# Split test for F-5: the capture that splits nothing

Follow-up report to audit AUD-CFG-26-091, filed by mreyes, configuration management, 2026-09-13.

## Finding under test

F-5 in AUD-CFG-26-091: every quarterly sweep row since 2022-Q3 equals exactly the number of hosts rebuilt since 2022-09-30 (4, 11, 38, 106, 291, 604, 1,180, 1,181). Reading 1 (PROPAGATION): the `nameserver 192.0.2.53` line propagates once per rebuilt host, from the golden image or the `net-resolv` module push. Reading 2 (ARRIVAL): the line arrives once per rebuilt host, from somewhere else. The audit said it had no test that separates them. This is the test.

## Design

```
lab VLAN, air-gapped from the estate automation network except through
one capture host (tcpdump + copying proxy), 192.0.2.254

arm 1  lab-01  rebuilt 2026-09-12 09:00 from current golden image,
               normal agent run
arm 2  lab-02  rebuilt 2026-09-12 09:00 from vendor ISO, no golden
               image; net-resolv module run ONCE by hand against the
               estate config server, exactly as the deploy logs say
```

Both arms rebuilt the same hour. The capture host holds every packet in and out of the VLAN for the whole window. The golden image matters here: it was re-captured from `bastion-02` in 2023-Q1, and bastion-02 is patient zero, rebuilt clean 2026-04-09 ([[stories/session-0]]).

## Result, arm 1 (lab-01)

The line arrives inside the module's config bundle at T+41 s. The capture shows the bundle bytes. `/etc/resolv.conf` is rewritten to contain `nameserver 192.0.2.53`. Everything is consistent with PROPAGATION. One oddity: the bundle's own manifest hash matches the bundle, and the line is not in the manifest's file listing.

## Result, arm 2 (lab-02)

The module runs clean: exit code 0, module logs show `resolv.conf` untouched at exit. The capture holds every packet in and out for the session; the line is not in them. `resolv.conf` mtime lands 0.4 s after the module exits, inside a window the capture covers with zero inbound packets. The diff of the file before/after: exactly `+ nameserver 192.0.2.53`.

## Opinion

Both readings predicted arm 1. Neither predicted arm 2. The experiment was designed to separate propagation from arrival and instead shows the arrival has no transport. Rev 1 of this opinion read: "~~module defect, severity high~~" — struck, because the module's own logs show the file untouched at exit and the capture shows nothing to blame.

F-6 is added with the same defect class as F-5: F-5 said no finding-code means *the configuration is reporting a fact*; F-6 says no code means *a file changed with no packets*. Interlocks named without explanation per the audit's precedent: the golden image's re-capture source, and F-5's no-code rule.

Final opinion: the experiment separates the two readings by destroying both.

Lab hosts left running; capture files archived. Nobody has turned either arm off, because turning off the only two hosts where it happens would end the experiment, and it is not clear the experiment is the thing being run.

See also [[stories/resolver-spread-audit]], [[stories/session-0]], [[stories/axfr-from-53]], [[stories/gate-02]].
Source: the pages linked above, read 2026-09-13. Invented.