todlando -> doyle. CLEANUP END. The bounded read-only replacement check SUCCEEDED. No elevation was needed, so liam was not involved. No writes, no retry loop, no broad census.

=== 1. HUNG INSTRUMENT STOPPED, RECORDED AS AN INSTRUMENT FAILURE ===
Revalidated before acting: pid 51532, pwsh.exe, CreationUTC 2026-09-12T20:49:01Z, command line naming portfields.ps1 -Port 5470. Identity matched, so I stopped that pid alone. Verified ABSENT afterwards.
Elapsed ~6 minutes, never completed, capture ZERO BYTES. Preserved to .spt/preserved/304-w2-attempt2-20260912/instrument-failure-portfields-5470/ as capture-EMPTY.txt plus a RECORD.txt stating in its own words that the empty file is NOT evidence about 5470 and exists so it can never later be read as a measurement. Filed as instrument failure, not a firewall result.

=== 2. 5470 LISTENER STATE, QUERIED SEPARATELY ===
LISTENERS 0. Baseline said LISTENER_STATE NONE / LISTENERS 0. MATCH.

=== 3. THE CAPTURED RULE, BY EXACT NAME, SAME FIELDS, PER-RULE FILTERS ===
Rule {FF36EE51-2837-46D8-9AB8-2441D9070633}, each query bounded at 60s with terminating errors:
  field                 baseline 20:45:13Z                  now 20:57Z            verdict
  Name                  {FF36EE51-...-2441D9070633}         same                  MATCH
  Group                 (empty)                             (empty)               MATCH
  Enabled               True                                True                  MATCH
  Direction             Inbound                             Inbound               MATCH
  Action                Allow                               Allow                 MATCH
  Profile               Private                             Private               MATCH
  SourceType            Local                               Local                 MATCH  (PolicyStoreSourceType; PolicyStoreSource=PersistentStore)
  Protocol              TCP                                 TCP                   MATCH
  LocalPort             5470                                5470                  MATCH
  RemoteAddress         192.168.1.0/255.255.255.0           same                  MATCH
  Program               Any                                 Any                   MATCH
All eleven captured fields re-read and equal. Queries A-E each returned OK inside the bound; no timeout, no access or provider error, no missing rule.

I nearly shipped this with a hole: my first pass queried ten fields and silently omitted SourceType, which the baseline carries. I went back for it rather than presenting a comparison that quietly covered less than the capture did.

=== 4. THE PREDICATE IS LIVE, NOT A CLEAN ZERO ===
Negative control, same cmdlet and same shape against a GUID that cannot exist: classified RULE_MISSING. So the check can distinguish a missing rule from a present one, and the eleven MATCHes are readings rather than a filter that answers OK to everything. Missing-rule, access-or-provider-error and timeout were kept as three distinct classes in the classifier; none of them could have been reported as unchanged.

=== 5. REMAINING GAP, STATED ===
This is a PER-RULE comparison, not a census. The baseline also carried census-level counters -- CTL_RULES_NONZERO 1, CTL_SPTEXE_RULES 7, MATCHING_RULES 1, LISTENER_PROVIDER OK -- and I did NOT re-take them, because a broad census is exactly what you excluded. So: the named rule is unchanged in every captured field and 5470 has no listener. Whether the surrounding rule POPULATION changed is not established by this check and I am not implying it is.

=== STATE AT CLEANUP END ===
Rig broker 52608 absent. Rig brain 53496 exited on its own. 29470 clear. 5470 rule intact and unchanged in every captured field, no listener. Pool released. Firewall mutation reversed and verified at teardown. Production daemon 4732 untouched throughout. Evidence archived with a 106-line manifest; the instrument-failure record sits beside it.

Attempt 2 is closed on my side: verdict preserved as setup reaching enforcement rejection, Arm B unrun, populated timing unanswered, Full never weakened and reconcile never retried. Hertz's archive review continues independently.