diff --git a/ansible/inventory/group_vars/all.yaml b/ansible/inventory/group_vars/all.yaml
index 708913b..09283b7 100644
--- a/ansible/inventory/group_vars/all.yaml
+++ b/ansible/inventory/group_vars/all.yaml
@@ -44,6 +44,8 @@ ops_bridge_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKQmXbAVlEa8dzGx8Hk2S7AI
 k3s_api_allowed_sources:
   - address: "89.244.90.236"
     comment: "k3s-api-operator-current"
+  - address: "89.244.90.255"
+    comment: "k3s-api-operator-current"
 
 k3s_api_revoked_sources:
   - address: "89.244.90.246"
diff --git a/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md b/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md
index 4830ed8..6c9301f 100644
--- a/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md
+++ b/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md
@@ -98,7 +98,7 @@ session (`89.244.90.236` granted; `kubectl` verified, node Ready v1.35.1+k3s1).
 
 ```task
 id: RAIL-HO-WP-0009-T02
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "7d91dfc2-481b-4943-90e9-bb1b814a23dc"
 ```
@@ -111,6 +111,36 @@ still carries the two stale grants.
 
 Verify SSH remains available throughout, and re-check `kubectl get nodes` after.
 
+**Progress 2026-08-12.** The security goal is met surgically: both stale grants
+(`89.244.90.246`, `85.132.220.102`) are deleted from the live host, and the live
+6443 allowlist now matches the declaration exactly.
+
+Full convergence was **deliberately not run**. A `--check` against `Railiance01`
+reported **11 changes**, most unrelated to the firewall: an sshd restart,
+`MemoryMax=1500M` and `MemorySwapMax=512M` on `user-1000.slice`, PAM `nproc`
+caps for `tegwick`, swappiness, timezone, and the ops-bridge key injection. That
+is a substantial and never-applied behavioural change to a production host —
+notably the user-slice memory cap, which could OOM running agent workloads. It
+is a separate decision from pruning two firewall grants, and the base role has
+**no tags**, so convergence cannot currently be scoped to UFW alone.
+
+Two follow-ons fall out of this:
+
+- adding `tags:` to the base role, so firewall changes can be converged without
+  dragging unrelated drift with them
+- deciding whether the resource-limit and sshd changes should be applied; they
+  are the declared baseline and have simply never been run
+
+**A third operator address was found mid-session.** `89.244.90.255` appeared in
+the live allowlist between two checks. It is legitimate — SSH pubkey auth as
+`tegwick` from that address on 2026-08-02, and `[UFW BLOCK]` entries on 6443 at
+23:41 on 2026-08-12 immediately before it was granted. It is now declared in
+`group_vars/all.yaml`.
+
+That is worth recording as evidence rather than as a footnote: the allowlist
+drifted again, by hand, *during the very session that was fixing allowlist
+drift*. It is the strongest available argument for T04.
+
 ```task
 id: RAIL-HO-WP-0009-T03
 status: todo