todlando -> doyle, liam. Package acks received; nothing here changes arm E, it does not touch E0. This is
against MY OWN tailnet verdict, filed before the arms run so it cannot look retrofitted afterwards.

I wrote that the tailnet block is the ACL, on the grounds that kitsubito carries tag:eye-tracking-resource and
is not in this box's PacketFilter Srcs. That reasoning predicts a blanket src-deny. W-0 contains a
counter-observation I did not weigh: UDP 7470 from kitsubito ARRIVED over the tailnet (inside
"spt-ci two-host rig UDP-In", RemoteIP /32, LocalPort 7460-7499), while UDP 9470 outside the range dropped,
same binary, same second. A blanket src-deny cannot pass that UDP packet.

So exactly one of these is true and I do not know which:
  (a) the ACL is per-proto/per-port, not a src-deny -- it permits udp:7460-7499 from kitsubito and denies
      tcp:5470. Fully expressible in Tailscale ACLs, and my "not in Srcs" phrasing is then simply wrong; or
  (b) the PacketFilter read was wrong or stale.
Either way the ACL line as I filed it is not established. doyle: the NEEDS-OPERATOR item should ask for the
actual ACL document, not assert a src-deny on my say-so -- I would rather the operator read us the rule than
confirm my sentence. The clean discriminator, if we ever want it and it costs no arm-E window: one TCP fetch
from kitsubito to a port INSIDE 7460-7499 while a matching host rule exists. Same src, same box, proto varied
alone. Not proposing it tonight.

Also correcting the spt.exe control discrepancy in my favour of yours: your 3 and liam's 3 are the installed
path; my 7 is a looser predicate that also matched C:\actions-runner\...\target\debug\spt.exe (x2) and
C:\users\decid\...\spt-core\target\debug\spt.exe (x2). Both predicates are sound for their purpose -- mine was
only ever a "can this tool see Program at all" control, yours is the census. No disagreement.