YOU WERE RIGHT AND THE MISS WAS MINE. The bundle was not wired to r3: the copied driver still set SP to the 291081e5 scratchpad, so BIN resolved there and an execution would have loaded the OLD helper while my manifest said r3. Worse, I had called it preflighted. My parse test used an EXTRACTED function against a file I handed it, so it proved the parser and said nothing whatever about runtime path resolution - you named that exactly. I have not run the driver.

CORRECTED EXECUTION COPY, configuration only
  fp-driver-v9-bundle.sh   sha256 268436e507e3937fb244758c77e1df7131e3713b9369974b3e76ad3dcaf88e99   71900 bytes, CRLF (1139/1139), bash -n clean
  in the bundle dir beside the helpers. The PINNED v9 a9510e1e is preserved untouched, both in the bundle and at the original 291081e5 path.
  EXACT DIFF, one line, nothing else in the file:
    -SP='...291081e5-a375-43ea-81a8-f0e1b7e15a41/scratchpad'
    +SP='...920f96d8-9033-4e9b-a259-c8b586fe390e/scratchpad/bundle-r3'
  W is untouched, so EXE still points at the lane worktree release binary. No logic, no constant, no gate changed.

RESOLVED PATHS VERIFIED WITHOUT RUNNING THE DRIVER. I extracted only the configuration block (lines 167-199) and checked it contains no mkdir, no redirect and no removal before evaluating it, so the check itself creates nothing:
  SP  = ...920f96d8.../scratchpad/bundle-r3
  BIN = ...bundle-r3/fp-bin
  H   = ...bundle-r3/fp-home          (fresh, under the bundle)
  RUN_ROOT = ...bundle-r3/fp-run      R = ...bundle-r3/fp-run/20260912T102239Z   (fresh, under the bundle)
  EXE = C:/Users/decid/Documents/projects/spt-core/.worktrees/304-w2-repr/target/release/spt.exe   (unchanged)
  RESOLVED HELPER HASH at $BIN/runner-census.ps1 = 63d0508b93a8d15fa2bc9940708c7a13ac4abda1f8ca9c9a5d32a63b1dcf3e8a - r3.

AND THE NEGATIVE CONTROL, because a resolution test that cannot fail would be the same mistake twice: the identical probe run against the UNFIXED copy resolves BIN to the 291081e5 scratchpad and hashes the helper there at 0d8b67edf980f852aa120fa3a88c51b00916566611753aba3bb843da608984f9 - the OLD helper. So the defect you found is reproduced by measurement, and the probe demonstrably discriminates between wired and unwired rather than just agreeing with me.

WHAT IS NOT RE-PROVEN, stated so the receipt is not over-read: r3's live census and the box_gate parse controls were run earlier through the ORIGINAL bundle paths and stand as measurements of r3 and of the parser. The only new claim here is path resolution. Per your word I did not repeat the stub battery for a path-only change.

liam's LEDGER IS IN THE PROCEDURE, labelled as you required: "How liam says they implement it - REPORTED MECHANISM, not independently verified", with an explicit line that I have not inspected their ledger or exercised the branches, and all three states recorded as liam's account of their own behaviour rather than a guarantee the procedure has proven. I requested no ledger implementation and wrote none.
  HANDOFF-PROCEDURE-v9.md is now sha256 987569883091f7104c116fa52a6b9b13f885f51dc376dcf6d69aea3dd2654273, 7511 bytes (was 2b6b764b, 6343). The only content change is that single labelled block.

perri's ADDENDUM PRESERVED VERBATIM with your ruling attached to the header: .spt/preserved/todlando-300-adapter-assessments/perri-claude-spt-addendum-2026-09-12.txt, sha256 57ca1644979dff7cc1d8d5a914b09380be1df6dd0d0e620b17233fadd5ebc554, beside the original assessment at 233056d8. The header records that the machine-injection finding is a SEPARATE UNRESOLVED REQUIREMENT - a submitter contract must distinguish human submission from automated delivery - that pattern matching is NOT proven provenance, and that the contract is not to be expanded before Reavo's answer. The contract draft is untouched at 24069979 and unpushed.

Admission remains held pending your reading of this execution-path receipt. No build, no field launch, nothing elevated, and nothing reaped - 39260 and 43280 both still running, so the population r3 was measured against is intact.