diff --git a/crates/spt-daemon/src/bootstrap_firewall/windows.rs b/crates/spt-daemon/src/bootstrap_firewall/windows.rs
index 848a23fe..31ef24c8 100644
--- a/crates/spt-daemon/src/bootstrap_firewall/windows.rs
+++ b/crates/spt-daemon/src/bootstrap_firewall/windows.rs
@@ -411,7 +411,7 @@ fn lan_scope(addresses: &[Address]) -> LanScope {
 /// The face of a host that cannot carry the LAN half at all.
 // [impl->REQ-WEB-LAN-BOOTSTRAP-FIREWALL]
 fn no_lan_scope_message() -> String {
-    "no connected IPv4 interface: the LAN half of the bootstrap admission pair cannot be scoped,      so LAN admission is UNVERIFIED. The tailnet half is unaffected. Elevation cannot repair this;      connect the machine to a network and rerun bootstrap."
+    "no connected IPv4 interface: the LAN half of the bootstrap admission pair cannot be scoped, so LAN admission is UNVERIFIED. The tailnet half is unaffected. Elevation cannot repair this; connect the machine to a network and rerun bootstrap."
         .to_string()
 }
 
@@ -807,7 +807,7 @@ fn decide(state: &Snapshot, expected_program: &str, port: u16) -> Result<bool, S
     for rule in &state.active {
         if rule.source_type != "Local" {
             return Err(format!(
-                "Bootstrap rule {} is effective but its source store is {}, not Local:                  admission that does not come from the persistent store does not survive a reboot",
+                "Bootstrap rule {} is effective but its source store is {}, not Local: admission that does not come from the persistent store does not survive a reboot",
                 rule.name, rule.source_type
             ));
         }
@@ -956,7 +956,7 @@ fn scope_change(observed: &[Rule], want: &[RuleSpec]) -> Option<String> {
 // [impl->REQ-BOOTSTRAP-FIREWALL-VERIFY-ONE-PASS]
 fn unverified_after_write(error: &str) -> String {
     format!(
-        "The admission pair was WRITTEN and then could not be verified: {error}.          The rules may already be in place -- this is not a refused write. Rerun          bootstrap to re-observe them before changing elevation or host policy."
+        "The admission pair was WRITTEN and then could not be verified: {error}. The rules may already be in place -- this is not a refused write. Rerun bootstrap to re-observe them before changing elevation or host policy."
     )
 }
 
@@ -1103,9 +1103,9 @@ mod tests {
 
         let on_bound = observed(want.name, BOUND, "", &want.profile, DESIRED_TAILNET_REMOTES);
         let on_stale = observed(want.name, CONFIGURED, "", &want.profile, DESIRED_TAILNET_REMOTES);
-        assert!(spec_satisfied_by(&on_bound, &want), "the bound-port rule satisfies the spec");
+        assert!(spec_satisfied_by(&on_bound, want), "the bound-port rule satisfies the spec");
         assert!(
-            !spec_satisfied_by(&on_stale, &want),
+            !spec_satisfied_by(&on_stale, want),
             "a rule sitting on the configured port must NOT satisfy a spec for the bound one"
         );
     }
@@ -1127,9 +1127,9 @@ mod tests {
         let without = observed(want.name, 5470, "", &want.profile, DESIRED_TAILNET_REMOTES);
         let with = observed(want.name, 5470, "C:\\spt\\spt.exe", &want.profile, DESIRED_TAILNET_REMOTES);
 
-        assert!(spec_satisfied_by(&without, &want));
+        assert!(spec_satisfied_by(&without, want));
         assert!(
-            !spec_satisfied_by(&with, &want),
+            !spec_satisfied_by(&with, want),
             "an extra application filter is a narrowing nobody asked for, and it is the \
              difference between admitting the tailnet and admitting nothing"
         );
@@ -1154,8 +1154,8 @@ mod tests {
         let unrestricted = observed(want.name, 5470, "", &want.profile, &["Any"]);
         let narrowed = observed(want.name, 5470, "", &want.profile, DESIRED_TAILNET_REMOTES);
 
-        assert!(!spec_satisfied_by(&unrestricted, &want), "`Any` is not the narrow scope");
-        assert!(spec_satisfied_by(&narrowed, &want));
+        assert!(!spec_satisfied_by(&unrestricted, want), "`Any` is not the narrow scope");
+        assert!(spec_satisfied_by(&narrowed, want));
 
         // Order is not significance: the comparison is set-like, so a reordered
         // render still matches.
@@ -1175,7 +1175,7 @@ mod tests {
         // A wrong profile fails even with the right remotes — the trap that a
         // RemoteIP-only assertion cannot catch.
         let wrong_profile = observed(want.name, 5470, "", "Private", DESIRED_TAILNET_REMOTES);
-        assert!(!spec_satisfied_by(&wrong_profile, &want), "profile is part of the policy");
+        assert!(!spec_satisfied_by(&wrong_profile, want), "profile is part of the policy");
     }
 
     /// HYGIENE IS A PRECONDITION, NOT PART OF THE POLICY: a rule that fails it
@@ -1185,9 +1185,9 @@ mod tests {
     fn a_rule_failing_hygiene_is_refused_even_when_its_scope_is_exactly_right() {
         let want = &desired_specs("c:\\spt\\spt.exe", 5470, &one_lan())[0];
         let mut rule = observed(want.name, 5470, "", &want.profile, DESIRED_TAILNET_REMOTES);
-        assert!(spec_satisfied_by(&rule, &want), "the scope is right to begin with");
+        assert!(spec_satisfied_by(&rule, want), "the scope is right to begin with");
         rule.hygiene = false;
-        assert!(!spec_satisfied_by(&rule, &want));
+        assert!(!spec_satisfied_by(&rule, want));
     }
 
     // ---- FOLD-4: representation is not policy (releases#304 W2) -------------
diff --git a/crates/spt/src/serveverb.rs b/crates/spt/src/serveverb.rs
index e9a9e275..f8f03054 100644
--- a/crates/spt/src/serveverb.rs
+++ b/crates/spt/src/serveverb.rs
@@ -200,6 +200,7 @@ pub(crate) fn run(command: ServeCmd, json: bool) -> i32 {
         }
     };
     match result {
+        ServeResult::Missing => 0,
         ServeResult::Refused { error } => {
             eprintln!("{error}");
             1