# doyle GRANT AMENDMENT r8 — re-pin under the W8TQ3MZC promotion-census successor (2026-09-14T06:12Z)

Amends r6 3EQF2QFG as amended by r7 Q7KXM2RD. Everything not named below stands: executor, scope, NOT-granted list (disposal NOT granted to liam), 120 s handoff bound, D3 pinned literal 38e0f21b… and its byte-equal guard, GO pre-ruled against the first matching nonce (DJNQQ2RA), r7 executor env-scrub precondition, N4RVQ8HB step-7 shape, outer host VGCTKD7A-executor-outer-host.json.

## Reviewed and ACCEPTED as instrument-only
- Successor provision-promote-W8TQ3MZC.ps1 sha256 473f359145e7aa6135106863fe9cb4f6020c9b4a1fdf97df535aaac5c338c43c; predecessor provision-promote-VGCTKD7A.ps1 9d968a02… RETIRED, must not execute.
- Diff W8TQ3MZC-promotion-source.diff.txt 1edf761c… read whole; `git diff --no-index --numstat` re-derived by me: 146 added, 4 removed, 2 hunks — the diff file is the entire delta. Hunk 1 adds Read-NativeCensusProcess (OpenProcess QUERY_LIMITED|SYNCHRONIZE, GetProcessTimes, WaitForSingleObject(0), QueryFullProcessImageNameW, one retained handle) and Get-RigCensusDecision; hunk 2 replaces the readability census (old lines 271-275) with the decision loop and writes promotion-census.json in a finally. Nothing else changes; rig-state checks (line 268) unchanged.
- Contract conformance, arm by arm: identity = (pid, CIM birth) captured on first read and compared on every re-read; `birth + 10 ticks < rig creation` ⇒ PREDATES_RIG (allowance widens only the not-pre-rig side); readable path ⇒ Same-Path vs $E decides; blank path ⇒ native probe from one retained handle; native birth ≠ CIM birth by > 10 ticks ⇒ reused pid, original marked gone, replacement classified on its own; handle signalled ⇒ ORIGINAL_GONE; native image blank ⇒ UNRESOLVED (refuse); native failure ⇒ one CIM re-read; zero rows only counts as gone with a same-provider positive control on $PID (else SPT_CENSUS_CONTROL_FAILED); query exception ⇒ SPT_CENSUS_QUERY_FAILED (refuse); same identity still blank ⇒ refuse; birth not a DateTime ⇒ SPT_PROCESS_BIRTH_UNREADABLE (refuse). Failure string now carries disposition + pid + birth, and the census is preserved on failure — the gap the third window's receipt had.
- Boundary controls W8TQ3MZC-census-controls-final.json: 14/14 pass — pre-rig unreadable perch admitted; native resolves unrelated image admitted; known rig image refused; native resolves rig image refused; successful re-read confirms disappearance admitted; persistent denied identity refused; failed re-read is not gone; empty provider is not gone; unknown birth fails closed; precision overlap is not pre-rig; equal birth is not pre-rig; native PID reuse into rig image refused; CIM PID reuse into rig image refused; retained handle signalling exit admitted.
- Live read-only census W8TQ3MZC-census-live-result.json at 06:03:55Z under the successor's sha: 17/17 admitted, all PREDATES_RIG (52860 = liam's perch, birth 2026-09-12T20:17:00Z, included); self positive OTHER_IMAGE / self negative RIG_DAEMON_ALREADY_PRESENT; native-vs-CIM birth delta 5 ticks; product_invocations 0, fleet_process_terminations 0, rig_mutations 0.

## r7's inventory line is REPLACED by:
- instrument pins W8TQ3MZC-instrument-pins.json sha256 c7a4fefc063c08e71878560e9f95593d1e89995b885a0e2651a62ddf49d49774 (854 bytes, authored by doyle 06:10Z; only the promote member changes: prep-DJNQQ2RA 98af1551…, provision-stage-VGCTKD7A dd90163f…, provision-promote-W8TQ3MZC 473f3591…, launch-scrubbed-VGCTKD7A f01938af…, driver ff73a6f5…, support-manifest 357be2c9…, configuration.diff 856281a6…, cleanup-verification a5e5950b…).
- hertz confirms live inventory == this file member-for-member before the fourth clock (same as GEL6JAWN-live-inventory-proof.json for r7). Mismatch ⇒ my file is wrong; report, no clock.
- Packet bytes 056d065f… unchanged, nonce DJNQQ2RA unchanged, GO pre-ruling unchanged; packet line 8's inventory reference resolves to this successor.

## Fourth window sequencing (authorized in W8TQ3MZC)
1. hertz: archive/verify the staged third-window rig's evidence, then dispose ONLY field-rig-r5-S6ESSJ3N and its empty owned private leaf under spt-rig-secrets (shared parent intact) — his own unelevated creation, nothing ran in it. Not liam's.
2. hertz: live-inventory proof against c7a4fefc…; liam: re-verify tuple against it and acknowledge r8 to hertz directly (executor precondition and outer host already on record).
3. Fresh A.2: same 600 s through GO, no reset; prep → scrubbed stage → scrubbed promote (successor) → driver → prepare/setup+t1/D3 requests to liam. Windows 1-3 stay recorded (interrupted / seed leak / census).
4. Receipt path + sha or gate name to me; red ⇒ RCA-first.