**NEEDS-OPERATOR (by comment; flag label refuses in WIP) — W-2a needs four elevated netsh lines on HFENDULEAM. doyle, 2026-09-11 12:12Z.**

**Why.** The #297 fold ruling (comment 5634187958) rests on which Windows rule shape admits TCP over the tailnet on this box. No agent session holds elevation: todlando measured `IsInRole(Administrator) = FALSE` and a functional `netsh … add rule` refusal ("requires elevation"), and stopped without a workaround. Arm A re-measured at 12:07Z: kitsubito → `http://100.68.35.65:5470/install` curl (28) timeout at 8 s while loopback answered 200 at the same instant. The only 5470 rule present is the hand rule `spt lan-bootstrap 5470` (Private, RemoteIP 192.168.1.0/24), which cannot match a tailnet peer.

**What we ask.** In an elevated shell, run arm B, tell todlando (`spt send todlando`), he fetches from kitsubito, then delete; then arm C the same way. Throwaway names only; nothing else on the box is touched.

```
# ARM B — the W1 lane's shape (program-scoped, all profiles, no remote restriction)
netsh advfirewall firewall add rule name="spt-w2a-B" dir=in action=allow protocol=TCP localport=5470 profile=any program="C:\Users\decid\AppData\Local\spt-core\bin\spt.exe"
#   -> say "B up" to todlando; after his fetch:
netsh advfirewall firewall delete rule name="spt-w2a-B"

# ARM C — the W2 lane's shape (port + remote scoped, profile split, no program)
netsh advfirewall firewall add rule name="spt-w2a-C" dir=in action=allow protocol=TCP localport=5470 profile=any remoteip=100.64.0.0/10
netsh advfirewall firewall add rule name="spt-w2a-C" dir=in action=allow protocol=TCP localport=5470 profile=private,domain remoteip=LocalSubnet
#   -> say "C up" to todlando; after his fetch:
netsh advfirewall firewall delete rule name="spt-w2a-C"
```

**Predictions on record before the first line runs** (todlando's, doyle concurs): B BLOCKED, C ADMITTED. B is close to already measured: at W-0 the rule `spt-core daemon` (Program = that exact spt.exe, Private, Protocol ANY, RemoteIP Any) was present and enabled, the Tailscale interface classifies Private, and TCP 5470 still timed out; B differs only by `profile=any`, which adds nothing on a Private interface. C is the shape of the only inbound path this pair has ever demonstrably accepted (the port+remote UDP rule). Both BLOCKED would put the block at the tailnet ACL for TCP and make the question unanswerable on this pair; that outcome is an ACL question, not a third rule shape.

**Also for scheduling.** W-2 proper tests the PRODUCT's own elevated rule write (UAC prompt), so it needs an operator at the console for its window as well; W-2a first tells us which shape that product should write.

Until then: W2 build HELD, no kitsubito clone, W1 stays integrated-not-golden. Q1/Q2 above still open.