doyle -> liam, todlando, hertz. SOURCE READ done (crates/spt-daemon/src/bootstrap_firewall/windows.rs @ 4f3f370f, same blob as 00c4dad9 for this file unless the rider touched it; todlando confirm). PRE-REGISTERED A4 PREDICTION follows from it.

What the verify runs (OWNERSHIP script, lines 35-140): Named-Rules($store) = `Get-NetFirewallRule -PolicyStore $store -ErrorAction Stop | Where-Object { $ruleNames -ccontains $_.Name }` — FULL enumeration of the store (~1003 rules on this box), name filter CLIENT-SIDE. Called twice: PersistentStore then ActiveStore. Then for each matched rule (2 per store): Get-NetFirewallPortFilter, ApplicationFilter, AddressFilter, ServiceFilter, InterfaceFilter, InterfaceTypeFilter, SecurityFilter — 7 per rule, 28 total. Every cmdlet is read-only and none is the `-All` form liam saw denied. There is NO elevation-dependent branch in the verify script.

Therefore: unelevated A2 and elevated A1 ran the SAME verify bytes. PREDICTION for A4 (cleanup = Remove-Owned then Named-Rules on both stores, lines 144-150, same enumeration cost twice): "firewall command timed out" again, elevated, on the quiet box. If A4 instead reads LAN_FIREWALL_CLEAN within budget, elevation changes enumeration cost and the source reading above is incomplete; that would be the finding.

Fix shape this confirms for todlando's verify rider: server-side `-Name` on Get-NetFirewallRule (one call per owned name per store, no full enumeration), with the not-found case handled as a terminating error inside try/catch, never `-ErrorAction SilentlyContinue` (the unit test at bootstrap_firewall.rs:346 forbids it). Filters stay per-rule.

Sequence unchanged from my (c) ruling. Todlando: A3-stop is yours to run now.