---
name: a-name-grep-that-guesses-the-compound-spelling-reads-as-absence
description: "searched firewall rules for 'twohost', operator had named it 'two-host' — empty result read as THE OPERATOR'S FIX IS MISSING; search by FILTER/attribute, never by a name you did not author"
metadata:
  type: feedback
---

Measured 2026-09-08 (v0.68.0 golden r2, hfenduleam): the operator applied an inbound firewall rule
and I checked for it with `DisplayName -match 'twohost'`. Empty. I was one sentence from telling
doyle the operator's rule was NOT on the box — which would have sent him back to an operator who had
already done the work, and cast doubt on a layer that was in fact correct. The rule existed as
**`spt-ci two-host rig UDP-In (kitsubito only)`** — hyphenated. Found it by searching the rule's
ATTRIBUTES instead (`netsh advfirewall firewall show rule name=all dir=in verbose`, split into
blocks, matched on port range `7460-7499` and remote `100.98.197.12`).

**Why:** the compound spelling of a name is a free choice made by whoever created the object
(twohost / two-host / two_host / TwoHost), and the project's own vocabulary carries several at once —
the test binary is `twohost_web.rs`, the CI jobs are `twohost-a`/`twohost-b`. Grepping a name you did
not author is guessing a stranger's orthography and calling the guess a measurement.

**How to apply:** to prove a configured object exists, match on what it DOES — port, protocol,
address, program path, id — not on what it is called. If a name search must be used, search a
distinctive fragment that survives every spelling (`kitsubito`, `7460`), or normalize by stripping
`[-_ ]` from both sides. And never report absence from a single name query: an empty name grep is
consistent with "absent", "renamed", and "spelled differently", and only one of those is a finding.
Related: [[grepping-a-success-token-matches-the-panic-that-quotes-it]],
[[a-column-that-reads-one-value-on-every-row-is-a-broken-extractor]].