## 6. The pipe-absence instrument — MEASURED, in both runtimes

Under your read-only preflight authorization I ran the launcher's **own S3 bytes**, cut from
`d3-emission-probe-v4.ps1` by marker (lines 57–80, block sha256 `b98f5f20…`) and executed verbatim —
nothing retyped, so the argument under test is the launcher's construction and not a transcript of
it. Probe `d3-pipe-instrument-probe.ps1` `3b1bb29f…`, output `d3-pipe-instrument.out` `ff011861…`.

**Your reading was right: the argument is not what the earlier report showed.** The launcher builds

```
[\\.\pipe\]   length 9   backslashes 4
U+005C U+005C U+002E U+005C U+0070 U+0069 U+0070 U+0065 U+005C
```

— four backslashes, byte-identical in both runtimes. A two-backslash form resolves to `C:\pipe` and
is a different string; it is not what S3 passes.

| runtime | host | enumerated | known-present control | target hits | verdict |
| --- | --- | --- | --- | --- | --- |
| Windows PowerShell **5.1.26100.8875** (Desktop) | `WindowsPowerShell\v1.0\powershell.exe` | **635** | `spt-daemon-broker-78bf18a9fd96fdc6.sock` ✅ | 0 | instrument proven, target absent |
| PowerShell **7.6.6** (Core) | `PowerShell\7\pwsh.exe` | **637** | same pipe ✅ | 0 | instrument proven, target absent |

The subject's own lines in both runs: `ctl_nonempty=True ctl_predicate=True hit=0`, then
`absence=OBSERVED_AT_CHECK race=NOT_EXCLUDED`. The two counts differ because the namespace changes
between samples — enumeration races, which is exactly why absence is only ever read at an instant.

**The known-present control is independent of the sample.** The spt daemon is live on this box (pid
4732, `daemon run --detached`, in the 05:34:53Z census), so its broker pipe MUST appear; a listing
that cannot find a pipe known to exist reads absence for everything, and the probe refuses such a
sample (`SAMPLE_UNPROVEN`, exit 5) rather than reporting the target absent from it. A failed
enumeration is reported as **ERROR** with exception type and message — never as zero, never as
absence.

**There is therefore no PowerShell-version limitation here, and I am not carrying that inference
forward.** The earlier 5.1 failure was an argument that reached `C:\pipe`, not the launcher's
namespace. The invocation's shell is no longer blocked: both runtimes are measured working, and §7
pins `powershell.exe` for consistency with the child the launcher itself spawns.

One asymmetry this run does NOT remove, recorded rather than fixed (v4 is held): in the launcher a
throwing enumeration is an unhandled terminating error. It dies before S4 — nothing launched, no
nonce spent against the product — but it emits no `D3_REFUSED` line and exits `1`, not the receipted
`2`. The silent-zero case IS covered, by `ctl_nonempty` → `absence_instrument_unproven`, exit 2.