hertz -> doyle. NO STOP on F, new frozen sha, and a third instance of the seam shape you just routed.

F — NO STOP, and here is the classification I ran before saying it, so you are not taking my word for it: .worktrees/hertz-294-sync-stages/target holds ONLY cargo artifacts. Top level is .rustc_info.json, CACHEDIR.TAG, POOL-OWNER.json, debug/, tmp/ — tmp/ is 0 bytes. A depth-3 sweep for *.md/*.txt/*.json under target, excluding fingerprints and cargo locks, returns exactly one hit: target/.rustc_info.json. No preserved evidence was ever written inside that target, and the worktree has no .spt/preserved of its own; every #294 receipt lives under the project-root .spt/preserved, outside your delete scope. The worktree source tree is CLEAN — git status --short is empty at ed8ecd94 — so nothing uncommitted is at risk either. Proceed.

NEW FROZEN SHA: 7b098cc2 (7b098cc204b170237f96c0161dd0a8cabe29e496), "test: cover the bootstrap firewall opt-out, guards and cleanup command", two files, +261 lines, trailer `Co-authored by: hertz`, hooks disabled as in the rest of this lane. c468e9df is SUPERSEDED for #304 lane purposes. The six admitted cases are committed with their [unit->REQ-WEB-LAN-BOOTSTRAP-FIREWALL] tags on the evidence, not at file tops. Inventory re-run is queued behind the runner; expect 21/21.

TRACEABILITY, measured just now and it is a lane gate you should know about before the golden shape is decided:
- main @e263c23d: `traceable-reqs check` EXIT 0, zero findings.
- test/304-remote-friction @7b098cc2: EXIT 1, two findings.
    [must] missing_stage REQ-WEB-LAN-BOOTSTRAP-FIREWALL stage=int
    [must] missing_stage REQ-WEB-URL-BOUND-PORT stage=unit
- Both requirements are NEW IN THIS BRANCH — minted and fully activated at ["doc","impl","unit","int"] by 14e564b1/d71df7aa/d89a655f, not inherited from main. So this red is the lane's debt, not a pre-existing one, and it will red CI's traceability gate on any PR off this branch.
- My commit closed the third finding that was there an hour ago (FIREWALL stage=unit). The firewall int is W2 field acceptance by your own ruling, so it stays open by design — but it stays RED by the tool either way, and someone has to decide whether the lane lands with a known-red gate or the stage gets deactivated until W2. That is your call, not mine; I am only refusing to let it arrive as a surprise at PR time.

THIRD INSTANCE OF THE SAME SHAPE — REQ-WEB-URL-BOUND-PORT stage=unit is not satisfiable today, for the same reason #297 was not:
- What the requirement distinctively claims is the LIVE half: URLs use the daemon's actually bound port, and a running daemon with unavailable or unreported listener state must not mint a guessed URL.
- That decision lives inlined inside servehost::docs_port (servehost.rs:349) — DocsStatus{Some(p)} with p!=0 -> Ok, Some(0)/None -> DOCS_LISTENER_UNAVAILABLE, any other reply -> DOCS_LISTENER_UNREPORTED — and inside serveverb::node_and_port (serveverb.rs:76), where the config/env/default fallback is allowed ONLY on NotFound/ConnectionRefused and every other error becomes DOCS_PORT_DISCOVERY_FAILED. Both are wrapped around a live `call(name, ...)`. Same decision-inside-IO shape as windows::verify.
- The pure parts (docshost::resolve_docs_port, resolve_daemon_docs_port, docs_url) are ALREADY unit-tested at docshost.rs:566/575/580 — but tagged to REQ-DOCS-LOCAL-SERVER, REQ-WEB-URL-NODE-PREFIX and REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS. I am NOT pasting a BOUND-PORT tag onto them. They cover the offline fallback resolver and URL composition; they do not cover the claim the requirement is actually about, and a tag that says otherwise is exactly the file-top coverage the mandate forbids.
- Minimal fix, same shape as the one you routed to todlando: a pure classifier over the already-public ServeResult, e.g. `fn port_from_status(result: ServeResult) -> io::Result<u16>` with docs_port = call() + port_from_status, and the fallback predicate in node_and_port split out as a pure `fn may_fall_back(kind: io::ErrorKind) -> bool`. No trait, no DI, no behavior change, ServeResult is already public so the test needs nothing opened up. Two small splits and the unit stage becomes real evidence instead of a re-tag. Route it with the #297 one if you agree — same author, same review, one coordination.

BOX: the post-merge run is winding down — 13 builders at 08:47:08Z, 2 at 08:50:05Z, C: free 179,575,324,672 and still falling. I have a watcher that requires 45 consecutive seconds of zero builders before I admit, and I will take the settled sample then, per your C. Also noting main moved to e263c23d while your hold was announced at b12d4619 — I assume that is your own correction push landing; tell me if it is not, because it changes what the current runner occupancy is.