feat(device-plane): enable B2 discovery ingress

device-plane/docs/IMPLEMENTATION_BASELINE.md

@@ -1,11 +1,10 @@
 # Device Plane Implementation Baseline
 
 Status: PostgreSQL, Control Core and Gateway foundation are running healthy on
-Synology with public ingress, discovery ingest and commands disabled. The first
-application artifact is terminal-failed because its health gate timed out and
-its automatic rollback could not model the DB-bootstrap predecessor. Recovery
-is a separate source-only canonical transition; the failed artifact is never
-retried.
+Synology. The accepted foundation has public ingress and discovery ingest
+disabled. The next additive transition enables only an authenticated,
+quarantine-only ARUSNAVI B2 discovery path on raw TCP 9921. Command transport
+remains disabled.
 
 ## Product boundary
 
@@ -87,9 +86,12 @@ does not build, restart, recreate or remove any service.
 
 ## Network boundary
 
-The baseline publishes no device port. The planned pilot ingress is
-`device.nodedc.ru:9921/TCP` only after a port-collision check, quarantine/rate
-limits and a separate reviewed ingress transition.
+The accepted foundation publishes no device port. The reviewed pilot transition
+publishes `9921/TCP` from Device Gateway after a port-collision check and keeps
+health endpoints loopback-only.
+
+`device.nodedc.ru` is a DNS name, not an HTTP/TCP mode. The same name may later
+serve an HTTPS Control API on 443 and the B2 raw TCP protocol on 9921.
 
 DSM HTTP/HTTPS Reverse Proxy is not a raw TCP ingress and must not be configured
 as `443 -> 9921`.
@@ -121,10 +123,21 @@ The official B2 material proves:
 - server route fields for DNS/IP, TCP port, protocol and optional ID;
 - SMS/TCP command families and a six-digit device access password.
 
-The public material inspected so far does not define enough exact INTERNAL
-packet framing and acknowledgement detail to implement a production decoder.
-The B2 adapter therefore hashes bounded evidence and fails closed. It does not
-search arbitrary bytes for a 15-digit sequence and call that an IMEI.
+The official ARUSNAVI INTERNAL protocol sheet now provides the first read-path
+framing contract:
+
+- HEADER2 for GPRS is `FF 23` followed by an eight-byte little-endian IMEI;
+- the server confirms HEADER2 with a bounded `SERVER_COM` carrying Unix time;
+- a PACKAGE begins with `5B`, carries a package number in `01..FB`, contains
+  one or more length-framed PACKET records and ends with `5D`;
+- every PACKET checksum is verified before acknowledgement;
+- every valid PACKAGE is acknowledged by package number;
+- without acknowledgement the tracker repeats the transmission.
+
+The pilot codec implements only that verified read/acknowledgement subset. It
+does not decode telemetry tags, export command builders or accept arbitrary
+server commands. An IMEI parsed from a valid HEADER2 remains a claimed
+identifier and never proves tenant ownership.
 
 ## Command boundary
 
@@ -151,8 +164,13 @@ raw TCP remain forbidden until separate reviewed acceptance slices.
   claimed devices, Foundry bindings and append-only audit events.
 - Core health endpoint and an authenticated quarantine-ingest boundary that is
   disabled unless explicitly enabled with file-backed secrets.
-- Gateway health endpoint and a loopback-only test listener that records only
-  a bounded evidence hash, sends no acknowledgement and emits no identifier.
+- Gateway discovery-only HEADER2/PACKAGE state machine with bounded buffers,
+  handshake timeout, concurrent/per-source session limits and per-source
+  connection rate limits.
+- Authenticated Gateway-to-Core discovery ingest. Core HMAC-hashes the full IMEI
+  and persists only its digest, masked view and verified framing evidence.
+- Only HEADER2 and valid PACKAGE acknowledgements are emitted; no command
+  builder or command transport is present.
 - Recursive rejection of secret-like fields, raw payloads and command-shaped
   input in presentation contracts.
 - Automated contract, adapter, migration, Core and Gateway tests.
@@ -169,13 +187,16 @@ raw TCP remain forbidden until separate reviewed acceptance slices.
 
 ## Next source slice
 
-1. Promote the reviewed recovery-capable runner through the standalone root
-   administrative gate and run a fresh `verify-install`.
-2. Plan and apply the exact source-only foundation recovery artifact once, then
-   reconcile its journal/backup and repeat runtime acceptance.
-3. Obtain or capture the exact official B2 INTERNAL framing and acknowledgement
-   contract; keep ingress disabled until its fixtures pass.
-4. Add an authenticated internal Core/Gateway discovery boundary and explicit
-   platform-admin claim operation.
-5. Open raw TCP ingress only in a later reviewed slice after quarantine,
-   framing, rate-limit and audit acceptance.
+1. Add the versioned B2 discovery-ingress descriptor and runner acceptance
+   contract without weakening foundation/recovery acceptance.
+2. Build a deterministic data-only app-overlay and promote the runner extension
+   through the standalone root administrative gate.
+3. Plan/apply the exact discovery-ingress artifact and independently prove:
+   Core/Gateway/PostgreSQL health, PostgreSQL generation preservation,
+   `0.0.0.0:9921` publication, verified framing, quarantine-only Core ingest and
+   disabled command transport.
+4. Only after runtime acceptance, allow TCP 9921 in DSM firewall and configure
+   WAN-to-NAS TCP forwarding. Keep the HTTP(S) Reverse Proxy out of this path.
+5. Add the NDC route to one approved B2 free server slot while preserving
+   Gelios, then prove HEADER/discovery/PACKAGE acknowledgement. Claim and
+   tenant assignment remain a later explicit platform-admin operation.