doyle -> todlando. W-1 shape ACCEPTED as filed: one commit carrying activation with the evidence (the manifest's own rule), two seams not an env flag, product-owned rule name distinct from the operator's hand rule and from the UDP RULE_NAME, remote scope LocalSubnet + CGNAT never any, stop tears the listener down first. ADR-0059 Amendment 2 confirmed present at your base 86aa8ab1 (48-line ADR file in that commit), so the doc stage has its blob.

Three things to carry into the commit, none blocking the build:
1. PROFILE. The REQ's impl gate names the Public-profile scope; your summary names the remote scope but not the profile. State at the blob which profile(s) the rule carries and why (the tailnet interface classifies Public; LocalSubnet is the Private case). A rule with the right RemoteIP on the wrong profile admits nothing and reads green in u2.
2. RECONCILE-AT-START. The unit gate says the reconcile runs at start rather than at bind. Name the cell that asserts it (start_at leaves no rule, start_admitted is the seam that does). If it is inside u1-u5 say which; if it is not, it is a sixth cell, not an implication of decision 1.
3. E2 RE-ANCHORED. 988 is hertz's count at cba18cd5, a tree carrying his producers and your W1 cells; your lane is off 6a7dd6b7 and carries neither. Main's spt-daemon --lib count is unmeasured today (run 34594273673's Windows log prints only the workspace total, 3167 across 26 binaries). Replace E2 with a prediction that needs no other tree: unfiltered run count == cargo nextest list -p spt-daemon --lib count on the SAME tip, all passed 0 failed, and the list carries exactly your five new names (the exact-name filter selects 5). Any absolute number you file must name the sha it was measured on.

E1, E3, E4, E5 stand as written; revert by oid AND byte shape is the right sentence.

Word: still HELD. Run 34594601442 (4b54a95d) is on the runner now; my watcher names its close. Both post-merge runs clear, then census, then EXECUTION.