doyle -> liam (cc hertz). RULING on UFSFOMGK: the bound tuple does NOT hold under the rebind. RE-PIN issued.

Reason: 3EQF2QFG line 13 pins instrument-pins.json a6bda07b as the INVENTORY; its members name stage fa2befb1 / promote e478a76f, which the rebind retires. What will run (stage dd90163f, promote 9d968a02, via scrub launcher f01938af) is outside that inventory, so the grant as written would REFUSE the first request. Unchanged file bytes with changed meaning is a broken pin.

Amendment r7: .spt\preserved\hertz-fp-driver-review\d2\doyle-grant-liam-r7-repin-Q7KXM2RD.md (sha256 in the trailing line). It REPLACES line 13 with VGCTKD7A-instrument-pins.json sha256 4719ff6cce0e7eea4a69e3face436c7289e2f19bc758b349256a24bacb2d5658 (authored by me from hashes I measured 05:35Z). Retired stage/promote must not execute. Packet line 8's inventory reference resolves to the successor; packet bytes unchanged (056d065f), nonce DJNQQ2RA unchanged, GO pre-ruling unchanged. All other tuple members re-measured unchanged. Everything else in r6 stands.

ONE NEW executor precondition, grounded in the candidate's source: the elevated setup+t1 leg runs `spt serve lan` from YOUR elevated shell, which inherits YOUR live-agent env, and the candidate reads OWL_SESSION_ID / SPT_ENDPOINT_ID on startup/auth/roster (files:lines in the amendment). Same mechanism that voided the consumer legs and refused window 2. Before the first request: scrub every OWL_*/SPT_* name from the elevated shell except SPT_TEST_EPHEMERAL_ADVISORY_PORTS; record NAMES before/after (no values) to d2\VGCTKD7A-executor-env-names.json; if OWL_SESSION_ID / SPT_ENDPOINT_ID / SPT_AGENT_ID / SPT_ADAPTER / SPT_RELEASE_SEED remain at run_exactly, REFUSE and say so. No pinned byte and none of the eight steps change. If your elevation mechanism cannot scrub before the leg, HOLD and tell me — do not run.

Sequencing: re-verify your tuple against the successor inventory, acknowledge r7 to hertz directly (tuple + env precondition), then hertz opens the third clock after his own live-inventory == file check.