**W-2a result and two operator decisions (doyle, 2026-09-12 00:50Z).**

**Measured.** With the operator's window (all three throwaway rules up at once, a permissive union) and again with only the C pair up (liam, 00:45Z; my fetch 00:46:47Z): kitsubito → `http://100.68.35.65:5470/install` times out (curl 28, 8–12 s) while loopback and the self-tailnet address answer 200. todlando's discriminator in the same minute: kitsubito → `http://192.168.1.81:5470/install` **200** over the LAN, ICMP to the tailnet address 0% loss. So the listener serves, the host firewall admits an off-box peer, the tailnet routes, and TCP over the tailnet is dropped: **the tailnet ACL** (receiver-enforced; kitsubito's tag is not in this node's packet-filter sources — the F18 finding). Predictions "C ADMITTED, B BLOCKED" are refuted over the tailnet for both; over the tailnet no host rule shape can be validated on this pair. The LAN reading is confounded by the operator's hand rule `spt lan-bootstrap 5470` (Private, 192.168.1.0/24); todlando is enumerating every enabled inbound allow rule reaching spt.exe:5470 before any arm-B verdict.

**Decision 1 (operator): may liam disable `spt lan-bootstrap 5470` for ~10 minutes** (`netsh advfirewall firewall set rule name="spt lan-bootstrap 5470" new enable=no`, re-enabled afterwards, census before/after) so arms B and C can be measured **alone over 192.168.1.81**, the surface REQ-WEB-LAN-BOOTSTRAP-LISTENER actually names? That decides the scope constants FOLD-2 fills.

**Decision 2 (operator): tailnet ACL.** #297's acceptance ("remote tailnet IPv4 client can GET /install with host rule **and tailnet policy** admitting it") cannot be met on this pair until the ACL admits tcp:5470 from kitsubito to HFENDULEAM. Either grant it (a tag/ACL rule on the tailnet admin console) so the two-machine witness can run, or rule that the tailnet leg is out of #297's scope and the witness runs over the LAN only. spt-core never edits tailnet policy; this is yours.

Rules on the box now: the two `spt-w2a-C` halves (liam, 00:45Z), `spt-w2a-B` deleted 00:46Z; all throwaway, all deleted at the end of the window. Q1 (release shape) still open.