--- name: a-probe-must-share-the-identity-of-what-it-vouches-for description: "2026-09-08: hfenduleam's firewall is BlockInbound with PER-EXECUTABLE allow rules, so a pwsh/python/bash probe carries a different identity than twohost_web-.exe. A shell probe would agree with reality only by coincidence and go green the moment the PROBER was allowed." metadata: node_type: memory type: feedback --- A golden twohost run burned 900 s on EACH half because B's datagrams never reached A: Windows BlockInbound on every profile, allow rules naming only exes under `Documents\projects\spt-core\target` and a DEAD `_work\spt-core` path, none for any `twohost_web-*.exe`. The runner is a service, so the Allow dialog never appears. Every QUIC dial died on its 10 s bound — 75 of them at exactly 12.00 s cadence (10 s bound + 2 s rig sleep), never one ADMIT. The obvious rider was a shell/pwsh probe step. **It would have been wrong**, and today it would have LOOKED right: the Windows rule is PER-EXECUTABLE, so an allow rule naming pwsh says nothing about the test binary. Both are blocked today, so a shell probe agrees with reality by coincidence — and goes GREEN the moment anyone allows the PROBER, certifying the exact failure it exists to catch. **Why:** a probe asserts a property OF SOMETHING ELSE. It is only evidence where it shares whatever the property is keyed on — here, executable identity. This is the boundary-crossing rule again: a control that does not cross the boundary the guard faces proves the guard FIRES, never that it SEES. **How to apply:** - Put the probe IN the binary whose reachability/permission/identity is in question, as its own `#[test]` cell, and run it as a SEPARATE invocation before the real work (inside one `cargo test` the cells are threads and nothing orders them — only a step boundary orders them). - Assert on the side that can OBSERVE the property. A sender cannot tell a dropped datagram from a delivered one; the receiver can. Put the assertion there. - Mint the probe's OWN outcome (`INBOUND_BLOCKED`), never reuse the real path's error, or it inherits the ambiguity it exists to remove. - Corollary for the FIX: the operator rule must be PORT+REMOTE scoped, never program-scoped, or the next rebuild's binary hash orphans it exactly as the dead `_work\spt-core` rules were. A same-binary probe stays correct under either rule, which is the second reason it wins. - A latency probe may be an instrument that never gates (`link-probe.sh` says so of itself, rightly): latency is CONTINUOUS and "bad" is a judgement. A reachability probe SHOULD gate: delivery is BINARY, and a false precondition is not a slow one. **AND THE PROBE MUST NOT NAME A CAUSE IT DID NOT MEASURE** (banked as the IR-82 design rule). This failure had TWO layers — the host firewall AND an asymmetric TAILNET ACL (a member device may open flows TO a tagged resource; the reverse is denied, so the receiver permits inbound from a list the sender is absent from). EITHER ALONE produces identical silence, so the first fix looks wrong when it changes nothing. The probe therefore reds one outcome — "the box cannot receive, stop triaging the product" — and hands over the ONE measurement that separates the layers rather than guessing: bind the SAME listener and send once over the LAN and once over the overlay. LAN receives and overlay does not = ACL. Neither = firewall (or both). **Solicited return traffic works under either fault, so an echo reply proves nothing about the cold direction** — that sentence is what stopped the first RCA one layer short, and it belongs in the failure text, not in a thread. Related: [[a-single-idle-sample-of-a-busy-box-is-a-lull]], [[golden-twohost-is-cross-os-and-a-count-is-not-an-owner]], [[dont-infer-a-mechanism-from-wording-open-the-emitter]].