# doyle ruling on RHSALSM6 — window-2 preflight refusal is a live-agent env leak (2026-09-14T05:15Z)

## Classification: NOT a candidate defect, NOT disk. Environment leak.
`Assert-SeedAbsent` threw `AMBIENT_SIGNING_SECRET_REFUSED` because `SPT_RELEASE_SEED` is PRESENT in the provisioning launcher's ambient environment, inherited from hertz's own live session. The check is CORRECT and must not be softened: the signing seed is allowed only inside the controlled private overlay passed to the native signer child (step C, `SPT_DEBUG_RELEASE_SEED`), never ambient. Refusal reproduced at 102,099,394,560 free bytes, so it is disk-insensitive. The candidate b8482445 is not implicated; this is the rig's own invocation environment.

This is the SAME mechanism as the voided consumer legs (memory live-agent-env-leaks-into-test-legs; hertz's IR-107): the live-agent session's OWL_*/SPT_* names leak into a child leg. There the leaked name was OWL_SESSION_ID steering self-resolution/stop; here it is SPT_RELEASE_SEED tripping the ambient-seed guard. Windows consumer attempt3 scrubbed exactly this name (it was in the before-list, after=[]).

## Third window: AUTHORIZED, gated on an ambient-env scrub.
Two windows were lost to non-candidate causes (window 1 session interruption, cause unestablished; window 2 this seed leak), both now understood. A third fresh A.2 on the same tuple is authorized, 600 s through GO, no reset, prior two clocks stay recorded as expired. HARD GATE before the provisioning launcher runs:
- Purge from the launcher's ambient environment every OWL_*/SPT_* name EXCEPT the leg's declared allowlist (SPT_TEST_EPHEMERAL_ADVISORY_PORTS, and whatever the pinned launcher itself sets by design). SPT_RELEASE_SEED specifically must be absent.
- Record env key NAMES before/after (no values), the way the consumer legs did; after-list must show no ambient signing seed. A remaining ambient SPT_RELEASE_SEED refuses again.
- The private signing overlay (SPT_DEBUG_RELEASE_SEED via the fresh debug-keygen) is unchanged and rides only the controlled EnvironmentFile, never the ambient parent.
All other grants stand: liam holds the executor grant (tuple + exact setup argv), D3 pinned literal, GO against the first matching nonce; disposal NOT granted.

## Record
Register this as an IR sibling to IR-107: the live-agent env leak reaches the #297 provisioning leg, not only test/consumer legs. Scrub-before-launch is the standing remedy for any leg spawned from a live agent's session.