hertz -> doyle. W-2 ACCEPTED. PHASE 2 PRE-READ DONE, AND IT RETIRES ONE OF YOUR NEEDS-OPERATOR ITEMS.
Rig not built yet; todlando has no "rig built, cells listed" from me and must keep waiting.

PHASE 2 CENSUS, kitsubito, read-only, exactly the commands you gave:
  systemctl is-active ufw firewalld nftables -> active / inactive / inactive.  UFW IS THE MANAGER.
  command -v: /usr/sbin/ufw, /usr/sbin/nft, /usr/sbin/iptables present; firewall-cmd ABSENT.
  sudo -n true -> EXIT 0.
THAT LAST LINE IS THE ONE THAT MATTERS. PASSWORDLESS SUDO IS ALREADY AVAILABLE TO ME ON KITSUBITO. The
Linux leg's elevated write is therefore NOT blocked on an operator - your census was going to file a
NEEDS-OPERATOR item that the box says is unnecessary. Before you file it, decide the opposite question,
which is now the live one: I CAN write ufw state on kitsubito non-interactively, and your dispatch says
I never write firewall state on either box. I am holding to that - I will not touch ufw unless you rule
otherwise in so many words. Flagging the capability, not using it.

ADDRESSING, MEASURED, AND ONE REAL DISCRIMINATOR FALLS OUT OF IT:
  kitsubito: 192.168.1.168/24 on wlp2s0 (WIFI-ONLY box), tailscale0 100.98.197.12/32.
  HFENDULEAM: 192.168.1.81 per this node's own LAN-EXPOSED banner.
  Same /24, so SPT_TWO_HOST_PEER_IP=192.168.1.81 is the LAN path and that is what I will use by
  default. Note the LAN leg rides WIFI on my side - relevant to timeouts, not to admission.

  THE DISCRIMINATOR: it is MEASURED AND ON RECORD that HFENDULEAM's PROGRAM-SCOPED firewall rules DO
  NOT ADMIT OVER TAILSCALE - an exe-scoped rule read BLOCKED over the tailnet while a port+remote-scoped
  rule admitted. FOLD-2's whole scope policy, in your own words, is "port+remote pair, NO PROGRAM
  FILTER". So the tailnet path is not a second copy of the LAN test - it is the arm that discriminates
  whether FOLD-2 actually did what it says. If the admitted cell passes over 100.98.197.12 as well as
  over 192.168.1.81, that is direct evidence the program filter is gone; if it passes on LAN and blocks
  on tailnet, the rule is still program-scoped in effect whatever the policy says, and THAT is a finding
  worth the whole lane. It costs one extra arm with one env var changed. I am not adding it on my own
  authority - it widens the population you specified. Say yes and I build the cells to take the peer IP
  from env so A1 can run twice, or say no and I run LAN only.

TWO THINGS I WILL PRE-REGISTER IN THE FILE HEADER UNLESS YOU OBJECT, both from hazards already paid for:
  - The blocked-cell face is "timed out, no SYN-ACK, no RST". On a WIFI link a timeout can also be
    ordinary packet loss. I will log elapsed for every attempt so a 6 s timeout that was really a lost
    SYN is distinguishable from a firewall drop by its repeat behaviour, and I will say in the header
    that the blocked face is NOT proof of a drop on a single sample.
  - Every raw TcpStream read gets an explicit read_timeout. An unbounded read here would hang to
    nextest's terminate-after rather than red, and the red I would then be "fixing" might be the loop's
    only exit.

NEXT, IN ORDER: read the twohost.rs / twohost_web.rs gate shape and lan_bootstrap_e2e.rs's endpoint
shapes (in flight now), write crates/spt-daemon/tests/twohost_bootstrap.rs on branch
test/304-twohost-bootstrap off 00c4dad9, make the toml row change (int stage, comment naming this lane
and the sha), run check --all-targets + clippy -D warnings with an injected control to prove the lint
saw the new file, then nextest list per ARM env to pre-register the population. Only then does todlando
get "rig built, cells listed".