# Twohost execution plan -- REQ-WEB-LAN-BOOTSTRAP-FIREWALL int stage (candidate b6bbaf22)

Author hertz 2026-09-12. QUEUED AFTER A7. NO EXECUTION GRANT. Nothing here runs until doyle grants an
exclusive HFENDULEAM host window plus a kitsubito build window.

## 0. Geometry, and why it is this way round

The cells are role A, the FETCHING side, and the file has no role B. The admission pair being witnessed is
WINDOWS firewall state (bootstrap_firewall/windows.rs), so the SERVING host is HFENDULEAM and the three
arms EXECUTE ON KITSUBITO. That is not a convenience: role A must distinguish a firewall DROP (timeout)
from a listener REFUSAL (RST), and on Windows a refused connect costs ~2.05 s (IR-120) while on Linux a
closed port and an open one are within 66 us of each other. Running the fetcher on Linux is what makes
Face::Blocked and Face::Stopped separable by kind rather than by a latency threshold -- and no measured
constant enters the assertion either way (IR-117 corollary).

## 1. Hashes recorded BEFORE any arm (none may be copied from an earlier session)

- candidate: b6bbaf22e1ffda82561f7b3416a57c065dae09fc, parent 00c4dad9. Its file blob for the rig and the
  worktree oid asserted CLEAN at arm start and again at teardown (IR-113: the previous arm's state is
  proven at the next arm's start, never trusted).
- test binary: sha256 of the nextest-built twohost_bootstrap binary on kitsubito, captured from the build.
- served product binary: sha256 of the artifact HFENDULEAM actually serves, re-derived at run time from the
  bytes on disk AND from the served response. The value currently advertised by this node's LAN notice is
  NOT admissible as that number -- it is today's advertisement, not this run's evidence.
- SPT_TWO_HOST_BOOTSTRAP_SHA is set from the re-derived value. The cell already refuses an empty sha, which
  is its own built-in positive control: without it the arm would assert only that SOMETHING was served.

## 2. Harness liveness control FIRST, before any state is built

On kitsubito, at the candidate, with no rig env: `--ignored` over the three cells must give
exit 101, 0 passed, 3 failed, every failure MISCONFIGURED RIG. This is the negative control the commit
already records, re-run here for one reason -- it proves the harness I am about to trust is the one that
refuses to pass without a peer. If this reads green, STOP: the opt-in guard is gone and no arm below means
anything. (Run with `--success-output immediate`: a nextest GREEN prints passing output nowhere, and the
eprintln census lines the arms emit are the record.)

## 3. The three states, one writer, announced

ONE WRITER on HFENDULEAM (IR-114). Every transition is announced with its UTC time, and the census is taken
BY THE SAME COMMAND that makes the transition, before and after -- not carried forward from an earlier step.
Each census names its tool and privilege and carries both positive controls in the same dump: one rule known
to carry LocalPort 29470, one known to name the serving program (IR-115).

| arm | listener | owned pair | expected face | what REFUTES it |
|---|---|---|---|---|
| blocked | UP on 29470 | ABSENT | 3/3 TimedOut, no RST | any RST (that is STOPPED: the listener answered), or a connect (the peer reached a listener with the rule absent) |
| admitted | UP on 29470 | PRESENT (elevated reconcile) | /install 200, binary bytes byte-true to the sha, sidecar artifact_sha256 equal to the bytes served | a sha mismatch, a non-200, or a sidecar disagreeing with the bytes |
| stopped | DOWN | PRESENT | ConnectionRefused | a timeout -- and that is THE FINDING, not a flake: the two refusals would share a face at the wire. Report measured times, do not soften the assertion |

The stopped arm requires the pair PRESENT. With the pair absent the drop wins and the arm measures the
blocked state under the stopped arm's name -- the one ordering mistake that turns this rig into a
tautology. Order blocked -> admitted -> stopped so each state has a neighbour whose result refutes the
other reading of it; one arm per invocation, selected by SPT_TWO_HOST_BOOTSTRAP_ARM.

## 4. Per-arm record

Per arm: the ARM selector, the four env values, the server-side census before and after, the arm's own
eprintln lines (peer, port, face, elapsed_ms, budget_ms), nextest's exit code and its
passed/failed/ignored counts, and every curl/connect exit code. An arm killed mid-flight is a VOID arm,
not a red (IR-116 corollary), and a cell that reports SKIP because the selector named another cell
witnessed nothing -- neither may be reported as a result.

## 5. Teardown, as a list of processes and states asserted gone

Not a list of conclusions (IR-119). (a) The LAN serve closed (`spt serve lan --stop`) and the port asserted
not listening. (b) Every process started for the rig named and asserted absent against a live positive
control, on BOTH boxes. (c) The owned firewall pair left in a DECLARED state -- removed, or left present
and said so with its census. (d) No file server is used anywhere in this rig for any purpose, including a
route control: an empty throwaway directory or nothing. (e) The candidate worktree oid re-asserted clean.
Teardown runs in the same breath as the last arm, not after the verdict is named.

## 6. What this plan does NOT claim

It does not establish that the cells pass. It does not license a landing: the traceability half is done
(0.4.1 and the 0.2.0 pin both exit 0 on b6bbaf22, session copies preserved beside this file) and the
execution half is exactly what this plan is for. int stays unchanged on the unlanded candidate.