@@ -54,7 +54,7 @@ The set a tenant may name is `gateway.tenantSelectableClasses` plus the current
 | `publishing.certificates.solver: dns01` | `dns01` | one wildcard `Certificate` per tenant |
 | otherwise | `http01` | one `Certificate` per published hostname, except the passthrough names below |
 
-Under `http01` a hostname held by a TLS-passthrough listener is the exception to the per-hostname rule. Once a `TLSRoute` is served on that listener and forwards to a backend, the hostname earns neither an HTTPS-terminate listener nor a `Certificate`, because the backend presents its own certificate and the Gateway never holds a key for the name. The shipped `tlsPassthroughServices` defaults put `api`, `vm-exportproxy` and `cdi-uploadproxy` in that position on the publishing tenant, and the `Certificate` objects that covered them are collected on upgrade; `packages/extra/gateway/README.md` carries what that changes and the ways forward.
+Under `http01` a hostname held by a TLS-passthrough listener is the exception to the per-hostname rule. Once a `TLSRoute` is served on that listener and forwards to a backend, the hostname earns neither an HTTPS-terminate listener nor a `Certificate`, because the backend presents its own certificate and the Gateway never holds a key for the name. Which of the platform's own names sit in that position on the publishing tenant turns on `gateway.passthroughMode`: under `singleAddress` only `api`, passed through on port 6443, while `vm-exportproxy` and `cdi-uploadproxy` are terminated by `HTTPRoute`s and keep a `Certificate` each; under `separateAddress` all three, passed through on the second Gateway. A `Certificate` that covered a name now in that position is collected on upgrade; `packages/extra/gateway/README.md` carries what that changes and the ways forward.
 
 Edge therefore wins over an operator-supplied wildcard Secret, which wins over the solver. In edge mode the solver, DNS-01 provider and issuer-name inputs are not read at all, so an unsupported value in any of them does not fail the tenant's release. `existingSecret` skips the same validations; only `http01` and `dns01` reject a bad solver, provider or issuer name.
 
@@ -63,10 +63,10 @@ Edge therefore wins over an operator-supplied wildcard Secret, which wins over t
 - The Gateway serves port 80 only. Its listeners are `edge` for `*.<apex>`, `edge-apex` for `<apex>`, and one `edge-child-*` per inheriting child tenant carrying that child's `*.<child-apex>`. There is no port-443 listener, and no hostname-less port-80 listener either.
 - No per-tenant ACME `Issuer` and no `Certificate` are created.
 - No http-to-https redirect `HTTPRoute` is created. The edge is expected to perform that redirect.
-- `tlsPassthroughServices` is not written onto the `TenantGateway` and no passthrough listener is rendered, so the tenant Kubernetes API, VM export and CDI upload endpoints are not published through such a Gateway. The packages that own those endpoints still create their `TLSRoute` objects, which then match no listener on that Gateway.
+- Neither `tlsPassthroughServices` nor the `api` entry of `tlsPassthroughListeners` is written onto the `TenantGateway`, and no passthrough listener is rendered, so the tenant Kubernetes API is not published through such a Gateway. The VM export and CDI upload endpoints depend on `gateway.passthroughMode`: under `singleAddress` they are `HTTPRoute`s and attach to the edge listeners like any application, while under `separateAddress` their `TLSRoute`s, and the API's, name a passthrough Gateway that is never created and so match no listener. Under `singleAddress` no route for the API is rendered at all.
 - Application `HTTPRoute`s attach by hostname exactly as in the other modes — the edge listeners carry the same namespace selector the HTTPS listeners carry elsewhere.
 
-That last point has a blast radius worth stating on its own, and it applies only where those endpoints are published through the Gateway at all. Each of them renders its `TLSRoute` only when `gateway.enabled` is on and its name is still in `publishing.exposedServices`; at the default `gateway.enabled: false` there is no such route and nothing to lose. Where both hold, setting `gateway.className` to an edge-terminated class puts the publishing tenant on it too, and then the endpoints that go unpublished are the platform's own: the `TLSRoute` for `api.<root-host>` is pinned to a `tls-api` listener, an edge Gateway has no such listener, so the tenant Kubernetes API stops being served — VM export and CDI upload go the same way. Nothing fails at render time, and the loss surfaces only on the routes themselves, which the controller flips to `Accepted=False` with reason `NoMatchingParent`. Putting only child tenants on the edge class avoids it, because the platform's routes keep pointing at the publishing tenant's Gateway.
+The passthrough point has a blast radius worth stating on its own, and it applies only where those endpoints are published through the Gateway at all. Each of them renders its route only when `gateway.enabled` is on and its name is still in `publishing.exposedServices`; at the default `gateway.enabled: false` there is no such route and nothing to lose. Where both hold, setting `gateway.className` to an edge-terminated class puts the publishing tenant on it too, and then the endpoints that go unpublished are the platform's own: the tenant Kubernetes API in either `passthroughMode`, since an edge Gateway has no `tls-api` listener, and VM export and CDI upload as well under `separateAddress`. Nothing fails at render time. Under `separateAddress` the loss surfaces only on the routes themselves, which the controller flips to `Accepted=False` with reason `NoMatchingParent`; under `singleAddress` the gateway chart renders no route for the API, so nothing reports it and `api.<root-host>` simply stops answering. Putting only child tenants on the edge class avoids it, because the platform's routes keep pointing at the publishing tenant's Gateway.
 
 Listing a class in `gateway.edgeTerminatedClasses` is an assertion about that class, and nothing verifies it. Put the bundled `cilium` class in the list and its Gateways serve every application hostname over plain HTTP on a public address, with no redirect and no certificate. Only list a class whose provider really does terminate TLS in front of the Gateway.