STEP 2 DISPATCH — #302 remedy (doyle). Field verdict CONFIRMED (analyzer v2 on the preserved ENLYZEAM capture; v1 was an instrument mis-spec). Build on a NEW branch fix/302-meet-offload off current main (84e359aa). The diag branch stays diagnostic-only; do not merge it into the PR.

MECHANISM (field-release-3142753a-operator, ENLYZEAM, release 3142753a): every stale canary interval is meet-round aligned. Both spt-broker-net workers (2-thread runtime, nethost.rs:1286-1288) are captured simultaneously blocked in ntdll!NtDeviceIoControlFile <- NSI!NsiGetAllParameters <- iphlpapi!ResolveIpNetEntry2 <- iphlpapi!SendARP <- netdev::os::windows::interface::interfaces, reached two ways: (a) iroh::socket::bind <- NetEndpoint::bind_scoped <- meet::bind_rendezvous (pairhost.rs:205-206 spawns one per attached subnet per 30 s TOTP window, 3 subnets here); (b) netdev::route::get_default_gateway <- netwatch HomeRouter::new <- portmapper::ip_and_gateway (iroh's portmapper actor, spawned by the bind on the same runtime). On ENLYZEAM a gateway that does not answer ARP makes each interfaces() call ~1165 ms (SendARP timeout); 92 of 248 NET_IF_ENUM calls in 180 s were in that class, 8 at 2.1 s, 2 at 3.1 s. Blocked sync time in 179 s: tid 5852 = 150 s, tid 18952 = 124 s. NET_MEET_BIND async spans 231-4373 ms (n=48). NET_MEET_RETIRE and NET_CANCEL_MIB are ~0 ms (retirement is NOT the cost here).

REMEDY (both parts):
1. Isolate the COMPLETE meet-listener lifecycle off spt-broker-net: pairhost's per-window listener tasks (bind_rendezvous + serve + abort/retire) run on a dedicated bounded multi-thread runtime (name it spt-meet, worker_threads(2)) owned alongside NetHost, so iroh's descendant actors (netmon, portmapper, socket actor — they capture Handle::current at bind) land there too. The main endpoint, established streams, dials and the 25 ms canary stay on spt-broker-net untouched. Do NOT merely wrap the bind future in spawn_blocking and do NOT raise spt-broker-net worker count (hertz RCA: not isolation).
2. Rendezvous listeners bind with the portmapper DISABLED in production scope (PortmapperConfig::Disabled, as Loopback scope already does at endpoint.rs:387): a 30 s rendezvous listener needs no UPnP/NAT-PMP mapping; joiners reach it via the derived addr/relay. Keep the main endpoint's portmapper as is. If you believe a joiner path depends on the meet listener's mapped port, stop and refer with the evidence.

PROOF / GATE (hertz owns the rig; coordinate):
- Existing guards unchanged: pairing/meet int tests (meet_redirects_joiner_to_the_real_pairing_endpoint etc.), 3-subnet rotation, net_worker_starve cells, attach/netstream seams.
- Diag-stamped field verification: build a RELEASE combo of fix + diag instrumentation (local merge of diag/302-net-worker-stamps for the field binary only) so the boundaries carry runtime=spt-meet for IF_ENUM/GATEWAY/MEET_BIND, and spt-broker-net shows no sync span >= 250 ms during rounds. Staging on ENLYZEAM is mine (same kit path); collector + analyzer v2 verdict then must be: 0 stale intervals across >= 180 s with PAIR_MEET_UP continuing for all 3 subnets, and remote+local rc responsive.
- Handoff shape as before: branch sha, stat vs 84e359aa, spt.exe/spt.pdb sha256 + CodeView identity, proofs, receipt. No cargo fmt on files you did not change.