### 5643115673 SaberMage 2026-09-12T03:20:13Z
**W-2 field leg at `00c4dad9`, A2 → A3 → A3b → A5 → A4: the verify leg exceeds its budget at steady state with edition and privilege held constant; the requirement's non-sharing clause is unsatisfiable from a peer on a host that drops to closed ports; phase 2 held for want of a negative control (doyle, 2026-09-12 03:40Z).**

Continues comment 5642993884 (A0/A1/F). Same isolated home, head `spt.exe` EXE_SHA `1e29d549…5137`, blob `crates/spt-daemon/src/bootstrap_firewall/windows.rs` = `57e32e52` at both `00c4dad9` and the rider `4f3f370f` (rider touched `crates/xtask/src/main.rs` only). One hand per step: liam on every firewall write and every elevated run, todlando on every unelevated product run and every remote fetch, hertz on kitsubito only. Every arm bracketed by liam's census (`census.ps1`, pwsh 7 instrument, valid for box quietness across rows only; every per-cmdlet figure from it is withdrawn from product costing).

**A2 (todlando, unelevated bootstrap, pair present, box measured quiet on both sides).** 02:59:30.633→33.728Z, wall 3095 ms, exit 0; stderr in order `LAN_FIREWALL_ELEVATION_UNAVAILABLE` then `LAN_FIREWALL_UNVERIFIED: powershell.exe: firewall command timed out`. Bracket 573 ms / 523 ms (687 blocks each, pair present and unchanged both sides). Liam's contention prediction ("should NOT reproduce on an idle box with the same 2006 rules") is falsified on its second half; steady-state cost suffices. Neither party's enumeration magnitude (2316/1574 ms vs 1.0–1.7 s) is settled by one point.

**A3 (todlando, unelevated stop, pair present).** 03:02:24.722→26.964Z, wall 2242 ms, exit 0; stdout `LAN_BOOTSTRAP_DOWN`; stderr `LAN_FIREWALL_ELEVATION_UNAVAILABLE` then `LAN_FIREWALL_CLEANUP_UNVERIFIED: owned firewall resources remain; … Cleanup (elevated): powershell.exe … -EncodedCommand <~8 KB>`. Bracket 635 / 566 ms, pair unchanged (an unelevated stop removes nothing, correctly). Source (`crates/spt/src/serveverb.rs:376` `report_lan_cleanup`): `is_clean()` runs FIRST unelevated and the reason string "owned firewall resources remain" exists only on its `Ok(false)` arm, so this wall is the product's own cold `powershell.exe` 5.1 shape — spawn, NetSecurity import, `Named-Rules` on PersistentStore and ActiveStore, JSON — completing inside 2242 ms. Remote fetch 03:03:52Z: 000 / curl 28 / 6.002 s, recorded VOID BY CONSTRUCTION (the pair does not admit, per A1, so the packet never reached a stack that could refuse). Local controls: loopback and own-LAN address both curl 7 at ~2.03 s.

**A3b (liam re-adds hand rule `spt-w2-F` 03:05:04Z, listener DOWN; todlando fetch x3 03:06:41–53Z).** 000 / 28 / 6.002 s three times, state verified by both hands (F Enabled/Allow/Inbound/TCP 29470/192.168.1.0/24/Domain+Private; 29470 LISTEN rows 0). **Finding F-A3b-1:** the 2×2 on one box, one port, one peer is complete — F present + listener up 200 (02:52Z); F present + listener down 28; F absent + up 28; F absent + down 28. Only the bound-and-admitted cell answers. Mechanism named with its knob: Windows Firewall stealth mode (no RST for ports with no listener while the firewall is enabled); `Get-NetFirewallProfile` read-only on this box: `DisableStealthMode` NotConfigured on Domain/Private/Public, active profile Private, `Enabled` True ×3, `DefaultInboundAction` NotConfigured ×3. The field read is the evidence; NotConfigured = stealth on is Microsoft's documented default, not measured tonight, and no causal write was taken. Loopback and own-LAN bypass the filter, which is why the stack's refusal is visible from the host (7) and never from the peer. F deleted 03:10:32Z (F 0, pair 2, port-29470 rules 2).

**A5 (liam, ELEVATED bootstrap, pair present, listener down, bracketed 563 / 654 ms).** 03:12:14.264→24.378Z, wall 10102 ms, exit 0; stdout `LAN_BOOTSTRAP_UP … (port 29470)` + anchor; stderr one line `LAN_FIREWALL_UNVERIFIED: powershell.exe: firewall command timed out`. Firewall log 2097: `…-inbound-tcp` 03:12:21.208Z, `…-lan` 03:12:21.257Z (+6.94/+6.99 s), ModifyingApp WmiPrvSE.exe. Pre-registered prediction from source (the verify script has no elevation branch) confirmed on every clause. **Privilege is not the variable.**

**A4 (liam, ELEVATED stop, listener up, pair present, bracketed 546 / 671 ms).** 03:12:47.098→54.210Z, wall 7099 ms, exit 0; stdout `LAN_BOOTSTRAP_DOWN` then `LAN_FIREWALL_CLEAN: no bootstrap-owned firewall resource remains`; stderr EMPTY. Post-dump pair 0, port-29470 rules 0, hand rule and installed-exe controls intact, 687→685. Store and claim agree.

**F-A1-1 sharpened by direct A/B, edition and privilege constant:** bootstrap (verify = two full-store enumerations + 7 `Get-NetFirewall*Filter` calls per matched rule ×4 + JSON depth 6; `windows.rs:35-140`) times out at 3000 ms; stop (cleanup = `Remove-Owned` + two enumerations, no Describe; `:63-69`, `:144-150`) completes. Enumeration is client-side (`Get-NetFirewallRule -PolicyStore $store | Where-Object`, no `-Name`). Fix criterion: server-side `-Name` per owned name per store (not-found as a terminating error inside try/catch; `bootstrap_firewall.rs:346` forbids `-ErrorAction SilentlyContinue`), the filter walk budgeted or reduced, and the new verify's wall MEASURED on this store in the product's own edition (powershell.exe 5.1) before any budget number is chosen. A budget raise without that measurement is refused. **Firewall log (liam, read-only 03:14:57Z, population controlled 2011×48 / 2052×6 / 2097×6):** A5 creates 2052+2097 pairs at 03:12:21.147–.257Z; A4: a 2052 pair on the two owned names at 03:12:50.859/.893Z (+3.76/+3.79 s into a 7.10 s command); zero events between A5's end (24.378Z) and A4's start (47.098Z), a MEASURED gap: the 48 id-2011 events all fall 01:24:55–02:12:57Z (daemon-start class), the newest event of any id in the log is one of the six, and a 400-event re-read of the same window returns the identical six. Nothing commits after the client dies (A5's last event 3.12 s before its end). The log is direction-blind: 2052 fires on creates and deletes in the observed population, 2097 is create-specific, nothing observed is delete-specific; the census carries the sign (a rig keying "written"/"removed" on 2052 cannot fail in the direction it claims). **F-A5-1 (inferred; the product logs no invocation walls):** the reconcile WRITE invocation's duration is UNMEASURED and the same subtraction disagrees across instances — A5 (quiet, listener bring-up unsubtracted) ≈3.0 s, A1 (noisy, ALREADY_UP) ≈1.1 s, trailing verify kill 3.12 vs 3.11 s — against a 3.0 s hard kill. A kill between `Remove-Owned` and the second `New-NetFirewallRule` leaves a half-written pair, which the requirement's own text calls a broken admission, invisible to the product's next (timing-out) verify. Fix rider, in this order: (3) reconcile script safe under a kill at any point (correctness, margin-independent); (1) per-invocation wall+outcome logging; (2) the write shape measured in the product's edition on this store (A6c).

**Edition confound (liam, self-reported):** every warm figure tonight was pwsh 7; the product spawns `powershell.exe` (Windows PowerShell 5.1). Edition-correct numbers: todlando's `-Name` lookup 1371/1267/1281 ms, two-store enumeration 2316/1574 ms, A3 whole command 2242 ms (all 5.1, cold). A6 (post-restore, todlando): the is_clean shape (A3 blob decoded, `Remove-Owned` line removed) and the verify shape (OWNERSHIP+QUERY through `script()`), each ×2 cold `powershell.exe -EncodedCommand`, ×2 cold `pwsh`, ×2 warm 5.1.

**Requirement ruling (REQ-WEB-LAN-BOOTSTRAP-FIREWALL, `traceable-reqs.toml:7670`, clause "after the listener stops it must fail as STOPPED — two refusals that MUST NOT SHARE A FACE"):** not a product defect and no product change reaches it. Keyed to HOST POSTURE, not platform: a host that drops to closed ports (Windows with the firewall enabled and stealth at default; Linux under a default-deny policy) hides the distinction from a peer; a host that RSTs exposes it (kitsubito as postured: ufw inactive, nft/iptables INPUT policy accept; todlando 03:10:33Z HFENDULEAM→kitsubito:29471 no listener → curl 7 in 2.037 s, ssh:22 control connect 6 ms). The rig ESTABLISHES posture before trusting any STOPPED verdict: dial a known-closed port on the serving host; 7 = refusing posture, remote STOPPED admissible; 28 = dropping posture, STOPPED witnessed on the serving host (listener row absent + local refusal) and the census carries the admission state. Peer-side STOPPED on a dropping host is recorded, never interpreted. Amendment text to follow; hertz's `bootstrap_stopped_from_second_machine` (blob `49102e39`, budget 1 s→6 s, itself a predicate that would have minted "faces share" on a correct product) stays HELD and re-shapes after the text lands with the posture probe as its first step.

**Phase 2 HELD.** Kitsubito as postured has no failing state (port 22 reachable from HFENDULEAM with no rule); the product's Linux backend needs active ufw/firewalld or an existing inet nft input chain (`linux.rs:153-162`, `:242-244`), none present. An enforcing posture with a measured BLOCKED must precede the product's verb; enabling default-deny on the CI box is a shared-box posture change designed after restore, not tonight.

**The ~2 s:** Windows takes ~2.04 s to surface a connection refusal to any client (curl 8.21.0/Schannel and .NET TcpClient within 30 ms, in-process stopwatch, warm; live socket 0.2–5 ms same process) while a Linux caller learns the same closed port in 0.125 ms. Client-side path, failure-specific, cause unattributed; hertz's tcpdump arm (SYN retransmit on RST vs above-the-wire) post-restore on his word. The discriminator is the exit code, never a sub-second bound.

**Register lines:** `systemctl is-active ufw` = active while `ufw status` = inactive (service ≠ enforcement; Windows twin: `Enabled` True + `DefaultInboundAction` NotConfigured says nothing about a packet); IR-107 ninth instance (`cargo … | tail` over ssh, cargo off PATH in a non-login shell, exit 0); fourth dead-counter instance tonight (count predicate 0 with its negative control also 0); the 56 s census transient (rows +84 s and +142 s after hertz's 71 MB pull) stays a labelled hole with a decaying-transient reading over 18 rows; F-A3-1 (UX) the CLEANUP_UNVERIFIED remediation hands a human ~8 KB of opaque base64 to run elevated.

**Post-A4 fetch (todlando 03:13:43Z):** 000 / curl 28 / 6.002 s, BLOCKED as predicted with the pair gone.

**Restore by PATH (todlando 03:14:21–48Z), field state returned to D0 exactly.** Pre-control no `SPT_HOME`: `LAN_BOOTSTRAP_ALREADY_UP` at 5470. Population by path (never the launch line's pid): 2 = daemon 39320 (`daemon run --detached`) + brain 52464 (`daemon brain --generation 0`), both `…asm-304-w2\target\debug\spt.exe`. Daemon stopped first; the brain was already gone when reached — the supervisor reaps its brain on the way down, so brain-first would have opened a respawn window over a directory about to be deleted (ordering ruling now measured). Asm-path count 0 at 03:14:22.904Z and 0 at 03:14:25.004Z; installed-path processes 9 (positive control). Isolated home deleted (67.7 MB), verified absent. Post-control `ALREADY_UP` at 5470, 29470 LISTEN rows 0. Final census 03:14:48Z vs D0 02:13:37Z identical on every field: rules 685 = 685, group 0 = 0, port-29470 0 = 0, asm-exe 0/0 = 0/0, ctrl-5470 1 = 1, ctrl-installed-exe 3 = 3, DUMP_VALID True. Operator's hand rule and installed-exe rules intact and untouched.

**Standing after the leg:** (1) the product's LAN half does not admit on this box (four-point discrimination + one-column A/B: `LocalSubnet` drops where a literal `192.168.1.0/24` admits, F-A1-3; fix FOLD-3 = literal prefixes of connected IPv4 interfaces on todlando's lane); (2) the requirement's ADMITTED leg is undemonstrated by the product on Windows — the rig's admitted cell passed through liam's hand rule and is never cited for it; (3) F-A1-1 localised to the verify's filter walk with edition and privilege constant, fix criterion above; (4) non-sharing clause keyed to posture, amendment to follow, stopped cell held; (5) the ~2 s is the Windows client path. Owed: todlando A6 + verify rider (-Name, clause (c), per-invocation logging, kill-safe reconcile) + FOLD-3; liam A6c; hertz capture arm on his word, then the stopped cell re-shape after the amendment; doyle the REQ amendment, the phase-2 design, the W-2 gate record.