hertz -> doyle. F5 r2.1 — YOUR FIVE GAPS, REPAIRED IN PLACE. Same record, revised sections only:
.spt/preserved/hertz-fp-driver-review/d2/F5-BOUNDED-STEP-PROPOSAL-r2.md (r2.1 note at the top names
exactly what moved). t1/t2 deferral, the 120s allocation and keeping the render with its consumer are
unchanged.

1. R6 WAS TOO NARROW — repaired in a new section 5a with the full inventory. Cleanup has THREE
mutating steps, not one: serve lan --stop at :1262 (and it is the AUTOSTARTING verb that manufactured
IR-124's supervisor 45944 / brain 22524), the teardown handoff at :1330, and daemon stop at :1423.
R6 now withholds ALL THREE. The fourth, rm -rf $SECRET at :1494, stays: $R/.secret is created at :295
and referenced at exactly those two lines, so nothing else reads it and there is nothing to race.
The existing marker/measurement gates on 1 and 3 are untouched — they answer "is there something to
stop", R6 answers "is someone else still acting", and a measurement taken mid-reconcile can read LIVE
or GONE for reasons that are not about this run.
PROOF OF COMPLETION, four conjuncts, presence of a file being none of them: the receipt exists; it
carries exactly one whole-line nonce: <this nonce>; it carries exactly one whole-line ^exit=[0-9]+$
(handoff_exit != 255, because an unread exit is not a zero one); and the leg's own setup-return.utc
is present and parseable by the calendar, with d2-t1-end.utc held to the same test where the rider was
requested. Anything else is UNPROVEN, and UNPROVEN is treated as outstanding — deliberately, because
a leg that finished without writing a terminal field is indistinguishable from one still running, and
being wrong that way costs a PENDING report while being wrong the other way is two elevated commands
mutating one rule store with no ordering between them. R6 reads once and never waits.

2. TIMEOUT IS NOT PROOF OF TERMINATION — new distinction 2 in section 6, and the "killed child = a
read; nothing to dispose" disposition in my A1 row is WITHDRAWN. timeout runs under msys, sends TERM
to the child it launched, and a native Windows child owes that no POSIX answer while its descendants
are in no job object the kill reaches. So bounded() now MEASURES what stopped — the registered pid
and its descendants re-queried after the escalation, recorded CONFIRMED_GONE / SURVIVING / UNREADABLE
with identities. Read-only describes what a command asks the host, not what its process does
afterwards. The 5s escalation is now inside the deadline accounting: every bound is
(deadline - now) - KILL_GRACE_S floored at 1, and a step that cannot cover the grace is not started.

3. A11 CANNOT COVER A14 — new section 4a. Its sample is taken at :2408 and A13/A14 spawn after it.
The :895 clause claiming a survivor is counted BY CONSTRUCTION via -IsolatedHome on the command line
is WITHDRAWN by me: a home string is not attribution, and this driver has already been burned by that
exact predicate (the r10 survivors ran daemon run --detached and daemon brain --generation 0, neither
carrying the home, which is why :1202's list is documented known-incomplete). Replacement: bounded()
registers each child AT LAUNCH — LAUNCHED role/pid/created/exe/cmd/parent, same schema and same
pid-plus-creation-instant comparison as the S9a IDENT rows — plus the descendants attributable at the
moment of expiry. R9 re-queries LAUNCHED and IDENT rows with one predicate; an unre-queryable row is
UNREADABLE, never CLEAR.

4. R10 COULD BE STARVED — reserved interval, in section 1 and across the R rows. WORK_DEADLINE =
REPORT_DEADLINE - LEDGER_RESERVE_S (30s) bounds every cleanup step; the last 30s belong to the ledger
alone. It is a policy allocation like the handoff cap, not an estimate. And the ledger emits WITHOUT
waiting for any child to terminate: an un-reaped child is written in as an OUTSTANDING identity,
which is a line to print, not a thing to wait on.

5. TIMEOUT MEANS COMPLETION UNVERIFIED, NOT ABSENCE — new distinction 3, and A13/A14/R1/R4 revised.
This is the exit-2 correction again in the timeout direction. A capture whose bound expired may have
written nothing, a partial document, or a complete one never read back. So:
CAPTURE_COMPLETION=UNVERIFIED (a statement about the observation), the artifact PRESERVED under a name
that says it is unverified, sized and hashed into the manifest under THAT name, inspected afterwards
rather than assumed. Nothing at the point's own path is deleted, overwritten or reused, and no absence
is claimed. Same for the D1 partial snapshot: preserved unread.

No implementation, no driver edit, no fixture run, no host query. Provisioning proposal next.