D44/D45 = all picks applied (R-1265, R-1266 closed; R-1280–R-1283 opened); R-232 dated check done; release-2026-10-26 evidence: fix A/B live on rc.6, D47 set-aside alarm on rc.7

documentation/architecture/06-offsite-connectivity.md

@@ -330,12 +330,16 @@ traverse `/root`) — create datastores under a world-traversable parent (`/srv`
 ## 6. Trust-model conformance (01 §3/§4 preserved)
 
 - The box **only ever dials out** (UDP to the endpoint; the same posture as hub-poll and
-  PBS-push, 01 §4/§7). No inbound listener is added to any customer box; the hub still never
-  initiates into a box.
+  PBS-push, 01 §4/§7). ~~No inbound listener is added to any customer box; the hub still never
+  initiates into a box.~~ **[DESIGN — corrected 2026-10-25, D45 = all picks, R-1266]** Two listeners sit on the box's tunnel side, reachable only through
+  the tunnel: the agent's poke listener (UDP 51822 on the box's WireGuard address — a poke carries no command, the box
+  still pulls) and, on an appliance install, the operator door `felhom-sshd` (only from the operator's `/32`, §4.5) —
+  the documented break-glass (`03` §5). The hub still never sends a command into a box.
 - The endpoint VM cannot reach into boxes either: it terminates tunnels whose per-peer routes
   (§4.5) admit only box→PBS traffic; it holds no box credentials.
-- **Out of scope, explicitly:** (a) operator-inbound access to boxes — a *separate* future
-  problem with its own trust decision; nothing here creates or presumes it; (b) game-server
+- **Out of scope, explicitly:** (a) ~~operator-inbound access to boxes — a *separate* future
+  problem with its own trust decision; nothing here creates or presumes it;~~ operator-inbound access to boxes was
+  added on 2026-07-05 (TASK H1) and rides this tunnel — §4.5 (corrected 2026-10-25, D45, R-1266); (b) game-server
   ingress — public players are not tunnel peers; that is a different ingress problem (public
   reachability), not a backup-transport one.
 
@@ -387,7 +391,7 @@ venue; it gates nothing. Runbook:
 
 **MVP that puts offsite backup in a real customer's hands = S1 → S2 → S3; then S4.** S5/S6
 complete the story. The cloudflared service (`internal/hub/cloudflared.go:9-12` — then a
-read-only prober that named itself "the seam for the tunnel-management slice") adopts the
-S3-piloted agent-managed-service pattern in a later, separate slice. *(Dated note 2026-10-24: cloudflared is a GUEST
-container the agent only reads — four states, `cloudflared.go:12-23`; `03` §2 says the agent will not manage it.
-Whether this plan is withdrawn is the operator's — a row of review round 2.)*
+read-only prober that named itself "the seam for the tunnel-management slice") ~~adopts the
+S3-piloted agent-managed-service pattern in a later, separate slice.~~ **[DESIGN — corrected 2026-10-25, D45 = all picks, R-1266]** This plan is withdrawn:
+cloudflared is a GUEST container that the controller renders and keeps up; the agent only reads it (four states,
+`cloudflared.go:12-23`) and will not manage it — `03` §2/§3 wins.