# Physical session DAC configuration boundary

The shared session DAC helper now loads inert machine inputs from
`LIBHFT_PHYSICAL_DAC_CONFIG`. Development uses its private file only when a
caller explicitly supplies it; the helper no longer discovers a mirrored file
under `internal/`. A stripped harness carries only a synthetic example and has
no default rig or installed payload admission. The existing **two rig
records and sixteen installed SHA-256 values are preserved exactly**, including
the legacy default rig. Existing queued packages and root installations are
unchanged.

The affected Java, .NET and Rust entrypoints import and show help without
private facts. Jobs require a configured rig; missing or malformed explicit
inputs cannot fall back to private defaults. All requested legacy payload pins
are checked before the first remote operation. Root ownership and actual
installed hash verification remain required. Instrumented generations keep
their separately pinned complete runtime trees.

The .NET comparison gate reports absent legacy admission as a blocker rather
than borrowing hashes or throwing a lookup error. A source archive reports
`source-archive-unqualified`, including under another Git checkout, and that
identity cannot promote a retained .NET arm. Physical counters, topology,
quiet-window, raw sample, admin, delay, rate and stability checks remain required.

Retained .NET grading sources and Rust/legacy Java manifests now preserve the
effective deployment configuration with its hash. Java's three legacy DAC
controllers resolve the contract auditor from the owning harness. A missing
auditor stays missing; an enclosing checkout cannot supply it.

Verification passes **335 focused checks**, with **zero skips**. This includes
the retained real session evidence, negative payload/runtime mutations, current
report gates and new configuration/archive checks. The complete stripped
selection also passes **25 checks**, including actual help from **18 session DAC
entrypoints**, explicit synthetic configuration, refusal of missing inputs,
unqualified identity and ancestor isolation. All **715 materialized files**
(selection plus templates) remain unchanged after those archive checks.
The source-comprehensiveness gate passes. These are fixture/configuration
checks, with no engine compilation, physical run or new timing grade.

Readiness selects **712 files (9.6 MB)**, with **250 scrub findings in 77
files**, **94 textual escapes** and **zero dead documentation links**. Other
deployment assumptions, engine paths, external SDK/licence admission and release
qualification remain work in the export plan.

Original receipts, checker, preservation baseline and seals:
[physical DAC configuration evidence](evidence/physical-dac-config-20261003/SHA256SUMS).