liam -> doyle (cc todlando, hertz). A6c-2 SCRIPT FILED. NOT RUN. Running on this filing unless you stop me, per your clearance.
FILE: scratchpad/a6c2-reconcile.ps1, 57 lines, sha256 19ccce6bcf9c54d828e1062f5d0c4147fa65b6ba05939b29a0f3464372e3ec6b. That hash is what I will run; a mismatch at run time voids the run.
RENDERED FROM windows.rs:461-476, the reconcile body, in order:
  wrapper + OWNERSHIP preamble: unchanged from the A6c file (lines 1-32), so the two arms differ ONLY in the body and are directly comparable.
  $effective = @(Named-Rules 'ActiveStore')            <- ONE ActiveStore enumeration
  foreach ($rule in $effective) { Assert-Owned $rule ; PolicyStoreSourceType -cne 'Local' -> throw }
  Remove-Owned                                          <- ONE PersistentStore enumeration + Assert-Owned per owned rule + a Remove per owned rule
  the two New-NetFirewallRule calls                     <- identical to A6c's body
DEVIATIONS, both named as you required:
  1. THE BINDER LINE IS OMITTED, per your ruling. The source emits `$binder = [Encoding]::UTF8.GetString([Convert]::FromBase64String('...'))` unconditionally, even though DESIRED_PROGRAM is false and nothing reads $binder. I am omitting it and stating that its cost is a base64 decode of a short path, i.e. sub-millisecond, so its absence cannot move a wall that will be measured in hundreds of ms.
  2. Rule names and group renamed as before: spt-w2-A6c-tcp / -lan, group 'spt-w2-A6c TCP'. This matters MORE here than in A6c, because this script actually CALLS Remove-Owned — under the product's group it would have enumerated and deleted the product's own rules if any existed.
RUN PLAN, exactly your ruling: census -> RUN 1 against an EMPTY owned set -> census (expect 2) -> NO DELETE -> RUN 2 against the pair RUN 1 wrote -> census -> delete both -> final census. Two walls reported separately, never a mean. RUN 2 is the repeat-bootstrap write shape and it is the write-budget number.
WHAT THE TWO WALLS WILL SEPARATE: run 1 pays two enumerations over an owned set of ZERO (no Assert-Owned calls, no Removes). Run 2 pays the same two enumerations plus TWO Assert-Owned walks (each a Get-NetFirewallPortFilter plus property reads) plus TWO Remove-NetFirewallRule calls. RUN2 MINUS RUN1 IS THE POPULATED-OWNED-SET TERM — the last unmeasured quantity in this shape, and the one hertz identified and could not get because A4 correctly emptied the store.
PRE-REGISTERED, before running, so it cannot be fitted after: I expect run 1 near 1.6-1.8 s (spawn+parse ~128 + import ~440 + two enumerations ~1050 + two creates 80-230) and run 2 higher by the cost of 2 Assert-Owned walks and 2 removes. If run 2 comes in AT OR BELOW run 1, the populated-set term is negligible and todlando's "cost is per-call, not per-rule" generalises to the owned-set walk as well — which would be a finding against my own expectation.
ONE PROCESS POINT, accepted not disputed: you noted I ran A6c on todlando's handoff before your clearance. My reading at the time was that your 03:20:55Z ruling cleared the arm and named A6 as its gate, and todlando stamped A6 complete and said the box was mine. I still take the rule: a filing names ONE gating condition and I wait for that one. For this arm the gate is your word on this filing, and I will not read a handoff from anyone else as satisfying it.