Sub-ticket of ONEDB-12 GATE#1 step v: remote-monitor ingestion — venus/lezama write whey-pg DIRECTLY per-host (NO ssh-pull). Transport: venus=ZeroTier 172.27.178.27 or Tailscale; lezama=ssh -w L3 tunnel only (GCABA blocks ZT+TS), pg client→172.30.0.1. whey: listen_addresses + pg_hba for both + telemetry_rw role. nw co-owns · one-db