Two commits: the guard (`golden.yml` +50, `twohost_web.rs` +347) and its IR-89 register amendment (+48). Closes the workflow half of IR-89.

## Why

A golden run spent 900 s on each half discovering that B's datagrams never reached A — 75 QUIC dials, each dying on its 10 s bound, cadenced at exactly 12.00 s, never one ADMIT. Two layers were behind it and **either alone produces the same silence**: the receiver's per-executable host firewall, and an asymmetric tailnet ACL. It was triaged as product, then as rig, before it was measured as box.

These cells ask that question first, in their own words, as their own step before the ceremony. The probe **is** the test binary — the Windows rule is per-executable, so a pwsh or python probe would go green the moment anyone allowed the prober and would certify the exact failure it exists to catch.

## The four corrections the design needed

Each is a way a probe can certify the fault it exists to catch, and each is measured, not argued.

1. **No fixed symmetric window.** A step boundary orders the probe on one host; it does not align two. The first hand-run redded `INBOUND_BLOCKED` at 10.24 s because cargo's start-up on the *sender* put its first datagram after the receiver's window closed — an innocent box, convicted by the guard's own text. Rendezvous is now data: A beacons, B starts its ten-second clock only on the first beacon, and "no beacon" is a fourth outcome (`PROBE_NO_BEACON`) rather than a firewall accusation.
2. **The listening socket never sends.** Any outbound from the measured port opens stateful return state, so the probe then arrives *solicited* and crosses under both faults. With the beacon on A's listening socket, the out-of-grant control went **green** on a port a listen-only run had measured **blocked** eight minutes earlier.
3. **The ack goes to the rig port, not to `from`.** Acking to the probe's source port produced a run that contradicted itself — A said `INBOUND OK`, B said `INBOUND_BLOCKED`, same run — because the ack isn't return traffic of the flow B opened and a port-range inbound rule drops it.
4. **The falsifier is the operator's own rule.** Forcing the probe port one port outside the granted range reds the guard on demand, with no elevation and no policy edit.

## In-situ results (2026-09-09, hfenduleam + kitsubito)

| arm | wall | result |
|---|---|---|
| dir 1 — A=hfenduleam, B=kitsubito, udp 7489 | 13:45:14 → 13:45:18Z | **GREEN**, ack after 1 datagram, exits 0/0 |
| dir 2 — A=kitsubito, B=hfenduleam, udp 7489 | 13:45:41 → 13:45:58Z | **GREEN**, ack after 1 datagram, exits 0/0 |
| control — probe port 7509, outside the grant | 13:43:41 → 13:44:23Z | **RED**, A after 40 s / 39 beacons, B 48 datagrams no ack, exits 101/101 |
| control — same, immediately again | 13:44:25 → 13:45:07Z | **RED**, same shape, 47 datagrams, exits 101/101 |

Two consecutive reds are the proof the design writes no state of its own; one would only have proved a timeout expired. Both hosts ran byte-identical source (md5 `f31779339266f8034dcd72917c56a37e`, checked both sides). Free space 174.38 GiB, flat across all four arms. `traceable-reqs check` exit 0.

## What this PR does not prove

**The `golden.yml` steps are unexercised until the next golden run.** Thin CI compiles the cells and skips them — `Rig::from_env` returns `None` without `SPT_TWO_HOST` — so a green thin run says the code builds and nothing about the steps. The in-situ runs above are the field proof; the workflow half is landed-pending-golden, not verified by its own PR.

Process note, disclosed: mid-lane I ran `git checkout` on the test file to inspect whether the tree was dirty and reverted the uncommitted redesign. Recovered by replaying the edit scripts; nothing lost. The lesson banked is that a scripted edit is replayable and a hand edit is not.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01WAw9XAcTR8oSwzYPsqZoY2