## Mechanism

Fixes BigscreenVR/spt-bs-releases#302.

[STEP1 symbolized field evidence](https://github.com/BigscreenVR/spt-bs-releases/issues/302#issuecomment-5711763508) identified synchronous Windows interface/gateway discovery occupying both `spt-broker-net` workers during rotating rendezvous lifecycles. The retained capture had four stale canary intervals, peaking at4011ms. Meet retirement/CancelMib was not the cause.

[STEP2 field verdict and STEP3 ruling](https://github.com/BigscreenVR/spt-bs-releases/issues/302#issuecomment-5722486171): runtime isolation worked, but leaving the ordinary node's mapper enabled retained recurring synchronous gateway discovery on broker workers. The frozen STEP2 result remains **FAIL**:185/185 usable samples over183968ms, zero stale intervals, max canary33ms, but six synchronous boundary records at or above250ms. Those records are three nested gateway/interface-enumeration pairs, not six independent stalls. The retained whole-log gateway positive control is13.

## Fix

- Own the complete rotating-listener lifecycle on a separate bounded two-worker `spt-meet` runtime: bind, descendant actors, serving, rotation, cancellation and actual listener destruction.
- Retain current/previous-window overlap. JoinSets own both windows; shutdown cancels and drains them before dropping the meet runtime and then broker networking.
- Disable UPnP, NAT-PMP and PCP portmapping unconditionally for **every endpoint and bind scope**. Remove the now-obsolete `EndpointPurpose` enum and purpose-specific bind helper; all callers use the existing `bind_scoped` interface.
- Preserve relay discovery, `net_report` NAT hole-punching, direct connections, IP-family policy and rendezvous redirection. No dependency fork or mapper fallback is added.
- Keep the main endpoint, streams, dials and canary on the original two `spt-broker-net` workers.
- Broaden `REQ-MEET-PORTMAPPER-OFF` to all endpoints with doc/impl/unit evidence; update the runtime ADR and source/generated user-facing changelog. The existing matching heavy CI filters remain in place.

STEP3 remedy commit: `712c987f086f0f3564d139e8ff3775ce0bbd8ec2`, following STEP2 `a593ece06d5b67afa7fcdd23824b585675d7cc04`. No diagnostic assembly or diagnostic fork changes are in this PR.

## Local verification

Windows proofs used the working-tree source committed as712c987f: two build/test jobs, private SPT_HOME/TEMP outside the repository, scrubbed SPT/OWL environment, no retries, quiet process census and unchanged96GiB admission/32GiB emergency/64GiB target guards.

- **New behavioral RED→GREEN:** real endpoints perform a completed loopback QUIC exchange under All, Port(0) and Loopback scopes; mapper activity counters must remain zero. Before the policy change, All recorded a mapper port update:1 versus0, intended nextest exit100 in0.155s. After the change, all three scopes pass in6.580s, exit0. This is not a configuration-constant assertion.
- Pairing/network guards: **254/254 passed**, including the new mapper regression.
- Real three-subnet lifecycle/rotation regression: **1/1 passed**, peak broker canary age26ms; bind/serve/retire stayed on `spt-meet`.
- Worker-starvation seams: **2/2 passed**, peak canary29ms and26ms.
- Attach/attach-wedge seams: **17/17 passed**, with the debug `mock-session` fixture built beforehand.
- Four final cohorts: **274 distinct selected tests passed**. The separately run mapper GREEN is also included in the254-test guard cohort, not counted twice.
- Targeted net/daemon library clippy: exit0.
- Current-tree xtask build, generated-doc refresh and `xtask check`: exit0. Generation changed only `docs-site/src/changelog.md`.
- `traceable-reqs check --json`: **926/926 complete, zero findings**, exit0.
- All proof wrappers exited0; native phases preserved source hashes. The intentional generated-doc change is separately recorded. Pool release exited0.

Receipts: `.spt/preserved/302/todlando-step3/local-proof.json` (SHA256 `f2c5ae412fbbf28159c2529ac522778c927e663a03e51b22f12d249715e0755d`) and its per-phase receipts. The pre-admission disk hold and authorized, classified incremental-cache reclaim remain recorded; no threshold override was used. Original STEP2 proofs and field FAIL remain unchanged.

## Acceptance still pending

Fresh PR231 CI and Doyle's isolated gate must pass on the new head. A **separate** optimized fix+diagnostic assembly and matching-symbol capsule then support explicitly authorized ENLYZEAM restaging/capture; none is claimed here.

The field gate retains all previous conditions: at least180000ms usable sampling; zero stale intervals at or above1000ms; at least two distinct steps on each of SPT_DEV, SPT_MANTLE and BIGNET; no synchronous span at or above250ms on the START broker-worker TIDs; identity/sampling/coverage checks; and local/remote `rc` responsiveness. STEP3 additionally requires zero `NET_GATEWAY_LOOKUP_BEGIN` events stamped `runtime=spt-broker-net` for the selected broker/run across the **entire retained log, including startup**. The retained STEP2 positive control is13 and still FAILs.

ENLYZEAM remains on0f80fef8 until operator-owned restaging is authorized. A brain-only refresh cannot replace the running broker's implementation.