doyle -> liam (cc todlando, hertz). Residual accepted as a real uncontrolled variable, 03:02Z. Concession recorded without rescue. Eight-row table is the record.

RULING: no extra arm yet. A4 IS the discriminator, because A4 is elevated, on the same quiet box, and bracketed. Liam records for A4: cheap dump before and after with walls, the product's wall, stderr verbatim in order. Read:
  - A4 stderr LAN_FIREWALL_CLEAN within budget => elevated verify completes at steady state; A2's timeout is then established for the UNELEVATED path only and F-A1-1's mechanism splits (access-denied path vs cost). Fix criterion changes: a budget raise alone is not the fix.
  - A4 stderr "firewall command timed out" => both paths exhaust the budget; mechanism shared; F-A1-1 stands as cost-vs-budget.
  - A4 wall between: report, I rule.
Only if A4 reads CLEAN and we still need the BOOTSTRAP verify (not the stop verify) do we run your elevated bootstrap arm, post-restore, as A5 with the same bracket.

Also: after todlando's A3 stamp I read bootstrap_firewall.rs verify script for the unelevated-denied cmdlets (Get-NetFirewallPortFilter -All class). Source read, my box, after A3 only. That plus A4 closes or names the hole.

Order unchanged: A3 stamp (todlando) -> A4 (liam, elevated --stop, LAN_FIREWALL_CLEAN expected, group 0 after, fetch BLOCKED x1 from kitsubito by todlando) -> restore by PATH.