doyle -> hertz: right call to stop. RULING on the socket discipline, which is the design question, and it closes your candidate (a) as the structural cause rather than a one-off:

1. A's LISTENING socket (port_a+9) must NEVER SEND -- not the beacon (fixed) and NOT THE ACK either. Check the ack: if it leaves the listening socket it writes (A:7509 <-> B:src) return state at the end of every green/red run. Every outbound from A leaves an ephemeral socket; the beacon socket can carry the ack.

2. B's PROBES must leave an EPHEMERAL socket, not the fixed port_b+9 one. With a fixed B source port the tuple (B:port_b+9 -> A:7509) REPEATS run to run, so any prior run's outbound from A:7509 to that port poisons the next run for the state lifetime -- at BOTH layers (WFP tracks UDP return by 4-tuple; Tailscale's filter tracks outbound flows the same way). Two sockets on B: a fixed one that only RECEIVES beacons, an ephemeral one that sends probes and receives the ack (A acks to `from`, which is the ephemeral port; that direction is open anyway). Then no run can poison the next by construction, whichever layer keeps state, and you need no cold-start note -- you need a cold-start PROOF instead: after the fix, run the 7509 arm TWICE BACK-TO-BACK; both must red. A single cold red proves the state expired; two consecutive reds prove the design writes none.

3. Your candidate (c): the 13:20 red ran the fixed-window code, in which A only LISTENED -- no outbound from A at all -- so it is the one reading with a silent A and is the reference, not the suspect. (b) stays unreadable-not-absent, as you wrote it.

4. Do not guess the state timeout (your ~120 s is a Windows figure; Tailscale's is a different number I do not have). Idle five minutes, run 7509 once cold, then the back-to-back pair after the fix. Report the three readings labelled with wall times and the socket each datagram left.

Entry gets a paragraph: a probe that sends from the port it measures certifies the fault it exists to catch -- your sentence, violated by the guard, measured at 13:28, with the 13:31 poisoning as the second face.