diff --git a/docs/deployment/synology-rt2600ac-checklist.md b/docs/deployment/synology-rt2600ac-checklist.md
index c0ec3b3..b0d5f85 100644
--- a/docs/deployment/synology-rt2600ac-checklist.md
+++ b/docs/deployment/synology-rt2600ac-checklist.md
@@ -302,7 +302,19 @@ Kit-connect is the unified replacement for Sections 6 and 7. One SPK installs bo
 
 **Resolution for x4662**: Kittunnel restarted via Package Center through QuickConnect. Tunnel stable on port 2229.
 **Resolution for x4324**: Kit-connect daemon reconnected after authorized_keys fix on VPS. Tunnel stable on port 2225.
-**Pending**: x4078 needs physical access — kit-connect daemon is installed and connecting but fails because it forwards to port 22 instead of 2223.
+**Resolution for x4078 (2026-07-22, remote — NO physical access needed)**: Recovered entirely over the
+still-live **Tailscale** path (`100.116.71.43`, SRM SSH `:2223`) — QuickConnect was also up the whole
+time. The reverse tunnel was the *only* dead path. Root cause on-device: `TUNNEL_LOCAL_SSH_PORT=22` in
+`/etc/kit-connect/connect.conf` (SRM sshd listens on 2223). Fix: SSH in over Tailscale from a tailnet
+node (e.g. the hub), `sed -i 's/^TUNNEL_LOCAL_SSH_PORT=.*/TUNNEL_LOCAL_SSH_PORT=2223/'` the conf, then
+`synopkg stop kit-connect; synopkg start kit-connect`. Tunnel came back on port 2226; end-to-end verified.
+Lesson: **a field router is only "inaccessible" if ALL of {Tailscale, QuickConnect, reverse tunnel} are
+down — check each before assuming physical access is required.**
+
+**Latent daemon bug found**: `connect-daemon.sh` main loop ends each iteration with a bare `wait`, which
+blocks forever on the `setsid`-launched `tailscaled` child. Once the tunnel started failing, the loop
+wedged for ~58 min and never self-healed on the corrected config until the package was restarted. Fix
+the `wait` (e.g. `wait "$SSH_PID"` or `wait -n`) so the retry loop can recover on its own.
 
 **SPK fixed**: Rebuilt with `which` instead of `command -v` and `TUNNEL_LOCAL_SSH_PORT=2223`. Available at `https://git.keylinkit.net/allen/kit-busrouter/raw/branch/main/kit-connect/kit-connect-0.1-0001.spk`.
 
diff --git a/kit-connect/bin/connect-daemon.sh b/kit-connect/bin/connect-daemon.sh
index ad8fba0..782775a 100755
--- a/kit-connect/bin/connect-daemon.sh
+++ b/kit-connect/bin/connect-daemon.sh
@@ -210,6 +210,6 @@ while true; do
     # Start tunnel (blocking — restarts on failure)
     start_tunnel 2>/dev/null || true
 
-    log "daemon: both services running"
-    wait  # Wait for any child to die, then restart
+    # start_tunnel is already blocking and self-retrying; no bare wait here — a bare
+    # wait blocks forever on the setsid'd tailscaled child and wedges the retry loop.
 done
diff --git a/kit-connect/kit-connect-0.1-0001.spk b/kit-connect/kit-connect-0.1-0001.spk
index 0ee3bd0..2355dab 100644
Binary files a/kit-connect/kit-connect-0.1-0001.spk and b/kit-connect/kit-connect-0.1-0001.spk differ