## Summary

Repin the Windows refresh-freeze rig to the bounded-recovery contract in REQ-DAEMON-REFRESH / REQ-HAZARD-INPUT-ACK-BACKPRESSURE. The golden 35299506382 failure was an isolated 2016ms ACK after recovery, not a frozen stream.

- Keep the 2000ms ACK/state and 15000ms recovery bounds unchanged.
- Anchor recovery at the first timely candidate; require all post-refresh tags complete, at least 90% timely from that candidate, no three consecutive misses, and startup backlog completed within the recovery deadline.
- Add six deterministic policy checks and their Rust test entrypoint; document the sparse-periodic-stall ceiling covered separately by #302's field gate.
- Three test/support files only; no product changes. KNOWN-HAZARDS §7.19 remains accurate and unchanged.

Head: `0ab1e48b7c4cf4c16e0e46c14b415ff28bbc8f5c`, based on `712c987f086f0f3564d139e8ff3775ce0bbd8ec2`.
Related release tracking: https://github.com/BigscreenVR/spt-bs-releases/issues/307

## Author proof

Manifest: `.spt/preserved/307/ack-jitter-repin/DELIVERY.json`
SHA256: `90cff3888726ae9f1d2d406bc70569a0b2c432d23b27ca588c66e9b703b85e6f`

- Replay matrix **10/10** expected outcomes: golden PASS, four prior positives PASS, five evaluated negatives remain REGRESSION. The additional startup-only PRECONDITION/cleanup failure remains separately preserved, not counted as a regression replay.
- Live Windows cell **PASS**: recovery 4063ms; all 23 post tags complete; 21/22 timely after first recovery; longest miss run 1; zero replacement poison; two detach-only closures.
- Native teardown **CONFIRMED_GONE**, zero active processes; nextest and guarded wrapper exit 0. Deterministic Python checks **6/6**.
- Targeted clippy exit 0; traceable-reqs **926/926 complete, zero findings**; changed-file rustfmt passed. The unrelated workspace-format differences/timeout remain recorded, with no unrelated edits; workspace formatting is not the project's gate.
- The two-line ceiling comment was present during the live cell/checks and committed afterward; all 964 recorded source-map entries match the final tree byte-for-byte.
- Census, resource admission, pool claim/release and original receipts are retained under the same proof root.

Key receipts: `replay-final.json`, `live-rig/observation/receipt.json`, `live-rig/native.json`, `checks/receipt.json`, `pool-release/receipt.json`.
Live receipt SHA256: `13d700bf09279f241119a184e9c14d2457f2f7892aa5a0f3fea172c9278edb09`.

## Independent second producer — Doyle PASS

Gate directory: `.spt/preserved/307/gate-307-0ab1e48b/`
Ruling: Doyle `FIGIBR7X`, same head `0ab1e48b`.

- Isolated worktree, sequential pool takeover; golden environment block and Python312 pin, perch identity scrubbed (`env-scrub-check.txt`).
- Pool claim, build and Python precheck exit 0.
- `refresh_freeze` **2/2 PASS**: policy wrapper 0.609s; live cell 80.892s.
- Traceability and pool release exit 0; census clear before/after.
- `attempt1-pool-refusal/` preserves the original unhatched `SPT_POOL_FOREIGN` refusal as rig/admission evidence, not a product red or a passing attempt.

Doyle owns fast-forward merge after thin CI 5/5. Tested head must equal merged head; no merge or release action requested here.

Co-authored by: hertz