diff --git a/tools/ca3-v4-amend/pc1-v4-sub2-g1.ps1 b/tools/ca3-v4-amend/pc1-v4-sub2-g1.ps1
new file mode 100644
index 000000000..19f39a27f
--- /dev/null
+++ b/tools/ca3-v4-amend/pc1-v4-sub2-g1.ps1
@@ -0,0 +1,88 @@
+# Counter ASIC 3.0, the class v4 amendment, sub-version 2 (7 October 2026, AP-F8-1, main: B2, object byte 7): gate G1 only, on PC 1
+# (machine ae432dc7, the project lead's desk, released by main's "go PC 1" for this one job after the 0.3.20 sweep step). The RTX 5090 is
+# switched off by the RUNNER (`--cards-off nvidia:NVIDIA GeForce RTX 5090` at publish: the runner matches the live card by its
+# key with or without the device index and restores it after), never by this script; the script confirms the card quiet by
+# the process list (no igneum-worker-cuda with --device 0) and nvidia-smi's compute-apps list, as the 6 October PC 1 jobs did,
+# then runs the installed worker's --bench on the eight packs. The app, the prover, the AMD and Intel cards and settings.json
+# are untouched; nothing else runs on PC 1 in this job. of docs/plans/counter-asic-2-rollout.md
+# section 7 on PC 2's RTX 5090 (machine 1ccfe586) for the class v4 candidate mx8+sh256x27 composed with the era
+# (docs/plans/counter-asic-3-gate/hash-gates.md). ONE signed `run` job carries both gates, as the PC 2 rule of the
+# ca3 brief asks. It never quits, restarts or updates the installed app, never touches the prover (left ON), /opt or
+# settings.json (read only, for the card keys), and does not switch the card off: bit-exactness and the verifier
+# re-hash are not load sensitive, so the app keeps mining beside the runs and every row says what ran on the card.
+# The kit is the fetch job fetch-ca3-v4-sub2-pc1-20261007 (packs-ca3-v4: the class v3 control mx8-devnet-epoch0 and the seven
+# class v4 packs v4-devnet-epoch0, v4-era-0 .. v4-era-5, each with seeds.txt), every file sha256-listed.
+# G1: the INSTALLED igneum-worker-cuda.exe (NVRTC, the pack's own kernel text) --bench on every pack: the self-test
+# (cache FNV, dataset head, word MASK, 64 samples, 96 vector lanes) and the 2^24 fingerprint at base nonce 0, which
+# must equal the Mac's (Metal and Apple OpenCL). G2: the worker's serve mode, one job of 1,024 nonces at target
+# ffffffffffffffff per pack (every nonce a "found g2 <nonce> <hash>" line). The found lines never go to stdout: the
+# intake's closing report keeps the last 200 KB of job.log and a file upload its last 256 KB, and the first run of this
+# job (15:52Z) lost its G1 lines under 8 x 1,024 found lines. Each pack's found lines go to g2-<pack>.found in this job's
+# folder (LF, nonce order), and stdout carries one line per pack: the count and the file's sha256. The Mac re-check
+# (tools/ca3-v4/g2-recheck.sh) derives the same file from `igneum-pow hash-bound --prehash 00..01 --count 1024` on the
+# same pack and compares digests: equal digests are 1,024 of 1,024; on a mismatch the file is fetched with
+# `publish-jobs.sh add --kind collect --glob "app/jobs/<job id>/g2-*.found"` and diffed line by line. Every result line
+# starts with RESULT, there are about 60 of them, and the report carries them all whatever the log length; the full
+# job.log stays at app/jobs/<job id>/job.log on the PC (the RESULT log line names it; collect it with the same glob form).
+$ErrorActionPreference = 'Continue'
+function Stamp { (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') }
+function Smi($q) { try { (& nvidia-smi --query-gpu=$q --format=csv,noheader,nounits 2>$null) -join ' | ' } catch { 'nvidia-smi failed' } }
+function CudaApps { @(& nvidia-smi --query-compute-apps=pid,process_name,used_memory --format=csv,noheader 2>$null | ForEach-Object { "$_" }) }
+"RESULT start $(Stamp) machine $env:COMPUTERNAME"
+"RESULT log $(Join-Path $env:IGNEUM_JOB_DIR 'job.log') (the full output; the found lines of G2 are g2-<pack>.found beside it: collect --glob app/jobs/<job id>/g2-*.found)"
+"RESULT gpus $(Stamp) $(Smi 'index,name,driver_version,memory.used,clocks.sm,clocks.mem,power.draw,power.limit,temperature.gpu')"
+
+# the kit: the fetch job's folder under the app's jobs folder (nothing of another job's is reached)
+$jobs = Split-Path $env:IGNEUM_JOB_DIR
+$kit = Join-Path $jobs 'fetch-ca3-v4-sub2-pc1-20261007'
+$packs = Join-Path $kit 'packs-ca3-v4-sub2'
+if (-not (Test-Path $packs)) { "RESULT error packs missing at $packs (the fetch job fetch-ca3-v4-sub2-pc1-20261007 runs first)"; exit 2 }
+$inst = @("$env:LOCALAPPDATA\Programs\Igneum Miner", "$env:ProgramFiles\Igneum Miner") | Where-Object { Test-Path (Join-Path $_ 'igneum-worker-cuda.exe') } | Select-Object -First 1
+if (-not $inst) { "RESULT error no installed igneum-worker-cuda.exe"; exit 2 }
+$exe = Join-Path $inst 'igneum-worker-cuda.exe'
+"RESULT worker $exe sha256 $((Get-FileHash -Algorithm SHA256 $exe).Hash.ToLower()) bytes $((Get-Item $exe).Length)"
+$appExe = Join-Path $inst 'igneum-app.exe'
+if (Test-Path $appExe) { try { "RESULT app-version $((& $appExe --version 2>&1 | Out-String).Trim())" } catch { } }
+foreach ($f in (Get-ChildItem $packs -Recurse -File | Sort-Object FullName)) { "RESULT kitfile $($f.FullName.Substring($packs.Length + 1).Replace('\', '/')) sha256 $((Get-FileHash -Algorithm SHA256 $f.FullName).Hash.ToLower()) bytes $($f.Length)" }
+
+# the card keys, both forms, from settings.json (read only; nothing is posted: the card stays as it is)
+$appDir = $env:IGNEUM_APP_DIR
+if (-not $appDir) { $appDir = Join-Path $env:LOCALAPPDATA 'igneum\app' }
+$sj = Join-Path $appDir 'settings.json'
+if (Test-Path $sj) {
+  try {
+    $settings = Get-Content -LiteralPath $sj -Raw | ConvertFrom-Json
+    if ($settings.cards) {
+      foreach ($p in $settings.cards.PSObject.Properties) {
+        $short = ($p.Name -split ':')[0] + ':' + (($p.Name -split ':') | Select-Object -Last 1)
+        "RESULT card-key settings.json `"$($p.Name)`" short-form `"$short`" enabled=$($p.Value.enabled) identities=$($p.Value.identities) power_pct=$($p.Value.power_pct)"
+      }
+    } else { 'RESULT card-key none in settings.json' }
+  } catch { "RESULT card-key settings.json unreadable: $_" }
+} else { 'RESULT card-key no settings.json' }
+# ---- the card quiet (the RUNNER's --cards-off took): no cuda worker carrying --device 0, no igneum compute app on the 5090 ----
+function CudaWorkers { @(Get-CimInstance Win32_Process -Filter "Name = 'igneum-worker-cuda.exe'" -ErrorAction SilentlyContinue | Where-Object { $_.CommandLine -match '--device 0\b' -or $_.CommandLine -notmatch '--device' } | ForEach-Object { $_.ProcessId }) }
+$t = 0; $left = @(CudaWorkers)
+while ($t -lt 90 -and $left.Count -gt 0) { Start-Sleep -Seconds 5; $t += 5; $left = @(CudaWorkers) }
+$apps = @(CudaApps | Where-Object { $_ -match 'igneum|sp1|prove' })
+if ($left.Count -eq 0 -and $apps.Count -eq 0) { "RESULT card $(Stamp) quiet after $t s: no cuda worker on device 0 and no igneum compute app (the runner's --cards-off took)" }
+else { "RESULT card $(Stamp) UNCONFIRMED after $t s: cuda worker pids [$($left -join ' ')], compute apps: $($apps -join '; ') (was the job published with --cards-off?); the fingerprints below are still bit-exactness, only the rates are beside a miner" }
+"RESULT gpus $(Stamp) $(Smi 'index,name,memory.used,power.draw,clocks.sm')"
+
+$order = @('mx8-devnet-epoch0', 'v4-devnet-epoch0', 'v4-era-0', 'v4-era-1', 'v4-era-2', 'v4-era-3', 'v4-era-4', 'v4-era-5')
+# ---- G1: --bench on every pack (self-test + 2^24 fingerprint at base 0; 5 timed dispatches, the rate a reference beside the miner) ----
+foreach ($pk in $order) {
+  $d = Join-Path $packs $pk
+  if (-not (Test-Path $d)) { "RESULT g1 $pk missing"; continue }
+  $t0 = Get-Date
+  "RESULT g1 $pk start $(Stamp)"
+  & $exe --bench --pack $d --batches 5 --batch-log2 24 --block-warps 1 2>&1 | ForEach-Object { "RESULT g1 $pk $_" }
+  "RESULT g1 $pk end $(Stamp) exit=$LASTEXITCODE wall_s=$([int]((Get-Date) - $t0).TotalSeconds)"
+}
+
+# G2 is OWED by the project lead's word (limited testing: the vectors, the pairing and this G1 prevent a split and prove the fix).
+$w = @(Get-Process -Name 'igneum-worker-cuda' -ErrorAction SilentlyContinue)
+"RESULT processes $(Stamp) igneum-worker-cuda running: $($w.Count); compute apps: $((CudaApps) -join '; ')"
+"RESULT gpus_after $(Stamp) $(Smi 'power.draw,power.limit,clocks.sm,clocks.mem,temperature.gpu,memory.used')"
+"RESULT end $(Stamp)"
+exit 0