diff --git a/apps/vms/unifi/10-default-deny.yaml b/apps/vms/unifi/10-default-deny.yaml
index 603a53c..31d28cb 100644
--- a/apps/vms/unifi/10-default-deny.yaml
+++ b/apps/vms/unifi/10-default-deny.yaml
@@ -1,5 +1,5 @@
 ---
-# STAGING / DRAFT — see namespace.yaml header.
+# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
 #
 # Default-deny baseline (R-NET-01): deny all ingress + egress, allow ONLY DNS to the
 # in-cluster resolver. Identical shape to the rendered pihole/app baseline. The VM's
diff --git a/apps/vms/unifi/20-datavolume.yaml b/apps/vms/unifi/20-datavolume.yaml
index 71d15e5..c89ef07 100644
--- a/apps/vms/unifi/20-datavolume.yaml
+++ b/apps/vms/unifi/20-datavolume.yaml
@@ -1,5 +1,5 @@
 ---
-# STAGING / DRAFT — see namespace.yaml header.
+# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
 #
 # CDI DataVolume — the UniFi VM boot disk. This is the FIRST real CDI *http* import on
 # this cluster (the vm-demo/conformance path imports a containerdisk from a *registry*;
@@ -9,7 +9,7 @@
 # STANDALONE DataVolume (NOT a dataVolumeTemplate) so the disk OUTLIVES `kubectl delete vm`
 # and survives destroy/rebuild (R-STATE-01) — same durability contract as vm-demo.
 #
-# STORAGE = longhorn-vm (the RWX/migratable StorageClass the storage workstream is adding):
+# STORAGE = longhorn-vm (the RWX/Block/migratable StorageClass; live in platform/longhorn):
 #   - accessModes: ReadWriteMany + volumeMode: Block  => REQUIRED for KubeVirt LIVE MIGRATION
 #     (evictionStrategy: LiveMigrate in the VM). A ReadWriteOnce disk cannot live-migrate.
 #   - 40Gi: the Ubuntu cloud image virtual size is ~3.5Gi; cloud-init growpart/growroot
diff --git a/apps/vms/unifi/30-virtualmachine.yaml b/apps/vms/unifi/30-virtualmachine.yaml
index 75c2dd4..988aa7a 100644
--- a/apps/vms/unifi/30-virtualmachine.yaml
+++ b/apps/vms/unifi/30-virtualmachine.yaml
@@ -65,14 +65,14 @@ spec:
               # these and (b) surfaces them as containerPorts on the virt-launcher pod so the
               # LoadBalancer Services + CiliumNetworkPolicy ingress can target/match them.
               ports:
-                - { name: inform,   port: 8080,  protocol: TCP }   # device inform / adoption
-                - { name: ui-legacy, port: 8443, protocol: TCP }   # legacy Network UI (still served)
-                - { name: ui,       port: 11443, protocol: TCP }   # UOS web UI (modern default)
-                - { name: portal-http,  port: 8880, protocol: TCP } # guest portal HTTP
-                - { name: portal-https, port: 8843, protocol: TCP } # guest portal HTTPS
-                - { name: throughput,   port: 6789, protocol: TCP } # mobile speedtest / throughput
-                - { name: stun,     port: 3478,  protocol: UDP }   # STUN (device<->controller)
-                - { name: discovery, port: 10001, protocol: UDP }  # L2 device discovery
+                - { name: inform, port: 8080, protocol: TCP }         # device inform / adoption
+                - { name: ui-legacy, port: 8443, protocol: TCP }      # legacy Network UI (still served)
+                - { name: ui, port: 11443, protocol: TCP }            # UOS web UI (modern default)
+                - { name: portal-http, port: 8880, protocol: TCP }    # guest portal HTTP
+                - { name: portal-https, port: 8843, protocol: TCP }   # guest portal HTTPS
+                - { name: throughput, port: 6789, protocol: TCP }     # mobile speedtest / throughput
+                - { name: stun, port: 3478, protocol: UDP }           # STUN (device<->controller)
+                - { name: discovery, port: 10001, protocol: UDP }     # L2 device discovery
         resources:
           requests:
             memory: 4Gi
diff --git a/apps/vms/unifi/40-networkpolicy.yaml b/apps/vms/unifi/40-networkpolicy.yaml
index 73e4fa1..ff297a8 100644
--- a/apps/vms/unifi/40-networkpolicy.yaml
+++ b/apps/vms/unifi/40-networkpolicy.yaml
@@ -1,5 +1,5 @@
 ---
-# STAGING / DRAFT — see namespace.yaml header.
+# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
 #
 # Additive ALLOWs on top of the 10-default-deny baseline. Cilium enforces the UNION of the k8s
 # NetworkPolicy (default-deny) and these CiliumNetworkPolicies (same pattern as pihole). The VM's
@@ -31,13 +31,13 @@ spec:
         - host
       toPorts:
         - ports:
-            - { port: "8080",  protocol: TCP }   # inform / adoption
+            - { port: "8080", protocol: TCP }    # inform / adoption
             - { port: "11443", protocol: TCP }   # UOS UI
-            - { port: "8443",  protocol: TCP }   # legacy UI
-            - { port: "8880",  protocol: TCP }   # guest portal http
-            - { port: "8843",  protocol: TCP }   # guest portal https
-            - { port: "6789",  protocol: TCP }   # throughput
-            - { port: "3478",  protocol: UDP }   # STUN
+            - { port: "8443", protocol: TCP }    # legacy UI
+            - { port: "8880", protocol: TCP }    # guest portal http
+            - { port: "8843", protocol: TCP }    # guest portal https
+            - { port: "6789", protocol: TCP }    # throughput
+            - { port: "3478", protocol: UDP }    # STUN
             - { port: "10001", protocol: UDP }   # discovery
 ---
 # 2) EGRESS from the controller: internet (apt, the UOS installer download, UniFi updates + remote
diff --git a/apps/vms/unifi/50-service-l4.yaml b/apps/vms/unifi/50-service-l4.yaml
index cb01dcf..66d2c56 100644
--- a/apps/vms/unifi/50-service-l4.yaml
+++ b/apps/vms/unifi/50-service-l4.yaml
@@ -1,5 +1,5 @@
 ---
-# STAGING / DRAFT — see namespace.yaml header.
+# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
 #
 # ============================================================================================
 # L4 EXPOSURE (the hard part) — why the shared HTTPS Gateway is NOT enough for UniFi.
@@ -49,12 +49,12 @@ spec:
   selector:
     kubevirt.io/vm: unifi
   ports:
-    - { name: inform,       port: 8080,  targetPort: 8080,  protocol: TCP }
-    - { name: ui,           port: 11443, targetPort: 11443, protocol: TCP }
-    - { name: ui-legacy,    port: 8443,  targetPort: 8443,  protocol: TCP }
-    - { name: portal-http,  port: 8880,  targetPort: 8880,  protocol: TCP }
-    - { name: portal-https, port: 8843,  targetPort: 8843,  protocol: TCP }
-    - { name: throughput,   port: 6789,  targetPort: 6789,  protocol: TCP }
+    - { name: inform, port: 8080, targetPort: 8080, protocol: TCP }
+    - { name: ui, port: 11443, targetPort: 11443, protocol: TCP }
+    - { name: ui-legacy, port: 8443, targetPort: 8443, protocol: TCP }
+    - { name: portal-http, port: 8880, targetPort: 8880, protocol: TCP }
+    - { name: portal-https, port: 8843, targetPort: 8843, protocol: TCP }
+    - { name: throughput, port: 6789, targetPort: 6789, protocol: TCP }
 ---
 apiVersion: v1
 kind: Service
@@ -72,5 +72,5 @@ spec:
   selector:
     kubevirt.io/vm: unifi
   ports:
-    - { name: stun,      port: 3478,  targetPort: 3478,  protocol: UDP }
+    - { name: stun, port: 3478, targetPort: 3478, protocol: UDP }
     - { name: discovery, port: 10001, targetPort: 10001, protocol: UDP }