docs: kill-switch robustness fix done+validated; conformance tests partial (rate-limited)

Co-Authored-By: Claude Opus 4.8 <[email protected]>

DECISIONS-LOG.md

@@ -688,3 +688,16 @@ Operator provisioned the host vault; PM drove the deployment + validation on `k3
   `nft flush set` line from `vpn-egress-down.sh.j2`. Gate passes without it, but this is defense-in-depth.
 - **Cross-agent lesson reinforced:** parallel agents must use `isolation: worktree` (an earlier non-isolated
   pair caused the dropped-file break above).
+
+### Kill-switch robustness fix DONE + validated; conformance tests PARTIAL (2026-08-24)
+Dispatched two worktree-isolated, code-only agents (WS-NET fix, WS-TEST conformance). Both hit the shared
+**session rate limit (resets 12:20pm CT)** and died mid-work; salvaged their uncommitted worktree changes:
+- **WS-NET (DONE):** `vpn-egress-down.sh.j2` no longer flushes the nft src set on tunnel-down (retains it so
+  the `oifname != tun0 drop` rule stays armed = explicit, edge-independent fail-closed); README documents it.
+  Reviewed, `ansible-lint` clean (production profile), merged to main (`b0ff689`), redeployed to k3s-dev-3,
+  and **validated live**: tunnel-down → nft set RETAINS `{ 10.72.193.53 }`, drop rule armed; clean recovery.
+- **WS-TEST (PARTIAL):** egress-class chainsaw test rewritten for ADR-0015 assertions — preserved as WIP on
+  branch `feature/conformance-egress-killswitch-adr0015` (`e7a567d`, NOT merged, unreviewed). STILL TODO: the
+  `vpn-killswitch` L3 test + its host fault-injection fixture (privileged node-pinned pod running
+  `nsenter -t 1 … systemctl stop/start vpn-egress-tunnel`, self-healing `finally`). Re-dispatch after the
+  rate-limit resets, or finish by hand; then run the suite live and gate gluetun retirement on it.