Inspected clean DATA/scratch/console-access-acceptance at a74ab66bae81197d8f7a22f61ccba1a686b7a79e and frozen product 8fb6f413179b094288316e25845c137440ba23fa in candidate checkout A. DATA is /run/media/kmosoti/data/FabricO11y. Root reports native clock binding and nine clock controls exited0; these are not packaged browser qualification. Fenn ran no project code/imports/tests/browser/compiler and changed no repository source.

1. Fix a concrete lifecycle prerequisite first. live_browser_check.py:1238–1254 skips a private group when its leader exited, and KILLs only when waiting for the leader times out; it then removes scratch and declares groups stopped without descendant proof. Register literal success/timeout/leader-exited TERM-resistant child controls before the smallest correction: stop every owned group, confirm absence, preserve diagnostics and retain scratch if cleanup is unconfirmed. Default ConsoleBridge.close:466–491 has no subgroup-empty proof when no subgroup is supplied; it is not a verified shortcut.

2. Admit exact package inputs, then reuse the role cell. Require fresh #40 inspection/provenance/payloads, fresh #41 on those hashes, clean merged harness full SHA/path, console source/build receipt, extracted binaries/assets, actual browser/driver/NSS identities and SHA-bound root driver. The live CLI accepts paths, not package receipts/full candidate SHA (:118–122,152–171); the driver must bind those. Snapshot/asset checks exist (:398–434; stage_console.py:35–47). Reuse browser-command-plan.md:34–38, separately adding --browser chrome --role-matrix and --browser firefox --role-matrix, fresh labels. Real production serve, WebAuthn/resident inventory and 144 exact dispatches are implemented (live_browser_check:466,549–600,926–951). Matrix mode cannot combine polling/pressure/cursor/recovery/shell flags; its early return does not credit those later workflows. Preserve separate baseline/recovery, Chrome installed-PWA, cursor, pressure, polling and named defect cells.

3. Extend the existing clock controller narrowly for genuine sessions. SessionClock.argv:87–88 is probe-only interactive; the live fixture never calls check_sessions. Native success removes helper/probe staging (session_clock.py:236–246), so freeze the actual new helper and package ELF before launch, inspect its interpreter/dynamic clock_gettime import and record actual loader/libc/build identities. Reuse freeze_images/process_binding:34–59 for server PID/start ticks/cgroup/executable/helper dev/inode/hash/maps. Bind REALTIME ledger calls to serialized550ms request windows/sequence; independently witness ordinary controller/browser/driver/Spindle clocks and absent helper/FD/config inheritance. Every admitted realtime/monotonic/raw call counts against the unchanged1MiB ledger (session_clock.c:71–92); Tokio traffic/lock contention must actually fit, not be truncated or silently broadened.

Use actual resident/UV-issued A/B from no-prior-cookie login contexts, with secret cookies only in bounded memory. Public expiry binds issuance=expiry−28800; derive last-success from actual server calls. Every authenticated GET refreshes memory-only seen (candidate access.rs:762–807,1234–1240); disable polling and automatic step-up, and do not use ConsoleBridge.request's extra session GET (:350–365) for untouched B. Observe A last-success+1799, untouched B+1800, C's28 keepalives at issuance+1000k, then+28799/+28800, exact200/401 sign in required, immutable expiry/hashes/prior-seen/server-call seconds; explicit UI Check session must lock/clear memory while browser Date remains ordinary. Keep forward-only offsets, ambiguous reads inconclusive, TLS validity and no future-state reuse.

Resolve a registration ambiguity before implementation: clock protocol111 requires C in a separate disposable state, while session_clock_oracle.py:59–75 requires every A/B/C row share one target PID. A separate server cannot satisfy that. Clarify the state boundary; if separate servers are intended, register explicit per-fixture PID expectations and wrong-PID controls in a trust-only commit. Never rewrite genuine rows or quietly combine states.

4. Real reader TTL needs a separate ordinary-time cell. Normal token600 exceeds inner240s; cursor token1800 waits902s and must remain valid (live_browser_check:913,998–1005). Existing rotation/revocation (1008–1023) does not establish expiry. Actually issue a short reader, prove pre-expiry200, wait on real monotonic time past server-supplied expiry, require exact401 plus adjacent long-reader/owner200. A later request is not an in-flight race. Register missing/wrong-token/status/error checker controls. The current negative grader handles only cache/nonresident (check-browser-defect.py:10–26).

5. Orca requires an isolated executable supplement. DOM roles/skip link (live_browser_check:847–855) do not establish U5 announcements (operator-console.md:170). Follow browser-gap-closure-plan.md:57–65: finite private Firefox/AT-SPI/Orca tooling probe, private DBus/accessibility bus, actual initialized backend plus speech text and fixture PID/document binding. Headless export/focus is unverified; preserve that environment outcome and admit pinned private display tooling if necessary. No owner display/session. Begin speech observation after setup/one-time secrets leave the DOM. Witness packaged busy/completed, error and lock/logout changes with focus elsewhere; register missing-utterance and genuine live-region suppression controls reaching the announcement assertion. Debug SPEECH OUTPUT alone does not prove backend/listener/acoustic conformance.

Production URL/trust already uses https://localhost:<port>/console/ (live_browser_check:466,552). Firefox trusts an owned NSS CA, acceptInsecureCerts=false (499–505,524–531); Chrome's exact SPKI allowlist is labeled controlled fixture trust (518–521), not operator OS trust installation. browser_check.py:79,131–143 serves HTTP/demo and cannot replace this. browser_producer.py:37–45 produces independent OTLP canaries, not credentials. Completed ceremony replay/signed wrong-origin/RP/UV/fixation, legacy migration/old-format refusal and remaining U2 error cells still need the registered supplements in browser-gap-closure-plan.md:11–20; native tests do not complete package cells.

Prospective order: separate trust controls → root actual red → minimal correction → unchanged green → exact artifact/harness/tool/driver preflight and second key → fresh41 → serial package cells → immutable C1–C8/U1–U6 wiki record. Every eventual tool/project/validator cell uses the SHA-bound launcher: outer1800s/no swap, combined browser3.5GB high/4GB max/CPU200%/Tasks512, fixture512MiB, full1GiB reservation and fresh complete namespace census. Keep inner240s or existing cursor1200s; clock/TTL/Orca should be separate finite cells. Overrun is preserved failure, not permission for hidden limit changes/retries. Read#59 before/after, preserve raw failures and require outer stopped receipts and confirmed secret/process/scratch cleanup. No acceptance from probe/controls alone.