diff --git a/quest/m1/cluster-routing/transit.md b/quest/m1/cluster-routing/transit.md
index a938e75adb..5bfb336887 100644
--- a/quest/m1/cluster-routing/transit.md
+++ b/quest/m1/cluster-routing/transit.md
@@ -45,7 +45,9 @@ customer/provider export rule, RFC 9234, reduced to one bit):
 - Edge links run qmux over TLS on TCP, not WebSocket and not QUIC:
   intra-region links are not congested. qmux over TCP exists today only in
   plaintext (`tcp://`, moq-tokio's `tcp.rs`); add `tls://` beside it on
-  moq-tokio's `tls` helpers. (Scheme name decided 2026-09-30.)
+  moq-tokio's `tls` helpers. (Scheme name decided 2026-09-30.) The closed
+  [#4731](https://github.com/moq-dev/moq/pull/4731) is prior art for the
+  `tls://` qmux piece in moq-tokio; its edge/core roles are not wanted.
 
 Test: a two-region cluster in `rs/moq-relay/tests`. One region has two edges
 whose links to two cores are upstream; the other is one relay that also
diff --git a/quest/m3/routing-cost-domains.md b/quest/m3/routing-cost-domains.md
index abb942b3e6..23c909b5bc 100644
--- a/quest/m3/routing-cost-domains.md
+++ b/quest/m3/routing-cost-domains.md
@@ -19,7 +19,18 @@ Costs reflect SKU, directional egress economics, provider affinity, and marginal
 transfer savings. A hosting provider is not necessarily a policy domain:
 moq.pro can coordinate one model across its OVH and Linode nodes. Domain
 membership must come from an operator-controlled trust boundary, not a peer's
-unverified assertion.
+unverified assertion. Whatever identifies a boundary must hold to these
+operator-safety constraints:
+
+- A boundary is an explicitly configured link with an expected remote
+  identity. A URL, an observed address, or the `peer` grant alone does not
+  make a link a boundary.
+- The identity is bound to the authenticated link, whichever side dialed,
+  never taken from a route or announcement.
+- A missing, malformed, or mismatched boundary identity is fatal: refuse it
+  at startup or drop the link.
+- `cluster.id` is never reused as a domain identity. It is one node's id, and
+  sharing it across nodes merges distinct origins.
 
 Investigate a shared cost model within a coordinating domain and explicit
 import/export policy at its boundaries. A remote number is not comparable to
@@ -63,3 +74,5 @@ quests. Open wire/API choices belong to this design exercise.
 
 - [#3769](https://github.com/moq-dev/moq/pull/3769) - measurement-based pricing
   prompted the separation of measurement, operator policy, and protocol
+- [#4718](https://github.com/moq-dev/moq/pull/4718) - the dropped
+  cluster-domain hop plan the boundary constraints come from