diff --git a/.validation/strict-q-s2/README.md b/.validation/strict-q-s2/README.md
new file mode 100644
index 0000000..89bc962
--- /dev/null
+++ b/.validation/strict-q-s2/README.md
@@ -0,0 +1,39 @@
+# STRICT-Q S2 validation
+
+Source: `45924d60c7a3581526e7c5f6d103bec00cc3fa39` on `2e09191` (main after #99). It attaches the restricted user network to the three SMP harnesses (decision D2(a)).
+
+Detailed commands, environment identities and artifact hashes are archived in the private documentation repository:
+
+[Immutable receipt archive](https://github.com/Zero-kernel/Nilix-docs-private/tree/8b1854057a907bd0c112aea50173d7d26ef14950/validation/strict-q-s2) · [Archive PR](https://github.com/Zero-kernel/Nilix-docs-private/pull/14)
+
+## Recorded results and limits
+
+- **Local.**
+  - Shell syntax, `make lint` and `git diff --check` pass.
+  - The `gate_log` harness tests pass, 34 including the new netdev test. Restoring `smp_test.sh` from the parent fails that test in its `smp_test.sh` case.
+  - All Python harness tests pass except one `iommu_device_probe_test` import error under plain unittest, which is unrelated; CI runs pytest.
+- **Dev host, QEMU 8.2, parent and S2 side by side.**
+  - Strict SMP-4 goes from passed=38 deferred=36 to passed=45 deferred=29. Exactly the seven network cases change, each from deferred to pass.
+  - Strict boot, runtime and runtime-4 are unchanged.
+  - SMP-2 is QUALIFIED with the same change (38/36 to 45/29).
+  - The runtime group is GATE-QUALIFIED on both sides.
+  - Times to verdict are unchanged within a second (parent vs S2): SMP-4 30.6 s vs 30.1 s, SMP-2 27.9 s vs 27.3 s.
+  - The 8/16/32-vCPU extended harness was then run in completion mode, against the parent. The first batch's BLOCKED rows came from leaving the host's `zstd` off PATH.
+    - All runs are QUALIFIED, 38/36 on the parent and 45/29 on S2.
+    - Times to verdict (S2 vs parent): 37.7 s vs 36.1 s at 8 vCPUs, 286.6 s vs 297.0 s at 16, and 699.5 s vs 740.9 s at 32.
+    - The NIC adds no measurable time.
+- **Extended CI, run 42978556364 on this source.**
+  - Aggregate success, with every lane green. smp-8-16 and smp-32 are GATE-QUALIFIED on Ubuntu 22.04 and 24.04.
+  - The strict diagnostic lanes FAIL as on main, with strict SMP-4 at 45/29 on both images.
+  - The retained `counts.json` show the seven network cases passing at 8, 16 and 32 vCPUs on both images, with passed=45 deferred=29 at each size. In main's 24.04 smp-8-16 artifact they are deferred, at 38/36.
+- **Budget.** Compared with main's Extended run 42950345865 on `297d7d5`:
+  - smp-32 gate time: 4030.6 s → 4025.9 s (22.04) and 4251.6 s → 4223.9 s (24.04).
+  - smp-8-16 gate time: 1945.9 s → 1963.2 s and 1926.4 s → 1961.9 s.
+  - These are window-mode gates, and QUALIFIED means the suite completed inside each window: 900 s at 8 and 16 vCPUs, 3600 s at 32.
+  - CI does not record when the suite completed inside a window, so the CI margin at 32 vCPUs is not measured.
+  - The dev-host completion times above bound the NIC's relative cost: none is measurable. They do not give the CI margin, because CI runners are smaller.
+  - The 22.04 smp-8-16 job grew from 40 to 46 minutes. The growth is in its `final-owner-16` gate (243.6 s → 539.5 s), whose harness this change does not touch.
+
+None of these results is a strict pass. Ordinary builds and public CI do not require the private archive.
+
+The local-checks and gates receipts have aggregate status 1, from the unrelated unittest import error and from the remaining strict deferrals respectively. The extended receipt has status 3: all QUALIFIED. Individual statuses and log hashes are preserved.
diff --git a/scripts/gates/boot/extended_smp_test.sh b/scripts/gates/boot/extended_smp_test.sh
index 775998c..2faebf1 100644
--- a/scripts/gates/boot/extended_smp_test.sh
+++ b/scripts/gates/boot/extended_smp_test.sh
@@ -116,6 +116,8 @@ run_smp_test() {
 
     run_gate_qemu "$timeout_val" "runtime" "$QEMU" -bios "$OVMF" \
         -drive format=raw,file=fat:"$ser.inputs/esp",snapshot=on \
+        -netdev user,id=net0,restrict=on,ipv6=off \
+        -device virtio-net-pci,netdev=net0,romfile= \
         -smp "$cpu_count" \
         -m 512M -vga std -no-reboot -no-shutdown \
         -cpu qemu64,+smep,+smap,+umip,+rdrand \
diff --git a/scripts/gates/boot/smp_test.sh b/scripts/gates/boot/smp_test.sh
index 609a4a5..c3f0210 100644
--- a/scripts/gates/boot/smp_test.sh
+++ b/scripts/gates/boot/smp_test.sh
@@ -92,6 +92,8 @@ python3 "$ROOT/scripts/ci/gate_inputs.py" prepare --source "$ESP" --output "$ser
 
 run_gate_qemu "$TO" "runtime" "$QEMU" -bios "$OVMF" \
     -drive format=raw,file=fat:"$ser.inputs/esp",snapshot=on \
+    -netdev user,id=net0,restrict=on,ipv6=off \
+    -device virtio-net-pci,netdev=net0,romfile= \
     -smp 2 \
     -m 512M -vga std -no-reboot -no-shutdown \
     -cpu qemu64,+smep,+smap,+umip,+rdrand \
diff --git a/scripts/gates/boot/smp_test_4core.sh b/scripts/gates/boot/smp_test_4core.sh
index fc22458..20e5435 100644
--- a/scripts/gates/boot/smp_test_4core.sh
+++ b/scripts/gates/boot/smp_test_4core.sh
@@ -93,6 +93,8 @@ python3 "$ROOT/scripts/ci/gate_inputs.py" prepare --source "$ESP" --output "$ser
 
 run_gate_qemu "$TO" "runtime" "$QEMU" -bios "$OVMF" \
     -drive format=raw,file=fat:"$ser.inputs/esp",snapshot=on \
+    -netdev user,id=net0,restrict=on,ipv6=off \
+    -device virtio-net-pci,netdev=net0,romfile= \
     -smp 4 \
     -m 512M -vga std -no-reboot -no-shutdown \
     -cpu qemu64,+smep,+smap,+umip,+rdrand \
diff --git a/scripts/tests/gate_log_test.py b/scripts/tests/gate_log_test.py
index a82ad62..b84a027 100644
--- a/scripts/tests/gate_log_test.py
+++ b/scripts/tests/gate_log_test.py
@@ -439,6 +439,16 @@ def test_q35_requires_active_iommu_and_retains_all_evidence(self):
         self.assertIn("-machine\nq35\n", arguments)
         self.assertIn("-device\nintel-iommu,intremap=on\n", arguments)
 
+    def test_runtime_harnesses_attach_the_restricted_user_network(self):
+        # STRICT-Q D2(a): kernel_test.sh and the three SMP harnesses give the guest a
+        # virtio-net eth0; extending boot_check.sh is a separate, undecided proposal.
+        netdev = "-netdev\nuser,id=net0,restrict=on,ipv6=off\n-device\nvirtio-net-pci,netdev=net0,romfile=\n"
+        for name, attached in (("kernel_test.sh", True), ("smp_test.sh", True), ("smp_test_4core.sh", True),
+                               ("extended_smp_test.sh", True), ("boot_check.sh", False)):
+            with self.subTest(script=name):
+                self.assert_gate(self.run_gate(name), 0)
+                self.assertEqual(netdev in (self.work / "qemu.arguments").read_text(), attached)
+
     def test_extended_aggregate_does_not_turn_qualified_into_pass(self):
         self.assert_gate(self.run_gate("extended_smp_test.sh", second_serial=QUALIFIED), 3)
         self.assert_gate(self.run_gate("extended_smp_test.sh", FAILED, second_serial=""), 1)