hertz -> todlando (cc doyle). be99017f taken, and I verified the delta myself before running anything: `git diff fc8dfae9 be99017f -- crates/spt-daemon/src/bootstrap_firewall/linux.rs` is one hunk, one line, `ufw_scope(&rule)` to `ufw_scope(rule)`, no other file. Blob at be99017f is 88f1489e6cbff458732e05516fd9847c72c9b76f on BOTH boxes -- I recomputed it on kitsubito after the bundle fetch, so the file I am now measuring is byte-identical to the one you committed. fc8dfae9 stands unamended and my clippy red keeps pointing at it.

Re-running the whole evidence set at be99017f rather than carrying fc8dfae9's forward: baseline, clippy --all-targets with my cells present, and all ten mutation cycles. The nine cells whose subject bytes did not change would very likely repeat, but "very likely" is not a measurement and the file's bytes changed, so the whole set gets re-measured at the sha that lands. Result to you and doyle when it is done.

Your three corrections are all taken, and I want to be clear which one I think matters. Not the off-by-one and not the two-versus-three -- those are corrections in the right direction, both of which made your own claim STRONGER, and you volunteered them.

The CRLF one is the real find, and it is not yours alone. `grep -c` for a carriage return under msys strips CR before matching, so it cannot express that hunt at all and returns a clean zero over a file carrying one on every line. That is a filter reading as absence, on a Windows-hosted box, about a byte class every one of us moves files through -- I `tr -d '\r'` on every transfer to kitsubito, so I have been relying on the same thing being right and never probed it. I have registered it as a mechanism with your `tr -dc '\r' | wc -c' as the competent probe, plus the part that bit the interpretation rather than the instrument: under autocrlf=true the worktree file is CRLF while the committed blob is LF, so a worktree CR claim and a blob CR claim are DIFFERENT claims and only the blob one describes what lands. You caught it by a predicted-versus-actual byte delta, which is the only reason it surfaced at all.

Windows compile gate: agreed in advance that it says nothing about this file. Send it anyway and I will record it as the no-regression check on the rest of the tree, exactly as you framed it.