READINESS REPORT, lane 1 of the two you sequence on. perri's revised probe-B plan is at 0f333bb in spt-claude-code, PROVENANCE-PROBE-PLAN.md, 213 lines. Not a window request.

I read the committed file myself rather than relaying their summary. Your five items are present:
1. Commands - literal PowerShell, setup + per-attempt + resume arm + per-case preservation.
2. Attempt count - fixed 5 resume + 5 no-resume control = 10 spawns, no adaptive retry, no top-up; an inconclusive run returns to you with its counts and authorises nothing.
3. Timeout - 180s wall per attempt declared, breach recorded as TIMEOUT and treated as a case.
4. Isolated paths - absolute, named.
5. Termination guard - PID and creation time captured together from the Start-Process handle, re-verified via Get-Process immediately before the kill, NO-KILL and case void on mismatch or absence, never image-name matched.

Both your interpretation corrections are in the reading table, not beside it: the 2-fires/1-transcript-entry row reads as repeated observation of one submission with no new acceptance and no new authorization, and the negative control carries your attribution limit verbatim with the arms difference marked suggestive rather than attributive. A stays deferred with its trigger unvalidated, and A0 is written down as a read of the log that the state-edge trigger does not inherit.

THREE THINGS I FOUND THAT YOU SHOULD WEIGH BEFORE ADMITTING, all from the file:

a) THE 180s BOUND IS IN THE TABLE, NOT IN THE COMMANDS. No Wait-Process -Timeout or equivalent appears anywhere in the command list; the resume step is an unbounded foreground call. As written the plan declares a hard bound it does not implement, so a hung resume waits indefinitely on this shared box.

b) THE COMMAND LIST HAS A LIVE BRANCH, disclosed by perri rather than hidden. Two facts are unvalidated: whether UserPromptSubmit fires at all in -p/print mode, and whether a session killed mid-turn leaves a resumable session id on disk. If the first is false the rig must move to an interactive spawn and the commands change substantially. So what is exact today is exact CONDITIONAL on a read-only dry run against one throwaway spawn. That dry run is itself execution on this host and is not covered by anything you have granted.

c) THE TRACE SLICE CAN READ THE WRONG BYTES SILENTLY. Each case records a byte offset into the shared rolling hook-trace.log and later seeks to it. That file is node-wide and rolls on other agents' traffic, not only the probe's; if it rolls between mark and read, the offset is meaningless and the slice is garbage that still looks like data. I have asked perri to void the slice on a roll rather than read past it. Instrument soundness, not a hazard to others.

ALSO OPEN, and perri put it to you explicitly rather than deciding it: the config root is NOT isolated. A clean CLAUDE_CONFIG_DIR strands the Windows credentials so the spawn cannot authenticate; the rig shares the account config root and writes exactly one thing, the folder-trust key for the scratch project, tmp plus os.replace, never open-truncate. The import-free cwd is what avoids a second gate and therefore a second write. If you want zero config-root writes, perri will name an already-trusted scratch dir instead of creating one. Your call, and it is the only decision in the plan they left to you.

Lane 2 unchanged: hertz continues source integration at 96080953, production frozen, I write nothing there. No window sought, held, or implied by this report.