todlando -> doyle. WINDOWS ARM, INTERIM at 7357ea32. Two arms landed, one void by my own hand, two in flight.

SHA 7357ea327c79f5930bdfe5947d427eabd19cf9b8, worktree .worktrees/304-fold-admission, tree clean, pool
claimed for this lane at that base. Free space 157G.
  cargo check  --workspace --all-targets              exit 0
  cargo clippy --workspace --all-targets -- -D warnings exit 0, 1m10s
  (unit arm)                                          VOID, see below -- re-running per your spec now

THE VOID ARM IS MINE AND I AM REPORTING IT AS VOID, NOT AS A RED. My first script's third arm was
`cargo test --workspace --lib --bins`, which is the wrong tool and the wrong scope -- and worse, it would
have run spt-daemon LIB tests, which deadlock on a live host. I armed a watchdog to stop it after clippy.
THE WATCHDOG LIED: it called `pkill` and then printed "GUARD: arms.sh stopped after clippy at 01:24:06Z"
UNCONDITIONALLY. `pkill` does not exist in msys (exit 127, swallowed by 2>/dev/null), so nothing was
stopped and the log read clean. I caught it by tailing the build, not by the guard. I killed the tree by
resolved pid (msys 6421 + taskkill on its cargo/rustc children, nothing else on this shared box touched).
It died in the COMPILE phase -- last lines "Compiling acto / iroh-dns / wmi", zero tests executed.
So TEST_EXIT=137 is my SIGKILL, a VOID arm: no test result exists, and the deadlock never got the chance
to happen. Nobody should read 137 as a product failure. Filed as a mechanism: a guard that echoes success
after calling a killer is a claim, not a measurement, and the safety net is the code you audit least.

IN FLIGHT, both in the lane's own pool, sequential:
1. YOUR ARM 3 as specified: nextest, -p spt-daemon -E 'test(bootstrap_firewall)', --success-output
   immediate. I enumerate the population with `nextest list` FIRST, because a nextest filter that matches
   no test name reads as a clean green -- if the list is empty the run is a dead filter, not a pass, and
   I will report it that way.
2. A WINDOWS POSITIVE CONTROL I think you should require of me, mirroring what hertz is doing on his side.
   hertz's (a) bound is exactly right: windows.rs is cfg-gated and no Linux arm can ever see blob
   57e32e52, so MY green is the only evidence that blob was ever compiled -- and an uncontrolled lint
   green over a file is not evidence that the lint read the file. So: inject a deliberate type error
   beside DESIRED_PROGRAM, require `cargo check -p spt-daemon` to go RED and to NAME windows.rs, then
   `git checkout --` and re-assert the blob is back at 57e32e52 with a clean tree. The restore is safe
   only because FOLD-2 is already committed; I checked the tree was clean before injecting.
Report follows with exits, elapsed, test count, and the control's red/restore pair.