Duoh, smacks forehead. My JTAG comment is wrong too. Only SPIEN and BOOTRST are on. Off is on and on is off. Yeah, that’s easy.
It’s what one gets for an over-reliance on the fuse selection toggles in the device programming panel of AS7... next time I’ll consult the fuse calculator, thank you very much.