- federation.json (the shape Coves' settings UI writes against) promised that both deleteRemote paths restore the default-on state under the same identity — false since 17d: the destructive purge tombstones the actor and setEnabled refuses re-enablement forever. The description now states the irreversibility and tells a UI to present deleteRemote as permanent; the soft-tier re-enable promise is kept, scoped to the soft tier. MANIFEST.sha256 regenerated for the one file. - README's opt-out section said the consumer records deleteRemote intent "but does not act on it until task 17's destructive tier is wired" — contradicting its own CONSUMER_ENABLED row two sections up. It now describes the wired tier and the refused re-enable. - README's host-router paragraph claimed bare IPs reach the bridge; the router 421s public IP literals by design (isServiceHost admits only loopback) — a security-posture doc asserting the opposite of the dedicated test. Reworded to loopback-only with the 421 stated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>