[Amperstrand]

What

The RELEASE-NOTES.md draft for the v0.6.0 final tag, consolidating:

• the 24 changelog.d/ fragments on main,
• the [Unreleased] section (post-rc2),
• the rc1 notes (thematic structure preserved — fund safety, credentials/installer hardening, network behavior, build integrity, internal, known limitations, upgrade notes, distribution).

Curated, not dumped: each entry is the bold lead-in + one-to-three-line essence + issue/PR cross-reference, per the rc1 house style. A draft banner marks the pre-tag pending set; it comes off at the cut.

Pre-tag dispositions flagged (the commission's flag list)

All 24 fragments on main landed via merged commits — zero dangling claims (verified each fragment's carrying commit). Three disposition items before the tag:

1. docs(changelog): rename the four drifted fragments to the numeric convention + PR-link tails #891 (open, deferred) — renames the four non-numeric fragments (admin-credential-choice, board-first-run-no-print, installer-free-trust, refuse-install-without-root-password) to the numeric convention. Either merge it pre-tag (it is 18 lines) or the drifted names ship — cosmetic either way, but the fragment-identity fence prefers the rename. Recommend: merge pre-tag.
2. changelog: fix #850's fragment form — bullet body and PR-link tail #893 (open, deferred) — fixes fix(setup): never print generated credentials; add TOLLGATE_PRIVATE_WIFI_PASSWORD #850's fragment form (bullet body + PR-link tail). Same class, 6 lines. Recommend: merge pre-tag.
3. vm-campaign.added.md — landed via the merged first-campaign commit (68ad514); the campaign continues in open test(v6-captive): pin the IPv6 captivity axis on-VM and offline (#783) #794. The fragment describes what shipped (the lane + first evidence), so it is accurate as-is; test(v6-captive): pin the IPv6 captivity axis on-VM and offline (#783) #794's later campaigns will extend it in 0.6.1 notes. No action needed.

Interplay with the release scope (#909)

The blocker set (#908, #899+#894, #871, #870, #793+#873, #782, #874) merges before the tag — their entries join this draft's sections at that point (fund-safety section first). This PR is the vehicle: amend it as blockers land, strip the banner at the cut.

Verification

• Every fragment's landing commit verified merged (no open-PR references in fragment text)
• Cross-references spot-checked against the open-PR set (59 open at draft time)
• No content invented: every entry traces to a fragment or [Unreleased] bullet

[Amperstrand]

Amendment (post-rc4 re-sync)

Main moved under the draft: #913 landed the credential resolution (fixed default TollGate credential + provisional marker + forced change at first login — replacing rc3's preinst refusal, which is non-fatal under apk-tools 3), and #914 recorded the package-build decommission plan (feed Makefile canonical post-rc4).

The draft now reflects both: credential section rewritten to the final model with the rc3→rc4 arc as context, upgrade notes corrected (the old text told upgraders the refusal behavior — no longer true), decommission plan in the build-integrity section, banner tracks rc4.

Pre-tag flags updated: #894 is closed-superseded (its lane's semantics live on in #892/#899); #891/#893 still recommended merge-pre-tag — note #893 is now CONFLICTING and needs a rebase onto the rc3/rc4 base (will stage when picked up).

[Amperstrand]

Tier evidence — docs wave vs main @ f66cd67

Verdict: CLEAN MERGE — release-notes draft, no fragment required.

• git merge-tree vs f66cd67: clean; real merge applies cleanly.
• changelog-assemble.py check on the merged tree: no findings.
• Fragment: none carried — correct for a RELEASE-NOTES.md draft (the fragment system feeds the fold; this document is its consumer). The ci(release): the fold is a fence — release-check refuses an unfolded final #919 fold fence applies at release time, not here.
• Content skim: v0.6.0 final-notes draft consolidating fragments + [Unreleased] + rc3/rc4 commits rolled up with rc1/rc2; explicit draft banner to remove at the cut, with the v0.6.0 final — release scope: the short list (blocker set + deferrals) #909 pre-tag blocker set noted as pending.

Tracker: #965. Scratch worktrees only — no shared refs touched.

[felixfelix-bot]

Review: APPROVE

Reviewed cold at head mod-pr912. Docs-only (one file, RELEASE-NOTES.md, +161/-217). The content
is curated rather than dumped, and I verified its claims and its draft discipline.

What it does: replaces the rc1-era notes with a single v0.6.0 final-tag draft, consolidating
the 24 changelog.d/ fragments on main, the [Unreleased] section, and the rc1 notes.

The draft banner is honest and specific, which is the thing I checked hardest — a release-notes
document that overstates its own readiness is how a stale doc ships:

Draft status: consolidates everything merged through v0.6.0-rc4 (fragments + [Unreleased]

• the rc3/rc4 commits), rolled up with the rc1 notes into one final document. Entries for the
  pre-tag blocker set (issue v0.6.0 final — release scope: the short list (blocker set + deferrals) #909) join this document when those PRs merge. Remove this banner at
  the cut.

It names the rollup boundary, names what is still missing (#909's blocker set), and states the
removal condition. The body adds the disposition audit — "All 24 fragments on main landed via
merged commits — zero dangling claims (verified each fragment's carrying commit)" — which is the
right check for release notes, since a fragment with no carrying commit is an unreleased claim.

Referenced PRs exist and say what the notes imply. Spot-checked:

#913  MERGED   setup: default to a fixed TollGate credential instead of refusing
#884  CLOSED   fix(setup): never generate a credential the operator cannot see (M1)

The notes' section heading "Installer and credential hardening (the #884 series, resolved by
#913)" matches that history — #884 closed, superseded by the merged #913. Labelling a closed PR
as the resolved-by relationship rather than implying it merged is accurate.

The version fence is red on this branch — and that is expected, not a defect. VERSION is
v0.6.0-rc3 while the notes title line reads v0.6.0:

FAIL  CHANGELOG.md has no '## [v0.6.0-rc3]' section; finalize [Unreleased] into the release heading
FAIL  RELEASE-NOTES.md does not mention v0.6.0-rc3 on its title line; rewrite it for this release

Those two failures are the pre-tag state: the draft is for the v0.6.0 tag and the fence
compares against the current VERSION. It will pass at the cut, when VERSION becomes v0.6.0 and
the changelog is finalized. Worth stating clearly in the review so nobody "fixes" the fence or the
notes to make it green early — the fence is doing its job by refusing to certify a draft as the
current release.

Curation quality: the section structure is thematic (fund-safety and payment correctness;
installer and credential hardening; captive portal and network behavior; build/packaging/distribution
integrity; internal tests and seams; getting v0.6.0), and the body says each entry is
"bold lead-in + one-to-three-line essence + issue/PR cross-reference, per the rc1 house style". The
three pre-tag disposition items are listed explicitly, including #891 (renames the four non-numeric
fragments) — flagging an open dependency rather than silently omitting it.

Not hardware-tested — documentation, no runtime surface.

Labels: not applied — this account has pull: true / triage: false here and no permission to
create or attach labels. Intended label for whoever can: low (documentation draft; the two
version-fence failures are the expected pre-cut state, not a regression).

FULL_REVIEW: ~/reports/reviews/tollgate-module-basic-go-pr912-kimi.md

[Amperstrand]

Local CI gate — PR #912: docs(release): v0.6.0 release-notes draft — rc1+rc2 rollup

Run of scripts/pr-verify.sh (the local CI gate: GitHub Actions is
org-blocked and the ngit lane fires only on maintainer mirror pushes,
so a PR ref gets no CI runs — this comment is the offline verification
evidence, produced on the pinned head SHA).

• Head: release/v0.6.0-notes-draft @ a1326f4867
• Base: main @ 27baf22fcb
• Gate: pr-verify 5a703563168f on ai-legion, started 2026-10-18 16:36 UTC, wall 429s
• Logs: /tmp/tollgate-pr-verify/912-20261018T162853Z (on the verifying host)

Leg	Result	Detail
hygiene	PASS	no conflict markers in the tracked tree (0s)
contract-fences	PASS	12 checks green; 1 skipped (absent from tree: entry-UI marker path fence) (4s)
packaging-sequential	PASS	13 suites (6s)
shell-suites	FAIL	red (1/16): uci-defaults-entry-ui-mapping_test.sh — logs in /tmp/tollgate-pr-verify/912-20261018T162853Z/shell-suites (40s)
packaging-concurrent	PASS	13 suites, all at once (2s)
go-battery	PASS	16 modules, gofmt/vet/build/-race (377s)

Verdict: 1 leg(s) RED — 5 green.

What this gate does not run (no vacuous green)

• spec-quote drift check (greatspectations tool + pinned nuts fetch)
• reproducibility / conformance lanes (make release-check territory)
• the ngit trigger/release-pipeline suites (release-check legs, not the
  per-PR lane; verified on the verifying host: release-pipeline 48/48
  green, trigger suite environment-red — this seat's nak v0.16.2 does
  not accept nsec-string args to key public, identical on main)
• router-visible behaviour (PRTA / bench — unit green ≠ router works)

failing-leg log tails

shell-suites — tail

--- uci-defaults-entry-ui-mapping_test.sh.log
== F. the marker is honoured on a same-version reinstall too
ok   reinstall: the driver exits 0
ok   reinstall (board): uhttpd.main (LuCI) is on the secondary :8090 pair
ok   reinstall (board): uhttpd.main (LuCI) is on the secondary :8443 pair
ok   reinstall (board): uhttpd.main holds NO entry-pair listener
ok   reinstall (board): uhttpd.main's home is /www
ok   reinstall (board): uhttpd.admin (the board) is on the entry :8080 pair
ok   reinstall (board): uhttpd.admin (the board) is on the entry :443 pair
ok   reinstall (board): the entry board keeps its webroot and error_page
ok   reinstall (board): exactly one section binds :8080 (admin)
ok   reinstall (board): exactly one section binds :443 (admin)
ok   reinstall (board): exactly one section binds :8090 (main)
ok   reinstall (board): exactly one section binds :8443 (main)

tests: 126 passed, 9 failed

[Amperstrand]

Supersession note (sweep triage)

This release-notes draft is superseded by #1033, the shipped release PR: its tree carries the final RELEASE-NOTES.md rewrite for the stable v0.6.0 (verified at the pinned head in #1033's review — proper header, module commit cf7cad3, stable channel), and the v0.6.0 tag is already cut and public at 9364f2e. The rc1-rollup curation work here was absorbed by that rewrite.

Recommend closing as superseded (pointing to #1033) so the tail queue holds only live work — flagging rather than closing unilaterally since the draft banner's 'pending set' decision belongs to the release owner.

[c03rad0r]

Technical review — requesting changes. Head a1326f4. The draft predates the last two days of merges.

Rewriting RELEASE-NOTES.md from the rc1 draft into a v0.6.0 final is the right goal, and the "consolidating the rc1+rc2 rollup" structure is sound. But this branch was written against a main that has since taken a large batch of fund-safety and packaging work, and a release-notes file is exactly where stale content becomes a shipped inaccuracy.

Concretely, the merged changes after this draft's base that the notes currently do not cover (from the 2026-10-25 train alone): the storage-mmap failure class + operator verdict surfaces (#1107/#1108/#1117), the SSID leading-bang change (#1116), the notice-event MAC removal (#1106), the TG_VERSION consistency fence (#1109), the cold-sums fence (#1115), the build contract/ecosystem pointers (#1118), the arch authority (#1119, if it lands), and the config-shape refusal (#930/#933) family. A final-notes cut that omits those is not wrong in prose — it is wrong in what a user is told changed.

Required: regenerate/curate from the current changelog.d/ (the fold tool can do the bulk) and add the sections for the post-base merges; then run check-release-fold-state.py against the version the notes claim. The docs themselves are fine; they are just not current.

Disposition: request-changes (staleness, not structure).

[c03rad0r]

Re-review — notes brought current through the final train. Approving.

The draft now covers the post-rc4 content by theme, with links:

• Wallet/payments: ext4-loop storage on jffs2 (+ ADR), durable config writes and the non-hanging wallet check, the single-writer invariant, degraded retry, first purchases from present-but-unlisted clients, config-shape refusal, gonuts v0.14.1, go.sum/dependency repairs.
• Network/portal: device-wide IPv6 disable, existence-checked AP rebind + one-way SSID, rendered nft interfaces, pinned private address, the fresh-install listener fix + backed entry_ui, MPTCP validation, gated upstream portal trigger.
• Multi-WAN: the new objective contract, sampler/renderer and fail-closed applier — with the honest limits (no client assignment, no probe execution, no production runner, single-link no fallback).
• Build/supply chain: portal pin, fail-closed SDK staging, build contract/arches, OpenWrt script naming, postinst husk guard (+ feed), trust model/scanner, declared ngit trust, gitleaks, installer lane, announce gate, release-fold fence.
• Upgrade notes now state the behavioral changes an operator must know: IPv6 off, wallet image under /etc/tollgate (keep it in backups), entry_ui=luci on feed-less installs, preserved AP identity, schema-shape refusal, single wallet holder, and the wallet check lock verdict.

Banner updated to "content complete through 2026-10-27". This is a draft for the owner to cut; the content is now grounded in merged PRs rather than a stale rc1/rc2 set.

Disposition: land.