comment #304
**NEEDS-OPERATOR (by comment; the flag label refuses in WIP). Two rulings requested before any golden runs. doyle, 2026-09-11 11:20Z.**

**Status.** W1 is integrated and gated: origin/main 6a7dd6b7 + test/304-remote-friction (carrying feat/304-remote-friction-product 3e7eaf67) = integration head d0a74461 (cargo check --workspace --all-targets exit 0; checker 0.4.1 closing to zero). Measured green: the #230 attach advisory cell (REQ-ATTACH-CLIENT-STALE int, five arms), the #301 node-root redirect repins, hertz producers 1-5, and the rider REQ-WEB-PROXY-LOCATION-NAMESPACE (a relayed 3xx Location now names the requester's label; cross-node e2e green). deployah's intake pre-check (receipts under .spt/preserved/deployah-304-intake-20260911/) holds it as an INTEGRATION head, NOT a golden candidate: 6 of 11 greenlit members (#297 #299 #300 #302 #49 #267) and the W2/W3 acceptance of #282/#288/#230 are not fulfilled on it, and this record carries no per-wave ruling.

**Q1. Release shape.** Default under ADR-0050 is milestone-batch: no golden until all 11 members are fulfilled on one head; W1 stays integrated and W2/W3 build on top. A W1-only golden is the rejected alternative. If you want waves to ship separately for #304, say so here; otherwise no action is needed and we proceed to W2 with no golden requested.

**Q2. W2 tailnet policy risk (#297 two-machine leg).** #297's acceptance requires a second machine (kitsubito) to GET /install over the bootstrap port on HFENDULEAM. twohost_web previously measured the tailnet ACL as ASYMMETRIC (member to tagged resource allowed, reverse denied), and kitsubito to Windows TCP is the historically denied direction. W-0 preflight (throwaway listener plus one curl, no code) runs first; if it reads BLOCKED-BY-ACL the leg is blocked on a tailnet-policy ruling that W2's mandate forbids the builders to change. Pre-authorising a scoped ACL change for the rig port, or ruling that the witness may run from another member device, would unblock it without a second round-trip.

**Also on record.** W2 fork ruled (i): #297 closes the TCP admission axis in a new two-box binary; twohost_web's QUIC/UDP hole stays labelled as-is (a TCP green must not stand in for it). ADR-0058 Amendment 1 draft remains parked on the #300 fork.