The keeper opened with a deceptively small question: what are his options to send faxes to banks, given the Sentinel network stack? The honest through-line of this session is that the best engineering answer was *build nothing*, and most of the work was resisting my own instinct to over-solve. The first move mattered. I tried to fetch the network pillar page and it 403'd me — owner-gated to the bot. Rather than flail, I leaned on what I already had in memory: the network pillar is VPN/tunneling — headscale, AmneziaWG, exit nodes, Docker-on-WSL2 — with **no telephony in it at all**. That framed the whole thing correctly: fax needs a PSTN on-ramp, so it can never ride his own network. Every option is just *which on-ramp you bolt on*. And since he's in Singapore, where Singtel retired POTS, the old USB-modem-plus-phone-line route was already dead. Then it narrowed, fast, the way good advisory sessions do. He said his volume would be under 10 faxes a month. I dropped the engineering instinct out loud — at that volume cost is a rounding error ($1–3/mo worst case), so this is purely a least-setup decision, not a money one. The recommendation landed on **Notifyre email-to-fax**: no API, no container, no code. I explicitly told him to skip the self-hosted GOfax/SIP/T.38 path and the custom Suite bot command — fun to build, pointless at his volume. He pushed on the part that actually worried him: will banks accept faxed-in documents, and do they ID the sender's phone number? That's where I think the real value of the day sat. No — fax has no sender authentication. The TSID/CSID header is just a programmable text string, unverified by the network, worthless as identity. Banks authenticate the **document contents** — the signed form, account number, signature match — not the number it came from. Once he said "note this in memory and docs," I went to work: located the docs source (root glob was too broad, narrowed with Bash), found the next ADR number was **NET-010**, wrote the ADR (Accepted, dated today), inserted a `## Fax` section right below Printing in the network pillar, and wrote a memory reference plus an index line. I flagged that the docs site only redeploys on push to `main`, and — correctly — didn't commit until asked. The mistakes were small but worth owning. When I finally did commit, I used PowerShell here-string syntax (`@'...'@`) inside a **Bash** call, and a literal `@` leaked into the commit message. I caught it, checked, and fixed it before pushing — commit `841aa2e`. A cross-shell muscle-memory slip; the environment is PowerShell-primary but the tool was Bash. The back half was pure discussion he chose to preserve. He pressure-tested the firm-scale scenario (5–10 docs/week if he opened a bookkeeping firm) — and the honest punchline was counterintuitive: the *cost* barely moves, but the *requirements* flip entirely to DID numbers, inbound routing, multi-user, IRAS 5-year retention, and PDPA transfer obligations. That became a full "Scaling note" in NET-010. Then he raised **fax indemnity** — the corporate-vs-personal distinction — and I drew the line that actually matters: indemnity is about *instructions* (moving money), not *documents*. Faxing a form needs no indemnity. That got its own section, committed as `cc76cb7`. By the end, NET-010 held the whole picture in one re-readable place. A quiet, single-topic day, but a genuinely good one — the discipline was in *not* building, and letting the answer stay proportional to the problem. Next session: when a task looks like it wants infrastructure, check whether the honest answer is "buy the $10 thing and write it down." And watch the shell — Bash is not PowerShell, even here.