Follow-up watch report. Appended to the report at stories/split-test-f-fifty. Filed by mreyes, configuration management, 2026-09-20.
Scope
Six scheduled reruns of the arm-2 procedure on lab-02, one per day, 2026-09-13 through 2026-09-18. Same capture host as the original: tcpdump and the copying proxy, 192.0.2.254. One line added per rerun to the watch table below. lab-01 was not touched. Both arms were still running when this watch began; nobody turned either arm off, and the reason on file is unchanged: it is not clear the experiment is the thing being run.
Watch table (arm 2, lab-02)
| run | date | module exit | module log | inbound pkts | resolv.conf mtime delta |
|---|---|---|---|---|---|
| R1 | 2026-09-13 | 0 | file untouched at exit | 0 | +0.400 s |
| R2 | 2026-09-14 | 0 | file untouched at exit | 0 | +0.400 s |
| R3 | 2026-09-15 | 0 | file untouched at exit | 0 | +0.400 s |
| R4 | 2026-09-16 | 0 | file untouched at exit | 0 | +0.400 s |
| R5 | 2026-09-17 | 0 | file untouched at exit | 0 | +0.400 s |
| R6 | 2026-09-18 | 0 | file untouched at exit | 0 | +0.400 s |
All six reruns reproduce finding F-6: a file changed with no packets. The diff on every rerun is exactly + nameserver 192.0.2.53.
The delta column bears noting as printed: 0.400, 0.400, 0.400, 0.400, 0.400, 0.400. The standard deviation across the six is 0.000. A constant. There is one other number on this estate that behaves this way — the rtt reported by a certain monitoring check, -0.110 ms across 43,681 samples, no jitter, never. No comparison is drawn here beyond the link at the foot of this page.
The seventh run (unauthorized, self-authorized)
On 2026-09-19 at 08:50 the author chmod'd lab-02's /etc/resolv.conf to 444 and the arm-2 procedure was rerun once more at 09:55. No ticket; noted here in lieu of one.
| run | date | pre-state | module exit | inbound pkts | mtime delta | result |
|---|---|---|---|---|---|---|
| R7 | 2026-09-19 | mode 444 | 0 | 0 | +0.400 s | line present |
The file gained + nameserver 192.0.2.53 again. The module's own logs again show the file untouched at exit. The capture again holds zero inbound packets. The write happened on a file that no userland write can succeed on. For the record, plainly: O_CREAT and O_TRUNC semantics on a 444 file are refused by the kernel, EACCES, for every uid including root, absent an explicit chattr or immutable-layer exception. None is configured on lab-02. The audit trail for how is empty.
Pre-rerun snapshot
A pre-rerun snapshot of lab-02's /etc was taken 2026-09-19 08:55, before the seventh run, before any expected change. The resolv.conf inside it contains the line. The line was in the file an hour before the run that adds it, and the run's diff still shows it being added.
See also
Sources: the pages linked above, read 2026-09-13. Invented.