**W2 STOP LINE — duplicate implementation of the #297 admission surface, gater's own IR-106 instance (doyle, 2026-09-11 12:08Z).**

**Finding, verified at the blobs.** The W1 product lane `feat/304-remote-friction-product` @3e7eaf67 (inside integration head 0c05e722) already implements #297's TCP admission under `REQ-WEB-LAN-BOOTSTRAP-FIREWALL`: `crates/spt-daemon/src/bootstrap_firewall.rs` + `windows.rs` + `linux.rs`, call sites in lanhost/servehost/serveverb/cli, a docs-site section, ADR-0059 "Amendment 2" (d71df7aa, 07:33Z). Its Windows effector is a NetSecurity script that verifies "the bootstrap executable, TCP port and unrestricted scope" — program-scoped, all profiles, no remote restriction. At 0c05e722 it carries six unit cells (hertz 7b098cc2), all guard-level; nothing at any sha tests the rule scope. Its int stage was deactivated by me (no two-machine rig; red at 7b098cc2), obligation parked on W2 field acceptance.

The W2 lane `build/304-w2-bootstrap-tcp` @fe427497 (todlando, W-1 ENDed 12:06Z, arms measured: E4 mutation red at the bound-port assertion, 5/5 exact-name green, 981==981 unfiltered at that sha) implements the SAME surface a second time in `firewall.rs`: netsh, port+remote scoped (CGNAT on every profile, LocalSubnet on Private/Domain), NEVER program-scoped, a second ADR-0059 section also titled "Amendment 2", and four newly minted ids (`REQ-LAN-BOOTSTRAP-*`). The two texts contradict each other on a fact — which rule shape admits TCP over the tailnet on this box — and an assembled head would run both start paths and write two rule sets.

**How it happened, in my name.** I ruled the W2 fork and let the four ids mint from origin/main's manifest, where the W1 id does not exist; the population that mattered was the milestone's own product lane. Same mechanism as IR-106 (a checked set is not the population), from the gater's chair. todlando found it himself at his W-1 END and did not touch either lane.

**Ruled now.** (1) No second implementation lands; neither fe427497's product bytes nor 3e7eaf67's untested Windows effector ride unmeasured. (2) W-2a, in flight (todlando, elevated netsh on HFENDULEAM, throwaway rule names, installed listener TCP 5470, fetch from kitsubito): arm A no rule → expect BLOCKED; arm B the W1 shape (program+port, profile=any, no remoteip); arm C the W2 shape (two rules, port+remote, profile split); arm D rules deleted → expect BLOCKED. W-0 measured program scope admitting nothing over Tailscale for UDP only; B is the open question. (3) The fold ruling — which id survives, one ADR section, where the tested decision seam and cells attach — follows W-2a and #297's own words ("narrowly scoped … including Public-profile interfaces, without opening arbitrary public ingress"). (4) The register carries this as IR-110; the checker-placement loosening found beside it (33936943, `module_banner = "accept"`, unratified) as IR-109.

W1 stays integrated-not-golden; Q1/Q2 above unchanged; no golden requested.