checks pass locally and on HP,
zero skips. The initial local test-loader path error was corrected before the
source capsule was frozen; the physical job has no failed pair or continuation.

Native source remains `730ba5e512ce789743aed70439214023e67fa708`, with the
same19 selected inputs,204 unmodified bundled SDK files, eight framework
headers and actual compile dependencies as the
[localhost proof](RECORD_2026-10-16_hp-llfix-capture-bounded.md). These frozen
inputs are reverified; this does not qualify later framework or SDK edits.

| Product | Unchanged SHA-256 |
|---|---|
| Sender | `f3b16bd7bcb2c65561fdd816a013d05fdf37689b53314992cd4beb6a0adfd484` |
| Receiver | `dc918079805e05efafcb0441663ad05e1f250d59a6c7949ace727e46fd2fe530` |

The existing approved immutable-data installer registers three new data
generations. The existing namespace entry runs their adapter as the benchmark
user. The adapter refuses root before input reads or writes and checks protected
native/config/tool bytes. Both root helpers keep their previous hashes; no sudo
rule or executable helper is changed. All three installed checks pass after
qualification:

| Data engine | Generation |
|---|---|
| `llfix-capture-upstream` | `5322c1f99a1673bb34a2d7565581ccfb5ba4398c0ab1f7d77fc3488e54ddc1b0` |
| `llfix-capture-monotonic` | `7599cbc3f8814530f784f5847242c5579300418104426dd285726f64ee79af3f` |
| `llfix-capture-peer` | `1e5e6cd0834775a94e4314f28182e412f353fa326770dfec576966cd8cb3c85b` |

The old original/reference/framework journalling generations and Stage2 llfix1.0.8
remain separate and unchanged. The reused SDK is upstream
`165cc999fa283a4ead17a7b935c5d3f850fec851`, bundled llfix1.0.7.

## Remaining work

Quiet timing requires the unchanged whole-host120-second/5% gate and monitoring,
followed by result files under the
[compact result contract](../../../docs/bench/BENCH_RESULTS.md). The capture-v1
workload changes persistence and adds a real converted-value consumer; it must
not inherit the original vendor/reference timing identity. A matched libhft
comparison also needs its own equivalent workload and source qualification.
This sitting grants no timing, vendor reproduction, Stage2, Stage5, canonical
full-session or release admission. Raw working output stays outside Git.