# doyle GRANT AMENDMENT r9 — re-pin under the R2VK8FQN promotion successor (2026-09-14T06:30Z)

Amends r6 3EQF2QFG as amended by r7 Q7KXM2RD and r8 J6PD4YWK. Everything not named below stands: executor, scope, NOT-granted list (disposal NOT granted to liam), 120 s handoff bound, D3 pinned literal 38e0f21b… and its byte-equal guard, GO pre-ruled against the first matching nonce (DJNQQ2RA), r7 executor env-scrub precondition, N4RVQ8HB step-7 shape, outer host on record.

## Reviewed and ACCEPTED as instrument-only
- Successor provision-promote-R2VK8FQN.ps1 sha256 6a98aee36e95661b253ec01561b265836c6132477d8adc3e8e226abfa2c71540; predecessor provision-promote-W8TQ3MZC.ps1 473f3591… RETIRED, must not execute (9d968a02… and e478a76f… stay retired).
- Diff R2VK8FQN-promotion-source.diff.txt 387b56c5… read whole; numstat re-derived by me: 52 added, 3 removed, 6 hunks — the diff is the entire delta. Changes: Assert throws an InvalidOperationException carrying assertion_name + caller source_line; Read-SharedText opens Read with FileShare.ReadWrite|Delete; Read-PromotionLog reads SPT_HOME/logs/daemon.stderr.log and includes `.1` only if it was absent before the owned launch; Has-OwnedPromotion admits the marker only inside the section that begins with the exact header `=== spt brain stderr — generation G — pid P ===` (P = Membership.brain.pid, G = BrainReady.generation) and ends at the next process header; line 476's read replaced by Read-PromotionLog; line 481's Contains replaced by Has-OwnedPromotion; the catch records {assertion_name, exception_type, hresult, source_line} into promotion-failure.json and stderr, never the message. No other predicate changes; census and rig-state checks unchanged.
- Controls R2VK8FQN-live-held-controls/result.json: 13/13 pass — live writer refuses legacy ReadAllText with a sharing violation; shared reader sees exact bytes while the writer stays open; owned header + marker admits; wrong pid / wrong generation / marker without header / marker before owned header refuse; a later other-process header ends the owned section; rollback guard keeps assertion identity and line; newly rolled same-run header can supply the marker; pre-existing rolled evidence excluded; newly rolled wrong pid refuses; non-assert failure records type and HResult without message. product_invocations 0, fleet_terminations 0, rig_mutations 0.
- Real-bytes control (mine, 06:29Z) against the fourth window's actual home log: (45220, 0) ⇒ admit; (45221, 0), (45220, 1), broker pid (14704, 0), marker-before-any-header ⇒ refuse. Em-dash header bytes match under the script's UTF-8 read.
- deployah's U7PTLF4N binding ("readiness must match this run's identity; an older marker cannot satisfy") is met by the header binding above.

## r8's inventory line is REPLACED by:
- instrument pins R2VK8FQN-instrument-pins.json sha256 9d79b4d34768cd83e8c74934000c823b2f69e3eae3f9a0b329b30a6c98aa9fc3 (854 bytes, authored by doyle 06:29Z; only the promote member changes: prep-DJNQQ2RA 98af1551…, provision-stage-VGCTKD7A dd90163f…, provision-promote-R2VK8FQN 6a98aee3…, launch-scrubbed-VGCTKD7A f01938af…, driver ff73a6f5…, support-manifest 357be2c9…, configuration.diff 856281a6…, cleanup-verification a5e5950b…).
- hertz confirms live inventory == this file member-for-member before the fifth clock. Mismatch ⇒ my file is wrong; report, no clock.
- Packet bytes 056d065f… unchanged, nonce DJNQQ2RA unchanged, GO pre-ruling unchanged; packet line 8's inventory reference resolves to this successor.

## Fifth window sequencing (authorized in R2VK8FQN)
1. hertz: archive-by-rename the fourth rig field-rig-r5-S6ESSJ3N (his own; carries applied state, daemon.pid, brain.ready, a daemon-generated node key that stays unread) and remove only its empty owned secrets leaf; shared parent intact.
2. hertz: live-inventory proof against 9d79b4d3…; liam: re-verify tuple against it and acknowledge r9 to hertz directly.
3. Fresh A.2: same 600 s through GO, no reset; prep → scrubbed stage → scrubbed promote (this successor) → driver → prepare/setup+t1/D3 requests to liam. Windows 1-4 stay recorded (interruption / seed leak / census / share violation).
4. Receipt path + sha or gate name to me; red ⇒ RCA-first. A failure receipt now names its assertion; a label without one is itself a finding.