docs: A-5 — a one-way block heals itself and a full split still leaves one node serving

Three injections failed first: kube-router keeps reinserting its chain above a hand-placed FORWARD rule, the JGroups connection direction had reversed since A-1, and only the raw table runs ahead of conntrack. Each failure looked like nothing happening.

Blocking one direction never partitioned the cluster because JGroups reconnected the other way before failure detection fired. Blocking both produced a real split brain with two coordinators in JGROUPS_PING, yet only the non-coordinator node reported DOWN, so the Service kept an endpoint and the front door stayed at 200. That answers the question A-1 left open.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/evidence/a5-asymmetric-partition/07-bidirectional-block.txt

@@ -0,0 +1,17 @@
+=== 양방향 차단 — 두 노드 모두에 raw DROP ===
+  주입: 12:40:25
+  +25초  keycloak-0:1/1 keycloak-1:1/1 | ready=[10.42.0.42 10.42.1.77] 외부 200
+  +50초  keycloak-0:1/1 keycloak-1:1/1 | ready=[10.42.0.42 10.42.1.77] 외부 200
+  +75초  keycloak-0:1/1 keycloak-1:1/1 | ready=[10.42.0.42 10.42.1.77] 외부 200
+  +100초  keycloak-0:1/1 keycloak-1:0/1 | ready=[10.42.1.77] 외부 200
+  +125초  keycloak-0:1/1 keycloak-1:0/1 | ready=[10.42.1.77] 외부 200
+  +150초  keycloak-0:1/1 keycloak-1:0/1 | ready=[10.42.1.77] 외부 200
+  +175초  keycloak-0:1/1 keycloak-1:0/1 | ready=[10.42.1.77] 외부 200
+  +200초  keycloak-0:1/1 keycloak-1:0/1 | ready=[10.42.1.77] 외부 200
+  +225초  keycloak-0:1/1 keycloak-1:0/1 | ready=[10.42.1.77] 외부 200
+
+=== 뷰 상태 ===
+  keycloak-0  [keycloak-0-24309(v=16.0.12)|14] (1) [keycloak-0-24309(v=16.0.12)]
+
+  keycloak-1  [keycloak-1-45480(v=16.0.12)|14] (1) [keycloak-1-45480(v=16.0.12)]
+