diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md
index f97dae5..62d0eb8 100644
--- a/docs/HANDOFF.md
+++ b/docs/HANDOFF.md
@@ -276,11 +276,20 @@ The inter-VLAN firewall policy reported as configured is:
 
 | Source | Destination | Protocol/port | Purpose/state |
 | --- | --- | --- | --- |
-| `net-utils01` (`192.168.20.30`) | PS5 (`192.168.40.14`) | TCP `9021` | payload manager to ELF loader; active |
-| PS5 (`192.168.40.14`) | `net-utils01` (`192.168.20.30`) | TCP `80`, `443`, `8000`; UDP/TCP `53` | Relapse page, User Guide gateway and restricted DNS; active |
-| PS5 (`192.168.40.14`) | `net-utils01` (`192.168.20.30`) | TCP `8001` | reserved for payload-manager phase 5; enable only during that phase |
-| PS5 (`192.168.40.14`) | remaining `192.168.20.0/24` hosts | all | blocked |
-| hosts other than `net-utils01` | PS5 (`192.168.40.14`) | TCP `9021` | blocked |
+| `net-utils01` (`192.168.20.30`) | consoles (`192.168.40.0/28`) | TCP `9021` | payload manager to ELF loader; active |
+| consoles (`192.168.40.0/28`) | `net-utils01` (`192.168.20.30`) | TCP `80`, `443`, `8000`; UDP/TCP `53` | Relapse page, User Guide gateway and restricted DNS; active |
+| consoles (`192.168.40.0/28`) | `net-utils01` (`192.168.20.30`) | TCP `8001` | reserved for payload-manager phase 5; enable only during that phase |
+| consoles (`192.168.40.0/28`) | remaining `192.168.20.0/24` hosts | all | blocked |
+| hosts other than `net-utils01` | consoles (`192.168.40.0/28`) | TCP `9021` | blocked |
+
+The console-side allow rules were originally scoped to `192.168.40.14` only. On
+2026-10-11 the PS5 Payload Manager on `192.168.40.13` (PS5FAT) failed every
+catalog sync with "Could not resolve hostname"; the gateway logged zero DNS
+queries from VLAN 40, proving the console's DNS packets never reached
+`192.168.20.30`. Broadening these rules from the single `/32` to the console VLAN
+`192.168.40.0/28` fixed it, and both consoles now resolve. Keep the source scoped
+to the `/28`, not wider. The UDP `53` leg is essential: the manager's libcurl
+resolves over UDP first, so a TCP-only rule reproduces the same failure.
 
 The specific allow rules must be evaluated before the broader deny rules. Keep
 TCP `8001` disabled until phase 5 has a reviewed service that requires it. The