diff --git a/.changeset/registry-cloud-tunnel.md b/.changeset/registry-cloud-tunnel.md
new file mode 100644
index 0000000..b42a687
--- /dev/null
+++ b/.changeset/registry-cloud-tunnel.md
@@ -0,0 +1,5 @@
+---
+"ftw-webapp": patch
+---
+
+Name the box session through FTW Cloud in the shared registry: the carrier `tunnel` and the capability `cloud.tun`. The web app does not use either yet.
diff --git a/contract/registry.yaml b/contract/registry.yaml
index 0cfdaec..63b4de5 100644
--- a/contract/registry.yaml
+++ b/contract/registry.yaml
@@ -103,6 +103,10 @@ capabilities:
   # only and offers no FTW Cloud. It says nothing about whether the owner
   # turned FTW Cloud on; the box's grant decides that.
   - cloud.link
+  # The box takes its app session through FTW Cloud, end to end, as `tun`
+  # (docs/protocol-cloud.md, Tunnel, in srcfl/ftw). Absent means a phone
+  # reaches the box through the relay, even when it knows the home id.
+  - cloud.tun
   # The box can take a watch: it opens the relay's exchange socket and mints
   # watch codes. Absent means the phone offers no Add watch. The wire is
   # docs/watch-exchange.md in srcfl/ftw-webapp.
@@ -274,7 +278,9 @@ client_errors:
 # the two into one enum cannot express "connected, but the inverter is quiet".
 # ---------------------------------------------------------------------------
 source_states: [live, lagging, stale, down, never]
-carrier_states: [webrtc, relay, cloud, cache, none]
+# tunnel is the box's own session carried by FTW Cloud, which cannot read it.
+# cloud is the box-signed copy FTW Cloud holds and can read.
+carrier_states: [webrtc, relay, tunnel, cloud, cache, none]
 
 # ---------------------------------------------------------------------------
 # History resolutions backed by what the box actually stores.