Architecture: note the stale boot clock and the metered povo SIM

The car unit has no RTC battery, so before NTP the clock sits near the
last shutdown time; that is the case the two-clock envelope exists for.
The LTE SIM is povo, not an IoT SIM, and its connection now carries
the metered flag the map-sync guard relies on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -84,6 +84,8 @@ Payloads: a self-describing JSON envelope for decoded signals; compact binary fo
 Every envelope carries **two clocks**. `monotonic` is authoritative for ordering
 and intervals; `timestamp` is the absolute reference and may step, since the car
 boots without network and NTP corrects the clock once LTE connects mid-drive.
+The car unit has no RTC battery, so until then the clock sits at roughly the
+last shutdown time — offset by however long the car was parked.
 
 Topic names, payload schemas and the signal registry live in
 [contracts](gitea:yukart/contracts).
@@ -259,10 +261,11 @@ They are never committed. `tool-mapmint` holds the scripts that fetch and build
 them, plus a report of each build's provenance; `svc-nav` consumes the output. The
 artifacts themselves live outside git and never touch the workstation-side repo.
 
-They reach the car by `rsync` **over the LAN only, never over LTE** — the IoT SIM
-is not a sensible transport for a multi-gigabyte tile set. Gate the sync on a
+They reach the car by `rsync` **over the LAN only, never over LTE** — the metered
+povo SIM is not a sensible transport for a multi-gigabyte tile set. Gate the sync on a
 reachable LAN target rather than on an SSID, so the check validates the thing it
-actually needs, and treat NetworkManager's metered flag as a second guard.
+actually needs, and treat NetworkManager's metered flag as a second guard (set on the `povo`
+connection).
 Cadence is quarterly or on annoyance; road geometry does not move fast enough to
 justify anything more.