5b driver v2 — your four corrections folded, stop path exercised. No cargo. Field hold unchanged; no 5b producer run.

DRIVER: .spt/preserved/hertz-304-w2-traceability/controls_5b_v2.py
sha256 1b4be9e6f1d54585ded2867092a9a69c0a3b5d452b16398d7cd19e1d068bfae5
v1 (controls_5b.py) left in place unedited as the superseded record. controls_5a_v5.py NOT edited — it is a hashed, already-run artifact; the per-producer floor check is six duplicated lines here rather than a refactor into it.

THE FOUR CORRECTIONS

A. Continue-past-unexpected (was 158-172). The loop now judges each cell in place and, on the first unexpected result, sets the abort and breaks INSIDE the try. finally restores; restoration is asserted BEFORE the abort is raised, so a failed restore cannot be masked by the abort that preceded it.

B. Capacity per producer. New floor_check() runs immediately before EVERY spawn, inside the cell loop — 96 GiB admission floor, 32 GiB stop. It reads free space only and deliberately does not call verify_state, because at that point the tree is intentionally mutated and a clean-tree precondition would be false by design.

C. EOL normalisation under a byte-identity claim (was 126-132). Identity is now against the ORIGINAL WORKING BYTES captured before the mutation, no normalisation at all. Pin equivalence is retained as a separately named check (git show delivers the blob in git's EOL, so that one is an equivalence, not an identity). Two lines print, two different claims.

D. Dry-run that could not fail. --dry-run now requires valid state, exactly one test-module boundary, and exactly one product-region anchor per mutation, and exits nonzero naming every condition that did not hold. tests_region() also enforces the unique boundary at run time, not only in the dry run — two markers would silently redefine what "the product region" means.

MEASURED, all source-only

--dry-run from the gate worktree: state 4/4 OK, one boundary, anchor count 1 for all five mutations. DRY-RUN OK.
--dry-run-control (anchor deliberately absent): refused with "product anchor count 0, must be exactly 1". The arm can fail and says why. I also ran --dry-run from the wrong cwd: it exits 1, but by traceback at file open, before reaching the anchor arm — which is why the targeted control above exists.

STOP PATH (--stop-test), your exercise. Stub payload is a REAL capture, not a fixture I invented: 5a's preserved arm1_adjacency red replayed as m1's FIRST cell (E1) — a genuine nextest red for a different cell, i.e. compiled, something failed, not the selected thing.
  aborted (SystemExit raised)                 PASS
  abort names the unexpected cell             PASS
  abort says remaining cells were not run     PASS
  exactly 1 spawn reached                     PASS
  second cell never spawned                   PASS
  tree restored (verify_state)                PASS
  tracked tree clean                          PASS
  RESTORE m1_program_raw exact_bytes=True pinned_equivalent=True tracked_clean=True
  spawns: [an_unrestricted_program_spelled_any_satisfies_a_spec_wanting_none]

NEGATIVE CONTROL, because a stop-path test that has never been seen to fail measures nothing. The same assertions were run against v1's continue behaviour (main takes stop_on_unexpected=False, that arm exists only for this). It ran cell 2: spawns = both cells, "exactly 1 spawn reached" FAIL, "second cell never spawned" FAIL. Rejected as required.

TWO HONEST QUALIFICATIONS ON THAT CONTROL
1. "abort says the remaining cells were not run" PASSED in BOTH arms — the phrase is a fixed string in the abort message, so in the continue arm it is printed by a run that did not stop. It is non-discriminating; the real discriminators are the spawn count and the second-cell check.
2. "abort names the unexpected cell" FAILED in the control only because the LAST abort names E4. That is accidental discrimination, not designed. I am not counting it as a control property.

Stub bytes were written to a separate directory, 5b-stoppath-stub-not-producer-output/, never into 5a-raw/ — a raw file named for a 5b cell sitting beside real captures, holding a capture no producer made, is the fabricated-evidence shape this battery exists to refuse. Both files hash e1e27ee8… (identical to arm1's capture, as expected).

STATE: gate worktree .worktrees/304-w2-repr at 53d625cd, tracked tree clean, free 124.47 GiB (read fresh before the dry run and before each stubbed producer). MANIFEST-v5.sha256 appended with the driver and the two stub files.

Awaiting your ruling on v2. If cleared I will run 5b (five mutations, bounded --build-jobs 2 --test-threads 2, floor rechecked before every producer), then the final clean combined run, scoped clippy, traceable-reqs check, pool-release, and the END report.