diff --git a/docs/research/vision.md b/docs/research/vision.md
index e9b00c0..7fa4ab2 100644
--- a/docs/research/vision.md
+++ b/docs/research/vision.md
@@ -35,10 +35,21 @@ not protocol invention.
    multiplexing, and userauth state machines come from russh; third-
    party-upstream posture applies (file asks upstream; never silently
    absorb a workaround).
-2. **A door, not a backend.** alkssh speaks family-protocol types only
-   at the mapped seams. It carries no deployment policy: a downstream
-   app (alkforge) embeds it, enables features, and brings identity/ACL
-   configuration.
+2. **A door in both directions, vanilla on the outside.** alkssh is a
+   door for vanilla clients (server direction: vanilla in, family out
+   — each channel served by a family seam entry; primary current
+   purpose: git) and a door to vanilla servers (client direction:
+   family in, vanilla out — the reverse-runner shape: a family hub
+   dials vanilla sshd and the ops map family-side onto the same
+   protocols, **alktty** for sessions, **alktunnels** for
+   tunnels/-D legs, **alkgit** for upstream git, alkfs client later
+   for sftp; the runner stays vanilla by design). Type symmetry at
+   the seam: the family-facing surface speaks family-protocol types
+   in BOTH directions; the vanilla side speaks russh. The asymmetry
+   is honest and recorded: the server direction *serves* family seam
+   entries; the client direction *consumes* family types. It carries
+   no deployment policy: a downstream app (alkforge) embeds it,
+   enables features, and brings identity/ACL configuration.
 3. **Fail-closed everything.** The feature graph, the auth-method
    disposition, and the channel-request disposition all default to a
    clean decline. Nothing is advertised that isn't served; nothing is