Review round 2 (batch 2 + close-out): 02/07/09/10/11/14/15/16/inventory facts corrected at file:line (EDITS.md), undocumented decisions as notes (R-1265), rulings left for the operator (R-1266); register 190 -> 207 (R-1251..R-1267 opened: R-1251 P1 cut drive-app restore put back over newer data, R-1252 P2 rejected backup block deletes second-drive copies - reproduced on 9202); STATUS D43-D45; CONTEXT; audit README

documentation/architecture/03-host-agent.md

@@ -308,6 +308,18 @@ A controller can only `POST /rollback` (or snapshot/backup) **its own** guest
 token → guest and authorizes per guest, so a compromised controller's blast radius is
 **self-scoped and bounded** to its own guest.
 
+**[DESIGN — undocumented, found 2026-10-24, review round 2 — confirmed through R-1265]:** the surface listed above is
+the slice-8 design; on `main` the local API registers **41** routes (`felhom-agent/internal/localapi/server.go`; 24 of
+them are not listed above — the backup tiers and target, disk candidates, decommission, format status, guest attach,
+the network storage routes, the controller swap, the escrow stage/preflight/ceremony routes, the debug logs, guest
+memory). Among them the controller can start a HOST action: `POST /host/line-test/run` (about 55 s; bounded by the due
+date, the window, 6 tries a day and the heavy-operation gate — R-1250, unreleased). The local API also listens on the
+R-50 island bridge (host `169.254.253.1`, guest `net1` `169.254.253.2/30`, `internal/config/config.go:260-269`). The
+weekly line test keeps its state in the OOB state dir (`line-test.json`) and has an off switch, `line_test.disable`.
+The served WireGuard block carries `oob_peer_ip` and `oob_operator_ssh_key` (`internal/hub/report.go`). The D30 re-key
+runs only inside the tunnel watchdog, and its 15-minute count lives in memory — an agent restart starts it again (the
+once-an-hour bound survives in `wg/last-rekey`).
+
 ### 6a. Implementation (slice 8A — implemented)
 
 **Status: implemented** (agent v0.10.0 `internal/localapi`; controller v0.35.0 `internal/bootstrap`