# V2 Runtime Unpacker Integrity

The runtime unpacker is the launch-time counterpart to the executable packing
plan. It verifies the signed packing manifest, unwraps the release envelope,
decrypts the AES-256-GCM payload, maps executable pages, and records a
post-unpack executable-memory baseline before normal game startup continues.

## Integrity Scope

The integrity check compares executable text pages against the signed baseline
derived from the packing manifest. It is scoped to patched bytes in executable
memory and deliberately excludes writable data pages, rollback simulation state,
accessibility fallback modules, and crash reporting helpers. This records
patched bytes in executable memory as release evidence without expanding into
anti-debugging behavior.

Each desktop profile writes:

- an unpacked module map
- a memory baseline manifest
- integrity evidence for release review and support

The page baseline uses SHA-256 and requires a startup full scan plus periodic
integrity sampling. The check is evidence-oriented: on mismatch, the game enters
safe-boot offline-only mode, disables ranked/progression grants, emits
structured telemetry for review, and does not crash the process.

## Boundaries

This layer does not implement anti-debugging, process scanning, driver
inspection, or hidden runtime enforcement. Those are separate anti-cheat and DRM
tasks with independent review. The runtime unpacker must preserve crash unwind
information so protected builds can still produce useful crash reports; crash
unwind information is part of the release gate. The evidence label is
`crash unwind information`.

Deterministic simulation must remain unaffected by protected and unprotected
packaging differences. The accessibility safe mode bypass must also remain
available for support-approved recovery and compatibility workflows.

## CI Gates

`V2/ue/Tools/plan-v2-runtime-unpacker-integrity.py` emits the deterministic
runtime unpacker plan. `V2/ue/Tools/check-v2-runtime-unpacker-integrity.py`
validates the manifest, planner output, executable-packing dependency, Horde
wiring, CI workflow wiring, and this runbook.

Required release gates:

- `drm-runtime-unpacker-plan-generated`
- `drm-runtime-unpacker-profile-coverage`
- `drm-runtime-unpacker-integrity-baselines`
- `drm-runtime-unpacker-patched-byte-detection`
- `drm-runtime-unpacker-safe-boot-response`

The gates ensure that every shipping desktop profile has a runtime unpacker,
signed-manifest verification, executable-memory baselines, patched-byte
detection, safe-boot offline-only response, and a do not crash response for
integrity mismatches.