- /config delivery now targets the service's dedicated Maestro peer listener: https + authmgmt.MaestroTransport() (Maestro's own mTLS identity, never downgraded in dev), port from org.dcntrlized.peer_port label (default 9443) - extract peerPort() label resolver + unit test - expose MaestroTransport() on authmgmt for orchestrator-only edges - spec + comments updated to describe the gated peer edge