Record two further drift findings in T03

UFW is entirely inactive on CoulombCore - no firewall on a host running ArgoCD,
the registry and databases - while the declared baseline says UFW active with
default deny. Same defect class as the k3s finding but in the opposite
direction: the declaration is stronger than reality, and equally undetected.
Not an emergency (6443 unreachable from outside, 22/443/80 the expected
surface), but converging that host would enable UFW on a frozen production
system and needs its own decision.

Full convergence of Railiance01 carries 11 changes, most unrelated to the
firewall and none ever applied, including a user-slice memory cap that could OOM
running agent workloads. The base role has no tags, so convergence cannot be
scoped - adding tags folded into this task.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

WORK-RECORDS.md

@@ -29,7 +29,7 @@
 | task | RAIL-HO-WP-0008-T02 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
 | task | RAIL-HO-WP-0008-T03 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
 | task | RAIL-HO-WP-0009-T01 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
-| task | RAIL-HO-WP-0009-T02 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
+| task | RAIL-HO-WP-0009-T02 | progress | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
 | task | RAIL-HO-WP-0009-T03 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
 | task | RAIL-HO-WP-0009-T04 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
 | task | RAIL-HO-WP-0009-T05 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |

workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md

@@ -159,6 +159,26 @@ Note during the same session: port `2224/tcp` is open to Anywhere on
 this role at all. Establish whether it is intended, and either declare it or
 remove it.
 
+**Second finding, 2026-08-12: UFW is entirely inactive on `CoulombCore`.**
+`ufw status` returns `Status: inactive` — no firewall at all, on a host running
+ArgoCD, the container registry and databases. The declared baseline
+(`docs/verification.md`) says "UFW active, default deny inbound". Not an
+emergency: 6443 is not reachable from outside (k3s appears bound locally or a
+provider firewall is in front), and 22/443/80 are the expected surface. But it
+is the same defect class as the k3s finding, in the opposite direction — the
+declaration is *stronger* than reality here, and equally undetected.
+
+Converging `CoulombCore` would **enable UFW on a frozen production host**, which
+is a real availability risk and must not be done casually. Treat as its own
+decision.
+
+**Third finding: full convergence carries unrelated drift.** `--check` against
+`Railiance01` reports 11 changes, most of them not firewall-related and none
+ever applied — an sshd restart, `MemoryMax=1500M` / `MemorySwapMax=512M` on
+`user-1000.slice`, PAM `nproc` caps, swappiness, timezone. The user-slice memory
+cap in particular could OOM running agent workloads. The base role has **no
+tags**, so convergence cannot be scoped. Add tags as part of this task.
+
 ```task
 id: RAIL-HO-WP-0009-T04
 status: todo