1 files changed, 14 insertions, 2 deletions
diff --git a/docs/STATE.md b/docs/STATE.md
index d9edcb0..f4a563a 100644
--- a/docs/STATE.md
+++ b/docs/STATE.md
@@ -20,7 +20,8 @@ server/protocol/ledger only.
    tenant isolation, append-only triggers, `VACUUM INTO` snapshots. Postgres
    deliberately rejected for now; keep DB access behind one layer for a later
    port.
-4. **Protocol**: NDJSON over Unix socket (+ optional token TCP), protocol v1.
+4. **Protocol**: NDJSON over Unix socket (+ optional plain TCP and a native
+   TLS listener), protocol v1.
    `dry_run` on every mutation, `client_ref` idempotency, stable error codes,
    `describe` + `agent.instructions`, money in integer öre.
 5. **Auth**: multi-org; memberships owner/bookkeeper/viewer; API tokens bound
@@ -55,6 +56,14 @@ server/protocol/ledger only.
     on the dashboard. `--org ID` bypasses the picker.
 13. **Settings**: `settings.get`/`settings.set`; keys `default_series`,
     `attachment_dir`.
+14. **Transport**: Unix socket for host clients; plain TCP loopback-only;
+    native TLS listener (`BOKFD_TLS`, `BOKFD_TLS_CERT/KEY`, OpenSSL, TLS 1.2+,
+    cert reload on file change) with client targets `tls:host:port` and
+    system-trust verification (`BOKFD_TLS_CA` for private CAs). Certificates
+    come from a lego sidecar using INWX DNS-01 (`compose.yaml`). Externals
+    get accounts/roles/tokens, never VPN access. `scripts/deploy.sh` builds
+    locally and ships over SSH, or builds on the host when architectures
+    differ.
 
 ## Pending decisions
 
@@ -79,7 +88,10 @@ server/protocol/ledger only.
    implemented).
 6. `describe` argument schemas (currently name/summary/permission only).
 7. Pre-migration `VACUUM INTO` snapshot (promised in SCHEMA.md, not built).
-8. Docker image + compose (multi-arch amd64/arm64, GHCR) and systemd unit.
+8. ~~Docker image + compose (multi-arch amd64/arm64, GHCR) and systemd unit.~~
+   Done as a Dockerfile + `compose.yaml` (amd64/arm64 build stage) and
+   `scripts/deploy.sh` over SSH; no registry and no systemd unit (the
+   container is the unit).
 9. Password change, user disable, TOTP.
 10. Bank import/reconciliation (CSV first, then PSD2), invoicing/reskontra,
     AGI/payroll if employees.