docs(device-edge): record isolated ingress status

device-plane/README.md

@@ -4,7 +4,11 @@
 It is intentionally separate from Foundry, Engine L2, External Data Plane and
 the preserved Gelios integration.
 
-Current implementation status: local fail-closed foundation; not deployed.
+Recorded runtime status: the private Synology foundation and the isolated Mini
+IPvlan relay are running through their reviewed artifacts. Synology has no
+public device listener; the Mini relay is LAN-addressable only and router/NAT
+exposure remains a separate manual gate. The admission-gate source below is
+prepared and staged, but has not yet been applied.
 
 - `packages/device-protocol-contract` owns safe discovery and presentation
   contracts.
@@ -38,7 +42,9 @@ the Mini's single Ethernet link, so the host Amnezia full tunnel stays intact
 and Docker publishes no host port. The fixed relay address is
 `192.168.71.253`, explicitly outside the documented Deco DHCP pool
 `192.168.68.50`–`192.168.71.250`. See `docs/IMPLEMENTATION_BASELINE.md` for
-the remaining activation gates.
+the remaining activation gates. The staged admission update keeps the relay
+opaque but requires a public IPv4 source and bounds its source table and bytes
+per direction; it does not enable router/NAT exposure.
 
 The Foundry `Device Manager` is a canonical page template using a server-owned
 `device-plane-control` binding. It is not a service in this directory.