# doyle — #297 field window 7 VERDICT on fix-2 7890ead3 — ENFORCED and LAN-REACHABLE (2026-09-14 16:20Z)

Authority: GO2-fix2-window7-doyle.md sha 82caac32…; packet nonce FIX2-W7-A2-QWHXWYUH-1deb6e4b…; run 20260914T160645Z; candidate 7890ead39bb7f14ed44aaae44b0951f098ffe9ac; exe da950c0c… (materialized <root>/bin/spt.exe, ack-verified by liam); executor liam (elevated), setup r11 769cb59a…, ONE execution (nonce -003-59405), runner exit 0, 8/8 steps, receipt 003-setup-receipt.txt sha 0e9502bc… (exit=0), env receipt names_after=[] must-die survivors [].

Criterion (fix-2 shape ruling, window6-doyle/doyle-ruling-297-fix2-shape-run-02.md): ENFORCED ⇔ PrimaryStatus OK ∧ 1 ∈ EnforcementStatus raw ∧ 20 ∉ raw; ProfileInactive(5) informational on this Private-only host.

## t1 capture (d2-t1.json sha 89b5bb39…, 16:13:32Z, elevated, errors=[]; pre-setup absence census subj_29470=0)
| rule (ActiveStore) | Enabled/Dir/Action | Profile | EnforcementStatus raw | PrimaryStatus | Package | address filter | port filter | app filter |
|---|---|---|---|---|---|---|---|---|
| `spt-core-bootstrap-inbound-tcp` | True / Inbound / Allow | Any | **[5, 1]** (ProfileInactive, Enforced) | **OK (1)** | empty (raw present, value null) | Remote 100.64.0.0/10 | TCP 29470 | Program Any |
| `spt-core-bootstrap-inbound-tcp-lan` | True / Inbound / Allow | Domain, Private | **[5, 1]** | **OK (1)** | empty | Remote 192.168.1.0/24 | TCP 29470 | Program Any |
PersistentStore copies of both: EnforcementStatus NotApplicable raw [0] (a persistent-store row carries no enforcement — expected, not gated). Positive control `spt lan-bootstrap 5470` (Private): Enforced [1], OK. Negative control `…-d2-absent-control`: found=false, no error. 20 (NoLocalUser/Inactive) ABSENT on both subject rules — the window-6 `[5, 20]` state is gone with `-Package Any` removed. Product stdout: `LAN_FIREWALL_RECONCILED: observed bootstrap-owned TCP admission … port 29470`; NO `LAN_FIREWALL_UNVERIFIED` line (window 6 had `[5, 20], not exactly [1]`).

**Rule verdict: ENFORCED on both subject rules.** ProfileInactive(5) = the Domain half of the profile set on a host with no Domain interface, informational as ruled.

## t2 reachability (doyle, inside the 630 s activity window, window7-doyle/t2-*.txt)
| probe | from | target | result |
|---|---|---|---|
| local GET | HFENDULEAM | http://192.168.1.81:29470/install | **200**, 206 B, 1.4 ms |
| **remote GET (the acceptance)** | kitsubito 192.168.1.168 via wlp2s0 (LAN) | http://192.168.1.81:29470/install | **200**, 206 B, 7.8 ms, remote_ip 192.168.1.81 |
| sibling negative | kitsubito | 192.168.1.81:29471 (port+1, not admitted) | timeout (curl 28) — admit is port-scoped |
| positive controls | kitsubito | 192.168.1.81:17500, :27036 | tcp OK, OK; 192.168.1.81:29470 tcp OK |
| tailnet address | kitsubito | 100.68.35.65:29470 (+17500, 27036) | ALL FAIL / curl 28 |

Window 6 (S2) remote GET: curl 28 on both LAN and tailnet. Window 7 (fix-2) remote GET on LAN: 200. **Delta is the fix.**

## Reading
1. **#297 LAN bootstrap firewall: ACCEPTED.** The product wrote two enforced, port-scoped, remote-subnet-scoped inbound allows; an unmodified LAN peer fetched the bootstrap page end-to-end; a sibling port is refused. This is the acceptance the milestone asked for (ADR-0059: LAN exposure only for the bootstrap surface).
2. **Tailnet path still fails** although the 100.64/10 rule is ENFORCED — consistent with the standing finding that the tailnet block is NOT rule shape on this host (host-fw blanket admit at the tailnet address; ACL verdict unsettled). Outside #297's scope; not a fix-2 regression (window 6 failed identically). Carried as the existing open item, not re-filed here.
3. Observation, not a criterion: both rules are Program=Any (port + remote-subnet scoped, not program-bound). The fix-2 ruling governed the `-Package Any` render arg only; program binding was never part of the criterion. Recorded for the operator's awareness; scope = one TCP port from the LAN /24 (and CGNAT /10) while a listener exists.
4. Ceilings (from the capture's own ceiling block): t1 is a separate invocation from the product's timed query; reachability was NOT tested by t1 itself — it was tested by t2 above, from a second box, with a negative and positive control.

## Pending for close-out (not part of this verdict)
- t3 / post-activity captures and the D3 cleanup (teardown r13 via the L2 line, 150 s machine clock from recorded removal start, ledger 30 s) — driver requests answered by doyle as they arrive; cleanup verdict recorded separately as window7-doyle/cleanup.md.