# 3XE67XYP — group N receipt and containment result

**Owner:** hertz. **Date:** 2026-09-13. **Disposition:** all twelve required control verdicts proved; field execution remains HELD.

This is a composite evidence result, not a claim that an earlier red run passed. The preserved full run supplies N0–N9; targeted, negative-gated corrective runs supply N10 and N-D. `FINAL-RESULT.json` identifies each accepted result. Every failed attempt remains intact.

## Deliverables and immutable evidence

All paths below are relative to `.spt/preserved/hertz-fp-driver-review/d2/` unless stated otherwise.

- Successor: `fp-driver-d2-r5.sh`; review diff: `fp-driver-d2-r4-to-r5.diff`.
- Native launcher: `launch-v2.ps1` and `launch-v2.cs`.
- Runtime helpers: `launch-record.py`, `run-daemon-ready.ps1`, `run-daemon-control.py`.
- Executable controls: `controls/group-n.ps1`, `controls/n-*`.
- One group N output: `controls-out/20260913T1109444702137Z-N/`.
- Infrastructure entries: **IR-127, IR-128, IR-129** in repository `docs/INFRA-REGISTER.md`. IR-128 also records the managed-string recurrence found during N0.

The output inventory covers **1,675 files / 5,734,848 bytes**, excluding the inventory itself. `ARCHIVE.sha256` has SHA-256:

`9c1cab8733b924c28e4995e269bded0088ee74111984c6720e62f75391474893`

Final source pins:

| Artifact | SHA-256 |
|---|---|
| `fp-driver-d2-r5.sh` | `df6cca2d987e8eb2a6e9ccba6e9532d278c08bb4f873674836653e5a8e419c59` |
| `launch-v2.ps1` | `6e2c2eac82dd53fd0af42c4fe796f911e987d406e6f31219cd4480a78f1f6804` |
| `launch-v2.cs` | `c3a905ec7cbc118f0b59dd1813b187740319802267689e14dacf6008730de157` |
| `launch-record.py` | `8fb2f87f9d55d845cd4932f6c6008edbb1d2db756196480a4da82ec0c179092f` |
| `run-daemon-ready.ps1` | `bf43935f5402771932e0a39eafe77af387a3f5ddba30643c56b7bd392c10de1c` |
| `run-daemon-control.py` | `4d04f0c3eb10d84a39ce6fdc64ba64c73b742da1626834c25fa63bd904fb2d0a` |

`final-instruments/` preserves these bytes. Per-attempt `instruments/` directories preserve the instruments actually used in that attempt. The assembly-only scripts were archived in `integration-source/` and removed from the working delivery directory. Frozen r4, launcher v1, and group M evidence were not replaced.

## Implemented contract

### Argument transport and native custody

`bounded` writes a JSON string array. V2 populates `ProcessStartInfo.ArgumentList`, then serializes that vector using Windows argument quoting into the mutable native command buffer. It does not invoke `Process.Start` and subsequently suspend an already-running subject. There are no script-specific argument repairs.

The native order is: create private non-inheritable job; set and read back **exactly 0x2000**; create subject with `CREATE_SUSPENDED`; retain its process/thread handles and native birth/image identity; assign it to the owned job; read membership; resume its primary thread. Only the explicitly selected standard handles are inherited. Job configuration, membership, resume, exit, reference release, accounting, and closure are journalled.

The elapsed bound starts in PowerShell before native compilation. A confirmation reserve is inside that bound. Shutdown uses the owned job or the retained handle of an unassigned suspended subject, never a discovered PID as termination authority. It observes direct exit, releases process references, reads `ActiveProcesses == 0`, and closes the job before publishing `CONFIRMED_GONE`. An unreadable accounting result remains `UNREADABLE`.

Native exit and completion reason are independent fields. A subject's native 124 is `subject_exit`; an expired deadline is `deadline_expired`. An explicit run-job stop can return controller exit 0 while retaining the terminated subject's native exit 124.

### Coverage and ledger

Direct-subject state, operation coverage, and termination confirmation remain separate. A native job is not a universal containment claim for WMI, service, scheduler, elevation, or other delegated creation. General command admission remains conservative; only audited creation chains receive `process-tree` admission.

The ledger requires complete indexed operation evidence and confirmed termination in addition to the existing residue/listener measurements. Known LIVE evidence takes precedence over missing coverage. Missing records, missing coverage, partial admission, or unconfirmed termination cannot produce CLEAR. The Python-to-Bash status protocol now emits explicit LF, avoiding Windows CRLF values that look complete when printed but fail exact shell comparisons.

### Run-scoped daemon

The pinned foreground `daemon run` path has a separate owned run job. Step-job teardown cannot close that job. The actual r5 lifecycle helpers were extracted and exercised, not the field driver's main program:

1. Readiness refused before any run job existed.
2. The real pinned foreground daemon was started under the run job in a fresh isolated home.
3. Fresh request-ID membership queries bound `daemon.pid` and `brain.ready` to live native birth/image identities, parentage, and the retained owned job.
4. A separate r5 bounded step completed and closed its job.
5. A new readiness query still confirmed the daemon.
6. The owned stop channel ended the run job; both run and step coverage were COMPLETE and their operation termination was CONFIRMED_GONE.

The foreground admission is specific to this audited pinned path. It does not admit general `daemon start` or a job-neutral launch ladder. Autostart-capable driver actions require the owned-daemon preflight; the old uncontained `run_cmd` listener-stop path was removed. Session guard variables are not scrubbed to bypass the guarded daemon-stop verb.

## Accepted controls

Paths in this table are within the group N output. Each arm preserves its assertions, native exits, subject captures, identities, and native chronology.

| Control | Measured result | Accepted evidence |
|---|---|---|
| N0 | Real partial operation followed by deliberate false COMPLETE assertion; expected exit **1** gates later controls | `corrected-3/N0/` |
| N1 | Immediate child spawn occurs only after suspended creation, assignment, membership read, and resume; contained shutdown confirmed | `corrected-3/N1/` |
| N2 | Actual assignment failure; subject never resumed; owned suspended subject confirmed gone | `corrected-3/N2/` |
| N3 | Parent, child, and grandchild reach readiness and are contained at teardown | `corrected-3/N3/` |
| N4 | Actual native breakaway request denied with error **5**; child not created | `corrected-3/N4/` |
| N5 | Native exits 124 and 37 preserved; deadline-generated 124 has a distinct persisted reason | `corrected-3/N5/` |
| N6 | Parent observes its ready child alive immediately before parent exit; whole-job teardown then confirms the descendant gone | `corrected-3/N6/` |
| N7 | Owned launcher forcibly terminated after descendant readiness; handle-close containment measured. Separate native crash exits **198** and leaves no fabricated final confirmation | `corrected-3/N7/` |
| N8 | Actual accounting-query failure returns **126**, `confirmation_failed`, and UNREADABLE, not a false confirmation | `corrected-3/N8/` |
| N9 | Empty, spaced, quoted, LF, CRLF, trailing-backslash, and Unicode arguments preserved; exact real M4 multiline call arrives as three arguments and exits 0 | `corrected-3/N9/` |
| N10 | Actual extracted ledger: partial/missing/missing-record/unconfirmed → UNREADABLE; live and live-plus-missing → LIVE; complete → CLEAR | `ledger-final/N10/` |
| N-D | Actual pinned native breakaway denial; foreground supervisor/brain membership; separate-step survival; actual r5 start/readiness/stop and complete accounting | `daemon-final/N-D/` |

N9's empty-home branch correctly reports `IDENT_PROBE=UNREADABLE reason=no-pid-file`. That is evidence of successful argument transport and execution, not evidence that an unobserved home is clean.

N10 uses explicitly labelled point-in-time predicate fixtures seeded from real launch records. The live record is sampled while running, then its owned job is stopped before the slower ledger exercise. It is not represented as a continuing host measurement or a lease.

## N-D: actual executable and actual breakaway observation

The only SPT executable used by N-D was:

`.worktrees/304-w2-repr/target/release/spt.exe`

SHA-256:

`72d309011415b419aabfdb0b4065df1183bfd0069a9f95b5779da62e43349b10`

It was hash-checked before and after the controls. No rebuild or substitute executable was used.

The separate fresh-home `daemon start` arm used the existing pinned test hook `SPT_FORCE_LAUNCH_RUNG=breakaway`. All ladder attempts therefore stayed on the native breakaway rung; WMI, scheduler, and in-job fallback were not selected. Actual CLI stderr was:

`DAEMON_START_FAIL: Access is denied. (os error 5)`

The subject exited 1 with `subject_exit`. No successful-rung marker, supervisor breadcrumb, or brain breadcrumb appeared. Those absences are supporting observations, not the proof of policy denial: the proof is the actual returned native error surfaced by the CLI. Individual per-attempt return values are not exposed and are not claimed.

The normal foreground brain-spawn path remains separately labelled **NOT_REACHED_BY_FOREGROUND_BRAIN_SPAWN** for breakaway. Its job membership is not used to invent a breakaway result.

In the additional actual-r5 lifecycle exercise, supervisor **54924** ended with native exit 124, `stop_requested`, COMPLETE, CONFIRMED_GONE, exact flags 8192, and active count 0. The r5 helper returned success for both combined coverage and termination. Membership evidence is in `daemon-final/N-D/r5-run/run-daemon.json.membership.json`.

## Failures preserved and corrected

- **Initial N0:** PowerShell converted the nullable `File.Replace` backup-path argument into an empty string. State publication failed before any subject was created. The publisher now uses overwrite-rename `File.Move(..., true)`. This recurrence is recorded under IR-128.
- **Tree/crash control instrument:** querying `Process.MainModule.FileName` immediately after child creation could encounter an unloaded module and throw. Identity measurement now uses native `QueryFullProcessImageNameW` on the retained process handle.
- **Bash selection instrument:** `Get-Command bash` returned two executable paths; string coercion joined them into a nonexistent executable name. The runner now selects one resolved application explicitly.
- **Argument observer instrument:** an advanced-script mandatory parameter rejected the extra empty argument before the observer ran. The observer now uses normal script argument binding; the successful vector includes the empty value unchanged.
- **Coverage implementation:** native Python stdout emitted CRLF into a Bash line protocol. The JSON aggregate was COMPLETE, but the shell value retained CR and failed the equality check. Explicit LF fixes the actual protocol boundary.
- **Live-fixture lifetime instrument:** the control required a 30-second live job to outlast unrelated shell preparation and predicate rendering. It now samples the live record, stops the owned job immediately, and exercises the labelled snapshot. No deadline was inflated to conceal the error.

The initial output and `corrected-1/`, `corrected-2/`, and `corrected-3/` retain their original failures. `ledger-final/` and `daemon-final/` are fresh targeted runs, each admitted by its own expected-failure N0. Both targeted group invocations exited **0**.

## Final disposition, verification, and authority

The consolidated final read covered **201 registered birth anchors** from every attempt in this output, in one pass:

- **198 GONE**;
- **3 GONE_PID_REUSED**, meaning the registered birth no longer exists, not authority over the current PID occupant;
- **0 surviving**, **0 unreadable**;
- disposition command exit **0**.

The identity instrument's positive control differed by **5 ticks**; the deliberately skewed control differed by **5,000,005 ticks**. No PID-only termination was used.

One initial publisher record lacked its launcher's birth stamp. `initial-launcher-anchor-resolution.json` links it to the same invocation's retained-created-Process record; the initial subject was NOT_STARTED with PID 0. The raw incomplete record remains unchanged. This repairs evidence linkage; it does not turn the failed initial operation into a successful one.

PowerShell parsing, native C# instrument compilation, and Bash parsing passed. `traceable-reqs check` exited **0**: **903 requirements complete, 0 incomplete, 0 findings**. Captured evidence is included in the output inventory.

No field driver execution, field-home provisioning, signing, update apply, cargo build, firewall manipulation, or fleet process manipulation was performed. Fresh isolated control homes were created only for the authorized owned-daemon measurements. This receipt does not grant field authority or certify arbitrary delegated process creation.