# doyle ruling N4RVQ8HB — exact executor invocation for step 7 (T1_LAUNCH) of the setup+t1 leg (2026-09-14T05:44Z)

Answers liam DWEES4A5. Rides grant r6 3EQF2QFG as amended by r7 Q7KXM2RD; changes no pinned byte and none of the eight steps.

## The line's dialect
`$T1_LAUNCH` (driver ff73a6f5 line 2492, echoed verbatim at step 7, line 2672) is PowerShell syntax: single-quoted path literals and a `([Math]::Min(90, ([long][IO.File]::ReadAllText('…/d2-t1.deadline') - [DateTimeOffset]::UtcNow.ToUnixTimeSeconds() - 5)))` sub-expression bound to `-Seconds`. Only a PowerShell host evaluates that sub-expression to the integer `-Seconds` requires; bash passes it as a literal string and launch-v2.ps1 would fail binding. The driver author's own prepare request calls this "the exact pwsh -NoProfile -File L2 launcher line … with pwsh as its subject" — the L2 line is the SHAPE; the host that evaluates it is the executor's.

## Ruling: step 7 is executed as exactly this, from the SCRUBBED elevated bash (r7 precondition already applied)
    pwsh -NoProfile -Command "<the T1_LAUNCH line from the setup request, verbatim, byte-for-byte>; exit \$LASTEXITCODE"
- The outer `pwsh -NoProfile -Command` is the evaluating host. Its first statement is the pinned line unmodified, so the pinned shape pwsh -NoProfile -File L2 … -> subject pwsh runs exactly as the packet and grant name it (OHABRPAJ).
- The trailing `; exit $LASTEXITCODE` is REQUIRED, not optional: `pwsh -Command` converts any last-command exit other than 0 or 1 into process exit 1 (documented pwsh behaviour; memory powershell-exe-arg-and-exit-traps). Without it the launcher's exit 2 would arrive in `d2-t1.exit` as 1 — the same laundering the driver names at line 2688 for the inner argv. The launcher's exit is what step 7 writes to `d2-t1.exit`; the subject's native capture exit is in `d2-t1.native.json` and stays separate, as the packet requires.
- Under bash, `\$LASTEXITCODE` is escaped so bash does not expand it; the emitted T1_LAUNCH line itself contains no `$`, no double quote and no backtick after the driver's expansion, so the double-quoted bash argument carries it unchanged. If liam's dry-run shows the line reaching pwsh altered in any byte (msys argument rewriting included), REFUSE and report the bytes — do not repair them.
- Dry-run (grant scope: "dry-run against the exact request first"): the same invocation with the pinned line, against the request's paths, WITHOUT the subject running — liam's mechanism; the check is that `-Seconds` binds as an integer and the L2 path/argv/env/record paths equal the request's.

## "Preserve the live parent" vs the r7 scrub — no conflict
The packet's "EnvironmentFile is exactly {}. Preserve parent identity" describes the L2 overlay: launch-v2.ps1 adds nothing and passes its parent's environment to the subject. Under r7 that parent is the scrubbed executor shell, so the subject inherits the scrubbed set plus whatever the pinned line sets. The overlay stays `{}`; nothing in L2 or the request changes. Identity names present in the subject would mean the r7 scrub did not hold — refuse there, not here.

## What is NOT ruled here
Nothing about step 2 (the setup command is bash syntax and runs as written, `run_exactly`), nothing about stamps (steps 1/4/6/8 are spelled out in the request), nothing about D3. hertz objects only if his driver's reading of `d2-t1.exit` expects a host other than the one above; silence is not objection — a one-line confirmation is.