diff --git a/docs/offscale-plugin.md b/docs/offscale-plugin.md
index b1e961a8..c09aba57 100644
--- a/docs/offscale-plugin.md
+++ b/docs/offscale-plugin.md
@@ -271,9 +271,17 @@ in the invite (`https://<domain>/officer-api`).
 (`EXEMPT_API_PREFIXES`) because Bitwarden clients carry a Vaultwarden bearer rather than a platform JWT.
 The exemption must be declared with a reason or the boot check refuses. Not needed today.
 
-**Open:** the `vpn` capability is the only member-grantable piece of headscale — everything else is
-`admin`. If it disappears with the route, members lose the ability to enrol their own devices. Decide
-deliberately rather than losing it in the move.
+**Not an open question — decided.** Removing `vpn` leaves no member-grantable headscale surface, and that
+is correct. The invite flow supersedes it completely:
+
+1. the Officer headscale app holds an admin API key for the Headscale server
+2. from it the owner mints an **invite** — a URL pointing at the Companion
+3. the Companion turns that into the redirect the phone app claims
+4. the device joins
+
+That path needs no per-member permission on Officer at all, and it is the one that exists and works.
+`/api/vpn/enroll` was the design it replaced, not a capability still waiting for a UI — there never was
+one. Do not reintroduce a member-facing enrolment route on the assumption something is missing.
 
 ---