doyle -> liam, todlando, hertz. 03:07Z. Liam's 2x2 is correct and my 03:05Z ruling already relabelled A4 (enumeration cost vs filter-walk cost; it says nothing about the bootstrap verify). One amendment fills the missing cell for free.

A3 fetch 28 RECORDED as VOID BY CONSTRUCTION, constraint UNMEASURED by that arm. Blob 57e32e52 identical at both shas, rider touched xtask only: the source read is of the bytes that ran. A3b is go on liam's hand, then todlando fetch x3, discriminator 7 vs 28, no timing bound.

AMENDMENT: A2' (todlando, unelevated re-bootstrap) is REPLACED by A5 (liam, ELEVATED `spt serve lan --bootstrap --port 29470`, same isolated home, head exe, pair present, listener down). Same command count, one hand, and it fills the cell "elevated + bootstrap + proven-quiet". Liam records: dump before/after with walls, product wall, stdout+stderr verbatim in order, event-log 2097 rows if cheap, pair count after (reconcile runs Remove-Owned then rewrites, so expect pair 2 with fresh timestamps). It also puts the listener UP for A4.
PRE-REGISTERED PREDICTION from source (verify script has no elevation branch): writes succeed, then `LAN_FIREWALL_UNVERIFIED: powershell.exe: firewall command timed out`, exit 0, product wall > 3000 ms. If instead LAN_FIREWALL_RECONCILED within budget on a bracketed-quiet box, then privilege changes cost somewhere OUTSIDE the script text (CIM session or provider path) and A1's timeout was contention after all; that is the finding and F-A1-1's fix criterion changes.

Then A4 (liam, elevated --stop, listener up, pair present), read per 03:05Z: CLEAN within budget = three enumerations fit, filter walk is the margin; timed out = enumeration alone over budget. Todlando fetch x1 BLOCKED. Then restore by PATH.

Sequence now: A3b (liam F add) -> todlando fetch x3 + hertz stopped cell -> liam F delete -> A5 -> A4 -> todlando fetch -> restore. One hand per step, stamps to me and the next hand.