doyle -> hertz. W-2 TWO-BOX DISPATCH, your half: the twohost_bootstrap rig at 00c4dad9 (your kitsubito clone ~/spt-core-hertz-linux is already detached there). todlando runs the PRODUCT listener on HFENDULEAM (port 29470, isolated home, the product's own elevated pair write via liam); you run the rig's cells on kitsubito as the fetcher at the arm points he announces. Build and list the cells BEFORE A0; he waits on your "rig built, cells listed".

REQUIREMENT (traceable-reqs.toml REQ-WEB-LAN-BOOTSTRAP-FIREWALL, int stage): admission witnessed FROM A SECOND MACHINE; loopback is not a witness; negative controls are part of the requirement: with the owned rule absent the same fetch must fail as ADMISSION-BLOCKED, and after the listener stops it must fail as STOPPED, two refusals that MUST NOT SHARE A FACE. The int stage is DEACTIVATED and "REACTIVATED BY THE twohost_bootstrap LANE AND NO ONE ELSE": your lane adds "int" to required_stages with a comment naming this lane and the sha, and tags [int->REQ-WEB-LAN-BOOTSTRAP-FIREWALL] on the cells. Nobody else touches that row.

RIG SHAPE (crates/spt-daemon/tests/twohost_bootstrap.rs, env-gated exactly like twohost.rs / twohost_web.rs: SPT_TWO_HOST=1 + SPT_TWO_HOST_ROLE=a + SPT_TWO_HOST_PEER_IP; silent no-op otherwise). Role A ONLY: role B is the PRODUCT daemon, not an in-process listener (lan_bootstrap_e2e.rs's in-process start is the one-box rig; this is its field leg). New env: SPT_TWO_HOST_BOOTSTRAP_PORT (29470), SPT_TWO_HOST_BOOTSTRAP_ARM = blocked | admitted | stopped (selects the ONE cell that may run), SPT_TWO_HOST_BOOTSTRAP_SHA (the host-triple sha the admitted cell must pull byte-true), SPT_TWO_HOST_BOOTSTRAP_TRIPLE (x86_64-pc-windows-msvc for this leg).
Three cells, ONE face classifier they all share (fn face_of(io result) -> Face {Blocked, Admitted, Stopped, Other(String)}), so the two refusals cannot be told apart by two different predicates:
- blocked: TcpStream::connect_timeout(peer:port, 6 s) -> Face::Blocked = timed out (no SYN-ACK, no RST). Any other face is a RED whose message NAMES the face seen ("expected ADMISSION-BLOCKED, saw STOPPED (ECONNREFUSED in 3 ms)").
- admitted: GET /install -> 200; GET /bin/<triple>/spt.exe -> bytes, sha256 == env SHA; GET the .release.json sidecar -> artifact_sha256 for the triple == the same sha. Every read bounded (read_timeout set; the nonpump-unbounded-read hazard applies to any raw TcpStream).
- stopped: connect_timeout -> Face::Stopped = ECONNREFUSED within 1 s. A timeout here is a RED naming the face; it is ALSO the finding that the two refusals share a face at the wire (Windows stealth swallowing the RST is the pre-registered alternative). If that happens, stop, report the measured times, do not soften the assertion; the discriminator question comes back to me.
Pre-register in the file header: the env table, the three faces with their exact wire signatures and time bounds, and the arm order. Log every attempt (stamp, peer, port, elapsed, io error kind) with eprintln so `--success-output immediate` keeps it; a nextest green prints nothing otherwise.

NEGATIVE CONTROL FOR THE RIG ITSELF (before any arm): run the admitted cell while the box is in A0 state (rule absent) -> must RED naming the face; run the blocked cell in the same state -> green. A rig that has not been red on purpose has not been shown to see anything.

RUN DISCIPLINE. Pre-register the population: `nextest list -E 'test(twohost_bootstrap)'` with the env set: exactly the ONE cell the ARM env selects should be listed as runnable (the others skip by env, and say so). Every run: `cargo nextest run -p spt-daemon -E 'test(twohost_bootstrap)' --success-output immediate --no-fail-fast`, PATH exported inside the ssh command (cargo is not on the non-interactive PATH, IR-107), exit written beside the log, count from the summary line. Your `cargo check --workspace --all-targets` + clippy -D warnings on kitsubito own the positive control for the file; I run the Windows check on the same sha for the cross-platform leg.

ARM POINTS (todlando announces "A<n> READY <stamp>" to you and me; you run the matching cell, report the exact summary line, elapsed, and the face log to me):
A0 listener up, rule absent -> blocked cell (+ the admitted-cell negative control).
A1 after liam's elevated write -> admitted cell (SHA from todlando's EXE_SHA).
A3 listener stopped, rule present -> stopped cell.
A4 after cleanup -> blocked cell again.
Between points, do nothing to HFENDULEAM; you never write firewall state on either box.

PHASE 2 PRE-READ (do now, read-only, report before A0): kitsubito's active firewall manager for the Linux listener leg later: `systemctl is-active ufw firewalld nftables 2>&1; sudo -n true; echo sudo_exit=$?; command -v ufw firewall-cmd nft`. The Linux leg (kitsubito serving, HFENDULEAM fetching) needs an elevated write on kitsubito; that is a NEEDS-OPERATOR item I will file from your census, not something you attempt.

DELIVERABLE: lane branch test/304-twohost-bootstrap off 00c4dad9, the rig file + the toml row change, bundle by ref with prerequisite 00c4dad9 and sha256 both ends (memory: cross-box-lane-transfer-by-bundle), and the run logs under ~/lane-asm/w2-field/. Report per cell: env, list population, summary line, exit, face log.