diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md
index 0a2e520..a2b87cf 100644
--- a/notes/fresh-workspace-handoff.md
+++ b/notes/fresh-workspace-handoff.md
@@ -170,7 +170,7 @@ Git history and smoke artifacts carry routine proof. `state/evidence.jsonl` shou
 - Repo Persona child prompts now load the full global Codex `AGENTS.md` as inherited doctrine near the top of each Persona turn. This deliberately carries the Prime Directive, rebuild contract, humor doctrine, infrastructure habits, Epiphany stewardship, and Great Colossus mission frame into Persona cognition rather than relying on a local summary shard.
 - Repo Persona child turns now preserve Discord media context. `SourceMessage` carries attachment metadata, heartbeat Discord fetch caches image attachments under `.voidbot/media/discord-images`, Persona transcripts show `[media: image ... local=...]`, and owner Codex receives cached images through `codex exec --image`. Non-image attachments are visible as metadata only; Personas are explicitly told not to pretend they saw images unless a local image path was attached.
 - Repo Persona reply anchoring is parent-owned. The worker no longer has the old raw-`Would say` fallback that manufactured a `SAY` block when the parent Interpreter failed to return parseable structured output. A child Persona's natural `Would say` is candidate material only; public speech requires a structured parent `SAY` block, with `reply_to` preserved when an older side thread needs anchoring. `npm run agents:parent-interpreter-boundary-smoke` guards this after Mimir posted an orphan "Meet her first" line in `#general`.
-- VoidBot RAG embeddings still use the stable local contract `RAG_OLLAMA_BASE_URL=http://127.0.0.1:11434`, but that Starfire loopback port is now an ops-owned SSH tunnel to Nightwing Ollama. As of 2026-06-07 Nightwing serves `qwen3-embedding:0.6b` through CUDA on the GTX 860M after the NVIDIA `580.159.03` driver upgrade; verify with `ollama ps` showing `100% GPU` and `nvidia-smi` showing `/usr/local/lib/ollama/llama-server` GPU memory.
+- VoidBot RAG embeddings still use the stable local contract `RAG_OLLAMA_BASE_URL=http://127.0.0.1:11434`, but that Starfire loopback port is now a Windows portproxy to Nightwing's WireGuard endpoint `10.77.0.3:11434`. As of 2026-06-07 Nightwing serves `qwen3-embedding:0.6b` through CUDA on the GTX 860M after the NVIDIA `580.159.03` driver upgrade; the old `Nightwing Ollama Embedding Tunnel` SSH scheduled task is disabled. Verify with Starfire `netsh interface portproxy show v4tov4`, `npm run state:check`, Nightwing `OLLAMA_HOST=10.77.0.3:11434 ollama ps` showing `100% GPU`, and `nvidia-smi` showing `/usr/local/lib/ollama/llama-server` GPU memory.
 - After those gates exist, run dry/mock Persona turns before re-enabling `GameCult Local Orchestrator`.
 - The direct-ask receipt check remains important, but it is no longer the next move while the swarm is offline.
 - Next cuts should delete unstable foundations early: do not revive `legacyJsonPath`, working projections, top-level mirror fields, or cleanup code that only compensated for those broken boundaries.
diff --git a/state/evidence.jsonl b/state/evidence.jsonl
index d8c4944..e01eee9 100644
--- a/state/evidence.jsonl
+++ b/state/evidence.jsonl
@@ -397,3 +397,4 @@
 {"ts":"2026-06-07T03:54:39Z","type":"implementation","status":"ok","note":"VoidBot swarm Eve dashboard now publishes turnReliability: parent-Interpreter route/retry/drop/malformed counts from model-output log tail plus turn/job failures from heartbeat history, surfaced in CultMesh/Eve and the local HTML HUD."}
 {"ts":"2026-06-07T04:38:08Z","type":"implementation","status":"ok","note":"Moved VoidBot RAG embedding inference off Starfire without changing the configured embedder URL: Starfire 127.0.0.1:11434 is now an SSH tunnel to Nightwing Ollama, Nightwing serves qwen3-embedding:0.6b on CPU via GGML_VK_VISIBLE_DEVICES=-1 and OLLAMA_LLM_LIBRARY=cpu_avx2, Starfire Ollama startup shortcut is disabled, and npm run state:check passed with rag_ollama.model reachable."}
 {"ts":"2026-06-07T10:03:36Z","type":"implementation","status":"ok","note":"Upgraded Nightwing Ollama embedding lane from CPU fallback to CUDA on GTX 860M without changing VoidBot's stable RAG_OLLAMA_BASE_URL. Nightwing now runs NVIDIA driver 580.159.03, ollama.service forces OLLAMA_LLM_LIBRARY=cuda_v12 with Intel Vulkan disabled, Starfire 127.0.0.1:11434 tunnels to Nightwing 127.0.0.1:11434, embedding smoke returned 1024 dimensions, ollama ps reported qwen3-embedding:0.6b at 100% GPU, and nvidia-smi showed llama-server using GPU memory."}
+{"ts":"2026-06-07T11:43:01Z","type":"implementation","status":"ok","note":"Replaced the Nightwing Ollama embedding SSH forward with the GameCult WireGuard mesh while preserving VoidBot's stable RAG_OLLAMA_BASE_URL. Starfire runs WireGuardTunnel$wg-gamecult-starfire as 10.77.0.2, Yggdrasil runs wg-gamecult as 10.77.0.1, Nightwing runs wg-gamecult as 10.77.0.3, Nightwing Ollama binds OLLAMA_HOST=10.77.0.3:11434, and Starfire portproxy maps 127.0.0.1:11434 to 10.77.0.3:11434. npm run state:check passed; warm embedding calls over the WireGuard path averaged about 344 ms with qwen3-embedding:0.6b at 100% GPU."}
diff --git a/state/map.yaml b/state/map.yaml
index 1666820..740e8f4 100644
--- a/state/map.yaml
+++ b/state/map.yaml
@@ -190,7 +190,7 @@ accepted_design:
   - Deep agent-state, personality, culture, and persistent-world design work now belongs to the sibling Ghostlight repo; VoidBot should consume that work instead of remaining its long-term home.
   - VoidBot's Verse contract is documented in `docs/architecture/voidbot-verse-service-contract.md`: durable agent/service state should be typed CultCache `.cc` or have a `.cc` witness/export; `voidbot.swarm` currently publishes through `cultmesh://voidbot.local/eve/providers/voidbot.swarm`; target Eve surfaces are `voidbot.discord`, `voidbot.archive`, `voidbot.source`, `voidbot.repo_persona`, and `voidbot.swarm`; static/browser dashboard output is only a lowering, not authority.
   - `voidbot.swarm` publishes derived turn reliability telemetry in the Eve TUI surface and local HTML lowering. `scripts/render-voidbot-swarm-dashboard.mjs` derives parent-Interpreter route/retry/drop/malformed counts from `.voidbot/logs/model-outputs.jsonl` and turn/job failure counts from repo Persona heartbeat history, then emits the compact `turnReliability` summary in the snapshot, CultMesh publication, and dashboard HUD.
-  - VoidBot RAG embeddings keep `RAG_OLLAMA_BASE_URL=http://127.0.0.1:11434` as the stable Starfire contract because the URL is part of the current embedder id recorded in Qdrant metadata. The live implementation is an ops-owned SSH tunnel from Starfire loopback `11434` to Nightwing's loopback Ollama `11434`, with Nightwing serving `qwen3-embedding:0.6b` through CUDA on its GTX 860M after the NVIDIA `580.159.03` driver upgrade. Do not change the configured URL unless planning a vector rebuild or metadata migration.
+  - VoidBot RAG embeddings keep `RAG_OLLAMA_BASE_URL=http://127.0.0.1:11434` as the stable Starfire contract because the URL is part of the current embedder id recorded in Qdrant metadata. The live implementation is an ops-owned Windows portproxy from Starfire loopback `11434` to Nightwing's WireGuard address `10.77.0.3:11434`, with Nightwing serving `qwen3-embedding:0.6b` through CUDA on its GTX 860M after the NVIDIA `580.159.03` driver upgrade. The old SSH tunnel scheduled task is disabled. Do not change the configured URL unless planning a vector rebuild or metadata migration.
   - Long-running work should expose durable logs or status files instead of relying on one attached session and hope.
   - Persistent project memory must stay ruthlessly distilled; git history and artifacts carry routine proof.