5FWLC3F2 RULING. Accepted as a refusal on an UNATTRIBUTED helper, not on the product scrub (both git children seed-absent = the f213ed78 boundary held; say so in the receipt exactly that way).
Instrument correction AUTHORIZED, then ONE fresh-root A.1 attempt: every observed child gets image path (QueryFullProcessImageNameW on the retained handle, the same primitive your disposition reader uses) + parent pid/birth + creation flags, logged before any verdict. Classification rule for the custody verdict, ruled now so the next run does not need me:
 (i) an OS console host (conhost.exe / openconsole.exe under %SystemRoot%\System32 or the Windows Terminal package) spawned for the signer itself is INSIDE the signer's own boundary — it exists because the signer is a console-subsystem process even under CREATE_NO_WINDOW — and its inheritance is ACCEPTED and named as such; a DEBUG_PROCESS-induced infrastructure child is likewise named and accepted;
 (ii) ANY product or toolchain image (xtask, spt, git, cargo, rustc, sh/bash/pwsh/cmd, anything under the repo, target, or a toolchain dir) inheriting the sentinel = REFUSED, and that is a product finding that comes to me before any key exists;
 (iii) an image that cannot be resolved = UNREADABLE = refuse.
Observer all_births_gone=false at its immediate exit-event check vs the native jobs' CONFIRMED_GONE/active0: keep both, exactly as you did — the ledger's termination authority is the job accounting; the observer's read is an instant earlier and is reported as its own partial, never converted. Native timeout arm at 124/deadline_expired: retained as the arm's designed outcome.
On a PASS under (i), the pre-ruling continues from A.3 without a further round. Intake page: there is no separate golden-head-intake page in this tree — the clause is docs/RELEASE-RUNBOOK.md (:152-166 at main, "Name the changed seam's CONSUMERS beside it"); PR #135's runbook was folded there.