{"body":"## Mechanism\n\nFixes BigscreenVR/spt-bs-releases#302.\n\n[Confirmed field mechanism](https://github.com/BigscreenVR/spt-bs-releases/issues/302#issuecomment-5711763508): rotating rendezvous listeners occupied both `spt-broker-net` workers with synchronous Windows interface/gateway discovery. Symbolized stacks showed `NtDeviceIoControlFile` → `NsiGetAllParameters` → `ResolveIpNetEntry2` → `SendARP` → `netdev::os::windows::interface::interfaces`, reached through both rendezvous endpoint bind and its descendant portmapper actor. A non-answering gateway made individual enumerations approximately 1165ms. The retained 180-second diagnostic capture had four stale canary intervals, peaking at 4011ms; meet retirement/CancelMib was not the cause.\n\n## Fix\n\n- Own the complete rotating listener lifecycle on a separate bounded two-worker `spt-meet` runtime: bind, descendant actors, serve, rotation, cancellation and actual listener destruction.\n- Retain current/previous-window overlap. JoinSets own the tasks; shutdown cancels and drains both windows before the meet runtime and then broker networking are dropped.\n- Disable the portmapper for rendezvous endpoints via an explicit internal endpoint purpose. Main endpoint All/Port mapping policy, relay/discovery/IP-family behavior and broker worker count remain unchanged.\n- Keep the main endpoint, streams, dials and canary on `spt-broker-net`. This is neither bind-only `spawn_blocking` nor additional broker workers.\n- Update runtime ADR, user-facing/generated changelog, requirement evidence and both matching heavy CI filters.\n\nFix-only commit: `a593ece06d5b67afa7fcdd23824b585675d7cc04`; 13 files, +473/-29, based on `84e359aa52900256fc860e71052252255b22054e`. No diagnostic assembly or fork changes are in this PR.\n\n## Verification\n\nWindows, hermetic private homes/temp, two build/test jobs, no retries, fixed disk admission/emergency/target-cap guards:\n\n- Real three-subnet lifecycle regression: 1/1 passed, peak broker canary age 26ms while two meet bind polls were blocked. Current/previous endpoints answered; expired listeners retired; every bound listener retired at host shutdown; bind/serve/retire ran on `spt-meet`.\n- Approved one-line routing mutant (`meet_runtime.handle()` → `runtime.handle()`): actual nextest exit 100, intended assertion `two synchronous meet binds starved broker workers`, peak 471ms and bind events on `spt-broker-net`. Exact source hashes and empty index/worktree difference proved restoration before final runs.\n- Post-restoration pairing/net/meet guards: 253/253 passed.\n- `net_worker_starve`: 2/2 passed.\n- Attach/attach-wedge seams: 17/17 passed. Total final selected tests: 273/273.\n- Targeted net/daemon library clippy: exit 0.\n- Generated docs and current-tree `xtask check`: exit 0.\n- Final `traceable-reqs check --json`: 926/926 complete, zero findings, exit 0.\n- Final trace and pool release: wrapper/native 0, no source changes.\n\nReceipts retained under `.spt/preserved/302/todlando-step2/`: `meet-red-placement`, `control-restored.json`, four `*-restored` cohorts, `checks`, `docs-gen`, `final-trace`, `pool-release`. The initial post-generation trace was refused before launch for disk admission (not a trace failure); classified/measured incremental-cache reclamation restored admission. Both the refusal and successful final trace remain preserved.\n\n## Acceptance still pending\n\nDoyle accepted the remedy on source review. Isolated gate and ff-only landing remain Doyle-owned. A separate local fix+diagnostic release assembly is being built for ENLYZEAM; operator-owned restaging, ≥180s field evidence with zero ≥1000ms stale intervals, continued rounds on all three subnets, physical-worker boundary checks and local/remote `rc` responsiveness are not yet claimed. Updating only the brain is insufficient: the running broker must be replaced.\n","title":"fix(net): isolate rotating rendezvous listeners from broker workers"}