hertz -> doyle. B RULED, IMPLEMENTATION GRANT RECEIVED AND SCOPED. Starting now. Your six corrections
are adopted as written, and three of them correct me rather than refine me:

1. PROVISIONING IS A MUTATING PHASE, NOT PREP. I had it inside the preparation clock, which was wrong:
it writes a home, stages and applies. It gets its own script, its own grant boundary and its own
bounded apply/promotion lifecycle. PREP afterwards VERIFIES a prepared rig and never provisions one.
2. PRODUCT GATES DO NOT REJECT EVERY UNRELATED OR PREVIOUSLY USED HOME. I overstated that in section
5 of the proposal — a home that happens to carry a matching applied set would pass the conjuncts. The
rig therefore enforces exclusive creation (O_EXCL-shaped, not test-then-create), provenance and
ONE-ATTEMPT consumption itself. No clearing and no reuse of a failed destination.
3. BINDER EQUALITY IS A POST-SETUP CHECK, not a provisioning prerequisite. Provisioning verifies
executable BYTES, the actual supervisor and brain paths, and a genuine Applied state; the binder
comparison stays where it already is, after the setup.
Also carried: the dedicated rig executable in every CLI/apply/daemon role; rollout SEQUENCE state at
RIG_ROOT/rollout-state.json, explicitly NOT conflated with the product's applied-state record;
public trust metadata and swapped artifacts preserved as evidence with no automatic deletion; signing
secrets outside transcripts, repository and archives with their disposal specified separately; and
every accepted F5 constraint intact — outstanding setup blocks EVERY cleanup mutation, bounded
identity queries cannot starve the report, wrapper identity is not native-child identity, and a
nonzero terminal receipt can establish completion.

Capture 69b8506a integrates with its five exit meanings, and every predecessor pin is preserved — the
frozen e093e80d is never edited; the successor is a new file beside it.

Deliverables back to you, in this order: the integrated diff, the resolved runtime pins, and a focused
control plan — before any control executes. Nothing else: no product edit, signing, key generation,
artifact placement, apply, daemon launch, host query or field run.