# FIELD PLAN v1 (SOURCE-ONLY PREPARATION) — repaired candidate 53d625cd
todlando, 2026-09-12. NOT a proposal to execute. No build, no field grant, no instrumentation
change made. Every line below is from reading source at 53d625cd in .worktrees/304-w2-repr.

## A. SUBJECT
candidate 53d625cd (branch test/304-w2-observed-spelling-cells), my 10d18b7f an ancestor.
Product file: crates/spt-daemon/src/bootstrap_firewall/windows.rs (1896 lines at this sha),
shared harness crates/spt-daemon/src/bootstrap_firewall.rs (420 lines).

## B. WHAT A FIELD RUN MAY DECIDE, AND WHAT IT MAY NOT
MAY: representation acceptance — whether decide() reaches its later arms on a real host whose
NetSecurity spelling differs from what was written (the W2 defect: Ok(false) at the spec match).
MAY NOT: enforcement. decide()'s hygiene, source-store and ENFORCEMENT arms are untouched by my
lane and stay untouched by this plan. No Full predicate is weakened to obtain a pass, and a
reconcile is never ASSUMED successful — a run that did not observe a written pair reports that,
it does not infer one.

## C. OUTCOME / CENSUS DISCIPLINE (retained from A7)
Per invocation the product already emits, from bootstrap_firewall.rs:99-109:
  bootstrap-firewall leg=<label> program=<program> wall_ms=<n> outcome=<completed|killed|failed>
outcome() (:120-126) keeps KILLED distinct from FAILED — a budget expiry says nothing about
whether the host changed, so a killed leg is a VOID arm, never a red. Legs are labelled at the
call sites; the query leg is "verify-query" (windows.rs:676).
Census: taken before AND after the series, bracketing it, both stamped, per hertz's bracketing
discipline in twohost-exec-plan-v4-section-d.md:222-223. A single post-hoc census cannot
attribute a change to the run.

## D. THE PRODUCT'S QUERY SNAPSHOT — FEASIBILITY VERDICT
NOT CAPTURABLE WITHOUT CHANGING THE SUBJECT. Measured by reading, not inferred:
 - snapshot() (windows.rs:675-680) calls powershell("verify-query", script(QUERY)) and hands the
   stdout straight to serde_json::from_str. It is never stored, never echoed.
 - powershell() (:666-674) forwards to super::run.
 - super::run (bootstrap_firewall.rs:99-109) logs ONLY leg, program, wall_ms and outcome. The
   child's stdout is returned to the caller and NEVER written to any log.
 - run_bounded (:136-188) pipes stdout into a reader thread, caps it at 1 MiB, and returns it.
   No tee, no file, no trace hook.
So the evidence limit I carried into the lane stands at 53d625cd: failure-time matcher INPUTS are
not recoverable from the product as built, and no field run can name which field decided a run.

Two ways forward, both named, neither taken:
 D1 NO SUBJECT CHANGE — out-of-band QUERY replay. Reconstruct the exact script from the source
    constants and run it via powershell.exe, bracketing the product's own verify (before/after).
    WHAT IT CANNOT ESTABLISH, stated up front: it is a PARALLEL snapshot from a DIFFERENT
    invocation. It bounds the observed spellings around the product's call; it does not prove
    what the product's own call saw, and the host may change between them (the same reason the
    census was folded into the product's single invocation — windows.rs QUERY comment,
    "a laptop that joins a subnet between two invocations").
 D2 NAMED INSTRUMENTATION CHANGE — emit the raw verify-query stdout once beside its existing log
    line. Source change, therefore a build, therefore your grant. Naming it per your instruction;
    NOT proposing execution, and not written.

## E. OPEN, BLOCKING PARTS OF YOUR BRIEF I CANNOT GROUND
See the two questions sent alongside this file. Sections for them are stubbed, not guessed.

## F. REGISTRY / RIDER NOTE CARRIED IN
Placement not-placement-judged count DIFFERS BY SUBJECT: 2 at main 7cdcf5da (my corroboration),
3 at 53d625cd (hertz's standalone traceability, per your END summary). The delta is +1 and is a
property of the candidate, not of the checker. Named, not explained — I have not identified the
files, and the JSON carries no field that could.