fix: route portal canary through isolated edge tunnel

docs/103-runtime-topology.md

@@ -1,6 +1,6 @@
 # Local and 103 runtime topology
 
-> Last confirmed: 2026-07-07 09:19 CST.
+> Last confirmed: 2026-07-26 20:18 CST.
 >
 > This is the current topology source of truth for local Memind and 103 production. Prefer this document over older migration notes. Older architecture documents may contain historical paths from before the MindSpace split.
 
@@ -39,14 +39,20 @@ Portal must be released as a runtime artifact. Do not edit source directly on 10
 
 | Item | Value |
 |------|-------|
-| Identity router | `127.0.0.1:18080` |
+| Stable edge upstream | `105 nginx -> 58.38.22.103:8081` |
+| Identity router | `127.0.0.1:18082` |
+| Canary edge tunnel | `105 127.0.0.1:19082 -> 103 127.0.0.1:18082` |
 | Candidate Portal | `127.0.0.1:18081` |
 | Candidate goosed | `127.0.0.1:18015` |
 | Release entry | `scripts/release-portal-canary-prod.sh` |
 | Rollback entry | `scripts/rollback-portal-canary-prod.sh` |
 
-The stable Portal stays on 8081. The 105 reverse tunnel points to 18080 only after the
-candidate, router, backups, immutable identity checks, and fallback checks pass.
+The stable Portal stays on 8081 and the normal 105 edge path is a direct upstream, not
+the retired 19081 tunnel. A canary release starts an isolated 19082 tunnel and changes
+the two committed 105 nginx upstreams only after the candidate, router, 103/105 backups,
+immutable identity checks, and tunnel checks pass. It then proves stable fallback before
+declaring success. Port 18080 is occupied by a separate Memory V2 mock service and must
+not be reused.
 
 ## MindSpace Service