Enforce the CVE-2026-98432 filter on sf2 too

README.md

@@ -184,8 +184,9 @@ machine it signs in as their shared `user` account on port 5222, whose sudo
 wants its password, so it takes `-K`:
 `ansible-playbook cve.yml -K --check --diff -l sf`, then without `--check`.
 Their mode is `cve_2026_98432_mode` in `group_vars/infra_boxes/main.yml`,
-rolled out the same way: `count`, then `enforce` one box at a time. To test
-from outside, use 5222. Both run Debian 12 with nft 1.0.6, and both have
+rolled out the same way: `count`, then `enforce` one box at a time; both
+enforce since 2026-10-30. To prove it, use the on-box test above as `user`
+(no sudo needed to run it). Both run Debian 12 with nft 1.0.6, and both have
 loaded the enforce ruleset in a throwaway namespace. The real fix is Debian's
 `6.1.190-1` kernel and a reboot.
 

group_vars/infra_boxes/main.yml

@@ -16,5 +16,7 @@ infra_ci_pubkey_file: "{{ playbook_dir }}/keys/github-actions.pub"
 
 # The same switch as group_vars/ipfs_nodes (see its comment), set separately so
 # these boxes go through count before enforce on their own schedule. Override
-# per box in host_vars to enforce one before the other.
-cve_2026_98432_mode: count
+# per box in host_vars to enforce one before the other. Both counted from
+# 2026-10-30 16:09 UTC (nothing matched), then sf enforced alone from 16:26
+# before this became the default.
+cve_2026_98432_mode: enforce