feat(device-edge): add isolated B2 ingress domain

device-plane/docs/IMPLEMENTATION_BASELINE.md

@@ -27,6 +27,26 @@ Device Control Core <-> Device PostgreSQL
 Device Gateway <-> physical devices
 ```
 
+The isolated ingress placement replaces the direct physical-device arrow when
+the raw route must not terminate on the multi-service Synology:
+
+```text
+ARUSNAVI B2 device
+        |
+        | raw TCP 9921 (future, separately approved)
+        v
+Device Edge Relay on dedicated mini
+        |
+        | outbound restricted SSH local-forward; opaque byte stream only
+        v
+Synology loopback 127.0.0.1:9921 -> Device Gateway -> Device Control Core
+```
+
+The Edge Relay owns neither protocol acknowledgement nor device identity. It
+does not receive the Gateway/Core token, PostgreSQL credentials, Foundry
+bindings or any command capability. The Synology Gateway remains the sole B2
+codec and acknowledgement owner.
+
 Engine L2 may consume safe decoded observations and build workflows/Data
 Products. It does not own TCP sessions, secrets or the command transport.
 
@@ -50,7 +70,9 @@ platform/device-plane/
   packages/arusnavi-b2-adapter/
   services/device-control-core/
   services/device-gateway/
+  services/device-edge-relay/
   docker-compose.device-plane.yml
+  docker-compose.device-edge.yml
 ```
 
 Planned Synology runtime:
@@ -99,6 +121,41 @@ as `443 -> 9921`.
 The artifact never changes DSM firewall, DSM Router Configuration, DNS or a
 physical router.
 
+### Dedicated mini Device Edge
+
+The Debian mini is the isolated raw-TCP edge. Its accepted predecessor keeps the
+relay disabled and publishes health only on `127.0.0.1:18221`. The reviewed
+target removes even that host publication: health remains container-internal,
+the relay stays on the `internal: true` private bridge for backhaul, and a
+second IPvlan L2 attachment gives only the relay a LAN-routable address for
+`9921/TCP`. The relay has bounded global/per-address sessions and connection
+rate, emits no bytes of its own and does not inspect device payloads.
+
+IPvlan deliberately reuses the Mini's one physical parent `enp1s0f0`; a second
+Ethernet adapter is not required. The host keeps `192.168.68.54/22` and the
+Amnezia `0.0.0.0/1` plus `128.0.0.0/1` routes. The relay has its own fixed LAN
+IPv4 and default route through `192.168.68.1`, while its private connected route
+continues to reach `device-edge-backhaul:19921`. No Docker host `ports:` entry,
+host-network mode, privileged container or VPN teardown is allowed.
+
+Enabling ingress is a separate reviewed operation and requires all of the
+following evidence:
+
+1. A distinct, no-shell Synology SSH account and key whose sole permitted open
+   target is `127.0.0.1:9921`; host-key pinning and a persistent, monitored
+   tunnel are required.
+2. A private backhaul sidecar/network; the raw listener may forward only to
+   that tunnel. The Core token and all Core/Database secrets remain on
+   Synology.
+3. Router evidence proving the fixed relay IPv4 is outside DHCP, followed by a
+   manual router/NAT rule mapping only TCP `9921` to that IPv4. The artifact
+   cannot choose an address and never changes router, firewall or DHCP state.
+4. The host full-tunnel VPN remains active. Before production activation, the
+   exact single-NIC IPvlan design must pass duplicate-address detection,
+   gateway reachability, external return-path and private-backhaul checks.
+5. One pre-authorized B2 pilot route, quarantine-only Gateway/Core ingest and
+   disabled command transport.
+
 ## Identity and onboarding
 
 An IMEI is a claimed protocol identifier, not proof of tenant ownership.
@@ -185,20 +242,21 @@ raw TCP remain forbidden until separate reviewed acceptance slices.
   absence preflight: an existing database container or volume fails closed,
   and rollback never removes the volume.
 
-## Next source slice
+## Next activation slice
 
-1. Add the versioned B2 discovery-ingress descriptor and runner acceptance
-   contract without weakening foundation/recovery acceptance.
-2. Build a deterministic data-only app-overlay and promote the runner extension
-   through the standalone root administrative gate.
-3. Plan/apply the exact discovery-ingress artifact and independently prove:
-   Core/Gateway/PostgreSQL health, PostgreSQL generation preservation,
-   `127.0.0.1:9921` loopback-only publication, verified framing,
-   quarantine-only Core ingest and disabled command transport.
-4. Do not publish raw device TCP from the multi-service Synology. Design and
-   independently review an isolated edge/DMZ/VPS ingress with no lateral NAS
-   access, explicit firewall/NAT evidence, acceptance and rollback.
-5. Only after that separate edge gate, add the NDC route to one approved B2
-   free server slot while preserving Gelios, then prove
-   HEADER/discovery/PACKAGE acknowledgement. Claim and tenant assignment
-   remain a later explicit platform-admin operation.
+1. The Deco DHCP range has been recorded as `192.168.68.50` through
+   `192.168.71.250`; the fixed Relay IPv4 is `192.168.71.253`, outside that
+   pool and independently DAD-tested. It is pinned in Compose, descriptor,
+   builder and the separate Edge runner.
+2. Build the deterministic `component=device-edge` artifact, promote the
+   root-owned Edge runner and review its `plan`. The Synology runner and inbox
+   are not used for this host.
+3. Apply only `device-edge-relay`; prove exact IPvlan runtime, no host ports,
+   internal health, private backhaul reachability, unchanged backhaul/tailnet
+   identities and preserved Amnezia routes. Automatic rollback restores the
+   predecessor relay and removes the unused ingress network.
+4. Independently add the single router/NAT rule for TCP `9921` only and verify
+   that Synology still exposes no public device port.
+5. Add the NDC route to one approved B2 free server slot while preserving
+   Gelios, then prove HEADER/discovery/PACKAGE acknowledgement. Claim and tenant
+   assignment remain a later explicit platform-admin operation.