### IR-124 — a cleanup that runs `serve lan --stop` UNCONDITIONALLY creates the daemon it exists to remove, when the setup it is cleaning up after never ran - **Status:** OPEN, measured once in the field. D2 field run `20260913T041410Z`, driver `2e3aec1b`, recorded by hertz 2026-09-13 at doyle's direction. Archive `.spt/preserved/hertz-fp-driver-review/d2/field-run-20260913T041410Z/` (72 files, manifest `defa5d29…`). **This is a RIG defect. It is mine — I wrote the driver — and doyle's admission review missed the unconditional stop path as well; both are recorded because a review that misses a path is part of the mechanism, not an aside.** - **Instance.** The elevated setup was **DECLINED and NOT STARTED** by liam at 04:18:55Z — measured, unambiguous, and the right call: his leg was ready at 04:18:35Z against a hard 04:19:10Z expiry and he refused rather than race the teardown. Nothing ran, nothing mutated. The driver then entered cleanup and executed its own unconditional `env SPT_INSTALL_NO_FIREWALL=1 SPT_HOME= serve lan --stop`, which dispatched through the daemon (`ensure_running`, `serveverb.rs:191`) and **CREATED** a supervisor (`daemon run --detached`, Windows PID 45944, `04:19:18.0312050Z`) and a brain (`daemon brain --generation 0 --start-reason cold`, PID 22524, `04:19:19.7696380Z`, parent 45944). `fp-home-d2`, measured ABSENT at the 04:13:58Z at-launch recheck, existed with `daemon.pid`, `brain.ready` and a full tree by 04:19:18Z. - **Why the hold could not stop it.** doyle held the elevated teardown for exactly this reason and liam held all commands. But this stop is **internal to the running driver**, not a handoff, so no authorization gate reached it: the only levers were killing the driver or editing a running script, and both are forbidden. **A guard that only governs dispatched work does not govern a step the subject performs itself.** - **The pre-dispatch markers named the mechanism and did not prevent it.** `daemon_may_run — serve dispatches through the daemon (ensure_running, serveverb.rs:191); the elevated leg may leave one running` was set BEFORE the setup was requested. The driver correctly refused to infer absence from its own expectation — and then triggered the very mechanism the marker warned about, from the cleanup path, on the branch where the warning did not apply. - **Three things kept apart, because collapsing any two misstates the run.** (1) Liam's testimony: NOT_STARTED, no mutation — still true, he created none of it. (2) The driver's conservative verdict: `CLEANUP=PENDING`, `residual_state=UNREADABLE`, `residue=UNMEASURED` — an honest refusal to claim clean, not a contradiction of liam. (3) An **actually observed** residual, created by the driver itself. That third thing is a measurement; the first two are testimony and abstention. - **Mechanism.** A teardown verb that is also a *start* verb. `serve lan --stop` must reach the daemon to ask it to stop, so invoking it when no daemon exists starts one. Cleanup paths are written for the case where setup succeeded, and are reached on every path including the ones where setup never happened; the branch nobody exercises is the branch where cleanup has nothing to clean. - **Rule.** A cleanup step whose command can CREATE the resource it removes must be **conditional on evidence that the resource exists** — not on the state markers, which say "may exist" by design, and not on the fact that cleanup was entered. Where the existence check is itself unavailable, the step is SKIPPED and reported as skipped, because an unnecessary teardown that spawns is strictly worse than a labelled gap. Exercise every cleanup path from the **setup-never-ran** state, not only from the setup-succeeded state. - **Kin:** [[IR-122]] (the other half: the stop that *cannot* run leaves a daemon; this is the stop that *should not* run and makes one), memory setup-suppresses-failing-arm, gate-against-documented-design, remedy-must-run-from-refusal-state. - **Ripe when:** before any repeat field run — a repeat under this driver reproduces the residue. · **Size:** small. ### IR-125 — the driver's own executable sweep reported ZERO processes on the pinned exe while `Win32_Process` showed TWO, at the same instant - **Status:** OPEN, measured in D2 field run `20260913T041410Z` (hertz, 2026-09-13). **A FALSE-NEGATIVE SWEEP, not a false CLEAR** (doyle's classification, and the distinction is load-bearing): the ledger's actual verdict was `residual_state=UNREADABLE` / `CLEANUP=PENDING`, which was correct, and the sweep line is explicitly labelled evidence-only in the driver's own output. - **Instance.** `SUBJECT_EXE_PROBE=OK running_the_pinned_executable=0 enum_total=618` — the probe enumerated 618 processes and concluded none was running the pinned executable. A `Win32_Process` read moments later returned **two**, both with `ExecutablePath` exactly `…\.worktrees\304-w2-repr\target\release\spt.exe`: PIDs 45944 and 22524. An independent sweep by path, not by pid, agreed: `count=2`. - **Why it matters despite being labelled evidence-only.** The line reads as a clean box to anyone skimming, and it is the only line in the run that speaks to "is anything of ours still running" in plain terms. It was contradicted only because a native read was performed for a different reason. Had the ledger's verdict logic depended on it, this is a false CLEAR. - **Candidate cause, NOT diagnosed** (deferred by doyle until cleanup was complete, and still open): the probe's raw path comparison. The Win32 `ExecutablePath` is backslashed Windows form; the driver's pinned `$EXE` is forward-slashed msys-friendly form. A literal comparison between those two spellings of the same file fails for every process. **Unconfirmed** — it is a candidate because it fits, not because it has been measured. - **Mechanism.** A predicate that can only ever return "no" reports a clean zero over a large, healthy-looking enumeration. `enum_total=618` is what makes it convincing: the instrument demonstrably ran and demonstrably saw the machine, and still could not see the thing it was looking for. Same family as the two other instrument-versus-reality mismatches in this lane, and all three were invisible to stubs. - **Rule.** A sweep that reports zero carries its own **positive control** — in the same run, the same predicate must find something known present, or the zero is UNMEASURED rather than absent. Where a predicate compares paths across the msys/Windows boundary, normalise both sides and prove the normalisation on a known-matching pair; never compare two spellings of a path and call a non-match an absence. - **Kin:** memory count-predicate-needs-its-own-positive-control, zero-match-filter-reads-as-absent, windows-firewall-census-clean-zeros, verdict-from-probe-competence, [[IR-118]]. - **Ripe when:** with IR-124, before a repeat field run. · **Size:** small. ### IR-126 — the experimental budget CONTAINED its own read-only preflight, leaving 128 s of a 300 s window for the elevated leg, and the leg was correctly declined - **Status:** OPEN, measured in D2 field run `20260913T041410Z` (hertz, 2026-09-13). Boundary NOT moved for that run — doyle refused the change mid-flight and was right to; this entry is the scheduling review he asked to be preserved. - **Measured, from the run's own timestamps.** Run start `04:14:10Z` · pre-setup absence census `04:16:23Z` · handoff request written `04:17:02Z`. So **172 s of the 300 s experimental budget went to in-budget read-only preflight** — CI axis queried by name across five statuses, ancestry census, six-instrument hashing, subject identity, 5470 guard baseline, pre-setup absence census — and the driver printed the remainder itself: `HANDOFF_WAIT bounded to 128s`. - **The consequence, and it is not hypothetical.** Liam's leg script was ready at `04:18:35Z`. Setup alone had measured ~9 s, plus four PowerShell stamps, plus a t1 capture of unmeasured duration, against 35 s of remaining clock. He DECLINED without mutation, which was the correct call and the one the instruction asked for. **The window was consumed before the work it existed for could start.** - **Two overruns recorded beside it, as observations and not as permissions.** Experimental activity ended at **306 s of the 300 s budget** (the deadline exits through the EXIT trap, so cleanup is never skipped, but the boundary was crossed). The driver was still running after its 180 s cleanup reporting bound had elapsed; it exited by `04:23:54Z`. Neither overrun was authorised, taken as an extension, or used to do more work. - **Mechanism.** A budget defined from process start, over a phase order that puts every read-only admission check inside it, gives the elevated leg whatever is left rather than what it needs. The preflight cost is not waste — those checks are why the run was admissible — but charging them to the same clock makes the window's usable size an accident of how slow the host's firewall enumeration is that minute. - **Rule.** Bound the ELEVATED LEG on its own clock, sized from its measured duration, and start it when the leg is dispatched. Admission checks get a separate bound. A driver that cannot guarantee a usable handoff window should REFUSE TO DISPATCH rather than dispatch a leg that cannot finish — an operator declining at the deadline is the correct outcome of a wrong window, not a failure of the operator. - **Kin:** [[IR-122]], memory your-cadence-can-be-the-blocker, reap-step-duration-is-not-the-window, twohost-run-window-discipline. - **Ripe when:** with IR-124 — a repeat field run under the current budget shape reproduces the squeeze. · **Size:** small.