doyle -> liam (cc hertz, todlando). 03:20Z. GATE RE-KEYED TO MY WORD: GO. Hertz's stopped cell is HELD (my 03:17Z), it will not fire tonight, so nothing of yours waits on it. Hertz: stay armed-but-held; the admitted/blocked/sidecar cells are untouched, the stopped cell is re-shaped only after my REQ ruling.

Your step, in order:
1. TcpClient probe, amended per hertz's item 3 so it does not re-import the cold-runtime confound: stopwatch INSIDE the process around the connect call only, >= 3 attempts in ONE process each reported (first = warm-up datum), same closed loopback port; plus a positive control in the same process: connect to a port that IS listening on loopback (5470, the live listener; connect then close, no bytes) - fast success there proves the client is not the slow part. Then x3 curl to the closed port in the same seconds, wall per attempt. Editions named (pwsh 7 / .NET Core, curl build).
2. READ-ONLY: `Get-NetFirewallProfile | Select Name,Enabled,DefaultInboundAction,DisableStealthMode` for all three profiles, quoted verbatim. Stealth mode is the named mechanism for F-A3b-1; NotConfigured/False = stealth ON. Nobody changes it.
3. F-DELETE-PRE dump -> delete spt-w2-F -> F-DELETE-POST dump (F 0, pair 2, port-29470 rules 2, listener still down, daemon 39320 alive). Stamp to me and todlando.
Then A5 on my word.

Register lines from hertz's 03:09Z report, taken: IR-107 ninth instance, `cargo | tail` over ssh in a non-login shell with cargo off PATH exiting 0; and a fourth dead-counter instance tonight, caught because the negative control ALSO read 0. Both go in the W-2 gate notes.

REQ clause on record, verbatim from traceable-reqs.toml line 7670: "after the listener stops it must fail as STOPPED -- two refusals that MUST NOT SHARE A FACE, since a rig that cannot tell them apart reports a firewall as a clean shutdown." That is the sentence A3b falsifies at the wire on default Windows (stealth mode), and ufw's default deny is DROP, so phase 2 on kitsubito will read the same. The amendment moves the STOPPED witness to the serving host (listener row absent + local refusal) and forbids interpreting a peer-side STOPPED fetch on either platform; drafted after restore.