Brief P7: split the gate into offline and on-device parts

Approved 2026-09-17. Evidence is in docs/decisions.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/design.md

@@ -81,7 +81,8 @@ ordinary outbound networking can reach the whole tailnet and the internet as the
 ## Inference contract (the part existing harnesses get wrong)
 
 1. **Baseline budget.** System prompt plus tool schemas at session start: 3,000 tokens or less,
-   measured with the server's tokenizer, enforced by a test.
+   measured with the server's tokenizer (`/tokenize`), enforced by a test. That test needs
+   straylight, so it runs in `make verify-device`, not in the offline `make gate`.
 2. **Append-only.** The request for turn N+1 is a strict extension of the request for turn N.
    Nothing volatile (time, heartbeat notes, memory refreshes) goes anywhere but the newest message.
    Enforced by a property test on the serialized message array. The session log stores each
@@ -201,4 +202,5 @@ Files are the source of truth. SQLite is allowed only for rebuildable indexes an
   field and does not implement `Deserialize`, so no other crate or wire message can produce one.
   `proto` carries a plain `DecisionRecord` for the audit log and the wire.
 - Dependencies are few and justified in `docs/dependencies.md`. `cargo-deny` runs in the gate.
+- `make gate` runs offline. Checks that need straylight run in `make verify-device`.
 - No telemetry, no update checks, no outbound call not listed in `docs/egress.md`.