[hanhainebula]

Restore the preinstalled Java 21 runtime in isolated submission processes. Their sanitized environments dropped JAVA_HOME and often removed the Java executable directory from PATH, causing PyJNIus to report Unable to find javac even though its Java interface works with the installed runtime when JAVA_HOME is set.

Changes

• Set JAVA_HOME=/opt/java/openjdk across 43 affected tasks and include its bin directory in fixed submission paths. Update separate build/query launchers, mirrored development/verifier runtime modules, and the incremental-vector-search public profiler.
• Add the Java installation directory to the read/execute allowlists in icsi-meeting-memory, filtered-ann-retrieval, incremental-vector-search, and sparse-retrieval-pruning. Keep other paths protected and retain the existing thread, resource, and network restrictions.
• Add a regression that exercises 29 actual task environment/command builders in both phases, checks Java availability, and verifies that private coding-agent and judge credentials remain excluded. All 58 subcases fail for missing JAVA_HOME against the original source and pass with this fix.

This task-runtime fix remains compatible with CLI 0.3.0 and Harbor 0.22.0. It does not inject an OpenAI API key or change Pyserini's missing-key behavior. Scoring rules, task instructions, input assets, shared base images, and resource budgets are unchanged.

Validation

• Repository unit suite: 417 passed, 2 skipped (419 total).
• Related task regressions: 8 passed, 1 skipped; the skipped case requires an unrestored catalog asset.
• All 47 task packages passed merge-ready static checks. Release checks reported 0 errors and 0 warnings; git diff --check passed.
• Offline Docker checks passed for all 43 updated submission environments: 23 CPU-image cases and 20 GPU-image cases without allocating a GPU. Each checked Java command resolution and Java 21 JNI calls through pyserini.pyclass as UID 65534, with private credentials excluded.
• All four updated filesystem sandboxes permit reading Java runtime files while continuing to deny an otherwise world-readable file outside their allowlists. ICSI, filtered ANN, and incremental vector search also passed Java-command/JNI checks as UID 10001. Sparse retrieval retains its new-thread prohibition; its sandbox check verifies Java-file access and thread denial rather than claiming that a full JVM can run under that policy.
• Differential checks across the 43 environment constructors confirm that only JAVA_HOME and the Java path changed. Production-source comparison confirms that the remaining changes are limited to Java read/execute allowlists.

Runtime checks used cached pinned base images with the updated environment constructors and sandbox source. Full task-image rebuilds, coding-model/judge API calls, and formal benchmark reevaluations were not performed. Existing archived results and trajectories were not modified.