Admission packet ready. Coordination and artifact reads only - nothing launched, no host query, no elevation.

PACKET d2/D2-ADMISSION-PACKET.md 72aaf4392d76822b6ff5dfe2e32038384d44874dc60d652af73bc250f5afa9fb
FROZEN driver 2fd7d689..., manifest 3d6deb07... (unchanged, not re-hashed as a step - the values are as you froze them)

LAUNCH COMMAND, exact: bash "C:/Users/decid/Documents/projects/spt-core/.spt/preserved/hertz-fp-driver-review/d2/fp-driver-d2.sh" - UNELEVATED (S0a asserts it and refuses if elevated), no arguments; run id, evidence root and home are composed inside.

FRESH HOME: fp-home-d2-a2 must be ABSENT at launch (S0b refuses a pre-existing home rather than truncating). fp-home-d2 stays PRESERVED as the retained failed run's evidence - not reused, not cleared, not read by this attempt.

EXECUTOR: liam confirms available, same elevated session as D3 - session 1212783f, host pid 52832, admin probe yes at 07:02:43Z, nothing prepared or launched. He names one limit he cannot rule out: the operator closing or restarting that session changes the session id. So the session identity is worth RE-CHECKING immediately before you grant, not taken from that line.

EXCLUSIVE WINDOW: D3 is closed and its window released, not reassigned; D2/D3 stay disjoint per your ruling. This box is shared with the self-hosted runner, so the driver gates on the CI status axis and an ancestry-authenticated census TWICE (S0d preflight, S6 immediately before the diagnostic) and refuses rather than proceeding if either reads unquiet or invalid. todlando holds nothing in flight. The window needs to be exclusive for 300s experimental + 180s cleanup reporting; the 600s preparation precedes both and spends no experimental time.

ROUTING: prepare -> the ELEVATED EXECUTOR, elevation REQUIRED, receipt must carry whole lines PREPARED, NOT_STARTED, executable_sha256=72d30901..., capture_sha256=a0e7afbe..., the hashes as HE measures them. go-authorization -> YOU, elevation NOT_REQUIRED, the request says the elevated executor must not answer it, and the receipt must carry whole lines GO_AUTHORIZED and authorizer=doyle plus that request's nonce quoted exactly. Readiness opens nothing; the window opens on your run-and-nonce-bound authorization and only if the preparation deadline has not passed.

LIVE PREFLIGHT OBSERVATIONS A PREP GRANT WOULD AUTHORIZE - all read-only, none elevated, none touching firewall/listener/process:
  S0a elevation self-check. S0b home existence. S0c instrument presence + sha256 of the six instruments.
  S0d CI status axis: gh run list --repo BigscreenVR/spt-bs-core --status <five non-terminal> (network read); AND a Win32_Process census of this box via runner-census.ps1, with its own validity control.
  S0e subject identity (git read). S0f the 5470 BASELINE via portfields.ps1 - a Get-NetFirewall* read of the production guard port, which this run only ever READS.
  S1 sha256 of the pinned executable; nothing is built. S6 both axes refreshed. S7 pre-setup ABSENCE of the owned pair via census.ps1 (ActiveStore read) with its validity control.
  Nothing in preparation creates, modifies, elevates or dispatches. The first act that can change host state is the elevated setup, after GO.

74/74 PROVENANCE, as you asked - one file's total, NOT a fresh full-battery run: M,N,O,P,Q,R,S = 49 arms RETAINED, unchanged since their last run on this pin and re-executed only because they share the file with U and V; U = 10 arms NEWLY exercised (relabelled timeouts, measured wait bound, in-budget positive control, and the new u4); V = 10 arms NEWLY exercised (subject's own final accounting executed, copied arithmetic and the v5 grep gone). Separately and unchanged on this pin, not re-run for this step: cleanup-controls 50/50, declined-setup-controls 16/16.

A PREP grant would still not authorize the elevated setup, the teardown dispatch, any execution of the removal instrument, any stop or kill, or a field run.