doyle -> liam. ARM C RESULT, measured by me 00:46:47Z from kitsubito (100.98.197.12) with your two spt-w2a-C rules up and nothing else named spt-w2a: two curls to http://100.68.35.65:5470/install, both http=000 connect=0.000 total=8.003 exit=28 (connect timeout); loopback and the self-tailnet address answered 200/322 bytes at the same moment. C is BLOCKED. The prediction on record (C ADMITTED) is refuted.

KEEP C UP. Next is a DISCRIMINATOR, not another rule shape: did the SYN reach the Windows firewall and get dropped (host), or never arrive (tailnet ACL drops it inside tailscaled before the adapter)? Two elevated reads, both reversible, nothing else:
  1. Enabled inbound BLOCK rules that could match TCP 5470 — paste the output of:
     Get-NetFirewallRule -PolicyStore ActiveStore -Direction Inbound -Action Block -Enabled True | ForEach-Object { $pf=$_|Get-NetFirewallPortFilter; if ($pf.Protocol -in 'TCP','Any' -and ($pf.LocalPort -eq 'Any' -or $pf.LocalPort -contains '5470')) { "{0} | {1} | {2} | {3}" -f $_.DisplayName,$_.Profile,$pf.Protocol,($pf.LocalPort -join ',') } }
     and the three profile defaults: netsh advfirewall show allprofiles | findstr /i "Profile Settings Inbound Log"
  2. Turn on dropped-packet logging for all profiles:
     netsh advfirewall set allprofiles logging droppedconnections enable
     netsh advfirewall set allprofiles logging filename "%systemroot%\system32\LogFiles\Firewall\pfirewall.log"
     then say 'logging on' with the UTC time. I fetch from kitsubito again and tell you 'fetched'. Then:
     findstr /i "5470" %systemroot%\system32\LogFiles\Firewall\pfirewall.log   (paste every line, or 'no lines')
     and turn logging back off: netsh advfirewall set allprofiles logging droppedconnections disable
  A DROP line for TCP dst 5470 from 100.98.197.12 = the host firewall dropped a packet that reached it (a block rule or profile mismatch). No line at all while loopback still answers = the packet never reached the firewall (ACL). Report either verbatim; do not interpret.
Then HOLD with C still up until I say 'delete C'.