v7.1.1 — twelve defects found by reading the code against what it promised

Only defects, and nothing on the MCP surface moves: no name, no
parameter, no docstring of a tool. Nothing to reconnect; an open
chat picks the fixes up on its next call. The web page's HTML is
unchanged too.

What the eleven commits above this one carry, each reproduced on
7.1.0 before it was touched and each kept by a case that was seen to
go red with the defect put back:

• a message can be cited, (MS-0001), as the manual has promised
  since 6.0.0 — the engine refused it as "never defined";
• tasks_amend gets the 64000-byte body ceiling tasks_add already had;
• project_amend types the values of fields and refuses a wrong one
  by name instead of crashing;
• a queue_cap or a code duration out of range, a date off the
  calendar (2026-13-45 used to be accepted and compared as text),
  an id given as a number: refused, not thrown;
• tasks_list is three statements instead of one per entry and no
  longer loads every body to print titles (212 -> 30 ms on 116 MB);
• a rule or a task is looked up through its unique index, not by
  scanning the view (100 lookups: 43 -> 2 ms);
• session start reads every perimeter in two statements instead of
  two per rule (rules_list 704 -> 9 statements on 300 rules; payloads
  byte-identical);
• the rules page reads the anagrafica once, not once per widget;
• the preflight reads the registry once, as its docstring said;
• the entrypoint walks the volume once per boot, not three times;
• the lock's docstring names methods that exist, and the GET
  ceilings are measured on the JSON that is sent.

Also in this release, though not in the image: scripts/test.sh and
scripts/ship.sh, the delivery from a clone with nothing else, and
the probes job of build.yml running on a real runner for the first
time — it was added after the v7.1.0 tag.

Suites on the bench: test_schema 53/0 · test_registry 91/0 ·
test_collaudo 450/0 · test_surface 880/0 · test_crash green;
probes/run.py green (74 + 25)

v7.1.0 — the anagrafica becomes a register and a card

The admin page's anagrafica, rebuilt — and the rules page that was a 500 on every skill.

The consumers screen. It was a wall of forms; it is now a register you read and one card you open.

• a register of every consumer — kind, state, post — one row per name
• Add a consumer opens its own card; editing opens the same card on a name picked from the register, so the two gestures stop sharing one crowded form
• the card of a person now says what it is for: a name, an address, and one checkbox that says who the post goes to. "Write the post" said nothing about what a post is; it is gone
• brief and specs are markdown — rendered where they are read, and comfortable where they are written
• the approver carries forward: editing somebody else's card no longer silently drops who receives the mail

The rules page stops being a 500 on every skill (7.0.2). profile["brief"] was read on a payload that does not carry one — a skill's profile is {withheld, note}. The defect predates v7, and nothing here caught it: the suites read prose, the probes drove only the new pages. Both now do.

The MCP surface does not move. No tool name, parameter or description changes — server.py and both manuals are untouched since v7.0.1 — so there is nothing to reconnect and no new conversation to open.

Suites on a bench built from this commit, engine at the pinned v1.2.0: schema 53, registry 91, collaudo 402, surface 817, crash OK. Both live probes green.

v7.0.1 — the page's address is derived, not configured a second time

⚠ NO RECONNECTION NEEDED for this one: the MCP surface does not move, no docstring changed, and the schema is untouched.

WEB_BASE_URL IS GONE — born in v7.0.0, dead here. The address of the admin page is not an independent fact: it is the same host the deployment already declares in BASE_URL, on the port the UI is already listening on, over http because that port carries no certificate. web.ui_base_url(BASE_URL) derives it (https://host.tailnet.ts.net -> http://host.tailnet.ts.net:9443), the service hands it to the mailer, and nobody reads a variable for it. An address written twice is an address that can disagree with itself, and here disagreeing means a button in an email that opens nothing.

⚠ AND THE PORT IS WHAT KEEPS THAT LINK INSIDE THE TAILNET, which a free-text field could not guarantee: the host is the one the Funnel publishes, on 443 and only there, and the UI cannot run on any port the Funnel could publish because the preflight refuses those three. The premise the closing-ticket design rests on is now enforced by a check that already existed.

test_surface pins the removal in BOTH directions — not in the template AND read by nobody — because the first alone would go green the day somebody put the reader back and only forgot the field.

Suites on this code: 53 / 91 / 401 / 816, test_crash green, plus two live probes. Six new probe cases on the derivation itself and two injections — https for http, the Funnel's port for the UI's — each red naming what came out.

AFTER THE APPLY: nothing to fill in on Unraid. If WEB_BASE_URL is still in the container's variables from v7.0.0, it is now dead — remove it when convenient, it is read by nobody.

v7.0.0 — the admin page stops being a tax, and a task closes from its own email

⚠ RECONNECT THE CONNECTOR AND TEST IN A NEW CONVERSATION. The docstrings of
tasks_add and tasks_amend moved, and a client caches those: a stale description
does not fail, it advises badly.

⚠ NO SCHEMA CHANGE. SCHEMA_GENERATION stays at 6, the databases are not
recreated, and the open entries — which have no source outside the database —
are not at risk. Take a copy of the folder at a stopped container anyway: in
WAL a database is three files, and copying one is a corrupt backup.

THE PAGE. The password is typed at the door and nowhere else; the idle ceiling
goes up, one hour to eight, because it is now the only thing between a borrowed
browser and the corpus. One-time codes come out in a line, two spaces apart,
one press each. The whole task log on one page, grouped by desk or by sender,
nothing capped, with complete/drop/correct under every entry. The anagrafica
replaces people: every chat, skill and person, live and retired, with brief
and specs written and rendered as markdown. Type at 17px. The login carries a
username field a password manager can actually see.

THE ENGINE. Whoever sent an entry may amend it — until now only the desk could.
A task closes from a button in its own email: an HMAC ticket keyed on the
project's admin code, no table and therefore no schema generation, single-use
because closed is closed. task_board and roster are the two readings behind
the new pages. Task and message stop sharing a word.

ONE RULE GAINS ITS FIRST EXCEPTION, DECLARED: the page writes any consumer's
brief and specs. From a tool the rule is unchanged — a chat writing another
chat's mandate is what that guard is for, and on the page there is no chat.

TWO VARIABLES, BOTH OPTIONAL, both inert until filled: WEB_BASE_URL — empty
means no button and yesterday's message, and it must NEVER be an address
reachable from outside the tailnet — and TASK_LINK_DAYS, 14.

Suites on this code: 53 · 91 · 401 · 814, test_crash green, plus two live
probes. Fourteen injections, each red naming its culprit.