**A7 END — 2026-09-12 06:35Z. The window is closed, the box is returned, and the populated arm was NOT run. Every timestamp below is a measured `date -u` stamp from `timeline.txt` or a log's own line; where a value is not measured it says so.**

## E1. Verdict first

| | |
|---|---|
| ARM A (empty owned set, unelevated) | **THREE completed rows — a successful, measured arm** |
| ARM B (populated) | **NOT RUN.** The registered pair-present precondition was never established |
| A7's question — does the FOLD-3 verify complete on a populated store? | **UNANSWERED** |
| Root cause of the setup failure | **OPEN** |
| Enforcement predicate | **NEVER REACHED**, untouched, not cleared by anything here |

## E2. ARM A — the table, with its instrumentation gap declared

| run | wall_ms | outcome | window (wrapper interval, bounds not duration) | pre-census | post-census | CPU bracket |
|---|---|---|---|---|---|---|
| A1 | **2633** | completed | 06:23:41Z → 06:23:48Z (7 s) | 06:23:41Z valid | 06:24:26Z valid | **ABSENT — procedure lapse** |
| A2 | **1784** | completed | 06:25:04Z → 06:25:08Z (4 s) | 06:25:04Z valid | 06:25:42Z valid | **ABSENT — procedure lapse** |
| A3 | **1952** | completed | 06:26:16Z → 06:26:21Z (5 s) | 06:26:16Z valid | 06:26:57Z valid | **ABSENT — procedure lapse** |

Every census: 1001 rules, `ctl_5470=1`, `ctl_sptexe=7`, `subj_group=0`, `subj_29470=0`, valid=YES. Both invocations exit 0 in every run.

Spread min 1784 / max 2633 = **849 ms**, reported as a number with **no attribution** — larger than A6's 554 ms and apportioned to nothing.

**The CPU bracket registered in Amendment 4 A5.3 was never wired into the ARM A script.** It is recorded as absent per row rather than backfilled: a sample taken after a wall is not a bracket on that wall. One contextual observation inside the arm window (06:25:11Z, 5.47 cpu-s/3 s, zero build-class) is retained SEPARATELY and substitutes for nothing. **Instrumentation therefore differs between the arms** — ARM A census-only, the ARM B rig built with the bracket outside the timed invocation — and that difference is part of the record, not a footnote.

Two clauses withdrawn during the arm, both mine: "the arm that pays no walk term" (my own census measured 1001 ActiveStore rules the query enumerates regardless of ownership) and the 5 s/4 s/5 s figures as *exposure durations* (they are wrapper intervals bracketing two commands; the listener's own up/down events are not instrumented, so true exposure is unknown within those bounds).

Observed and kept separate from the arm's table: three `leg=is-clean` rows on the stop paths, 2024 / 2036 / 2241 ms, all completed.

## E3. Why ARM B never ran

liam's elevated reconcile (action 1 of 2, exit 0) produced four completed legs — `verify-query` 2532, `verify-query` 1694, `reconcile-write` 2021, `verify-query` 2160 — and then:

```
LAN_FIREWALL_UNVERIFIED: NetSecurity completed but the observed rules do not match the
admission pair: spt-core-bootstrap-inbound-tcp (TCP port 29470, profile Any, remotes
100.64.0.0/10, program none); spt-core-bootstrap-inbound-tcp-lan (TCP port 29470, profile
Private,Domain, remotes 192.168.1.0/24, program none)
```

**A completed child invocation is not a successful reconcile** (doyle). The rules exist; the product says they are not the pair it wanted. ARM B was HELD: no reconcile retry, no hand-written rule, no `netsh`, and no trial against a precondition the product itself refuses to certify.

## E4. What the store actually held — read-only, both stores

Both names present in ActiveStore **and** PersistentStore, `PolicyStoreSource=PersistentStore`, `PolicyStoreSourceType=Local`, Enabled=True, Allow/Inbound, TCP, LocalPort 29470, RemotePort Any, LocalAddress Any, Package Any, InterfaceType Any.

| rule | Profile | RemoteAddress | Program |
|---|---|---|---|
| `spt-core-bootstrap-inbound-tcp` | `Any` | `100.64.0.0/255.192.0.0` | `Any` |
| `spt-core-bootstrap-inbound-tcp-lan` | `Domain, Private` | `192.168.1.0/255.255.255.0` | `Any` |

ActiveStore rows additionally: `EnforcementStatus={ProfileInactive, NoLocalUser}`, `PrimaryStatus=Inactive`. PersistentStore rows: `NotApplicable` / `OK`.

## E5. Pinned-source trace at `921aa68f`, read-only — where it fails and where it does not

`decide` returns `Ok(false)` from `pair_satisfied_by` **before** the source-type, LAN-scope and enforcement branches, and the text emitted is `mismatch_message`. **So the rejection is at the SPEC MATCH, and the enforcement check was never reached.** Nothing in this trace argues for weakening it, and `EnforcementStatus` being `{ProfileInactive, NoLocalUser}` rather than `Full` is a *separate* condition that a representation fix would not clear.

Three predicates in `spec_satisfied_by`, each independently sufficient to return false, against the desired side read from the constants:

| predicate | desired | observed (my later census) |
|---|---|---|
| `observed.program.is_empty()` (since `DESIRED_PROGRAM = false`) | no program filter | `Program` renders as the literal **`Any`** — non-empty |
| `observed.profile != want.profile` | `DESIRED_LAN_PROFILE = "Private,Domain"` | `"Domain, Private"` |
| lowercased sorted set equality on remotes | `lan_scope` emits network/prefix → `192.168.1.0/24`; constant `100.64.0.0/10` | mask form `192.168.1.0/255.255.255.0`, `100.64.0.0/255.192.0.0` |

**"The LAN half alone" is unsupported** — the Program value and the tailnet mask form conflict with the same predicates, so on these values both halves would fail and no single field can be singled out.

**The load-bearing limit, stated as a limit and not a hedge: these are PREDICTED mismatches from source plus a census taken AFTER the failure. The product's own QUERY snapshot is never logged, so the failure-time matcher inputs are not recoverable from this run.**

**A structural finding independent of which field actually fails:** the unit fixture `reconciled_store` builds each observed row FROM the spec it will be compared against — `observed(spec.name, spec.port, "", &spec.profile, &remotes)` — so observed and desired are spelled identically by construction and **representation divergence is invisible to the entire suite by design of the fixture.** A matcher can only be exercised against spellings its fixture can produce.

## E6. Cleanup evidence

liam's action 2 of 2, exit 0, product cleanup only: `LAN_BOOTSTRAP_DOWN`; `leg=is-clean wall_ms=1968 completed`; `leg=cleanup wall_ms=2783 completed`; `LAN_FIREWALL_CLEAN: no bootstrap-owned firewall resource remains`.

- **Final census 06:34:58Z** — 1001 rules (the pre-experiment count), `ctl_5470=1`, `ctl_sptexe=7`, `subj_group=0`, `subj_29470=0`, valid=YES.
- **Owned-rule absence by NAME in BOTH stores**, not by count: ActiveStore 0, PersistentStore 0.
- **5470 by named comparison, a-pre-1 vs final:** `{FF36EE51-2837-46D8-9AB8-2441D9070633}` en=True, Inbound/Allow, TCP:5470, remote `192.168.1.0/255.255.255.0`, prog=Any — **unchanged on name, port, enabled, remote, program** (those five fields, snapshot to snapshot; not full rule equivalence and not continuous invariance).
- **Listeners:** 29470 none; 5470 pid 4732, unchanged across both elevated actions and the reap.
- **Pool released** 06:35:13Z exit 0; `.worktrees/asm-304-w2` clean at `921aa68f`.

**The rig daemon, and a guard finding.** Pid 40280 was the A7 rig's own daemon, autostarted into the isolated home by ARM A run 1 — mine, not liam's to reap. `spt daemon stop` REFUSED it: exit 3, `DAEMON_STOP_REFUSED`, because that guard keys on `OWL_SESSION_ID` and **cannot distinguish an isolated-home broker from the live one**. I reaped the single pid after double authentication — command line naming the asm-304-w2 release exe with `daemon run --detached`, and `a7-home/daemon.pid` reading 40280 — with live pid 4732 verified present before and after. Worth carrying forward: *an env-keyed guard cannot protect a per-home broker, and the safe verb was unavailable for exactly the case it exists to serve.*

## E7. Setup rows, preserved in place

S1 06:12:46→06:12:48Z exit 0. S2 06:13:13→06:13:14Z exit 0. **S3 attempt 1 06:13:42→06:13:44Z exit 101** — panic `seed is hex: ParseIntError`, because my extraction matched the keygen output's DATA line and its INSTRUCTION line ("Set SPT_DEBUG_RELEASE_SEED to seed_hex on the fast coordinator"), yielding a 68-character value where 64 was required; post-failure state measured, nothing written. S3 retry 06:14:38→06:20:14Z exit 0, `DEBUG_ROLLOUT_STAGED version=1`, release build 5m33s. S4 06:20:29→06:20:33Z exit 0, `DEBUG_MARKED_APPLIED version=1`. S5 06:20:33Z exit 0.

**Provenance is a three-way match, not a self-report:** manifest `artifact_sha256` = staged bin sha256 = `W/target/release/spt.exe` sha256 = `e99a352cb57a18a6f69da55c9f7f5933dbfa528e2cad9aa2b7ff5f2f59222da3`, and the manifest's own provenance block names `git_commit 921aa68f…`, `git_dirty false`, `build_host HFENDULEAM`. Exact START of the run is **UNKNOWN** — pool-claim predates my stamping and no command-start log exists for it; it is not back-computed.

A second dead-predicate catch, recorded because it would have read as absence: a grep for the unescaped `"artifact_sha256"` returned EMPTY because the field lives inside the ESCAPED JSON string `metadata_json`. The file was read verbatim instead.

## E8. Evidence

Under the session scratchpad `a7-run/`: `a7b-setup.log`, `a7b-teardown.log`, `matcher-fields-b-precondition.csv`, `census-{a-pre,a-post}-{1,2,3}.csv`, `census-b-precondition.csv`, `census-control-preflight.csv`, `census-final.csv`, `a7a-{1,2,3}.{out,err,stop.out,stop.err}`, `timeline.txt`, `s2-pin.out`, `s3-rollout.err` (attempt 1), `s3b-rollout.{out,err}`, `s4-applied.out`, `s5-provenance.out`, `s9-poolrelease.out`, `rig-daemon-stop.{out,err}`, `census.ps1`, `cpubracket.ps1`, `armb.sh` (written, unused).

**`s1-keygen.out` is EXCLUDED from shared evidence — it contains the signing seed.**

## E9. Handoff

Repair is split and neither half is done here: **product comparison changes are mine; independent observed-spelling regression cases are hertz's.** No new field run and no amendment of `921aa68f` is authorized, and none was made.