todlando -> doyle: v3 COMMAND SECTION + OUTCOME TABLE. Not a prose revision. Nothing run, no grant assumed. PATHS, fixed and stated once (every command names them; no inherited cwd anywhere) W = C:/Users/decid/Documents/projects/spt-core/.worktrees/304-w2-repr (HEAD 53d625cd, status EMPTY) H = /fp-home (FRESH isolated home, this experiment only) R = /fp-run (all captures land here) EXE = W/target/release/spt.exe (RELEASE, per your correction 1) = C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/71de7b8b-0f13-494d-8fa4-c01f4a215d10/scratchpad Every capture is REDIRECTED TO A FILE, never piped. Each command's exit is read and recorded on its own line before the next runs: after each, `echo "_EXIT=$?" >> R/exits.txt`, and a non-zero exit on any S-step HALTS. CORRECTION TAKEN ON THE BUILD: the debug `cargo build -p spt --bins` in v2 section 3 is WITHDRAWN. The release binary is produced by the rollout verb itself with --build-current, which is what A7 actually did (s3b-rollout.out, and s5-provenance.out naming target/release/spt.exe). There is no separate cargo build step. S0 CAPACITY + POOL + RUNNER, before anything cargo run --manifest-path W/Cargo.toml -p xtask -- disk-floor --path W --floor-gb 96 --label fp-53d625cd > R/s0-disk.out 2>&1 cargo run --manifest-path W/Cargo.toml -p xtask -- pool-claim --pool W/target --label fp-53d625cd > R/s0-pool.out 2>&1 claimed FROM W so the recorded lane identity is this lane's. The incumbent record is hertz's 304w2-combined-gate, whose gate you have accepted as ENDED, so this is a sequential takeover of a FINISHED lane, not a contested one. I predict lane-identity refusals from the BUILD, never from the claim verb (IR-42); if the first build refuses SPT_POOL_FOREIGN or a lane-identity arm, that is the finding and everything HALTS. SPT_POOL_UNCHECKED is not used. jobs=2 for every cargo invocation: CARGO_BUILD_JOBS=2 exported once in R/env.txt and named per command. Runner/job census, two-axis, into R/s0-census.txt: a jobs-level CI read (gh run view --json jobs, never --json status) AND an ancestry-authenticated local process census (parent chain, not a name match). S1 FRESH ISOLATED HOME. mkdir H; record its absolute path in R/timeline.txt. Never SPT_HOME of this box. S2 cargo run --manifest-path W/Cargo.toml -p xtask -- debug-keygen fp-debug-2026 > R/s2-keygen.out 2>&1 cargo run --manifest-path W/Cargo.toml -p xtask -- debug-pin --key-id fp-debug-2026 --public-key --home H > R/s2-pin.out 2>&1 SEED: SPT_DEBUG_RELEASE_SEED must be SET and hex. A7's S3 died exactly here — panic "seed is hex: ParseIntError" at xtask/src/main.rs:2717 — so it is checked BEFORE the rollout, by a predicate that prints only a boolean and a length: never the value, never expanded into any log. S3 CARGO_BUILD_JOBS=2 cargo run --manifest-path W/Cargo.toml -p xtask -- debug-rollout \ --key-id fp-debug-2026 --product-version 0.69.0-fp --channel debug --version 1 --build-current \ --stage-dir H/releases --state W/target/fp-rollout-state.json > R/s3-rollout.out 2> R/s3-rollout.err Expect DEBUG_ROLLOUT_STAGED version=1 channel=debug platforms=x86_64-pc-windows-msvc. This step performs the RELEASE build; it is the long one. S4 cargo run --manifest-path W/Cargo.toml -p xtask -- debug-mark-applied --version 1 --home H > R/s4-applied.out 2>&1 Expect DEBUG_MARKED_APPLIED version=1. S5 PROVENANCE ROW, its own row, independent of any product self-report: sha256sum EXE ; stat size+mtime ; absolute path > R/s5-provenance.out and the staged set's artifact_sha256 read from H/releases > R/s5-staged.out S5 must EXIST and MATCH before any timed trial. If it does not, the prerequisite is the finding. S6 RUNNER/JOB CENSUS REFRESHED AFTER THE BUILD AND BEFORE ARM A, two-axis as S0 > R/s6-census.txt THE OPT-OUT, answering your point 5 exactly. Measured in source at 53d625cd: report_lan_admission (crates/spt/src/serveverb.rs:352-373) runs bootstrap_firewall::verify FIRST and only then, if `retry` is true, requests elevation or reconciles; `retry` is the --bootstrap flag (serveverb.rs:163,247). So `serve lan --port 29470` WITHOUT --bootstrap emits EXACTLY ONE verify-query leg and can neither request elevation nor reconcile. Every TIMED TRIAL in both arms omits --bootstrap. --bootstrap appears exactly once in this whole experiment: Arm B setup, elevated, by liam. PER-TRIAL SEQUENCE, identical in both arms (N=1,2,3). Census AND CPU bracket bracket EACH TRIAL. pwsh -NoProfile -File R/census.ps1 -Tag -pre-N -OutDir R # pair state BEFORE pwsh -NoProfile -File R/cpubracket.ps1 -Tag -pre-N >> R/cpu-brackets.txt # OUTSIDE the timed call echo "N_START_UTC=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> R/timeline.txt SPT_HOME=H EXE serve lan --port 29470 > R/-N.out 2> R/-N.err # TIMED. no --bootstrap echo "N_SERVE_EXIT=$?" >> R/exits.txt SPT_HOME=H EXE serve lan --stop > R/-N.stop.out 2> R/-N.stop.err echo "N_STOP_EXIT=$?" >> R/exits.txt echo "N_END_UTC=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> R/timeline.txt pwsh -NoProfile -File R/cpubracket.ps1 -Tag -post-N >> R/cpu-brackets.txt pwsh -NoProfile -File R/census.ps1 -Tag -post-N -OutDir R # pair state AFTER SUBJECT ROW EXTRACTION, and the row count is asserted: rows=$(grep -c 'leg=verify-query' R/-N.err) rows -eq 1 -> the trial's single subject row is recorded with its outcome field rows -eq 0 -> VOID. print it AND STOP: `exit 1` out of the arm driver. No further trial runs. rows -gt 1 -> VOID for this experiment. Multiple rows are NOT interchangeable observations; the opt-out was expected to guarantee one. Investigate before any further trial. The driver is `set -e`-guarded and the VOID branch EXITS the driver — printing VOID without halting is the A7 failure mode you are naming, and it is a hard stop here, not a log line. Census validity, per dump, two positive controls or the dump is VOID: ctl_5470 >= 1 AND ctl_sptexe >= 1. ctl_5470 also carries the 5470 PRESERVATION check: the live 0.69.0 listener on 5470 is NOT ours, is never stopped, and must still be counted in the post dump of every trial. A post dump whose ctl_5470 dropped to zero is a stop-everything condition, not a census note. ARM A (pair ABSENT), trials 1-3, unelevated, cold. Precondition asserted from the pre-census: subj_group = 0 and subj_29470 = 0. If a pair is present, Arm A's precondition is not met and it does not run. ARM B SETUP — ONE elevated action, liam, and its ACCEPTANCE is now a real gate (your point 3) (elevated) SPT_HOME=H EXE serve lan --bootstrap --port 29470 > R/b-setup.out 2> R/b-setup.err (elevated) SPT_HOME=H EXE serve lan --stop > R/b-teardown.out 2> R/b-teardown.err ACCEPTANCE = a SUCCESSFUL reconcile: the pair present in the post-census AND no refusal line in b-setup.err. Anything else — including an ENFORCEMENT refusal — is NOT acceptance: an enforcement refusal establishes that SPEC MATCHING PASSED FOR THAT INVOCATION, and nothing more. It does NOT establish the registered successful-reconcile precondition for Arm B. In that case I RECORD THE DIAGNOSTIC FINDING, HOLD the populated trials, RUN CLEANUP, and stop — no populated arm without a separately reviewed amendment from you. ON SETUP FAILURE, product cleanup runs regardless: (elevated) SPT_HOME=H EXE serve lan --stop, then the is-clean/cleanup legs the product itself emits, and the post-census must show subj_group = 0 while ctl_5470 is still >= 1. A7 left this implicit; it is explicit here. ARM B (pair PRESENT), trials 1-3, unelevated, no --bootstrap, same per-trial sequence, only after acceptance. TEARDOWN (elevated) product cleanup as above; assert LAN_FIREWALL_CLEAN and subj_group = 0, ctl_5470 >= 1. ISOLATED DAEMON: a daemon autostarts under H (A7 saw DAEMON_AUTOSTART / DAEMON_LAUNCH_VIA_WMI). It is stopped SCOPED TO H, in a shell with OWL_SESSION_ID cleared for that one command, and the production broker's pid is recorded BEFORE and AFTER to prove it was untouched. A7's rig-daemon-stop was REFUSED for exactly this reason (DAEMON_STOP_REFUSED, $OWL_SESSION_ID set) and I am NOT silently reusing the forced reap that followed: if the scoped stop refuses, that refusal is reported and the process is left for you, not force-reaped. cargo run --manifest-path W/Cargo.toml -p xtask -- pool-release --pool W/target > R/s9-poolrelease.out 2>&1 Both pins and the warm target preserved; nothing under W/target/debug is deleted. OUTCOME TABLE — PER TRIAL (classification, binding) completed a measurement; three of them make an arm SUCCESSFUL failed a measurement OF failed (non-deadline Err); error text quoted in place; does not count killed a measurement OF killed (3 s deadline expiry); IS the populated arm's failure verdict row absent NOT a measurement -> VOID -> the driver HALTS; no further trial runs rows > 1 VOID -> halt; not interchangeable observations All three scheduled attempts are kept. No replacement runs to manufacture completions. OUTCOME TABLE — WHAT A REFUSAL STRING ESTABLISHES (corrected per your point 2) mismatch_message recurring -> SPEC-MATCH REJECTION for that invocation. It does NOT establish a spelling defect: hygiene, port, a missing rule or a duplicate name can each reject at the same verdict. Discriminating among those needs the D1 diagnostic, and even then it is a separate invocation's evidence. source-store refusal -> spec match passed for that invocation; persistence arm refused. no_lan_scope_message -> host carries no LAN prefix this trial; LAN half unverifiable. enforcement refusal -> spec match passed FOR THAT INVOCATION. Nothing more. Specifically NOT a successful reconcile, and NOT Arm B's precondition. Ok(()) / verified -> spec match passed and ActiveStore enforcement read Full. I make NO unconditional prediction. Per your point 4: profiles being active does not alone imply Full — the other enforcement conditions stand — so the only prediction I register is CONDITIONAL on the actual captured enforcement values recurring: IF a trial's captured EnforcementStatus is again exactly "ProfileInactive NoLocalUser" as in matcher-fields-b-precondition.csv, THEN that trial's expected representation-accepted signal is the enforcement refusal rather than Ok(()). WITHDRAWN, your point 2, and corrected by replacement: v2 lines 120-121 called matcher-fields-b-precondition.csv failure-time evidence. It is NOT. It is a LATER READ of the host, taken after the refusal it sits beside. The product's own failure-time snapshot remains unrecoverable at this sha. D1 stays a SEPARATE SERIALIZED DIAGNOSTIC: never inside a timed trial, never concurrent with one, and never presented as the product's failure-time snapshot.