R3 S1 native headroom run 03

On 2026-10-16, the 70-second full-rate S1 measurement and independent stopped inspector both exited 0, after admission exited 0. All three launchers confirmed their whole outer service stopped. This establishes finite S1 headroom only; FULL R3 and the original ten-gate acceptance were not run. Failed runs 01 and 02 remain preserved.

Authority and inputs

Runtime source: 5220e27f81e3f1e3285dd736057dd70a25c261c5, clean before and after every cell, in DATA/scratch/r3-execution-03. PR75 hosted fast and extended succeeded; it merged at 06:51:08Z as e79080c6159e9202d8c858f724b9b81bee21c33e; runtime ancestry in fetched main was checked before admission. DATA means /run/media/kmosoti/data/FabricO11y.

Frozen product e078ba23b543126011a2136dd1f7e98ca65370eb, canonical compilation source 28bcdf7ac833ab634d3b130b85cb2a0aa47eb7a8, and separately admitted native simulator ELF 5d0555dfc38cd001d0ecca0f488d309eb0be02cdf0cf295b3e07cbb3c79eee24 were unchanged. The 5220 caller correction privately creates the helper output directory before setup; it does not change the workload or gates.

Binding	SHA-256
Corrected metadata plan	b162823bcb0a37b6a2244e6218df126e0965fa1ea13365edb886a69227b17334
Owner binding	972010a770b101cba01981f2e0579f8f6b5c23f9fe110d71fa53d815b9e22e7b
Actual admission	09c00352bd0d5ca377b82e347824007da48b23d94db01bb55a6afd6422c3bc76
Independent expected inputs	4940a5875549cf8282d03d52b5a809d41a38a85787522a3009843a73bfdb8d61
Native publication certificate	11036a5d01b46e49bcb16da8f66c5a0dadaa4ce925258afeeeee3c7b31273b50
Browser continuity certificate	397e5b4bb60bf9df575dac852e9c6354a9d4408f2571292f8b11ea4917649ef8
Immutable headroom pending evidence	99f56d09fe8c53a68d8de692cd06dad1e46f0f0d67cd7a45d44b64663c8f3a2f
Terminal ledger	204a48bc9ddadf125b9d66b017ffe1f456ca8663e8f2a7c7aa1a4162f14cdc1e

Certificate paths, complete artifact/source/input hashes, actual commands and private receipt locations are bound in DATA/results/r3-s1-replacement-tls-preparation-03/s1-headroom-terminal-03.json and its admission. Certificates authorize finite mechanisms; actual run evidence was captured live. Original contradictory metadata remains preserved; the append-only corrected map was posted before execution.

Exact guarded commands

Working directory for all commands: /run/media/kmosoti/data/FabricO11y/scratch/r3-execution-03. Drivers invoke tools/resource_group.py; commands below are the actual guarded entrypoints, not uncapped equivalents.

Admission:

python3 -B /run/media/kmosoti/data/FabricO11y/results/r3-s1-replacement-tls-preparation-03/run-step.py r3-s1-admission-03 1073741824 python3 -B /run/media/kmosoti/data/FabricO11y/results/r3-s1-replacement-tls-preparation-03/prepare.py --binding /run/media/kmosoti/data/FabricO11y/results/r3-s1-replacement-tls-preparation-03/binding.json --binding-sha256 972010a770b101cba01981f2e0579f8f6b5c23f9fe110d71fa53d815b9e22e7b

Measurement:

python3 -B /run/media/kmosoti/data/FabricO11y/results/r3-s1-replacement-tls-preparation-03/run-measure.py r3-s1-measure-03 5368709120 --delegate python3 -B tools/qualification/soak_r3.py --admission /run/media/kmosoti/data/FabricO11y/results/r3-s1-replacement-tls-preparation-03/admission.json --admission-sha256 09c00352bd0d5ca377b82e347824007da48b23d94db01bb55a6afd6422c3bc76

Independent stopped inspector:

python3 -B /run/media/kmosoti/data/FabricO11y/results/r3-s1-replacement-tls-preparation-03/run-step.py r3-s1-inspect-03 1073741824 python3 -B /run/media/kmosoti/data/FabricO11y/results/r3-s1-replacement-tls-preparation-03/inspect-stopped.py --expected /run/media/kmosoti/data/FabricO11y/results/r3-s1-replacement-tls-preparation-03/expected.json --expected-sha256 4940a5875549cf8282d03d52b5a809d41a38a85787522a3009843a73bfdb8d61

Cell	Actual UTC interval	Exit / launcher exit / outer stop
admission	2026-10-16T06:51:53.307386+00:00 → 2026-10-16T06:51:54.313220+00:00	0 / 0 / confirmed
measure	2026-10-16T06:52:25.049549+00:00 → 2026-10-16T06:54:38.307185+00:00	0 / 0 / confirmed
inspect	2026-10-16T06:55:34.081938+00:00 → 2026-10-16T06:55:36.088555+00:00	0 / 0 / confirmed

Observations and limits

Workload: 100 identities and 100 workers, seed 0xA11FA001, two 512-byte logs/second/identity and 32 metric points/15 seconds. The actual native helper offered all 70 seconds; the stopped inspector reparsed native offers and syscall publication, continuous real UI evidence, checkpoint inventories, runtime phases and resource joins. It rejected an injected forged stopped-source hash with pinned input changed.

Actual phase maxima (seconds), each accepted with the registered 1.25 multiplier:

Phase	Actual maximum	Registered budget
Setup	61.554994276	170
Exposure transition beyond offered time	0.172049567	10
Drain/seal	0.053602806	60
Shutdown	0.452304316	20
Checkpoint	0.255148326	20
Closeout through outside observed whole-service stop	0.144029414	20

Measurement used the registered 7500-second activation deadline, 5/6 GiB memory high/max, 1536 tasks and zero swap; admission and inspection used default 1800-second, 16/20 GiB, zero-swap launchers. Fresh storage reservations were 1/5/1 GiB respectively under the strict 95 GB DATA census. Independently captured live unit/proc/kernel identity is pinned by owner observation SHA-256 47d90fcd685d021dadb9241bcda35936333748120cb209540d88e24ded487a7e; measurement workload cgroup identity was device 30, inode 247907.

After workload wrapper/descendant reap, the held workload root was empty (pids.current=0, populated=0), peak 774,553,600 bytes and 316 tasks. Aggregate outer accounting, honestly measured while only the guardian remained, showed peak 785,080,320 bytes and 317 tasks; swap current and all OOM/high/max events were zero. The guardian subsequently exited and the outside launcher confirmed the whole service stopped. No post-guardian kernel peak is claimed. Runtime recorded clean shutdown, no forced shutdown, immutable inputs, simulator/server exits 0. All three launcher temporary directories were removed; evidence/checkpoints and previous failures were retained.

Actual outer receipt	SHA-256
admission	8a6f036344063e5cae17f6da6d7bb9838176559d406afcfd582b73e06526dab3
measure	dac7ebf6360b7f8b2c4567383671b5fb119c426004ad7d6e643783f3447345ff
inspect	501eaaa1a6d0576be8928b9cf80c996a532f07b072a4cf7b7403c1e34b6644a3

The immutable headroom file retains validated_pending_inspector_stop. The terminal ledger separately joins the inspector’s actual exit and stopped outer receipt; no pending artifact was rewritten into acceptance.

Board result and receipt binding; resolved measurement argv; resolved inspector argv. Raw evidence stays in controlled DATA storage; this page contains no credentials or collected payloads.

FULL admission remains pending actual exact-candidate #41 installation, #42 service/query, #43 pressure/outage, #45 browser and #46 fresh-owner closures, current immutable artifacts/certificates/main authority, fresh board review, storage/resource admission and sole scheduler clearance. This S1 is not a substitute for the registered 7200-second exposure or any independent acceptance gate.