memory: address-based reach shipped; my credential-boundary objection was half wrong

persistent-memory.md

@@ -342,8 +342,22 @@ below is a live commitment or a known-open risk._
   including `ana-docker`, `ana-ml2`, `nh3-docker`, `pfi-gx10`, `esh-docker-vm` and
   every hypervisor, i.e. most of where the work happens. Widening
   `~/.config/remote-ssh-mcp/config.json` does NOT fix this; the aliases have to
-  exist first. Any real adoption push starts with ssh_config coverage, not with the
-  allowlist.
+  exist first. **RESOLVED the same day, and NOT by adding aliases.** Operator
+  pushback, correct: a poking-around tool is ad-hoc by nature, and pre-registering
+  a host before you can look at it is the opposite of ad-hoc — generating aliases
+  for the known fleet would not have helped, because the ad-hoc case is by
+  definition the host not yet in the inventory. Implemented address-based reach
+  instead (`allowedNetworks` / `deniedNetworks` / `defaultUser` /
+  `defaultIdentityFile` / `hostKeyPolicy`). **Live config: `10.0.0.0/8` allowed,
+  connecting as `infra-ops` with `~/.ssh/infra-ops_ed25519`, `accept-new` host
+  keys, SureFire tenant hosts carved out via `deniedNetworks` (deny beats allow,
+  host-specific rather than a /24 because `pfi-pve` shares 10.250.250.0/24).**
+  Verified live: 10.0.10.83 opens by raw IP as infra-ops, 10.250.150.100 refused by
+  the carve-out, 192.168.1.5 refused as outside. ⚠ **My own earlier objection was
+  half wrong** — the credential boundary is about SECRETS ("never accept passwords
+  or private-key material"), not identity, so supplying a username does not breach
+  it; the real problem was only that the server passed no user at all, so a bare
+  address would connect as the LOCAL account. Mechanics, not principle.
 
 - ⚠ **`uv tool install --force .` DOES NOT REBUILD when the version has not moved**
   (forseti, measured 2026-09-05). `--force` only handles "a tool by this name