Group N implementation contract, hertz, ruling 3XE67XYP. All paths relative to .spt/preserved/hertz-fp-driver-review/d2/.
Ownership: NativeLauncher writes launch-v2.ps1 and launch-v2.cs only. NativeControls writes controls/group-n.ps1 plus controls/n-* only (not running any controls). Main owns fp-driver-d2-r5.sh, its builder/helpers, docs/INFRA-REGISTER.md, integration and all execution. Everyone skips build/test/lint/format until Main serial verification. Preserve every earlier pinned artifact. No field/provision/sign/apply. No process launch by agents.

Launcher interface: pwsh -NoProfile -File launch-v2.ps1 -Label NAME -Seconds INT -RecordFile ABS_JSON -ArgsFile ABS_JSON_VECTOR -Exe ABS_EXE -OutFile ABS_OUT -ErrFile ABS_ERR [-Admission process-tree|none] [-Scope step|run] [-StopFile ABS] [-EnvironmentFile ABS_JSON_OBJECT] [-ControlFault none|assignment|accounting|crash-after-resume]. Defaults Admission=none, Scope=step, ControlFault=none. JSON vector carries strings unchanged through ProcessStartInfo.ArgumentList. Native CREATE_SUSPENDED consumes that vector through proper Windows command-line encoding; never Process.Start then suspend. Only created process handles and retained job authorize termination. No external pid kill. Run scope retains job until StopFile or deadline, not direct-subject exit; step scope terminates remaining job members at direct exit or deadline. Environment overrides merge into inherited env (for N-D isolated SPT_HOME, SPT_INSTALL_NO_FIREWALL=1); never bypass fleet session guard. Each invocation refuses pre-existing RecordFile/OutFile/ErrFile/event destinations. Initial status must be written before launch and progressed atomically; append each state to RecordFile.events.jsonl for retained chronology. Stopwatch begins before setup/Add-Type, total Seconds includes shutdown/confirmation; bounded cleanup reserve built within it.

JSON record version 2 shape (keys required even when null): version,label,scope,launcher:{pid,created,exe},subject:{pid,created,exe,native_exit,state},completion_reason,coverage,termination,job:{assigned,membership_read,kill_on_close_read,limit_flags,active_processes},started_utc,ended_utc,error. subject.pid=0 until created; state NOT_STARTED|SUSPENDED|RUNNING|EXITED|TERMINATED|GONE|UNREADABLE. completion_reason=running|setup_refused|subject_exit|deadline_expired|stop_requested|confirmation_failed. coverage NONE before assignment; PARTIAL without explicit Admission=process-tree; COMPLETE only with admitted chain and actual job enforcement. termination=NOT_CONFIRMED|CONFIRMED_GONE|UNREADABLE. Final normal subject exit preserves native exit exactly, including124; driver uses completion_reason, never exit124 by itself. Deadline exit124, setup refusal127, failed confirmation126; nonzero native exit otherwise verbatim. On scope run StopFile: exit0 only with confirmed gone. Job limits exactly0x2000; no breakaway flags; readback before resume. Controlled termination uses TerminateJobObject then releases process handles after observing exit and polls ActiveProcesses=0 before final confirmation. Crash control must actually end launcher after ResumeThread with Environment.FailFast (or native exit) so job last-handle-close is exercised; final running record persists, survivor checks external. Failure controls provoke real Assign/Query failures with invalid handles while retaining true owned handles for safe cleanup. No fake confirmation states.

Group N controls: One new timestamped output dir, each arm its own dir, refuse reuse, preserve failures. Negative N0 deliberately asserts whole-operation confirmed for PARTIAL/missing ledger state, expect assertion1 (not harness error). N1 immediate-spawn suspended-before-assignment event ordering; N2 real assignment failure never resumes (subject marker absent plus anchored gone); N3 child+grandchild; N4 breakaway denied; N5 native124 subject_exit vs timeout deadline_expired; N6 child outlives direct subject (job removes it); N7 launcher actual abnormal exit / last handle close; N8 accounting failure UNREADABLE; N9 exact multiline M4 real extracted r5 capture call plus vector empty/spaces/quotes/newlines; N10 actual extracted r5 ledger partial/missing/live/fully-confirmed cases; N-D pinned .worktrees/304-w2-repr/target/release/spt.exe SHA begins72d30901 (Main supplies full verified pin), fresh isolated home under output, foreground daemon run in Scope=run. Observe only registered supervisor and its home-pid/parent-confirmed brain, read job membership with retained launcher query seam if necessary; record actual breakaway behavior, not infer. No firewall/sign/apply. Verify all owned identities gone by pid+birth at end with corrected m-disposition type-safe pattern. Never query or terminate fleet homes. N-D executable must not be rebuilt or substituted.

Main r5 contract: bounded LABEL DEADLINE OUT ERR -- COMMAND... stays shell interface; writes JSON argv via helper, invokes launch-v2.ps1 with its neighboring launch-v2.cs, no precreated output files (launcher refuses reuse). register_launched and measure_termination consume v2 JSON, keep direct subject vs whole operation separate. Ledger known LIVE precedence, otherwise any missing coverage/confirmation =>UNREADABLE, CLEAR requires every real record COMPLETE and CONFIRMED_GONE plus residue/listener predicates. Default admission none; explicit allowlist audited probes only process-tree; arbitrary commands remain PARTIAL. Run daemon controller same launcher Scope=run, lifetime at run not step, owned home+identity readiness required before any autostart-capable step; refuse otherwise. Field start remains gated. Main informs controls agent when r5 helpers ready.