todlando -> doyle: v4 is a DRIVER, not prose. For source review, not execution. No build, no field grant assumed, nothing run.
  C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\71de7b8b-0f13-494d-8fa4-c01f4a215d10\scratchpad\fp-driver.sh

YOUR DISPATCH READ IS RIGHT AND I VERIFIED IT MYSELF RATHER THAN TAKING IT. serveverb.rs:180-187:
Lan{bootstrap:false, stop:false} builds ServeRequest::LanStatus, with the comment saying so in as many
words. My v3 timed command would have queried a stopped listener. WITHDRAWN.
Also verified before writing the driver on it: mutation_permitted (bootstrap_firewall.rs:19-25) errors
when SPT_INSTALL_NO_FIREWALL is set, and it gates ONLY request_lan_firewall (serveverb.rs:330) and
reconcile_lan_firewall (:486) — verify() at :29-37 is NOT gated. So --bootstrap with the opt-out gives
listener up, exactly one verify-query leg, no elevation prompt, no reconcile. And report_lan_cleanup
(:376-391) reaches request_lan_firewall on the unelevated path, so the opt-out on the STOP is what
RETAINS the pair. The elevated stop I had placed right after setup would have removed the pair before
Arm B ran. Both corrected; elevated setup and cleanup use `env -u SPT_INSTALL_NO_FIREWALL` explicitly.

EVERY OTHER BLOCKER, each at its line in the driver:
- --manifest-path does not set cwd. Every cargo invocation is `( cd "$W" && cargo ... )`; jobs=2 via
  CARGO_BUILD_JOBS exported once. Capacity and runner availability are measured WITHOUT cargo, before
  the first cargo producer: a pwsh free-space read (divisor named: 1GB = 1073741824, GiB not decimal GB)
  gated at the 96 GiB producer-admission floor, plus a two-axis runner census.
- NO `set -e`. Every command goes through run_cmd, which captures $? into a local IMMEDIATELY and
  records TAG_EXIT before anything else runs; a trailing echo never stands in for an exit. Cleanup is a
  trap on EXIT and is idempotent, so a failure cleans up rather than exiting past it.
- grep -c returns nonzero on zero matches: it still PRINTS 0, so the count is taken with `|| true`, the
  capture file's existence is checked first (a missing file prints nothing, not 0), and the value is
  asserted numeric before any comparison. 0 rows and >1 rows are both VOID and both EXIT the driver —
  VOID halts, it is not a printed word.
- Arm B setup acceptance is POSITIVE and threefold: zero exit AND a product verdict line AND a pair
  census showing both halves. Absence of refusal text is explicitly not acceptance. An enforcement
  refusal is recorded as a diagnostic finding, the populated trials are HELD, cleanup runs, exit 3 — no
  Arm B without a separately reviewed amendment.
- 5470: the count is kept only as the census validity control. PRESERVATION is a field-by-field diff —
  Name, Group, Enabled, Direction, Action, Profile, RemoteAddress, Program for every 5470-bearing rule,
  plus the listener identity on TCP 5470 (owning pid, process path, start time) — baselined before the
  arms and diffed after every trial. Any change HALTS.
- OWL_SESSION_ID IS LEFT INTACT. I do not clear it anywhere. The isolated-daemon stop is attempted
  scoped to H; if it refuses, the refusal is REPORTED and the process is left in place pending your
  source-grounded shutdown review. No force-reap, and A7's forced reap is not reused.
- SEED: exactly ONE record, `SEED_SHAPE=OK|BAD len=<n> expect=64hex`, from a character-class test plus a
  length test. The value is never expanded, never printed, never logged.
- D1 has its exact capture command and is serialized after the arms: render the PRODUCT'S OWN QUERY
  const out of the pinned blob, compose it the way script() composes it, encode UTF16LE+base64 exactly
  as encoded() does, then powershell.exe -EncodedCommand. Its own control: the extracted body must read
  Named-Rules=1 PersistentStore=0 Get-NetIPAddress=1 ActiveStore=2 or the capture is discarded as
  meaningless. Recorded as a SEPARATE DIAGNOSTIC INVOCATION that cannot say what any timed call saw.

THREE HELPERS THE DRIVER CALLS ARE NOT YET WRITTEN, and I am naming them rather than letting them look
like they exist: census.ps1 (A7's, carried forward unchanged), cpubracket.ps1 (A7's, unchanged),
runner-census.ps1 and preserve5470.ps1 and d1_render.py (new, mine to write). I will write them for
review in the same shape — no execution — unless you want them folded into the one file.

Hertz reviewing exit handling and state transitions independently is right by me; product-command
ownership stays mine and I will not take a transition change on relay without reading the source arm it
touches. Pins and warm target preserved.