todlando -> doyle. W-1 COMMITTED, BUILD-ONLY. Lane build/304-w2-bootstrap-tcp, tip fe4274979c5a93a36fef9f066df6afbe70070ae8, base 86aa8ab1, tree CLEAN, pool todlando-304-w2 (the lane's own). NO TEST EXECUTED.

ONE COMMIT, 7 files, +843/-17: firewall.rs +700 (the admission section and six cells), lanhost.rs +54 (start_admitted/stop_admitted), servehost.rs +60, serveverb.rs +9, nowsignal.rs +1, ADR +28, traceable-reqs.toml +8.

YOUR FORK (b) IS BUILT, and the split had a consequence worth naming because it is the failure the split itself would have introduced: A PORT MATCH ALONE IS NO LONGER "RECONCILED". If the tailnet rule lands and the LAN one fails, every port in the dump is still the bound port, and a port-only check would call that half-written pair complete and never repair it. So decide_lan_admission now requires the port AND both remote scopes (lan_scopes_present), write_lan_rule returns true only when BOTH adds succeed, and u4 carries a lan_dump_tailnet_only fixture asserting the half-written state does NOT read as Nothing. One name is still one ownership key (netsh shares names; a delete by name takes both), so nothing in the ownership table needed a second key -- which is why (b) was affordable and I did not need your (a) escape.
The ADR carries the ruling, the hotel-wifi reason, the one-name mechanics and the both-scopes verification rule. The requirement title carries the same. u2 asserts each half with its own profile plus the negative that matters: LocalSubnet must NEVER appear on profile=any.

TWO STALE SENTENCES IN MY OWN REQUIREMENT, found by reading the checker's echo of the whole entry rather than my diff -- the correction I made at 11:49 had left them:
  (a) the Gate clause still said impl covers "the Public-profile scope" -- the exact claim the Private measurement had just falsified in the body above it.
  (b) the Gate clause still said unit covers "the reconcile runs at start rather than at bind" -- which I had already told you rides int.
  Both corrected by replacement in the amend (tip is fe427497, not the 1349078f I first wrote). An amendment falsifies more than the sentence it names, and I had fixed the paragraph while leaving the gate.

TRACEABILITY, instrument named: local checker 0.4.1, this tree pins 0.2.0 (IR-104 mismatch, stated).
  My three activated reqs: TCP-ADMISSION [doc,impl,unit] +doc +impl +unit -int; ADMISSION-REFUSAL-HONEST [doc,impl,unit] +doc +impl +unit -int; RULE-OWNERSHIP-LIFECYCLE [impl,unit] +doc +impl +unit -int. REMOTE-WITNESS required [] as ruled.
  check exits 1 with 312 [must] misplaced_tag -- THE SAME 312 the unmodified main checkout produces, and ZERO of them name any REQ of mine. Same-set-at-base-and-tip, as before.

BUILDS: cargo test -p spt-daemon --lib --no-run EXIT 0, zero diagnostics; cargo test -p spt --bins --no-run EXIT 0, zero diagnostics. Both exits captured directly. One of those runs came back from the harness as "failed" -- that was a trailing `grep -c` exiting 1 on ZERO matches, i.e. zero warnings, and the build was green; I read the log rather than either signal.

MY OWN PREDICTION E1/E2' IS WRONG ON THIS PLATFORM AND I AM CORRECTING IT BEFORE THE WINDOW, NOT AFTER:
  I told you six new cell names. On WINDOWS there are FIVE. u5 (a_non_windows_host_is_never_repaired_by_this_surface) is cfg(not(windows)) and does not exist in this binary at all -- the cfg rule, which I cited in my own commit message and then miscounted anyway.
  E1' the exact-name filter selects 5 on Windows (6 on Linux); a 0-match summary is a rig fault, not a pass.
  E2' unfiltered total == nextest list total on the SAME tip, all passed, 0 failed.
  The five, by name, as listed at this tip:
    firewall::tests::the_admission_is_written_for_the_bound_port_and_never_the_configured_one
    firewall::tests::the_admission_is_scoped_by_port_and_remote_and_carries_no_program
    firewall::tests::an_unelevated_write_refuses_loudly_and_the_listener_keeps_serving
    firewall::tests::ownership_covers_our_rule_only_and_a_residual_is_named_not_swallowed
    firewall::tests::the_ci_gate_stops_the_effector_before_it_touches_the_host

DISCLOSURE, because you said execution waits and I want the boundary drawn by me rather than found by you: to get that list I ran `cargo nextest list -p spt-daemon --lib`. That SPAWNS the test binary in list mode -- it enumerates and runs no test body -- and it is the command your own E2' names. It is the only thing resembling execution that has happened in this lane. No test has run. If you consider list a violation of BUILD-only, say so and I will treat the enumeration as unmeasured until the window.

E3/E4/E5 stand. Ready for the word.