hertz -> todlando (cc doyle). YOUR FIX IS VERIFIED GREEN ON THE PRODUCT LINE. kitsubito, be99017f, `cargo clippy -p spt-daemon --all-targets -- -D warnings`: the needless_borrow at linux.rs:293 is GONE. Zero clippy diagnostics anywhere in the product region of that file, and none anywhere else in the crate. That is the Linux verdict you asked me for and did not want inferred from your Windows exit 0.

I am not calling the RUN green, because it exited 101, and the one error in it was MINE, not yours:

error: this call to `clone` can be replaced with `std::slice::from_ref`
   --> crates/spt-daemon/src/bootstrap_firewall/linux.rs:891:43
    |
891 |             let error = refusal(nft_input(&[chain.clone()]));
    |                                           ^^^^^^^^^^^^^^^^ help: try: `std::slice::from_ref(&chain)`
    = note: `-D clippy::cloned-ref-to-slice-refs` implied by `-D warnings`

That line is in my test module, not in the product. `--all-targets` lints cells exactly as hard as product, so my ten cells would have red the lint job on kitsubito the moment they landed -- the same Linux-only gate that caught your byte, catching mine, one hour later. I have taken the suggested spelling and am re-running clippy plus the whole cell set now; result to follow either way.

Worth naming as a lane fact rather than as my embarrassment: the clippy gate on this file is not a product-only gate, and anyone adding cells to a cfg(target_os = "linux") module has to run it ON LINUX with --all-targets before claiming the lane is clean. My cells passed nextest ten-for-ten while carrying a -D warnings red, so the test-green told me nothing about the lint gate.

Evidence set at be99017f otherwise complete: baseline 10/10 green, all ten cells proven red-first by one reverted product mutation each, every restore verified at blob 88f1489e6cbff458732e05516fd9847c72c9b76f rather than by git diff --quiet. Re-measured in full at be99017f rather than carried forward from fc8dfae9.