feat(docs): transmitter beside codesys, eight products on five release lines, cascade 1.0.2 install pages

src/content/docs/cascade/running.md

@@ -5,6 +5,10 @@ description: "Run Cascade with Podman Quadlet or Helm on k3s, on SQLite or Postg
 editUrl: false
 ---
 
+:::note[Written against main]
+This page follows `main` at 1f8ad0c, and it differs from the copy in HotLoop Cascade 1.0.2, the latest release. Parts of it may be newer than what you have installed. The [release notes](/releases/) say what moved.
+:::
+
 On a Podman host, `deploy/quadlet` has systemd units. One file and a volume is
 Cascade on SQLite; `deploy/quadlet/postgres` is the server, a worker and
 PostgreSQL on a network of their own. Both start at boot, restart on failure and
@@ -14,15 +18,15 @@ it.
 To pull a version by hand:
 
 ```sh
-podman pull ghcr.io/hotloop-io/hotloop-cascade:1.0.1
+podman pull ghcr.io/hotloop-io/hotloop-cascade:1.0.2
 ```
 
 The units follow `:stable` and Podman's auto-update timer moves them.
 
 On k3s, `charts/hotloop-cascade` is the Helm chart:
 
 ```sh
-helm install cascade oci://ghcr.io/hotloop-io/charts/hotloop-cascade --version 1.0.1
+helm install cascade oci://ghcr.io/hotloop-io/charts/hotloop-cascade --version 1.0.2
 ```
 
 The chart carries the labels the EmberNet dashboard reads, on the Service and on

src/content/docs/cascade/status.md

@@ -5,7 +5,11 @@ description: "Cascade is released: what is in it, what is not in it yet, and whe
 editUrl: false
 ---
 
-1.0.1 is the release out today, and 1.0.0 is the one before it. 1.0.0 is the first
+:::note[Written against main]
+This page follows `main` at 1f8ad0c, and it differs from the copy in HotLoop Cascade 1.0.2, the latest release. Parts of it may be newer than what you have installed. The [release notes](/releases/) say what moved.
+:::
+
+1.0.2 is the release out today, and 1.0.1 and 1.0.0 are the two before it. 1.0.0 is the first
 with the identity and governance work, each piece tried against the real server it
 talks to: SAML (against Keycloak), LDAP and Active Directory (OpenLDAP and a Samba
 domain controller), SCIM (against scim2-tester), custom roles, external secrets
@@ -15,11 +19,13 @@ Azurite). It also has a new editor, so every one of those has a screen. 1.0.1 fi
 one mistake in sign-in: when the database could not be read, Cascade answered "not
 signed in" and cleared the cookie, so a short outage signed everyone out and could
 turn a good second factor into a wrong code. Now it says to try again and keeps the
-session. Nothing migrates between the two.
+session. 1.0.2 lets a workflow sign and verify with an HMAC key kept as a credential,
+and lets a public form on another website call a webhook from the browser. Nothing
+migrates between 1.0.0 and 1.0.2.
 
 What isn't here yet (Git source control and environments, more connectors, AI steps
 and an MCP server) is in `docs/ROADMAP.md`.
 
 The repository is private. The image and the chart are public and pull with no
-login. The image is `ghcr.io/hotloop-io/hotloop-cascade`, with tags `1.0.1`,
+login. The image is `ghcr.io/hotloop-io/hotloop-cascade`, with tags `1.0.2`,
 `1.0`, `1`, `latest` and `stable`, for amd64 and arm64.

src/content/docs/gateway/overview.md

@@ -28,17 +28,17 @@ The ground floor, in 4.18.11 and in every release back to 4.16.0:
 - [Automations](/iot/automations/) covers triggers, conditions, and actions, and why a rule is compiled when you save it instead of when it fires at 3 AM.
 - [Model Context Protocol](/iot/mcp/) is the Gateway as an MCP server and client, and how one Gateway reads every site.
 
-New in 4.18.11, and not in 4.18.10: the database is PostgreSQL 17 with an upgrade that runs itself, SNMP and BACnet/IP through one integrations flow, kiosk sign-in with a lockout, alarm escalation, and a UI that installs on a phone. [Below](#new-in-41811) is what each one buys you, and what it costs.
+New in 4.18.11, and not in 4.18.10: the database is PostgreSQL 17 with an upgrade that runs itself, SNMP and BACnet/IP through one integrations flow, kiosk sign-in with a lockout, alarm escalation, and a UI that installs on a phone. [The release notes](/releases/hotloop-4-18-11/) say what each one buys you, and what it costs.
 
-New in 4.18.10, and not in 4.17.0: the four-product lineup, a choice of database, MQTT, and network discovery, historian targets, and boxes that update themselves. [Below](#new-in-41810) is what each one buys you.
+New in 4.18.10, and not in 4.17.0: the four-product lineup, a choice of database, MQTT, and network discovery, historian targets, and boxes that update themselves. [The release notes](/releases/hotloop-4-18-10/) say what each one buys you.
 
 New in 4.17.0, and not in 4.16.0:
 
-- [Recipes](/iot/recipes/), [Scripts](/iot/scripts/), [Blueprints](/iot/blueprints/), [Helpers](/iot/helpers/), [Logbook](/iot/logbook/) and [UniFi Network](/iot/unifi/). [Below](#new-in-4170) is what each one buys you.
+- [Recipes](/iot/recipes/), [Scripts](/iot/scripts/), [Blueprints](/iot/blueprints/), [Helpers](/iot/helpers/), [Logbook](/iot/logbook/) and [UniFi Network](/iot/unifi/). [The release notes](/releases/hotloop-4-17-0/) say what each one buys you.
 
 ## What it does with the data
 
-**Historian.** TimescaleDB by default (on PostgreSQL 17 since 4.18.11), and plain PostgreSQL or a SQLite file work too, because [the database is a setting](#new-in-41810). The history table is a hypertable when the extension is there and natively range-partitioned when it isn't, so a plain PostgreSQL works instead of failing. Set a deadband per tag. Without one, a sensor jittering in its last bit writes a row every scan forever, and a thousand tags polled every second is about 86 million rows a day.
+**Historian.** TimescaleDB by default (on PostgreSQL 17 since 4.18.11), and plain PostgreSQL or a SQLite file work too, because [the database is a setting](/releases/hotloop-4-18-10/). The history table is a hypertable when the extension is there and natively range-partitioned when it isn't, so a plain PostgreSQL works instead of failing. Set a deadband per tag. Without one, a sensor jittering in its last bit writes a row every scan forever, and a thousand tags polled every second is about 86 million rows a day.
 
 **Alarms.** ISA-18.2, including the state most homegrown systems miss: `rtn-unack`, an alarm that cleared on its own before anybody saw it. Acknowledged and returned-to-normal are separate axes, so the transient trip at 03:00 is still on the list when the morning shift walks in, instead of vanishing with nobody the wiser. Asymmetric deadbands and on and off delays stop a borderline value from chattering the list into noise nobody reads. Shelving tops out at 24 hours, because a shelve with no end is a suppression nobody wrote down.
 
@@ -64,57 +64,13 @@ HotLoop is one codebase shipped as four products, all released together from one
 
 All four are installable today, all 4.18.11. The relay is its own image and chart, about 15 MB against the Gateway's 37, with no database and no UI. The Gateway's fleet management tracks and commands every registered relay, and it's API only (`/api/fleet`): there's no Fleet screen in the UI.
 
-## New in 4.18.11
+## What changed, release by release
 
-:::caution[Read this one before you upgrade a running plant]
-The database engine changed. HotLoop runs on PostgreSQL 17 from this release, and a box with PostgreSQL 16 data moves itself on its next upgrade. It needs about as much free disk as your data takes, the database pod sits in `Init` for as long as the copy lasts, and `helm rollback` to 4.18.10 will not start its database. [Upgrading from 4.18.10](/gateway/upgrading/#upgrading-from-41810) has all of it. The short version: take a backup on 4.18.10 first, and roll forward.
-:::
-
-- **PostgreSQL 17, and the upgrade comes with it.** PostgreSQL won't open another major version's data directory, so a bare image change would have left every existing box with a database that can't start. A script runs before the database, copies your data across with `pg_upgrade`, proves the new server opens it, and only then swaps the names. The old directory stays as `pgdata.pg16`, which is your way back and is yours to delete. Proven on real 4.18.10 data for the Gateway, Edge, and IoT, on the chart and on Quadlet, with every row kept.
-- **[Integrations](/iot/integrations/): point HotLoop at a device you know the address of.** One flow for every kind of device: ask what it needs, look at the real thing with the answers, keep the points you want. Nothing it makes is armed, every tag is read-only, and a setup that fails part way leaves no device behind.
-- **SNMP and BACnet/IP, read-only.** SNMP v1, v2c, and v3 for switches, UPSs, PDUs, and meters, with no default community, because `public` is how a plant's switches get read by whoever asks. BACnet/IP for building controllers and meters. HotLoop never sends a SET and never writes a BACnet property: a write lands on a priority array, and a priority left set holds the equipment where it was put. Proven against a real net-snmp agent and recorded BACnet frames in the lab, not on a physical switch or controller, so treat the first read of a real device as commissioning.
-- **Kiosk sign-in, and a lockout that is on by default.** A panel opened at `/?screen=<name>` asks for one field, a PIN or whatever a keyboard badge reader types, and every write through the gate is that person's, so the audit trail says who opened the valve instead of "panel-3". Left alone for 15 minutes it signs out. The thing to know: ten wrong passwords or PINs in a row now lock that one account for 5 minutes on every install, kiosk or not, and a script that retries a wrong password will start getting `429`. `HOTLOOP_AUTH_LOCKOUT_ATTEMPTS=0` turns it off.
-- **Alarm escalation.** An alarm nobody acknowledges goes to the next person. An admin writes the policy: who, after how many minutes, and a repeat. An acknowledgement from anywhere stops it, and every step is a row in the alarm's own trail. It is off until you turn it on. A page to a phone on a nightstand used to be the end of it.
-- **The UI installs on a phone and opens with no connection.** It keeps the page and the last answers a person looks at, a bar says what time they are as of, and every write is refused before it leaves the page. It only runs over https or `localhost`.
-- **Smaller fixes you can notice.** The live feed closes when its session does. Every time history returns is in UTC, so a trend no longer spells `-04:00` on one plant and `Z` on another. A reconnecting edge node announces itself once, where a millisecond-apart second birth could make a host see a stopped node come back.
-
-## New in 4.18.10
-
-:::note[Not in 4.17.0]
-Everything in this section shipped in 4.18.10. A 4.17.0 Gateway has none of it, so don't go looking for it there. [Upgrade](/gateway/upgrading/) first.
-:::
-
-:::caution[There is no 4.18.0 to 4.18.9]
-I tagged all ten, and none of them published a complete release. Nine published nothing. 4.18.8 passed every test and then I cancelled its run by mistake while it was publishing, so it left Gateway, Edge Relay, IoT, and Edge images on ghcr.io with no chart and no release, and the Gateway, Edge Relay, and IoT ones moved `:stable` with them. 4.18.10 replaced it, so a box that follows `:stable` may have run 4.18.8 until it updated.
-:::
-
-- **[Four products, one tag](/products/).** IoT and Edge are new on ghcr.io and in the chart repository, and the Gateway keeps its names. A product is a build, not a setting: the OPC UA server isn't switched off in the IoT image, it isn't in it. A route for a feature the product doesn't have answers `404` and names the product that does.
-- **The database is a setting.** `HOTLOOP_DB_TYPE=sqlite` runs any product on a file, with no second container. In the chart it's `database.type`, and a product offers only what it runs on. Moving between databases is a backup and a restore. [Install](/gateway/install/) has it.
-- **[MQTT discovery](/iot/mqtt-discovery/) and [network discovery](/iot/network-discovery/).** Point ESPHome, Zigbee2MQTT, Tasmota, or a Shelly at the broker and it shows up, reading. It can't command anything until an admin accepts it and arms each point by hand. Network discovery listens and sends nothing unless you list a network to probe.
-- **[Historian targets](/iot/historian-targets/).** Every reading HotLoop keeps also goes to the plant's own PostgreSQL, TimescaleDB, SQL Server, InfluxDB, or MySQL and MariaDB, the same rows with the same quality. A target that's down slows nothing down.
-- **Boxes follow `:stable` and roll a bad release back.** Podman Quadlet units for the Gateway, Edge, and IoT are new, and [the auto-update page](/install/auto-update/) says what an update does. That only works because migrations only add, and an app refuses to start on a schema two releases ahead of it.
-- **[Edge publish](/edge/edge-publish/) survives the ugly cases.** A boot during an outage, a link that dies without a reset, and a replay that has to outrun the plant. The outage queue is capped at 64 MiB by default now.
-- **The Edge Relay takes a pushed config live,** with no restart and no lost Sparkplug session, discovers devices on a broker like the Gateway does, and reports its version and image digest in every birth, so the Gateway's fleet list shows what each one runs.
-- **Broker logins with rules.** A login made in Settings, MQTT carries publish and subscribe rules from a profile, checked on every publish, subscription, and outgoing message.
-- **[The sun](/iot/sun/).** Sunrise, sunset, and the sun's height worked out on the box from a latitude and a longitude.
-- **UniFi on a wall board and a phone,** and two more MCP tools, `get_network_topology` and `get_network_events`.
-- **Every image carries every third-party license,** and a GPL, AGPL, or LGPL module, or one with no license, stops the build.
-
-## New in 4.17.0
-
-:::note[Not in 4.16.0]
-Everything in this section shipped in 4.17.0. A 4.16.0 Gateway has none of it, so don't go looking for it there. [Upgrade](/gateway/upgrading/) first.
-:::
+Each release has its own notes, and the notes are where the detail lives, so it is in one place and not two.
 
-- **[Recipes](/iot/recipes/).** Grade A's zone temps, line speed, and die gap go out together or not at all: checked whole, refused whole, written in order through the gate, and read back from the device. The laminated sheet of numbers taped to the HMI can finally retire.
-- **[Scripts](/iot/scripts/).** Write the CIP cycle once, name it, and run it the same way from the Scripts screen, a rule, MCP, or its own entity. Paste it into four rules instead, and one day somebody fixes a step in three of them.
-- **[Blueprints](/iot/blueprints/).** A rule written once with typed blanks, filled in per pump. Each rule keeps the blueprint version it was made from until a person reviews the upgrade, so Wednesday's edit to the blueprint doesn't change what pump 7 does on Thursday.
-- **[Helpers](/iot/helpers/).** The values your people own and no PLC keeps: the batch target, which shift is on, the purge timer. Seven kinds, kept across restarts, and a value outside its range is refused, never clamped.
-- **[Logbook](/iot/logbook/).** State changes, writes, alarms, rule runs, and config changes on one timeline, for the whole plant, one branch of the tree, one entity, or one actor. "What happened right before it broke" stops being a tour of five screens.
-- **[The automation language](/iot/automations/).** Condition, wait, and stop steps inside a sequence, and `forSec` on a state trigger, so "the press has run for ten minutes" is a trigger instead of a delay and a prayer.
-- **[UniFi Network, read-only](/iot/unifi/).** Switches, ports, PoE, WAN links, and clients as ordinary tags. When a PLC goes quiet, its drawer says which switch port it's on and whether that link is up, and a stranger on a network you marked OT raises an alarm. Nothing writes to a console. Its first real read of our own Cloud Gateway got fooled: it called the 5G backup up when it had been dead for two days, because it trusted the WAN block's stale `up` the same way the console's summary did. The health checks knew, and the driver reads those now. A real cable pull and a phone joining SCADA haven't been done on real gear yet, and the page says so.
-- **Device passwords encrypted at rest.** A database dump or a backup holds ciphertext, with the key in a Secret the chart generates (`<release>-secret-key`) and keeps. Coming from 4.16.0, the first start seals every stored password, and from then on that Secret is part of your data: back it up somewhere other than next to your backups, because a restore with credentials needs it. [Device credentials](/iot/protocols/#device-credentials) has the rules.
-- **[MCP goes from 16 tools to 25](/iot/mcp/).** Nine more, for the logbook, scripts, recipes, blueprints, and the network. Every one that can move anything still demands a stated reason and still goes through the same gate as an operator.
+- [4.18.11](/releases/hotloop-4-18-11/): PostgreSQL 17 with an upgrade that runs itself (read this one before you upgrade a running plant), SNMP and BACnet/IP through one integrations flow, kiosk sign-in with a lockout, alarm escalation, and a UI that installs on a phone.
+- [4.18.10](/releases/hotloop-4-18-10/): the four-product lineup, a choice of database, MQTT and network discovery, historian targets, and boxes that update themselves. There is no 4.18.0 to 4.18.9, and the notes say why.
+- [4.17.0](/releases/hotloop-4-17-0/): recipes, scripts, blueprints, helpers, the logbook, and UniFi Network, read-only.
 
 ## License
 

src/content/docs/gateway/upgrading.md

@@ -15,7 +15,7 @@ The chart repository's index lists only the latest chart, 4.18.11, so `hotloop/h
 
 ## Upgrading from 4.18.10
 
-Why bother: the database is PostgreSQL 17 now, and the box moves itself. You also get [integrations](/iot/integrations/) with SNMP and BACnet/IP, kiosk sign-in, alarm escalation, and a UI that installs on a phone. [The Gateway overview](/gateway/overview/#new-in-41811) has the list. What follows is the part that bites.
+Why bother: the database is PostgreSQL 17 now, and the box moves itself. You also get [integrations](/iot/integrations/) with SNMP and BACnet/IP, kiosk sign-in, alarm escalation, and a UI that installs on a phone. [The 4.18.11 release notes](/releases/hotloop-4-18-11/) have the list. What follows is the part that bites.
 
 PostgreSQL will not open another major version's data directory, so a bare image change would have left every existing box with a database that can't start. HotLoop doesn't ask you to dump and reload. The first start after the upgrade runs a script before the database, and the script does the move.
 
@@ -59,7 +59,7 @@ Copy the new `hotloop-db.container`, `hotloop-db-upgrade.container`, and `hotloo
 
 ## Upgrading from 4.17.0
 
-Why bother: the Gateway stops being the only image. IoT and Edge are new, the database is a setting, devices that announce themselves over MQTT show up on their own, history can be written out to the plant's own database, and a box that follows `:stable` rolls a bad update back by itself. That last one only works because migrations only add. [The Gateway overview](/gateway/overview/#new-in-41810) has the list.
+Why bother: the Gateway stops being the only image. IoT and Edge are new, the database is a setting, devices that announce themselves over MQTT show up on their own, history can be written out to the plant's own database, and a box that follows `:stable` rolls a bad update back by itself. That last one only works because migrations only add. [The 4.18.10 release notes](/releases/hotloop-4-18-10/) have the list.
 
 It's a plain `helm upgrade`. I rendered the 4.17.0 and 4.18.11 Gateway charts side by side with the same values: the same eight objects, the same selectors, the same volume claims.