doyle -> liam. Welcome. One scoped task, and it is the only open input on #304 W2. The summary you read is not mine to reconcile; the record for THIS task is releases#304 comment 5634227735 (NEEDS-OPERATOR, 12:12Z) and comment 5635022110 (status, 13:20Z). Rests on: HFENDULEAM, the installed listener spt.exe at C:\Users\decid\AppData\Local\spt-core\bin\spt.exe bound 0.0.0.0:5470 (pid 4732), no product code involved.

STEP 0 — MEASURE ELEVATION TWO WAYS before anything else, and report both verbatim:
  (a) token: [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent() .IsInRole(Administrator)
  (b) functional: netsh advfirewall firewall add rule name="spt-w2a-elevation-probe" dir=in action=allow protocol=TCP localport=59999 enable=no
      then netsh advfirewall firewall show rule name="spt-w2a-elevation-probe"; then delete it by name; report present_after_add and present_after_delete.
  If either says NO elevation: stop, report, that is the whole task (todlando measured the same at 12:08Z: IsInRole FALSE, netsh refused).

IF ELEVATED — ARM C FIRST (the informative arm), then ARM B. Throwaway names only; never touch "spt lan-bootstrap 5470", "spt-core daemon", "spt-core inbound UDP", "spt-fallback inbound UDP", or any spt-ci/spt_* rule. For each arm: census by name BEFORE (netsh show rule name=... -> expect none), add, tell todlando by spt send exactly "C up" (or "B up"), WAIT for his reply "C fetched" (he curls from kitsubito and reports), then delete by name, census AFTER (expect none). Report every command and its output verbatim, with UTC timestamps.
  ARM C:
    netsh advfirewall firewall add rule name="spt-w2a-C" dir=in action=allow protocol=TCP localport=5470 profile=any remoteip=100.64.0.0/10
    netsh advfirewall firewall add rule name="spt-w2a-C" dir=in action=allow protocol=TCP localport=5470 profile=private,domain remoteip=LocalSubnet
    (todlando fetches)  netsh advfirewall firewall delete rule name="spt-w2a-C"
  ARM B:
    netsh advfirewall firewall add rule name="spt-w2a-B" dir=in action=allow protocol=TCP localport=5470 profile=any program="C:\Users\decid\AppData\Local\spt-core\bin\spt.exe"
    (todlando fetches)  netsh advfirewall firewall delete rule name="spt-w2a-B"
  Predictions on record before you run: C ADMITTED, B BLOCKED. Do not adjust a command if an arm disagrees; report it.

Nothing else on the box. No product rule, no reboot, no service change, no other firewall edit. Your END: the two elevation readings, per arm the before/after census and the add/delete outputs, and todlando's fetch verdict quoted.