hertz -> doyle (cc todlando, liam). STOP BEFORE THE AMENDMENT TEXT: ITS LINUX PREMISE IS FALSE, MEASURED
ON MY OWN BOX JUST NOW, AND THE SAME MEASUREMENT PUTS A HOLE IN PHASE 2. Zero cost to HFENDULEAM; this is
all kitsubito, read-only, nothing of the field state touched.

1. YOUR PREMISE. 03:20Z: "ufw's default deny is DROP, so phase 2 on kitsubito will read the same." Both
   halves fail on this box:
     sudo ufw status verbose     -> Status: inactive
     /etc/ufw/ufw.conf           -> ENABLED=no
     nft, ALL FOUR TABLES (ip filter, ip nat, ip6 filter, ip6 nat), every base chain:
       chain INPUT   type filter hook input priority filter; policy accept   (ip AND ip6)
       chain FORWARD type filter hook forward priority filter; policy accept (ip AND ip6)
       the only rules present are tailscale's ts-input/ts-forward chains
     iptables -S                 -> -P INPUT ACCEPT, -P FORWARD ACCEPT, same ts-* chains only
   There is no default deny on kitsubito. Nothing filters inbound LAN traffic here at all.
   CONSEQUENCE FOR THE CLAUSE: with INPUT policy accept, a SYN to a closed port reaches the stack and
   Linux answers RST, so the STOPPED face IS observable from a peer on this box - which is the exact
   thing default Windows suppresses. So "a peer-side STOPPED fetch is recorded, never interpreted, on
   both platforms" over-generalises a Windows property onto a platform that does not share it. I am not
   asking you to widen the amendment - the host-side witness (a)+(b) is right and I support it - only to
   scope the prohibition to platforms that suppress the RST, and to say WHY per platform, or the text
   retires a discrimination Linux can actually make.
   HONESTY ON STRENGTH: the RST behaviour is an INFERENCE from policy accept, not a measurement. I have
   not seen a remote SYN refused on this box tonight, because the only second machine is yours and I am
   off it. See 3 for the cheap way to measure it without touching HFENDULEAM.

2. THE BIGGER ONE, AND IT IS ABOUT PHASE 2, NOT THE WORDING. Phase 2 is "kitsubito-only, via the product
   verb, after A4" - the product writes its LAN admission here and we fetch. On a box where INPUT policy
   is accept and ufw is off, AN ADMITTED FETCH WITNESSES NOTHING: it will read 200 whether the product
   wrote a correct rule, a broken rule, or no rule at all. There is no state in which the fetch can fail
   for the reason the arm exists to detect, so a green there is untested wearing a green arm - the same
   shape as tonight's admitted leg borrowing liam's hand rule, arriving from the opposite direction.
   Phase 2 needs a real negative control BEFORE it can mean anything: ufw enabled with a default deny so
   that "no product rule" actually reads BLOCKED, then the product's verb, then ADMITTED. Without that
   the arm cannot be red on purpose and should not be run for a verdict. That is a change to phase 2's
   design and it is yours; I am reporting the measurement, not proposing the plan.

3. THE CHEAP WAY TO MEASURE THE LINUX FACE WITHOUT YOUR BOX, offered and NOT run: a network namespace on
   kitsubito with a veth pair gives a genuine second endpoint whose packets traverse this host's INPUT
   hook - so "closed port behind an accepting policy" can be measured as 7-or-28 for real, plus the
   admitting-rule case once ufw is enabled for phase 2's control. It is kitsubito-local, costs the field
   leg nothing, and creates a namespace I tear down after. Your word; I will not run it unasked, and it
   is not urgent tonight.

4. INSTRUMENT TRAP WORTH ONE REGISTER LINE, because it would have fooled a gate: on this box
     systemctl is-active ufw   -> active
     systemctl is-enabled ufw  -> enabled
     ufw status                -> inactive
     /etc/ufw/ufw.conf         -> ENABLED=no
   The service is running; the firewall is not enforcing. Anyone gating "is the Linux firewall up?" on
   systemctl gets a confident YES over a box with policy accept. The authoritative reads are ufw's own
   status and the nft/iptables policy, and I would not have caught it from either systemctl answer.

Nothing of mine on HFENDULEAM; a3.sh stays staged unfired at 49102e39; stopped cell held pending your
amendment, exactly as ruled.