# Artio normal immutable runtime and installed DAC entry — 2026-10-25

Both rigs pass eight relocated and eight installed DAC pairs, followed by
independent collected replay. All four canonical flows preserve zero/five
warmup, 24 measured samples, complete typed owners, exact shared raw clocks,
original administration and shutdown. Each host checks 1,540 application and
160 admin frames, plus 384 measured values per series. All 89 original
SDK/parent files remain unchanged. This closes the normal-runtime gate and
exports no report-grade cells. Fresh quiet full-size physical runs remain open.

## Qualified, byte-exact payload

Source: `aa40e2cf559f8402ab0864676fa70ee1bc32cfc0`.
Both rigs install generation
`db8c84ad5c3616185a38741b8dc2f582766ad098660c8fdad1b0cdf474b23d9b`.
All 28 manifest payload bindings match across hosts: the 26 unchanged original
SDK/runtime files, a normal-user launcher and `producer.jar`. The latter is
532,877 bytes, SHA-256
`ae0034e3f9ffc0e5763fc097013a66786e5cd8c006fc8c1d225d92a8eee9cee8`.

Its 119 classes comprise the four qualified producer classes, 73 read-only
shared-harness classes, 32 generated numeric codecs, eight normal bounded
runtime/channel classes and two prepared-offer classes. Every class hash
matches between hosts. The reader independently derives them from the pinned
phase receipt and original parent inventories. It checks SDK file hashes
against the qualified inputs, rather than accepting the bundle's declared
hash map. Canonical stored ZIP entries fix ordering, modes and timestamps;
container bytes are independent of host compression-library versions.
Diagnostic pressure classes are excluded from the payload and forbidden in
actual class-load captures. No Java/SDK source is rebuilt or modified.

The [original shared phase qualification](RECORD_2026-10-25_artio_shared_phases.md)
retains its own production and corrected-reader pins. Its captures and both
earlier failed grader attempts remain unchanged. This runtime uses exactly
those qualified class files. Parent phase receipts differ between rigs;
the resulting executable payloads, generation and class maps match exactly.

## Real process and namespace authority

The launcher enforces the fixed generation argument profile, requires a normal
user, records actual UID/GID, inherited CPU set, network namespace inode and
JDK binary hash, then executes the original JDK with the immutable classpath.
It uses one shared run, canonical payloads, no injected administration,
busy-spin transport and no diagnostic trace/probe. All seven original runtime
thread placements are checked. Request/reply and prepared tick clocks retain
the independently qualified boundaries and original shared measurement timer.

The fixed root entry supplies HP's `sfcA`/`sfcB` and SCAN's `mlxA`/`mlxB`,
address and separate endpoint CPU masks. Both actual endpoints run as UID/GID
1000. Class-load records bind the producer/common/numeric classes to the
installed or relocated producer JAR and the original SDK classes to their
qualified JARs. Whole bilateral bytes, bounded twelve-cycle preflight copies,
continuous SDK sequences, every phase owner, all primary/delay values and
complete original Logout are independently checked.

The installed generic helpers and existing one-time sudo registration are
unchanged. No new root code, permission registration or password prompt was
needed. The private controller's Artio engine identity is separate from legacy
Artio adapters. Root-owned generation modes, complete manifest and all hashes
pass the existing helper checks before and after. Only stopped per-instance
IPC/archive state is removed; raw observations remain available.

HP runs under a high-priority functional isolated lease; SCAN uses normal
priority. These are functional DAC checks, with concurrent shared work allowed.
They grant no quiet timing or Stage 5 report promotion. Report collection must
acquire `isol-no-shared` and retain the original full sample/rate, wire counter,
physical-host facts and admission thresholds.

## Verification and compact receipt bindings

The source/reader regression passes 562 tests without selected skips, plus
15 targeted controls on HP Python 3.11. After the portable ZIP and independent
input bindings, all 36 affected artifact/process controls pass. Both native
runtime services finish successfully with exit zero and `MainPID=0`.
Collectors execute once per host; independent local replay agrees with each
native cold proof. No unchanged producer matrix is rerun.

| Host | Runtime receipt SHA-256 | Input manifest SHA-256 |
|---|---|---|
| HP | `3b5a7b928017b3be2ba2bf9b71917d42a2c77a914f1eabd3c6c23b1b1c9e9ded` | `50440a83dd6cf1416333ab65ef4f267eaf658ebd790a730df38ce2714462f92c` |
| SCAN | `c2757a79ee67f4b2df6894934917040cfa43b8eb54e0b09e5abe42ef71a3327c` | `375033f4353b00d3f55aa7e23e7c61ae187e012f09a02b4b9c8a7e482f3d019b` |

| Host | Independent cold proof SHA-256 | Collected review index SHA-256 |
|---|---|---|
| HP | `bf0029a42146a0be6b47f02e82904eb3402b405dceb8daa6350a2eba711fb502` | `5041fe5f48fc7a98571560d0fe66c11586d86b34040bbb9b2694bc09f2e3b46d` |
| SCAN | `e161a83c4c2e9f0db2e064642b05562078ee75f71e70a000dfc87d425cb771d6` | `5150aa46f0693df72e6323fd2922105ff510e6e9b657416f56da2556d84eba64` |

Native roots are
`~/build/codex-fullbench/libhft/artio-runtime-qualification-20261025-v1`.
Independent collected roots are
`~/build/codex-fullbench/libhft/artio-runtime-review-20261025-v1/{hp,scan}`.
Retained `artio_runtime_{stage,qualification,collect,review}_20261025.py`
workers seal the inputs and preserve the original 28-file payload. This
checkpoint changes no older Artio results, SDK policy, physical-report grade,
comparison admission or public release gate.