# Renewal-aware deployment authorization — 2026-09-08

Owner instruction: replace the unconditional pre-15:00 refusal with a check that renewal has
already run successfully. This amends the E2 D-E2-2 time-window rule, not the other deployment
controls or the older disposable D2/adapter probes.

The E2 runner calls `Assert-RenewalSafe` at entry and immediately before module invocation.
For every discovered `win-acme renew*` task it requires Ready state and a known next run strictly
after the entire step budget. No `wacs` process may be running. If the budget touches 09:00–15:00
UTC, it also requires today's non-future LastRunTime and LastTaskResult 0. Failed, running,
queued, missing or unreadable evidence is refused. A budget crossing midnight is refused.
The proof is printed in the launcher transcript. WhatIf and executing steps use the same check.

The guard does not stop or disable renewals, inspect credentials, change certificates, or override
the interactive privilege proof, candidate fingerprint, module confirmation or rollback controls.
It is not an atomic mutex against a person manually starting renewal after the check; operators
must continue to avoid concurrent renewal and deployment operations.

The isolated host-observation tests cover successful renewal, outside-window behavior, stale and
failed runs, running processes, queued/running tasks, missing tasks, scheduler/process access
errors, next-run overlap, future timestamps, a process starting between observations, and midnight.
The real host check accepted today's successful renewal without any production mutation.