P7 spec rev3: X25519-only browser keygen (no ECDSA fallback), unblock row + honest semantics everywhere, three-zone WG firewall model

BACKLOG.md

@@ -475,8 +475,9 @@ Tickets DC-046 through DC-049 implement pluggable auth + email magic link. Sami
   `/network/devices/:id/revoke`. Orchestrates: provider calls, session kill
   (existing auth store), access-map purge/restore, audit log entries. Block must
   be fully reversible (snapshots pre-block grants). Remove deletes devices +
-  person record. Tests: orchestration order (mocked provider), reversibility,
-  last-admin guard integration, audit entries written.
+  person record. Tests: orchestration order (mocked provider), honest unblock
+  semantics (Tailscale: reauthRequired true + note; WireGuard: immediate
+  restore), last-admin guard integration, audit entries written.
 
 **Note (not a ticket):** the access map module itself is DC-145.
 
@@ -547,8 +548,10 @@ Tickets DC-046 through DC-049 implement pluggable auth + email magic link. Sami
 - **status:** todo
 - **details:** per-resource nft sets (net_dc_res_<name>), peer IPs per grant,
   transactional apply (build temp ruleset → `nft -c` → `nft -f` → verify →
-  rollback file), baseline: dcnet0 input = WG UDP + ICMP from 10.53.0.0/16 +
-  per-resource ports; host admin ports restricted to admin peers. Tests: ruleset
+  rollback file), three-zone baseline: external-interface UDP listen-port accept
+  (NOT on dcnet0); dcnet0 local input = ICMP + admin ports from admin set only +
+  resource ports; dcnet0 forwarding = per-resource sets, peer-to-peer default
+  drop. Tests: ruleset
   golden text, transactional failure injection (nft -c fails → no apply),
   verify-step failure, admin-port isolation.