# #304 W2 — admission preflight receipt

**Taken:** 2026-09-12T22:57:58Z, by todlando on HFENDULEAM.
**Subject:** `85f84d738fa702f35c83910f314aae17849d125c`
**Plan:** `5e8b3e0968f866f2cd5fd6f728f5b1e7a6896ea1` (`docs/304-W2-FIELD-PLAN.md`)
**Driver:** r8, frozen — `2dc91f95477339b5c5a017b465d57113f163bdd226e311f4da7256e17a23c3ff`
**Authorization for this document:** read-only preflight only. **No build, no field run, no host
probe, no elevation.** Liam's elevation handoff requires a fresh scoped authorization; no prior grant
carries forward.

Every value below was measured by me on this box at the timestamp above. Where a number originates
with a peer it is labelled as theirs. **This is a point-in-time reading, not a standing condition** —
see §7.

---

## 1. Capacity

| quantity | value |
| --- | --- |
| free on `C:` | **120.042 GiB** |
| used on `C:` | 1741.976 GiB |
| producer-admission floor (`FLOOR_GIB`) | 96 |
| hard stop (`HARD_STOP_GIB`) | 32 |

GiB throughout — divided by 1073741824, not decimal GB. Free space is **24.0 GiB above the
admission floor** and 88.0 GiB above the hard stop. Thresholds **retained unchanged**; r8 re-reads
the floor before every producer, which is where the binding check lives.

## 2. Local producer and runner census — ancestry-authenticated

591 processes enumerated via `Win32_Process`; every match below carries its parent chain, so
identity rests on ancestry rather than on a name.

| predicate | measured |
| --- | --- |
| `cargo.exe` | **0** |
| `rustc.exe` | **0** |
| `Runner.Worker.exe` | **ABSENT** |
| `Runner.Listener.exe` | 1 — `Runner.Listener.exe(22712) <- RunnerService.exe(19588) <- services.exe(1644) <- wininit.exe(1532)` |

The listener being up with **no worker descended from it** is the free-box state: the runner is
online and idle, not executing a job.

**18 `spt.exe` processes are present and are LIVE INFRA, not producers.** Every one authenticates to
a legitimate parent: the resident daemon at pid 4732 (itself the root), agent perches under
`spt-mobile-host.exe(11836) <- spt.exe(4732)`, `omp-spt` chains under the daemon, and terminal-hosted
sessions under `WindowsTerminal.exe`/`claude.exe`. **None is a build producer and none is to be
reaped.** They are recorded so that a later reader does not mistake a busy process table for a busy
box.

## 3. CI axis — `BigscreenVR/spt-bs-core`

**Amended 2026-09-12T23:02Z.** The first reading of this section was
`0 non-terminal among the latest 15` — a **bounded-history predicate**, blind to a queued run older
than that window. doyle named the gap; it was real. The original reading is retained below the
amendment rather than deleted, because the defect is the reusable part.

### Amended predicate — filtered by active status, not by recency

Each status queried independently, server-side, with every exit and count preserved:

| status | exit | count |
| --- | --- | --- |
| `queued` | 0 | **0** |
| `in_progress` | 0 | **0** |
| `pending` | 0 | **0** |
| `waiting` | 0 | **0** |
| `requested` | 0 | **0** |
| `action_required` (supplemental — a conclusion, not a lifecycle status) | 0 | **0** |

`action_required` is **supplemental, and is not part of the active-status predicate.** It is a
workflow **conclusion**, not an active lifecycle status (doyle), so a zero there is not evidence
about queued approvals and must not be read as such. It is recorded only because it was queried and
every query's result is kept. The predicate rests on the five lifecycle statuses above it.

No stderr on any of the six queries. **Zero matches, so no job detail was required** — had any status
matched, `gh run view --json jobs` would have been read for it.

**Pagination was not needed, and that is a measurement rather than an assumption:** each query ran
with `--limit 200` and returned 0, so no result can be a truncation artifact. A count below the cap
is complete by construction.

### Controls — so a zero is a real zero and not a dead instrument

| control | exit | count | what it establishes |
| --- | --- | --- | --- |
| positive: `--status success` | 0 | **200** | the filter and the counting path are live and return rows |
| negative: `--status stale` | 0 | **0** | a zero is reachable through that same live path |

The positive control proves **liveness, not exhaustiveness**: 200 is the `--limit` cap, so that
query was itself truncated. It does one job — showing that a 0 from this code path means "none
matched" rather than "nothing was counted". It also returned far more than 15 rows, which is the
empirical answer to the original defect: this query is not bounded to a recent slice the way the
`--limit 15` listing was.

### Superseded first reading, retained

`gh run list --limit 15 --json databaseId,headSha,status,conclusion,workflowName,createdAt`: 15 runs
returned, 0 non-terminal, newest `34676423540` `completed`/`success`, workflow `ci`, head `7cdcf5da`,
2026-09-12T05:46:11Z, gh exit 0. That reading is **not wrong about what it measured** — it is
insufficient as an admission predicate, because absence within the newest 15 is not absence.

**The CI axis alone is blind to local builds**, which is why §2 is taken independently and not
inferred from this section.

## 4. Staged driver and helper hashes — three-way agreement

Verified by me with `sha256sum -c` against both manifests, and separately by hashing the resolved
files directly.

**Freeze manifest** `R8-FROZEN.sha256` = `6384a8c9ec77dea62ed2bdff2d3a43acb9f038df5a328b1186375a56fb06e108`
— matches doyle's reported pin. `sha256sum -c` over it: **10 of 10 OK.**

**Staged manifest** `INSTRUMENTS-STAGED-r5.sha256` = `c658dd3ffb7c04436e4391f5ed0726a7188f230549b3ab5278b092cab7c95cbd`
— matches doyle's reported pin. `sha256sum -c` over it: **6 of 6 OK.**

The five helpers agree across all three independent sources — the accepted `bundle-r4` baseline, the
reissued staged manifest, and the bytes actually resolving at `$BIN` right now:

| helper | accepted (r4) == staged (r5) == resolved on disk |
| --- | --- |
| `census.ps1` | `7a50b14e2ea0bf93a310ca14c0ba4f06faf82f6905a9bc764c692b0f913d413b` |
| `cpubracket.ps1` | `fc10031d25eb551daa88ba84b1cb13da4b90baa45ddc5dde3986fbd1abe90e73` |
| `d1_render.py` | `3b9844932696286b83342b831a90407e4505cf1a16665bc936c71f2d99cca596` |
| `portfields.ps1` | `283386e7e1cac9df5e8e3c7e8283faea224ad3d12f4da30185a9b342b9a1da85` |
| `runner-census.ps1` | `63d0508b93a8d15fa2bc9940708c7a13ac4abda1f8ca9c9a5d32a63b1dcf3e8a` |

Driver: `staged-r8-cleanup-exit.sh` = `2dc91f95…`, identical in the freeze manifest, in the staged
manifest, and on disk.

This closes the earlier prerequisite that the **actual resolved files** — not merely an unchanged
review tree — match the accepted helper pins. It is closed by my own measurement of all three
sources, not by a report of any of them.

**Provenance note on the r4 baseline.** `BUNDLE-R4-FROZEN.sha256`
(`b8547bd67ac4e589ffd9adaeeccd462ec3a7ac3d9aebfd8940af380e39007332`) does **not** live beside the
r5 bundle; it is under a different session scratchpad root. A first search bounded to the r5 bundle's
own tree returned nothing, and that absence was **not** reported — a wider search found it
immediately. The staged manifest's own note is confirmed: the accepted `runner-census.ps1` is census
r3 `63d0508b`, superseding v9-as-delivered's `0d8b67ed`, and `63d0508b` is what resolves on disk.

## 5. Isolated home

`…/bundle-r5/fp-home` — **ABSENT.** This is the required admission state: a pre-existing isolated
home is rejected and never truncated, because a prior run's home would make provenance unreadable.

## 6. Build shape — retained unchanged

| parameter | value | source |
| --- | --- | --- |
| build path | **one** release build via `debug-rollout --build-current` | plan §2; not build-then-build |
| build parallelism | `CARGO_BUILD_JOBS=2` | driver r8:935, read not recalled |
| capacity thresholds | floor 96 GiB, hard stop 32 GiB | §1, retained |

**Release-build estimate: UNKNOWN.** Stated as unknown deliberately. It is not to be borrowed from
a debug-build figure, from the 46 s warm targeted-test measurement, or from a CI wall — none of
those measures this producer on this pool.

## 7. What this receipt is, and what it is not

Every reading here is **point-in-time**. Free space, the process table and the CI queue are all
volatile; this receipt records that admission conditions **were** satisfied at 22:57:58Z, and binds
nothing about the moment a producer actually runs. The driver re-reads the capacity floor before
every producer and refreshes both box axes after the build, which is where the enforcing checks
live — this document is the preflight, not a substitute for them.

**Subject state at the same instant:** `.worktrees/304-w2-repr` detached at `85f84d73`,
`windows.rs` blob `848a23fe`, `git status --porcelain` empty. The plan requires these three
reasserted immediately before the rollout producer as boundary observations; that requirement is
unchanged and is **not** discharged by this reading.

**Nothing here is a grant.** No build, field run, host probe or elevation is authorized by this
document, and it does not request one — it reports that the preflight conditions doyle named are
currently met.

## 8. Admission conditions — summary

| condition | state |
| --- | --- |
| fresh capacity above floor | **MET** — 120.042 GiB, floor 96 |
| no local producer | **MET** — cargo 0, rustc 0 |
| runner not executing | **MET** — `Runner.Worker.exe` ABSENT |
| CI axis quiet | **MET** — 0 across all five active lifecycle statuses, filtered by status rather than by recency; positive and negative controls both behaved (§3, amended) |
| staged driver and helper hashes | **MET** — three-way agreement, both manifests verify |
| isolated home absent | **MET** — `fp-home` does not exist |
| subject identity | **MET** — `85f84d73`, blob `848a23fe`, clean, detached |
| release-build estimate | **UNKNOWN**, by instruction |