diff --git a/docs/2026-06-14-gateway-optimization-assessment.md b/docs/2026-06-14-gateway-optimization-assessment.md
index d06fe5b..38abdd5 100644
--- a/docs/2026-06-14-gateway-optimization-assessment.md
+++ b/docs/2026-06-14-gateway-optimization-assessment.md
@@ -13,15 +13,33 @@
 conntrack 4403/524288). The bottlenecks are **not** CPU/RAM — they are (1) a
 **mis-routed relay IPv6 path** and (2) **no egress QoS**.
 
+## ✅ Implemented this session (2026-06-14)
+- **International access — DONE & live:** egress tunnel switched **IPv6→IPv4** endpoint
+  (`140.245.61.139:27913`) after the OCI ingress rule was added; **RTT 347 ms → 65 ms**,
+  abroad fetch 1.08 s → 0.61 s, exit still SIN/SG, stable across rekey, `.env` persisted.
+  Free (IPv4 not charged).
+- **分流 anti-saturation (criterion 3) — DONE & live:** `wg-sgp-qos` (CAKE `triple-isolate`,
+  200 Mbit egress + ingress-IFB) **enabled** → no single client (BT/簧片) can starve the
+  exit. Committed `5fb735d`.
+- **L7 DPI (criterion 3 correctness) — confirmed LIVE (was mis-reported as inert):**
+  `sni-router-tcp` (`--apply-mark`) + `sni-router-quic` (NFQUEUE/nDPI) run as **host systemd
+  units**, scoped to `@cdn_dpi` (Fastly+Cloudflare). Verified correct SNI decisions
+  (bitwarden→proxy, linear→direct, ECH `cloudflare-ech.com`→proxy). This is the recommended
+  L3-spine + L7-scalpel hybrid — already in place.
+- **Monitoring — DONE:** blackbox-icmp probes (relay v4+v6) + Grafana panel "Abroad relay
+  RTT — IPv4 vs IPv6" (Services→WireGuard). Verified IPv4 65 ms / IPv6 588 ms.
+
 ## Current architecture (measured)
 - **Split = L3:** mosdns split-DNS → nft sets `proxy_domain_v4` (~3790) / `_v6`
   (~2745) → mangle mark `0xdead` → `ip rule … fwmark 0xdead → table 200 → default
   dev wg-outbound-sgp`. CN goes direct via `br-wan` (campus public 166.111.17.108).
 - **Abroad exit = single** `wg-outbound-sgp` WireGuard tunnel to Oracle Cloud SGP
   ("Pulsar", peer `RW7T27…`).
-- **DPI L7 engine** (TCP TPROXY :12345 + QUIC NFQUEUE/nDPI) is **built and nft-wired**
-  (`@cdn_dpi_v4 tcp dport 443 tproxy to :12345`, historical 3.5M/3.7M pkt hits) but
-  **inert**: `cdn_dpi` set empty, daemon not running.
+- **DPI L7 engine** (TCP TPROXY :12345 + QUIC NFQUEUE/nDPI) is **LIVE** — runs as host
+  systemd units `sni-router-tcp`(`--apply-mark`)/`sni-router-quic`, scoped to `@cdn_dpi`
+  (Fastly+Cloudflare, 14 v4 ranges) in `table inet dpi`. (Correction: an earlier note that
+  it was "inert" was a wrong-table read — the set is in `inet dpi`, not `inet mangle`, and
+  the daemons run on the host, not in the infra container.)
 - **DoH/DoT cage partially present:** nft drops WAN-side :53 and **rejects client
   DoH/DoT/DoQ** to the known public resolvers (1.1.1.1/8.8.8.8/9.9.9.9/quad9/adguard/
   opendns) from br-lan + wg-server.