diff --git a/README.md b/README.md
index f3d8de4..75d4e7e 100644
--- a/README.md
+++ b/README.md
@@ -159,6 +159,17 @@ out as:
    drops IP options and the test proves nothing. After, no SYN-ACK, and the
    drop counter on the box goes up.
 
+   In practice the paths tried so far (an operator's ISP, lith-1 to sing-1)
+   drop IP options before they reach the box, so the external test proves
+   nothing. What does: on the enforcing box itself, as an unprivileged user,
+   connect to the box's own public IP with the record-route option set
+   (`setsockopt(IPPROTO_IP, IP_OPTIONS, b"\x07\x07\x04\x00\x00\x00\x00\x00")`
+   in Python). The traffic goes over `lo` and through the same prerouting
+   hook, so the connect times out and the drop counter rises by one per SYN,
+   while a plain connect to the same port succeeds. Only do this on a box that
+   already enforces: on one that only counts, the SYN reaches the unfixed
+   kernel.
+
 To watch for attempts on a box:
 `sudo tcpdump -ni any 'tcp[tcpflags] & tcp-syn != 0 and ip[0] & 0xf != 5'`.
 Undo instantly with `sudo systemctl stop cve-2026-98432-filter`, which deletes
diff --git a/group_vars/ipfs_nodes/main.yml b/group_vars/ipfs_nodes/main.yml
index e9326c4..6167c41 100644
--- a/group_vars/ipfs_nodes/main.yml
+++ b/group_vars/ipfs_nodes/main.yml
@@ -60,8 +60,10 @@ firewall_allowed_udp: []
 #   enforce  drop and strip
 #   off      remove the table and its unit
 #
-# Override per box in host_vars to enforce one box before the others.
-cve_2026_98432_mode: count
+# Override per box in host_vars to enforce one box before the others. All
+# three counted from 2026-10-30 13:20 UTC (no IP-options packets in the first
+# hour), then sing-1 enforced alone from 14:48 before this became the default.
+cve_2026_98432_mode: enforce
 
 # ---------------------------------------------------------------------------
 # Rollout mode
diff --git a/host_vars/sing-1/firewall.yml b/host_vars/sing-1/firewall.yml
deleted file mode 100644
index 9ce320e..0000000
--- a/host_vars/sing-1/firewall.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-# CVE-2026-98432: sing-1 is the canary for enforce. It drops IPv4 TCP with IP
-# options and strips MPTCP from SYNs, while lith-1 and chic-1 still only count
-# (group_vars). Once sing-1 has held up, set enforce in group_vars and delete
-# this file.
-cve_2026_98432_mode: enforce