# SCAN IRQ wrapper terminal repair

## Original attempt retained

The user's first invocation retained
`~/archive/libhft/scan-nic-irqs-20261010T151951Z-2269748/` on SCAN. Its original
`source-verification.txt` and `before.json` are present; `apply.json` is empty
and `after.json` is absent. The command is no longer running. A separate live
readback still finds all twenty incorrect Mellanox completion IRQ affinities,
and noninteractive sudo still requires a password. No successful root application
is claimed. The first wrapper did not retain its stderr, so the original sudo
message is unavailable.

The actual installed `host-cpu-slot` starts its supervised command with
`start_new_session=True`. The original wrapper authenticated with `sudo -v`
before the queue, then used `sudo -n` inside that detached session. This cannot
rely on the calling terminal's sudo timestamp. An inert negative control
reproduces authentication refusal without performing any root operation. A
separate read-only probe under SCAN's actual **high-priority isol-no-shared
lease** confirms that the detached child has no controlling terminal.

The original three receipt files are copied byte-for-byte into
[the evidence](evidence/scan-irq-wrapper-20261010/original-failed-receipt/before.json).
The original failed archive and original v1 cache capsule remain untouched.
The earlier measurement evidence is not rewritten or regraded.

## Separate repaired generation

The wrapper now creates a fresh controlling terminal with util-linux `script`
inside the same high-priority quiet lease, then requests sudo there. Its terminal
transcript destination is `/dev/null`, with input echo disabled and no input
logging. It keeps the 120-second lease deadline, source/profile verification,
inactive-irqbalance requirement and unchanged setter rollback/readback behavior.
Noninteractive callers are refused before queuing; remote callers use `ssh -t`.

Failures now retain a stage/exit-code receipt and a post-command live audit,
including an authentication refusal or failed setter. The successful status is
published only after both the root command and after audit succeed. The public
setter, auditor, installed load profile, source pins and frozen campaign inputs
are unchanged.

Eight focused inert wrapper tests pass locally and on SCAN, **zero skips**.
They execute the real wrapper with fixture host/root/audit commands and a queue
that actually detaches its child, including paths with spaces. Controls cover
the old terminal failure, source/profile drift, authentication refusal,
irqbalance, setter failure, inconsistent readback and noninteractive invocation.
They perform no root write. SCAN executes them under a high-priority shared
lease. A second actual high-priority quiet queue probe verifies a controlling
terminal, terminal stdin and disabled echo inside `script`; no sudo password
is read or recorded by these probes.

The separately sealed v2 capsule is:

`/home/yann/.cache/libhft/scan-benchmark-irq-policy-v2-0405156f5e63`

Seal: `0405156f5e6397f68282f84069984847aa06688fb005a8c4f4ba2215391b7c4e`.

The existing `/home/yann/apply-libhft-benchmark-irqs.sh` now invokes that capsule;
its mode is 0755 and both wrapper syntax and all staged hashes are verified.
The [new verifier](evidence/scan-irq-wrapper-20261010/verify.py) binds seven
source/support files and checks the retained failure, actual queue probes and
eight-test receipt.

Twenty-six of the original measurement generation's twenty-seven bound inputs
remain byte/mode-identical; only this private wrapper has a new generation.
The original verifier continues to describe its original source pin. The two
completed inert SCAN source files are sealed and verified in
`~/archive/libhft/codex-llfix-reference-20261010/scan-irq-wrapper1/` before removing
their exact owning build directory. The [retention receipt](evidence/scan-irq-wrapper-20261010/retention.json)
records the archive hash and cleanup; both operational v1/v2 capsules and the
home wrapper remain available.

**Root application is still pending** the user rerunning the home script and
entering the sudo password at the new prompt. The latest read-only audit still
reports the twenty isolated-CPU IRQs. This setting remains nonpersistent and
requires readback after reboot, driver reload or queue changes. There is no new
benchmark, timing, SDK or release qualification; new timing comparisons require
a fresh matched baseline.