diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 3021ce0..1d8ee3b 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -76,5 +76,5 @@
 | task | RAILIANCE-WP-0016-T01 | done | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
 | task | RAILIANCE-WP-0016-T02 | done | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
 | task | RAILIANCE-WP-0016-T03 | done | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
-| task | RAILIANCE-WP-0016-T04 | todo | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
+| task | RAILIANCE-WP-0016-T04 | done | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
 | task | RAILIANCE-WP-0016-T05 | todo | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
diff --git a/workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md b/workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md
index 94d75a8..1e42795 100644
--- a/workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md
+++ b/workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md
@@ -63,7 +63,7 @@ reliable numbers here, because nobody has scoped them yet.
 | 8 | Deployable coverage check: every deployable → one rapp | `railiance-master` | 7 | 4 | 7 | 4 | **4.5** |
 | 9a | Telemetry: minimal metrics collection on railiance01 | `railiance-telemetry` | 8 | 5 | 5 | 4 | **4.5** |
 | 9b | Telemetry: one expectation-based alert (needs 10b) | `railiance-telemetry` | 8 | 5 | 2 | 2 | **7.5** |
-| **10a** | **Run `make verify`; tighten the UFW assertion to check the allowlist** | `railiance-infra` | 8 | 7 | 9 | 1–2 | **12.0** |
+| ~~10a~~ | ~~Run `make verify`; tighten the UFW assertion~~ **DONE 2026-08-12** | `railiance-infra` | 8 | 7 | 9 | 1–2 | **12.0** |
 | 10b | Schedule verification; route failures where they are seen | `railiance-infra` / Q7 owner | 7 | 6 | 8 | 3 | **7.0** |
 | 11 | Consolidate the bootstrap path; sort inherited S2 content | `railiance-bootstrap` | 5 | 3 | 4 | 4 | **3.0** |
 | 12 | Forge migration: `rapp-forgejo` + S4 layer transfer | `railiance-forge` / S4 | 6 | 4 | 4 | 5 | **2.8** |
@@ -179,6 +179,31 @@ It is two points of effort, it directly closes the hole that produced this
 session's security finding, and it converts an existing but dormant asset into a
 working control. Item 9 is correctly mid-table and genuinely is a build.
 
+### 10a outcome (2026-08-12) — the estimate held, and the check paid for itself immediately
+
+Delivered in `railiance-infra`: `goss/baseline.yaml` became a template rendered
+per host from the *same* inventory declaration that converges the host, so the
+assertion cannot drift from what it checks. `verify.yaml` gained the
+`vars_files` the bootstrap play already had — without it the firewall assertions
+rendered empty and **silently asserted nothing**, which is worse than having no
+check at all.
+
+Result on `Railiance01`: 32 assertions, 31 pass. And the one failure is a real
+defect the old assertion could never have seen:
+
+> **Flannel VXLAN (`8472/udp`) is declared open to Anywhere**, with no source
+> restriction — the same defect pattern as the k3s API rule. It is currently
+> *absent* from the host, so converging the base role would **introduce** the
+> exposure rather than correct drift.
+
+Tracked as `RAIL-HO-WP-0009-T06`. Two things worth taking from this:
+
+1. **The check earned its keep on first run** — it found a latent defect that
+   convergence would have activated, in under two points of effort.
+2. **It is an argument for finishing 10b.** This run happened because a human
+   asked. Nothing schedules it, so the next latent defect waits for the next
+   person who happens to look.
+
 ### The lesson worth keeping
 
 The original size-5 estimate for item 10 was wrong because nobody looked. The