v0.2.6.7 — GATE-006 D, version row OSV check

- evaluateSupplyChainHold checks version row osv_status for target
  version, closing hole where we OSV-check one version but install
  another.
- confirm_dependencies uses TransitionByPackageFrom with source-state
  guard (StatusInstalling → Installed/Failed).
- Clears pinned version on successful install.
- Version bump to v0.2.6.7.

README.md

@@ -2,10 +2,12 @@
 
 **Self-hosted update management for operators who own their stack.**
 
-`v0.2.3.1` — June 2026 · MIT License
+`v0.2.6.6` — June 2026 · MIT License
 
-> **You're early — nearly 600 of you cloned this before it was announced.**
+> **You're early — over 1,000 of you cloned this before it was announced.**
 > A stable release is coming soon, bringing Windows support back fully gated.
+> I'll be pinning a release version this week to mark the start of stabilization —
+> focused on hardening what's here rather than shipping new features.
 > If you want it to keep existing, [sponsor the work](#sponsorship--consulting).
 
 ---
@@ -152,20 +154,27 @@ Before a package is installed: the agent fetches the expected SHA-256 from the s
 - Linux and Windows agent registration and update management
 - APT, DNF, Winget, Windows Update, Docker image scanning
 - Package state machine with enforced transitions and lifecycle orchestrator
+- Failed state recovery: reopen, resolve, and transition out of failed
+- Lifecycle history with status badges, version transitions, and failure reasons
+- Scan-set closure reconciler (close-by-absence) — fixes out-of-band false positives
 - Dry-run dependency checking with full closure resolution
 - Supply chain gate: OSV batch checks across transitive closures, vuln-is-a-full-stop enforcement, audited override path
+- Version soak-gating and package age gate as configurable policies
+- Capability-token minting for dnf/apt with Ed25519-signed token verification
 - Ed25519 key rotation and replay protection
 - Maintenance windows
 - Upstream version tracking (GitHub, Gitea, GitLab, Bitbucket, Repology, endoflife.date)
+- Metadata pipeline: CVE details, upstream intelligence, package provenance
+- Auto-discovery bridge (Repology, container registry, exact match)
 - Agent self-update via privileged helper (zero agent sudo)
+- Reversible token encryption with one-liner restore
 - Real-time heartbeat and rapid polling
 
 **Not yet done:**
-- Live end-to-end gate test (GATE-002)
-- Windows installer stubs report fake success (CRITICAL-004)
 - No AUR, Snap, Flatpak, or Homebrew support
 - macOS agent binaries not signed
 - Mobile dashboard usable, not optimized
+- Cert pinning and enforced TLS verification
 
 ---
 
@@ -247,17 +256,25 @@ I am a Systems Architect with 25 years on the frontier. I build sovereign agent
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history. Recent highlights:
 
-**v0.2.3.1** — Supply chain gate hardened: vuln in the dependency closure is a full stop at approval. Audited operator override path. Ack tracking fixed (no more 34-deep recycling).
+**v0.2.6.6** — Windows agent service logging treats `agent.log` as the primary sink, even when service console handles are unavailable.
 
-**v0.2.3.0** — OSV batch checks across full dependency closures. DNF dry-run detection fix. Auto-confirm frisks the whole closure.
+**v0.2.6.5** — Windows agent service logs now write to `C:\ProgramData\RedFlag\logs\agent.log`.
 
-**v0.2.2.0** — Package state machine enforced. Lifecycle orchestrator foundation. Vulnerability dashboard.
+**v0.2.6.4** — Windows installer fixes: CRLF, reachable host, port preservation, Ed25519 cold-start tolerance.
 
-**v0.2.1.1** — Zero-sudo agent. Helper self-upgrade. OSV expansion to apt/dnf. Staging page.
+**v0.2.6.2** — OSV scans moved to detection. Soak gate promoted to real policy. Dead scaffolding retired.
 
-**v0.2.1.0** — Token-is-the-command. Helper privilege split. DiscoveryRunner. Installer interface shrunk to 4 methods.
+**v0.2.6.0** — Metadata pipeline, auto-discovery bridge, Docker enrichment, filter/search primitives.
 
-**v0.2.0.7** — Refresh-token rotation. Machine-bound renewal. No unsigned binaries.
+**v0.2.5.1** — Failed state recovery, lifecycle history, reopen/resolve endpoints.
+
+**v0.2.5.2** — Reversible token encryption. Idempotent heartbeat auto-queue.
+
+**v0.2.3.5** — Unified agent+helper upgrade. Path traversal fixes. Self-update on fresh hosts.
+
+**v0.2.3.1** — Supply chain gate hardened: vuln is a full stop. Ack tracking fixed.
+
+**v0.2.2.0** — Package state machine enforced. Lifecycle orchestrator foundation.
 
 ---