patrickryan01 · Nov 8, 2026 · Nov 8, 2026 · Nov 8, 2026
diff --git a/scripts/sync-manifest.mjs b/scripts/sync-manifest.mjs
@@ -153,7 +153,8 @@ export const PAGES = [
 
 // Release notes are every file in docs/releases, found on the ref, not listed here.
 export const RELEASE_NOTES = [
-  { repo: 'hotloop', dir: 'docs/releases', slugPrefix: 'releases/hotloop-', label: 'HotLoop core' },
+  // 4.19.6 and 4.19.7 were tagged and never published (4.19.8's notes say why and carry both), so they get no page. A note for a release that does not exist is a claim that it does.
+  { repo: 'hotloop', dir: 'docs/releases', slugPrefix: 'releases/hotloop-', label: 'HotLoop core', skip: ['4.19.6', '4.19.7'] },
   { repo: 'flow', dir: 'docs/releases', slugPrefix: 'releases/flow-', label: 'HotLoop Flow' },
   // 0.1.0 was tagged and never published anything, so it gets no page. A note for a release that does not exist is a claim that it does.
   { repo: 'cascade', dir: 'docs/release-notes', slugPrefix: 'releases/cascade-', label: 'HotLoop Cascade', skip: ['0.1.0'] },

diff --git a/src/content/docs/edge-relay/install.md b/src/content/docs/edge-relay/install.md
@@ -1,7 +1,7 @@
 ---
 # generated by scripts/sync-docs.mjs
 title: "Install the Edge Relay with Helm or Quadlet"
-description: "Run HotLoop Edge Relay 4.18.11 on a cluster with Helm, or on a Pi or industrial PC as a systemd service with Podman Quadlet. The unit files are here in full."
+description: "Run HotLoop Edge Relay 4.19.8 on a cluster with Helm, or on a Pi or industrial PC as a systemd service with Podman Quadlet. The unit files are here in full."
 sidebar:
   label: "Install"
 editUrl: false
@@ -57,7 +57,7 @@ A device's `config` block can hold credentials, like an OPC UA `username` and `p
 helm repo add hotloop https://hotloop.io/hotloop
 helm repo update
 helm install press-line-3 hotloop/hotloop-edge-relay \
-  --version 4.18.11 --namespace hotloop --create-namespace \
+  --version 4.19.8 --namespace hotloop --create-namespace \
   --set edgePublish.broker=tcp://gateway.plant.local:1883 \
   --set edgePublish.group=Plant1 \
   --set edgePublish.node=press-line-3 \
@@ -90,7 +90,7 @@ Those end up in a ConfigMap and in the Helm release record, and anybody who can
 
 ```bash
 kubectl -n hotloop create secret generic press-devices --from-file=devices.json
-helm upgrade press-line-3 hotloop/hotloop-edge-relay --version 4.18.11 \
+helm upgrade press-line-3 hotloop/hotloop-edge-relay --version 4.19.8 \
   --reset-then-reuse-values --set devicesSecret=press-devices
 ```
 

diff --git a/src/content/docs/edge-relay/overview.md b/src/content/docs/edge-relay/overview.md
@@ -9,7 +9,7 @@ editUrl: false
 
 The Edge Relay is the headless one. It sits on a Pi or a small industrial PC next to the machines, polls them with the same drivers the Gateway uses, and forwards every reading over Sparkplug B to a Gateway somewhere with a real database. When the uplink dies it queues to disk and replays when the link comes back, so the historian upstream ends up with the outage backfilled, not a hole in it. No database, no web UI, no users, no write path, and every one of those missing pieces is something that can't break at 3 AM.
 
-The current release is 4.18.11: `ghcr.io/hotloop-io/hotloop-edge-relay:4.18.11` for amd64, arm64, and arm/v7 (a Pi 3 or a 32-bit Pi OS install is exactly the box a relay ends up on), about 15 MB, pulled with no login, and the `hotloop-edge-relay` chart from `https://hotloop.io/hotloop`. 4.16.0 was the first release that published it, and arm/v7 came with 4.18.10. It shares a version number with the Gateway, and a release refuses to go out unless both charts carry the tag's version and the Quadlet unit follows `:stable`. So the relay gets a new version every release whether its code changed or not. One version number to ask about, and a relay chart can never point at an image nobody pushed. [Install it](/edge-relay/install/).
+The current release is 4.19.8: `ghcr.io/hotloop-io/hotloop-edge-relay:4.19.8` built for amd64 alone this time (a Pi 3 or a 32-bit Pi OS install is exactly the box a relay ends up on, and its arm64 and arm/v7 images on `:stable` are 4.19.5's, the last build of every architecture, until the next release builds them all again), about 15 MB, pulled with no login, and the `hotloop-edge-relay` chart from `https://hotloop.io/hotloop`. 4.16.0 was the first release that published it, and arm/v7 came with 4.18.10. It shares a version number with the Gateway, and a release refuses to go out unless both charts carry the tag's version and the Quadlet unit follows `:stable`. So the relay gets a new version every release whether its code changed or not. One version number to ask about, and a relay chart can never point at an image nobody pushed. [Install it](/edge-relay/install/).
 
 :::note[New in 4.18.10]
 **A pushed device file applies the moment it lands.** New devices connect, removed ones let go, changed ones reconnect, and the ones nobody touched keep their sessions. The Sparkplug session stays up, with no NDEATH and the same `bdSeq`. A bad file is refused and the old one keeps running, and `/status` says which file is running and which was refused. On 4.17.0 a push only staged the file until something restarted the relay.

diff --git a/src/content/docs/edge/install.md b/src/content/docs/edge/install.md
@@ -1,13 +1,13 @@
 ---
 # generated by scripts/sync-docs.mjs
-title: "Install HotLoop Edge 4.18.11"
-description: "Install HotLoop Edge 4.18.11 on k3s with Helm or on an industrial PC with Podman Quadlet, then turn on the OPC UA server and Sparkplug publishing."
+title: "Install HotLoop Edge 4.19.8"
+description: "Install HotLoop Edge 4.19.8 on k3s with Helm or on an industrial PC with Podman Quadlet, then turn on the OPC UA server and Sparkplug publishing."
 sidebar:
   label: "Install"
 editUrl: false
 ---
 
-HotLoop Edge first shipped in 4.18.10. The image is `ghcr.io/hotloop-io/hotloop-edge:4.18.11`, built for amd64, arm64, and arm/v7, and the chart is `hotloop-edge` in the same Helm repository as the rest of the lineup. Both pull with no login. There is no Docker or Compose path, on purpose, and a bare `podman run` from a shell that dies with the session isn't an install.
+HotLoop Edge first shipped in 4.18.10. The image is `ghcr.io/hotloop-io/hotloop-edge:4.19.8`, built for amd64 alone this release (the arm64 and arm/v7 images on `:stable` are 4.19.5's, the last build of every architecture, and the next release builds them all again), and the chart is `hotloop-edge` in the same Helm repository as the rest of the lineup. Both pull with no login. There is no Docker or Compose path, on purpose, and a bare `podman run` from a shell that dies with the session isn't an install.
 
 A cluster gets Helm. An industrial PC or a Pi with no cluster gets Podman Quadlet. The database is a choice you make once: TimescaleDB (the default), plain PostgreSQL or a SQLite file with no database container at all.
 
@@ -16,7 +16,7 @@ A cluster gets Helm. An industrial PC or a Pi with no cluster gets Podman Quadle
 ```bash
 helm repo add hotloop https://hotloop.io/hotloop
 helm repo update
-helm install hotloop hotloop/hotloop-edge --version 4.18.11 \
+helm install hotloop hotloop/hotloop-edge --version 4.19.8 \
   --namespace hotloop --create-namespace
 ```
 

diff --git a/src/content/docs/edge/overview.md b/src/content/docs/edge/overview.md
@@ -8,7 +8,7 @@ editUrl: false
 ---
 
 :::note[Edge is out, first released in 4.18.10]
-The image is `ghcr.io/hotloop-io/hotloop-edge:4.18.11` for amd64, arm64, and arm/v7, about 37 MB on amd64 and 34 MB on arm, and the chart is `hotloop-edge` from `https://hotloop.io/hotloop`. Both pull with no login, and the source repo is still private. The Quadlet units are the `edge/` directory of [Podman Quadlet](/install/quadlet/). [Install it](/edge/install/). Before 4.18.10 the Gateway could run at the edge and publish Sparkplug upstream, and it has since 4.5.0, but it was the whole Gateway to do it.
+The image is `ghcr.io/hotloop-io/hotloop-edge:4.19.8` built for amd64 alone this time (the arm64 and arm/v7 images on `:stable` are 4.19.5's, the last build of every architecture, and the next release builds them all again), about 37 MB on amd64 and 34 MB on arm, and the chart is `hotloop-edge` from `https://hotloop.io/hotloop`. Both pull with no login, and the source repo is still private. The Quadlet units are the `edge/` directory of [Podman Quadlet](/install/quadlet/). [Install it](/edge/install/). Before 4.18.10 the Gateway could run at the edge and publish Sparkplug upstream, and it has since 4.5.0, but it was the whole Gateway to do it.
 :::
 
 Edge is a box bolted next to a line. It reads the machine, runs the rules on the machine, keeps working when the WAN goes down, and tells the rest of the plant what it saw. Think Ignition Edge, built in Go, with the same write gate as everything else.

diff --git a/src/content/docs/gateway/install.md b/src/content/docs/gateway/install.md
@@ -1,13 +1,13 @@
 ---
 # generated by scripts/sync-docs.mjs
-title: "Install HotLoop Gateway 4.18.11 with Helm"
-description: "Install HotLoop Gateway 4.18.11 from the published Helm chart on k3s or any Kubernetes, sign in, and set what matters before a real plant sees it."
+title: "Install HotLoop Gateway 4.19.8 with Helm"
+description: "Install HotLoop Gateway 4.19.8 from the published Helm chart on k3s or any Kubernetes, sign in, and set what matters before a real plant sees it."
 sidebar:
   label: "Install"
 editUrl: false
 ---
 
-HotLoop Gateway 4.18.11 ships as a container image for amd64 and arm64, about 37 MB on amd64 and 35 MB on arm64, and a Helm chart. Both pull with no login. It keeps the names it shipped under through 4.17.0, image `ghcr.io/hotloop-io/hotloop` and chart `hotloop`, so nobody running it has to change a thing. Already running an older release? Don't install over it. [Upgrading](/gateway/upgrading/) has the path from 4.17.0, which is a plain `helm upgrade`, and the paths from 4.16.0 and 4.3.1, which go in hops.
+HotLoop Gateway 4.19.8 ships as a container image for amd64 (the arm64 image on `:stable` is 4.19.5's, the last build of every architecture, and the next release builds both again), about 37 MB on amd64 and 35 MB on arm64, and a Helm chart. Both pull with no login. It keeps the names it shipped under through 4.17.0, image `ghcr.io/hotloop-io/hotloop` and chart `hotloop`, so nobody running it has to change a thing. Already running an older release? Don't install over it. [Upgrading](/gateway/upgrading/) has the path from 4.17.0, which is a plain `helm upgrade`, and the paths from 4.16.0 and 4.3.1, which go in hops.
 
 Two ways to run it for real: the Helm chart on any Kubernetes, k3s included, and Podman Quadlet on a box that isn't in a cluster, below. There's no Docker or Compose path, on purpose, and a bare `podman run` from a shell that dies with the session isn't an install.
 
@@ -16,7 +16,7 @@ Two ways to run it for real: the Helm chart on any Kubernetes, k3s included, and
 ```bash
 helm repo add hotloop https://hotloop.io/hotloop
 helm repo update
-helm install hotloop hotloop/hotloop --version 4.18.11 \
+helm install hotloop hotloop/hotloop --version 4.19.8 \
   --namespace hotloop --create-namespace
 ```
 
@@ -58,7 +58,7 @@ Put these in a values file and install with `-f`. Don't lean on `--set` for anyt
 | `global.timezone` | `America/New_York` | Schedules, reports and shift changes run on it. It has to be a real zone name (`America/Chicago`, not `CST`), because a timezone that won't load stops startup instead of quietly running on UTC. |
 | `publicUrl` | empty | The address a phone on the plant Wi-Fi reaches HotLoop at. Without it, notifications have no link back and ntfy gets no Acknowledge button. |
 | `safety.allowWrites` | `false` | The master switch. Off, nothing writes to a machine, from anywhere. Turn it on once the deployment has been reviewed. |
-| `safety.allowMcpWrites` | `false` | Lets agents write through the same gate. It narrows the master switch and never goes around it. Set it without `safety.allowWrites` and the Gateway refuses to start. |
+| `safety.allowMcpWrites` | `true` | Lets agents write through the same gate, on since 4.19.4. It follows the master switch: with `safety.allowWrites` off, nothing writes, agents included. Set it `false` and agents can still read the whole plant and never write. The charts always set an MCP token, so `/mcp` is never open. |
 | `database.postgresql.persistence.size` | `20Gi` | Your history lives here. Size it for your tag count and `historian.retentionDays` (90). |
 | `logbook.retentionDays` | `90` | Days of entity state changes the [logbook](/iot/logbook/) keeps. `0` keeps everything until the volume fills, and the Gateway warns you about it at start. |
 | `secretKey.existingSecret` | empty | A Secret you manage holding the device password key. Leave it empty and the chart makes one. Set it if you render the chart with `helm template`. |

diff --git a/src/content/docs/gateway/overview.md b/src/content/docs/gateway/overview.md
@@ -7,8 +7,8 @@ sidebar:
 editUrl: false
 ---
 
-:::note[4.18.11 is out]
-The release where HotLoop stops being one image. [IoT](/iot/overview/), [Edge](/edge/overview/), the Gateway and the [Edge Relay](/edge-relay/overview/) all ship from this tag, each with its own image and chart. The Gateway keeps `ghcr.io/hotloop-io/hotloop:4.18.11` and the chart `hotloop` from `https://hotloop.io/hotloop`, and both pull with no login. The source repo is still private. [Install it](/gateway/install/). On 4.17.0? It's a plain `helm upgrade`, but not with `--reuse-values`, and a couple of defaults moved. On 4.16.0 or 4.3.1? You go through 4.17.0 first. Either way, [read the upgrade first](/gateway/upgrading/). You want to find this out here, not from a stuck rollout.
+:::note[4.19.8 is out]
+Four products from one tag: [IoT](/iot/overview/), [Edge](/edge/overview/), the Gateway and the [Edge Relay](/edge-relay/overview/), each with its own image and chart. This build is amd64 only, and the arm images on `:stable` are 4.19.5's until the next release builds every architecture. The Gateway keeps `ghcr.io/hotloop-io/hotloop:4.19.8` and the chart `hotloop` from `https://hotloop.io/hotloop`, and both pull with no login. The source repo is still private. [Install it](/gateway/install/). On 4.18.11? It's a `helm upgrade`, and agents can write after it, so read the two things that change. On 4.17.0? It's a plain `helm upgrade`, but not with `--reuse-values`, and a couple of defaults moved. On 4.16.0 or 4.3.1? You go through 4.17.0 first. Either way, [read the upgrade first](/gateway/upgrading/). You want to find this out here, not from a stuck rollout.
 :::
 
 HotLoop Gateway reads your plant. It polls PLCs and servers in their own protocols, keeps every reading and its quality in a historian, raises ISA-18.2 alarms that can page a phone, runs automations against all of it, and hands the whole plant to agents over MCP. A site runs one chart, the Gateway and its database, instead of a historian, an alarm server, a rules engine, and a pile of glue, each one breaking on its own damn schedule.
@@ -19,7 +19,7 @@ It's written in Go, from scratch: one static binary on a distroless base, no sid
 
 ## Where to start
 
-The ground floor, in 4.18.11 and in every release back to 4.16.0:
+The ground floor, in 4.19.8 and in every release back to 4.16.0:
 
 - [Install](/gateway/install/) is Helm from the published chart or Podman Quadlet on a box, the key to back up, and the handful of values to set before a real plant sees it.
 - [Upgrading](/gateway/upgrading/) is the procedure that keeps your data, from 4.17.0, 4.16.0, or 4.3.1, and every API change a script will trip over.
@@ -28,6 +28,8 @@ The ground floor, in 4.18.11 and in every release back to 4.16.0:
 - [Automations](/iot/automations/) covers triggers, conditions, and actions, and why a rule is compiled when you save it instead of when it fires at 3 AM.
 - [Model Context Protocol](/iot/mcp/) is the Gateway as an MCP server and client, and how one Gateway reads every site.
 
+New in 4.19.4, and not in 4.18.11: agents write through the same gate as the screen (MCP is on in every product, and the endpoint always has a token), a value written to a scaled tag lands in the register the way you meant it, a CODESYS runtime is read by the names in its Symbol Configuration, a Kafka event stream joins the historian targets, OPC UA PubSub over UADP subscribes and publishes, and `hostNetwork` is a chart setting. 4.19.5 is its multi-arch build, and 4.19.8 adds a Logbook fix and tag pickers that search the whole plant. [The release notes](/releases/hotloop-4-19-4/) say what each one buys you, and what it costs.
+
 New in 4.18.11, and not in 4.18.10: the database is PostgreSQL 17 with an upgrade that runs itself, SNMP and BACnet/IP through one integrations flow, kiosk sign-in with a lockout, alarm escalation, and a UI that installs on a phone. [The release notes](/releases/hotloop-4-18-11/) say what each one buys you, and what it costs.
 
 New in 4.18.10, and not in 4.17.0: the four-product lineup, a choice of database, MQTT, and network discovery, historian targets, and boxes that update themselves. [The release notes](/releases/hotloop-4-18-10/) say what each one buys you.
@@ -62,12 +64,15 @@ New in 4.17.0, and not in 4.16.0:
 
 HotLoop is one codebase shipped as four products, all released together from one tag: IoT, Edge, the Gateway, and the Edge Relay. The Gateway is the top of it: everything in IoT and Edge, plus fleet management, multi-site roll-ups, and scheduled reports. Features split the products. Protocols never will: every product speaks every protocol we have, so nobody has to buy up a tier to read the PLC on their bench. [The lineup](/products/) has what each one carries.
 
-All four are installable today, all 4.18.11. The relay is its own image and chart, about 15 MB against the Gateway's 37, with no database and no UI. The Gateway's fleet management tracks and commands every registered relay, and it's API only (`/api/fleet`): there's no Fleet screen in the UI.
+All four are installable today, all 4.19.8. The relay is its own image and chart, about 15 MB against the Gateway's 37, with no database and no UI. The Gateway's fleet management tracks and commands every registered relay, and it's API only (`/api/fleet`): there's no Fleet screen in the UI.
 
 ## What changed, release by release
 
 Each release has its own notes, and the notes are where the detail lives, so it is in one place and not two.
 
+- [4.19.8](/releases/hotloop-4-19-8/): the Logbook's Older entries button keeps its page, and every tag picker searches the whole plant. It carries 4.19.6's and 4.19.7's changes too, because neither was published.
+- [4.19.5](/releases/hotloop-4-19-5/): the multi-arch build of 4.19.4, with nothing else in it.
+- [4.19.4](/releases/hotloop-4-19-4/): agent writes and a token on every MCP endpoint, scaled writes that land right, CODESYS by symbol name, a Kafka event stream, OPC UA PubSub over UADP, and `hostNetwork`. There is no 4.19.0 to 4.19.3, and the notes say why.
 - [4.18.11](/releases/hotloop-4-18-11/): PostgreSQL 17 with an upgrade that runs itself (read this one before you upgrade a running plant), SNMP and BACnet/IP through one integrations flow, kiosk sign-in with a lockout, alarm escalation, and a UI that installs on a phone.
 - [4.18.10](/releases/hotloop-4-18-10/): the four-product lineup, a choice of database, MQTT and network discovery, historian targets, and boxes that update themselves. There is no 4.18.0 to 4.18.9, and the notes say why.
 - [4.17.0](/releases/hotloop-4-17-0/): recipes, scripts, blueprints, helpers, the logbook, and UniFi Network, read-only.

diff --git a/src/content/docs/gateway/reports.md b/src/content/docs/gateway/reports.md
@@ -5,10 +5,6 @@ description: "Historian numbers on a schedule as CSV or HTML, stored and emailed
 editUrl: false
 ---
 
-:::note[Written against main]
-This page follows `main` at 4d5da2f, and it differs from the copy in HotLoop core 4.18.11, the latest release. Parts of it may be newer than what you have installed. The [release notes](/releases/) say what moved.
-:::
-
 Added in 4.14.0. `internal/reports` runs operator-defined reports on a schedule:
 it queries the historian, renders the result as CSV and HTML, stores it on a
 volume, and optionally emails it. It is the counterpart of Ignition's Reporting