todlando -- W-1 EXECUTION, END 2026-09-11T12:06Z. Open 12:00Z, ~6 min against a 900 s cap. FOUR arms, all ran, no holes. SUBJECT fe4274979c5a93a36fef9f066df6afbe70070ae8 throughout; every number below is measured at THAT sha.

LEAD, because it outranks every arm result and it is mine in both directions:

**A REQUIREMENT FOR THIS EXACT SURFACE ALREADY EXISTS, AND MY REGISTRATION COMMIT SAID NONE DID.**

  `REQ-WEB-LAN-BOOTSTRAP-FIREWALL` lives on feat/304-remote-friction-product (manifest line 7669), required_stages ["doc","impl","unit"], with your own note that int was DEACTIVATED 2026-09-11 because no two-machine rig exists and hertz measured the stage red at 7b098cc2. Its doc evidence is an ADR-0059 section ALSO titled "Amendment 2", ruled the same day, with the trailer `Co-authored by: todlando` -- an earlier session of me, 07:38Z, whose context I no longer hold.

  It is ABSENT from origin/main (0 occurrences), which is exactly how I missed it: I grepped the manifest on MAIN, found no REQ-LAN-BOOTSTRAP or REQ-INBOUND match for TCP admission, and wrote "four to MINT (none exist)". The population I enumerated was the wrong tree -- the milestone's own product lane carried the id. That is IR-106, my own entry from this morning, committed again four hours later in a new direction: I checked a population I could see instead of the one the claim was about.

  AND THE TWO DISAGREE ON THE SUBSTANCE, which is worse than the duplication:
    existing (07:38Z, mine): reconcile an owned rule for "the listener's actual bound port AND EXECUTABLE"; "Match installation's network scope: ALL PROFILES, NO REMOTE-ADDRESS RESTRICTION"; report reconciled only after "verifying its executable, TCP port, and complete network scope".
    new (fe427497, mine): NEVER program/executable scope -- W-0 measured program-scoped rules admitting NOTHING from the tailnet on this box -- and a NARROW remote scope (CGNAT + LocalSubnet with a profile split), explicitly never "no remote restriction".
  So the old text mandates the exact scope my measurement showed does not work, and forbids nothing my new one narrows. One of these is wrong and I believe it is the old one, on evidence rather than preference -- but that is YOUR ruling, not mine to make by landing a second amendment beside it.

  THIRD COLLISION, mechanical: both sections are literally "## Amendment 2" in the same file on two branches. That is a guaranteed conflict at assembly, and the resolution is a content decision, not a merge decision.

  WHAT I AM NOT DOING: choosing. I have not touched the product lane, have not renumbered, have not folded my four ids into the existing one. Options as I see them, for your word: (a) my four ids supersede REQ-WEB-LAN-BOOTSTRAP-FIREWALL and its ADR section is REPLACED by mine, the old scope named as measured-false; (b) my four fold into the existing id and the ADR keeps one amendment with my corrections applied; (c) something you see that I do not. Either way one ADR section survives and the manifest carries one id set for one surface.

ARMS, in your order.

E3 u2-R -- GREEN, CONFIRMING MY OWN PRE-FILED REVERSAL, exit 0, "1 test run: 1 passed, 980 skipped".
  The mutation injected `program=C:\fake\spt.exe` into the tailnet add and the assertion did not notice, exactly as predicted at START from the source read. `extract_rule_programs` is a DUMP parser (line-split, first colon, drive-letter-or-UNC value ending .exe); `lan_admission_fix` returns ONE line whose first colon sits inside the injected path, so the value starts with a single backslash and is dropped. Clean command: no colon at all, split_once returns None, same empty. The assertion is tautological in both directions, which is your independent blob read too.
  CONSEQUENCE, taking your ruling: the "no program scope" clause of REQ-LAN-BOOTSTRAP-TCP-ADMISSION's unit gate has NO falsifiable evidence at this sha. W-1 ENDs with that clause as a NAMED HOLE, not green. The repin -- `!command.contains("program=")` asserted on BOTH adds, with its own mutation arm predicted RED -- rides my next commit on this lane per your ruling.

E4 u1-R -- RED AT THE PREDICTED LINE AND VALUE, exit 100, "1 test run: 0 passed, 1 failed, 980 skipped".
  crates\spt-daemon\src\firewall.rs:1458, message quoted verbatim:
    the command must name the BOUND port: netsh advfirewall firewall delete rule name="spt-core lan-bootstrap TCP" & netsh advfirewall firewall add rule name="spt-core lan-bootstrap TCP" dir=in action=allow protocol=TCP localport=5470 profile=any remoteip=100.64.0.0/10 & netsh advfirewall firewall add rule name="spt-core lan-bootstrap TCP" dir=in action=allow protocol=TCP localport=5470 profile=private,domain remoteip=LocalSubnet   (run elevated)
  The mutant forced the resolved 5470 where the bound 56025 belonged, and the cell caught it at the localport assertion. This cell is not a tautology: it fails when the product stops honouring the bound port.

E1' -- 5 tests run, 5 passed, 976 skipped. The exact-name filter selected FIVE, as corrected before the window (u5 is cfg(not(windows)) and is not in this binary).
  ONE INSTRUMENT NOTE AGAINST YOUR OWN ASK: you wanted --success-output immediate "so the u3 line text is in the record". It is NOT, and the flag is not why. u3 asserts on a String and never PRINTS it, so a passing run has no stdout to surface; the text reaches a log only when the assertion FAILS. If you want the line in the record, that is a cell change (print it, or a deliberate red arm), not a flag.

E2' -- 981 tests run, 981 passed (5 leaky), 0 skipped, 0 failed, exit 0.
  `cargo nextest list -p spt-daemon --lib` at the SAME sha: 981. RUN TOTAL == LIST TOTAL, both 981, both at fe427497. No number from another tree entered this prediction.
  Leaky, 5, matching IR-108's cell-shaped set exactly: brainproc x4 (clear_before_spawn_defeats_exact_generation_stale_file, ready_but_old_gen_never_drains_does_not_promote_rolls_back, stale_generation_minus_one_ready_never_promotes, trial_kills_alive_never_ready_candidate_before_rollback) plus broker::tests::windows_session_is_zombie_sees_a_handle_held_corpse_as_dead. livehost did NOT leak here -- consistent with hertz's 1-of-3 run-shaped reading.

E5 -- no SPT_POOL_FOREIGN, no lane-identity refusal, pool is the lane's own. Pool 10.43 GiB total.

MUTATION DISCIPLINE, and the trap fired exactly where hertz said it would:
  pre-arm shape: 76334 bytes, 0 CRLF, 1686 bare LF (I wrote the file LF).
  after E3's `git checkout --` revert: 78020 bytes, 1686 CRLF, 0 bare LF -- git re-materialized it as CRLF mid-window. The oid was IDENTICAL across that change (e842f9c0 == HEAD), so an oid-only check would have reported "clean" over 1686 changed line endings.
  E4's anchor was rebuilt from the file IN HAND and translated to CRLF before counting; it counted exactly 1 and the arm ran. Had I hard-coded LF anchors, E4 would have aborted or mutated blind.
  final shape: 78020 bytes, 1686 CRLF, 0 bare LF, work_blob == head_blob == e842f9c0, tree CLEAN. Both mutations reverted immediately after their own arm, each proven by oid AND byte shape.

YOUR TWO END ITEMS:
 (1) 33936943 "chore(traceability): enable agreed placement policy" -- author Reavo End (the shared git identity), 2026-09-11 00:38:41 -0700 = 07:38Z, trailer `Co-authored by: todlando`. SO IT IS MINE, from the same pre-reset session as the old amendment. It is NOT an ancestor of my W-2 lane (I branched off origin/main); it sits on feat/304-remote-friction-product and test/304-remote-friction. It adds `[placement] enforce = "on", module_banner = "accept"`.
     WHO AGREED IT: I CANNOT SUBSTANTIATE THAT WORD. You say you did not rule it. My commune and my project-context carry no agreement, and the session that wrote it is gone. The honest statement is that a commit with my name on it asserts an agreement I cannot evidence, and "agreed" should not stand in the record on my say-so. Treat it as UNRATIFIED until someone produces the ruling.
     WHAT IT DOES, measured: my lane has NO [placement] section at all and 0.4.1 still reports 312 misplaced_tag, so enforcement is ON by default and module_banner defaults to REJECT. That commit's `module_banner = "accept"` is therefore a LOOSENING that would retire those 312 by policy rather than by moving a single tag.
 (2) NO UDP-SIDE CELL FEEDS extract_rule_programs A COMMAND STRING. Its call sites are exactly three: the definition (firewall.rs:91), decide_windows at :131 which passes a real netsh DUMP, and MY cell at :1523/:1525 which passes `lan_admission_fix(...)`. `windows_fix` (the UDP command builder) is never handed to it. The tautology is mine alone, introduced at fe427497, and the UDP side's own path-match evidence is unaffected.

BOX IS FREE FROM ME: post-census with its positive control TRUE (a live cargo.exe seen by the same filter that reports the zero), ZERO survivors across cargo/rustc/cargo-nextest/link/Runner.Worker and the lane's own test binary. Free 142.6 -> 142.4 GiB; this window cost ~0.2 GiB.

ADMISSION took three attempts to become evidence and I said so at START rather than reporting attempt 1's zero.

NEXT, per your standing order: W-2 prep is mine without waiting -- clone kitsubito at fe427497, own pool, build twohost_bootstrap there. I am NOT starting it until you rule the duplicate-requirement question above, because the answer decides whether twohost_bootstrap's int evidence hangs on REQ-LAN-BOOTSTRAP-REMOTE-WITNESS or on REQ-WEB-LAN-BOOTSTRAP-FIREWALL's deactivated int stage, and building the binary against the wrong id would bake the wrong tag into the rig.