6U2UZVXK — G1 QUALIFIED / G2 PREPARED, NOT EXECUTED

G1
r6 is a fail-closed UNCONFIGURED template. Six final configuration slots remain blank until Doyle supplies the assembly tuple. Original r5 remains byte-for-byte pinned; no field top-level ran.
Common handoff deadline is min(entry+requested_wait, entry+120, phase_work_deadline); cleanup selects WORK_DEADLINE even before GO. Final sleep is clamped. Receipt checking/recording consumes the deadline, and acceptance at/after it is refused. Nonce-count, authorizer and ordinary/cleanup signal semantics are preserved.
Preparation requires SPT_RIG_PREP_EPOCH and SPT_RIG_PREP_DEADLINE: decimal integers, epoch<=now<deadline, deadline=epoch+600. Missing/unpinned/expired inputs refuse before runtime evidence creation. No fresh600 fallback.

Qualification: 62/62 observations, including original-r5 counterexamples, deadline/cap/reserve boundaries, overhead, late/exact-boundary receipt rejection, nonce/signal controls, inherited preparation validation, and actual real-clock wait smoke. Real-clock arm: logical exit1 at timeout, wall2.391s; source wait reported2s and enclosing shell interval3s. Scheduling overhead is not claimed preventable; it grants no additional poll/acceptance window.
Native owner record: launcher35868 birth2026-09-13T12:28:11.7204455Z; Python38144 birth2026-09-13T12:28:12.8196325Z; native0, COMPLETE, CONFIRMED_GONE, active_processes0. stderr empty. Runtime34.92s. Bash syntax0.
Proof: controls/r6-deadline-proof-Doyle6U2UZVXK/
Native record/captures: controls-out/r6-deadline-launch-6U2UZVXK/

G2
Prepared controls/custody-discriminator.ps1 and custody-observer.cs. Neither discriminator nor compiler nor signer was executed. PowerShell parse0; C# is reviewed source, NOT compilation/runtime-qualified.
The observer uses DEBUG_PROCESS and duplicated retained debug-event handles to observe actual signer, both actual git children, and all descendant helpers at CREATE_PROCESS and their initial loader breakpoint. No PATH shim, substituted signer, injected DLL or env scrubber. Exact observed git path/hash, provenance argv role and compile-time repo cwd must match. Unsupported x64 PEB/debug-event state, unknown image, missing process or missing loader observation refuses. Only the intentionally suspended timeout git-status may omit its loader breakpoint.
Arms: normal public-fixture staging; timeout holding the second actual git until the inner native job expires; post-provenance staging error; deliberately forbidden helper inheritance rejected by the same policy; clean post-window helper. Only a fixed PUBLIC dummy value is supported; no keygen or real-secret input capability. No environment values/dumps are emitted. Births are lossless UTC strings. Environment scanning uses one page-bounded buffer, does not allocate strings for other environment entries, and clears the buffer on return.
This proves inheritance boundaries, not continuous arbitrary in-process mutation. Compiler/setup completes seed-absent before the observed injection window. All jobs and births must disappear before owned dummy EnvironmentFiles retire. Public partial files and first-review sources remain preserved.

Prepared invocation AFTER Doyle supplies the xtask pin:
pwsh -NoProfile -File <absolute-d2>/controls/custody-discriminator.ps1 -XtaskExe <Doyle absolute xtask.exe> -XtaskSha256 <Doyle SHA256> -QualificationRoot C:/Users/decid/Documents/spt-custody-6U2UZVXK -OutputRoot <absolute-d2>/controls-out/custody-6U2UZVXK -BuildRepoRoot C:/Users/decid/Documents/projects/spt-core/.worktrees/asm-304-v3 -GitExe "C:/Program Files/Git/cmd/git.exe" -GitSha256 f4f1ff2df52c33239013f8cac4047696a380b02b7790c69895bcf8fd81ea7bb6 -AuthorizePublicDummyQualification
The compile-time root remains subject to Doyle's final identity and actual child-cwd check; no argv placeholder is runnable authority. Both roots must still be fresh and their parents present. Qualification additionally excludes repo/build/LocalAppData staging, reparse paths, old dbdb signer, mismatched pins, ambient seed and reused/overlapping roots before mutation.
Compiler availability, hashed not run: C:/Windows/Microsoft.NET/Framework64/v4.0.30319/csc.exe SHA25646809206887326d2d24db1eff1f3064de972c3451abe766b49111450a5e08e00. Future diagnostic compile is explicit, non-cargo and native-bounded; its output hash is frozen before observed arms.

PINS (SHA256, relative to .spt/preserved/hertz-fp-driver-review/d2)
fp-driver-d2-r5.sh df6cca2d987e8eb2a6e9ccba6e9532d278c08bb4f873674836653e5a8e419c59
fp-driver-d2-r6.sh 7de896c27634a2a7b253f74c815f13518360c538f7195e9718d0aca083975ac4
controls/r6-deadline-controls.py 351572e0dd3c87210d920b6db29d2ecbf6cfd0a04fcc4d34548c0a065846a9bb
controls/custody-discriminator.ps1 ccdbf17efbba5ebd2aa64ae99dcfe8aebcce151c521822e496ad9e2ecb6e0b96
controls/custody-observer.cs 1dd9ac0105167033c6e2977a996302351655a170e3888c01ce32f7d22d5928fa
launch-v2.ps1 6e2c2eac82dd53fd0af42c4fe796f911e987d406e6f31219cd4480a78f1f6804
launch-v2.cs c3a905ec7cbc118f0b59dd1813b187740319802267689e14dacf6008730de157
r6-support-6U2UZVXK/manifest.json d64ddf3c96bfea95aa4fe57691d8d9fbe14845932e451e235e66b9d28525273e

The11 public field helpers were frozen outside RIG_ROOT in r6-support-6U2UZVXK; manifest names original source paths and exact bytes. Final configured r6 gets a distinct SHA after configuration-only binding; its exercised function bodies must remain unchanged. Source snapshots and a D2-relative inventory accompany this receipt in controls-out/r6-g1-g2-return-6U2UZVXK.

Traceability check0:903complete,0incomplete,0findings. Syntax/trace receipts: controls-out/r6-g1-g2-verification-6U2UZVXK/. These are not custody runtime proof or field proof.

NO RIG_ROOT writes, qualification-root creation, keys, trust, staging, apply, firewall mutation, field run, cargo/rebuild, fleet change or disposal occurred. RIG_ROOT and the intended qualification root were absent at receipt preparation.

NEXT / AUTHORITY
Waiting on Doyle's final assembled commit and absolute spt.exe/xtask.exe paths+SHA256. Then run A.1 under6U2UZVXK, verify every c1-c5 gate and fresh host samples, carry ONE600s preparation deadline, and record Doyle's preauthorization only for the FIRST matching run nonce. No second approval round is needed on the specified passing tuple; any actual gate failure/changed tuple/second attempt returns to Doyle. Real key minting waits for custody PASS. D.15 exact owned breadcrumb retirement and private seed retirement are granted; RIG_ROOT filesystem disposal is NOT granted. Lifecycle infrastructure remains extension-owned.