R="C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/909af448-f4ab-4fa1-ba30-02e38b275a11/scratchpad/bundle-r5/fp-run/20260913T041410Z"
H="$R/handoff"; L="C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/1212783f-c73e-4b6f-a6b2-fa9a428720d5/scratchpad/nonce-ledger.txt"
N=20260913T041410Z-001-26086
EXE="C:/Users/decid/Documents/projects/spt-core/.worktrees/304-w2-repr/target/release/spt.exe"
CAPPS="C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/909af448-f4ab-4fa1-ba30-02e38b275a11/scratchpad/bundle-r5/fp-bin/d2_capture.ps1"
now=$(date -u +%s); lim=$(date -u -d 2026-09-13T04:18:35Z +%s)
if [ "$now" -gt "$lim" ]; then echo "NOT_STARTED: clock $(date -u +%H:%M:%SZ) past 04:18:35Z start guard"; exit 90; fi
[ -e "$H/001-setup-receipt.txt" ] && { echo "NOT_STARTED: receipt already exists"; exit 91; }
grep -q -- "$N" "$L" 2>/dev/null && { echo "NOT_STARTED: nonce in ledger"; exit 92; }
eh=$(sha256sum "$EXE" | cut -d' ' -f1); ch=$(sha256sum "$CAPPS" | cut -d' ' -f1)
if [ "$eh" != 72d309011415b419aabfdb0b4065df1183bfd0069a9f95b5779da62e43349b10 ] || [ "$ch" != a0e7afbee4dce9f310ade9704c199b3b759715c06da7e033d286beb7cfda8c06 ]; then
  printf 'HANDOFF_RECEIPT setup REFUSED\nnonce: %s\nrefused: executable or capture hash mismatch, have exe %s capture %s; no step run\n' "$N" "$eh" "$ch" > "$H/001-setup-receipt.txt"; echo REFUSED_HASH; exit 93; fi
echo "$N STARTED $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$L"
stamp() { MSYS_NO_PATHCONV=1 powershell.exe -NoLogo -NoProfile -NonInteractive -Command "[DateTime]::UtcNow.ToString('yyyy-MM-ddTHH:mm:ssZ') | Set-Content -NoNewline -Encoding ascii '$1'"; }
# 1
stamp "$R/setup-start.utc"
# 2
env -u SPT_INSTALL_NO_FIREWALL SPT_HOME="C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/909af448-f4ab-4fa1-ba30-02e38b275a11/scratchpad/bundle-r5/fp-home-d2" "C:/Users/decid/Documents/projects/spt-core/.worktrees/304-w2-repr/target/release/spt.exe" serve lan --bootstrap --port 29470 > "C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/909af448-f4ab-4fa1-ba30-02e38b275a11/scratchpad/bundle-r5/fp-run/20260913T041410Z/handoff/001-setup-command.out" 2> "C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/909af448-f4ab-4fa1-ba30-02e38b275a11/scratchpad/bundle-r5/fp-run/20260913T041410Z/handoff/001-setup-command.err"
# 3
SETUP_RC=$?
# 4
stamp "$R/setup-return.utc"
# 5
printf '%s' "$SETUP_RC" > "$R/setup.exit"
echo "$N SETUP_EXIT=$SETUP_RC $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$L"
# 6
stamp "$R/d2-t1-start.utc"
# 7
read -r -d '' CAP <<'CAPLINE'
& 'C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/909af448-f4ab-4fa1-ba30-02e38b275a11/scratchpad/bundle-r5/fp-bin/d2_capture.ps1' -CapturePoint 't1' -RuleName @('spt-core-bootstrap-inbound-tcp','spt-core-bootstrap-inbound-tcp-lan') -Port 29470 -IsolatedHome 'C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/909af448-f4ab-4fa1-ba30-02e38b275a11/scratchpad/bundle-r5/fp-home-d2' -RunId '20260913T041410Z' -OutPath 'C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/909af448-f4ab-4fa1-ba30-02e38b275a11/scratchpad/bundle-r5/fp-run/20260913T041410Z/d2-t1.json' -ControlRuleName '{FF36EE51-2837-46D8-9AB8-2441D9070633}' -AbsentControlName 'spt-core-bootstrap-inbound-tcp-d2-absent-control' -PreSetupAbsence 'census(pre-setup-absence) CENSUS tag=pre-setup-absence utc=2026-09-13T04:16:23Z rules=1001 ctl_5470=1 ctl_sptexe=7 subj_group=0 subj_29470=0 valid=YES' -SetupIntervalStart (Get-Content -Raw 'C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/909af448-f4ab-4fa1-ba30-02e38b275a11/scratchpad/bundle-r5/fp-run/20260913T041410Z/setup-start.utc').Trim() -SetupIntervalEnd (Get-Content -Raw 'C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/909af448-f4ab-4fa1-ba30-02e38b275a11/scratchpad/bundle-r5/fp-run/20260913T041410Z/setup-return.utc').Trim()
CAPLINE
MSYS_NO_PATHCONV=1 powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$CAP; exit \$LASTEXITCODE" > "$R/d2-t1.liam-console.out" 2> "$R/d2-t1.liam-console.err"
CAP_RC=$?
printf '%s' "$CAP_RC" > "$R/d2-t1.exit"
# 8
stamp "$R/d2-t1-end.utc"
echo "$N CAPTURE_EXIT=$CAP_RC $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$L"
cat > "$H/001-setup-receipt.txt" <<EOF
HANDOFF_RECEIPT setup
nonce: $N
exit=$SETUP_RC
executor: liam @ HFENDULEAM, session 1212783f, elevated
setup_command_status_above_is_the_setup_only; capture status is separate in d2-t1.exit ($CAP_RC)
exe_sha256_verified: $eh (own sha256sum before step 1)
capture_script_sha256_verified: $ch (d2_capture.ps1, own sha256sum before step 1)
steps: 1-8 all run in order, one leg; setup under bash, stamps and t1 under powershell.exe -NoLogo -NoProfile -NonInteractive (-ExecutionPolicy Bypass for t1, trailing LASTEXITCODE)
stamps: setup-start $(cat "$R/setup-start.utc" 2>&1) / setup-return $(cat "$R/setup-return.utc" 2>&1) / t1-start $(cat "$R/d2-t1-start.utc" 2>&1) / t1-end $(cat "$R/d2-t1-end.utc" 2>&1)
t1 console captured by liam: d2-t1.liam-console.out / .err (extra, not part of request)
annotation (doyle ADBJV2ZV): the driver's printed ceiling saying capture paths have met only a stub is STALE; corrected capture paths were exercised in read-only preflight. Output preserved unchanged; driver not edited.
EOF
echo "$N RECEIPT_WRITTEN $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$L"
echo "DONE setup_rc=$SETUP_RC cap_rc=$CAP_RC $(date -u +%H:%M:%SZ)"