diff --git a/docs/trust-boundary/security.md b/docs/trust-boundary/security.md
index c65c7b72..cc4751c2 100644
--- a/docs/trust-boundary/security.md
+++ b/docs/trust-boundary/security.md
@@ -236,22 +236,38 @@ for every operation that genuinely requires root.
 **Narrow interface** — `PrivRequest` variants map 1:1 to specific
 known operations; there is no arbitrary command pass-through:
 
-| Operation                                        | What it runs                                                                                          |
-| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------- |
-| `StartContainer` / `StopContainer`               | `nixos-container start/stop <name>`                                                                   |
-| `KillContainer`                                  | `machinectl kill <machine> --signal=SIGKILL` (`nixos-container` has no kill verb)                     |
-| `CreateContainer` / `UpdateContainer`            | `nixos-container create/update <name> --flake <ref>`                                                  |
-| `DestroyContainer`                               | `nixos-container destroy <name>`                                                                      |
-| `ListContainers`                                 | `nixos-container list`                                                                                |
-| `ReadContainerJournal`                           | `journalctl -M <container> -n <n> [filters...]`                                                       |
-| `ReloadGatewayNginx`                             | `systemctl reload/start/reset-failed nginx` (host unit; the unit name is hard-coded, not a parameter) |
-| `WriteNspawnFlags`                               | write `/etc/nixos-containers/<container>.conf` (bind-mount list + network isolation vars)             |
-| `WriteResourceLimits`                            | write `CPUQuota=`/`MemoryMax=`/`CPUWeight=`/`IOWeight=` systemd drop-in for agent container           |
-| `RemoveServiceDropin`                            | remove `container@<name>.service.d/` drop-in on destroy                                               |
-| `DaemonReload`                                   | `systemctl daemon-reload`                                                                             |
-| `RunForgeAdmin`                                  | `nixos-container run hive-forge -- runuser -u forgejo -- forgejo admin <args>`                        |
-| `WriteAgentForgeToken` / `WriteAgentMatrixToken` | write `0600` credential file into agent state dir                                                     |
-| `RestartMatrixDaemon`                            | `systemctl --machine=h-<name> restart hive-matrix-daemon.service`                                     |
+| Operation                                                      | What it runs                                                                                                                                                                                                                                                                                                                              |
+| -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `StartContainer` / `StopContainer`                             | `nixos-container start/stop <name>`                                                                                                                                                                                                                                                                                                       |
+| `KillContainer`                                                | `machinectl kill <machine> --signal=SIGKILL` (`nixos-container` has no kill verb)                                                                                                                                                                                                                                                         |
+| `CreateContainer` / `UpdateContainer`                          | `nixos-container create/update <name> --flake <ref>`                                                                                                                                                                                                                                                                                      |
+| `DestroyContainer`                                             | `nixos-container destroy <name>`                                                                                                                                                                                                                                                                                                          |
+| `ListContainers`                                               | `nixos-container list`                                                                                                                                                                                                                                                                                                                    |
+| `ReadContainerJournal`                                         | `journalctl -M <container> -n <n> [filters...]`                                                                                                                                                                                                                                                                                           |
+| `ReloadGatewayNginx`                                           | `systemctl reload/start/reset-failed nginx` (host unit; the unit name is hard-coded, not a parameter)                                                                                                                                                                                                                                     |
+| `WriteNspawnFlags`                                             | write `/etc/nixos-containers/<container>.conf` (bind-mount list + network isolation vars)                                                                                                                                                                                                                                                 |
+| `WriteResourceLimits`                                          | write `CPUQuota=`/`MemoryMax=`/`CPUWeight=`/`IOWeight=` systemd drop-in for agent container                                                                                                                                                                                                                                               |
+| `RemoveServiceDropin`                                          | remove `container@<name>.service.d/` drop-in on destroy                                                                                                                                                                                                                                                                                   |
+| `DaemonReload`                                                 | `systemctl daemon-reload`                                                                                                                                                                                                                                                                                                                 |
+| `RunForgeAdmin`                                                | `nixos-container run hive-forge -- runuser -u forgejo -- forgejo admin <args>`                                                                                                                                                                                                                                                            |
+| `WriteAgentForgeToken` / `WriteAgentMatrixToken`               | write `0600` credential file into agent state dir                                                                                                                                                                                                                                                                                         |
+| `RestartMatrixDaemon`                                          | `systemctl --machine=h-<name> restart hive-matrix-daemon.service`                                                                                                                                                                                                                                                                         |
+| `ControlInfraContainer`                                        | `systemctl <action> container@<container>.service` — the `InfraContainer` enum is the allowlist, and serde rejects unknown names at the wire boundary (`hive-c0re` has no variant, so no request can name it)                                                                                                                             |
+| `SyncAgentTmpfiles`                                            | write `/etc/tmpfiles.d/hyperhive-agents.conf` for the agent set, then `systemd-tmpfiles --create`                                                                                                                                                                                                                                         |
+| `SetAgentPaused`                                               | create / remove the `<state>/<name>/harness/paused` marker that parks an agent's turn loop                                                                                                                                                                                                                                                |
+| `WriteAgentGithubToken`                                        | write `0600` `github-token` into agent state dir (same semantics as the forge/matrix token writes)                                                                                                                                                                                                                                        |
+| `WriteAgentExtraForgeAccount` / `DeleteAgentExtraForgeAccount` | write / remove `forge-<label>-token` + a `forge-<label>.json` base-URL sidecar, both `0600`. hive-priv validates `label` as a plain identifier before it reaches the filename — an unchecked one traverses out of the state dir                                                                                                           |
+| `RegisterCiRunner`                                             | write `/run/hive-ci/runner-token` (host path, root-owned) then `systemctl --machine=hive-ci restart gitea-runner-hive.service`. Only the registration token crosses; the forge admin token never enters the container                                                                                                                     |
+| `EnsureAgentSubvolume`                                         | `btrfs subvolume create <state>/<name>` for a new agent — no-op when the path exists or the filesystem isn't btrfs                                                                                                                                                                                                                        |
+| `UpgradeAgentSubvolume`                                        | migrate an existing plain state dir into a subvolume: create, `cp -a --reflink=auto`, atomic swap. Operator opt-in, and the caller stops the agent first                                                                                                                                                                                  |
+| `DeleteAgentSubvolume`                                         | `btrfs subvolume delete <state>/<name>` — purge path only, never a plain destroy                                                                                                                                                                                                                                                          |
+| `EnsureBtrfsQuota`                                             | `btrfs quota enable <AGENT_STATE_ROOT>`. Operator opt-in — enabling forces a full rescan                                                                                                                                                                                                                                                  |
+| `ReadSubvolumeUsage`                                           | `btrfs qgroup show -f --raw <state>/<name>`                                                                                                                                                                                                                                                                                               |
+| `SetSubvolumeQuota`                                            | `btrfs qgroup limit <bytes\|none> <state>/<name>`                                                                                                                                                                                                                                                                                         |
+| `SnapshotAgentSubvolume`                                       | `btrfs subvolume snapshot -r <agent_root> <snapshot_path>` — the frozen point-in-time copy a migration streams from                                                                                                                                                                                                                       |
+| `DeleteAgentSnapshot`                                          | `btrfs subvolume delete <snapshot_path>`                                                                                                                                                                                                                                                                                                  |
+| `SendAgentSnapshotToFile`                                      | `btrfs send [-p <parent>] <snapshot>` into a bare filename under `MIGRATE_STAGING_ROOT`; refuses to overwrite an existing export                                                                                                                                                                                                          |
+| `SendAgentSnapshotToFd`                                        | `btrfs send [-p <parent>] <snapshot>` into a **file descriptor passed with the request** (`SCM_RIGHTS`). hive-c0re connects to the peer and hands over the connected socket, so hive-priv never learns an address or protocol. hive-priv requires exactly one descriptor here, and refuses one that arrives alongside any other operation |
 
 **Container allowlist** — `hive-priv` validates every request against
 an allowlist before any operation: the allowlist accepts only names