docs: R-NET fail-closed (L3) green; conformance status

DECISIONS-LOG.md

@@ -373,6 +373,13 @@ alpine/k8s) once tested, or a newer kyverno chart that drops the bitnami depende
   DATA_SURVIVED_OK yet FAILED). Converted all to JMESPath `contains($stdout, 'X')` in BLOCK style (flow
   `{ }` breaks on the comma inside `contains()`). data-survival passes; the 9 later-phase tests
   (egress/vpn/alerting/dr/updates/drift/sso) are now syntactically correct for when their phases deploy.
+- **R-NET-01/02 FAIL-CLOSED (L3) PROVEN (main @ cde3335):** implemented the `default-deny-failclosed`
+  scaffold — fixtures = default-deny baseline + source + dest:8080 + the sole explicit allow. Verifies
+  source→dest works, then REVOKES the allow (real fault: `kubectl delete networkpolicy`), and asserts
+  connectivity fails CLOSED while DNS still resolves. Proves default-deny is datapath-enforced, not just
+  declared. PASSES. (DNS check asserts the resolved answer — busybox nslookup exits non-zero on success.)
+  **Conformance green now: R-NET-01/02 (L2+L3), R-TLS-01/03, R-DNS-02, R-STATE-01.** Remaining tests need
+  later-phase components (VPN P3, monitoring/backup/updates P4, SSO P6) → operator secrets.
 
 ## KNOWN ISSUES to fix before Phase-2 un-suspend (logged, not yet fixed)
 | # | Issue | Impact | Fix |