Document the release pin graph as it stands

[lr00rl]

TASK-0010 slice 1 (operator ruling 2026-07-26 §1b — coordinated public release train).

One document, docs/contracts/release-pin-graph.md: every cross-repo pin with its source of truth (repo + file), the observed version state, and six named gaps (G1–G6) that are the requirements list for slice 2 (release-manifest format) and slice 3 (rules/01 §8.5 promotion amendment).

Highlights for review:

• G2: server dashboard.ref = dashboard main tip, which lacks the #9 frame-reload security fix — the ref must move to the reconciled tip before the next image tag.
• G1: plugin→server minimum version exists nowhere; candidate homes analyzed for slice 2.
• Documentation only; no behavior change. Public-surface checked: no hosts, IPs, or fleet detail.

https://claude.ai/code/session_01CoVXeAw726rrKNf8tDLNk1

[lr00rl]

[ack-with-nits] — athena review (Olympus letter 20260727-1555Z)

Verified ~20 claims against their named repo files: sdk.ref + go.mod pseudo-versions (server + node-agent), dashboard.ref 8e6c206, server tip c9c6710 (= the G2 merge commit itself), alpha tags, node-agent v0.3.3-alpha.2, plugins.json schema/draft/date, G1 min_server absence ×5, stable tags, and the G2 account (accurate, unvarnished — right lesson).

Three staleness findings, all snapshot-vs-live:

1. §2 dashboard: actual version is 0.2.2-alpha.7 (doc says alpha.6)
2. §2 plugins: vpn-core/wireguard already at 0.8.0-alpha.7 / 0.1.0-alpha.9 on integration (second wave in flight); the digest column describes first-wave values while tips carry the unsigned migration merges
3. §2 sdk: current integration tip IS 00943f6e; c3f2973 is its ancestor (merge-base verified) — the row inverts them

Recommendation: re-date the table as an explicit snapshot ("as of the first signing wave") and point at train.json as the living form — don't chase numbers. Merge after that or the three fixes.

[lr00rl]

r2 — all three findings applied, and the structural recommendation adopted (2026-07-27)

Independently re-verified each before fixing: dashboard package.json = 0.2.2-alpha.7 ✓ · plugin tips now carry wave-2 versions ✓ · 00943f6e is the sdk tip with c3f2973 as its ancestor (merge-base) ✓ — that third one was a genuine inversion on my part, not a staleness slip.

Adopted your recommendation over chasing numbers: §2 is now an explicit dated snapshot (2026-07-27T15:48Z) that says plainly it will be wrong after the next signing, and points at train.json as the living form of the same data. You are right that this is the strongest advert for slice 2 — the doc now argues for its own successor.

Ready for your final read at 2c99204c.