# Artio v10 complete-fixture runtime and physical controller

2026-10-12. The separately pinned v10 runtime and physical admission reader
qualify on **HP and SCAN**. These are real localhost functional sessions,
with **no physical, timing or release grade**. Older runtime pins and grades
remain unchanged.

## Admission and immutable inputs

The [complete original fixture](RECORD_2026-10-12_artio_complete_fixture.md)
now has its own runtime and physical entry point. The controller requires its
explicit `canonical_body_v2` capability, both successful endpoints and the
complete original bodies/Logons/owner/admin/thread proof. A declaration or an
old twelve-cycle capture cannot remove the comparison-fixture blocker.

Every report run must have the successful original-evidence receipt. The
manifest derives alignment from all runs; physical counters, sample count,
rate, scheduler delay and percentile stability still decide report admission.
A fixture can pass while rate or timing fails. v9 cannot borrow v10 admission.
The physical grading snapshot retains the complete checker's dependencies.

| Input | Identity |
|---|---|
| Qualified controller source | `3f2619dc0ba5edf1d01a7555402b4eb080e3e6d4` |
| Whole stripped source archive | 793 regular files with exact hashes/modes |
| Previously qualified compiled source | `80aa66ff6316956ae238678ff40ded39fea2b0ad` |
| Identical independently built JAR | `66ab83974eaf352027c1dbe6151863180bbec64d456d13480f86cc7a5f7cd337` |
| New 26-file payload tree hash | `e523874a1702a8f063c8d0d69cf4c5cc8bc5e7ba51d866a4220eda753aa5cc5c` |
| Fixed root namespace launcher | `9672abf4076b0eb76b0bb881ad396d78051e6e2caed3ff522325008c95489dd1` |

All library pins and the adapter script match the preserved v9 inventory.
The JAR comes from the two independent prior compiles, without a new build.
SDK/build and fixture receipts are separate pinned payload files. Installation
is atomic, root owned and refuses changed existing inputs. The fixed namespace
launcher runs Java as `yann`, with an empty environment, fixed paths, bounded
timeout and per-instance result/runtime directories.

## Actual qualification

The stripped archive passes **104 portable checks per host, zero skips**.
The fixed payload adapter then runs **twelve real TCP pairs per host**: all
four flows with excluded warmup 0, 5 and 17, twenty measured samples at 100/s.
The actual worker masks match those expected by the physical controller.
Each pair is re-read by the physical admission reader with complete original
bytes and real process exits. The resulting receipt matches the original.

Across both hosts this retains **24 pairs, 480 primary samples, 480 scheduler
delay samples and 1,640 application frames per peer**. Eighteen real-artifact
negative controls refuse a legacy capability, false/missing peer declaration,
missing original capture, changed last frame, missing Logon, failed endpoint,
wrong thread placement and truncated raw samples. All source bytes/modes,
new payload inputs and the preserved old SDK remain unchanged.

A separate frozen-reader replay reproduces **all 24 receipts exactly**,
normalizing only the copied artifact directory. Original bytes/modes remain
unchanged. It opens zero new sockets and compiles nothing. HP waits at high
priority, both actual runtime qualifications hold `isol` leases, and HP's
read-only replay holds `shared`. Other sessions' jobs and queues are preserved;
these cooperative leases do not prove absence of unleased work.

## Original failures and historical tests

The first caller on both hosts incorrectly requested a private default rig
from the stripped archive's deliberately empty configuration. It failed before
tests or sockets. The next caller corrected that input but still selected the
first build directory, and refused the existing directory before tests or
sockets. Both callers and all four failure logs remain unchanged. The passing
caller uses a distinct build root and only supplies the host field needed by
the functional reader; actual physical configuration remains a separate,
hash-bound private input.

The unversioned, v8 and v9 DAC tests depend on private campaign records and
root installer sources, so they now live under `internal/`. Every original
test remains. The first move exposed six old adjacent-controller path errors
with 331 passes; that original failure log is retained. Correcting those paths
produces **337 combined checks, zero skips**. The public Artio suite contains
the 104 portable checks, without requiring private evidence. Source checks
before the move also passed all 151 selected regression checks.

## Staging, physical caller and retention

Both hosts verify all nine staged runtime installers, including the new v10.
`~/install-fullbench-stage5-next.sh` checks both hosts before root installation,
waits through CPU contention and uses high priority on HP. Its previous
eight-runtime version is retained. Sudo authentication must come from the
user's terminal.

The ready physical caller binds the original 793-file archive and explicit
private rig configuration. It checks actual root ownership/hashes **before
queues, sockets or outputs**, then requires both CPU leases for four strict
tiny pairs and the full three-run 10,000-sample report. The original gates
and failure rows are retained; campaign promotion is not claimed by the caller.
Actual read-only preflights confirm **v10 is missing on both hosts**. No new
physical job has been queued or run. The old eight requested root generations
also remain pending at this checkpoint.

Evidence: [sealed import](evidence/artio-v10-controller-20261012/import-receipt.json),
[joint original replay](evidence/artio-v10-controller-20261012/cold-check-hp-scan/report.json),
[replication](evidence/artio-v10-controller-20261012/replication-receipt.json).
`~/archive/libhft/artio-v10-controller-20261012` seals **1,265 files /
20,050,173 bytes**, SHA-256
`547b9e9058c61823e703ef8b4a27547b5ef33b530fecb89df109d3ea3332903d`.
It retains 1,243 original committed files plus import/replication receipts;
23 source/JAR products stay archive-only. All sealed SHA-256/size/mode entries
are independently checked on both hosts. Binary SDKs are not added to the
export or website. Root installation, fresh physical report gates, matched
libhft comparison, whole-harness consumption and release remain open.