docs: promote no-debug-API principle; make monitoring ports configurable

Bench and flight share one query channel, so debugging exercises the
production path daily. Grafana/Prometheus/exporter host ports become
env-overridable for shared hosts.

README.md

@@ -15,6 +15,7 @@ This repository describes how to build, deliver, test, and operate that platform
 5. **Zero trust, provisioned ahead.** Keys are issued per device before deployment; nothing joins the swarm at runtime. Dev channels are physically absent from production builds.
 6. **The whole fleet has one version.** A release manifest pins every image digest, model weight, schema, and config. Rollback is atomic.
 7. **SQL is the contract.** Peer data access is read-only DuckDB SQL over SSH forced commands — the query language already lives on both ends, so no service, port, or protocol is invented for it.
+8. **No debug API.** The bench and the flight use the same channel: an engineer debugging on the ground runs the identical query through the identical wrapper, permissions, and output format a peer drone would use. What you test is what flies.
 
 ## Documentation
 

docs/06-environments.md

@@ -55,6 +55,7 @@ Replay is the warehouse's flagship feature: because every broadcast, detection,
 The environment engineers live in daily — and deliberately the first thing to build (see [08 — Roadmap](08-roadmap.md)), because everything else is validated inside it.
 
 - **Dev Containers** give every engineer the same toolchain in minutes; no snowflake laptops.
+- **No debug API** ([04](04-swarm-sync.md)): bench access to a drone's data goes through the same read-only SQL-over-SSH wrapper the peers use in flight — same permissions, same statement gate, same columnar output. Debugging exercises the production path instead of a parallel one, so the query channel is regression-tested every working day for free.
 - **The virtual drone fleet** ([`simulator/`](../simulator/)) runs the *identical* data plane: same writer, same partitioning, same sealing, same broadcast schema. `DRONE_COUNT=10 docker compose up` is a swarm on a laptop.
 - **Scenarios are reproducible by seed:** route shapes, sensor noise, drone dropouts, link losses are all parameterized — a bug report is a seed + config, not a war story.
 - **T4 data slices**: a thin tool pulls partition subsets from T3 (`flight=X, drone=Y, hour=Z`) for local work — layout-identical, so every query and pipeline runs unmodified.

simulator/docker-compose.yml

@@ -29,7 +29,7 @@ services:
       - ./data:/data:ro
       - ./monitoring:/app/monitoring:ro
     ports:
-      - "9105:9105"
+      - "${EXPORTER_PORT:-9105}:9105"
 
   prometheus:
     image: prom/prometheus:v2.53.0
@@ -37,7 +37,7 @@ services:
     volumes:
       - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
     ports:
-      - "9090:9090"
+      - "${PROMETHEUS_PORT:-9090}:9090"
 
   grafana:
     image: grafana/grafana:11.1.0
@@ -50,6 +50,6 @@ services:
       - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
       - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards:ro
     ports:
-      - "3000:3000"
+      - "${GRAFANA_PORT:-3000}:3000"
     depends_on:
       - prometheus