diff --git a/NucleicBroker/Wslc/WslcFacade.cs b/NucleicBroker/Wslc/WslcFacade.cs
index cc157e6..34fae74 100644
--- a/NucleicBroker/Wslc/WslcFacade.cs
+++ b/NucleicBroker/Wslc/WslcFacade.cs
@@ -16,14 +16,21 @@ namespace NucleicBroker.Wslc;
 // enum, RegistryAuth as a string, ImageInfo.Name/.Sha256, and two separate output events
 // instead of one with a stderr flag.
 //
-// Three things the SDK genuinely cannot do — enumerate containers, report per-container
-// stats, or allocate a pty — and which `wslc.exe` CAN, addressing containers by name. So
-// this class becomes a HYBRID: the SDK for the hot path (session, create/start/stop, exec
-// with event stdio, pull with progress), and the CLI for the cold paths it lacks
-// (`wslc container ps` for the reattach roster, `wslc container stats`, `-it` for the
-// Terminal panel). That split lives entirely here — `IWslc` does not change, so nothing
-// on the Swift side knows which arm answered. See §13.1 for the evidence, including the
-// unanswered microsoft/WSL#41024 discussion reporting the same gap.
+// Four things this SDK cannot do at all — enumerate containers, report per-container stats,
+// allocate/resize a pty, and attach to an existing container or session. That is not the
+// projection hiding them: `wslcsdk.dll` wraps `WSLCCompat.idl`, the deliberately-stable
+// SDK-facing COM surface, and that surface genuinely lacks them.
+//
+// They DO exist on `wslc.idl`, the service-internal COM interface `wslc.exe` itself calls
+// (IWSLCSessionManager, IID 82A7ABC8-6B50-43FC-AB96-15FBBE7E8760) — ListContainers, Stats,
+// ResizeTty, OpenContainer/Attach, OpenSessionByName, and IWSLCVirtualMachine::GetId, which
+// is the VM GUID an AF_HYPERV bind needs. Both IDLs are in the open-source WSL repo. The
+// internal one carries an explicit "ABI breaking changes are OK" warning.
+//
+// So there are two ways to close the gaps — direct internal COM, or shelling out to
+// `wslc.exe` — with a real stability-versus-fidelity trade-off between them, and it has NOT
+// been decided. §13.1 lays it out. Whichever wins lives entirely inside this class: `IWslc`
+// does not change, so nothing on the Swift side knows which surface answered.
 //
 // Also note: `ProcessSettings` has no uid/gid, so exec wraps argv in setpriv/su — which
 // §3.2 already anticipated as the fallback, so it costs nothing.
diff --git a/spikes/README.md b/spikes/README.md
index 3750bbc..3d27fa4 100644
--- a/spikes/README.md
+++ b/spikes/README.md
@@ -67,9 +67,9 @@ for, and nothing above it should move. These three are different:
 
 | Finding | Consequence |
 | --- | --- |
-| No container enumeration, stats, or pty in the SDK | **Not fatal** — `wslc.exe` has all three and addresses containers by name, so `WslcFacade` becomes a hybrid (SDK hot path + CLI cold paths). Confirmed by the native header and the API reference, and publicly reported in [microsoft/WSL#41024](https://github.com/microsoft/WSL/discussions/41024), which Microsoft has not answered. |
-| No create-or-attach on `Session` | Still open. The native-only `WSLC_CONTAINER_START_FLAG_ATTACH` may be it; the C# `Start()` takes no flags. Needs a live answer before item 11. |
-| No gateway address anywhere on the API | §5's primary transport must source it from `GetAdaptersAddresses` over the `vEthernet (WSL)` adapter instead. If a `Bridged` container can't reach the host there, promote the AF_HYPERV/AF_VSOCK fallback. |
+| No container enumeration, stats, pty or attach in the SDK | **Not fatal, and not CLI-only.** `wslcsdk.dll` wraps `WSLCCompat.idl` (the stable SDK surface), which genuinely lacks them; they all exist on `wslc.idl`, the service-internal COM interface `wslc.exe` calls — `ListContainers`, `Stats`, `ResizeTty`, `OpenContainer`/`Attach`, `OpenSessionByName`, and `IWSLCVirtualMachine::GetId` (the VM GUID for AF_HYPERV). Both IDLs are open source. Internal COM vs. CLI is an undecided trade-off — see §13.1. |
+| No create-or-attach on `Session` | **Answered:** `IWSLCSessionManager::OpenSessionByName` / `EnterSession` / `ListSessions` exist on the internal interface. Reattach (§2.3) is mechanically possible; what remains is choosing the surface. |
+| No gateway address anywhere on the API | Source it from `GetAdaptersAddresses` over the `vEthernet (WSL)` adapter — **or skip TCP entirely**: `IWSLCVirtualMachine::GetId` returns the VM GUID, so §5's AF_HYPERV/AF_VSOCK path (true vsock parity with macOS) is directly reachable rather than being upside. |
 | No uid on `ProcessSettings` | Recoverable, and already planned for: exec wraps argv in `setpriv`/`su agent -c`. Interceptors and nash don't care about the numeric uid (§3.2). |
 
 ---