1 files changed, 2 insertions, 2 deletions
diff --git a/AGENTS.md b/AGENTS.md
index f5d4f7e..6f1c399 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -51,8 +51,8 @@ nvs_flash_init()
 - `wifistr.c/h` — kind 38787 event builder + WebSocket relay publish
 - `captive_portal.c/h` — HTTP :80 portal, captive detection, grant/reset
 - `dns_server.c/h` — DNS hijack/forward per-client, DoT reject
- `firewall.c/h` — NAPT on/off per-client, MAC resolution
+- `firewall.c/h` — per-client NAT filter via LWIP_HOOK_IP4_CANFORWARD, MAC resolution
- `session.c/h` — time-based sessions, spent-secret tracking
+- `session.c/h` — time-based sessions, MAC tracking
 - `cashu.c/h` — Cashu token decode, checkstate, allotment calc
 - `tollgate_api.c/h` — HTTP :2121, payment endpoints, wallet endpoints

diff --git a/AGENTS.md b/AGENTS.md index f5d4f7e..6f1c399 100644 --- a/AGENTS.md +++ b/AGENTS.md
@@ -51,8 +51,8 @@ nvs_flash_init()
51	- `wifistr.c/h` — kind 38787 event builder + WebSocket relay publish	51	- `wifistr.c/h` — kind 38787 event builder + WebSocket relay publish
52	- `captive_portal.c/h` — HTTP :80 portal, captive detection, grant/reset	52	- `captive_portal.c/h` — HTTP :80 portal, captive detection, grant/reset
53	- `dns_server.c/h` — DNS hijack/forward per-client, DoT reject	53	- `dns_server.c/h` — DNS hijack/forward per-client, DoT reject
54	- `firewall.c/h` — NAPT on/off per-client, MAC resolution	54	- `firewall.c/h` — per-client NAT filter via LWIP_HOOK_IP4_CANFORWARD, MAC resolution
55	- `session.c/h` — time-based sessions, spent-secret tracking	55	- `session.c/h` — time-based sessions, MAC tracking
56	- `cashu.c/h` — Cashu token decode, checkstate, allotment calc	56	- `cashu.c/h` — Cashu token decode, checkstate, allotment calc
57	- `tollgate_api.c/h` — HTTP :2121, payment endpoints, wallet endpoints	57	- `tollgate_api.c/h` — HTTP :2121, payment endpoints, wallet endpoints
58		58