liam -> doyle, todlando, hertz. ARM F IS UP. One write. Gate met by hertz's red, not by the clock; my 02:55:00Z timer was not needed and I let it expire unused.
PREDICATE VALIDATION — F-PRE 02:51:36.179Z, dump 579 ms, 687 rules parsed. All five controls present, so the instrument is proven on its first run exactly as you ruled:
  SUBJECT asm exe       -> Allow=0 Block=0
  CONTROL installed exe -> Allow=3 Block=0 (spt-core inbound UDP, spt-fallback inbound UDP, spt-core daemon)
  CONTROL hand rule     -> 1: spt lan-bootstrap 5470 | port 5470 | remote 192.168.1.0/24 | Allow
  BOOTSTRAP PAIR        -> 2: ...-lan | 29470 | remote LocalSubnet | prog '' | Domain,Private ; ...-tcp | 29470 | remote 100.64.0.0/10 | prog '' | Domain,Private,Public
  ARM F                 -> 0
  VALIDATION: PASS
  Cost 579 ms against the 24-29 s CIM census it replaces, and it prints VOID instead of a reading if a control is missing.
F ADD 02:51:36.210Z: netsh add rule name="spt-w2-F" dir=in action=allow enable=yes profile=domain,private protocol=TCP localport=29470 remoteip=192.168.1.0/24 -> "Ok." exit=0.
F-POST 02:51:37.014Z, dump 649 ms, 688 rules (one more than pre, which is the only delta):
  ARM F -> 1: spt-w2-F | port 29470 | remote 192.168.1.0/24 | prog '' | Allow | enabled Yes | Domain,Private
  BOOTSTRAP PAIR -> 2, unchanged and left in place. SUBJECT still 0/0. Controls unchanged.
  All rules on port 29470 -> 3: spt-w2-F, spt-core-bootstrap-inbound-tcp-lan, spt-core-bootstrap-inbound-tcp
THE SINGLE-AXIS CLAIM IS NOW MEASURED, NOT ASSERTED. Side by side from the same dump:
  spt-core-bootstrap-inbound-tcp-lan : port 29470, TCP, In, Allow, Domain,Private, program '', remote LocalSubnet
  spt-w2-F                           : port 29470, TCP, In, Allow, Domain,Private, program '', remote 192.168.1.0/24
Identical on every column the dump reports except RemoteIP. Doyle's profile correction was load-bearing: my composed line had private alone, which would have varied profile AND remote and discriminated nothing.
Listener unchanged: 0.0.0.0:29470 LISTENING 39320. Dialog scan: nothing. No Security Alert seen, with my standing caveat that the scan cannot see a title I did not anticipate.
todlando: the box is yours, fetch when ready. I am holding and will NOT delete F except on doyle's word, and I will not run A4 while F exists.