END — #304 W2 verify-representation, test-side lane closed. Pin 53d625cd, tracked tree clean, pool released, free 122.02 GiB (floor 96, stop 32; never approached).

FINAL COMBINED RUN — measured by count, not by colour
  list, parent module anchored, test(/^bootstrap_firewall::/)          31 names
  sentinel test(/^bootstrap_firewall::hz_absent_sentinel_/)             0  — the filter can express absence
  run, same filter, --build-jobs 2 --test-threads 2 --success-output immediate
                                          31 tests run: 31 passed, 982 skipped
  list count == run count. Coverage preservation is MEASURED, not audited: the five sibling owners of the claims I dropped are in this selection and passed.

THE 26 LISTING, preserved per your instruction
  final-list.txt (sha d93b0c0f) is the superseded run: I used the filter from validation-commands.md, bootstrap_firewall::windows::tests::, which enumerated 26 against my recorded expectation of 31. Wrong command of mine, not a missing population. Set difference preserved and re-derivable from final-list.txt vs final-list-parent.txt: the 26 are a STRICT SUBSET of the 31 (empty in-26-not-in-31), and the five extra are exactly the parent-module cells —
    bootstrap_firewall::tests::an_invocation_outcome_separates_killed_from_failed_and_completed
    bootstrap_firewall::tests::the_opt_out_disables_mutation_for_every_value_including_empty_and_zero
    bootstrap_firewall::tests::the_opt_out_refuses_before_the_argument_guard_and_before_any_host_command
    bootstrap_firewall::tests::the_residual_cleanup_command_is_a_self_verifying_removal_that_creates_nothing
    bootstrap_firewall::tests::verify_refuses_a_relative_binder_and_port_zero_under_either_opt_out_state

SCOPE DEVIATION, mine, reported as you required
  I ran cargo clippy --workspace --all-targets --jobs 2. That EXCEEDED the scoped spt-daemon library check authorized here. It was already in flight when you ruled; per your instruction I let it finish inside the capacity limits, launched no second clippy, and fixed nothing.
  ACTUAL SCOPE RUN: whole workspace, all targets, jobs 2, 3m33s, checking through xtask.
  RESULT: 0 error lines. 9 warnings, all one lint (needless_borrow / "creates a reference which is immediately dereferenced"), all in crates/spt-daemon/src/bootstrap_firewall/windows.rs at 1031, 1033, 1055, 1057, 1082, 1083, 1103, 1113, 1115 — all INSIDE the test module (boundary at line 916).
  ATTRIBUTION, blamed not assumed: all nine lines come from 61d3459f (2026-09-11, "refactor(bootstrap_firewall): move the scope policy out of PowerShell into a testable seam"). That predates BOTH my cells (53d625cd) and todlando's FOLD-4 repair (10d18b7f). Pre-existing, not introduced by this lane. Not fixed — no authorization and you said no unrelated fixes.

EXITS CAPTURED SEPARATELY, per your correction
  My original launch chained clippy && traceable-reqs, which cannot establish both. I re-ran the checker ALONE: traceable-reqs check, own exit 0, artifact final-traceable-standalone.txt (sha 09aa8e61).
  Clippy's own exit is not directly captured and I am not claiming it as measured — I am stating the inference and its ground: the chain used &&, the checker's output file was written, therefore clippy exited 0. If you want clippy's exit as a measured number rather than an inference, that needs a run I have not been granted.
  CHECKER VERSION CHECKED AGAINST THE CI PIN: local traceable-reqs 0.4.1; .github/workflows/ci.yml sets WANT=0.4.1. Match — a green from a version-mismatched checker was the hazard and it does not apply.
  CAVEAT FROM THE CHECKER ITSELF, not swallowed: "3 tag-carrying file(s) not placement-judged (no grammar for the language, or the parse recovered from errors)".

5b, AS ADJUDICATED — 5b-m5-adjudication.md (sha 284adbd5)
  8 invocations, 5 mutations. m1/m2/m3/m4 green on every check. m5 accepted on your ruling off the raw; the original mismatch is preserved unrepaired in controls_5b_v2.py and m5 was not re-run. Diagnostic-wording sensitivity RECORDED AS NOT EXERCISED — no sixth mutation, and it is not counted as covered.
  I also caught and removed a REQ tag I had minted in that file against an unregistered id. No requirement registered, none proposed.

CLEAN STATE, verified after everything
  HEAD 53d625cd, git status --porcelain empty, working file matches pinned content, one test-module boundary, all five product anchors still count 1.
  Pool: "pool target released (still owned by .worktrees/304-w2-repr)". Lane 304w2-combined-gate closed.

WHAT THIS RESULT MAY NOT CLAIM
  5a status unchanged: arm1_adjacency ACCEPTED off raw, query_onepass MEASURED, the other six (h1,h2,e1,e2,e3,e4) remain PEER-REPORTED ONLY and are not upgraded.
  FIELD EXECUTION REMAINS HELD. No NetSecurity call, no elevation, no firewall write occurred at any point. The twohost plan (v4/v5 + census.ps1) is a separate gate that has never run.

50 hashed entries in MANIFEST-v5.sha256. Lane is yours.