# A7 — the new verify's wall, cold powershell.exe 5.1, x3 EMPTY and x3 POPULATED
Pre-registered before any run. doyle's acceptance criterion 5 (03:34Z) as amended by hertz (every wall
carries its exit code and a post-state census; a parse-only or structural check runs BEFORE invocation).

## THE SUBJECT IS THE PRODUCT, NOT A TRANSCRIPTION OF IT
liam's A6c/A6c-2 rendered the reconcile body from source by hand, and doyle accepted that with the
deviation named. I am NOT doing that here, because I no longer have to: rider item 1 makes the product
log its own per-invocation wall and outcome. So the instrument is the product's own line
  bootstrap-firewall leg=verify-query program=powershell.exe wall_ms=<W> outcome=completed
read out of the daemon log. That measures the SUBJECT (the shipped verify, rendered by script() from the
real QUERY const, encoded and invoked exactly as the product does it) instead of my copy of it.
COST OF THIS CHOICE, NAMED: the wall is measured INSIDE the process (Instant around the child), so it
excludes the parent's own overhead and includes the child's spawn+import. That is the same boundary the
3000 ms budget is enforced at, which is the boundary the budget decision needs. It is NOT comparable to a
Measure-Command wall around powershell.exe from a shell, and I will not put the two in one table.

## ARM A — EMPTY owned set (unelevated, read-only, no rule touched)
`report_lan_admission` calls verify FIRST and only requests elevation if it fails, so an unelevated
bootstrap start on a box with zero owned rules produces exactly one verify-query invocation over an empty
owned set. x3, each a COLD process (the product spawns a fresh powershell.exe every invocation, so every
arm is cold by construction -- there is no warm variant to confuse it with).
  PRE-CHECK (before any run): rendered-script structural check -- the QUERY text contains exactly ONE
  `Named-Rules` call and ZERO `PersistentStore` occurrences. This is the brace-balance analogue: it costs
  no box and it is the one thing that would make the whole measurement meaningless (measuring the OLD
  two-pass shape and reporting it as the new one).
  CENSUS each run: owned-name count in BOTH stores = 0 before and after. Read-only arm, so the post-state
  census proves the arm changed nothing, not that work happened.
  EXIT CODE each run: the product's own outcome field (completed / failed / killed) beside the wall.

## ARM B — POPULATED (pair present). ELEVATED WRITE FIRST.
Write the pair with the product elevated (one reconcile), census to 2, then x3 unelevated verify runs.
  CENSUS each run: owned-name count = 2 before and after each verify; hygiene and source read Local.
  This is the arm that pays the filter walk (2 rules x 8 calls = 16 calls) and it is the shape the budget
  must cover -- per doyle, the populated arm is the one that counts.

## WHAT IS PREDICTED, BEFORE THE RUN -- SECTION REPLACED 05:52Z AFTER LIAM'S DEFICIT
MY EARLIER PREDICTION IS WITHDRAWN, not annotated. It read ARM A ~1050-1150 ms, ARM B ~1350-1800 ms,
derived from the measured terms. That is the SAME decomposition liam showed under-predicts the KILLED
verify by at least ~800 ms with no measured term to hold the deficit: every term any of us measured
tonight assembles to ~2180 ms for the OLD verify, and the old verify was KILLED AT ITS 3000 ms BUDGET
three times (A1 elevated, A2 unelevated on a bracketed-quiet box, A5 elevated). A prediction built on an
arithmetic known to run ~800 ms light is the same error twice.
PRE-REGISTERED INSTEAD, about the SHAPE rather than the number:
  DIRECTION: ARM B > ARM A, by the filter-walk term (B walks 2 rules, A walks none).
  DISCRIMINATOR, needing no estimate of mine: the old shape on a POPULATED store was KILLED at budget,
  three times. Any COMPLETED ARM B wall is therefore already a strict improvement, and the verdict is
  completed-vs-killed.
  THE RESULT THAT SAYS THE FIX FAILED: ARM B reads outcome=killed, or lands near enough to 3000 ms that
  the observed 554 ms cold-floor spread crosses it. Then the ~800 ms deficit is not per-call, halving the
  calls did not buy the ruled margin, and the array form plus process reuse return to the table.
  WHERE THE DEFICIT WOULD SHOW: ARM B much closer to ARM A than 16 removed calls can explain points at
  liam's candidate (b), the JSON emit over fully-described rules. I name his candidates; I do not pick one.
  NO BUDGET NUMBER IS CHOSEN BEFORE B READS (doyle's criterion 5).

## WHAT THIS ARM CANNOT SETTLE, SAID FIRST
1. It does not price the Describe walk directly; it measures the new shape WHOLE, per doyle's item 3.
2. It says nothing about a slower box. The fixed ~580 ms and the per-call class are HFENDULEAM figures.
3. The ~2.05 s Windows TCP refusal constant (hertz 03:36Z pcap, liam's loopback, ENLYZEAM) does NOT enter
   this budget at all: there is no TCP connect in a verify. I said earlier I would carry it into "the
   rider's budget reasoning" -- that was loose and I am withdrawing it. It belongs to rigs that time a
   refusal, not to the subprocess budget.