hertz -> doyle: W7 (#336) rig RED on main, 2/2 runs. Branch hertz/w7-336-rig @d250c7f3 (LOCAL on hfenduleam only, not pushed). File crates/spt/tests/auto_apply_e2e.rs.

SHAPE: two real daemons, peer_rig signer/bundle fixtures. B = DEFAULT update config (only relay:disabled + existing update_check_period_ms:1000), pump ON; A pump off. No W7 config key, class spelling or log text encoded. Observables that exist today: ReleaseCache staged/applied (== update status --json, CLI cross-checked at end), brain.ready exe_hash, adapter registry, undismissed notifs under NOTIF_KEY_UPDATE_STAGED. Artifact = built spt + tag bytes (brain_survive trick) so it RUNS and its hash names the set.
Arm 1: BrainOnly v11 + bundle(1 mock adapter) staged on A -> B's pump stages it, no verb -> wait exe_hash==v11 sha && applied>=11 -> adapter registered. Arm 2: BrokerBreaking v12 (resource ABI +1, still a runnable artifact so a WRONG apply would flip the hash) -> staged + notif, then 15 s settle, exe_hash/applied unchanged.

RESULT (kitsubito): precondition PASS (boot exe_hash == B's own binary). Positive control PASS: B staged v11 FROM A via its pump (UPDATE_STAGED:11:BrainOnly + UPDATE_BUNDLE_STAGED:11). Gate RED: 120 s later staged=11 applied=None last_outcome=staged, brain pid+hash unchanged. Notif detector controlled on main: notifs=1 in the red state (the gated default posts it). Arm 2 is not reached on main.

FINDINGS:
1. Stage latency comes from the artifact bytes, not the pump: the debug Linux spt is 460,067,952 B, and its pull held one stream 82.7 s (~5.6 MB/s over loopback QUIC). Stage took 72.2 s idle and 119.4 s at load 9 / 3 writers. The old 120 s bound would have false-redded run 3 at the STAGE wait. Stage waits now use a rig-owned ARTIFACT_WAIT of 600 s, sized to those bytes.
2. The apply wait is still 120 s. The brain boot exe-hash alone took 10 s, so if the green-side swap re-hashes 460 MB under load it may want the same treatment. Flagging it, not changing it blind.
3. The adapters-leg ORDER (post-swap) is not asserted, only that the leg lands. Proving the order without log text needs a product surface. That is the W7 impl's call.
4. No REQ is tagged: W7's seed is not minted. The test cannot land red on main; suggest it rides the W7 impl lane (or lands #[ignore]d, your call).

TEARDOWN: rig worktree+branch reaped. IR-150: apparent 6,737,253,822 / allocated 6,760,067,072 / escaped 0 FORCED (330 files @ nlink 2). Reclaimed 6,761,062,400, gap +995,328 B (+0.0147%), inside the pre-registered +/-0.1%. Write census: 19 writers at load 71.45 at reap start (not mine, unidentified), 2 during the rm window, so the delta is ambiguous at the MB scale. hertz holds 0 worktrees and 0 pools on kitsubito. Records: .spt/preserved/331/hertz/w7-336-rig/ (runs 2+3, full test log, reap log).