POG-EDGE LTE hairpin — Pos5 (phone hotspot) ↔ Pos4 (office inbound)
====================================================================

Permanent topology
------------------
The shielded copper between pos5 and pos4 has been pulled and will NOT return.
That hop is always WireGuard + gretap (POG-EDGE). Switching WG transport from
wlan0 to eth0 later is allowed and means new uplink addresses / Endpoints only
— same tunnel model, not a new protocol.

Roles (same as WIFI_BENCH_TONIGHT.txt)
--------------------------------------
- Pos5 end-of-bank: EDGE_GAME_IF=none → ETH_PORTS = gretap only (tunnel-only).
- Pos4: EDGE_GAME_IF=eth1 → ETH_PORTS = eth1,gretap (bank toward pos3 + tunnel).
- Pos1–3: stay on copper daisy among themselves (plain run_bridge_jun11_good.sh).

Hard constraint (T-Mobile / phone hotspot)
------------------------------------------
Phone hotspot LTE is usually CGNAT. Pos5 cannot be a reliable WireGuard listener.

  Office side owns the public Endpoint (inbound UDP 51820).
  Pos5 initiates the tunnel with PersistentKeepalive=25.

Temporary die-locus: AT&T → DT_WEB_SERVER (192.168.10.55)
---------------------------------------------------------
To prove the modem hop without the Ubiquiti UX:

1. On AT&T **Firewall → NAT/Gaming**, reassign service `Wiregaurd_VPN` (UDP 51820)
   from **Ubiquiti** (`192.168.10.52`) to **DT_WEB_SERVER** (`192.168.10.55`).
2. On DT_WEB_SERVER (Admin PowerShell), listen:
     powershell -NoProfile -ExecutionPolicy Bypass -File "...\tools\listen_udp_51820.ps1"
3. From outside (phone LTE / hotspot Pi / VPS), send probes to public IP:
     python3 tools/probe_udp_51820.py 104.6.5.168 51820 8
4. **Pass:** listener prints `pog-udp-probe-N` from a public/CGNAT source.
   **Fail:** nothing arrives → AT&T forward, wrong host, or carrier UDP block.
5. Restore NAT/Gaming to Ubiquiti (`192.168.10.52`) when done, then UX continues
   forwarding UDP 51820 → pos4 `10.1.10.39`.

Office inbound checklist
------------------------
1. Know the office WAN public IP (or set Dynamic DNS: DuckDNS / No-IP / etc.).
   That hostname/IP is the "directory" — not a game-protocol directory service.
2. On the office firewall / router, forward UDP 51820 to pos4's office uplink IP
   (wlan0 or eth0 — whichever EDGE_UPLINK uses on pos4).
   Alternatives: DMZ host = pos4, or 1:1 NAT to pos4.
3. Confirm from outside (phone LTE browser or a VPS):
     nc -u -vz <office-public-or-ddns> 51820
   (or any UDP probe you trust). No inbound = no handshake.

Pos5 phone hotspot steps
------------------------
1. Phone: enable Hotspot, disconnect phone from office WiFi (LTE only).
2. On pos5: join the phone SSID (EDGE_UPLINK=wlan0, EDGE_WIFI_SSID / PSK in
   /etc/ethergold/edge.env or legacy /etc/fixture/edge.env).
3. Pos5 will get a hotspot private IP (often 192.168.x.x) — that is fine.
4. In /etc/wireguard/wg0.conf on pos5, set peer Endpoint to:
     <office-public-or-ddns>:51820
   Keep AllowedIPs=0.0.0.0/0, Table=off, PersistentKeepalive=25
   (fix_wg_l2_conf.sh pattern).
5. On pos4, peer Endpoint may stay blank or point at a throwaway — pos5 dials in;
   keepalive keeps the LTE NAT mapping open.

Optional later: EDGE_UPLINK=eth0
--------------------------------
If either seat moves WG transport from WiFi to Ethernet, expect new DHCP/static
IPs and rewrite both wg0.conf Endpoints. Game path stays gretap; do not re-enable
copper between pos4 and pos5.

Start bridges (YOU — Pi UI console, foreground)
-----------------------------------------------
Pos5 (tunnel-only, on phone hotspot):
  cd ~/EtherGold/dev/pog-edge
  FIXTURE_POS=5 CHANNEL=machine sudo -E bash run_bridge_edge_bench.sh
  # Expect: eth_ports=gretapN — no eth1

Pos4 (eth1 + tunnel, office uplink inbound):
  cd ~/EtherGold/dev/pog-edge
  FIXTURE_POS=4 CHANNEL=machine sudo -E bash run_bridge_edge_bench.sh
  # Expect: eth_ports=eth1,gretapN

Do NOT start plain ~/EtherGold/dev/run_bridge_jun11_good.sh on pos4 while
EDGE_MODE=1 — that blacks out pos5 (no gretap path).

Pass checks
-----------
  sudo wg show          # latest handshake, transfer climbing on both
  ip -br link | grep gretap
  Games on pos4 reach the pos5 side across the missing copper hop

Stop (tunnel only — no copper restore)
--------------------------------------
1. Ctrl-C both foreground bridges.
2. On each Pi:
     cd ~/EtherGold/dev/pog-edge
     sudo bash tunnel_down.sh
3. Leave EDGE_MODE=1. Do not re-plug copper pos4 ↔ pos5 (cable is gone).
4. Stuck gretap0@NONE: reboot that Pi when convenient.

Failure modes
-------------
- No handshake: office UDP 51820 blocked, wrong public IP/DDNS, or pos5 Endpoint typo.
- Handshake but no games: wrong EDGE_GAME_IF / started copper launcher on pos4.
- Pos5 cannot open hotspot: still on office WiFi — force LTE-only on the phone.

Related
-------
  WIFI_BENCH_TONIGHT.txt  — same-building WiFi soak (office WLAN both sides)
  FIELD_EDGE.txt          — field bank-to-bank same-building notes
  fix_wg_l2_conf.sh       — Table=off + keepalive L2 patch