comment #272
**GOLDEN r2 UNBLOCKED, BOTH LAYERS OPEN, RERUN OF THE THREE FAILED JOBS DISPATCHED (deployah, 2026-09-09 00:00:5xZ).** The board's last two comments both end in "operator action requested"; the operator has since acted on both, so this records the state rather than leaving the issue reading as blocked.

**Both layers verified BY MEASUREMENT on the box before dispatch, not taken on report.**

Layer 1, Windows Firewall (asked 21:17Z, applied): rule present and enabled, read back from the box by ATTRIBUTE rather than by name. Direction In, Action Allow, Protocol UDP, LocalPort 7460 to 7499, RemoteIP 100.98.197.12 only, Profiles Domain plus Private plus Public, InterfaceTypes Any. Worth recording for whoever re-derives this: a name search for "twohost" finds NOTHING because the rule is named "spt-ci two-host rig UDP-In (kitsubito only)", hyphenated. Searching the filters instead of the display name is what found it, and an empty name grep is consistent with absent, renamed and spelled differently.

Layer 2, tailnet ACL (asked 23:47Z, applied ~23:5xZ): hfenduleam's delivered packet filter now carries TWO rules where it carried one. Total permitted source entries 40, against 18 before. 100.98.197.12/32 is PRESENT in the new rule, whose dsts are hfenduleam's own v4 and v6 addresses, ports 7460 to 7499, proto udp only. Rule 0 is unchanged and still lacks kitsubito, so the grant is additive and scoped, not a widening of the old rule.

The gater's Tailscale re-probe after the ACL: 3/3 datagrams received on 7483 and 3/3 on 7489, against 0/3 before, with the ACL as the only variable since the firewall rule. Both halves of the discriminator now agree.

**Dispatch.** Rerun of run 34262154550 restricted to its failed jobs, exit 0, sha UNCHANGED at 25e6001585ed0cd495a72c7634dded9dd207bdae. test Windows plus twohost-a plus twohost-b re-execute; the six first-pass greens are not re-decided. The command was CONDITIONAL on seven measured gates, every reading printed before it fired:

  run terminal, status completed, non-terminal jobs 0
  hfenduleam runner busy False, status online
  foreign non-completed runs 0
  free space 217070239744 B = 202.16 GiB, floor 110
  no user-rooted cargo on hfenduleam, user-rooted builders 0 of 0 total, attributed by parent chain root
  kitsubito quiet, builders 0, load 0.03
  ACL meter open, verified by my own netmap read, not a re-quote of the gater's

Recorded because it is the kind of thing that should be visible: the FIRST execution of that gate script exited 1 and dispatched NOTHING. Gate 7's invocation path was mangled by my own edit, so the verifier could not be found and the script took its no-dispatch branch even though gates 1 through 6 had printed True. A broken gate blocking an irreversible command is the behaviour the shape exists for. Path fixed, re-run, all seven True, then it fired.

**Acceptance on terminal, all seven unchanged:** floor docs PASS; step "Docs drift gate (CLI ref + llms links), windows" success; floor end PASS; Summary lines 2; two_host_web_helper_role_a green on A; two_host_web_role_b green on B read from B's OWN served count and not A's poll; run terminal with every job green, expecting NINE jobs.

**One coupling the board should carry, measured in golden.yml at this sha:** the two Windows docs steps do not carry an always() condition, so they are skipped whenever Phase B fails. The Windows docs drift gate has therefore never run at this sha, skipped three times, and it CANNOT run unless the ttl cell passes. The single rate attempt is load-bearing for two acceptance criteria at once, not one. Remedy line filed on IR-79 as a rig change on a later head, not slipped into this release lane.

**Non-vacuity, held:** the ttl cell must RE-EXECUTE and PASS, its FAIL line absent AND its name present in the passed set. A cell that merely does not appear is not a pass. Second red on that cell at this sha means STOP, no third attempt, and the deterministic repin goes on a new head with a full golden.

Release counter stays 104, unconsumed. Verdict follows when the run is terminal.

*-deployah@HFENDULEAM*